--- /dev/null
+From d7c767ae9753928cc439576f2f7592745761afa2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Nov 2020 19:38:43 +0100
+Subject: ARM: dts: sun8i-h2-plus-bananapi-m2-zero: add regulator nodes
+ vcc-dram and vcc1v2
+
+From: Michael Klein <michael@fossekall.de>
+
+[ Upstream commit 23e85be1ec81647374055f731488cc9a7c013a5c ]
+
+Add regulator nodes vcc-dram and vcc1v2 to the devicetree. These
+regulators correspond to U4 and U5 in the schematics:
+
+http://forum.banana-pi.org/t/bpi-m2-zero-schematic-diagram-public/4111
+
+Signed-off-by: Michael Klein <michael@fossekall.de>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20201130183841.136708-1-michael@fossekall.de
+Stable-dep-of: 4a0e7f2decbf ("netfilter: nf_tables: do not compare internal table flags on updates")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/sun8i-h2-plus-bananapi-m2-zero.dts | 24 +++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/arch/arm/boot/dts/sun8i-h2-plus-bananapi-m2-zero.dts b/arch/arm/boot/dts/sun8i-h2-plus-bananapi-m2-zero.dts
+index 4c6704e4c57ec..74d5732c412ba 100644
+--- a/arch/arm/boot/dts/sun8i-h2-plus-bananapi-m2-zero.dts
++++ b/arch/arm/boot/dts/sun8i-h2-plus-bananapi-m2-zero.dts
+@@ -62,6 +62,30 @@
+ states = <1100000 0>, <1300000 1>;
+ };
+
++ reg_vcc_dram: vcc-dram {
++ compatible = "regulator-fixed";
++ regulator-name = "vcc-dram";
++ regulator-min-microvolt = <1500000>;
++ regulator-max-microvolt = <1500000>;
++ regulator-always-on;
++ regulator-boot-on;
++ enable-active-high;
++ gpio = <&r_pio 0 9 GPIO_ACTIVE_HIGH>; /* PL9 */
++ vin-supply = <®_vcc5v0>;
++ };
++
++ reg_vcc1v2: vcc1v2 {
++ compatible = "regulator-fixed";
++ regulator-name = "vcc1v2";
++ regulator-min-microvolt = <1200000>;
++ regulator-max-microvolt = <1200000>;
++ regulator-always-on;
++ regulator-boot-on;
++ enable-active-high;
++ gpio = <&r_pio 0 8 GPIO_ACTIVE_HIGH>; /* PL8 */
++ vin-supply = <®_vcc5v0>;
++ };
++
+ wifi_pwrseq: wifi_pwrseq {
+ compatible = "mmc-pwrseq-simple";
+ reset-gpios = <&r_pio 0 7 GPIO_ACTIVE_LOW>; /* PL7 */
+--
+2.43.0
+
--- /dev/null
+From c774655ac98d69dca859582d2f95dbd03c0586e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Mar 2024 13:44:40 -0700
+Subject: bpf: report RCU QS in cpumap kthread
+
+From: Yan Zhai <yan@cloudflare.com>
+
+[ Upstream commit 00bf63122459e87193ee7f1bc6161c83a525569f ]
+
+When there are heavy load, cpumap kernel threads can be busy polling
+packets from redirect queues and block out RCU tasks from reaching
+quiescent states. It is insufficient to just call cond_resched() in such
+context. Periodically raise a consolidated RCU QS before cond_resched
+fixes the problem.
+
+Fixes: 6710e1126934 ("bpf: introduce new bpf cpu map type BPF_MAP_TYPE_CPUMAP")
+Reviewed-by: Jesper Dangaard Brouer <hawk@kernel.org>
+Signed-off-by: Yan Zhai <yan@cloudflare.com>
+Acked-by: Paul E. McKenney <paulmck@kernel.org>
+Acked-by: Jesper Dangaard Brouer <hawk@kernel.org>
+Link: https://lore.kernel.org/r/c17b9f1517e19d813da3ede5ed33ee18496bb5d8.1710877680.git.yan@cloudflare.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/cpumap.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c
+index 2dcc04b2f330e..9a4378df45998 100644
+--- a/kernel/bpf/cpumap.c
++++ b/kernel/bpf/cpumap.c
+@@ -299,6 +299,7 @@ static int cpu_map_bpf_prog_run_xdp(struct bpf_cpu_map_entry *rcpu,
+ static int cpu_map_kthread_run(void *data)
+ {
+ struct bpf_cpu_map_entry *rcpu = data;
++ unsigned long last_qs = jiffies;
+
+ set_current_state(TASK_INTERRUPTIBLE);
+
+@@ -322,10 +323,12 @@ static int cpu_map_kthread_run(void *data)
+ if (__ptr_ring_empty(rcpu->queue)) {
+ schedule();
+ sched = 1;
++ last_qs = jiffies;
+ } else {
+ __set_current_state(TASK_RUNNING);
+ }
+ } else {
++ rcu_softirq_qs_periodic(last_qs);
+ sched = cond_resched();
+ }
+
+--
+2.43.0
+
--- /dev/null
+From 4fcc59f3c74ef9e36629a6f26b3b0c18064a5af7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Mar 2024 00:27:19 +0900
+Subject: hsr: Fix uninit-value access in hsr_get_node()
+
+From: Shigeru Yoshida <syoshida@redhat.com>
+
+[ Upstream commit ddbec99f58571301679addbc022256970ca3eac6 ]
+
+KMSAN reported the following uninit-value access issue [1]:
+
+=====================================================
+BUG: KMSAN: uninit-value in hsr_get_node+0xa2e/0xa40 net/hsr/hsr_framereg.c:246
+ hsr_get_node+0xa2e/0xa40 net/hsr/hsr_framereg.c:246
+ fill_frame_info net/hsr/hsr_forward.c:577 [inline]
+ hsr_forward_skb+0xe12/0x30e0 net/hsr/hsr_forward.c:615
+ hsr_dev_xmit+0x1a1/0x270 net/hsr/hsr_device.c:223
+ __netdev_start_xmit include/linux/netdevice.h:4940 [inline]
+ netdev_start_xmit include/linux/netdevice.h:4954 [inline]
+ xmit_one net/core/dev.c:3548 [inline]
+ dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564
+ __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349
+ dev_queue_xmit include/linux/netdevice.h:3134 [inline]
+ packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276
+ packet_snd net/packet/af_packet.c:3087 [inline]
+ packet_sendmsg+0x8b1d/0x9f30 net/packet/af_packet.c:3119
+ sock_sendmsg_nosec net/socket.c:730 [inline]
+ __sock_sendmsg net/socket.c:745 [inline]
+ __sys_sendto+0x735/0xa10 net/socket.c:2191
+ __do_sys_sendto net/socket.c:2203 [inline]
+ __se_sys_sendto net/socket.c:2199 [inline]
+ __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199
+ do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+ do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x63/0x6b
+
+Uninit was created at:
+ slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768
+ slab_alloc_node mm/slub.c:3478 [inline]
+ kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523
+ kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560
+ __alloc_skb+0x318/0x740 net/core/skbuff.c:651
+ alloc_skb include/linux/skbuff.h:1286 [inline]
+ alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6334
+ sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2787
+ packet_alloc_skb net/packet/af_packet.c:2936 [inline]
+ packet_snd net/packet/af_packet.c:3030 [inline]
+ packet_sendmsg+0x70e8/0x9f30 net/packet/af_packet.c:3119
+ sock_sendmsg_nosec net/socket.c:730 [inline]
+ __sock_sendmsg net/socket.c:745 [inline]
+ __sys_sendto+0x735/0xa10 net/socket.c:2191
+ __do_sys_sendto net/socket.c:2203 [inline]
+ __se_sys_sendto net/socket.c:2199 [inline]
+ __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199
+ do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+ do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x63/0x6b
+
+CPU: 1 PID: 5033 Comm: syz-executor334 Not tainted 6.7.0-syzkaller-00562-g9f8413c4a66f #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
+=====================================================
+
+If the packet type ID field in the Ethernet header is either ETH_P_PRP or
+ETH_P_HSR, but it is not followed by an HSR tag, hsr_get_skb_sequence_nr()
+reads an invalid value as a sequence number. This causes the above issue.
+
+This patch fixes the issue by returning NULL if the Ethernet header is not
+followed by an HSR tag.
+
+Fixes: f266a683a480 ("net/hsr: Better frame dispatch")
+Reported-and-tested-by: syzbot+2ef3a8ce8e91b5a50098@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=2ef3a8ce8e91b5a50098 [1]
+Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
+Link: https://lore.kernel.org/r/20240312152719.724530-1-syoshida@redhat.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/hsr/hsr_framereg.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
+index 87fc86aade5c9..fc9fb3e5ae3e2 100644
+--- a/net/hsr/hsr_framereg.c
++++ b/net/hsr/hsr_framereg.c
+@@ -237,6 +237,10 @@ struct hsr_node *hsr_get_node(struct hsr_port *port, struct list_head *node_db,
+ */
+ if (ethhdr->h_proto == htons(ETH_P_PRP) ||
+ ethhdr->h_proto == htons(ETH_P_HSR)) {
++ /* Check if skb contains hsr_ethhdr */
++ if (skb->mac_len < sizeof(struct hsr_ethhdr))
++ return NULL;
++
+ /* Use the existing sequence_nr from the tag as starting point
+ * for filtering duplicate frames.
+ */
+--
+2.43.0
+
--- /dev/null
+From f1a4b91d1f3601d070fe36b7e1dd5ca669380bdc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Mar 2024 13:04:52 +0100
+Subject: hsr: Handle failures in module init
+
+From: Felix Maurer <fmaurer@redhat.com>
+
+[ Upstream commit 3cf28cd492308e5f63ed00b29ea03ca016264376 ]
+
+A failure during registration of the netdev notifier was not handled at
+all. A failure during netlink initialization did not unregister the netdev
+notifier.
+
+Handle failures of netdev notifier registration and netlink initialization.
+Both functions should only return negative values on failure and thereby
+lead to the hsr module not being loaded.
+
+Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)")
+Signed-off-by: Felix Maurer <fmaurer@redhat.com>
+Reviewed-by: Shigeru Yoshida <syoshida@redhat.com>
+Reviewed-by: Breno Leitao <leitao@debian.org>
+Link: https://lore.kernel.org/r/3ce097c15e3f7ace98fc7fd9bcbf299f092e63d1.1710504184.git.fmaurer@redhat.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/hsr/hsr_main.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/net/hsr/hsr_main.c b/net/hsr/hsr_main.c
+index 2fd1976e5b1c3..bea7f935f38e9 100644
+--- a/net/hsr/hsr_main.c
++++ b/net/hsr/hsr_main.c
+@@ -137,14 +137,21 @@ static struct notifier_block hsr_nb = {
+
+ static int __init hsr_init(void)
+ {
+- int res;
++ int err;
+
+ BUILD_BUG_ON(sizeof(struct hsr_tag) != HSR_HLEN);
+
+- register_netdevice_notifier(&hsr_nb);
+- res = hsr_netlink_init();
++ err = register_netdevice_notifier(&hsr_nb);
++ if (err)
++ return err;
++
++ err = hsr_netlink_init();
++ if (err) {
++ unregister_netdevice_notifier(&hsr_nb);
++ return err;
++ }
+
+- return res;
++ return 0;
+ }
+
+ static void __exit hsr_exit(void)
+--
+2.43.0
+
--- /dev/null
+From 77e27cb846941198b3fc06bc0706ad3c5fc21e34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Mar 2024 13:30:43 -0600
+Subject: io_uring: don't save/restore iowait state
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit 6f0974eccbf78baead1735722c4f1ee3eb9422cd ]
+
+This kind of state is per-syscall, and since we're doing the waiting off
+entering the io_uring_enter(2) syscall, there's no way that iowait can
+already be set for this case. Simplify it by setting it if we need to,
+and always clearing it to 0 when done.
