--- /dev/null
+From 6b4f1447273591251c6d2dcf7ce1edbb9d3395c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Mar 2023 21:23:09 +0800
+Subject: ACPI: tools: pfrut: Check if the input of level and type is in the
+ right numeric range
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chen Yu <yu.c.chen@intel.com>
+
+[ Upstream commit 0bc23d8b2237a104d7f8379d687aa4cb82e2968b ]
+
+The user provides arbitrary non-numeic value to level and type,
+which could bring unexpected behavior. In this case the expected
+behavior would be to throw an error.
+
+ pfrut -h
+usage: pfrut [OPTIONS]
+code injection:
+-l, --load
+-s, --stage
+-a, --activate
+-u, --update [stage and activate]
+-q, --query
+-d, --revid
+update telemetry:
+-G, --getloginfo
+-T, --type(0:execution, 1:history)
+-L, --level(0, 1, 2, 4)
+-R, --read
+-D, --revid log
+
+ pfrut -T A
+ pfrut -G
+log_level:0
+log_type:0
+log_revid:2
+max_data_size:65536
+chunk1_size:0
+chunk2_size:1530
+rollover_cnt:0
+reset_cnt:17
+
+Fix this by restricting the input to be in the expected range.
+
+Reported-by: Hariganesh Govindarajulu <hariganesh.govindarajulu@intel.com>
+Suggested-by: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Signed-off-by: Chen Yu <yu.c.chen@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/acpi/tools/pfrut/pfrut.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/tools/power/acpi/tools/pfrut/pfrut.c b/tools/power/acpi/tools/pfrut/pfrut.c
+index 52aa0351533c3..388c9e3ad0407 100644
+--- a/tools/power/acpi/tools/pfrut/pfrut.c
++++ b/tools/power/acpi/tools/pfrut/pfrut.c
+@@ -97,7 +97,7 @@ static struct option long_options[] = {
+ static void parse_options(int argc, char **argv)
+ {
+ int option_index = 0;
+- char *pathname;
++ char *pathname, *endptr;
+ int opt;
+
+ pathname = strdup(argv[0]);
+@@ -125,11 +125,23 @@ static void parse_options(int argc, char **argv)
+ log_getinfo = 1;
+ break;
+ case 'T':
+- log_type = atoi(optarg);
++ log_type = strtol(optarg, &endptr, 0);
++ if (*endptr || (log_type != 0 && log_type != 1)) {
++ printf("Number expected: type(0:execution, 1:history) - Quit.\n");
++ exit(1);
++ }
++
+ set_log_type = 1;
+ break;
+ case 'L':
+- log_level = atoi(optarg);
++ log_level = strtol(optarg, &endptr, 0);
++ if (*endptr ||
++ (log_level != 0 && log_level != 1 &&
++ log_level != 2 && log_level != 4)) {
++ printf("Number expected: level(0, 1, 2, 4) - Quit.\n");
++ exit(1);
++ }
++
+ set_log_level = 1;
+ break;
+ case 'R':
+--
+2.39.2
+
--- /dev/null
+From d8432d1284945b7c8dee16105a79e0797ec43a2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Mar 2023 17:33:00 +0800
+Subject: ACPI: video: Add backlight=native DMI quirk for Dell Vostro 15 3535
+
+From: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+
+[ Upstream commit 89b0411481967a2e8c91190a211a359966cfcf4b ]
+
+Sometimes the system boots up with a acpi_video0 backlight interface
+which doesn't work. So add Dell Vostro 15 3535 into the
+video_detect_dmi_table to set it to native explicitly.
+
+Signed-off-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+Signed-off-by: Rafael J. Wysocki <rjw@rjwysocki.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/video_detect.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index 710ac640267dd..14d6d81e536fe 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -716,6 +716,13 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "Dell G15 5515"),
+ },
+ },
++ {
++ .callback = video_detect_force_native,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 15 3535"),
++ },
++ },
+
+ /*
+ * Desktops which falsely report a backlight and which our heuristics
+--
+2.39.2
+
--- /dev/null
+From f88a32f9eefae44d6c903f12bb48ad06846bf0ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Mar 2023 11:04:35 +0100
+Subject: ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 7 B1-750
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit a5cb0695c5f0ac2ab0cedf2c1c0d75826cb73448 ]
+
+The Acer Iconia One 7 B1-750 is a x86 tablet which ships with Android x86
+as factory OS. The Android x86 kernel fork ignores I2C devices described
+in the DSDT, except for the PMIC and Audio codecs.
+
+As usual the Acer Iconia One 7 B1-750's DSDT contains a bunch of extra I2C
+devices which are not actually there, causing various resource conflicts.
+Add an ACPI_QUIRK_SKIP_I2C_CLIENTS quirk for the Acer Iconia One 7 B1-750
+to the acpi_quirk_skip_dmi_ids table to woraround this.
+
+The DSDT also contains broken ACPI GPIO event handlers, disable those too.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rjw@rjwysocki.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/x86/utils.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c
+index 4bf57cce30bbf..b2b0e2701333a 100644
+--- a/drivers/acpi/x86/utils.c
++++ b/drivers/acpi/x86/utils.c
+@@ -280,6 +280,16 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = {
+ * need the x86-android-tablets module to properly work.
+ */
+ #if IS_ENABLED(CONFIG_X86_ANDROID_TABLETS)
++ {
++ /* Acer Iconia One 7 B1-750 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Insyde"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "VESPA2"),
++ },
++ .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS |
++ ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY |
++ ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS),
++ },
+ {
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+--
+2.39.2
+
--- /dev/null
+From a96f2e9f8d748ba2cda5b4d8d3bc29946a0a9e9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Mar 2023 11:04:36 +0100
+Subject: ACPI: x86: Add skip i2c clients quirk for Lenovo Yoga Book X90
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 1a1e7540cf501dd5c8b57a577a155cdd13c7e202 ]
+
+The Lenovo Yoga Book X90 is a x86 tablet which ships with Android x86
+as factory OS. The Android x86 kernel fork ignores I2C devices described
+in the DSDT, except for the PMIC and Audio codecs.
+
+As usual the Lenovo Yoga Book X90's DSDT contains a bunch of extra I2C
+devices which are not actually there, causing various resource conflicts.
+Add an ACPI_QUIRK_SKIP_I2C_CLIENTS quirk for the Lenovo Yoga Book X90
+to the acpi_quirk_skip_dmi_ids table to woraround this.
+
+The DSDT also contains broken ACPI GPIO event handlers, disable those too.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rjw@rjwysocki.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/x86/utils.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c
+index b2b0e2701333a..da5727069d851 100644
+--- a/drivers/acpi/x86/utils.c
++++ b/drivers/acpi/x86/utils.c
+@@ -300,6 +300,17 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = {
+ ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY |
+ ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS),
+ },
++ {
++ /* Lenovo Yoga Book X90F/L */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "CHERRYVIEW D1 PLATFORM"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "YETI-11"),
++ },
++ .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS |
++ ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY |
++ ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS),
++ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+--
+2.39.2
+
--- /dev/null
+From db8d159778bbd2dbe831dcc5a525315412b13c84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Mar 2023 11:04:34 +0100
+Subject: ACPI: x86: Introduce an acpi_quirk_skip_gpio_event_handlers() helper
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 5adc409340b1fc82bc1175e602d14ac82ac685e3 ]
+
+x86 ACPI boards which ship with only Android as their factory image usually
+have pretty broken ACPI tables, relying on everything being hardcoded in
+the factory kernel image and often disabling parts of the ACPI enumeration
+kernel code to avoid the broken tables causing issues.
+
+Part of this broken ACPI code is that sometimes these boards have _AEI
+ACPI GPIO event handlers which are broken.
+
+So far this has been dealt with in the platform/x86/x86-android-tablets.c
+module, which contains various workarounds for these devices, by it calling
+acpi_gpiochip_free_interrupts() on gpiochip-s with troublesome handlers to
+disable the handlers.
+
+But in some cases this is too late, if the handlers are of the edge type
+then gpiolib-acpi.c's code will already have run them at boot.
+This can cause issues such as GPIOs ending up as owned by "ACPI:OpRegion",
+making them unavailable for drivers which actually need them.
+
+Boards with these broken ACPI tables are already listed in
+drivers/acpi/x86/utils.c for e.g. acpi_quirk_skip_i2c_client_enumeration().
+Extend the quirks mechanism for a new acpi_quirk_skip_gpio_event_handlers()
+helper, this re-uses the DMI-ids rather then having to duplicate the same
+DMI table in gpiolib-acpi.c .
+
+Also add the new ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS quirk to existing
+boards with troublesome ACPI gpio event handlers, so that the current
+acpi_gpiochip_free_interrupts() hack can be removed from
+x86-android-tablets.c .
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Rafael J. Wysocki <rjw@rjwysocki.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/x86/utils.c | 24 +++++++++++++++++++++---
+ drivers/gpio/gpiolib-acpi.c | 3 +++
+ include/acpi/acpi_bus.h | 5 +++++
+ 3 files changed, 29 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/acpi/x86/utils.c b/drivers/acpi/x86/utils.c
+index e45285d4e62a4..4bf57cce30bbf 100644
+--- a/drivers/acpi/x86/utils.c
++++ b/drivers/acpi/x86/utils.c
+@@ -251,6 +251,7 @@ bool force_storage_d3(void)
+ #define ACPI_QUIRK_UART1_TTY_UART2_SKIP BIT(1)
+ #define ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY BIT(2)
+ #define ACPI_QUIRK_USE_ACPI_AC_AND_BATTERY BIT(3)
++#define ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS BIT(4)
+
+ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = {
+ /*
+@@ -286,7 +287,8 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = {
+ },
+ .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS |
+ ACPI_QUIRK_UART1_TTY_UART2_SKIP |
+- ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY),
++ ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY |
++ ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS),
+ },
+ {
+ .matches = {
+@@ -294,7 +296,8 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "TF103C"),
+ },
+ .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS |
+- ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY),
++ ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY |
++ ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS),
+ },
+ {
+ /* Lenovo Yoga Tablet 2 1050F/L */
+@@ -336,7 +339,8 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "M890BAP"),
+ },
+ .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS |
+- ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY),
++ ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY |
++ ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS),
+ },
+ {
+ /* Whitelabel (sold as various brands) TM800A550L */
+@@ -413,6 +417,20 @@ int acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *s
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(acpi_quirk_skip_serdev_enumeration);
++
++bool acpi_quirk_skip_gpio_event_handlers(void)
++{
++ const struct dmi_system_id *dmi_id;
++ long quirks;
++
++ dmi_id = dmi_first_match(acpi_quirk_skip_dmi_ids);
++ if (!dmi_id)
++ return false;
++
++ quirks = (unsigned long)dmi_id->driver_data;
++ return (quirks & ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS);
++}
++EXPORT_SYMBOL_GPL(acpi_quirk_skip_gpio_event_handlers);
+ #endif
+
+ /* Lists of PMIC ACPI HIDs with an (often better) native charger driver */
+diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
+index 34ff048e70d0e..7c9175619a1dc 100644
+--- a/drivers/gpio/gpiolib-acpi.c
++++ b/drivers/gpio/gpiolib-acpi.c
+@@ -536,6 +536,9 @@ void acpi_gpiochip_request_interrupts(struct gpio_chip *chip)
+ if (ACPI_FAILURE(status))
+ return;
+
++ if (acpi_quirk_skip_gpio_event_handlers())
++ return;
++
+ acpi_walk_resources(handle, METHOD_NAME__AEI,
+ acpi_gpiochip_alloc_event, acpi_gpio);
+
+diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
+index 0584e9f6e3397..57acb895c0381 100644
+--- a/include/acpi/acpi_bus.h
++++ b/include/acpi/acpi_bus.h
+@@ -657,6 +657,7 @@ static inline bool acpi_quirk_skip_acpi_ac_and_battery(void)
+ #if IS_ENABLED(CONFIG_X86_ANDROID_TABLETS)
+ bool acpi_quirk_skip_i2c_client_enumeration(struct acpi_device *adev);
+ int acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *skip);
++bool acpi_quirk_skip_gpio_event_handlers(void);
+ #else
+ static inline bool acpi_quirk_skip_i2c_client_enumeration(struct acpi_device *adev)
+ {
+@@ -668,6 +669,10 @@ acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *skip)
+ *skip = false;
+ return 0;
+ }
++static inline bool acpi_quirk_skip_gpio_event_handlers(void)
++{
++ return false;
++}
+ #endif
+
+ #ifdef CONFIG_PM
+--
+2.39.2
+
--- /dev/null
+From 04e6c2e59ea6e3e9f44c068d6409b6c81a52a00a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 00:49:24 +0000
+Subject: ALSA: asihpi: check pao in control_message()
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 9026c0bf233db53b86f74f4c620715e94eb32a09 ]
+
+control_message() might be called with pao = NULL.
+Here indicates control_message() as sample.
+
+(B) static void control_message(struct hpi_adapter_obj *pao, ...)
+ { ^^^
+ struct hpi_hw_obj *phw = pao->priv;
+ ... ^^^
+ }
+
+(A) void _HPI_6205(struct hpi_adapter_obj *pao, ...)
+ { ^^^
+ ...
+ case HPI_OBJ_CONTROL:
+(B) control_message(pao, phm, phr);
+ break; ^^^
+ ...
+ }
+
+ void HPI_6205(...)
+ {
+ ...
+(A) _HPI_6205(NULL, phm, phr);
+ ... ^^^^
+ }
+
+Therefore, We will get too many warning via cppcheck, like below
+
+ sound/pci/asihpi/hpi6205.c:238:27: warning: Possible null pointer dereference: pao [nullPointer]
+ struct hpi_hw_obj *phw = pao->priv;
+ ^
+ sound/pci/asihpi/hpi6205.c:433:13: note: Calling function '_HPI_6205', 1st argument 'NULL' value is 0
+ _HPI_6205(NULL, phm, phr);
+ ^
+ sound/pci/asihpi/hpi6205.c:401:20: note: Calling function 'control_message', 1st argument 'pao' value is 0
+ control_message(pao, phm, phr);
+ ^
+Set phr->error like many functions doing, and don't call _HPI_6205()
+with NULL.
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/87ttypeaqz.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/asihpi/hpi6205.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/pci/asihpi/hpi6205.c b/sound/pci/asihpi/hpi6205.c
+index 27e11b5f70b97..c7d7eff86727f 100644
+--- a/sound/pci/asihpi/hpi6205.c
++++ b/sound/pci/asihpi/hpi6205.c
+@@ -430,7 +430,7 @@ void HPI_6205(struct hpi_message *phm, struct hpi_response *phr)
+ pao = hpi_find_adapter(phm->adapter_index);
+ } else {
+ /* subsys messages don't address an adapter */
+- _HPI_6205(NULL, phm, phr);
++ phr->error = HPI_ERROR_INVALID_OBJ_INDEX;
+ return;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 821f946d3b164a33aea991d2b98c663bde6396fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 00:50:28 +0000
+Subject: ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 98e5eb110095ec77cb6d775051d181edbf9cd3cf ]
+
+tuning_ctl_set() might have buffer overrun at (X) if it didn't break
+from loop by matching (A).
+
+ static int tuning_ctl_set(...)
