--- /dev/null
+From 4bc988b47019536b3b1f7d9c5b83893c712d94d6 Mon Sep 17 00:00:00 2001
+From: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
+Date: Mon, 30 Sep 2024 21:52:56 +0200
+Subject: accel/ivpu: Fix fw log printing
+
+From: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
+
+commit 4bc988b47019536b3b1f7d9c5b83893c712d94d6 upstream.
+
+ - Fix empty log detection that couldn't work without read_wrap_count
+ - Start printing wrapped log from correct position (log_start)
+ - Properly handle logs that are wrapped multiple times in reference
+ to reader position
+ - Don't add a newline when log buffer is wrapped
+ - Always add a newline after printing a log buffer in case log does
+ not end with one
+
+Reviewed-by: Tomasz Rusinowicz <tomasz.rusinowicz@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240930195322.461209-6-jacek.lawrynowicz@linux.intel.com
+Signed-off-by: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/accel/ivpu/ivpu_fw_log.c | 49 +++++++++++++++++++++++++--------------
+ 1 file changed, 32 insertions(+), 17 deletions(-)
+
+--- a/drivers/accel/ivpu/ivpu_fw_log.c
++++ b/drivers/accel/ivpu/ivpu_fw_log.c
+@@ -87,7 +87,7 @@ static void fw_log_print_lines(char *buf
+ }
+ line[index] = 0;
+ if (index != 0)
+- drm_printf(p, "%s\n", line);
++ drm_printf(p, "%s", line);
+ }
+
+ static void fw_log_print_buffer(struct vpu_tracing_buffer_header *log, const char *prefix,
+@@ -95,23 +95,29 @@ static void fw_log_print_buffer(struct v
+ {
+ char *log_data = (void *)log + log->header_size;
+ u32 data_size = log->size - log->header_size;
+- u32 log_start = log->read_index;
+- u32 log_end = log->write_index;
++ u32 log_start = only_new_msgs ? READ_ONCE(log->read_index) : 0;
++ u32 log_end = READ_ONCE(log->write_index);
+
+- if (!(log->write_index || log->wrap_count) ||
+- (log->write_index == log->read_index && only_new_msgs)) {
+- drm_printf(p, "==== %s \"%s\" log empty ====\n", prefix, log->name);
+- return;
++ if (log->wrap_count == log->read_wrap_count) {
++ if (log_end <= log_start) {
++ drm_printf(p, "==== %s \"%s\" log empty ====\n", prefix, log->name);
++ return;
++ }
++ } else if (log->wrap_count == log->read_wrap_count + 1) {
++ if (log_end > log_start)
++ log_start = log_end;
++ } else {
++ log_start = log_end;
+ }
+
+ drm_printf(p, "==== %s \"%s\" log start ====\n", prefix, log->name);
+- if (log->write_index > log->read_index) {
++ if (log_end > log_start) {
+ fw_log_print_lines(log_data + log_start, log_end - log_start, p);
+ } else {
+- fw_log_print_lines(log_data + log_end, data_size - log_end, p);
++ fw_log_print_lines(log_data + log_start, data_size - log_start, p);
+ fw_log_print_lines(log_data, log_end, p);
+ }
+- drm_printf(p, "\x1b[0m");
++ drm_printf(p, "\n\x1b[0m"); /* add new line and clear formatting */