+
+Fixes: 7b72d661f1f2 ("io_uring: gate iowait schedule on having pending requests")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/io_uring.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
+index 67a355f27ad80..fc60396c90396 100644
+--- a/io_uring/io_uring.c
++++ b/io_uring/io_uring.c
+@@ -7640,7 +7640,7 @@ static inline int io_cqring_wait_schedule(struct io_ring_ctx *ctx,
+ struct io_wait_queue *iowq,
+ ktime_t *timeout)
+ {
+- int io_wait, ret;
++ int ret;
+
+ /* make sure we run task_work before checking for signals */
+ ret = io_run_task_work_sig();
+@@ -7655,13 +7655,12 @@ static inline int io_cqring_wait_schedule(struct io_ring_ctx *ctx,
+ * can take into account that the task is waiting for IO - turns out
+ * to be important for low QD IO.
+ */
+- io_wait = current->in_iowait;
+ if (current_pending_io())
+ current->in_iowait = 1;
+ ret = 1;
+ if (!schedule_hrtimeout(timeout, HRTIMER_MODE_ABS))
+ ret = -ETIME;
+- current->in_iowait = io_wait;
++ current->in_iowait = 0;
+ return ret;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From dc8df7ecd526ad0fb68cfcf0efa752cefd267c9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Feb 2024 00:57:59 +0900
+Subject: kconfig: fix infinite loop when expanding a macro at the end of file
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit af8bbce92044dc58e4cc039ab94ee5d470a621f5 ]
+
+A macro placed at the end of a file with no newline causes an infinite
+loop.
+
+[Test Kconfig]
+ $(info,hello)
+ \ No newline at end of file
+
+I realized that flex-provided input() returns 0 instead of EOF when it
+reaches the end of a file.
+
+Fixes: 104daea149c4 ("kconfig: reference environment variables directly and remove 'option env='")
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/kconfig/lexer.l | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/scripts/kconfig/lexer.l b/scripts/kconfig/lexer.l
+index 240109f965aeb..72e5e9ac52bb4 100644
+--- a/scripts/kconfig/lexer.l
++++ b/scripts/kconfig/lexer.l
+@@ -305,8 +305,11 @@ static char *expand_token(const char *in, size_t n)
+ new_string();
+ append_string(in, n);
+
+- /* get the whole line because we do not know the end of token. */
+- while ((c = input()) != EOF) {
++ /*
++ * get the whole line because we do not know the end of token.
++ * input() returns 0 (not EOF!) when it reachs the end of file.
++ */
++ while ((c = input()) != 0) {
+ if (c == '\n') {
+ unput(c);
+ break;
+--
+2.43.0
+
--- /dev/null
+From a748c9fb79efbc21dcc7e4e043ba4c30697a3750 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Mar 2024 15:55:35 -0500
+Subject: net/bnx2x: Prevent access to a freed page in page_pool
+
+From: Thinh Tran <thinhtr@linux.ibm.com>
+
+[ Upstream commit d27e2da94a42655861ca4baea30c8cd65546f25d ]
+
+Fix race condition leading to system crash during EEH error handling
+
+During EEH error recovery, the bnx2x driver's transmit timeout logic
+could cause a race condition when handling reset tasks. The
+bnx2x_tx_timeout() schedules reset tasks via bnx2x_sp_rtnl_task(),
+which ultimately leads to bnx2x_nic_unload(). In bnx2x_nic_unload()
+SGEs are freed using bnx2x_free_rx_sge_range(). However, this could
+overlap with the EEH driver's attempt to reset the device using
+bnx2x_io_slot_reset(), which also tries to free SGEs. This race
+condition can result in system crashes due to accessing freed memory
+locations in bnx2x_free_rx_sge()
+
+799 static inline void bnx2x_free_rx_sge(struct bnx2x *bp,
+800 struct bnx2x_fastpath *fp, u16 index)
+801 {
+802 struct sw_rx_page *sw_buf = &fp->rx_page_ring[index];
+803 struct page *page = sw_buf->page;
+....
+where sw_buf was set to NULL after the call to dma_unmap_page()
+by the preceding thread.
+
+ EEH: Beginning: 'slot_reset'
+ PCI 0011:01:00.0#10000: EEH: Invoking bnx2x->slot_reset()
+ bnx2x: [bnx2x_io_slot_reset:14228(eth1)]IO slot reset initializing...
+ bnx2x 0011:01:00.0: enabling device (0140 -> 0142)
+ bnx2x: [bnx2x_io_slot_reset:14244(eth1)]IO slot reset --> driver unload
+ Kernel attempted to read user page (0) - exploit attempt? (uid: 0)
+ BUG: Kernel NULL pointer dereference on read at 0x00000000
+ Faulting instruction address: 0xc0080000025065fc
+ Oops: Kernel access of bad area, sig: 11 [#1]
+ .....
+ Call Trace:
+ [c000000003c67a20] [c00800000250658c] bnx2x_io_slot_reset+0x204/0x610 [bnx2x] (unreliable)
+ [c000000003c67af0] [c0000000000518a8] eeh_report_reset+0xb8/0xf0
+ [c000000003c67b60] [c000000000052130] eeh_pe_report+0x180/0x550
+ [c000000003c67c70] [c00000000005318c] eeh_handle_normal_event+0x84c/0xa60
+ [c000000003c67d50] [c000000000053a84] eeh_event_handler+0xf4/0x170
+ [c000000003c67da0] [c000000000194c58] kthread+0x1c8/0x1d0
+ [c000000003c67e10] [c00000000000cf64] ret_from_kernel_thread+0x5c/0x64
+
+To solve this issue, we need to verify page pool allocations before
+freeing.
+
+Fixes: 4cace675d687 ("bnx2x: Alloc 4k fragment for each rx ring buffer element")
+Signed-off-by: Thinh Tran <thinhtr@linux.ibm.com>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Link: https://lore.kernel.org/r/20240315205535.1321-1-thinhtr@linux.ibm.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+index d8b1824c334d3..0bc1367fd6492 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+@@ -1002,9 +1002,6 @@ static inline void bnx2x_set_fw_mac_addr(__le16 *fw_hi, __le16 *fw_mid,
+ static inline void bnx2x_free_rx_mem_pool(struct bnx2x *bp,
+ struct bnx2x_alloc_pool *pool)
+ {
+- if (!pool->page)
+- return;
+-
+ put_page(pool->page);
+
+ pool->page = NULL;
+@@ -1015,6 +1012,9 @@ static inline void bnx2x_free_rx_sge_range(struct bnx2x *bp,
+ {
+ int i;
+
++ if (!fp->page_pool.page)
++ return;
++
+ if (fp->mode == TPA_MODE_DISABLED)
+ return;
+
+--
+2.43.0
+
--- /dev/null
+From 4e2b74c07bb227872859c347acff31443da1f8aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Mar 2024 12:28:35 +0300
+Subject: net: dsa: mt7530: prevent possible incorrect XTAL frequency selection
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arınç ÜNAL <arinc.unal@arinc9.com>
+
+[ Upstream commit f490c492e946d8ffbe65ad4efc66de3c5ede30a4 ]
+
+On MT7530, the HT_XTAL_FSEL field of the HWTRAP register stores a 2-bit
+value that represents the frequency of the crystal oscillator connected to
+the switch IC. The field is populated by the state of the ESW_P4_LED_0 and
+ESW_P4_LED_0 pins, which is done right after reset is deasserted.
+
+ ESW_P4_LED_0 ESW_P3_LED_0 Frequency
+ -----------------------------------------
+ 0 0 Reserved
+ 0 1 20MHz
+ 1 0 40MHz
+ 1 1 25MHz
+
+On MT7531, the XTAL25 bit of the STRAP register stores this. The LAN0LED0
+pin is used to populate the bit. 25MHz when the pin is high, 40MHz when
+it's low.
+
+These pins are also used with LEDs, therefore, their state can be set to
+something other than the bootstrapping configuration. For example, a link
+may be established on port 3 before the DSA subdriver takes control of the
+switch which would set ESW_P3_LED_0 to high.
+
+Currently on mt7530_setup() and mt7531_setup(), 1000 - 1100 usec delay is
+described between reset assertion and deassertion. Some switch ICs in real
+life conditions cannot always have these pins set back to the bootstrapping
+configuration before reset deassertion in this amount of delay. This causes
+wrong crystal frequency to be selected which puts the switch in a
+nonfunctional state after reset deassertion.
+
+The tests below are conducted on an MT7530 with a 40MHz crystal oscillator
+by Justin Swartz.
+
+With a cable from an active peer connected to port 3 before reset, an
+incorrect crystal frequency (0b11 = 25MHz) is selected:
+
+ [1] [3] [5]
+ : : :
+ _____________________________ __________________
+ESW_P4_LED_0 |_______|
+ _____________________________
+ESW_P3_LED_0 |__________________________
+
+ : : : :
+ : : [4]...:
+ : :
+ [2]................:
+
+[1] Reset is asserted.
+[2] Period of 1000 - 1100 usec.
+[3] Reset is deasserted.
+[4] Period of 315 usec. HWTRAP register is populated with incorrect
+ XTAL frequency.
+[5] Signals reflect the bootstrapped configuration.
+
+Increase the delay between reset_control_assert() and
+reset_control_deassert(), and gpiod_set_value_cansleep(priv->reset, 0) and
+gpiod_set_value_cansleep(priv->reset, 1) to 5000 - 5100 usec. This amount
+ensures a higher possibility that the switch IC will have these pins back
+to the bootstrapping configuration before reset deassertion.
+
+With a cable from an active peer connected to port 3 before reset, the
+correct crystal frequency (0b10 = 40MHz) is selected:
+
+ [1] [2-1] [3] [5]
+ : : : :
+ _____________________________ __________________
+ESW_P4_LED_0 |_______|
+ ___________________ _______
+ESW_P3_LED_0 |_________| |__________________
+
+ : : : : :
+ : [2-2]...: [4]...:
+ [2]................:
+
+[1] Reset is asserted.
+[2] Period of 5000 - 5100 usec.
+[2-1] ESW_P3_LED_0 goes low.
+[2-2] Remaining period of 5000 - 5100 usec.
+[3] Reset is deasserted.
+[4] Period of 310 usec. HWTRAP register is populated with bootstrapped
+ XTAL frequency.
+[5] Signals reflect the bootstrapped configuration.
+
+ESW_P3_LED_0 low period before reset deassertion:
+
+ 5000 usec
+ - 5100 usec
+ TEST RESET HOLD
+ # (usec)
+ ---------------------
+ 1 5410
+ 2 5440
+ 3 4375
+ 4 5490
+ 5 5475
+ 6 4335
+ 7 4370
+ 8 5435
+ 9 4205
+ 10 4335
+ 11 3750
+ 12 3170
+ 13 4395
+ 14 4375
+ 15 3515
+ 16 4335
+ 17 4220
+ 18 4175
+ 19 4175
+ 20 4350
+
+ Min 3170
+ Max 5490
+
+ Median 4342.500
+ Avg 4466.500
+
+Revert commit 2920dd92b980 ("net: dsa: mt7530: disable LEDs before reset").
+Changing the state of pins via reset assertion is simpler and more
+efficient than doing so by setting the LED controller off.
+
+Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch")
+Fixes: c288575f7810 ("net: dsa: mt7530: Add the support of MT7531 switch")
+Co-developed-by: Justin Swartz <justin.swartz@risingedge.co.za>
+Signed-off-by: Justin Swartz <justin.swartz@risingedge.co.za>
+Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mt7530.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
+index 4056ca4255be7..0fbed76bb9697 100644
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -1581,11 +1581,11 @@ mt7530_setup(struct dsa_switch *ds)
+ */
+ if (priv->mcm) {
+ reset_control_assert(priv->rstc);
+- usleep_range(1000, 1100);
++ usleep_range(5000, 5100);
+ reset_control_deassert(priv->rstc);
+ } else {
+ gpiod_set_value_cansleep(priv->reset, 0);
+- usleep_range(1000, 1100);
++ usleep_range(5000, 5100);
+ gpiod_set_value_cansleep(priv->reset, 1);
+ }
+
+@@ -1704,11 +1704,11 @@ mt7531_setup(struct dsa_switch *ds)
+ */
+ if (priv->mcm) {
+ reset_control_assert(priv->rstc);
+- usleep_range(1000, 1100);
++ usleep_range(5000, 5100);
+ reset_control_deassert(priv->rstc);
+ } else {
+ gpiod_set_value_cansleep(priv->reset, 0);
+- usleep_range(1000, 1100);
++ usleep_range(5000, 5100);
+ gpiod_set_value_cansleep(priv->reset, 1);
+ }
+
+--
+2.43.0
+
--- /dev/null
+From 29fc6dcf1e392397498e6c7ccd6d413c665cfbc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Mar 2024 18:51:38 +0100
+Subject: netfilter: nf_tables: do not compare internal table flags on updates
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 4a0e7f2decbf9bd72461226f1f5f7dcc4b08f139 ]
+
+Restore skipping transaction if table update does not modify flags.