+ {
+ for (i = 0; i < TUNING_CTLS_COUNT; i++)
+(A) if (nid == ca0132_tuning_ctls[i].nid)
+ break;
+
+ snd_hda_power_up(...);
+(X) dspio_set_param(..., ca0132_tuning_ctls[i].mid, ...);
+ snd_hda_power_down(...); ^
+
+ return 1;
+ }
+
+We will get below error by cppcheck
+
+ sound/pci/hda/patch_ca0132.c:4229:2: note: After for loop, i has value 12
+ for (i = 0; i < TUNING_CTLS_COUNT; i++)
+ ^
+ sound/pci/hda/patch_ca0132.c:4234:43: note: Array index out of bounds
+ dspio_set_param(codec, ca0132_tuning_ctls[i].mid, 0x20,
+ ^
+This patch cares non match case.
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/87sfe9eap7.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_ca0132.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index acde4cd58785e..099722ebaed83 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -4228,8 +4228,10 @@ static int tuning_ctl_set(struct hda_codec *codec, hda_nid_t nid,
+
+ for (i = 0; i < TUNING_CTLS_COUNT; i++)
+ if (nid == ca0132_tuning_ctls[i].nid)
+- break;
++ goto found;
+
++ return -EINVAL;
++found:
+ snd_hda_power_up(codec);
+ dspio_set_param(codec, ca0132_tuning_ctls[i].mid, 0x20,
+ ca0132_tuning_ctls[i].req,
+--
+2.39.2
+
--- /dev/null
+From c390ddb8655532d0a9f1b85dff46dd42a64042da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Mar 2023 13:37:02 +0530
+Subject: ASoC: codecs: tx-macro: Fix for KASAN: slab-out-of-bounds
+
+From: Ravulapati Vishnu Vardhan Rao <quic_visr@quicinc.com>
+
+[ Upstream commit e5e7e398f6bb7918dab0612eb6991f7bae95520d ]
+
+When we run syzkaller we get below Out of Bound.
+ "KASAN: slab-out-of-bounds Read in regcache_flat_read"
+
+ Below is the backtrace of the issue:
+
+ dump_backtrace+0x0/0x4c8
+ show_stack+0x34/0x44
+ dump_stack_lvl+0xd8/0x118
+ print_address_description+0x30/0x2d8
+ kasan_report+0x158/0x198
+ __asan_report_load4_noabort+0x44/0x50
+ regcache_flat_read+0x10c/0x110
+ regcache_read+0xf4/0x180
+ _regmap_read+0xc4/0x278
+ _regmap_update_bits+0x130/0x290
+ regmap_update_bits_base+0xc0/0x15c
+ snd_soc_component_update_bits+0xa8/0x22c
+ snd_soc_component_write_field+0x68/0xd4
+ tx_macro_digital_mute+0xec/0x140
+
+ Actually There is no need to have decimator with 32 bits.
+ By limiting the variable with short type u8 issue is resolved.
+
+Signed-off-by: Ravulapati Vishnu Vardhan Rao <quic_visr@quicinc.com>
+Link: https://lore.kernel.org/r/20230304080702.609-1-quic_visr@quicinc.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/lpass-tx-macro.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c
+index 2449a2df66df0..8facdb922f076 100644
+--- a/sound/soc/codecs/lpass-tx-macro.c
++++ b/sound/soc/codecs/lpass-tx-macro.c
+@@ -242,7 +242,7 @@ enum {
+
+ struct tx_mute_work {
+ struct tx_macro *tx;
+- u32 decimator;
++ u8 decimator;
+ struct delayed_work dwork;
+ };
+
+@@ -635,7 +635,7 @@ static int tx_macro_mclk_enable(struct tx_macro *tx,
+ return 0;
+ }
+
+-static bool is_amic_enabled(struct snd_soc_component *component, int decimator)
++static bool is_amic_enabled(struct snd_soc_component *component, u8 decimator)
+ {
+ u16 adc_mux_reg, adc_reg, adc_n;
+
+@@ -849,7 +849,7 @@ static int tx_macro_enable_dec(struct snd_soc_dapm_widget *w,
+ struct snd_kcontrol *kcontrol, int event)
+ {
+ struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
+- unsigned int decimator;
++ u8 decimator;
+ u16 tx_vol_ctl_reg, dec_cfg_reg, hpf_gate_reg, tx_gain_ctl_reg;
+ u8 hpf_cut_off_freq;
+ int hpf_delay = TX_MACRO_DMIC_HPF_DELAY_MS;
+@@ -1064,7 +1064,8 @@ static int tx_macro_hw_params(struct snd_pcm_substream *substream,
+ struct snd_soc_dai *dai)
+ {
+ struct snd_soc_component *component = dai->component;
+- u32 decimator, sample_rate;
++ u32 sample_rate;
++ u8 decimator;
+ int tx_fs_rate;
+ struct tx_macro *tx = snd_soc_component_get_drvdata(component);
+
+@@ -1128,7 +1129,7 @@ static int tx_macro_digital_mute(struct snd_soc_dai *dai, int mute, int stream)
+ {
+ struct snd_soc_component *component = dai->component;
+ struct tx_macro *tx = snd_soc_component_get_drvdata(component);
+- u16 decimator;
++ u8 decimator;
+
+ /* active decimator not set yet */
+ if (tx->active_decimator[dai->id] == -1)
+--
+2.39.2
+
--- /dev/null
+From aa11ea032fee5c0c59f01bacc82872346ce5d0a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Mar 2023 06:54:41 +0000
+Subject: ASoC: hdmi-codec: only startup/shutdown on supported streams
+
+From: Emil Abildgaard Svendsen <EMAS@bang-olufsen.dk>
+
+[ Upstream commit e041a2a550582106cba6a7c862c90dfc2ad14492 ]
+
+Currently only one stream is supported. This isn't usally a problem
+until you have a multi codec audio card. Because the audio card will run
+startup and shutdown on both capture and playback streams. So if your
+hdmi-codec only support either playback or capture. Then ALSA can't open
+for playback and capture.
+
+This patch will ignore if startup and shutdown are called with a non
+supported stream. Thus, allowing an audio card like this:
+
+ +-+
+ cpu1 <--@-| |-> codec1 (HDMI-CODEC)
+ | |<- codec2 (NOT HDMI-CODEC)
+ +-+
+
+Signed-off-by: Emil Svendsen <emas@bang-olufsen.dk>
+Link: https://lore.kernel.org/r/20230309065432.4150700-2-emas@bang-olufsen.dk
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/hdmi-codec.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c
+index 74cbbe16f9aec..a22f2ec95901f 100644
+--- a/sound/soc/codecs/hdmi-codec.c
++++ b/sound/soc/codecs/hdmi-codec.c
+@@ -428,8 +428,13 @@ static int hdmi_codec_startup(struct snd_pcm_substream *substream,
+ {
+ struct hdmi_codec_priv *hcp = snd_soc_dai_get_drvdata(dai);
+ bool tx = substream->stream == SNDRV_PCM_STREAM_PLAYBACK;
++ bool has_capture = !hcp->hcd.no_i2s_capture;
++ bool has_playback = !hcp->hcd.no_i2s_playback;
+ int ret = 0;
+
++ if (!((has_playback && tx) || (has_capture && !tx)))
++ return 0;
++
+ mutex_lock(&hcp->lock);
+ if (hcp->busy) {
+ dev_err(dai->dev, "Only one simultaneous stream supported!\n");
+@@ -468,6 +473,12 @@ static void hdmi_codec_shutdown(struct snd_pcm_substream *substream,
+ struct snd_soc_dai *dai)
+ {
+ struct hdmi_codec_priv *hcp = snd_soc_dai_get_drvdata(dai);
++ bool tx = substream->stream == SNDRV_PCM_STREAM_PLAYBACK;
++ bool has_capture = !hcp->hcd.no_i2s_capture;
++ bool has_playback = !hcp->hcd.no_i2s_playback;
++
++ if (!((has_playback && tx) || (has_capture && !tx)))
++ return;
+
+ hcp->chmap_idx = HDMI_CODEC_CHMAP_IDX_UNKNOWN;
+ hcp->hcd.ops->audio_shutdown(dai->dev->parent, hcp->hcd.data);
+--
+2.39.2
+
--- /dev/null
+From 5536388a6727c6ba5f5cf8679acb24f3672d8bda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 14:48:51 +0100
+Subject: ASoC: Intel: avs: da7219: Explicitly define codec format
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+
+[ Upstream commit 61f368624fe4d0c25c6e9c917574b8ace51d776e ]
+
+da7219 is headset codec configured in 48000/2/S24_LE format regardless
+of front end format, so force it to be so.
+
+Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Link: https://lore.kernel.org/r/20230303134854.2277146-3-amadeuszx.slawinski@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/avs/boards/da7219.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/sound/soc/intel/avs/boards/da7219.c b/sound/soc/intel/avs/boards/da7219.c
+index acd43b6108e99..1a1d572cc1d02 100644
+--- a/sound/soc/intel/avs/boards/da7219.c
++++ b/sound/soc/intel/avs/boards/da7219.c
+@@ -117,6 +117,26 @@ static void avs_da7219_codec_exit(struct snd_soc_pcm_runtime *rtd)
+ snd_soc_component_set_jack(asoc_rtd_to_codec(rtd, 0)->component, NULL, NULL);
+ }
+
++static int
++avs_da7219_be_fixup(struct snd_soc_pcm_runtime *runrime, struct snd_pcm_hw_params *params)
++{
++ struct snd_interval *rate, *channels;
++ struct snd_mask *fmt;
++
++ rate = hw_param_interval(params, SNDRV_PCM_HW_PARAM_RATE);
++ channels = hw_param_interval(params, SNDRV_PCM_HW_PARAM_CHANNELS);
++ fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT);
++
++ /* The ADSP will convert the FE rate to 48k, stereo */
++ rate->min = rate->max = 48000;
++ channels->min = channels->max = 2;
++
++ /* set SSP0 to 24 bit */
++ snd_mask_none(fmt);
++ snd_mask_set_format(fmt, SNDRV_PCM_FORMAT_S24_LE);
++ return 0;
++}
++
+ static int avs_create_dai_link(struct device *dev, const char *platform_name, int ssp_port,
+ struct snd_soc_dai_link **dai_link)
+ {
+@@ -148,6 +168,7 @@ static int avs_create_dai_link(struct device *dev, const char *platform_name, in
+ dl->num_platforms = 1;
+ dl->id = 0;
+ dl->dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF | SND_SOC_DAIFMT_CBS_CFS;
++ dl->be_hw_params_fixup = avs_da7219_be_fixup;
+ dl->init = avs_da7219_codec_init;
+ dl->exit = avs_da7219_codec_exit;
+ dl->nonatomic = 1;
+--
+2.39.2
+
--- /dev/null
+From 99291b981e49238971c746eb6c672ce3d680814e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 14:48:50 +0100
+Subject: ASoC: Intel: avs: max98357a: Explicitly define codec format
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+
+[ Upstream commit d16c893425d07ada1fdd817ec06d322efcf69480 ]
+
+max98357a is speaker codec configured in 48000/2/S16_LE format
+regardless of front end format, so force it to be so.
+
+Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Link: https://lore.kernel.org/r/20230303134854.2277146-2-amadeuszx.slawinski@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/avs/boards/max98357a.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/sound/soc/intel/avs/boards/max98357a.c b/sound/soc/intel/avs/boards/max98357a.c
+index 921f42caf7e09..183123d08c5a3 100644
+--- a/sound/soc/intel/avs/boards/max98357a.c
++++ b/sound/soc/intel/avs/boards/max98357a.c
+@@ -8,6 +8,7 @@
+
+ #include <linux/module.h>
+ #include <linux/platform_device.h>
++#include <sound/pcm_params.h>
+ #include <sound/soc.h>
+ #include <sound/soc-acpi.h>
+ #include <sound/soc-dapm.h>
+@@ -24,6 +25,26 @@ static const struct snd_soc_dapm_route card_base_routes[] = {
+ { "Spk", NULL, "Speaker" },
+ };
+
++static int
++avs_max98357a_be_fixup(struct snd_soc_pcm_runtime *runrime, struct snd_pcm_hw_params *params)
++{
++ struct snd_interval *rate, *channels;
++ struct snd_mask *fmt;
++
++ rate = hw_param_interval(params, SNDRV_PCM_HW_PARAM_RATE);
++ channels = hw_param_interval(params, SNDRV_PCM_HW_PARAM_CHANNELS);
++ fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT);
++
++ /* The ADSP will convert the FE rate to 48k, stereo */
++ rate->min = rate->max = 48000;
++ channels->min = channels->max = 2;
++
++ /* set SSP0 to 16 bit */
++ snd_mask_none(fmt);
++ snd_mask_set_format(fmt, SNDRV_PCM_FORMAT_S16_LE);
++ return 0;
++}
++
+ static int avs_create_dai_link(struct device *dev, const char *platform_name, int ssp_port,
+ struct snd_soc_dai_link **dai_link)
+ {
+@@ -55,6 +76,7 @@ static int avs_create_dai_link(struct device *dev, const char *platform_name, in
+ dl->num_platforms = 1;
+ dl->id = 0;
+ dl->dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF | SND_SOC_DAIFMT_CBS_CFS;
++ dl->be_hw_params_fixup = avs_max98357a_be_fixup;
+ dl->nonatomic = 1;
+ dl->no_pcm = 1;
+ dl->dpcm_playback = 1;
+--
+2.39.2
+
--- /dev/null
+From 8bd2f652f65879286be3692f7e49c2f651f249a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 14:48:54 +0100
+Subject: ASoC: Intel: avs: nau8825: Adjust clock control
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cezary Rojewski <cezary.rojewski@intel.com>
+
+[ Upstream commit 6206b2e787da2ed567922c37bb588a44f6fb6705 ]
+
+Internal clock shall be adjusted also in cases when DAPM event other
+than 'ON' is triggered.
+
+Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Link: https://lore.kernel.org/r/20230303134854.2277146-6-amadeuszx.slawinski@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/avs/boards/nau8825.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/sound/soc/intel/avs/boards/nau8825.c b/sound/soc/intel/avs/boards/nau8825.c
+index 6731d8a490767..49438a67a77c6 100644
+--- a/sound/soc/intel/avs/boards/nau8825.c
++++ b/sound/soc/intel/avs/boards/nau8825.c
+@@ -33,15 +33,15 @@ avs_nau8825_clock_control(struct snd_soc_dapm_widget *w, struct snd_kcontrol *co
+ return -EINVAL;
+ }
+
+- if (!SND_SOC_DAPM_EVENT_ON(event)) {
++ if (SND_SOC_DAPM_EVENT_ON(event))
++ ret = snd_soc_dai_set_sysclk(codec_dai, NAU8825_CLK_MCLK, 24000000,
++ SND_SOC_CLOCK_IN);
++ else
+ ret = snd_soc_dai_set_sysclk(codec_dai, NAU8825_CLK_INTERNAL, 0, SND_SOC_CLOCK_IN);
+- if (ret < 0) {
+- dev_err(card->dev, "set sysclk err = %d\n", ret);
+- return ret;
+- }
+- }
++ if (ret < 0)
++ dev_err(card->dev, "Set sysclk failed: %d\n", ret);
+
+- return 0;
++ return ret;
+ }
+
+ static const struct snd_kcontrol_new card_controls[] = {
+--
+2.39.2
+
--- /dev/null
+From 805ffc94bc04a3b8a406306b33cb902e1dddc04f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 14:48:52 +0100
+Subject: ASoC: Intel: avs: rt5682: Explicitly define codec format
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+
+[ Upstream commit d24dbc865c2bd5946bef62bb862a65df092dfc79 ]
+
+rt5682 is headset codec configured in 48000/2/S24_LE format regardless
+of front end format, so force it to be so.