+ drm_printf(p, "==== %s \"%s\" log end ====\n", prefix, log->name);
+ }
+
+@@ -135,14 +141,19 @@ void ivpu_fw_log_print(struct ivpu_devic
+ void ivpu_fw_log_mark_read(struct ivpu_device *vdev)
+ {
+ struct vpu_tracing_buffer_header *log;
+- u32 next = 0;
++ u32 next;
+
+- while (fw_log_from_bo(vdev, vdev->fw->mem_log_crit, &next, &log) == 0)
+- log->read_index = log->write_index;
++ next = 0;
++ while (fw_log_from_bo(vdev, vdev->fw->mem_log_crit, &next, &log) == 0) {
++ log->read_index = READ_ONCE(log->write_index);
++ log->read_wrap_count = READ_ONCE(log->wrap_count);
++ }
+
+ next = 0;
+- while (fw_log_from_bo(vdev, vdev->fw->mem_log_verb, &next, &log) == 0)
+- log->read_index = log->write_index;
++ while (fw_log_from_bo(vdev, vdev->fw->mem_log_verb, &next, &log) == 0) {
++ log->read_index = READ_ONCE(log->write_index);
++ log->read_wrap_count = READ_ONCE(log->wrap_count);
++ }
+ }
+
+ void ivpu_fw_log_reset(struct ivpu_device *vdev)
+@@ -151,10 +162,14 @@ void ivpu_fw_log_reset(struct ivpu_devic
+ u32 next;
+
+ next = 0;
+- while (fw_log_from_bo(vdev, vdev->fw->mem_log_crit, &next, &log) == 0)
++ while (fw_log_from_bo(vdev, vdev->fw->mem_log_crit, &next, &log) == 0) {
+ log->read_index = 0;
++ log->read_wrap_count = 0;
++ }
+
+ next = 0;
+- while (fw_log_from_bo(vdev, vdev->fw->mem_log_verb, &next, &log) == 0)
++ while (fw_log_from_bo(vdev, vdev->fw->mem_log_verb, &next, &log) == 0) {
+ log->read_index = 0;
++ log->read_wrap_count = 0;
++ }
+ }
--- /dev/null
+From 1fc1251149a76d3b75d7f4c94d9c4e081b7df6b4 Mon Sep 17 00:00:00 2001
+From: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
+Date: Mon, 30 Sep 2024 21:52:55 +0200
+Subject: accel/ivpu: Refactor functions in ivpu_fw_log.c
+
+From: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
+
+commit 1fc1251149a76d3b75d7f4c94d9c4e081b7df6b4 upstream.
+
+Make function names more consistent and (arguably) readable in
+fw log code. Add fw_log_print_all_in_bo() that remove duplicated code in
+ivpu_fw_log_print().
+
+Reviewed-by: Tomasz Rusinowicz <tomasz.rusinowicz@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240930195322.461209-5-jacek.lawrynowicz@linux.intel.com
+Signed-off-by: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/accel/ivpu/ivpu_debugfs.c | 2 -
+ drivers/accel/ivpu/ivpu_fw_log.c | 62 ++++++++++++++++++++------------------
+ drivers/accel/ivpu/ivpu_fw_log.h | 2 -
+ 3 files changed, 35 insertions(+), 31 deletions(-)
+
+--- a/drivers/accel/ivpu/ivpu_debugfs.c
++++ b/drivers/accel/ivpu/ivpu_debugfs.c
+@@ -201,7 +201,7 @@ fw_log_fops_write(struct file *file, con
+ if (!size)
+ return -EINVAL;
+
+- ivpu_fw_log_clear(vdev);
++ ivpu_fw_log_mark_read(vdev);
+ return size;
+ }
+
+--- a/drivers/accel/ivpu/ivpu_fw_log.c