+
+Fixes: 179d9ba5559a ("netfilter: nf_tables: fix table flag updates")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 73b0a6925304c..8d4472b127e41 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -1097,7 +1097,7 @@ static int nf_tables_updtable(struct nft_ctx *ctx)
+ if (flags & ~NFT_TABLE_F_DORMANT)
+ return -EINVAL;
+
+- if (flags == ctx->table->flags)
++ if (flags == (ctx->table->flags & NFT_TABLE_F_MASK))
+ return 0;
+
+ /* No dormant off/on/off/on games in single transaction */
+--
+2.43.0
+
--- /dev/null
+From 942d294f35759927a95a222cf29de06f0857dbc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Mar 2024 10:02:41 +0100
+Subject: netfilter: nft_set_pipapo: release elements in clone only from
+ destroy path
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit b0e256f3dd2ba6532f37c5c22e07cb07a36031ee ]
+
+Clone already always provides a current view of the lookup table, use it
+to destroy the set, otherwise it is possible to destroy elements twice.
+
+This fix requires:
+
+ 212ed75dc5fb ("netfilter: nf_tables: integrate pipapo into commit protocol")
+
+which came after:
+
+ 9827a0e6e23b ("netfilter: nft_set_pipapo: release elements in clone from abort path").
+
+Fixes: 9827a0e6e23b ("netfilter: nft_set_pipapo: release elements in clone from abort path")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_set_pipapo.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
+index 70a59a35d1761..b9682e085fcef 100644
+--- a/net/netfilter/nft_set_pipapo.c
++++ b/net/netfilter/nft_set_pipapo.c
+@@ -2226,8 +2226,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,
+ if (m) {
+ rcu_barrier();
+
+- nft_set_pipapo_match_destroy(ctx, set, m);
+-
+ for_each_possible_cpu(cpu)
+ pipapo_free_scratch(m, cpu);
+ free_percpu(m->scratch);
+@@ -2239,8 +2237,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,
+ if (priv->clone) {
+ m = priv->clone;
+
+- if (priv->dirty)
+- nft_set_pipapo_match_destroy(ctx, set, m);
++ nft_set_pipapo_match_destroy(ctx, set, m);
+
+ for_each_possible_cpu(cpu)
+ pipapo_free_scratch(priv->clone, cpu);
+--
+2.43.0
+
--- /dev/null
+From 5f60cc3a0cdc39cff84a46c159109bd28687a8e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Mar 2024 12:36:22 +0530
+Subject: octeontx2-af: Use matching wake_up API variant in CGX command
+ interface
+
+From: Linu Cherian <lcherian@marvell.com>
+
+[ Upstream commit e642921dfeed1e15e73f78f2c3b6746f72b6deb2 ]
+
+Use wake_up API instead of wake_up_interruptible, since
+wait_event_timeout API is used for waiting on command completion.
+
+Fixes: 1463f382f58d ("octeontx2-af: Add support for CGX link management")
+Signed-off-by: Linu Cherian <lcherian@marvell.com>
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+index c0a0a31272cc2..55dfe1a20bc99 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+@@ -714,7 +714,7 @@ static irqreturn_t cgx_fwi_event_handler(int irq, void *data)
+
+ /* Release thread waiting for completion */
+ lmac->cmd_pend = false;
+- wake_up_interruptible(&lmac->wq_cmd_cmplt);
++ wake_up(&lmac->wq_cmd_cmplt);
+ break;
+ case CGX_EVT_ASYNC:
+ if (cgx_event_is_linkevent(event))
+--
+2.43.0
+
--- /dev/null
+From d7a92ef15f86699ebf9ff8bb25d08967917ad32b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Mar 2024 14:59:58 +0530
+Subject: octeontx2-af: Use separate handlers for interrupts
+
+From: Subbaraya Sundeep <sbhatta@marvell.com>
+
+[ Upstream commit 50e60de381c342008c0956fd762e1c26408f372c ]
+
+For PF to AF interrupt vector and VF to AF vector same
+interrupt handler is registered which is causing race condition.
+When two interrupts are raised to two CPUs at same time
+then two cores serve same event corrupting the data.
+
+Fixes: 7304ac4567bc ("octeontx2-af: Add mailbox IRQ and msg handlers")
+Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
+index acbc67074f59c..23b829f974de1 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
+@@ -1969,10 +1969,9 @@ static void rvu_queue_work(struct mbox_wq_info *mw, int first,
+ }
+ }
+
+-static irqreturn_t rvu_mbox_intr_handler(int irq, void *rvu_irq)
++static irqreturn_t rvu_mbox_pf_intr_handler(int irq, void *rvu_irq)
+ {
+ struct rvu *rvu = (struct rvu *)rvu_irq;
+- int vfs = rvu->vfs;
+ u64 intr;
+
+ intr = rvu_read64(rvu, BLKADDR_RVUM, RVU_AF_PFAF_MBOX_INT);
+@@ -1986,6 +1985,18 @@ static irqreturn_t rvu_mbox_intr_handler(int irq, void *rvu_irq)
+
+ rvu_queue_work(&rvu->afpf_wq_info, 0, rvu->hw->total_pfs, intr);
+
++ return IRQ_HANDLED;
++}
++
++static irqreturn_t rvu_mbox_intr_handler(int irq, void *rvu_irq)
++{
++ struct rvu *rvu = (struct rvu *)rvu_irq;
++ int vfs = rvu->vfs;
++ u64 intr;
++
++ /* Sync with mbox memory region */
++ rmb();
++
+ /* Handle VF interrupts */
+ if (vfs > 64) {
+ intr = rvupf_read64(rvu, RVU_PF_VFPF_MBOX_INTX(1));
+@@ -2300,7 +2311,7 @@ static int rvu_register_interrupts(struct rvu *rvu)
+ /* Register mailbox interrupt handler */
+ sprintf(&rvu->irq_name[RVU_AF_INT_VEC_MBOX * NAME_SIZE], "RVUAF Mbox");
+ ret = request_irq(pci_irq_vector(rvu->pdev, RVU_AF_INT_VEC_MBOX),
+- rvu_mbox_intr_handler, 0,
++ rvu_mbox_pf_intr_handler, 0,
+ &rvu->irq_name[RVU_AF_INT_VEC_MBOX * NAME_SIZE], rvu);
+ if (ret) {
+ dev_err(rvu->dev,
+--
+2.43.0
+
--- /dev/null
+From f2c35819dda9f9fdbb97e3f2e20b2c48a32f7a5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Mar 2024 14:18:16 +0000
+Subject: packet: annotate data-races around ignore_outgoing
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 6ebfad33161afacb3e1e59ed1c2feefef70f9f97 ]
+
+ignore_outgoing is read locklessly from dev_queue_xmit_nit()
+and packet_getsockopt()
+
+Add appropriate READ_ONCE()/WRITE_ONCE() annotations.
+
+syzbot reported:
+
+BUG: KCSAN: data-race in dev_queue_xmit_nit / packet_setsockopt
+
+write to 0xffff888107804542 of 1 bytes by task 22618 on cpu 0:
+ packet_setsockopt+0xd83/0xfd0 net/packet/af_packet.c:4003
+ do_sock_setsockopt net/socket.c:2311 [inline]
+ __sys_setsockopt+0x1d8/0x250 net/socket.c:2334
+ __do_sys_setsockopt net/socket.c:2343 [inline]
+ __se_sys_setsockopt net/socket.c:2340 [inline]
+ __x64_sys_setsockopt+0x66/0x80 net/socket.c:2340
+ do_syscall_64+0xd3/0x1d0
+ entry_SYSCALL_64_after_hwframe+0x6d/0x75
+
+read to 0xffff888107804542 of 1 bytes by task 27 on cpu 1:
+ dev_queue_xmit_nit+0x82/0x620 net/core/dev.c:2248
+ xmit_one net/core/dev.c:3527 [inline]
+ dev_hard_start_xmit+0xcc/0x3f0 net/core/dev.c:3547
+ __dev_queue_xmit+0xf24/0x1dd0 net/core/dev.c:4335
+ dev_queue_xmit include/linux/netdevice.h:3091 [inline]
+ batadv_send_skb_packet+0x264/0x300 net/batman-adv/send.c:108
+ batadv_send_broadcast_skb+0x24/0x30 net/batman-adv/send.c:127
+ batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:392 [inline]
+ batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline]
+ batadv_iv_send_outstanding_bat_ogm_packet+0x3f0/0x4b0 net/batman-adv/bat_iv_ogm.c:1700
+ process_one_work kernel/workqueue.c:3254 [inline]
+ process_scheduled_works+0x465/0x990 kernel/workqueue.c:3335
+ worker_thread+0x526/0x730 kernel/workqueue.c:3416
+ kthread+0x1d1/0x210 kernel/kthread.c:388
+ ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
+ ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
+
+value changed: 0x00 -> 0x01
+
+Reported by Kernel Concurrency Sanitizer on:
+CPU: 1 PID: 27 Comm: kworker/u8:1 Tainted: G W 6.8.0-syzkaller-08073-g480e035fc4c7 #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
+Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
+
+Fixes: fa788d986a3a ("packet: add sockopt to ignore outgoing packets")
+Reported-by: syzbot+c669c1136495a2e7c31f@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/netdev/CANn89i+Z7MfbkBLOv=p7KZ7=K1rKHO4P1OL5LYDCtBiyqsa9oQ@mail.gmail.com/T/#t
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/dev.c | 2 +-
+ net/packet/af_packet.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 0619d2253aa24..0e2c433bebcd4 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2324,7 +2324,7 @@ void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev)
+ rcu_read_lock();
+ again:
+ list_for_each_entry_rcu(ptype, ptype_list, list) {
+- if (ptype->ignore_outgoing)
++ if (READ_ONCE(ptype->ignore_outgoing))
+ continue;
+
+ /* Never send packets back to the socket
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 6cc054dd53b6e..db5d16c5d5b11 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3951,7 +3951,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, sockptr_t optval,
+ if (val < 0 || val > 1)
+ return -EINVAL;
+
+- po->prot_hook.ignore_outgoing = !!val;
++ WRITE_ONCE(po->prot_hook.ignore_outgoing, !!val);
+ return 0;
+ }
+ case PACKET_TX_HAS_OFF:
+@@ -4083,7 +4083,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+ 0);
+ break;
+ case PACKET_IGNORE_OUTGOING:
+- val = po->prot_hook.ignore_outgoing;
++ val = READ_ONCE(po->prot_hook.ignore_outgoing);
+ break;
+ case PACKET_ROLLOVER_STATS:
+ if (!po->rollover)
+--
+2.43.0
+
--- /dev/null
+From e599b7a7d13263358930162cb3758d1b5d127d74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Mar 2024 13:44:34 -0700
+Subject: rcu: add a helper to report consolidated flavor QS
+
+From: Yan Zhai <yan@cloudflare.com>
+
+[ Upstream commit 1a77557d48cff187a169c2aec01c0dd78a5e7e50 ]
+
+When under heavy load, network processing can run CPU-bound for many
+tens of seconds. Even in preemptible kernels (non-RT kernel), this can
+block RCU Tasks grace periods, which can cause trace-event removal to
+take more than a minute, which is unacceptably long.
+
+This commit therefore creates a new helper function that passes through
+both RCU and RCU-Tasks quiescent states every 100 milliseconds. This
+hard-coded value suffices for current workloads.