+
+Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Link: https://lore.kernel.org/r/20230303134854.2277146-4-amadeuszx.slawinski@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/avs/boards/rt5682.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/sound/soc/intel/avs/boards/rt5682.c b/sound/soc/intel/avs/boards/rt5682.c
+index 473e9fe5d0bf7..b2c2ba93dcb56 100644
+--- a/sound/soc/intel/avs/boards/rt5682.c
++++ b/sound/soc/intel/avs/boards/rt5682.c
+@@ -169,6 +169,27 @@ static const struct snd_soc_ops avs_rt5682_ops = {
+ .hw_params = avs_rt5682_hw_params,
+ };
+
++static int
++avs_rt5682_be_fixup(struct snd_soc_pcm_runtime *runtime, struct snd_pcm_hw_params *params)
++{
++ struct snd_interval *rate, *channels;
++ struct snd_mask *fmt;
++
++ rate = hw_param_interval(params, SNDRV_PCM_HW_PARAM_RATE);
++ channels = hw_param_interval(params, SNDRV_PCM_HW_PARAM_CHANNELS);
++ fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT);
++
++ /* The ADSP will convert the FE rate to 48k, stereo */
++ rate->min = rate->max = 48000;
++ channels->min = channels->max = 2;
++
++ /* set SSPN to 24 bit */
++ snd_mask_none(fmt);
++ snd_mask_set_format(fmt, SNDRV_PCM_FORMAT_S24_LE);
++
++ return 0;
++}
++
+ static int avs_create_dai_link(struct device *dev, const char *platform_name, int ssp_port,
+ struct snd_soc_dai_link **dai_link)
+ {
+@@ -201,6 +222,7 @@ static int avs_create_dai_link(struct device *dev, const char *platform_name, in
+ dl->id = 0;
+ dl->init = avs_rt5682_codec_init;
+ dl->exit = avs_rt5682_codec_exit;
++ dl->be_hw_params_fixup = avs_rt5682_be_fixup;
+ dl->ops = &avs_rt5682_ops;
+ dl->nonatomic = 1;
+ dl->no_pcm = 1;
+--
+2.39.2
+
--- /dev/null
+From 3d13d6bed45ea5dd9adaa44bc30b95317889eb6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 14:48:53 +0100
+Subject: ASoC: Intel: avs: ssm4567: Remove nau8825 bits
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cezary Rojewski <cezary.rojewski@intel.com>
+
+[ Upstream commit 933de2d127281731166cf2880fa1e23c5a0f7faa ]
+
+Some of the nau8825 clock control got into the ssm4567, remove it.
+
+Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Link: https://lore.kernel.org/r/20230303134854.2277146-5-amadeuszx.slawinski@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/avs/boards/ssm4567.c | 31 ----------------------------
+ 1 file changed, 31 deletions(-)
+
+diff --git a/sound/soc/intel/avs/boards/ssm4567.c b/sound/soc/intel/avs/boards/ssm4567.c
+index c5db696127624..2b7f5ad92aca7 100644
+--- a/sound/soc/intel/avs/boards/ssm4567.c
++++ b/sound/soc/intel/avs/boards/ssm4567.c
+@@ -15,7 +15,6 @@
+ #include <sound/soc-acpi.h>
+ #include "../../../codecs/nau8825.h"
+
+-#define SKL_NUVOTON_CODEC_DAI "nau8825-hifi"
+ #define SKL_SSM_CODEC_DAI "ssm4567-hifi"
+
+ static struct snd_soc_codec_conf card_codec_conf[] = {
+@@ -34,41 +33,11 @@ static const struct snd_kcontrol_new card_controls[] = {
+ SOC_DAPM_PIN_SWITCH("Right Speaker"),
+ };
+
+-static int
+-platform_clock_control(struct snd_soc_dapm_widget *w, struct snd_kcontrol *control, int event)
+-{
+- struct snd_soc_dapm_context *dapm = w->dapm;
+- struct snd_soc_card *card = dapm->card;
+- struct snd_soc_dai *codec_dai;
+- int ret;
+-
+- codec_dai = snd_soc_card_get_codec_dai(card, SKL_NUVOTON_CODEC_DAI);
+- if (!codec_dai) {
+- dev_err(card->dev, "Codec dai not found\n");
+- return -EINVAL;
+- }
+-
+- if (SND_SOC_DAPM_EVENT_ON(event)) {
+- ret = snd_soc_dai_set_sysclk(codec_dai, NAU8825_CLK_MCLK, 24000000,
+- SND_SOC_CLOCK_IN);
+- if (ret < 0)
+- dev_err(card->dev, "set sysclk err = %d\n", ret);
+- } else {
+- ret = snd_soc_dai_set_sysclk(codec_dai, NAU8825_CLK_INTERNAL, 0, SND_SOC_CLOCK_IN);
+- if (ret < 0)
+- dev_err(card->dev, "set sysclk err = %d\n", ret);
+- }
+-
+- return ret;
+-}
+-
+ static const struct snd_soc_dapm_widget card_widgets[] = {
+ SND_SOC_DAPM_SPK("Left Speaker", NULL),
+ SND_SOC_DAPM_SPK("Right Speaker", NULL),
+ SND_SOC_DAPM_SPK("DP1", NULL),
+ SND_SOC_DAPM_SPK("DP2", NULL),
+- SND_SOC_DAPM_SUPPLY("Platform Clock", SND_SOC_NOPM, 0, 0, platform_clock_control,
+- SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+ };
+
+ static const struct snd_soc_dapm_route card_base_routes[] = {
+--
+2.39.2
+
--- /dev/null
+From c00693a56213ed307f6de1f8a6da5bc62ca38218 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 11:54:12 +0200
+Subject: ASoC: SOF: Intel: hda-ctrl: re-add sleep after entering and exiting
+ reset
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 8bac40b8ed17ab1be9133e9620f65fae80262b7e ]
+
+This reverts commit a09d82ce0a867 ("ASoC: SOF: Intel: hda-ctrl: remove
+useless sleep")
+
+It was a mistake to remove those delays, in light of comments in the
+HDaudio spec captured in snd_hdac_bus_reset_link() that the codec
+needs time for its initialization and PLL lock.
+
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Rander Wang <rander.wang@intel.com>
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://lore.kernel.org/r/20230307095412.3416-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-ctrl.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/sof/intel/hda-ctrl.c b/sound/soc/sof/intel/hda-ctrl.c
+index 3aea36c077c9d..f3bdeba284122 100644
+--- a/sound/soc/sof/intel/hda-ctrl.c
++++ b/sound/soc/sof/intel/hda-ctrl.c
+@@ -196,12 +196,15 @@ int hda_dsp_ctrl_init_chip(struct snd_sof_dev *sdev)
+ goto err;
+ }
+
++ usleep_range(500, 1000);
++
+ /* exit HDA controller reset */
+ ret = hda_dsp_ctrl_link_reset(sdev, false);
+ if (ret < 0) {
+ dev_err(sdev->dev, "error: failed to exit HDA controller reset\n");
+ goto err;
+ }
++ usleep_range(1000, 1200);
+
+ hda_codec_detect_mask(sdev);
+
+--
+2.39.2
+
--- /dev/null
+From d0604453e3aa7de3bb17fa8705b8ebd0aa45d8d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 11:54:52 +0200
+Subject: ASoC: SOF: Intel: hda-dsp: harden D0i3 programming sequence
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rander Wang <rander.wang@intel.com>
+
+[ Upstream commit 52a55779ed14792a150421339664193d6eb8e036 ]
+
+Add delay between set and wait command according to hardware programming
+sequence. Also add debug log to detect error.
+
+Signed-off-by: Rander Wang <rander.wang@intel.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://lore.kernel.org/r/20230307095453.3719-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-dsp.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/sound/soc/sof/intel/hda-dsp.c b/sound/soc/sof/intel/hda-dsp.c
+index b4eacae8564c8..6b2094f74c9c0 100644
+--- a/sound/soc/sof/intel/hda-dsp.c
++++ b/sound/soc/sof/intel/hda-dsp.c
+@@ -399,6 +399,12 @@ static int hda_dsp_update_d0i3c_register(struct snd_sof_dev *sdev, u8 value)
+ snd_sof_dsp_update8(sdev, HDA_DSP_HDA_BAR, chip->d0i3_offset,
+ SOF_HDA_VS_D0I3C_I3, value);
+
++ /*
++ * The value written to the D0I3C::I3 bit may not be taken into account immediately.
++ * A delay is recommended before checking if D0I3C::CIP is cleared
++ */
++ usleep_range(30, 40);
++
+ /* Wait for cmd in progress to be cleared before exiting the function */
+ ret = hda_dsp_wait_d0i3c_done(sdev);
+ if (ret < 0) {
+@@ -407,6 +413,12 @@ static int hda_dsp_update_d0i3c_register(struct snd_sof_dev *sdev, u8 value)
+ }
+
+ reg = snd_sof_dsp_read8(sdev, HDA_DSP_HDA_BAR, chip->d0i3_offset);
++ /* Confirm d0i3 state changed with paranoia check */
++ if ((reg ^ value) & SOF_HDA_VS_D0I3C_I3) {
++ dev_err(sdev->dev, "failed to update D0I3C!\n");
++ return -EIO;
++ }
++
+ trace_sof_intel_D0I3C_updated(sdev, reg);
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 1e61114842fd535f51bbdd7fe35d52d4f7f0336a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 11:53:41 +0200
+Subject: ASoC: SOF: Intel: pci-tng: revert invalid bar size setting
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit ca09e2a351fbc7836ba9418304ff0c3e72addfe0 ]
+
+The logic for the ioremap is to find the resource index 3 (IRAM) and
+infer the BAR address by subtracting the IRAM offset. The BAR size
+defined in hardware specifications is 2MB.
+
+The commit 5947b2726beb6 ("ASoC: SOF: Intel: Check the bar size before
+remapping") tried to find the BAR size by querying the resource length
+instead of a pre-canned value, but by requesting the size for index 3
+it only gets the size of the IRAM. That's obviously wrong and prevents
+the probe from proceeding.
+
+This commit attempted to fix an issue in a fuzzing/simulated
+environment but created another on actual devices, so the best course
+of action is to revert that change.
+
+Reported-by: Ferry Toth <fntoth@gmail.com>
+Tested-by: Ferry Toth <fntoth@gmail.com> (Intel Edison-Arduino)
+Link: https://github.com/thesofproject/linux/issues/3901
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://lore.kernel.org/r/20230307095341.3222-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/pci-tng.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/sound/soc/sof/intel/pci-tng.c b/sound/soc/sof/intel/pci-tng.c
+index 5b2b409752c58..8c22a00266c06 100644
+--- a/sound/soc/sof/intel/pci-tng.c
++++ b/sound/soc/sof/intel/pci-tng.c
+@@ -75,11 +75,7 @@ static int tangier_pci_probe(struct snd_sof_dev *sdev)
+
+ /* LPE base */
+ base = pci_resource_start(pci, desc->resindex_lpe_base) - IRAM_OFFSET;
+- size = pci_resource_len(pci, desc->resindex_lpe_base);
+- if (size < PCI_BAR_SIZE) {
+- dev_err(sdev->dev, "error: I/O region is too small.\n");
+- return -ENODEV;
+- }
++ size = PCI_BAR_SIZE;
+
+ dev_dbg(sdev->dev, "LPE PHY base at 0x%x size 0x%x", base, size);
+ sdev->bar[DSP_BAR] = devm_ioremap(sdev->dev, base, size);
+--
+2.39.2
+
--- /dev/null
+From 606a7a34d4279e7fa657e52671b69c00b590e6ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 13:49:17 +0200
+Subject: ASoC: SOF: ipc3: Check for upper size limit for the received message
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit 989a3e4479177d0f4afab8be1960731bc0ffbbd0 ]
+
+The sof_ipc3_rx_msg() checks for minimum size of a new rx message but it is
+missing the check for upper limit.
+Corrupted or compromised firmware might be able to take advantage of this
+to cause out of bounds reads outside of the message area.
+
+Reported-by: Curtis Malainey <cujomalainey@chromium.org>
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Curtis Malainey <curtis@malainey.com>
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://lore.kernel.org/r/20230307114917.5124-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/ipc3.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sof/ipc3.c b/sound/soc/sof/ipc3.c
+index 1fef4dcc09368..fde8af5a1f485 100644
+--- a/sound/soc/sof/ipc3.c
++++ b/sound/soc/sof/ipc3.c
+@@ -970,8 +970,9 @@ static void sof_ipc3_rx_msg(struct snd_sof_dev *sdev)
+ return;
+ }
+
+- if (hdr.size < sizeof(hdr)) {
+- dev_err(sdev->dev, "The received message size is invalid\n");
++ if (hdr.size < sizeof(hdr) || hdr.size > SOF_IPC_MSG_MAX_SIZE) {
++ dev_err(sdev->dev, "The received message size is invalid: %u\n",
++ hdr.size);
+ return;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From fe2fb26c253f0dda78360d5ce47bcd1ea52e098d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 13:07:51 +0200
+Subject: ASoC: SOF: ipc4-topology: Fix incorrect sample rate print unit
+
+From: Seppo Ingalsuo <seppo.ingalsuo@linux.intel.com>
+
+[ Upstream commit 9e269e3aa9006440de639597079ee7140ef5b5f3 ]
+
+This patch fixes the sample rate print unit from KHz to Hz.
+E.g. 48000KHz becomes 48000Hz.
+
+Signed-off-by: Seppo Ingalsuo <seppo.ingalsuo@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://lore.kernel.org/r/20230307110751.2053-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/ipc4-topology.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/ipc4-topology.c b/sound/soc/sof/ipc4-topology.c
+index 59f4d42f9011e..65da1cf790d9c 100644
+--- a/sound/soc/sof/ipc4-topology.c
++++ b/sound/soc/sof/ipc4-topology.c
+@@ -155,7 +155,7 @@ static void sof_ipc4_dbg_audio_format(struct device *dev,
+ for (i = 0; i < num_format; i++, ptr = (u8 *)ptr + object_size) {
+ fmt = ptr;
+ dev_dbg(dev,
+- " #%d: %uKHz, %ubit (ch_map %#x ch_cfg %u interleaving_style %u fmt_cfg %#x)\n",
++ " #%d: %uHz, %ubit (ch_map %#x ch_cfg %u interleaving_style %u fmt_cfg %#x)\n",
+ i, fmt->sampling_frequency, fmt->bit_depth, fmt->ch_map,
+ fmt->ch_cfg, fmt->interleaving_style, fmt->fmt_cfg);
+ }
+--
+2.39.2
+
--- /dev/null
+From 5f321135d28e807ba23620a4edc93e7ce5447d62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 13:06:56 +0200
+Subject: ASoC: SOF: IPC4: update gain ipc msg definition to align with fw
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rander Wang <rander.wang@intel.com>
+
+[ Upstream commit e45cd86c3a78bfb9875a5eb8ab5dab459b59bbe2 ]
+
+Recent firmware changes modified the curve duration from 32 to 64 bits,
+which breaks volume ramps. A simple solution would be to change the
+definition, but unfortunately the ASoC topology framework only supports
+up to 32 bit tokens.
+
+This patch suggests breaking the 64 bit value in low and high parts, with
+only the low-part extracted from topology and high-part only zeroes. Since
+the curve duration is represented in hundred of nanoseconds, we can still
+represent a 400s ramp, which is just fine. The defacto ABI change has no
+effect on existing users since the IPC4 firmware has not been released just
+yet.