++++ b/drivers/accel/ivpu/ivpu_fw_log.c
+@@ -26,8 +26,8 @@ MODULE_PARM_DESC(fw_log_level,
+ " error=" __stringify(IVPU_FW_LOG_ERROR)
+ " fatal=" __stringify(IVPU_FW_LOG_FATAL));
+
+-static int fw_log_ptr(struct ivpu_device *vdev, struct ivpu_bo *bo, u32 *offset,
+- struct vpu_tracing_buffer_header **log_header)
++static int fw_log_from_bo(struct ivpu_device *vdev, struct ivpu_bo *bo, u32 *offset,
++ struct vpu_tracing_buffer_header **out_log)
+ {
+ struct vpu_tracing_buffer_header *log;
+
+@@ -48,7 +48,7 @@ static int fw_log_ptr(struct ivpu_device
+ return -EINVAL;
+ }
+
+- *log_header = log;
++ *out_log = log;
+ *offset += log->size;
+
+ ivpu_dbg(vdev, FW_BOOT,
+@@ -59,7 +59,7 @@ static int fw_log_ptr(struct ivpu_device
+ return 0;
+ }
+
+-static void buffer_print(char *buffer, u32 size, struct drm_printer *p)
++static void fw_log_print_lines(char *buffer, u32 size, struct drm_printer *p)
+ {
+ char line[IVPU_FW_LOG_LINE_LENGTH];
+ u32 index = 0;
+@@ -90,11 +90,11 @@ static void buffer_print(char *buffer, u
+ drm_printf(p, "%s\n", line);
+ }
+
+-static void fw_log_print_buffer(struct ivpu_device *vdev, struct vpu_tracing_buffer_header *log,
+- const char *prefix, bool only_new_msgs, struct drm_printer *p)
++static void fw_log_print_buffer(struct vpu_tracing_buffer_header *log, const char *prefix,
++ bool only_new_msgs, struct drm_printer *p)
+ {
+- char *log_buffer = (void *)log + log->header_size;
+- u32 log_size = log->size - log->header_size;
++ char *log_data = (void *)log + log->header_size;
++ u32 data_size = log->size - log->header_size;
+ u32 log_start = log->read_index;
+ u32 log_end = log->write_index;
+
+@@ -106,51 +106,55 @@ static void fw_log_print_buffer(struct i
+
+ drm_printf(p, "==== %s \"%s\" log start ====\n", prefix, log->name);
+ if (log->write_index > log->read_index) {
+- buffer_print(log_buffer + log_start, log_end - log_start, p);
++ fw_log_print_lines(log_data + log_start, log_end - log_start, p);
+ } else {
+- buffer_print(log_buffer + log_end, log_size - log_end, p);
+- buffer_print(log_buffer, log_end, p);
++ fw_log_print_lines(log_data + log_end, data_size - log_end, p);
++ fw_log_print_lines(log_data, log_end, p);
+ }
+ drm_printf(p, "\x1b[0m");
+ drm_printf(p, "==== %s \"%s\" log end ====\n", prefix, log->name);
+ }
+
+-void ivpu_fw_log_print(struct ivpu_device *vdev, bool only_new_msgs, struct drm_printer *p)
++static void
++fw_log_print_all_in_bo(struct ivpu_device *vdev, const char *name,
++ struct ivpu_bo *bo, bool only_new_msgs, struct drm_printer *p)
+ {
+- struct vpu_tracing_buffer_header *log_header;
++ struct vpu_tracing_buffer_header *log;
+ u32 next = 0;
+
+- while (fw_log_ptr(vdev, vdev->fw->mem_log_crit, &next, &log_header) == 0)
+- fw_log_print_buffer(vdev, log_header, "NPU critical", only_new_msgs, p);
