--- /dev/null
+From f45812cc23fb74bef62d4eb8a69fe7218f4b9f2a Mon Sep 17 00:00:00 2001
+From: Tim Schumacher <timschumi@gmx.de>
+Date: Fri, 26 Jan 2024 17:25:23 +0100
+Subject: efivarfs: Request at most 512 bytes for variable names
+
+From: Tim Schumacher <timschumi@gmx.de>
+
+commit f45812cc23fb74bef62d4eb8a69fe7218f4b9f2a upstream.
+
+Work around a quirk in a few old (2011-ish) UEFI implementations, where
+a call to `GetNextVariableName` with a buffer size larger than 512 bytes
+will always return EFI_INVALID_PARAMETER.
+
+There is some lore around EFI variable names being up to 1024 bytes in
+size, but this has no basis in the UEFI specification, and the upper
+bounds are typically platform specific, and apply to the entire variable
+(name plus payload).
+
+Given that Linux does not permit creating files with names longer than
+NAME_MAX (255) bytes, 512 bytes (== 256 UTF-16 characters) is a
+reasonable limit.
+
+Cc: <stable@vger.kernel.org> # 6.1+
+Signed-off-by: Tim Schumacher <timschumi@gmx.de>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/efivarfs/vars.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/fs/efivarfs/vars.c
++++ b/fs/efivarfs/vars.c
+@@ -372,7 +372,7 @@ static void dup_variable_bug(efi_char16_
+ int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *),
+ void *data, bool duplicates, struct list_head *head)
+ {
+- unsigned long variable_name_size = 1024;
++ unsigned long variable_name_size = 512;
+ efi_char16_t *variable_name;
+ efi_status_t status;
+ efi_guid_t vendor_guid;
+@@ -389,12 +389,13 @@ int efivar_init(int (*func)(efi_char16_t
+ goto free;
+
+ /*
+- * Per EFI spec, the maximum storage allocated for both
+- * the variable name and variable data is 1024 bytes.
++ * A small set of old UEFI implementations reject sizes
++ * above a certain threshold, the lowest seen in the wild
++ * is 512.
+ */
+
+ do {
+- variable_name_size = 1024;
++ variable_name_size = 512;
+
+ status = efivar_get_next_variable(&variable_name_size,
+ variable_name,
+@@ -431,9 +432,13 @@ int efivar_init(int (*func)(efi_char16_t
+ break;
+ case EFI_NOT_FOUND:
+ break;
++ case EFI_BUFFER_TOO_SMALL:
++ pr_warn("efivars: Variable name size exceeds maximum (%lu > 512)\n",
++ variable_name_size);
++ status = EFI_NOT_FOUND;
++ break;
+ default:
+- printk(KERN_WARNING "efivars: get_next_variable: status=%lx\n",
+- status);
++ pr_warn("efivars: get_next_variable: status=%lx\n", status);
+ status = EFI_NOT_FOUND;
+ break;
+ }
--- /dev/null
+From aeb004c0cd6958e910123a1607634401009c9539 Mon Sep 17 00:00:00 2001
+From: Nicolin Chen <nicolinc@nvidia.com>
+Date: Thu, 22 Feb 2024 13:23:45 -0800
+Subject: iommufd: Fix iopt_access_list_id overwrite bug
+
+From: Nicolin Chen <nicolinc@nvidia.com>
+
+commit aeb004c0cd6958e910123a1607634401009c9539 upstream.
+
+Syzkaller reported the following WARN_ON:
+ WARNING: CPU: 1 PID: 4738 at drivers/iommu/iommufd/io_pagetable.c:1360
+
+ Call Trace:
+ iommufd_access_change_ioas+0x2fe/0x4e0
+ iommufd_access_destroy_object+0x50/0xb0
+ iommufd_object_remove+0x2a3/0x490
+ iommufd_object_destroy_user
+ iommufd_access_destroy+0x71/0xb0
+ iommufd_test_staccess_release+0x89/0xd0
+ __fput+0x272/0xb50
+ __fput_sync+0x4b/0x60
+ __do_sys_close
+ __se_sys_close
+ __x64_sys_close+0x8b/0x110
+ do_syscall_x64
+
+The mismatch between the access pointer in the list and the passed-in
+pointer is resulting from an overwrite of access->iopt_access_list_id, in
+iopt_add_access(). Called from iommufd_access_change_ioas() when
+xa_alloc() succeeds but iopt_calculate_iova_alignment() fails.
+
+Add a new_id in iopt_add_access() and only update iopt_access_list_id when
+returning successfully.