+
+Link: https://github.com/thesofproject/linux/issues/4026
+
+Signed-off-by: Rander Wang <rander.wang@intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://lore.kernel.org/r/20230307110656.1816-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/ipc4-control.c | 3 ++-
+ sound/soc/sof/ipc4-topology.c | 4 ++--
+ sound/soc/sof/ipc4-topology.h | 6 ++++--
+ 3 files changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/sof/ipc4-control.c b/sound/soc/sof/ipc4-control.c
+index 0d5a578c34962..7442ec1c5a4d4 100644
+--- a/sound/soc/sof/ipc4-control.c
++++ b/sound/soc/sof/ipc4-control.c
+@@ -84,7 +84,8 @@ sof_ipc4_set_volume_data(struct snd_sof_dev *sdev, struct snd_sof_widget *swidge
+ }
+
+ /* set curve type and duration from topology */
+- data.curve_duration = gain->data.curve_duration;
++ data.curve_duration_l = gain->data.curve_duration_l;
++ data.curve_duration_h = gain->data.curve_duration_h;
+ data.curve_type = gain->data.curve_type;
+
+ msg->data_ptr = &data;
+diff --git a/sound/soc/sof/ipc4-topology.c b/sound/soc/sof/ipc4-topology.c
+index 65da1cf790d9c..6da6137fa2cbc 100644
+--- a/sound/soc/sof/ipc4-topology.c
++++ b/sound/soc/sof/ipc4-topology.c
+@@ -107,7 +107,7 @@ static const struct sof_topology_token gain_tokens[] = {
+ get_token_u32, offsetof(struct sof_ipc4_gain_data, curve_type)},
+ {SOF_TKN_GAIN_RAMP_DURATION,
+ SND_SOC_TPLG_TUPLE_TYPE_WORD, get_token_u32,
+- offsetof(struct sof_ipc4_gain_data, curve_duration)},
++ offsetof(struct sof_ipc4_gain_data, curve_duration_l)},
+ {SOF_TKN_GAIN_VAL, SND_SOC_TPLG_TUPLE_TYPE_WORD,
+ get_token_u32, offsetof(struct sof_ipc4_gain_data, init_val)},
+ };
+@@ -670,7 +670,7 @@ static int sof_ipc4_widget_setup_comp_pga(struct snd_sof_widget *swidget)
+
+ dev_dbg(scomp->dev,
+ "pga widget %s: ramp type: %d, ramp duration %d, initial gain value: %#x, cpc %d\n",
+- swidget->widget->name, gain->data.curve_type, gain->data.curve_duration,
++ swidget->widget->name, gain->data.curve_type, gain->data.curve_duration_l,
+ gain->data.init_val, gain->base_config.cpc);
+
+ ret = sof_ipc4_widget_setup_msg(swidget, &gain->msg);
+diff --git a/sound/soc/sof/ipc4-topology.h b/sound/soc/sof/ipc4-topology.h
+index 2363a7cc0b57d..cf9d278524572 100644
+--- a/sound/soc/sof/ipc4-topology.h
++++ b/sound/soc/sof/ipc4-topology.h
+@@ -217,14 +217,16 @@ struct sof_ipc4_control_data {
+ * @init_val: Initial value
+ * @curve_type: Curve type
+ * @reserved: reserved for future use
+- * @curve_duration: Curve duration
++ * @curve_duration_l: Curve duration low part
++ * @curve_duration_h: Curve duration high part
+ */
+ struct sof_ipc4_gain_data {
+ uint32_t channels;
+ uint32_t init_val;
+ uint32_t curve_type;
+ uint32_t reserved;
+- uint32_t curve_duration;
++ uint32_t curve_duration_l;
++ uint32_t curve_duration_h;
+ } __aligned(8);
+
+ /**
+--
+2.39.2
+
--- /dev/null
+From 00c823efb4eba37bf739ef817726142cbdc0f8e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 16:05:19 -0300
+Subject: cifs: fix missing unload_nls() in smb2_reconnect()
+
+From: Paulo Alcantara <pc@manguebit.com>
+
+[ Upstream commit c24bb1a87dc3f2d77d410eaac2c6a295961bf50e ]
+
+Make sure to unload_nls() @nls_codepage if we no longer need it.
+
+Fixes: bc962159e8e3 ("cifs: avoid race conditions with parallel reconnects")
+Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
+Cc: Shyam Prasad N <sprasad@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smb2pdu.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index f0b1ae0835d71..b37379b62cc77 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -144,7 +144,7 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon,
+ struct TCP_Server_Info *server)
+ {
+ int rc = 0;
+- struct nls_table *nls_codepage;
++ struct nls_table *nls_codepage = NULL;
+ struct cifs_ses *ses;
+
+ /*
+@@ -216,8 +216,6 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon,
+ tcon->ses->chans_need_reconnect,
+ tcon->need_reconnect);
+
+- nls_codepage = load_nls_default();
+-
+ mutex_lock(&ses->session_mutex);
+ /*
+ * Recheck after acquire mutex. If another thread is negotiating
+@@ -237,6 +235,8 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon,
+ }
+ spin_unlock(&server->srv_lock);
+
++ nls_codepage = load_nls_default();
++
+ /*
+ * need to prevent multiple threads trying to simultaneously
+ * reconnect the same SMB session
+--
+2.39.2
+
--- /dev/null
+From e98e1877962ac924efdd7e305d07ae32fe98b098 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Feb 2023 16:08:21 -0500
+Subject: drm/amd/display: Fix HDCP failing to enable after suspend
+
+From: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
+
+[ Upstream commit 728cefa53a36ba378ed4a7f31a0c08289687d824 ]
+
+[Why]
+On resume some displays are not ready for HDCP, so they will fail if we
+start the hdcp authentintication too soon.
+
+Add a delay so that the displays can be ready before we start.
+
+NOTE: Previoulsy this delay was set to 3 seconds but it was causing
+issues with compliance, 2 seconds should enough for compliance and the
+s3 resume case.
+
+[How]
+Change the Delay to 2 seconds.
+
+Reviewed-by: Aurabindo Pillai <Aurabindo.Pillai@amd.com>
+Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
+Signed-off-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c
+index a7fd98f57f94c..dc62375a8e2c4 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c
+@@ -495,7 +495,7 @@ static void update_config(void *handle, struct cp_psp_stream_config *config)
+ link->dp.mst_enabled = config->mst_enabled;
+ link->dp.usb4_enabled = config->usb4_enabled;
+ display->adjust.disable = MOD_HDCP_DISPLAY_DISABLE_AUTHENTICATION;
+- link->adjust.auth_delay = 0;
++ link->adjust.auth_delay = 2;
+ link->adjust.hdcp1.disable = 0;
+ conn_state = aconnector->base.state;
+
+--
+2.39.2
+
--- /dev/null
+From 09b46fb0ad74b0a493cbfcda8e7eaeb99f5835fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 18:48:41 +0800
+Subject: drm/amdgpu/vcn: custom video info caps for sriov
+
+From: Jane Jian <Jane.Jian@amd.com>
+
+[ Upstream commit d71e38df3b730a17ab6b25cabb2ccfe8a7f04385 ]
+
+for sriov, we added a new flag to indicate av1 support,
+this will override the original caps info.
+
+Signed-off-by: Jane Jian <Jane.Jian@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 4 +
+ drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h | 3 +-
+ drivers/gpu/drm/amd/amdgpu/soc21.c | 103 ++++++++++++++++++--
+ 3 files changed, 99 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h
+index 2b9d806e23afb..10a0a510910b6 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h
+@@ -123,6 +123,8 @@ enum AMDGIM_FEATURE_FLAG {
+ AMDGIM_FEATURE_PP_ONE_VF = (1 << 4),
+ /* Indirect Reg Access enabled */
+ AMDGIM_FEATURE_INDIRECT_REG_ACCESS = (1 << 5),
++ /* AV1 Support MODE*/
++ AMDGIM_FEATURE_AV1_SUPPORT = (1 << 6),
+ };
+
+ enum AMDGIM_REG_ACCESS_FLAG {
+@@ -321,6 +323,8 @@ static inline bool is_virtual_machine(void)
+ ((!amdgpu_in_reset(adev)) && adev->virt.tdr_debug)
+ #define amdgpu_sriov_is_normal(adev) \
+ ((!amdgpu_in_reset(adev)) && (!adev->virt.tdr_debug))
++#define amdgpu_sriov_is_av1_support(adev) \
++ ((adev)->virt.gim_feature & AMDGIM_FEATURE_AV1_SUPPORT)
+ bool amdgpu_virt_mmio_blocked(struct amdgpu_device *adev);
+ void amdgpu_virt_init_setting(struct amdgpu_device *adev);
+ void amdgpu_virt_kiq_reg_write_reg_wait(struct amdgpu_device *adev,
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h b/drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h
+index 6c97148ca0ed3..24d42d24e6a01 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgv_sriovmsg.h
+@@ -93,7 +93,8 @@ union amd_sriov_msg_feature_flags {
+ uint32_t mm_bw_management : 1;
+ uint32_t pp_one_vf_mode : 1;
+ uint32_t reg_indirect_acc : 1;
+- uint32_t reserved : 26;
++ uint32_t av1_support : 1;
++ uint32_t reserved : 25;
+ } flags;
+ uint32_t all;
+ };
+diff --git a/drivers/gpu/drm/amd/amdgpu/soc21.c b/drivers/gpu/drm/amd/amdgpu/soc21.c
+index 3d938b52178e3..9eedc1a1494c0 100644
+--- a/drivers/gpu/drm/amd/amdgpu/soc21.c
++++ b/drivers/gpu/drm/amd/amdgpu/soc21.c
+@@ -101,6 +101,59 @@ static const struct amdgpu_video_codecs vcn_4_0_0_video_codecs_decode_vcn1 =
+ .codec_array = vcn_4_0_0_video_codecs_decode_array_vcn1,
+ };
+
++/* SRIOV SOC21, not const since data is controlled by host */
++static struct amdgpu_video_codec_info sriov_vcn_4_0_0_video_codecs_encode_array_vcn0[] = {
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 2304, 0)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 2304, 0)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_AV1, 8192, 4352, 0)},
++};
++
++static struct amdgpu_video_codec_info sriov_vcn_4_0_0_video_codecs_encode_array_vcn1[] = {
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 2304, 0)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 2304, 0)},
++};
++
++static struct amdgpu_video_codecs sriov_vcn_4_0_0_video_codecs_encode_vcn0 = {
++ .codec_count = ARRAY_SIZE(sriov_vcn_4_0_0_video_codecs_encode_array_vcn0),
++ .codec_array = sriov_vcn_4_0_0_video_codecs_encode_array_vcn0,
++};
++
++static struct amdgpu_video_codecs sriov_vcn_4_0_0_video_codecs_encode_vcn1 = {
++ .codec_count = ARRAY_SIZE(sriov_vcn_4_0_0_video_codecs_encode_array_vcn1),
++ .codec_array = sriov_vcn_4_0_0_video_codecs_encode_array_vcn1,
++};
++
++static struct amdgpu_video_codec_info sriov_vcn_4_0_0_video_codecs_decode_array_vcn0[] = {
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_AV1, 8192, 4352, 0)},
++};
++
++static struct amdgpu_video_codec_info sriov_vcn_4_0_0_video_codecs_decode_array_vcn1[] = {
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)},
++};
++
++static struct amdgpu_video_codecs sriov_vcn_4_0_0_video_codecs_decode_vcn0 = {
++ .codec_count = ARRAY_SIZE(sriov_vcn_4_0_0_video_codecs_decode_array_vcn0),
++ .codec_array = sriov_vcn_4_0_0_video_codecs_decode_array_vcn0,
++};
++
++static struct amdgpu_video_codecs sriov_vcn_4_0_0_video_codecs_decode_vcn1 = {
++ .codec_count = ARRAY_SIZE(sriov_vcn_4_0_0_video_codecs_decode_array_vcn1),
++ .codec_array = sriov_vcn_4_0_0_video_codecs_decode_array_vcn1,
++};
++
+ static int soc21_query_video_codecs(struct amdgpu_device *adev, bool encode,
+ const struct amdgpu_video_codecs **codecs)
+ {
+@@ -111,16 +164,31 @@ static int soc21_query_video_codecs(struct amdgpu_device *adev, bool encode,
+ case IP_VERSION(4, 0, 0):
+ case IP_VERSION(4, 0, 2):
+ case IP_VERSION(4, 0, 4):
+- if (adev->vcn.harvest_config & AMDGPU_VCN_HARVEST_VCN0) {
+- if (encode)
+- *codecs = &vcn_4_0_0_video_codecs_encode_vcn1;
+- else
+- *codecs = &vcn_4_0_0_video_codecs_decode_vcn1;
++ if (amdgpu_sriov_vf(adev)) {
++ if ((adev->vcn.harvest_config & AMDGPU_VCN_HARVEST_VCN0) ||
++ !amdgpu_sriov_is_av1_support(adev)) {
++ if (encode)
++ *codecs = &sriov_vcn_4_0_0_video_codecs_encode_vcn1;
++ else
++ *codecs = &sriov_vcn_4_0_0_video_codecs_decode_vcn1;
++ } else {
++ if (encode)
++ *codecs = &sriov_vcn_4_0_0_video_codecs_encode_vcn0;
++ else
++ *codecs = &sriov_vcn_4_0_0_video_codecs_decode_vcn0;
++ }
+ } else {
+- if (encode)
+- *codecs = &vcn_4_0_0_video_codecs_encode_vcn0;
+- else
+- *codecs = &vcn_4_0_0_video_codecs_decode_vcn0;
++ if ((adev->vcn.harvest_config & AMDGPU_VCN_HARVEST_VCN0)) {
++ if (encode)
++ *codecs = &vcn_4_0_0_video_codecs_encode_vcn1;
++ else
++ *codecs = &vcn_4_0_0_video_codecs_decode_vcn1;
++ } else {
++ if (encode)
++ *codecs = &vcn_4_0_0_video_codecs_encode_vcn0;
++ else
++ *codecs = &vcn_4_0_0_video_codecs_decode_vcn0;
++ }
+ }
+ return 0;
+ default:
+@@ -729,8 +797,23 @@ static int soc21_common_late_init(void *handle)
+ {
+ struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
+- if (amdgpu_sriov_vf(adev))
++ if (amdgpu_sriov_vf(adev)) {
+ xgpu_nv_mailbox_get_irq(adev);
++ if ((adev->vcn.harvest_config & AMDGPU_VCN_HARVEST_VCN0) ||
++ !amdgpu_sriov_is_av1_support(adev)) {
++ amdgpu_virt_update_sriov_video_codec(adev,
++ sriov_vcn_4_0_0_video_codecs_encode_array_vcn1,
++ ARRAY_SIZE(sriov_vcn_4_0_0_video_codecs_encode_array_vcn1),
++ sriov_vcn_4_0_0_video_codecs_decode_array_vcn1,
++ ARRAY_SIZE(sriov_vcn_4_0_0_video_codecs_decode_array_vcn1));
++ } else {
++ amdgpu_virt_update_sriov_video_codec(adev,
++ sriov_vcn_4_0_0_video_codecs_encode_array_vcn0,
++ ARRAY_SIZE(sriov_vcn_4_0_0_video_codecs_encode_array_vcn0),
++ sriov_vcn_4_0_0_video_codecs_decode_array_vcn0,
++ ARRAY_SIZE(sriov_vcn_4_0_0_video_codecs_decode_array_vcn0));
++ }
++ }
+
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From 79bf9860fa6c3c3a55179ce4931cda26298a6d98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 16:19:02 -0800
+Subject: drm/amdkfd: fix a potential double free in pqm_create_queue
+
+From: Chia-I Wu <olvaffe@gmail.com>
+
+[ Upstream commit b2ca5c5d416b4e72d1e9d0293fc720e2d525fd42 ]
+
+Set *q to NULL on errors, otherwise pqm_create_queue would free it
+again.