+
+Suggested-by: Paul E. McKenney <paulmck@kernel.org>
+Reviewed-by: Jesper Dangaard Brouer <hawk@kernel.org>
+Signed-off-by: Yan Zhai <yan@cloudflare.com>
+Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
+Acked-by: Jesper Dangaard Brouer <hawk@kernel.org>
+Link: https://lore.kernel.org/r/90431d46ee112d2b0af04dbfe936faaca11810a5.1710877680.git.yan@cloudflare.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 00bf63122459 ("bpf: report RCU QS in cpumap kthread")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/rcupdate.h | 31 +++++++++++++++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+
+diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
+index 0122c03da24af..9db6710e6ee7b 100644
+--- a/include/linux/rcupdate.h
++++ b/include/linux/rcupdate.h
+@@ -226,6 +226,37 @@ do { \
+ cond_resched(); \
+ } while (0)
+
++/**
++ * rcu_softirq_qs_periodic - Report RCU and RCU-Tasks quiescent states
++ * @old_ts: jiffies at start of processing.
++ *
++ * This helper is for long-running softirq handlers, such as NAPI threads in
++ * networking. The caller should initialize the variable passed in as @old_ts
++ * at the beginning of the softirq handler. When invoked frequently, this macro
++ * will invoke rcu_softirq_qs() every 100 milliseconds thereafter, which will
++ * provide both RCU and RCU-Tasks quiescent states. Note that this macro
++ * modifies its old_ts argument.
++ *
++ * Because regions of code that have disabled softirq act as RCU read-side
++ * critical sections, this macro should be invoked with softirq (and
++ * preemption) enabled.
++ *
++ * The macro is not needed when CONFIG_PREEMPT_RT is defined. RT kernels would
++ * have more chance to invoke schedule() calls and provide necessary quiescent
++ * states. As a contrast, calling cond_resched() only won't achieve the same
++ * effect because cond_resched() does not provide RCU-Tasks quiescent states.
++ */
++#define rcu_softirq_qs_periodic(old_ts) \
++do { \
++ if (!IS_ENABLED(CONFIG_PREEMPT_RT) && \
++ time_after(jiffies, (old_ts) + HZ / 10)) { \
++ preempt_disable(); \
++ rcu_softirq_qs(); \
++ preempt_enable(); \
++ (old_ts) = jiffies; \
++ } \
++} while (0)
++
+ /*
+ * Infrastructure to implement the synchronize_() primitives in
+ * TREE_RCU and rcu_barrier_() primitives in TINY_RCU.
+--
+2.43.0
+
--- /dev/null
+From 9d8807122390ef41913cee8780aff025b25864bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Mar 2024 18:28:38 +0900
+Subject: rds: introduce acquire/release ordering in acquire/release_in_xmit()
+
+From: Yewon Choi <woni9911@gmail.com>
+
+[ Upstream commit 1422f28826d2a0c11e5240b3e951c9e214d8656e ]
+
+acquire/release_in_xmit() work as bit lock in rds_send_xmit(), so they
+are expected to ensure acquire/release memory ordering semantics.
+However, test_and_set_bit/clear_bit() don't imply such semantics, on
+top of this, following smp_mb__after_atomic() does not guarantee release
+ordering (memory barrier actually should be placed before clear_bit()).
+
+Instead, we use clear_bit_unlock/test_and_set_bit_lock() here.
+
+Fixes: 0f4b1c7e89e6 ("rds: fix rds_send_xmit() serialization")
+Fixes: 1f9ecd7eacfd ("RDS: Pass rds_conn_path to rds_send_xmit()")
+Signed-off-by: Yewon Choi <woni9911@gmail.com>
+Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
+Link: https://lore.kernel.org/r/ZfQUxnNTO9AJmzwc@libra05
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/send.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/net/rds/send.c b/net/rds/send.c
+index 65eeb82cb5de5..1923eaa91e939 100644
+--- a/net/rds/send.c
++++ b/net/rds/send.c
+@@ -103,13 +103,12 @@ EXPORT_SYMBOL_GPL(rds_send_path_reset);
+
+ static int acquire_in_xmit(struct rds_conn_path *cp)
+ {
+- return test_and_set_bit(RDS_IN_XMIT, &cp->cp_flags) == 0;
++ return test_and_set_bit_lock(RDS_IN_XMIT, &cp->cp_flags) == 0;
+ }
+
+ static void release_in_xmit(struct rds_conn_path *cp)
+ {
+- clear_bit(RDS_IN_XMIT, &cp->cp_flags);
+- smp_mb__after_atomic();
++ clear_bit_unlock(RDS_IN_XMIT, &cp->cp_flags);
+ /*
+ * We don't use wait_on_bit()/wake_up_bit() because our waking is in a
+ * hot path and finding waiters is very rare. We don't want to walk
+--
+2.43.0
+
--- /dev/null
+From 08755fbb4c3cfc23e658ffb3efa23aead0c2b103 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 May 2022 02:30:35 +0200
+Subject: regmap: Add missing map->bus check
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 5c422f0b970d287efa864b8390a02face404db5d ]
+
+The map->bus can be NULL here, add the missing NULL pointer check.
+
+Fixes: d77e745613680 ("regmap: Add bulk read/write callbacks into regmap_config")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Mark Brown <broonie@kernel.org>
+To: linux-kernel@vger.kernel.org
+Link: https://lore.kernel.org/r/20220509003035.225272-1-marex@denx.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index 2dfd6aa600450..a3c4086603a60 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -1796,7 +1796,7 @@ static int _regmap_raw_write_impl(struct regmap *map, unsigned int reg,
+ map->format.reg_bytes +
+ map->format.pad_bytes +
+ val_len);
+- else if (map->bus->gather_write)
++ else if (map->bus && map->bus->gather_write)
+ ret = map->bus->gather_write(map->bus_context, map->work_buf,
+ map->format.reg_bytes +
+ map->format.pad_bytes,
+--
+2.43.0
+
--- /dev/null
+From 0cf303022207e6a86537d22721bb6fcec14a4a45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Mar 2021 09:24:41 -0700
+Subject: remoteproc: Add new get_loaded_rsc_table() to rproc_ops
+
+From: Mathieu Poirier <mathieu.poirier@linaro.org>
+
+[ Upstream commit 1a631382be1d22ddab0582dae3498b3d28e2e44a ]
+
+Add a new get_loaded_rsc_table() operation in order to support
+scenarios where the remoteproc core has booted a remote processor
+and detaches from it. When re-attaching to the remote processor,
+the core needs to know where the resource table has been placed
+in memory.
+
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Reviewed-by: Arnaud Pouliquen <arnaud.pouliquen@st.com>
+Link: https://lore.kernel.org/r/20210312162453.1234145-6-mathieu.poirier@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Stable-dep-of: 32381bbccba4 ("remoteproc: stm32: Fix incorrect type in assignment for va")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/remoteproc_core.c | 32 ++++++++++++++++++++++++
+ drivers/remoteproc/remoteproc_internal.h | 10 ++++++++
+ include/linux/remoteproc.h | 6 ++++-
+ 3 files changed, 47 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
+index cc55ff0128cf2..a933e345683c4 100644
+--- a/drivers/remoteproc/remoteproc_core.c
++++ b/drivers/remoteproc/remoteproc_core.c
+@@ -1539,6 +1539,32 @@ static int rproc_fw_boot(struct rproc *rproc, const struct firmware *fw)
+ return ret;
+ }
+
++static int rproc_set_rsc_table(struct rproc *rproc)
++{
++ struct resource_table *table_ptr;
++ struct device *dev = &rproc->dev;
++ size_t table_sz;
++ int ret;
++
++ table_ptr = rproc_get_loaded_rsc_table(rproc, &table_sz);
++ if (!table_ptr) {
++ /* Not having a resource table is acceptable */
++ return 0;
++ }
++
++ if (IS_ERR(table_ptr)) {
++ ret = PTR_ERR(table_ptr);
++ dev_err(dev, "can't load resource table: %d\n", ret);
++ return ret;
++ }
++
++ rproc->cached_table = NULL;
++ rproc->table_ptr = table_ptr;
++ rproc->table_sz = table_sz;
++
++ return 0;
++}
++
+ /*
+ * Attach to remote processor - similar to rproc_fw_boot() but without
+ * the steps that deal with the firmware image.
+@@ -1558,6 +1584,12 @@ static int rproc_actuate(struct rproc *rproc)
+ return ret;
+ }
+
++ ret = rproc_set_rsc_table(rproc);
++ if (ret) {
++ dev_err(dev, "can't load resource table: %d\n", ret);
++ goto disable_iommu;
++ }
++
+ /* reset max_notifyid */
+ rproc->max_notifyid = -1;
+
+diff --git a/drivers/remoteproc/remoteproc_internal.h b/drivers/remoteproc/remoteproc_internal.h
+index c34002888d2c3..4f73aac7e60d1 100644
+--- a/drivers/remoteproc/remoteproc_internal.h
++++ b/drivers/remoteproc/remoteproc_internal.h
+@@ -177,6 +177,16 @@ struct resource_table *rproc_find_loaded_rsc_table(struct rproc *rproc,
+ return NULL;
+ }
+
++static inline
++struct resource_table *rproc_get_loaded_rsc_table(struct rproc *rproc,
++ size_t *size)
++{
++ if (rproc->ops->get_loaded_rsc_table)
++ return rproc->ops->get_loaded_rsc_table(rproc, size);
++
++ return NULL;
++}
++
+ static inline
+ bool rproc_u64_fit_in_size_t(u64 val)
+ {
+diff --git a/include/linux/remoteproc.h b/include/linux/remoteproc.h
+index 3fa3ba6498e87..2546758f13eb0 100644
+--- a/include/linux/remoteproc.h
++++ b/include/linux/remoteproc.h
+@@ -368,7 +368,9 @@ enum rsc_handling_status {
+ * RSC_HANDLED if resource was handled, RSC_IGNORED if not handled and a
+ * negative value on error
+ * @load_rsc_table: load resource table from firmware image
+- * @find_loaded_rsc_table: find the loaded resouce table
++ * @find_loaded_rsc_table: find the loaded resource table from firmware image
++ * @get_loaded_rsc_table: get resource table installed in memory
++ * by external entity
+ * @load: load firmware to memory, where the remote processor
+ * expects to find it
+ * @sanity_check: sanity check the fw image
+@@ -389,6 +391,8 @@ struct rproc_ops {
+ int offset, int avail);
+ struct resource_table *(*find_loaded_rsc_table)(
+ struct rproc *rproc, const struct firmware *fw);
++ struct resource_table *(*get_loaded_rsc_table)(
++ struct rproc *rproc, size_t *size);
+ int (*load)(struct rproc *rproc, const struct firmware *fw);
+ int (*sanity_check)(struct rproc *rproc, const struct firmware *fw);
+ u64 (*get_boot_addr)(struct rproc *rproc, const struct firmware *fw);
+--
+2.43.0
+
--- /dev/null
+From eb7a5ed5ad1fd50f57b40e1866c2089e1b13b0f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Nov 2020 00:36:30 +0100
+Subject: remoteproc: stm32: Constify st_rproc_ops
+
+From: Rikard Falkeborn <rikard.falkeborn@gmail.com>
+
+[ Upstream commit 0eee3d28ff6572f0e1afd41e863e44d396a308e2 ]
+
+The only usage of st_rproc_ops is to pass its address to rproc_alloc()
+which accepts a const pointer. Make it const to allow the compiler to
+put it in read-only memory.
+
+Acked-by: Arnaud Pouliquen <arnaud.pouliquen@st.com>
+Signed-off-by: Rikard Falkeborn <rikard.falkeborn@gmail.com>
+Link: https://lore.kernel.org/r/20201107233630.9728-3-rikard.falkeborn@gmail.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Stable-dep-of: 32381bbccba4 ("remoteproc: stm32: Fix incorrect type in assignment for va")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/stm32_rproc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/remoteproc/stm32_rproc.c b/drivers/remoteproc/stm32_rproc.c
+index df784fec124f6..5f12553f0b6d7 100644
+--- a/drivers/remoteproc/stm32_rproc.c
++++ b/drivers/remoteproc/stm32_rproc.c
+@@ -553,7 +553,7 @@ static void stm32_rproc_kick(struct rproc *rproc, int vqid)
+ }
+ }
+
+-static struct rproc_ops st_rproc_ops = {
++static const struct rproc_ops st_rproc_ops = {
+ .start = stm32_rproc_start,
+ .stop = stm32_rproc_stop,
+ .attach = stm32_rproc_attach,
+--
+2.43.0
+
--- /dev/null
+From 32a286c7562dab050f458dc466ffb1a1b49118f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jan 2024 14:53:12 +0100
+Subject: remoteproc: stm32: Fix incorrect type assignment returned by
+ stm32_rproc_get_loaded_rsc_tablef
+
+From: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
+
+[ Upstream commit c77b35ce66af25bdd6fde60b62e35b9b316ea5c2 ]
+
+The sparse tool complains about the remove of the _iomem attribute.