+
+Cc: stable@vger.kernel.org
+Fixes: 9227da7816dd ("iommufd: Add iommufd_access_change_ioas(_id) helpers")
+Link: https://lore.kernel.org/r/2dda7acb25b8562ec5f1310de828ef5da9ef509c.1708636627.git.nicolinc@nvidia.com
+Reported-by: Jason Gunthorpe <jgg@nvidia.com>
+Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/iommufd/io_pagetable.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/iommu/iommufd/io_pagetable.c
++++ b/drivers/iommu/iommufd/io_pagetable.c
+@@ -1330,20 +1330,23 @@ out_unlock:
+
+ int iopt_add_access(struct io_pagetable *iopt, struct iommufd_access *access)
+ {
++ u32 new_id;
+ int rc;
+
+ down_write(&iopt->domains_rwsem);
+ down_write(&iopt->iova_rwsem);
+- rc = xa_alloc(&iopt->access_list, &access->iopt_access_list_id, access,
+- xa_limit_16b, GFP_KERNEL_ACCOUNT);
++ rc = xa_alloc(&iopt->access_list, &new_id, access, xa_limit_16b,
++ GFP_KERNEL_ACCOUNT);
++
+ if (rc)
+ goto out_unlock;
+
+ rc = iopt_calculate_iova_alignment(iopt);
+ if (rc) {
+- xa_erase(&iopt->access_list, access->iopt_access_list_id);
++ xa_erase(&iopt->access_list, new_id);
+ goto out_unlock;
+ }
++ access->iopt_access_list_id = new_id;
+
+ out_unlock:
+ up_write(&iopt->iova_rwsem);
--- /dev/null
+From cf7c2789822db8b5efa34f5ebcf1621bc0008d48 Mon Sep 17 00:00:00 2001
+From: Nicolin Chen <nicolinc@nvidia.com>
+Date: Thu, 22 Feb 2024 13:23:47 -0800
+Subject: iommufd: Fix protection fault in iommufd_test_syz_conv_iova
+
+From: Nicolin Chen <nicolinc@nvidia.com>
+
+commit cf7c2789822db8b5efa34f5ebcf1621bc0008d48 upstream.
+
+Syzkaller reported the following bug:
+
+ general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN
+ KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7]
+ Call Trace:
+ lock_acquire
+ lock_acquire+0x1ce/0x4f0
+ down_read+0x93/0x4a0
+ iommufd_test_syz_conv_iova+0x56/0x1f0
+ iommufd_test_access_rw.isra.0+0x2ec/0x390
+ iommufd_test+0x1058/0x1e30
+ iommufd_fops_ioctl+0x381/0x510
+ vfs_ioctl
+ __do_sys_ioctl
+ __se_sys_ioctl
+ __x64_sys_ioctl+0x170/0x1e0
+ do_syscall_x64
+ do_syscall_64+0x71/0x140
+
+This is because the new iommufd_access_change_ioas() sets access->ioas to
+NULL during its process, so the lock might be gone in a concurrent racing
+context.
+
+Fix this by doing the same access->ioas sanity as iommufd_access_rw() and
+iommufd_access_pin_pages() functions do.
+
+Cc: stable@vger.kernel.org
+Fixes: 9227da7816dd ("iommufd: Add iommufd_access_change_ioas(_id) helpers")
+Link: https://lore.kernel.org/r/3f1932acaf1dd494d404c04364d73ce8f57f3e5e.1708636627.git.nicolinc@nvidia.com
+Reported-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/iommufd/selftest.c | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+--- a/drivers/iommu/iommufd/selftest.c
++++ b/drivers/iommu/iommufd/selftest.c
+@@ -48,8 +48,8 @@ enum {
+ * In syzkaller mode the 64 bit IOVA is converted into an nth area and offset
+ * value. This has a much smaller randomization space and syzkaller can hit it.