++ while (fw_log_from_bo(vdev, bo, &next, &log) == 0)
++ fw_log_print_buffer(log, name, only_new_msgs, p);
++}
+
+- next = 0;
+- while (fw_log_ptr(vdev, vdev->fw->mem_log_verb, &next, &log_header) == 0)
+- fw_log_print_buffer(vdev, log_header, "NPU verbose", only_new_msgs, p);
++void ivpu_fw_log_print(struct ivpu_device *vdev, bool only_new_msgs, struct drm_printer *p)
++{
++ fw_log_print_all_in_bo(vdev, "NPU critical", vdev->fw->mem_log_crit, only_new_msgs, p);
++ fw_log_print_all_in_bo(vdev, "NPU verbose", vdev->fw->mem_log_verb, only_new_msgs, p);
+ }
+
+-void ivpu_fw_log_clear(struct ivpu_device *vdev)
++void ivpu_fw_log_mark_read(struct ivpu_device *vdev)
+ {
+- struct vpu_tracing_buffer_header *log_header;
++ struct vpu_tracing_buffer_header *log;
+ u32 next = 0;
+
+- while (fw_log_ptr(vdev, vdev->fw->mem_log_crit, &next, &log_header) == 0)
+- log_header->read_index = log_header->write_index;
++ while (fw_log_from_bo(vdev, vdev->fw->mem_log_crit, &next, &log) == 0)
++ log->read_index = log->write_index;
+
+ next = 0;
+- while (fw_log_ptr(vdev, vdev->fw->mem_log_verb, &next, &log_header) == 0)
+- log_header->read_index = log_header->write_index;
++ while (fw_log_from_bo(vdev, vdev->fw->mem_log_verb, &next, &log) == 0)
++ log->read_index = log->write_index;
+ }
+
+ void ivpu_fw_log_reset(struct ivpu_device *vdev)
+ {
+- struct vpu_tracing_buffer_header *log_header;
++ struct vpu_tracing_buffer_header *log;
+ u32 next;
+
+ next = 0;
+- while (fw_log_ptr(vdev, vdev->fw->mem_log_crit, &next, &log_header) == 0)
+- log_header->read_index = 0;
++ while (fw_log_from_bo(vdev, vdev->fw->mem_log_crit, &next, &log) == 0)
++ log->read_index = 0;
+
+ next = 0;
+- while (fw_log_ptr(vdev, vdev->fw->mem_log_verb, &next, &log_header) == 0)
+- log_header->read_index = 0;
++ while (fw_log_from_bo(vdev, vdev->fw->mem_log_verb, &next, &log) == 0)
++ log->read_index = 0;
+ }
+--- a/drivers/accel/ivpu/ivpu_fw_log.h
++++ b/drivers/accel/ivpu/ivpu_fw_log.h
+@@ -24,7 +24,7 @@
+ extern unsigned int ivpu_fw_log_level;
+
+ void ivpu_fw_log_print(struct ivpu_device *vdev, bool only_new_msgs, struct drm_printer *p);
+-void ivpu_fw_log_clear(struct ivpu_device *vdev);
++void ivpu_fw_log_mark_read(struct ivpu_device *vdev);
+ void ivpu_fw_log_reset(struct ivpu_device *vdev);
+
+
--- /dev/null
+From 3a3fb8110c65d361cd9d750c9e16520f740c93f2 Mon Sep 17 00:00:00 2001
+From: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
+Date: Mon, 30 Sep 2024 21:52:53 +0200
+Subject: accel/ivpu: Rename ivpu_log_level to fw_log_level
+
+From: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
+
+commit 3a3fb8110c65d361cd9d750c9e16520f740c93f2 upstream.
+
+Rename module param ivpu_log_level to fw_log_level, so it is clear
+what log level is actually changed.