+
+stm32_rproc.c:660:17: warning: cast removes address space '__iomem' of expression
+
+Add '__force' to explicitly specify that the cast is intentional.
+This conversion is necessary to cast to addresses pointer,
+which are then managed by the remoteproc core as a pointer to a
+resource_table structure.
+
+Fixes: 8a471396d21c ("remoteproc: stm32: Move resource table setup to rproc_ops")
+Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
+Link: https://lore.kernel.org/r/20240117135312.3381936-3-arnaud.pouliquen@foss.st.com
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/stm32_rproc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/remoteproc/stm32_rproc.c b/drivers/remoteproc/stm32_rproc.c
+index d11949ae3ba0d..6e529ea05d3a8 100644
+--- a/drivers/remoteproc/stm32_rproc.c
++++ b/drivers/remoteproc/stm32_rproc.c
+@@ -617,7 +617,7 @@ stm32_rproc_get_loaded_rsc_table(struct rproc *rproc, size_t *table_sz)
+ done:
+ /* Assuming the resource table fits in 1kB is fair */
+ *table_sz = RSC_TBL_SIZE;
+- return (struct resource_table *)ddata->rsc_va;
++ return (__force struct resource_table *)ddata->rsc_va;
+ }
+
+ static const struct rproc_ops st_rproc_ops = {
+--
+2.43.0
+
--- /dev/null
+From 3751ecb30573bcc59895ea43e5e906b76be5b11a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jan 2024 14:53:11 +0100
+Subject: remoteproc: stm32: Fix incorrect type in assignment for va
+
+From: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
+
+[ Upstream commit 32381bbccba4c21145c571701f8f7fb1d9b3a92e ]
+
+The sparse tool complains about the attribute conversion between
+a _iomem void * and a void *:
+
+stm32_rproc.c:122:12: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *va @@ got void [noderef] __iomem * @@
+stm32_rproc.c:122:12: sparse: expected void *va
+stm32_rproc.c:122:12: sparse: got void [noderef] __iomem *
+
+Add '__force' to explicitly specify that the cast is intentional.
+This conversion is necessary to cast to virtual addresses pointer,used,
+by the remoteproc core.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202312150052.HCiNKlqB-lkp@intel.com/
+Fixes: 13140de09cc2 ("remoteproc: stm32: add an ST stm32_rproc driver")
+Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
+Link: https://lore.kernel.org/r/20240117135312.3381936-2-arnaud.pouliquen@foss.st.com
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/stm32_rproc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/remoteproc/stm32_rproc.c b/drivers/remoteproc/stm32_rproc.c
+index 8f7fb1baed10d..d11949ae3ba0d 100644
+--- a/drivers/remoteproc/stm32_rproc.c
++++ b/drivers/remoteproc/stm32_rproc.c
+@@ -118,7 +118,7 @@ static int stm32_rproc_mem_alloc(struct rproc *rproc,
+ void *va;
+
+ dev_dbg(dev, "map memory: %pad+%zx\n", &mem->dma, mem->len);
+- va = ioremap_wc(mem->dma, mem->len);
++ va = (__force void *)ioremap_wc(mem->dma, mem->len);
+ if (IS_ERR_OR_NULL(va)) {
+ dev_err(dev, "Unable to map memory region: %pad+0x%zx\n",
+ &mem->dma, mem->len);
+@@ -135,7 +135,7 @@ static int stm32_rproc_mem_release(struct rproc *rproc,
+ struct rproc_mem_entry *mem)
+ {
+ dev_dbg(rproc->dev.parent, "unmap memory: %pa\n", &mem->dma);
+- iounmap(mem->va);
++ iounmap((__force __iomem void *)mem->va);
+
+ return 0;
+ }
+--
+2.43.0
+
--- /dev/null
+From e918669be2074859541b077cb7b15f23e789db3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Mar 2021 09:24:42 -0700
+Subject: remoteproc: stm32: Move resource table setup to rproc_ops
+
+From: Mathieu Poirier <mathieu.poirier@linaro.org>
+
+[ Upstream commit 8a471396d21ca499d89d4071b2b670258f009ffa ]
+
+Move the setting of the resource table installed by an external
+entity to rproc_ops::get_loaded_rsc_table(). This is to support
+scenarios where a remote processor has been attached to but is
+detached at a later stage. To re-attach the remote processor,
+the address of the resource table needs to be available
+at a later time than the platform driver's probe() function.
+
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Reviewed-by: Arnaud Pouliquen <arnaud.pouliquen@st.com>
+Link: https://lore.kernel.org/r/20210312162453.1234145-7-mathieu.poirier@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Stable-dep-of: 32381bbccba4 ("remoteproc: stm32: Fix incorrect type in assignment for va")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/stm32_rproc.c | 141 +++++++++++++++----------------
+ 1 file changed, 68 insertions(+), 73 deletions(-)
+
+diff --git a/drivers/remoteproc/stm32_rproc.c b/drivers/remoteproc/stm32_rproc.c
+index 5f12553f0b6d7..b410684c3aa90 100644
+--- a/drivers/remoteproc/stm32_rproc.c
++++ b/drivers/remoteproc/stm32_rproc.c
+@@ -553,6 +553,73 @@ static void stm32_rproc_kick(struct rproc *rproc, int vqid)
+ }
+ }
+
++static int stm32_rproc_da_to_pa(struct rproc *rproc,
++ u64 da, phys_addr_t *pa)
++{
++ struct stm32_rproc *ddata = rproc->priv;
++ struct device *dev = rproc->dev.parent;
++ struct stm32_rproc_mem *p_mem;
++ unsigned int i;
++
++ for (i = 0; i < ddata->nb_rmems; i++) {
++ p_mem = &ddata->rmems[i];
++
++ if (da < p_mem->dev_addr ||
++ da >= p_mem->dev_addr + p_mem->size)
++ continue;
++
++ *pa = da - p_mem->dev_addr + p_mem->bus_addr;
++ dev_dbg(dev, "da %llx to pa %#x\n", da, *pa);
++
++ return 0;
++ }
++
++ dev_err(dev, "can't translate da %llx\n", da);
++
++ return -EINVAL;
++}
++
++static struct resource_table *
++stm32_rproc_get_loaded_rsc_table(struct rproc *rproc, size_t *table_sz)
++{
++ struct stm32_rproc *ddata = rproc->priv;
++ struct device *dev = rproc->dev.parent;
++ phys_addr_t rsc_pa;
++ u32 rsc_da;
++ int err;
++
++ /* The resource table has already been mapped, nothing to do */
++ if (ddata->rsc_va)
++ goto done;
++
++ err = regmap_read(ddata->rsctbl.map, ddata->rsctbl.reg, &rsc_da);
++ if (err) {
++ dev_err(dev, "failed to read rsc tbl addr\n");
++ return ERR_PTR(-EINVAL);
++ }
++
++ if (!rsc_da)
++ /* no rsc table */
++ return ERR_PTR(-ENOENT);
++
++ err = stm32_rproc_da_to_pa(rproc, rsc_da, &rsc_pa);
++ if (err)
++ return ERR_PTR(err);
++
++ ddata->rsc_va = devm_ioremap_wc(dev, rsc_pa, RSC_TBL_SIZE);
++ if (IS_ERR_OR_NULL(ddata->rsc_va)) {
++ dev_err(dev, "Unable to map memory region: %pa+%zx\n",
++ &rsc_pa, RSC_TBL_SIZE);
++ ddata->rsc_va = NULL;
++ return ERR_PTR(-ENOMEM);
++ }
++
++done:
++ /* Assuming the resource table fits in 1kB is fair */
++ *table_sz = RSC_TBL_SIZE;
++ return (struct resource_table *)ddata->rsc_va;
++}
++
+ static const struct rproc_ops st_rproc_ops = {
+ .start = stm32_rproc_start,
+ .stop = stm32_rproc_stop,
+@@ -561,6 +628,7 @@ static const struct rproc_ops st_rproc_ops = {
+ .load = rproc_elf_load_segments,
+ .parse_fw = stm32_rproc_parse_fw,
+ .find_loaded_rsc_table = rproc_elf_find_loaded_rsc_table,
++ .get_loaded_rsc_table = stm32_rproc_get_loaded_rsc_table,
+ .sanity_check = rproc_elf_sanity_check,
+ .get_boot_addr = rproc_elf_get_boot_addr,
+ };
+@@ -704,75 +772,6 @@ static int stm32_rproc_get_m4_status(struct stm32_rproc *ddata,
+ return regmap_read(ddata->m4_state.map, ddata->m4_state.reg, state);
+ }
+
+-static int stm32_rproc_da_to_pa(struct platform_device *pdev,
+- struct stm32_rproc *ddata,
+- u64 da, phys_addr_t *pa)
+-{
+- struct device *dev = &pdev->dev;
+- struct stm32_rproc_mem *p_mem;
+- unsigned int i;
+-
+- for (i = 0; i < ddata->nb_rmems; i++) {
+- p_mem = &ddata->rmems[i];
+-
+- if (da < p_mem->dev_addr ||
+- da >= p_mem->dev_addr + p_mem->size)
+- continue;
+-
+- *pa = da - p_mem->dev_addr + p_mem->bus_addr;
+- dev_dbg(dev, "da %llx to pa %#x\n", da, *pa);
+-
+- return 0;
+- }
+-
+- dev_err(dev, "can't translate da %llx\n", da);
+-
+- return -EINVAL;
+-}
+-
+-static int stm32_rproc_get_loaded_rsc_table(struct platform_device *pdev,
+- struct rproc *rproc,
+- struct stm32_rproc *ddata)
+-{
+- struct device *dev = &pdev->dev;
+- phys_addr_t rsc_pa;
+- u32 rsc_da;
+- int err;
+-
+- err = regmap_read(ddata->rsctbl.map, ddata->rsctbl.reg, &rsc_da);
+- if (err) {
+- dev_err(dev, "failed to read rsc tbl addr\n");
+- return err;
+- }
+-
+- if (!rsc_da)
+- /* no rsc table */
+- return 0;
+-
+- err = stm32_rproc_da_to_pa(pdev, ddata, rsc_da, &rsc_pa);
+- if (err)
+- return err;
+-
+- ddata->rsc_va = devm_ioremap_wc(dev, rsc_pa, RSC_TBL_SIZE);
+- if (IS_ERR_OR_NULL(ddata->rsc_va)) {
+- dev_err(dev, "Unable to map memory region: %pa+%zx\n",
+- &rsc_pa, RSC_TBL_SIZE);
+- ddata->rsc_va = NULL;
+- return -ENOMEM;
+- }
+-
+- /*
+- * The resource table is already loaded in device memory, no need
+- * to work with a cached table.