+ */
+-static unsigned long iommufd_test_syz_conv_iova(struct io_pagetable *iopt,
+- u64 *iova)
++static unsigned long __iommufd_test_syz_conv_iova(struct io_pagetable *iopt,
++ u64 *iova)
+ {
+ struct syz_layout {
+ __u32 nth_area;
+@@ -73,6 +73,21 @@ static unsigned long iommufd_test_syz_co
+ return 0;
+ }
+
++static unsigned long iommufd_test_syz_conv_iova(struct iommufd_access *access,
++ u64 *iova)
++{
++ unsigned long ret;
++
++ mutex_lock(&access->ioas_lock);
++ if (!access->ioas) {
++ mutex_unlock(&access->ioas_lock);
++ return 0;
++ }
++ ret = __iommufd_test_syz_conv_iova(&access->ioas->iopt, iova);
++ mutex_unlock(&access->ioas_lock);
++ return ret;
++}
++
+ void iommufd_test_syz_conv_iova_id(struct iommufd_ucmd *ucmd,
+ unsigned int ioas_id, u64 *iova, u32 *flags)
+ {
+@@ -85,7 +100,7 @@ void iommufd_test_syz_conv_iova_id(struc
+ ioas = iommufd_get_ioas(ucmd->ictx, ioas_id);
+ if (IS_ERR(ioas))
+ return;
+- *iova = iommufd_test_syz_conv_iova(&ioas->iopt, iova);
++ *iova = __iommufd_test_syz_conv_iova(&ioas->iopt, iova);
+ iommufd_put_object(ucmd->ictx, &ioas->obj);
+ }
+
+@@ -1045,7 +1060,7 @@ static int iommufd_test_access_pages(str
+ }
+
+ if (flags & MOCK_FLAGS_ACCESS_SYZ)
+- iova = iommufd_test_syz_conv_iova(&staccess->access->ioas->iopt,
++ iova = iommufd_test_syz_conv_iova(staccess->access,
+ &cmd->access_pages.iova);
+
+ npages = (ALIGN(iova + length, PAGE_SIZE) -
+@@ -1147,8 +1162,8 @@ static int iommufd_test_access_rw(struct
+ }
+
+ if (flags & MOCK_FLAGS_ACCESS_SYZ)
+- iova = iommufd_test_syz_conv_iova(&staccess->access->ioas->iopt,
+- &cmd->access_rw.iova);
++ iova = iommufd_test_syz_conv_iova(staccess->access,
++ &cmd->access_rw.iova);
+
+ rc = iommufd_access_rw(staccess->access, iova, tmp, length, flags);
+ if (rc)
--- /dev/null
+From 0ee695a471a750cad4fff22286d91e038b1ef62f Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Thu, 25 Jan 2024 10:32:11 -0700
+Subject: kbuild: Add -Wa,--fatal-warnings to as-instr invocation
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+commit 0ee695a471a750cad4fff22286d91e038b1ef62f upstream.
+
+Certain assembler instruction tests may only induce warnings from the
+assembler on an unsupported instruction or option, which causes as-instr
+to succeed when it was expected to fail. Some tests workaround this
+limitation by additionally testing that invalid input fails as expected.
+However, this is fragile if the assembler is changed to accept the
+invalid input, as it will cause the instruction/option to be unavailable
+like it was unsupported even when it is.
+
+Use '-Wa,--fatal-warnings' in the as-instr macro to turn these warnings
+into hard errors, which avoids this fragility and makes tests more
+robust and well formed.
+
+Cc: stable@vger.kernel.org
+Suggested-by: Eric Biggers <ebiggers@kernel.org>
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Tested-by: Eric Biggers <ebiggers@google.com>
+Tested-by: Andy Chiu <andybnac@gmail.com>
+Reviewed-by: Andy Chiu <andybnac@gmail.com>
+Tested-by: Conor Dooley <conor.dooley@microchip.com>
+Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
+Acked-by: Masahiro Yamada <masahiroy@kernel.org>
+Link: https://lore.kernel.org/r/20240125-fix-riscv-option-arch-llvm-18-v1-1-390ac9cc3cd0@kernel.org
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ scripts/Kconfig.include | 2 +-
+ scripts/Makefile.compiler | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/scripts/Kconfig.include
++++ b/scripts/Kconfig.include
+@@ -33,7 +33,7 @@ ld-option = $(success,$(LD) -v $(1))
+
+ # $(as-instr,<instr>)
+ # Return y if the assembler supports <instr>, n otherwise
+-as-instr = $(success,printf "%b\n" "$(1)" | $(CC) $(CLANG_FLAGS) -c -x assembler-with-cpp -o /dev/null -)
++as-instr = $(success,printf "%b\n" "$(1)" | $(CC) $(CLANG_FLAGS) -Wa$(comma)--fatal-warnings -c -x assembler-with-cpp -o /dev/null -)
+
+ # check if $(CC) and $(LD) exist
+ $(error-if,$(failure,command -v $(CC)),C compiler '$(CC)' not found)
+--- a/scripts/Makefile.compiler
++++ b/scripts/Makefile.compiler
+@@ -38,7 +38,7 @@ as-option = $(call try-run,\
+ # Usage: aflags-y += $(call as-instr,instr,option1,option2)
+
+ as-instr = $(call try-run,\
+- printf "%b\n" "$(1)" | $(CC) -Werror $(CLANG_FLAGS) $(KBUILD_AFLAGS) -c -x assembler-with-cpp -o "$$TMP" -,$(2),$(3))
++ printf "%b\n" "$(1)" | $(CC) -Werror $(CLANG_FLAGS) $(KBUILD_AFLAGS) -Wa$(comma)--fatal-warnings -c -x assembler-with-cpp -o "$$TMP" -,$(2),$(3))
+
+ # __cc-option
+ # Usage: MY_CFLAGS += $(call __cc-option,$(CC),$(MY_CFLAGS),-march=winchip-c6,-march=i586)
--- /dev/null
+From eb5555d422d0fc325e1574a7353d3c616f82d8b5 Mon Sep 17 00:00:00 2001
+From: Cristian Marussi <cristian.marussi@arm.com>
+Date: Thu, 25 Jan 2024 19:17:56 +0000
+Subject: pmdomain: arm: Fix NULL dereference on scmi_perf_domain removal
+
+From: Cristian Marussi <cristian.marussi@arm.com>
+
+commit eb5555d422d0fc325e1574a7353d3c616f82d8b5 upstream.