+
+Signed-off-by: Chia-I Wu <olvaffe@gmail.com>
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
+index 5137476ec18e6..4236539d9f932 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c
+@@ -218,8 +218,8 @@ static int init_user_queue(struct process_queue_manager *pqm,
+ return 0;
+
+ cleanup:
+- if (dev->shared_resources.enable_mes)
+- uninit_queue(*q);
++ uninit_queue(*q);
++ *q = NULL;
+ return retval;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 0993c8b8025394c19d5f59565adc7b270f75a353 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Mar 2023 10:21:06 -0600
+Subject: drm/amdkfd: Fix BO offset for multi-VMA page migration
+
+From: Xiaogang Chen <Xiaogang.Chen@amd.com>
+
+[ Upstream commit b4ee9606378bb9520c94d8b96f0305c3696f5c29 ]
+
+svm_migrate_ram_to_vram migrates a prange from sys ram to vram. The prange may
+cross multiple vma. Need remember current dst vram offset in the TTM resource for
+each migration.
+
+v2: squash in warning fix (Alex)
+
+Signed-off-by: Xiaogang Chen <Xiaogang.Chen@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
+index 10048ce16aea4..5c319007b4701 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
+@@ -289,7 +289,7 @@ static unsigned long svm_migrate_unsuccessful_pages(struct migrate_vma *migrate)
+ static int
+ svm_migrate_copy_to_vram(struct amdgpu_device *adev, struct svm_range *prange,
+ struct migrate_vma *migrate, struct dma_fence **mfence,
+- dma_addr_t *scratch)
++ dma_addr_t *scratch, uint64_t ttm_res_offset)
+ {
+ uint64_t npages = migrate->npages;
+ struct device *dev = adev->dev;
+@@ -299,8 +299,8 @@ svm_migrate_copy_to_vram(struct amdgpu_device *adev, struct svm_range *prange,
+ uint64_t i, j;
+ int r;
+
+- pr_debug("svms 0x%p [0x%lx 0x%lx]\n", prange->svms, prange->start,
+- prange->last);
++ pr_debug("svms 0x%p [0x%lx 0x%lx 0x%llx]\n", prange->svms, prange->start,
++ prange->last, ttm_res_offset);
+
+ src = scratch;
+ dst = (uint64_t *)(scratch + npages);
+@@ -311,7 +311,7 @@ svm_migrate_copy_to_vram(struct amdgpu_device *adev, struct svm_range *prange,
+ goto out;
+ }
+
+- amdgpu_res_first(prange->ttm_res, prange->offset << PAGE_SHIFT,
++ amdgpu_res_first(prange->ttm_res, ttm_res_offset,
+ npages << PAGE_SHIFT, &cursor);
+ for (i = j = 0; i < npages; i++) {
+ struct page *spage;
+@@ -398,7 +398,7 @@ svm_migrate_copy_to_vram(struct amdgpu_device *adev, struct svm_range *prange,
+ static long
+ svm_migrate_vma_to_vram(struct amdgpu_device *adev, struct svm_range *prange,
+ struct vm_area_struct *vma, uint64_t start,
+- uint64_t end, uint32_t trigger)
++ uint64_t end, uint32_t trigger, uint64_t ttm_res_offset)
+ {
+ struct kfd_process *p = container_of(prange->svms, struct kfd_process, svms);
+ uint64_t npages = (end - start) >> PAGE_SHIFT;
+@@ -451,7 +451,7 @@ svm_migrate_vma_to_vram(struct amdgpu_device *adev, struct svm_range *prange,
+ else
+ pr_debug("0x%lx pages migrated\n", cpages);
+
+- r = svm_migrate_copy_to_vram(adev, prange, &migrate, &mfence, scratch);
++ r = svm_migrate_copy_to_vram(adev, prange, &migrate, &mfence, scratch, ttm_res_offset);
+ migrate_vma_pages(&migrate);
+
+ pr_debug("successful/cpages/npages 0x%lx/0x%lx/0x%lx\n",
+@@ -499,6 +499,7 @@ svm_migrate_ram_to_vram(struct svm_range *prange, uint32_t best_loc,
+ unsigned long addr, start, end;
+ struct vm_area_struct *vma;
+ struct amdgpu_device *adev;
++ uint64_t ttm_res_offset;
+ unsigned long cpages = 0;
+ long r = 0;
+
+@@ -519,6 +520,7 @@ svm_migrate_ram_to_vram(struct svm_range *prange, uint32_t best_loc,
+
+ start = prange->start << PAGE_SHIFT;
+ end = (prange->last + 1) << PAGE_SHIFT;
++ ttm_res_offset = prange->offset << PAGE_SHIFT;
+
+ for (addr = start; addr < end;) {
+ unsigned long next;
+@@ -528,13 +530,14 @@ svm_migrate_ram_to_vram(struct svm_range *prange, uint32_t best_loc,
+ break;
+
+ next = min(vma->vm_end, end);
+- r = svm_migrate_vma_to_vram(adev, prange, vma, addr, next, trigger);
++ r = svm_migrate_vma_to_vram(adev, prange, vma, addr, next, trigger, ttm_res_offset);
+ if (r < 0) {
+ pr_debug("failed %ld to migrate\n", r);
+ break;
+ } else {
+ cpages += r;
+ }
++ ttm_res_offset += next - addr;
+ addr = next;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From a22bb3b87b6c0bdc68489a8b0fcde65f0449e650 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Mar 2023 13:37:24 -0800
+Subject: drm/amdkfd: fix potential kgd_mem UAFs
+
+From: Chia-I Wu <olvaffe@gmail.com>
+
+[ Upstream commit 9da050b0d9e04439d225a2ec3044af70cdfb3933 ]
+
+kgd_mem pointers returned by kfd_process_device_translate_handle are
+only guaranteed to be valid while p->mutex is held. As soon as the mutex
+is unlocked, another thread can free the BO.
+
+Signed-off-by: Chia-I Wu <olvaffe@gmail.com>
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+index f79b8e964140e..e191d38f3da62 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+@@ -1298,14 +1298,14 @@ static int kfd_ioctl_map_memory_to_gpu(struct file *filep,
+ args->n_success = i+1;
+ }
+
+- mutex_unlock(&p->mutex);
+-
+ err = amdgpu_amdkfd_gpuvm_sync_memory(dev->adev, (struct kgd_mem *) mem, true);
+ if (err) {
+ pr_debug("Sync memory failed, wait interrupted by user signal\n");
+ goto sync_memory_failed;
+ }
+
++ mutex_unlock(&p->mutex);
++
+ /* Flush TLBs after waiting for the page table updates to complete */
+ for (i = 0; i < args->n_devices; i++) {
+ peer_pdd = kfd_process_device_data_by_id(p, devices_arr[i]);
+@@ -1321,9 +1321,9 @@ static int kfd_ioctl_map_memory_to_gpu(struct file *filep,
+ bind_process_to_device_failed:
+ get_mem_obj_from_handle_failed:
+ map_memory_to_gpu_failed:
++sync_memory_failed:
+ mutex_unlock(&p->mutex);
+ copy_from_user_failed:
+-sync_memory_failed:
+ kfree(devices_arr);
+
+ return err;
+@@ -1337,6 +1337,7 @@ static int kfd_ioctl_unmap_memory_from_gpu(struct file *filep,
+ void *mem;
+ long err = 0;
+ uint32_t *devices_arr = NULL, i;
++ bool flush_tlb;
+
+ if (!args->n_devices) {
+ pr_debug("Device IDs array empty\n");
+@@ -1389,16 +1390,19 @@ static int kfd_ioctl_unmap_memory_from_gpu(struct file *filep,
+ }
+ args->n_success = i+1;
+ }
+- mutex_unlock(&p->mutex);
+
+- if (kfd_flush_tlb_after_unmap(pdd->dev)) {
++ flush_tlb = kfd_flush_tlb_after_unmap(pdd->dev);
++ if (flush_tlb) {
+ err = amdgpu_amdkfd_gpuvm_sync_memory(pdd->dev->adev,
+ (struct kgd_mem *) mem, true);
+ if (err) {
+ pr_debug("Sync memory failed, wait interrupted by user signal\n");
+ goto sync_memory_failed;
+ }
++ }
++ mutex_unlock(&p->mutex);
+
++ if (flush_tlb) {
+ /* Flush TLBs after waiting for the page table updates to complete */
+ for (i = 0; i < args->n_devices; i++) {
+ peer_pdd = kfd_process_device_data_by_id(p, devices_arr[i]);
+@@ -1414,9 +1418,9 @@ static int kfd_ioctl_unmap_memory_from_gpu(struct file *filep,
+ bind_process_to_device_failed:
+ get_mem_obj_from_handle_failed:
+ unmap_memory_from_gpu_failed:
++sync_memory_failed:
+ mutex_unlock(&p->mutex);
+ copy_from_user_failed:
+-sync_memory_failed:
+ kfree(devices_arr);
+ return err;
+ }
+--
+2.39.2
+
--- /dev/null
+From 81e2ee644325118a3526cb75c61beb3c1ce48ff9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 14:11:24 -0500
+Subject: drm/amdkfd: Fixed kfd_process cleanup on module exit.
+
+From: David Belanger <david.belanger@amd.com>
+
+[ Upstream commit 20bc9f76b6a2455c6b54b91ae7634f147f64987f ]
+
+Handle case when module is unloaded (kfd_exit) before a process space
+(mm_struct) is released.
+
+v2: Fixed potential race conditions by removing all kfd_process from
+the process table first, then working on releasing the resources.
+
+v3: Fixed loop element access / synchronization. Fixed extra empty lines.
+
+Signed-off-by: David Belanger <david.belanger@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_module.c | 1 +
+ drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 1 +
+ drivers/gpu/drm/amd/amdkfd/kfd_process.c | 67 +++++++++++++++++++++---
+ 3 files changed, 62 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_module.c b/drivers/gpu/drm/amd/amdkfd/kfd_module.c
+index 09b966dc37681..aee2212e52f69 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_module.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_module.c
+@@ -77,6 +77,7 @@ static int kfd_init(void)
+
+ static void kfd_exit(void)
+ {
++ kfd_cleanup_processes();
+ kfd_debugfs_fini();
+ kfd_process_destroy_wq();
+ kfd_procfs_shutdown();
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+index 552c3ac85a132..7dc55919993c0 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+@@ -926,6 +926,7 @@ bool kfd_dev_is_large_bar(struct kfd_dev *dev);
+
+ int kfd_process_create_wq(void);
+ void kfd_process_destroy_wq(void);
++void kfd_cleanup_processes(void);
+ struct kfd_process *kfd_create_process(struct file *filep);
+ struct kfd_process *kfd_get_process(const struct task_struct *task);
+ struct kfd_process *kfd_lookup_process_by_pasid(u32 pasid);
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+index 51b1683ac5c1e..4d9f2d1c49b1d 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+@@ -1167,6 +1167,17 @@ static void kfd_process_free_notifier(struct mmu_notifier *mn)
+ kfd_unref_process(container_of(mn, struct kfd_process, mmu_notifier));
+ }
+
++static void kfd_process_notifier_release_internal(struct kfd_process *p)
++{
++ cancel_delayed_work_sync(&p->eviction_work);
++ cancel_delayed_work_sync(&p->restore_work);
++
++ /* Indicate to other users that MM is no longer valid */
++ p->mm = NULL;
++
++ mmu_notifier_put(&p->mmu_notifier);
++}
++
+ static void kfd_process_notifier_release(struct mmu_notifier *mn,
+ struct mm_struct *mm)
+ {
+@@ -1181,17 +1192,22 @@ static void kfd_process_notifier_release(struct mmu_notifier *mn,
+ return;
+
+ mutex_lock(&kfd_processes_mutex);
++ /*
++ * Do early return if table is empty.
++ *
++ * This could potentially happen if this function is called concurrently
++ * by mmu_notifier and by kfd_cleanup_pocesses.
++ *
++ */
++ if (hash_empty(kfd_processes_table)) {
++ mutex_unlock(&kfd_processes_mutex);
++ return;
++ }
+ hash_del_rcu(&p->kfd_processes);
+ mutex_unlock(&kfd_processes_mutex);
+ synchronize_srcu(&kfd_processes_srcu);
+
+- cancel_delayed_work_sync(&p->eviction_work);
+- cancel_delayed_work_sync(&p->restore_work);
+-
+- /* Indicate to other users that MM is no longer valid */
+- p->mm = NULL;
+-
+- mmu_notifier_put(&p->mmu_notifier);
++ kfd_process_notifier_release_internal(p);
+ }
+
+ static const struct mmu_notifier_ops kfd_process_mmu_notifier_ops = {
+@@ -1200,6 +1216,43 @@ static const struct mmu_notifier_ops kfd_process_mmu_notifier_ops = {
+ .free_notifier = kfd_process_free_notifier,
+ };
+
++/*
++ * This code handles the case when driver is being unloaded before all
++ * mm_struct are released. We need to safely free the kfd_process and
++ * avoid race conditions with mmu_notifier that might try to free them.
++ *
++ */
++void kfd_cleanup_processes(void)
++{
++ struct kfd_process *p;
++ struct hlist_node *p_temp;
++ unsigned int temp;
++ HLIST_HEAD(cleanup_list);
++
++ /*
++ * Move all remaining kfd_process from the process table to a
++ * temp list for processing. Once done, callback from mmu_notifier
++ * release will not see the kfd_process in the table and do early return,
++ * avoiding double free issues.
++ */
++ mutex_lock(&kfd_processes_mutex);
++ hash_for_each_safe(kfd_processes_table, temp, p_temp, p, kfd_processes) {
++ hash_del_rcu(&p->kfd_processes);
++ synchronize_srcu(&kfd_processes_srcu);
++ hlist_add_head(&p->kfd_processes, &cleanup_list);
++ }
++ mutex_unlock(&kfd_processes_mutex);
++
++ hlist_for_each_entry_safe(p, p_temp, &cleanup_list, kfd_processes)
++ kfd_process_notifier_release_internal(p);
++
++ /*
++ * Ensures that all outstanding free_notifier get called, triggering
++ * the release of the kfd_process struct.
++ */
++ mmu_notifier_synchronize();
++}
++
+ static int kfd_process_init_cwsr_apu(struct kfd_process *p, struct file *filep)
+ {
+ unsigned long offset;
+--
+2.39.2
+
--- /dev/null
+From e90bf977ac4685331e7a815c2d05446324434312 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 09:22:54 +0000
+Subject: fbdev: au1200fb: Fix potential divide by zero
+
+From: Wei Chen <harperchen1110@gmail.com>
+
+[ Upstream commit 44a3b36b42acfc433aaaf526191dd12fbb919fdb ]
+
+var->pixclock can be assigned to zero by user. Without
+proper check, divide by zero would occur when invoking
+macro PICOS2KHZ in au1200fb_fb_check_var.