+
+Reviewed-by: Maciej Falkowski <maciej.falkowski@linux.intel.com>
+Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240930195322.461209-3-jacek.lawrynowicz@linux.intel.com
+Signed-off-by: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/accel/ivpu/ivpu_fw.c | 4 ++--
+ drivers/accel/ivpu/ivpu_fw_log.c | 12 ++++++------
+ drivers/accel/ivpu/ivpu_fw_log.h | 6 +++---
+ 3 files changed, 11 insertions(+), 11 deletions(-)
+
+--- a/drivers/accel/ivpu/ivpu_fw.c
++++ b/drivers/accel/ivpu/ivpu_fw.c
+@@ -218,7 +218,7 @@ static int ivpu_fw_parse(struct ivpu_dev
+ fw->cold_boot_entry_point = fw_hdr->entry_point;
+ fw->entry_point = fw->cold_boot_entry_point;
+
+- fw->trace_level = min_t(u32, ivpu_log_level, IVPU_FW_LOG_FATAL);
++ fw->trace_level = min_t(u32, ivpu_fw_log_level, IVPU_FW_LOG_FATAL);
+ fw->trace_destination_mask = VPU_TRACE_DESTINATION_VERBOSE_TRACING;
+ fw->trace_hw_component_mask = -1;
+
+@@ -323,7 +323,7 @@ static int ivpu_fw_mem_init(struct ivpu_
+ goto err_free_fw_mem;
+ }
+
+- if (ivpu_log_level <= IVPU_FW_LOG_INFO)
++ if (ivpu_fw_log_level <= IVPU_FW_LOG_INFO)
+ log_verb_size = IVPU_FW_VERBOSE_BUFFER_LARGE_SIZE;
+ else
+ log_verb_size = IVPU_FW_VERBOSE_BUFFER_SMALL_SIZE;
+--- a/drivers/accel/ivpu/ivpu_fw_log.c
++++ b/drivers/accel/ivpu/ivpu_fw_log.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /*
+- * Copyright (C) 2020-2023 Intel Corporation
++ * Copyright (C) 2020-2024 Intel Corporation
+ */
+
+ #include <linux/ctype.h>
+@@ -15,12 +15,12 @@
+ #include "ivpu_fw_log.h"
+ #include "ivpu_gem.h"
+
+-#define IVPU_FW_LOG_LINE_LENGTH 256
++#define IVPU_FW_LOG_LINE_LENGTH 256
+
+-unsigned int ivpu_log_level = IVPU_FW_LOG_ERROR;
+-module_param(ivpu_log_level, uint, 0444);
+-MODULE_PARM_DESC(ivpu_log_level,
+- "NPU firmware default trace level: debug=" __stringify(IVPU_FW_LOG_DEBUG)
++unsigned int ivpu_fw_log_level = IVPU_FW_LOG_ERROR;
++module_param_named(fw_log_level, ivpu_fw_log_level, uint, 0444);
++MODULE_PARM_DESC(fw_log_level,
++ "NPU firmware default log level: debug=" __stringify(IVPU_FW_LOG_DEBUG)
+ " info=" __stringify(IVPU_FW_LOG_INFO)
+ " warn=" __stringify(IVPU_FW_LOG_WARN)
+ " error=" __stringify(IVPU_FW_LOG_ERROR)
+--- a/drivers/accel/ivpu/ivpu_fw_log.h
++++ b/drivers/accel/ivpu/ivpu_fw_log.h
+@@ -1,6 +1,6 @@
+ /* SPDX-License-Identifier: GPL-2.0-only */
+ /*
+- * Copyright (C) 2020-2023 Intel Corporation
++ * Copyright (C) 2020-2024 Intel Corporation
+ */
+
+ #ifndef __IVPU_FW_LOG_H__
+@@ -17,12 +17,12 @@
+ #define IVPU_FW_LOG_ERROR 4
+ #define IVPU_FW_LOG_FATAL 5
+
+-extern unsigned int ivpu_log_level;
+-
+ #define IVPU_FW_VERBOSE_BUFFER_SMALL_SIZE SZ_1M
+ #define IVPU_FW_VERBOSE_BUFFER_LARGE_SIZE SZ_8M
+ #define IVPU_FW_CRITICAL_BUFFER_SIZE SZ_512K
+
++extern unsigned int ivpu_fw_log_level;
++
+ void ivpu_fw_log_print(struct ivpu_device *vdev, bool only_new_msgs, struct drm_printer *p);
+ void ivpu_fw_log_clear(struct ivpu_device *vdev);
+
--- /dev/null
+From 4b4d9e394b6f45ac26ac6144b31604c76b7e3705 Mon Sep 17 00:00:00 2001
+From: Tomasz Rusinowicz <tomasz.rusinowicz@intel.com>
+Date: Mon, 30 Sep 2024 21:52:54 +0200
+Subject: accel/ivpu: Reset fw log on cold boot
+
+From: Tomasz Rusinowicz <tomasz.rusinowicz@intel.com>
+
+commit 4b4d9e394b6f45ac26ac6144b31604c76b7e3705 upstream.