+
+On unloading of the scmi_perf_domain module got the below splat, when in
+the DT provided to the system under test the '#power-domain-cells' property
+was missing. Indeed, this particular setup causes the probe to bail out
+early without giving any error, which leads to the ->remove() callback gets
+to run too, but without all the expected initialized structures in place.
+
+Add a check and bail out early on remove too.
+
+ Call trace:
+ scmi_perf_domain_remove+0x28/0x70 [scmi_perf_domain]
+ scmi_dev_remove+0x28/0x40 [scmi_core]
+ device_remove+0x54/0x90
+ device_release_driver_internal+0x1dc/0x240
+ driver_detach+0x58/0xa8
+ bus_remove_driver+0x78/0x108
+ driver_unregister+0x38/0x70
+ scmi_driver_unregister+0x28/0x180 [scmi_core]
+ scmi_perf_domain_driver_exit+0x18/0xb78 [scmi_perf_domain]
+ __arm64_sys_delete_module+0x1a8/0x2c0
+ invoke_syscall+0x50/0x128
+ el0_svc_common.constprop.0+0x48/0xf0
+ do_el0_svc+0x24/0x38
+ el0_svc+0x34/0xb8
+ el0t_64_sync_handler+0x100/0x130
+ el0t_64_sync+0x190/0x198
+ Code: a90153f3 f9403c14 f9414800 955f8a05 (b9400a80)
+ ---[ end trace 0000000000000000 ]---
+
+Fixes: 2af23ceb8624 ("pmdomain: arm: Add the SCMI performance domain")
+Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20240125191756.868860-1-cristian.marussi@arm.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pmdomain/arm/scmi_perf_domain.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/pmdomain/arm/scmi_perf_domain.c b/drivers/pmdomain/arm/scmi_perf_domain.c
+index 709bbc448fad..d7ef46ccd9b8 100644
+--- a/drivers/pmdomain/arm/scmi_perf_domain.c
++++ b/drivers/pmdomain/arm/scmi_perf_domain.c
+@@ -159,6 +159,9 @@ static void scmi_perf_domain_remove(struct scmi_device *sdev)
+ struct genpd_onecell_data *scmi_pd_data = dev_get_drvdata(dev);
+ int i;
+
++ if (!scmi_pd_data)
++ return;
++
+ of_genpd_del_provider(dev->of_node);
+
+ for (i = 0; i < scmi_pd_data->num_domains; i++)
+--
+2.44.0
+
--- /dev/null
+From 2a93c6cbd5a703d44c414a3c3945a87ce11430ba Mon Sep 17 00:00:00 2001
+From: Bjorn Andersson <quic_bjorande@quicinc.com>
+Date: Mon, 26 Feb 2024 17:49:57 -0800
+Subject: pmdomain: qcom: rpmhpd: Fix enabled_corner aggregation
+
+From: Bjorn Andersson <quic_bjorande@quicinc.com>
+
+commit 2a93c6cbd5a703d44c414a3c3945a87ce11430ba upstream.
+
+Commit 'e3e56c050ab6 ("soc: qcom: rpmhpd: Make power_on actually enable
+the domain")' aimed to make sure that a power-domain that is being
+enabled without any particular performance-state requested will at least
+turn the rail on, to avoid filling DeviceTree with otherwise unnecessary
+required-opps properties.