+
+Error out if var->pixclock is zero.
+
+Signed-off-by: Wei Chen <harperchen1110@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/au1200fb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/video/fbdev/au1200fb.c b/drivers/video/fbdev/au1200fb.c
+index 81c3154544287..b6b22fa4a8a01 100644
+--- a/drivers/video/fbdev/au1200fb.c
++++ b/drivers/video/fbdev/au1200fb.c
+@@ -1040,6 +1040,9 @@ static int au1200fb_fb_check_var(struct fb_var_screeninfo *var,
+ u32 pixclock;
+ int screen_size, plane;
+
++ if (!var->pixclock)
++ return -EINVAL;
++
+ plane = fbdev->plane;
+
+ /* Make sure that the mode respect all LCD controller and
+--
+2.39.2
+
--- /dev/null
+From 01d815b18f0135054f4ac7f2ef7bedc850315672 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 08:33:47 +0000
+Subject: fbdev: intelfb: Fix potential divide by zero
+
+From: Wei Chen <harperchen1110@gmail.com>
+
+[ Upstream commit d823685486a3446d061fed7c7d2f80af984f119a ]
+
+Variable var->pixclock is controlled by user and can be assigned
+to zero. Without proper check, divide by zero would occur in
+intelfbhw_validate_mode and intelfbhw_mode_to_hw.
+
+Error out if var->pixclock is zero.
+
+Signed-off-by: Wei Chen <harperchen1110@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/intelfb/intelfbdrv.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/video/fbdev/intelfb/intelfbdrv.c b/drivers/video/fbdev/intelfb/intelfbdrv.c
+index 0a9e5067b2010..a81095b2b1ea5 100644
+--- a/drivers/video/fbdev/intelfb/intelfbdrv.c
++++ b/drivers/video/fbdev/intelfb/intelfbdrv.c
+@@ -1222,6 +1222,9 @@ static int intelfb_check_var(struct fb_var_screeninfo *var,
+
+ dinfo = GET_DINFO(info);
+
++ if (!var->pixclock)
++ return -EINVAL;
++
+ /* update the pitch */
+ if (intelfbhw_validate_mode(dinfo, var) != 0)
+ return -EINVAL;
+--
+2.39.2
+
--- /dev/null
+From 253616073bf3e7c755079797aff37d6d0d336677 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 09:05:18 +0000
+Subject: fbdev: lxfb: Fix potential divide by zero
+
+From: Wei Chen <harperchen1110@gmail.com>
+
+[ Upstream commit 61ac4b86a4c047c20d5cb423ddd87496f14d9868 ]
+
+var->pixclock can be assigned to zero by user. Without proper
+check, divide by zero would occur in lx_set_clock.
+
+Error out if var->pixclock is zero.
+
+Signed-off-by: Wei Chen <harperchen1110@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/geode/lxfb_core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/video/fbdev/geode/lxfb_core.c b/drivers/video/fbdev/geode/lxfb_core.c
+index 8130e9eee2b4b..556d8b1a9e06a 100644
+--- a/drivers/video/fbdev/geode/lxfb_core.c
++++ b/drivers/video/fbdev/geode/lxfb_core.c
+@@ -235,6 +235,9 @@ static void get_modedb(struct fb_videomode **modedb, unsigned int *size)
+
+ static int lxfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
+ {
++ if (!var->pixclock)
++ return -EINVAL;
++
+ if (var->xres > 1920 || var->yres > 1440)
+ return -EINVAL;
+
+--
+2.39.2
+
--- /dev/null
+From 4cd6c6b80b658ea7287f5d1f07dfc3c42d632139 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 07:18:31 +0000
+Subject: fbdev: nvidia: Fix potential divide by zero
+
+From: Wei Chen <harperchen1110@gmail.com>
+
+[ Upstream commit 92e2a00f2987483e1f9253625828622edd442e61 ]
+
+variable var->pixclock can be set by user. In case it
+equals to zero, divide by zero would occur in nvidiafb_set_par.
+
+Similar crashes have happened in other fbdev drivers. There
+is no check and modification on var->pixclock along the call
+chain to nvidia_check_var and nvidiafb_set_par. We believe it
+could also be triggered in driver nvidia from user site.
+
+Signed-off-by: Wei Chen <harperchen1110@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/nvidia/nvidia.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/video/fbdev/nvidia/nvidia.c b/drivers/video/fbdev/nvidia/nvidia.c
+index e60a276b4855d..ea4ba3dfb96bb 100644
+--- a/drivers/video/fbdev/nvidia/nvidia.c
++++ b/drivers/video/fbdev/nvidia/nvidia.c
+@@ -764,6 +764,8 @@ static int nvidiafb_check_var(struct fb_var_screeninfo *var,
+ int pitch, err = 0;
+
+ NVTRACE_ENTER();
++ if (!var->pixclock)
++ return -EINVAL;
+
+ var->transp.offset = 0;
+ var->transp.length = 0;
+--
+2.39.2
+
--- /dev/null
+From 14f89f6ea348b4102bb324191cfcb96d3b380541 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 13:08:56 +0000
+Subject: fbdev: tgafb: Fix potential divide by zero
+
+From: Wei Chen <harperchen1110@gmail.com>
+
+[ Upstream commit f90bd245de82c095187d8c2cabb8b488a39eaecc ]
+
+fb_set_var would by called when user invokes ioctl with cmd
+FBIOPUT_VSCREENINFO. User-provided data would finally reach
+tgafb_check_var. In case var->pixclock is assigned to zero,
+divide by zero would occur when checking whether reciprocal
+of var->pixclock is too high.
+
+Similar crashes have happened in other fbdev drivers. There
+is no check and modification on var->pixclock along the call
+chain to tgafb_check_var. We believe it could also be triggered
+in driver tgafb from user site.
+
+Signed-off-by: Wei Chen <harperchen1110@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/tgafb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/video/fbdev/tgafb.c b/drivers/video/fbdev/tgafb.c
+index 14d37c49633c6..b44004880f0d1 100644
+--- a/drivers/video/fbdev/tgafb.c
++++ b/drivers/video/fbdev/tgafb.c
+@@ -173,6 +173,9 @@ tgafb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
+ {
+ struct tga_par *par = (struct tga_par *)info->par;
+
++ if (!var->pixclock)
++ return -EINVAL;
++
+ if (par->tga_type == TGA_TYPE_8PLANE) {
+ if (var->bits_per_pixel != 8)
+ return -EINVAL;
+--
+2.39.2
+
--- /dev/null
+From b81fbe7a1756180ed1548f0c75439a194832c5ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 15:19:17 -0800
+Subject: lib: zstd: Backport fix for in-place decompression
+
+From: Nick Terrell <terrelln@fb.com>
+
+[ Upstream commit 038505c41f0aad26ef101f4f7f6e111531c3914f ]
+
+Backport the relevant part of upstream commit 5b266196 [0].
+
+This fixes in-place decompression for x86-64 kernel decompression. It
+uses a bound of 131072 + (uncompressed_size >> 8), which can be violated
+after upstream commit 6a7ede3d [1], as zstd can use part of the output
+buffer as temporary storage, and without this patch needs a bound of
+~262144.
+
+The fix is for zstd to detect that the input and output buffers overlap,
+so that zstd knows it can't use the overlapping portion of the output
+buffer as tempoary storage. If the margin is not large enough, this will
+ensure that zstd will fail the decompression, rather than overwriting
+part of the input data, and causing corruption.
+
+This fix has been landed upstream and is in release v1.5.4. That commit
+also adds unit and fuzz tests to verify that the margin we use is
+respected, and correct. That means that the fix is well tested upstream.
+
+I have not been able to reproduce the potential bug in x86-64 kernel
+decompression locally, nor have I recieved reports of failures to
+decompress the kernel. It is possible that compression saves enough
+space to make it very hard for the issue to appear.
+
+I've boot tested the zstd compressed kernel on x86-64 and i386 with this
+patch, which uses in-place decompression, and sanity tested zstd compression
+in btrfs / squashfs to make sure that we don't see any issues, but other
+uses of zstd shouldn't be affected, because they don't use in-place
+decompression.
+
+Thanks to Vasily Gorbik <gor@linux.ibm.com> for debugging a related issue
+on s390, which was triggered by the same commit, but was a bug in how
+__decompress() was called [2]. And to Sasha Levin <sashal@kernel.org>
+for the CC alerting me of the issue.
+
+[0] https://github.com/facebook/zstd/commit/5b266196a41e6a15e21bd4f0eeab43b938db1d90
+[1] https://github.com/facebook/zstd/commit/6a7ede3dfccbf3e0a5928b4224a039c260dcff72
+[2] https://lore.kernel.org/r/patch-1.thread-41c676.git-41c676c2d153.your-ad-here.call-01675030179-ext-9637@work.hours
+
+CC: Vasily Gorbik <gor@linux.ibm.com>
+CC: Heiko Carstens <hca@linux.ibm.com>
+CC: Sasha Levin <sashal@kernel.org>
+CC: Yann Collet <cyan@fb.com>
+Signed-off-by: Nick Terrell <terrelln@fb.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/zstd/decompress/zstd_decompress.c | 25 ++++++++++++++++++++++---
+ 1 file changed, 22 insertions(+), 3 deletions(-)
+
+diff --git a/lib/zstd/decompress/zstd_decompress.c b/lib/zstd/decompress/zstd_decompress.c
+index b9b935a9f5c0d..6b3177c947114 100644
+--- a/lib/zstd/decompress/zstd_decompress.c
++++ b/lib/zstd/decompress/zstd_decompress.c
+@@ -798,7 +798,7 @@ static size_t ZSTD_copyRawBlock(void* dst, size_t dstCapacity,
+ if (srcSize == 0) return 0;
+ RETURN_ERROR(dstBuffer_null, "");
+ }
+- ZSTD_memcpy(dst, src, srcSize);
++ ZSTD_memmove(dst, src, srcSize);
+ return srcSize;
+ }
+
+@@ -858,6 +858,7 @@ static size_t ZSTD_decompressFrame(ZSTD_DCtx* dctx,
+
+ /* Loop on each block */
+ while (1) {
++ BYTE* oBlockEnd = oend;
+ size_t decodedSize;
+ blockProperties_t blockProperties;
+ size_t const cBlockSize = ZSTD_getcBlockSize(ip, remainingSrcSize, &blockProperties);
+@@ -867,16 +868,34 @@ static size_t ZSTD_decompressFrame(ZSTD_DCtx* dctx,
+ remainingSrcSize -= ZSTD_blockHeaderSize;
+ RETURN_ERROR_IF(cBlockSize > remainingSrcSize, srcSize_wrong, "");
+
++ if (ip >= op && ip < oBlockEnd) {
++ /* We are decompressing in-place. Limit the output pointer so that we
++ * don't overwrite the block that we are currently reading. This will
++ * fail decompression if the input & output pointers aren't spaced
++ * far enough apart.
++ *
++ * This is important to set, even when the pointers are far enough
++ * apart, because ZSTD_decompressBlock_internal() can decide to store
++ * literals in the output buffer, after the block it is decompressing.
++ * Since we don't want anything to overwrite our input, we have to tell
++ * ZSTD_decompressBlock_internal to never write past ip.
++ *
++ * See ZSTD_allocateLiteralsBuffer() for reference.
++ */
++ oBlockEnd = op + (ip - op);
++ }
++
+ switch(blockProperties.blockType)
+ {
+ case bt_compressed:
+- decodedSize = ZSTD_decompressBlock_internal(dctx, op, (size_t)(oend-op), ip, cBlockSize, /* frame */ 1, not_streaming);
++ decodedSize = ZSTD_decompressBlock_internal(dctx, op, (size_t)(oBlockEnd-op), ip, cBlockSize, /* frame */ 1, not_streaming);
+ break;
+ case bt_raw :
++ /* Use oend instead of oBlockEnd because this function is safe to overlap. It uses memmove. */
+ decodedSize = ZSTD_copyRawBlock(op, (size_t)(oend-op), ip, cBlockSize);
+ break;
+ case bt_rle :
+- decodedSize = ZSTD_setRleBlock(op, (size_t)(oend-op), *ip, blockProperties.origSize);
++ decodedSize = ZSTD_setRleBlock(op, (size_t)(oBlockEnd-op), *ip, blockProperties.origSize);
+ break;
+ case bt_reserved :
+ default:
+--
+2.39.2
+
--- /dev/null
+From 65e554143561e67964380f542a723dda82717dce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 09:36:25 +1100
+Subject: md: avoid signed overflow in slot_store()
+
+From: NeilBrown <neilb@suse.de>
+
+[ Upstream commit 3bc57292278a0b6ac4656cad94c14f2453344b57 ]
+
+slot_store() uses kstrtouint() to get a slot number, but stores the
+result in an "int" variable (by casting a pointer).
+This can result in a negative slot number if the unsigned int value is
+very large.
+
+A negative number means that the slot is empty, but setting a negative
+slot number this way will not remove the device from the array. I don't
+think this is a serious problem, but it could cause confusion and it is
+best to fix it.
+
+Reported-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Song Liu <song@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 272cc5d14906f..beab84f0c585c 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -3131,6 +3131,9 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len)
+ err = kstrtouint(buf, 10, (unsigned int *)&slot);
+ if (err < 0)
+ return err;
++ if (slot < 0)
++ /* overflow */
++ return -ENOSPC;
+ }
+ if (rdev->mddev->pers && slot == -1) {
+ /* Setting 'slot' on an active array requires also
+--
+2.39.2
+
--- /dev/null
+From 67b49e9c3dd7377a6140c73423a18c2e3bad603b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 14:32:29 +0100
+Subject: net: hsr: Don't log netdev_err message on unknown prp dst node
+
+From: Kristian Overskeid <koverskeid@gmail.com>
+
+[ Upstream commit 28e8cabe80f3e6e3c98121576eda898eeb20f1b1 ]
+
+If no frames has been exchanged with a node for HSR_NODE_FORGET_TIME, the
+node will be deleted from the node_db list. If a frame is sent to the node
+after it is deleted, a netdev_err message for each slave interface is
+produced. This should not happen with dan nodes because of supervision
+frames, but can happen often with san nodes, which clutters the kernel
+log. Since the hsr protocol does not support sans, this is only relevant
+for the prp protocol.
+
+Signed-off-by: Kristian Overskeid <koverskeid@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/hsr/hsr_framereg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
+index 00db74d96583d..865eda39d6014 100644
+--- a/net/hsr/hsr_framereg.c
++++ b/net/hsr/hsr_framereg.c
+@@ -415,7 +415,7 @@ void hsr_addr_subst_dest(struct hsr_node *node_src, struct sk_buff *skb,
+ node_dst = find_node_by_addr_A(&port->hsr->node_db,
+ eth_hdr(skb)->h_dest);
+ if (!node_dst) {
+- if (net_ratelimit())
++ if (net_ratelimit() && port->hsr->prot_version != PRP_V1)
+ netdev_err(skb->dev, "%s: Unknown node\n", __func__);
+ return;
+ }
+--
+2.39.2
+
--- /dev/null
+From 795b98df42e299374dee3caea0cf06159a85c48c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jan 2023 10:09:01 +0200
+Subject: net/mlx5e: Lower maximum allowed MTU in XSK to match XDP
+ prerequisites
+
+From: Adham Faris <afaris@nvidia.com>
+
+[ Upstream commit 78dee7befd56987283c13877b834c0aa97ad51b9 ]
+
+XSK redirecting XDP programs require linearity, hence applies
+restrictions on the MTU. For PAGE_SIZE=4K, MTU shouldn't exceed 3498.