+- */
+- rproc->cached_table = NULL;
+- /* Assuming the resource table fits in 1kB is fair */
+- rproc->table_sz = RSC_TBL_SIZE;
+- rproc->table_ptr = (struct resource_table *)ddata->rsc_va;
+-
+- return 0;
+-}
+-
+ static int stm32_rproc_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+@@ -812,10 +811,6 @@ static int stm32_rproc_probe(struct platform_device *pdev)
+ ret = stm32_rproc_parse_memory_regions(rproc);
+ if (ret)
+ goto free_resources;
+-
+- ret = stm32_rproc_get_loaded_rsc_table(pdev, rproc, ddata);
+- if (ret)
+- goto free_resources;
+ }
+
+ rproc->has_iommu = false;
+--
+2.43.0
+
--- /dev/null
+From 2062555c96b42217a9be8ea75f485d302b30098a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jun 2023 12:45:42 +0200
+Subject: remoteproc: stm32: use correct format strings on 64-bit
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 03bd158e1535e68bcd2b1e095b0ebcad7c84bd20 ]
+
+With CONFIG_ARCH_STM32 making it into arch/arm64, a couple of format
+strings no longer work, since they rely on size_t being compatible
+with %x, or they print an 'int' using %z:
+
+drivers/remoteproc/stm32_rproc.c: In function 'stm32_rproc_mem_alloc':
+drivers/remoteproc/stm32_rproc.c:122:22: error: format '%x' expects argument of type 'unsigned int', but argument 5 has type 'size_t' {aka 'long unsigned int'} [-Werror=format=]
+drivers/remoteproc/stm32_rproc.c:122:40: note: format string is defined here
+ 122 | dev_dbg(dev, "map memory: %pa+%x\n", &mem->dma, mem->len);
+ | ~^
+ | |
+ | unsigned int
+ | %lx
+drivers/remoteproc/stm32_rproc.c:125:30: error: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'size_t' {aka 'long unsigned int'} [-Werror=format=]
+drivers/remoteproc/stm32_rproc.c:125:65: note: format string is defined here
+ 125 | dev_err(dev, "Unable to map memory region: %pa+%x\n",
+ | ~^
+ | |
+ | unsigned int
+ | %lx
+drivers/remoteproc/stm32_rproc.c: In function 'stm32_rproc_get_loaded_rsc_table':
+drivers/remoteproc/stm32_rproc.c:646:30: error: format '%zx' expects argument of type 'size_t', but argument 4 has type 'int' [-Werror=format=]
+drivers/remoteproc/stm32_rproc.c:646:66: note: format string is defined here
+ 646 | dev_err(dev, "Unable to map memory region: %pa+%zx\n",
+ | ~~^
+ | |
+ | long unsigned int
+ | %x
+
+Fix up all three instances to work across architectures, and enable
+compile testing for this driver to ensure it builds everywhere.
+
+Reviewed-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
+Acked-by: Randy Dunlap <rdunlap@infradead.org>
+Tested-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Stable-dep-of: 32381bbccba4 ("remoteproc: stm32: Fix incorrect type in assignment for va")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/Kconfig | 2 +-
+ drivers/remoteproc/stm32_rproc.c | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/remoteproc/Kconfig b/drivers/remoteproc/Kconfig
+index d99548fb5ddef..6dbf6ed10ea49 100644
+--- a/drivers/remoteproc/Kconfig
++++ b/drivers/remoteproc/Kconfig
+@@ -249,7 +249,7 @@ config ST_SLIM_REMOTEPROC
+
+ config STM32_RPROC
+ tristate "STM32 remoteproc support"
+- depends on ARCH_STM32
++ depends on ARCH_STM32 || COMPILE_TEST
+ depends on REMOTEPROC
+ select MAILBOX
+ help
+diff --git a/drivers/remoteproc/stm32_rproc.c b/drivers/remoteproc/stm32_rproc.c
+index b410684c3aa90..8f7fb1baed10d 100644
+--- a/drivers/remoteproc/stm32_rproc.c
++++ b/drivers/remoteproc/stm32_rproc.c
+@@ -117,10 +117,10 @@ static int stm32_rproc_mem_alloc(struct rproc *rproc,
+ struct device *dev = rproc->dev.parent;
+ void *va;
+
+- dev_dbg(dev, "map memory: %pa+%x\n", &mem->dma, mem->len);
++ dev_dbg(dev, "map memory: %pad+%zx\n", &mem->dma, mem->len);
+ va = ioremap_wc(mem->dma, mem->len);
+ if (IS_ERR_OR_NULL(va)) {
+- dev_err(dev, "Unable to map memory region: %pa+%x\n",
++ dev_err(dev, "Unable to map memory region: %pad+0x%zx\n",
+ &mem->dma, mem->len);
+ return -ENOMEM;
+ }
+@@ -608,7 +608,7 @@ stm32_rproc_get_loaded_rsc_table(struct rproc *rproc, size_t *table_sz)
+
+ ddata->rsc_va = devm_ioremap_wc(dev, rsc_pa, RSC_TBL_SIZE);
+ if (IS_ERR_OR_NULL(ddata->rsc_va)) {
+- dev_err(dev, "Unable to map memory region: %pa+%zx\n",
++ dev_err(dev, "Unable to map memory region: %pa+%x\n",
+ &rsc_pa, RSC_TBL_SIZE);
+ ddata->rsc_va = NULL;
+ return ERR_PTR(-ENOMEM);
+--
+2.43.0
+
--- /dev/null
+From b03a434a1e92825591d26829bbd6e846c580b2d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Feb 2024 21:02:58 -0800
+Subject: rtc: mt6397: select IRQ_DOMAIN instead of depending on it
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 544c42f798e1651dcb04fb0395219bf0f1c2607e ]
+
+IRQ_DOMAIN is a hidden (not user visible) symbol. Users cannot set
+it directly thru "make *config", so drivers should select it instead
+of depending on it if they need it.
+Relying on it being set for a dependency is risky.
+
+Consistently using "select" or "depends on" can also help reduce
+Kconfig circular dependency issues.
+
+Therefore, change the use of "depends on" for IRQ_DOMAIN to
+"select" for RTC_DRV_MT6397.
+
+Fixes: 04d3ba70a3c9 ("rtc: mt6397: add IRQ domain dependency")
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Eddie Huang <eddie.huang@mediatek.com>
+Cc: Sean Wang <sean.wang@mediatek.com>
+Cc: Matthias Brugger <matthias.bgg@gmail.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linux-mediatek@lists.infradead.org
+Cc: Alessandro Zummo <a.zummo@towertech.it>
+Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Cc: linux-rtc@vger.kernel.org
+Cc: Marc Zyngier <maz@kernel.org>
+Cc: Philipp Zabel <p.zabel@pengutronix.de>
+Cc: Peter Rosin <peda@axentia.se>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Link: https://lore.kernel.org/r/20240213050258.6167-1-rdunlap@infradead.org
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
+index 54cf5ec8f4019..8ddd334e049e1 100644
+--- a/drivers/rtc/Kconfig
++++ b/drivers/rtc/Kconfig
+@@ -1833,7 +1833,8 @@ config RTC_DRV_MT2712
+
+ config RTC_DRV_MT6397
+ tristate "MediaTek PMIC based RTC"
+- depends on MFD_MT6397 || (COMPILE_TEST && IRQ_DOMAIN)
++ depends on MFD_MT6397 || COMPILE_TEST
++ select IRQ_DOMAIN
+ help
+ This selects the MediaTek(R) RTC driver. RTC is part of MediaTek
+ MT6397 PMIC. You should enable MT6397 PMIC MFD before select
+--
+2.43.0
+
--- /dev/null
+From a1df3ffc09fd0f1feb8707e56c33917ce9e61c50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Mar 2024 12:31:52 +0100
+Subject: s390/vtime: fix average steal time calculation
+
+From: Mete Durlu <meted@linux.ibm.com>
+
+[ Upstream commit 367c50f78451d3bd7ad70bc5c89f9ba6dec46ca9 ]
+
+Current average steal timer calculation produces volatile and inflated
+values. The only user of this value is KVM so far and it uses that to
+decide whether or not to yield the vCPU which is seeing steal time.
+KVM compares average steal timer to a threshold and if the threshold
+is past then it does not allow CPU polling and yields it to host, else
+it keeps the CPU by polling.
+Since KVM's steal time threshold is very low by default (%10) it most
+likely is not effected much by the bloated average steal timer values
+because the operating region is pretty small. However there might be
+new users in the future who might rely on this number. Fix average
+steal timer calculation by changing the formula from:
+
+ avg_steal_timer = avg_steal_timer / 2 + steal_timer;
+
+to the following:
+
+ avg_steal_timer = (avg_steal_timer + steal_timer) / 2;
+
+This ensures that avg_steal_timer is actually a naive average of steal
+timer values. It now closely follows steal timer values but of course
+in a smoother manner.
+
+Fixes: 152e9b8676c6 ("s390/vtime: steal time exponential moving average")
+Signed-off-by: Mete Durlu <meted@linux.ibm.com>
+Acked-by: Heiko Carstens <hca@linux.ibm.com>
+Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/vtime.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/kernel/vtime.c b/arch/s390/kernel/vtime.c
+index 579ec3a8c816f..bd65ff88c5baa 100644
+--- a/arch/s390/kernel/vtime.c
++++ b/arch/s390/kernel/vtime.c
+@@ -214,13 +214,13 @@ void vtime_flush(struct task_struct *tsk)
+ virt_timer_expire();
+
+ steal = S390_lowcore.steal_timer;
+- avg_steal = S390_lowcore.avg_steal_timer / 2;
++ avg_steal = S390_lowcore.avg_steal_timer;
+ if ((s64) steal > 0) {
+ S390_lowcore.steal_timer = 0;
+ account_steal_time(cputime_to_nsecs(steal));
+ avg_steal += steal;
+ }
+- S390_lowcore.avg_steal_timer = avg_steal;
++ S390_lowcore.avg_steal_timer = avg_steal / 2;
+ }
+
+ /*
+--
+2.43.0
+
--- /dev/null
+From 9e51949a7041fdc345d54f7d348915f93a455056 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Oct 2020 02:27:11 -0700
+Subject: scsi: fc: Update formal FPIN descriptor definitions
+
+From: Shyam Sundar <ssundar@marvell.com>
+
+[ Upstream commit 874163aab75a6cd7422e71f1fbc6db12977fcf1d ]
+
+Add Fabric Performance Impact Notification (FPIN) descriptor definitions
+for the following FPINs:
+
+ - Delivery Notification Descriptor
+
+ - Peer Congestion Notification Descriptor
+
+ - Congestion Notification Descriptor
+
+Link: https://lore.kernel.org/r/20201021092715.22669-2-njavali@marvell.com
+Reviewed-by: James Smart <james.smart@broadcom.com>
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Shyam Sundar <ssundar@marvell.com>
+Signed-off-by: Nilesh Javali <njavali@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: 4a0e7f2decbf ("netfilter: nf_tables: do not compare internal table flags on updates")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/scsi/fc/fc_els.h | 114 +++++++++++++++++++++++++++++++++-
+ 1 file changed, 113 insertions(+), 1 deletion(-)
+
+diff --git a/include/uapi/scsi/fc/fc_els.h b/include/uapi/scsi/fc/fc_els.h
+index 8c704e510e398..91d4be9872203 100644
+--- a/include/uapi/scsi/fc/fc_els.h
++++ b/include/uapi/scsi/fc/fc_els.h
+@@ -916,7 +916,9 @@ enum fc_els_clid_ic {
+ ELS_CLID_IC_LIP = 8, /* receiving LIP */
+ };
+
+-
++/*
++ * Link Integrity event types
++ */
+ enum fc_fpin_li_event_types {
+ FPIN_LI_UNKNOWN = 0x0,
+ FPIN_LI_LINK_FAILURE = 0x1,
+@@ -943,6 +945,54 @@ enum fc_fpin_li_event_types {
+ { FPIN_LI_DEVICE_SPEC, "Device Specific" }, \
+ }
+
++/*
++ * Delivery event types
++ */
++enum fc_fpin_deli_event_types {
++ FPIN_DELI_UNKNOWN = 0x0,
++ FPIN_DELI_TIMEOUT = 0x1,
++ FPIN_DELI_UNABLE_TO_ROUTE = 0x2,
++ FPIN_DELI_DEVICE_SPEC = 0xF,
++};
++
++/*
++ * Initializer useful for decoding table.
++ * Please keep this in sync with the above definitions.
++ */
++#define FC_FPIN_DELI_EVT_TYPES_INIT { \
++ { FPIN_DELI_UNKNOWN, "Unknown" }, \
++ { FPIN_DELI_TIMEOUT, "Timeout" }, \
++ { FPIN_DELI_UNABLE_TO_ROUTE, "Unable to Route" }, \
++ { FPIN_DELI_DEVICE_SPEC, "Device Specific" }, \
++}
++
++/*
++ * Congestion event types
++ */
++enum fc_fpin_congn_event_types {
++ FPIN_CONGN_CLEAR = 0x0,
++ FPIN_CONGN_LOST_CREDIT = 0x1,
++ FPIN_CONGN_CREDIT_STALL = 0x2,
++ FPIN_CONGN_OVERSUBSCRIPTION = 0x3,
++ FPIN_CONGN_DEVICE_SPEC = 0xF,
++};
++
++/*
++ * Initializer useful for decoding table.