+
+But in the event that aggregation happens on a disabled power-domain, with
+an enabled peer without performance-state, both the local and peer
+corner are 0. The peer's enabled_corner is not considered, with the
+result that the underlying (shared) resource is disabled.
+
+One case where this can be observed is when the display stack keeps mmcx
+enabled (but without a particular performance-state vote) in order to
+access registers and sync_state happens in the rpmhpd driver. As mmcx_ao
+is flushed the state of the peer (mmcx) is not considered and mmcx_ao
+ends up turning off "mmcx.lvl" underneath mmcx. This has been observed
+several times, but has been painted over in DeviceTree by adding an
+explicit vote for the lowest non-disabled performance-state.
+
+Fixes: e3e56c050ab6 ("soc: qcom: rpmhpd: Make power_on actually enable the domain")
+Reported-by: Johan Hovold <johan@kernel.org>
+Closes: https://lore.kernel.org/linux-arm-msm/ZdMwZa98L23mu3u6@hovoldconsulting.com/
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Tested-by: Johan Hovold <johan+linaro@kernel.org>
+Link: https://lore.kernel.org/r/20240226-rpmhpd-enable-corner-fix-v1-1-68c004cec48c@quicinc.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pmdomain/qcom/rpmhpd.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/pmdomain/qcom/rpmhpd.c
++++ b/drivers/pmdomain/qcom/rpmhpd.c
+@@ -692,6 +692,7 @@ static int rpmhpd_aggregate_corner(struc
+ unsigned int active_corner, sleep_corner;
+ unsigned int this_active_corner = 0, this_sleep_corner = 0;
+ unsigned int peer_active_corner = 0, peer_sleep_corner = 0;
++ unsigned int peer_enabled_corner;
+
+ if (pd->state_synced) {
+ to_active_sleep(pd, corner, &this_active_corner, &this_sleep_corner);
+@@ -701,9 +702,11 @@ static int rpmhpd_aggregate_corner(struc
+ this_sleep_corner = pd->level_count - 1;
+ }
+
+- if (peer && peer->enabled)
+- to_active_sleep(peer, peer->corner, &peer_active_corner,
++ if (peer && peer->enabled) {
++ peer_enabled_corner = max(peer->corner, peer->enable_corner);
++ to_active_sleep(peer, peer_enabled_corner, &peer_active_corner,
+ &peer_sleep_corner);
++ }
+
+ active_corner = max(this_active_corner, peer_active_corner);
+
--- /dev/null
+From 30d5297862410418bb8f8b4c0a87fa55c3063dd7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <linux@weissschuh.net>
+Date: Sun, 4 Feb 2024 18:30:43 +0100
+Subject: power: supply: mm8013: select REGMAP_I2C
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <linux@weissschuh.net>
+
+commit 30d5297862410418bb8f8b4c0a87fa55c3063dd7 upstream.
+
+The driver uses regmap APIs so it should make sure they are available.
+
+Fixes: c75f4bf6800b ("power: supply: Introduce MM8013 fuel gauge driver")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20240204-mm8013-regmap-v1-1-7cc6b619b7d3@weissschuh.net
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/power/supply/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/power/supply/Kconfig b/drivers/power/supply/Kconfig
+index f21cb05815ec..3e31375491d5 100644
+--- a/drivers/power/supply/Kconfig
++++ b/drivers/power/supply/Kconfig
+@@ -978,6 +978,7 @@ config CHARGER_QCOM_SMB2
+ config FUEL_GAUGE_MM8013
+ tristate "Mitsumi MM8013 fuel gauge driver"
+ depends on I2C
++ select REGMAP_I2C
+ help
+ Say Y here to enable the Mitsumi MM8013 fuel gauge driver.
+ It enables the monitoring of many battery parameters, including
+--
+2.44.0
+
--- /dev/null
+From 3aff0c459e77ac0fb1c4d6884433467f797f7357 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Thu, 25 Jan 2024 10:32:12 -0700
+Subject: RISC-V: Drop invalid test from CONFIG_AS_HAS_OPTION_ARCH
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+commit 3aff0c459e77ac0fb1c4d6884433467f797f7357 upstream.
+
+Commit e4bb020f3dbb ("riscv: detect assembler support for .option arch")
+added two tests, one for a valid value to '.option arch' that should
+succeed and one for an invalid value that is expected to fail to make
+sure that support for '.option arch' is properly detected because Clang
+does not error when '.option arch' is not supported:
+
+ $ clang --target=riscv64-linux-gnu -Werror -x assembler -c -o /dev/null <(echo '.option arch, +m')
+ /dev/fd/63:1:9: warning: unknown option, expected 'push', 'pop', 'rvc', 'norvc', 'relax' or 'norelax'
+ .option arch, +m
+ ^
+ $ echo $?