+
+Features that contradict with XDP such HW-LRO and HW-GRO are enforced
+by the driver in advance, during XSK params validation, except for MTU,
+which was not enforced before this patch.
+
+This has been spotted during test scenario described below:
+Attaching xdpsock program (PAGE_SIZE=4K), with MTU < 3498, detaching
+XDP program, changing the MTU to arbitrary value in the range
+[3499, 3754], attaching XDP program again, which ended up with failure
+since MTU is > 3498.
+
+This commit lowers the XSK MTU limitation to be aligned with XDP MTU
+limitation, since XSK socket is meaningless without XDP program.
+
+Signed-off-by: Adham Faris <afaris@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 47d4b54d15634..1f4233b2842f7 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -4117,13 +4117,17 @@ static bool mlx5e_xsk_validate_mtu(struct net_device *netdev,
+ struct xsk_buff_pool *xsk_pool =
+ mlx5e_xsk_get_pool(&chs->params, chs->params.xsk, ix);
+ struct mlx5e_xsk_param xsk;
++ int max_xdp_mtu;
+
+ if (!xsk_pool)
+ continue;
+
+ mlx5e_build_xsk_param(xsk_pool, &xsk);
++ max_xdp_mtu = mlx5e_xdp_max_mtu(new_params, &xsk);
+
+- if (!mlx5e_validate_xsk_param(new_params, &xsk, mdev)) {
++ /* Validate XSK params and XDP MTU in advance */
++ if (!mlx5e_validate_xsk_param(new_params, &xsk, mdev) ||
++ new_params->sw_mtu > max_xdp_mtu) {
+ u32 hr = mlx5e_get_linear_rq_headroom(new_params, &xsk);
+ int max_mtu_frame, max_mtu_page, max_mtu;
+
+@@ -4133,9 +4137,9 @@ static bool mlx5e_xsk_validate_mtu(struct net_device *netdev,
+ */
+ max_mtu_frame = MLX5E_HW2SW_MTU(new_params, xsk.chunk_size - hr);
+ max_mtu_page = MLX5E_HW2SW_MTU(new_params, SKB_MAX_HEAD(0));
+- max_mtu = min(max_mtu_frame, max_mtu_page);
++ max_mtu = min3(max_mtu_frame, max_mtu_page, max_xdp_mtu);
+
+- netdev_err(netdev, "MTU %d is too big for an XSK running on channel %u. Try MTU <= %d\n",
++ netdev_err(netdev, "MTU %d is too big for an XSK running on channel %u or its redirection XDP program. Try MTU <= %d\n",
+ new_params->sw_mtu, ix, max_mtu);
+ return false;
+ }
+--
+2.39.2
+
--- /dev/null
+From 3228525fd283c6e7db353daba164cdabb094f2b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 11:11:50 +0100
+Subject: nvme-pci: add NVME_QUIRK_BOGUS_NID for Lexar NM620
+
+From: Philipp Geulen <p.geulen@js-elektronik.de>
+
+[ Upstream commit b65d44fa0fe072c91bf41cd8756baa2b4c77eff2 ]
+
+Added a quirk to fix Lexar NM620 1TB SSD reporting duplicate NGUIDs.
+
+Signed-off-by: Philipp Geulen <p.geulen@js-elektronik.de>
+Reviewed-by: Chaitanya Kulkarni <kkch@nvidia.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index c51ebbee8103e..ea3f0806783a3 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -3491,6 +3491,8 @@ static const struct pci_device_id nvme_id_table[] = {
+ .driver_data = NVME_QUIRK_BOGUS_NID, },
+ { PCI_DEVICE(0x1d97, 0x2263), /* Lexar NM610 */
+ .driver_data = NVME_QUIRK_BOGUS_NID, },
++ { PCI_DEVICE(0x1d97, 0x1d97), /* Lexar NM620 */
++ .driver_data = NVME_QUIRK_BOGUS_NID, },
+ { PCI_DEVICE(0x1d97, 0x2269), /* Lexar NM760 */
+ .driver_data = NVME_QUIRK_BOGUS_NID, },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMAZON, 0x0061),
+--
+2.39.2
+
--- /dev/null
+From 860bef73f1b1ac8f1e4fc9b878215fe33a1799ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Mar 2023 18:05:08 -0300
+Subject: nvme-pci: fixing memory leak in probe teardown path
+
+From: Irvin Cote <irvincoteg@gmail.com>
+
+[ Upstream commit a61d265533b7fe0026a02a49916aa564ffe38e4c ]
+
+In case the nvme_probe teardown path is triggered the ctrl ref count does
+not reach 0 thus creating a memory leak upon failure of nvme_probe.
+
+Signed-off-by: Irvin Cote <irvincoteg@gmail.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 29c902b9aecbd..c51ebbee8103e 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -3126,6 +3126,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ nvme_dev_unmap(dev);
+ out_uninit_ctrl:
+ nvme_uninit_ctrl(&dev->ctrl);
++ nvme_put_ctrl(&dev->ctrl);
+ return result;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 05265566a1f5a98e1f6029dd723d1616ee5121ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Mar 2023 19:32:38 -0700
+Subject: sched_getaffinity: don't assume 'cpumask_size()' is fully initialized
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit 6015b1aca1a233379625385feb01dd014aca60b5 ]
+
+The getaffinity() system call uses 'cpumask_size()' to decide how big
+the CPU mask is - so far so good. It is indeed the allocation size of a
+cpumask.
+
+But the code also assumes that the whole allocation is initialized
+without actually doing so itself. That's wrong, because we might have
+fixed-size allocations (making copying and clearing more efficient), but
+not all of it is then necessarily used if 'nr_cpu_ids' is smaller.
+
+Having checked other users of 'cpumask_size()', they all seem to be ok,
+either using it purely for the allocation size, or explicitly zeroing
+the cpumask before using the size in bytes to copy it.
+
+See for example the ublk_ctrl_get_queue_affinity() function that uses
+the proper 'zalloc_cpumask_var()' to make sure that the whole mask is
+cleared, whether the storage is on the stack or if it was an external
+allocation.
+
+Fix this by just zeroing the allocation before using it. Do the same
+for the compat version of sched_getaffinity(), which had the same logic.
+
+Also, for consistency, make sched_getaffinity() use 'cpumask_bits()' to
+access the bits. For a cpumask_var_t, it ends up being a pointer to the
+same data either way, but it's just a good idea to treat it like you
+would a 'cpumask_t'. The compat case already did that.
+
+Reported-by: Ryan Roberts <ryan.roberts@arm.com>
+Link: https://lore.kernel.org/lkml/7d026744-6bd6-6827-0471-b5e8eae0be3f@arm.com/
+Cc: Yury Norov <yury.norov@gmail.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/compat.c | 2 +-
+ kernel/sched/core.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/compat.c b/kernel/compat.c
+index 55551989d9da5..fb50f29d9b361 100644
+--- a/kernel/compat.c
++++ b/kernel/compat.c
+@@ -152,7 +152,7 @@ COMPAT_SYSCALL_DEFINE3(sched_getaffinity, compat_pid_t, pid, unsigned int, len,
+ if (len & (sizeof(compat_ulong_t)-1))
+ return -EINVAL;
+
+- if (!alloc_cpumask_var(&mask, GFP_KERNEL))
++ if (!zalloc_cpumask_var(&mask, GFP_KERNEL))
+ return -ENOMEM;
+
+ ret = sched_getaffinity(pid, mask);
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 9a0698353d60f..57d84b534cdea 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -8404,14 +8404,14 @@ SYSCALL_DEFINE3(sched_getaffinity, pid_t, pid, unsigned int, len,
+ if (len & (sizeof(unsigned long)-1))
+ return -EINVAL;
+
+- if (!alloc_cpumask_var(&mask, GFP_KERNEL))
++ if (!zalloc_cpumask_var(&mask, GFP_KERNEL))
+ return -ENOMEM;
+
+ ret = sched_getaffinity(pid, mask);
+ if (ret == 0) {
+ unsigned int retlen = min(len, cpumask_size());
+
+- if (copy_to_user(user_mask_ptr, mask, retlen))
++ if (copy_to_user(user_mask_ptr, cpumask_bits(mask), retlen))
+ ret = -EFAULT;
+ else
+ ret = retlen;
+--
+2.39.2
+
btrfs-zoned-count-fresh-bg-region-as-zone-unusable.patch
btrfs-zoned-drop-space_info-active_total_bytes.patch
fsverity-don-t-drop-pagecache-at-end-of-fs_ioc_enabl.patch
+cifs-fix-missing-unload_nls-in-smb2_reconnect.patch
+xfrm-zero-padding-when-dumping-algos-and-encap.patch
+asoc-codecs-tx-macro-fix-for-kasan-slab-out-of-bound.patch
+asoc-intel-avs-max98357a-explicitly-define-codec-for.patch
+asoc-intel-avs-da7219-explicitly-define-codec-format.patch
+asoc-intel-avs-rt5682-explicitly-define-codec-format.patch
+asoc-intel-avs-ssm4567-remove-nau8825-bits.patch
+asoc-intel-avs-nau8825-adjust-clock-control.patch
+lib-zstd-backport-fix-for-in-place-decompression.patch
+zstd-fix-definition-of-assert.patch
+acpi-video-add-backlight-native-dmi-quirk-for-dell-v.patch
+acpi-x86-introduce-an-acpi_quirk_skip_gpio_event_han.patch
+acpi-x86-add-skip-i2c-clients-quirk-for-acer-iconia-.patch
+acpi-x86-add-skip-i2c-clients-quirk-for-lenovo-yoga-.patch
+asoc-sof-ipc3-check-for-upper-size-limit-for-the-rec.patch
+asoc-sof-ipc4-topology-fix-incorrect-sample-rate-pri.patch
+asoc-sof-intel-pci-tng-revert-invalid-bar-size-setti.patch
+asoc-sof-intel-hda-dsp-harden-d0i3-programming-seque.patch
+asoc-sof-intel-hda-ctrl-re-add-sleep-after-entering-.patch
+asoc-sof-ipc4-update-gain-ipc-msg-definition-to-alig.patch
+asoc-hdmi-codec-only-startup-shutdown-on-supported-s.patch
+wifi-mac80211-check-basic-rates-validity.patch
+md-avoid-signed-overflow-in-slot_store.patch
+x86-pvh-obtain-vga-console-info-in-dom0.patch
+drm-amdkfd-fix-bo-offset-for-multi-vma-page-migratio.patch
+drm-amdkfd-fix-a-potential-double-free-in-pqm_create.patch
+drm-amdgpu-vcn-custom-video-info-caps-for-sriov.patch
+drm-amdkfd-fix-potential-kgd_mem-uafs.patch
+drm-amd-display-fix-hdcp-failing-to-enable-after-sus.patch
+net-hsr-don-t-log-netdev_err-message-on-unknown-prp-.patch
+alsa-asihpi-check-pao-in-control_message.patch
+alsa-hda-ca0132-fixup-buffer-overrun-at-tuning_ctl_s.patch
+fbdev-tgafb-fix-potential-divide-by-zero.patch
+acpi-tools-pfrut-check-if-the-input-of-level-and-typ.patch
+sched_getaffinity-don-t-assume-cpumask_size-is-fully.patch
+nvme-pci-fixing-memory-leak-in-probe-teardown-path.patch
+nvme-pci-add-nvme_quirk_bogus_nid-for-lexar-nm620.patch
+drm-amdkfd-fixed-kfd_process-cleanup-on-module-exit.patch
+net-mlx5e-lower-maximum-allowed-mtu-in-xsk-to-match-.patch
+fbdev-nvidia-fix-potential-divide-by-zero.patch
+fbdev-intelfb-fix-potential-divide-by-zero.patch
+fbdev-lxfb-fix-potential-divide-by-zero.patch
+fbdev-au1200fb-fix-potential-divide-by-zero.patch
+tools-power-turbostat-fix-dev-cpu_dma_latency-warnin.patch
+tools-power-turbostat-fix-decoding-of-hwp_status.patch
+tracing-fix-wrong-return-in-kprobe_event_gen_test.c.patch
--- /dev/null
+From ffec8467cac86b07e98dd3033f160b3bf38bdb39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 15:17:50 +0200
+Subject: tools/power turbostat: fix decoding of HWP_STATUS
+
+From: Antti Laakso <antti.laakso@intel.com>
+
+[ Upstream commit 92c25393586ac799b9b7d9e50434f3c44a7622c4 ]
+
+The "excursion to minimum" information is in bit2
+in HWP_STATUS MSR. Fix the bitmask used for
+decoding the register.
+
+Signed-off-by: Antti Laakso <antti.laakso@intel.com>
+Reviewed-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/x86/turbostat/turbostat.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
+index c24054e3ef7ad..c61c6c704fbe6 100644
+--- a/tools/power/x86/turbostat/turbostat.c
++++ b/tools/power/x86/turbostat/turbostat.c
+@@ -4426,7 +4426,7 @@ int print_hwp(struct thread_data *t, struct core_data *c, struct pkg_data *p)
+
+ fprintf(outf, "cpu%d: MSR_HWP_STATUS: 0x%08llx "
+ "(%sGuaranteed_Perf_Change, %sExcursion_Min)\n",
+- cpu, msr, ((msr) & 0x1) ? "" : "No-", ((msr) & 0x2) ? "" : "No-");
++ cpu, msr, ((msr) & 0x1) ? "" : "No-", ((msr) & 0x4) ? "" : "No-");
+
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From 2411dbe122076b7d0cddf6dc13383916523f5acd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Dec 2022 10:18:16 -0500
+Subject: tools/power turbostat: Fix /dev/cpu_dma_latency warnings
+
+From: Prarit Bhargava <prarit@redhat.com>
+
+[ Upstream commit 40aafc7d58d3544f152a863a0e9863014b6d5d8c ]
+
+When running as non-root the following error is seen in turbostat:
+
+turbostat: fopen /dev/cpu_dma_latency
+: Permission denied
+
+turbostat and the man page have information on how to avoid other
+permission errors, so these can be fixed the same way.
+
+Provide better /dev/cpu_dma_latency warnings that provide instructions on
+how to avoid the error, and update the man page.
+
+Signed-off-by: Prarit Bhargava <prarit@redhat.com>
+Cc: linux-pm@vger.kernel.org
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/x86/turbostat/turbostat.8 | 2 ++
+ tools/power/x86/turbostat/turbostat.c | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/power/x86/turbostat/turbostat.8 b/tools/power/x86/turbostat/turbostat.8
+index c7b26a3603afe..3e1a4c4be001a 100644
+--- a/tools/power/x86/turbostat/turbostat.8
++++ b/tools/power/x86/turbostat/turbostat.8
+@@ -344,6 +344,8 @@ Alternatively, non-root users can be enabled to run turbostat this way:
+
+ # chmod +r /dev/cpu/*/msr
+
++# chmod +r /dev/cpu_dma_latency
++
+ .B "turbostat "
+ reads hardware counters, but doesn't write them.