++ * Please keep this in sync with the above definitions.
++ */
++#define FC_FPIN_CONGN_EVT_TYPES_INIT { \
++ { FPIN_CONGN_CLEAR, "Clear" }, \
++ { FPIN_CONGN_LOST_CREDIT, "Lost Credit" }, \
++ { FPIN_CONGN_CREDIT_STALL, "Credit Stall" }, \
++ { FPIN_CONGN_OVERSUBSCRIPTION, "Oversubscription" }, \
++ { FPIN_CONGN_DEVICE_SPEC, "Device Specific" }, \
++}
++
++enum fc_fpin_congn_severity_types {
++ FPIN_CONGN_SEVERITY_WARNING = 0xF1,
++ FPIN_CONGN_SEVERITY_ERROR = 0xF7,
++};
+
+ /*
+ * Link Integrity Notification Descriptor
+@@ -974,6 +1024,68 @@ struct fc_fn_li_desc {
+ */
+ };
+
++/*
++ * Delivery Notification Descriptor
++ */
++struct fc_fn_deli_desc {
++ __be32 desc_tag; /* Descriptor Tag (0x00020002) */
++ __be32 desc_len; /* Length of Descriptor (in bytes).
++ * Size of descriptor excluding
++ * desc_tag and desc_len fields.
++ */
++ __be64 detecting_wwpn; /* Port Name that detected event */
++ __be64 attached_wwpn; /* Port Name of device attached to
++ * detecting Port Name
++ */
++ __be32 deli_reason_code;/* see enum fc_fpin_deli_event_types */
++};
++
++/*
++ * Peer Congestion Notification Descriptor
++ */
++struct fc_fn_peer_congn_desc {
++ __be32 desc_tag; /* Descriptor Tag (0x00020003) */
++ __be32 desc_len; /* Length of Descriptor (in bytes).
++ * Size of descriptor excluding
++ * desc_tag and desc_len fields.
++ */
++ __be64 detecting_wwpn; /* Port Name that detected event */
++ __be64 attached_wwpn; /* Port Name of device attached to
++ * detecting Port Name
++ */
++ __be16 event_type; /* see enum fc_fpin_congn_event_types */
++ __be16 event_modifier; /* Implementation specific value
++ * describing the event type
++ */
++ __be32 event_period; /* duration (ms) of the detected
++ * congestion event
++ */
++ __be32 pname_count; /* number of portname_list elements */
++ __be64 pname_list[0]; /* list of N_Port_Names accessible
++ * through the attached port
++ */
++};
++
++/*
++ * Congestion Notification Descriptor
++ */
++struct fc_fn_congn_desc {
++ __be32 desc_tag; /* Descriptor Tag (0x00020004) */
++ __be32 desc_len; /* Length of Descriptor (in bytes).
++ * Size of descriptor excluding
++ * desc_tag and desc_len fields.
++ */
++ __be16 event_type; /* see enum fc_fpin_congn_event_types */
++ __be16 event_modifier; /* Implementation specific value
++ * describing the event type
++ */
++ __be32 event_period; /* duration (ms) of the detected
++ * congestion event
++ */
++ __u8 severity; /* command */
++ __u8 resv[3]; /* reserved - must be zero */
++};
++
+ /*
+ * ELS_FPIN - Fabric Performance Impact Notification
+ */
+--
+2.43.0
+
--- /dev/null
+From 5812c796d4cd250ebbee0d457fb332aee0988958 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Feb 2024 17:04:57 +0200
+Subject: serial: 8250_exar: Don't remove GPIO device on suspend
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 73b5a5c00be39e23b194bad10e1ea8bb73eee176 ]
+
+It seems a copy&paste mistake that suspend callback removes the GPIO
+device. There is no counterpart of this action, means once suspended
+there is no more GPIO device available untile full unbind-bind cycle
+is performed. Remove suspicious GPIO device removal in suspend.
+
+Fixes: d0aeaa83f0b0 ("serial: exar: split out the exar code from 8250_pci")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20240219150627.2101198-2-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_exar.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c
+index 6e33c74e569f0..7c28d2752a4cd 100644
+--- a/drivers/tty/serial/8250/8250_exar.c
++++ b/drivers/tty/serial/8250/8250_exar.c
+@@ -688,6 +688,7 @@ static void exar_pci_remove(struct pci_dev *pcidev)
+ for (i = 0; i < priv->nr; i++)
+ serial8250_unregister_port(priv->line[i]);
+
++ /* Ensure that every init quirk is properly torn down */
+ if (priv->board->exit)
+ priv->board->exit(pcidev);
+ }
+@@ -702,10 +703,6 @@ static int __maybe_unused exar_suspend(struct device *dev)
+ if (priv->line[i] >= 0)
+ serial8250_suspend_port(priv->line[i]);
+
+- /* Ensure that every init quirk is properly torn down */
+- if (priv->board->exit)
+- priv->board->exit(pcidev);
+-
+ return 0;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From 1d2ce81b8623e985a80442371fe0120c4f5986ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jan 2024 10:22:01 -0500
+Subject: serial: max310x: fix syntax error in IRQ error message
+
+From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+
+[ Upstream commit 8ede8c6f474255b2213cccd7997b993272a8e2f9 ]
+
+Replace g with q.
+
+Helpful when grepping thru source code or logs for
+"request" keyword.
+
+Fixes: f65444187a66 ("serial: New serial driver MAX310X")
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+Link: https://lore.kernel.org/r/20240118152213.2644269-6-hugo@hugovil.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/max310x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
+index 2f88eae8a55a1..5570fd3b84e15 100644
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -1460,7 +1460,7 @@ static int max310x_probe(struct device *dev, const struct max310x_devtype *devty
+ if (!ret)
+ return 0;
+
+- dev_err(dev, "Unable to reguest IRQ %i\n", irq);
++ dev_err(dev, "Unable to request IRQ %i\n", irq);
+
+ out_uart:
+ for (i = 0; i < devtype->nr; i++) {
+--
+2.43.0
+
watchdog-stm32_iwdg-initialize-default-timeout.patch
nfs-fix-an-off-by-one-in-root_nfs_cat.patch
afs-revert-afs-hide-silly-rename-files-from-userspac.patch
+remoteproc-stm32-constify-st_rproc_ops.patch
+remoteproc-add-new-get_loaded_rsc_table-to-rproc_ops.patch
+remoteproc-stm32-move-resource-table-setup-to-rproc_.patch
+remoteproc-stm32-use-correct-format-strings-on-64-bi.patch
+remoteproc-stm32-fix-incorrect-type-in-assignment-fo.patch
+remoteproc-stm32-fix-incorrect-type-assignment-retur.patch
+tty-vt-fix-20-vs-0x20-typo-in-escsiignore.patch
+serial-max310x-fix-syntax-error-in-irq-error-message.patch
+tty-serial-samsung-fix-tx_empty-to-return-tiocser_te.patch
+kconfig-fix-infinite-loop-when-expanding-a-macro-at-.patch
+rtc-mt6397-select-irq_domain-instead-of-depending-on.patch
+serial-8250_exar-don-t-remove-gpio-device-on-suspend.patch
+staging-greybus-fix-get_channel_from_mode-failure-pa.patch
+usb-gadget-net2272-use-irqflags-in-the-call-to-net22.patch
+io_uring-don-t-save-restore-iowait-state.patch
+octeontx2-af-use-matching-wake_up-api-variant-in-cgx.patch
+s390-vtime-fix-average-steal-time-calculation.patch
+soc-fsl-dpio-fix-kcalloc-argument-order.patch
+hsr-fix-uninit-value-access-in-hsr_get_node.patch
+packet-annotate-data-races-around-ignore_outgoing.patch
+net-dsa-mt7530-prevent-possible-incorrect-xtal-frequ.patch
+wireguard-receive-annotate-data-race-around-receivin.patch
+rds-introduce-acquire-release-ordering-in-acquire-re.patch
+hsr-handle-failures-in-module-init.patch
+net-bnx2x-prevent-access-to-a-freed-page-in-page_poo.patch
+octeontx2-af-use-separate-handlers-for-interrupts.patch
+netfilter-nft_set_pipapo-release-elements-in-clone-o.patch
+scsi-fc-update-formal-fpin-descriptor-definitions.patch
+arm-dts-sun8i-h2-plus-bananapi-m2-zero-add-regulator.patch
+netfilter-nf_tables-do-not-compare-internal-table-fl.patch
+rcu-add-a-helper-to-report-consolidated-flavor-qs.patch
+bpf-report-rcu-qs-in-cpumap-kthread.patch
+spi-spi-mt65xx-fix-null-pointer-access-in-interrupt-.patch
+regmap-add-missing-map-bus-check.patch
--- /dev/null
+From 008c2058875943e1988fbe753c6552e5491fa622 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Feb 2024 20:34:36 +0100
+Subject: soc: fsl: dpio: fix kcalloc() argument order
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 72ebb41b88f9d7c10c5e159e0507074af0a22fe2 ]
+
+A previous bugfix added a call to kcalloc(), which starting in gcc-14
+causes a harmless warning about the argument order:
+
+drivers/soc/fsl/dpio/dpio-service.c: In function 'dpaa2_io_service_enqueue_multiple_desc_fq':
+drivers/soc/fsl/dpio/dpio-service.c:526:29: error: 'kcalloc' sizes specified with 'sizeof' in the earlier argument and not in the later argument [-Werror=calloc-transposed-args]
+ 526 | ed = kcalloc(sizeof(struct qbman_eq_desc), 32, GFP_KERNEL);
+ | ^~~~~~
+drivers/soc/fsl/dpio/dpio-service.c:526:29: note: earlier argument should specify number of elements, later size of each element
+
+Since the two are only multiplied, the order does not change the
+behavior, so just fix it now to shut up the compiler warning.
+
+Dmity independently came up with the same fix.
+
+Fixes: 5c4a5999b245 ("soc: fsl: dpio: avoid stack usage warning")
+Reported-by: Dmitry Antipov <dmantipov@yandex.ru>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/fsl/dpio/dpio-service.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/fsl/dpio/dpio-service.c b/drivers/soc/fsl/dpio/dpio-service.c
+index 779c319a4b820..6cdd2c517ba68 100644
+--- a/drivers/soc/fsl/dpio/dpio-service.c
++++ b/drivers/soc/fsl/dpio/dpio-service.c
+@@ -485,7 +485,7 @@ int dpaa2_io_service_enqueue_multiple_desc_fq(struct dpaa2_io *d,
+ struct qbman_eq_desc *ed;
+ int i, ret;
+
+- ed = kcalloc(sizeof(struct qbman_eq_desc), 32, GFP_KERNEL);
++ ed = kcalloc(32, sizeof(struct qbman_eq_desc), GFP_KERNEL);
+ if (!ed)
+ return -ENOMEM;
+
+--
+2.43.0
+
--- /dev/null
+From c11e65adb0a346f28a9435a8bd56f771b7989a6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Mar 2024 15:08:57 +0800
+Subject: spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
+
+From: Fei Shao <fshao@chromium.org>
+
+[ Upstream commit a20ad45008a7c82f1184dc6dee280096009ece55 ]
+
+The TX buffer in spi_transfer can be a NULL pointer, so the interrupt
+handler may end up writing to the invalid memory and cause crashes.
+
+Add a check to trans->tx_buf before using it.