+ 0
+
+Unfortunately, the invalid test started being accepted by Clang after
+the linked llvm-project change, which causes CONFIG_AS_HAS_OPTION_ARCH
+and configurations that depend on it to be silently disabled, even
+though those versions do support '.option arch'.
+
+The invalid test can be avoided altogether by using
+'-Wa,--fatal-warnings', which will turn all assembler warnings into
+errors, like '-Werror' does for the compiler:
+
+ $ clang --target=riscv64-linux-gnu -Werror -Wa,--fatal-warnings -x assembler -c -o /dev/null <(echo '.option arch, +m')
+ /dev/fd/63:1:9: error: unknown option, expected 'push', 'pop', 'rvc', 'norvc', 'relax' or 'norelax'
+ .option arch, +m
+ ^
+ $ echo $?
+ 1
+
+The as-instr macros have been updated to make use of this flag, so
+remove the invalid test, which allows CONFIG_AS_HAS_OPTION_ARCH to work
+for all compiler versions.
+
+Cc: stable@vger.kernel.org
+Fixes: e4bb020f3dbb ("riscv: detect assembler support for .option arch")
+Link: https://github.com/llvm/llvm-project/commit/3ac9fe69f70a2b3541266daedbaaa7dc9c007a2a
+Reported-by: Eric Biggers <ebiggers@kernel.org>
+Closes: https://lore.kernel.org/r/20240121011341.GA97368@sol.localdomain/
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Tested-by: Eric Biggers <ebiggers@google.com>
+Tested-by: Andy Chiu <andybnac@gmail.com>
+Reviewed-by: Andy Chiu <andybnac@gmail.com>
+Tested-by: Conor Dooley <conor.dooley@microchip.com>
+Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
+Acked-by: Masahiro Yamada <masahiroy@kernel.org>
+Link: https://lore.kernel.org/r/20240125-fix-riscv-option-arch-llvm-18-v1-2-390ac9cc3cd0@kernel.org
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/riscv/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/riscv/Kconfig
++++ b/arch/riscv/Kconfig
+@@ -294,7 +294,6 @@ config AS_HAS_OPTION_ARCH
+ # https://reviews.llvm.org/D123515
+ def_bool y
+ depends on $(as-instr, .option arch$(comma) +m)
+- depends on !$(as-instr, .option arch$(comma) -i)
+
+ source "arch/riscv/Kconfig.socs"
+ source "arch/riscv/Kconfig.errata"
--- /dev/null
+From 680341382da56bd192ebfa4e58eaf4fec2e5bca7 Mon Sep 17 00:00:00 2001
+From: Zong Li <zong.li@sifive.com>
+Date: Fri, 2 Feb 2024 01:51:02 +0000
+Subject: riscv: add CALLER_ADDRx support
+
+From: Zong Li <zong.li@sifive.com>
+
+commit 680341382da56bd192ebfa4e58eaf4fec2e5bca7 upstream.
+
+CALLER_ADDRx returns caller's address at specified level, they are used
+for several tracers. These macros eventually use
+__builtin_return_address(n) to get the caller's address if arch doesn't
+define their own implementation.
+
+In RISC-V, __builtin_return_address(n) only works when n == 0, we need
+to walk the stack frame to get the caller's address at specified level.