+ So it will not interfere with the OS or other programs, including
+diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
+index aba460410dbd1..c24054e3ef7ad 100644
+--- a/tools/power/x86/turbostat/turbostat.c
++++ b/tools/power/x86/turbostat/turbostat.c
+@@ -5482,7 +5482,7 @@ void print_dev_latency(void)
+
+ retval = read(fd, (void *)&value, sizeof(int));
+ if (retval != sizeof(int)) {
+- warn("read %s\n", path);
++ warn("read failed %s\n", path);
+ close(fd);
+ return;
+ }
+--
+2.39.2
+
--- /dev/null
+From 75dd00aee887948106f947e0d5b27b6a3017548f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 10:58:18 +0300
+Subject: tracing: Fix wrong return in kprobe_event_gen_test.c
+
+From: Anton Gusev <aagusev@ispras.ru>
+
+[ Upstream commit bc4f359b3b607daac0290d0038561237a86b38cb ]
+
+Overwriting the error code with the deletion result may cause the
+function to return 0 despite encountering an error. Commit b111545d26c0
+("tracing: Remove the useless value assignment in
+test_create_synth_event()") solves a similar issue by
+returning the original error code, so this patch does the same.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Link: https://lore.kernel.org/linux-trace-kernel/20230131075818.5322-1-aagusev@ispras.ru
+
+Signed-off-by: Anton Gusev <aagusev@ispras.ru>
+Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/kprobe_event_gen_test.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/trace/kprobe_event_gen_test.c b/kernel/trace/kprobe_event_gen_test.c
+index c736487fc0e48..e0c420eb0b2b4 100644
+--- a/kernel/trace/kprobe_event_gen_test.c
++++ b/kernel/trace/kprobe_event_gen_test.c
+@@ -146,7 +146,7 @@ static int __init test_gen_kprobe_cmd(void)
+ if (trace_event_file_is_valid(gen_kprobe_test))
+ gen_kprobe_test = NULL;
+ /* We got an error after creating the event, delete it */
+- ret = kprobe_event_delete("gen_kprobe_test");
++ kprobe_event_delete("gen_kprobe_test");
+ goto out;
+ }
+
+@@ -211,7 +211,7 @@ static int __init test_gen_kretprobe_cmd(void)
+ if (trace_event_file_is_valid(gen_kretprobe_test))
+ gen_kretprobe_test = NULL;
+ /* We got an error after creating the event, delete it */
+- ret = kprobe_event_delete("gen_kretprobe_test");
++ kprobe_event_delete("gen_kretprobe_test");
+ goto out;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 6617d6f3f817c6e761c40abbb73ba63ad8a8c16b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Feb 2023 10:52:19 +0100
+Subject: wifi: mac80211: check basic rates validity
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit ce04abc3fcc62cd5640af981ebfd7c4dc3bded28 ]
+
+When userspace sets basic rates, it might send us some rates
+list that's empty or consists of invalid values only. We're
+currently ignoring invalid values and then may end up with a
+rates bitmap that's empty, which later results in a warning.
+
+Reject the call if there were no valid rates.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/cfg.c | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index d611e15301839..e24d2d5b04ad0 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2576,6 +2576,17 @@ static int ieee80211_change_bss(struct wiphy *wiphy,
+ if (!sband)
+ return -EINVAL;
+
++ if (params->basic_rates) {
++ if (!ieee80211_parse_bitrates(link->conf->chandef.width,
++ wiphy->bands[sband->band],
++ params->basic_rates,
++ params->basic_rates_len,
++ &link->conf->basic_rates))
++ return -EINVAL;
++ changed |= BSS_CHANGED_BASIC_RATES;
++ ieee80211_check_rate_mask(link);
++ }
++
+ if (params->use_cts_prot >= 0) {
+ link->conf->use_cts_prot = params->use_cts_prot;
+ changed |= BSS_CHANGED_ERP_CTS_PROT;
+@@ -2597,16 +2608,6 @@ static int ieee80211_change_bss(struct wiphy *wiphy,
+ changed |= BSS_CHANGED_ERP_SLOT;
+ }
+
+- if (params->basic_rates) {
+- ieee80211_parse_bitrates(link->conf->chandef.width,
+- wiphy->bands[sband->band],
+- params->basic_rates,
+- params->basic_rates_len,
+- &link->conf->basic_rates);
+- changed |= BSS_CHANGED_BASIC_RATES;
+- ieee80211_check_rate_mask(link);
+- }
+-
+ if (params->ap_isolate >= 0) {
+ if (params->ap_isolate)
+ sdata->flags |= IEEE80211_SDATA_DONT_BRIDGE_PACKETS;
+--
+2.39.2
+
--- /dev/null
+From ec6ca50686804013fdf01e589551951e952aba98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 15:45:48 +0100
+Subject: x86/PVH: obtain VGA console info in Dom0
+
+From: Jan Beulich <jbeulich@suse.com>
+
+[ Upstream commit 934ef33ee75c3846f605f18b65048acd147e3918 ]
+
+A new platform-op was added to Xen to allow obtaining the same VGA
+console information PV Dom0 is handed. Invoke the new function and have
+the output data processed by xen_init_vga().
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+
+Link: https://lore.kernel.org/r/8f315e92-7bda-c124-71cc-478ab9c5e610@suse.com
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/xen/Makefile | 2 +-
+ arch/x86/xen/enlighten_pv.c | 3 ++-
+ arch/x86/xen/enlighten_pvh.c | 13 +++++++++++++
+ arch/x86/xen/vga.c | 5 ++---
+ arch/x86/xen/xen-ops.h | 7 ++++---
+ include/xen/interface/platform.h | 3 +++
+ 6 files changed, 25 insertions(+), 8 deletions(-)
+
+diff --git a/arch/x86/xen/Makefile b/arch/x86/xen/Makefile
+index 3c5b52fbe4a7f..a9ec8c9f5c5dd 100644
+--- a/arch/x86/xen/Makefile
++++ b/arch/x86/xen/Makefile
+@@ -45,6 +45,6 @@ obj-$(CONFIG_PARAVIRT_SPINLOCKS)+= spinlock.o
+
+ obj-$(CONFIG_XEN_DEBUG_FS) += debugfs.o
+
+-obj-$(CONFIG_XEN_PV_DOM0) += vga.o
++obj-$(CONFIG_XEN_DOM0) += vga.o
+
+ obj-$(CONFIG_XEN_EFI) += efi.o
+diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
+index 5b13796628770..68f5f5d209dfa 100644
+--- a/arch/x86/xen/enlighten_pv.c
++++ b/arch/x86/xen/enlighten_pv.c
+@@ -1389,7 +1389,8 @@ asmlinkage __visible void __init xen_start_kernel(struct start_info *si)
+
+ x86_platform.set_legacy_features =
+ xen_dom0_set_legacy_features;
+- xen_init_vga(info, xen_start_info->console.dom0.info_size);
++ xen_init_vga(info, xen_start_info->console.dom0.info_size,
++ &boot_params.screen_info);
+ xen_start_info->console.domU.mfn = 0;
+ xen_start_info->console.domU.evtchn = 0;
+
+diff --git a/arch/x86/xen/enlighten_pvh.c b/arch/x86/xen/enlighten_pvh.c
+index bcae606bbc5cf..1da44aca896c6 100644
+--- a/arch/x86/xen/enlighten_pvh.c
++++ b/arch/x86/xen/enlighten_pvh.c
+@@ -43,6 +43,19 @@ void __init xen_pvh_init(struct boot_params *boot_params)
+ x86_init.oem.banner = xen_banner;
+
+ xen_efi_init(boot_params);
++
++ if (xen_initial_domain()) {
++ struct xen_platform_op op = {
++ .cmd = XENPF_get_dom0_console,
++ };
++ long ret = HYPERVISOR_platform_op(&op);
++
++ if (ret > 0)
++ xen_init_vga(&op.u.dom0_console,
++ min(ret * sizeof(char),
++ sizeof(op.u.dom0_console)),
++ &boot_params->screen_info);
++ }
+ }
+
+ void __init mem_map_via_hcall(struct boot_params *boot_params_p)
+diff --git a/arch/x86/xen/vga.c b/arch/x86/xen/vga.c
+index 14ea32e734d59..d97adab8420f4 100644
+--- a/arch/x86/xen/vga.c
++++ b/arch/x86/xen/vga.c
+@@ -9,10 +9,9 @@
+
+ #include "xen-ops.h"
+
+-void __init xen_init_vga(const struct dom0_vga_console_info *info, size_t size)
++void __init xen_init_vga(const struct dom0_vga_console_info *info, size_t size,
++ struct screen_info *screen_info)
+ {
+- struct screen_info *screen_info = &boot_params.screen_info;
+-
+ /* This is drawn from a dump from vgacon:startup in
+ * standard Linux. */
+ screen_info->orig_video_mode = 3;
+diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
+index 9a8bb972193d8..a10903785a338 100644
+--- a/arch/x86/xen/xen-ops.h
++++ b/arch/x86/xen/xen-ops.h
+@@ -108,11 +108,12 @@ static inline void xen_uninit_lock_cpu(int cpu)
+
+ struct dom0_vga_console_info;
+
+-#ifdef CONFIG_XEN_PV_DOM0
+-void __init xen_init_vga(const struct dom0_vga_console_info *, size_t size);
++#ifdef CONFIG_XEN_DOM0
++void __init xen_init_vga(const struct dom0_vga_console_info *, size_t size,
++ struct screen_info *);
+ #else
+ static inline void __init xen_init_vga(const struct dom0_vga_console_info *info,
+- size_t size)
++ size_t size, struct screen_info *si)
+ {
+ }
+ #endif
+diff --git a/include/xen/interface/platform.h b/include/xen/interface/platform.h
+index 655d92e803e14..79a443c65ea93 100644
+--- a/include/xen/interface/platform.h
++++ b/include/xen/interface/platform.h
+@@ -483,6 +483,8 @@ struct xenpf_symdata {
+ };
+ DEFINE_GUEST_HANDLE_STRUCT(xenpf_symdata);
+
++#define XENPF_get_dom0_console 64
++
+ struct xen_platform_op {
+ uint32_t cmd;
+ uint32_t interface_version; /* XENPF_INTERFACE_VERSION */
+@@ -506,6 +508,7 @@ struct xen_platform_op {
+ struct xenpf_mem_hotadd mem_add;
+ struct xenpf_core_parking core_parking;
+ struct xenpf_symdata symdata;
++ struct dom0_vga_console_info dom0_console;
+ uint8_t pad[128];
+ } u;
+ };
+--
+2.39.2
+
--- /dev/null
+From 127254d2d550ce033db377cd10412e32088512cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 09:09:52 +0800
+Subject: xfrm: Zero padding when dumping algos and encap
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 8222d5910dae08213b6d9d4bc9a7f8502855e624 ]
+
+When copying data to user-space we should ensure that only valid
+data is copied over. Padding in structures may be filled with
+random (possibly sensitve) data and should never be given directly
+to user-space.
+
+This patch fixes the copying of xfrm algorithms and the encap
+template in xfrm_user so that padding is zeroed.
+
+Reported-by: syzbot+fa5414772d5c445dac3c@syzkaller.appspotmail.com
+Reported-by: Hyunwoo Kim <v4bel@theori.io>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_user.c | 45 ++++++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 41 insertions(+), 4 deletions(-)
+
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index cf5172d4ce68c..103af2b3e986f 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -1012,7 +1012,9 @@ static int copy_to_user_aead(struct xfrm_algo_aead *aead, struct sk_buff *skb)
+ return -EMSGSIZE;
+
+ ap = nla_data(nla);
+- memcpy(ap, aead, sizeof(*aead));
++ strscpy_pad(ap->alg_name, aead->alg_name, sizeof(ap->alg_name));
++ ap->alg_key_len = aead->alg_key_len;
++ ap->alg_icv_len = aead->alg_icv_len;
+
+ if (redact_secret && aead->alg_key_len)
+ memset(ap->alg_key, 0, (aead->alg_key_len + 7) / 8);
+@@ -1032,7 +1034,8 @@ static int copy_to_user_ealg(struct xfrm_algo *ealg, struct sk_buff *skb)
+ return -EMSGSIZE;
+
+ ap = nla_data(nla);
+- memcpy(ap, ealg, sizeof(*ealg));
++ strscpy_pad(ap->alg_name, ealg->alg_name, sizeof(ap->alg_name));
++ ap->alg_key_len = ealg->alg_key_len;
+
+ if (redact_secret && ealg->alg_key_len)
+ memset(ap->alg_key, 0, (ealg->alg_key_len + 7) / 8);
+@@ -1043,6 +1046,40 @@ static int copy_to_user_ealg(struct xfrm_algo *ealg, struct sk_buff *skb)
+ return 0;
+ }
+
++static int copy_to_user_calg(struct xfrm_algo *calg, struct sk_buff *skb)
++{
++ struct nlattr *nla = nla_reserve(skb, XFRMA_ALG_COMP, sizeof(*calg));
++ struct xfrm_algo *ap;
++
++ if (!nla)
++ return -EMSGSIZE;
++
++ ap = nla_data(nla);
++ strscpy_pad(ap->alg_name, calg->alg_name, sizeof(ap->alg_name));
++ ap->alg_key_len = 0;
++
++ return 0;
++}
++
++static int copy_to_user_encap(struct xfrm_encap_tmpl *ep, struct sk_buff *skb)
++{
++ struct nlattr *nla = nla_reserve(skb, XFRMA_ENCAP, sizeof(*ep));
++ struct xfrm_encap_tmpl *uep;
++
++ if (!nla)
++ return -EMSGSIZE;
++
++ uep = nla_data(nla);
++ memset(uep, 0, sizeof(*uep));
++
++ uep->encap_type = ep->encap_type;
++ uep->encap_sport = ep->encap_sport;
++ uep->encap_dport = ep->encap_dport;
++ uep->encap_oa = ep->encap_oa;
++
++ return 0;
++}
++
+ static int xfrm_smark_put(struct sk_buff *skb, struct xfrm_mark *m)
+ {
+ int ret = 0;
+@@ -1098,12 +1135,12 @@ static int copy_to_user_state_extra(struct xfrm_state *x,
+ goto out;
+ }
+ if (x->calg) {
+- ret = nla_put(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg);
++ ret = copy_to_user_calg(x->calg, skb);
+ if (ret)
+ goto out;
+ }
+ if (x->encap) {
+- ret = nla_put(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
++ ret = copy_to_user_encap(x->encap, skb);
+ if (ret)
+ goto out;
+ }
+--
+2.39.2
+
--- /dev/null
+From 22f90de804e6385e6cbcc64b2c3d50ab937ca876 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Jan 2023 14:14:36 +0100
+Subject: zstd: Fix definition of assert()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
+
+[ Upstream commit 6906598f1ce93761716d780b6e3f171e13f0f4ce ]
+
+assert(x) should emit a warning if x is false. WARN_ON(x) emits a
+warning if x is true. Thus, assert(x) should be defined as WARN_ON(!x)
+rather than WARN_ON(x).
+
+Signed-off-by: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
+Signed-off-by: Nick Terrell <terrelln@fb.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/zstd/common/zstd_deps.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/zstd/common/zstd_deps.h b/lib/zstd/common/zstd_deps.h
+index 7a5bf44839c9c..f06df065dec01 100644
+--- a/lib/zstd/common/zstd_deps.h
++++ b/lib/zstd/common/zstd_deps.h
+@@ -84,7 +84,7 @@ static uint64_t ZSTD_div64(uint64_t dividend, uint32_t divisor) {
+
+ #include <linux/kernel.h>
+
+-#define assert(x) WARN_ON((x))
++#define assert(x) WARN_ON(!(x))
+
+ #endif /* ZSTD_DEPS_ASSERT */
+ #endif /* ZSTD_DEPS_NEED_ASSERT */
+--
+2.39.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