+
+Fixes: 1ce24864bff4 ("spi: mediatek: Only do dma for 4-byte aligned buffers")
+Signed-off-by: Fei Shao <fshao@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://msgid.link/r/20240321070942.1587146-2-fshao@chromium.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-mt65xx.c | 22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c
+index 92a09dfb99a8e..0bcf4a28132ad 100644
+--- a/drivers/spi/spi-mt65xx.c
++++ b/drivers/spi/spi-mt65xx.c
+@@ -566,17 +566,19 @@ static irqreturn_t mtk_spi_interrupt(int irq, void *dev_id)
+ mdata->xfer_len = min(MTK_SPI_MAX_FIFO_SIZE, len);
+ mtk_spi_setup_packet(master);
+
+- cnt = mdata->xfer_len / 4;
+- iowrite32_rep(mdata->base + SPI_TX_DATA_REG,
+- trans->tx_buf + mdata->num_xfered, cnt);
++ if (trans->tx_buf) {
++ cnt = mdata->xfer_len / 4;
++ iowrite32_rep(mdata->base + SPI_TX_DATA_REG,
++ trans->tx_buf + mdata->num_xfered, cnt);
+
+- remainder = mdata->xfer_len % 4;
+- if (remainder > 0) {
+- reg_val = 0;
+- memcpy(®_val,
+- trans->tx_buf + (cnt * 4) + mdata->num_xfered,
+- remainder);
+- writel(reg_val, mdata->base + SPI_TX_DATA_REG);
++ remainder = mdata->xfer_len % 4;
++ if (remainder > 0) {
++ reg_val = 0;
++ memcpy(®_val,
++ trans->tx_buf + (cnt * 4) + mdata->num_xfered,
++ remainder);
++ writel(reg_val, mdata->base + SPI_TX_DATA_REG);
++ }
+ }
+
+ mtk_spi_enable_transfer(master);
+--
+2.43.0
+
--- /dev/null
+From 855e2bf2982d759719a1c4f6135b861e3d17ae73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Mar 2024 10:04:48 +0300
+Subject: staging: greybus: fix get_channel_from_mode() failure path
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 34164202a5827f60a203ca9acaf2d9f7d432aac8 ]
+
+The get_channel_from_mode() function is supposed to return the channel
+which matches the mode. But it has a bug where if it doesn't find a
+matching channel then it returns the last channel. It should return
+NULL instead.
+
+Also remove an unnecessary NULL check on "channel".
+
+Fixes: 2870b52bae4c ("greybus: lights: add lights implementation")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Rui Miguel Silva <rmfrfs@gmail.com>
+Reviewed-by: Alex Elder <elder@linaro.org>
+Link: https://lore.kernel.org/r/379c0cb4-39e0-4293-8a18-c7b1298e5420@moroto.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/greybus/light.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c
+index d2672b65c3f49..e59bb27236b9f 100644
+--- a/drivers/staging/greybus/light.c
++++ b/drivers/staging/greybus/light.c
+@@ -100,15 +100,15 @@ static struct led_classdev *get_channel_cdev(struct gb_channel *channel)
+ static struct gb_channel *get_channel_from_mode(struct gb_light *light,
+ u32 mode)
+ {
+- struct gb_channel *channel = NULL;
++ struct gb_channel *channel;
+ int i;
+
+ for (i = 0; i < light->channels_count; i++) {
+ channel = &light->channels[i];
+- if (channel && channel->mode == mode)
+- break;
++ if (channel->mode == mode)
++ return channel;
+ }
+- return channel;
++ return NULL;
+ }
+
+ static int __gb_lights_flash_intensity_set(struct gb_channel *channel,
+--
+2.43.0
+
--- /dev/null
+From 7a4d2287ff1ba9a934ab897a1998bdf4e865ae26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jan 2024 10:45:08 +0000
+Subject: tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT
+
+From: Tudor Ambarus <tudor.ambarus@linaro.org>
+
+[ Upstream commit 314c2b399288f0058a8c5b6683292cbde5f1531b ]
+
+The core expects for tx_empty() either TIOCSER_TEMT when the tx is
+empty or 0 otherwise. s3c24xx_serial_txempty_nofifo() might return
+0x4, and at least uart_get_lsr_info() tries to clear exactly
+TIOCSER_TEMT (BIT(1)). Fix tx_empty() to return TIOCSER_TEMT.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Reviewed-by: Sam Protsenko <semen.protsenko@linaro.org>
+Link: https://lore.kernel.org/r/20240119104526.1221243-2-tudor.ambarus@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/samsung_tty.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/tty/serial/samsung_tty.c b/drivers/tty/serial/samsung_tty.c
+index fa5b1321d9b15..5388eb7fa0f47 100644
+--- a/drivers/tty/serial/samsung_tty.c
++++ b/drivers/tty/serial/samsung_tty.c
+@@ -922,11 +922,10 @@ static unsigned int s3c24xx_serial_tx_empty(struct uart_port *port)
+ if ((ufstat & info->tx_fifomask) != 0 ||
+ (ufstat & info->tx_fifofull))
+ return 0;
+-
+- return 1;
++ return TIOCSER_TEMT;
+ }
+
+- return s3c24xx_serial_txempty_nofifo(port);
++ return s3c24xx_serial_txempty_nofifo(port) ? TIOCSER_TEMT : 0;
+ }
+
+ /* no modem control lines */
+--
+2.43.0
+
--- /dev/null
+From ebcf27ea07f34eed723c1a707529c28bb7ccfe8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jan 2024 12:03:17 +0100
+Subject: tty: vt: fix 20 vs 0x20 typo in EScsiignore
+
+From: Jiri Slaby (SUSE) <jirislaby@kernel.org>
+
+[ Upstream commit 0e6a92f67c8a94707f7bb27ac29e2bdf3e7c167d ]
+
+The if (c >= 20 && c <= 0x3f) test added in commit 7a99565f8732 is
+wrong. 20 is DC4 in ascii and it makes no sense to consider that as the
+bottom limit. Instead, it should be 0x20 as in the other test in
+the commit above. This is supposed to NOT change anything as we handle
+interesting 20-0x20 asciis far before this if.
+
+So for sakeness, change to 0x20 (which is SPACE).
+
+Signed-off-by: "Jiri Slaby (SUSE)" <jirislaby@kernel.org>
+Fixes: 7a99565f8732 ("vt: ignore csi sequences with intermediate characters.")
+Cc: Martin Hostettler <textshell@uchuujin.de>
+Link: https://lore.kernel.org/all/ZaP45QY2WEsDqoxg@neutronstar.dyndns.org/
+Tested-by: Helge Deller <deller@gmx.de> # parisc STI console
+Link: https://lore.kernel.org/r/20240122110401.7289-4-jirislaby@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/vt/vt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 0252c0562dbc8..df645d127e401 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -2516,7 +2516,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c)
+ }
+ return;
+ case EScsiignore:
+- if (c >= 20 && c <= 0x3f)
++ if (c >= 0x20 && c <= 0x3f)
+ return;
+ vc->vc_state = ESnormal;
+ return;
+--
+2.43.0
+
--- /dev/null
+From 7e66f8e7f257f6990bab7945869dc5ee1ffe5f0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 18:17:34 +0000
+Subject: usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 600556809f04eb3bbccd05218215dcd7b285a9a9 ]
+
+Currently the variable irqflags is being set but is not being used,
+it appears it should be used in the call to net2272_probe_fin
+rather than IRQF_TRIGGER_LOW being used. Kudos to Uwe Kleine-König
+for suggesting the fix.
+
+Cleans up clang scan build warning:
+drivers/usb/gadget/udc/net2272.c:2610:15: warning: variable 'irqflags'
+set but not used [-Wunused-but-set-variable]
+
+Fixes: ceb80363b2ec ("USB: net2272: driver for PLX NET2272 USB device controller")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/20240307181734.2034407-1-colin.i.king@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/net2272.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/udc/net2272.c b/drivers/usb/gadget/udc/net2272.c
+index 23a735641c3df..8c56efe6abc49 100644
+--- a/drivers/usb/gadget/udc/net2272.c
++++ b/drivers/usb/gadget/udc/net2272.c
+@@ -2636,7 +2636,7 @@ net2272_plat_probe(struct platform_device *pdev)
+ goto err_req;
+ }
+
+- ret = net2272_probe_fin(dev, IRQF_TRIGGER_LOW);
++ ret = net2272_probe_fin(dev, irqflags);
+ if (ret)
+ goto err_io;
+
+--
+2.43.0
+
--- /dev/null
+From 02d5889db6b6098487b9128848e29200c1fa470d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Mar 2024 16:49:06 -0600
+Subject: wireguard: receive: annotate data-race around
+ receiving_counter.counter
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit bba045dc4d996d03dce6fe45726e78a1a1f6d4c3 ]
+
+Syzkaller with KCSAN identified a data-race issue when accessing
+keypair->receiving_counter.counter. Use READ_ONCE() and WRITE_ONCE()
+annotations to mark the data race as intentional.
+
+ BUG: KCSAN: data-race in wg_packet_decrypt_worker / wg_packet_rx_poll
+
+ write to 0xffff888107765888 of 8 bytes by interrupt on cpu 0:
+ counter_validate drivers/net/wireguard/receive.c:321 [inline]
+ wg_packet_rx_poll+0x3ac/0xf00 drivers/net/wireguard/receive.c:461
+ __napi_poll+0x60/0x3b0 net/core/dev.c:6536
+ napi_poll net/core/dev.c:6605 [inline]
+ net_rx_action+0x32b/0x750 net/core/dev.c:6738
+ __do_softirq+0xc4/0x279 kernel/softirq.c:553
+ do_softirq+0x5e/0x90 kernel/softirq.c:454
+ __local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381
+ __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]
+ _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210
+ spin_unlock_bh include/linux/spinlock.h:396 [inline]
+ ptr_ring_consume_bh include/linux/ptr_ring.h:367 [inline]
+ wg_packet_decrypt_worker+0x6c5/0x700 drivers/net/wireguard/receive.c:499
+ process_one_work kernel/workqueue.c:2633 [inline]
+ ...
+
+ read to 0xffff888107765888 of 8 bytes by task 3196 on cpu 1:
+ decrypt_packet drivers/net/wireguard/receive.c:252 [inline]
+ wg_packet_decrypt_worker+0x220/0x700 drivers/net/wireguard/receive.c:501
+ process_one_work kernel/workqueue.c:2633 [inline]
+ process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2706
+ worker_thread+0x525/0x730 kernel/workqueue.c:2787
+ ...
+
+Fixes: a9e90d9931f3 ("wireguard: noise: separate receive counter from send counter")
+Reported-by: syzbot+d1de830e4ecdaac83d89@syzkaller.appspotmail.com
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireguard/receive.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireguard/receive.c b/drivers/net/wireguard/receive.c
+index d38b24339a1f9..ed274e9bdf3ce 100644
+--- a/drivers/net/wireguard/receive.c
++++ b/drivers/net/wireguard/receive.c
+@@ -258,7 +258,7 @@ static bool decrypt_packet(struct sk_buff *skb, struct noise_keypair *keypair)
+
+ if (unlikely(!READ_ONCE(keypair->receiving.is_valid) ||
+ wg_birthdate_has_expired(keypair->receiving.birthdate, REJECT_AFTER_TIME) ||
+- keypair->receiving_counter.counter >= REJECT_AFTER_MESSAGES)) {
++ READ_ONCE(keypair->receiving_counter.counter) >= REJECT_AFTER_MESSAGES)) {
+ WRITE_ONCE(keypair->receiving.is_valid, false);
+ return false;
+ }
+@@ -325,7 +325,7 @@ static bool counter_validate(struct noise_replay_counter *counter, u64 their_cou
+ for (i = 1; i <= top; ++i)
+ counter->backtrack[(i + index_current) &
+ ((COUNTER_BITS_TOTAL / BITS_PER_LONG) - 1)] = 0;
+- counter->counter = their_counter;
++ WRITE_ONCE(counter->counter, their_counter);
+ }
+
+ index &= (COUNTER_BITS_TOTAL / BITS_PER_LONG) - 1;
+@@ -470,7 +470,7 @@ int wg_packet_rx_poll(struct napi_struct *napi, int budget)
+ net_dbg_ratelimited("%s: Packet has invalid nonce %llu (max %llu)\n",
+ peer->device->dev->name,
+ PACKET_CB(skb)->nonce,
+- keypair->receiving_counter.counter);
++ READ_ONCE(keypair->receiving_counter.counter));
+ goto next;
+ }
+
+--
+2.43.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