+
+data.level started from 'level + 3' due to the call flow of getting
+caller's address in RISC-V implementation. If we don't have additional
+three iteration, the level is corresponding to follows:
+
+callsite -> return_address -> arch_stack_walk -> walk_stackframe
+| | | |
+level 3 level 2 level 1 level 0
+
+Fixes: 10626c32e382 ("riscv/ftrace: Add basic support")
+Cc: stable@vger.kernel.org
+Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Signed-off-by: Zong Li <zong.li@sifive.com>
+Link: https://lore.kernel.org/r/20240202015102.26251-1-zong.li@sifive.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/riscv/include/asm/ftrace.h | 5 +++
+ arch/riscv/kernel/Makefile | 2 +
+ arch/riscv/kernel/return_address.c | 48 +++++++++++++++++++++++++++++++++++++
+ 3 files changed, 55 insertions(+)
+ create mode 100644 arch/riscv/kernel/return_address.c
+
+--- a/arch/riscv/include/asm/ftrace.h
++++ b/arch/riscv/include/asm/ftrace.h
+@@ -25,6 +25,11 @@
+
+ #define ARCH_SUPPORTS_FTRACE_OPS 1
+ #ifndef __ASSEMBLY__
++
++extern void *return_address(unsigned int level);
++
++#define ftrace_return_address(n) return_address(n)
++
+ void MCOUNT_NAME(void);
+ static inline unsigned long ftrace_call_adjust(unsigned long addr)
+ {
+--- a/arch/riscv/kernel/Makefile
++++ b/arch/riscv/kernel/Makefile
+@@ -7,6 +7,7 @@ ifdef CONFIG_FTRACE
+ CFLAGS_REMOVE_ftrace.o = $(CC_FLAGS_FTRACE)
+ CFLAGS_REMOVE_patch.o = $(CC_FLAGS_FTRACE)
+ CFLAGS_REMOVE_sbi.o = $(CC_FLAGS_FTRACE)
++CFLAGS_REMOVE_return_address.o = $(CC_FLAGS_FTRACE)
+ endif
+ CFLAGS_syscall_table.o += $(call cc-option,-Wno-override-init,)
+ CFLAGS_compat_syscall_table.o += $(call cc-option,-Wno-override-init,)
+@@ -46,6 +47,7 @@ obj-y += irq.o
+ obj-y += process.o
+ obj-y += ptrace.o
+ obj-y += reset.o
++obj-y += return_address.o
+ obj-y += setup.o
+ obj-y += signal.o
+ obj-y += syscall_table.o
+--- /dev/null
++++ b/arch/riscv/kernel/return_address.c
+@@ -0,0 +1,48 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * This code come from arch/arm64/kernel/return_address.c
++ *
++ * Copyright (C) 2023 SiFive.
++ */
++
++#include <linux/export.h>
++#include <linux/kprobes.h>
++#include <linux/stacktrace.h>
++
++struct return_address_data {
++ unsigned int level;
++ void *addr;
++};
++
++static bool save_return_addr(void *d, unsigned long pc)
++{
++ struct return_address_data *data = d;
++
++ if (!data->level) {
++ data->addr = (void *)pc;
++ return false;
++ }
++
++ --data->level;
++
++ return true;
++}
++NOKPROBE_SYMBOL(save_return_addr);
++
++noinline void *return_address(unsigned int level)
++{
++ struct return_address_data data;
++
++ data.level = level + 3;
++ data.addr = NULL;
++
++ arch_stack_walk(save_return_addr, &data, current, NULL);
++
++ if (!data.level)
++ return data.addr;
++ else
++ return NULL;
++
++}
++EXPORT_SYMBOL_GPL(return_address);
++NOKPROBE_SYMBOL(return_address);
--- /dev/null
+From 3fb3f7164edc467450e650dca51dbe4823315a56 Mon Sep 17 00:00:00 2001
+From: Samuel Holland <samuel.holland@sifive.com>
+Date: Tue, 27 Feb 2024 22:55:33 -0800
+Subject: riscv: Fix enabling cbo.zero when running in M-mode
+
+From: Samuel Holland <samuel.holland@sifive.com>
+
+commit 3fb3f7164edc467450e650dca51dbe4823315a56 upstream.
+
+When the kernel is running in M-mode, the CBZE bit must be set in the
+menvcfg CSR, not in senvcfg.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 43c16d51a19b ("RISC-V: Enable cbo.zero in usermode")
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Signed-off-by: Samuel Holland <samuel.holland@sifive.com>
+Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://lore.kernel.org/r/20240228065559.3434837-2-samuel.holland@sifive.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/riscv/include/asm/csr.h | 2 ++
+ arch/riscv/kernel/cpufeature.c | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+--- a/arch/riscv/include/asm/csr.h
++++ b/arch/riscv/include/asm/csr.h
+@@ -415,6 +415,7 @@
+ # define CSR_STATUS CSR_MSTATUS
+ # define CSR_IE CSR_MIE
+ # define CSR_TVEC CSR_MTVEC
++# define CSR_ENVCFG CSR_MENVCFG
+ # define CSR_SCRATCH CSR_MSCRATCH
+ # define CSR_EPC CSR_MEPC
+ # define CSR_CAUSE CSR_MCAUSE
+@@ -439,6 +440,7 @@
+ # define CSR_STATUS CSR_SSTATUS
+ # define CSR_IE CSR_SIE
+ # define CSR_TVEC CSR_STVEC
++# define CSR_ENVCFG CSR_SENVCFG
+ # define CSR_SCRATCH CSR_SSCRATCH
+ # define CSR_EPC CSR_SEPC
+ # define CSR_CAUSE CSR_SCAUSE
+--- a/arch/riscv/kernel/cpufeature.c
++++ b/arch/riscv/kernel/cpufeature.c
+@@ -740,7 +740,7 @@ arch_initcall(check_unaligned_access_all
+ void riscv_user_isa_enable(void)
+ {
+ if (riscv_cpu_has_extension_unlikely(smp_processor_id(), RISCV_ISA_EXT_ZICBOZ))
+- csr_set(CSR_SENVCFG, ENVCFG_CBZE);
++ csr_set(CSR_ENVCFG, ENVCFG_CBZE);
+ }
+
+ #ifdef CONFIG_RISCV_ALTERNATIVE
--- /dev/null
+From 05ab803d1ad8ac505ade77c6bd3f86b1b4ea0dc4 Mon Sep 17 00:00:00 2001
+From: Samuel Holland <samuel.holland@sifive.com>
+Date: Tue, 27 Feb 2024 22:55:35 -0800
+Subject: riscv: Save/restore envcfg CSR during CPU suspend
+
+From: Samuel Holland <samuel.holland@sifive.com>
+
+commit 05ab803d1ad8ac505ade77c6bd3f86b1b4ea0dc4 upstream.
+
+The value of the [ms]envcfg CSR is lost when entering a nonretentive
+idle state, so the CSR must be rewritten when resuming the CPU.
+
+Cc: <stable@vger.kernel.org> # v6.7+
+Fixes: 43c16d51a19b ("RISC-V: Enable cbo.zero in usermode")
+Signed-off-by: Samuel Holland <samuel.holland@sifive.com>
+Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Link: https://lore.kernel.org/r/20240228065559.3434837-4-samuel.holland@sifive.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/riscv/include/asm/suspend.h | 1 +
+ arch/riscv/kernel/suspend.c | 4 ++++
+ 2 files changed, 5 insertions(+)
+
+--- a/arch/riscv/include/asm/suspend.h
++++ b/arch/riscv/include/asm/suspend.h
+@@ -14,6 +14,7 @@ struct suspend_context {
+ struct pt_regs regs;
+ /* Saved and restored by high-level functions */
+ unsigned long scratch;
++ unsigned long envcfg;
+ unsigned long tvec;
+ unsigned long ie;
+ #ifdef CONFIG_MMU
+--- a/arch/riscv/kernel/suspend.c
++++ b/arch/riscv/kernel/suspend.c
+@@ -11,6 +11,8 @@
+ void suspend_save_csrs(struct suspend_context *context)
+ {
+ context->scratch = csr_read(CSR_SCRATCH);
++ if (riscv_cpu_has_extension_unlikely(smp_processor_id(), RISCV_ISA_EXT_XLINUXENVCFG))
++ context->envcfg = csr_read(CSR_ENVCFG);
+ context->tvec = csr_read(CSR_TVEC);
+ context->ie = csr_read(CSR_IE);
+
+@@ -32,6 +34,8 @@ void suspend_save_csrs(struct suspend_co
+ void suspend_restore_csrs(struct suspend_context *context)
+ {
+ csr_write(CSR_SCRATCH, context->scratch);
++ if (riscv_cpu_has_extension_unlikely(smp_processor_id(), RISCV_ISA_EXT_XLINUXENVCFG))
++ csr_write(CSR_ENVCFG, context->envcfg);
+ csr_write(CSR_TVEC, context->tvec);
+ csr_write(CSR_IE, context->ie);
+
mmc-sdhci-xenon-add-timeout-for-phy-init-complete.patch
mmc-sdhci-xenon-fix-phy-init-clock-stability.patch
ceph-switch-to-corrected-encoding-of-max_xattr_size-in-mdsmap.patch
+risc-v-drop-invalid-test-from-config_as_has_option_arch.patch
+riscv-add-caller_addrx-support.patch
+riscv-fix-enabling-cbo.zero-when-running-in-m-mode.patch
+riscv-save-restore-envcfg-csr-during-cpu-suspend.patch
+power-supply-mm8013-select-regmap_i2c.patch
+kbuild-add-wa-fatal-warnings-to-as-instr-invocation.patch
+iommufd-fix-iopt_access_list_id-overwrite-bug.patch
+iommufd-fix-protection-fault-in-iommufd_test_syz_conv_iova.patch
+efivarfs-request-at-most-512-bytes-for-variable-names.patch
+pmdomain-arm-fix-null-dereference-on-scmi_perf_domain-removal.patch
+pmdomain-qcom-rpmhpd-fix-enabled_corner-aggregation.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