+
+Add ivpu_fw_log_reset() that resets the read_index of all FW logs
+on cold boot so logs are properly read.
+
+Signed-off-by: Tomasz Rusinowicz <tomasz.rusinowicz@intel.com>
+Reviewed-by: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
+Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240930195322.461209-4-jacek.lawrynowicz@linux.intel.com
+Signed-off-by: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/accel/ivpu/ivpu_fw_log.c | 14 ++++++++++++++
+ drivers/accel/ivpu/ivpu_fw_log.h | 1 +
+ drivers/accel/ivpu/ivpu_pm.c | 1 +
+ 3 files changed, 16 insertions(+)
+
+--- a/drivers/accel/ivpu/ivpu_fw_log.c
++++ b/drivers/accel/ivpu/ivpu_fw_log.c
+@@ -140,3 +140,17 @@ void ivpu_fw_log_clear(struct ivpu_devic
+ while (fw_log_ptr(vdev, vdev->fw->mem_log_verb, &next, &log_header) == 0)
+ log_header->read_index = log_header->write_index;
+ }
++
++void ivpu_fw_log_reset(struct ivpu_device *vdev)
++{
++ struct vpu_tracing_buffer_header *log_header;
++ u32 next;
++
++ next = 0;
++ while (fw_log_ptr(vdev, vdev->fw->mem_log_crit, &next, &log_header) == 0)
++ log_header->read_index = 0;
++
++ next = 0;
++ while (fw_log_ptr(vdev, vdev->fw->mem_log_verb, &next, &log_header) == 0)
++ log_header->read_index = 0;
++}
+--- a/drivers/accel/ivpu/ivpu_fw_log.h
++++ b/drivers/accel/ivpu/ivpu_fw_log.h
+@@ -25,6 +25,7 @@ extern unsigned int ivpu_fw_log_level;
+
+ void ivpu_fw_log_print(struct ivpu_device *vdev, bool only_new_msgs, struct drm_printer *p);
+ void ivpu_fw_log_clear(struct ivpu_device *vdev);
++void ivpu_fw_log_reset(struct ivpu_device *vdev);
+
+
+ #endif /* __IVPU_FW_LOG_H__ */
+--- a/drivers/accel/ivpu/ivpu_pm.c
++++ b/drivers/accel/ivpu/ivpu_pm.c
+@@ -38,6 +38,7 @@ static void ivpu_pm_prepare_cold_boot(st
+
+ ivpu_cmdq_reset_all_contexts(vdev);
+ ivpu_ipc_reset(vdev);
++ ivpu_fw_log_reset(vdev);
+ ivpu_fw_load(vdev);
+ fw->entry_point = fw->cold_boot_entry_point;
+ }
--- /dev/null
+From 1f77c05408c96bc0b58ae476a9cadc9e5b9cfd0f Mon Sep 17 00:00:00 2001
+From: Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>
+Date: Mon, 10 Mar 2025 17:32:31 +0530
+Subject: Bluetooth: btnxpuart: Fix kernel panic during FW release
+
+From: Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>
+
+commit 1f77c05408c96bc0b58ae476a9cadc9e5b9cfd0f upstream.
+
+This fixes a kernel panic seen during release FW in a stress test
+scenario where WLAN and BT FW download occurs simultaneously, and due to
+a HW bug, chip sends out only 1 bootloader signatures.
+
+When driver receives the bootloader signature, it enters FW download
+mode, but since no consequtive bootloader signatures seen, FW file is
+not requested.
+
+After 60 seconds, when FW download times out, release_firmware causes a
+kernel panic.
+
+[ 2601.949184] Unable to handle kernel paging request at virtual address 0000312e6f006573
+[ 2601.992076] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000111802000
+[ 2601.992080] [0000312e6f006573] pgd=0000000000000000, p4d=0000000000000000
+[ 2601.992087] Internal error: Oops: 0000000096000021 [#1] PREEMPT SMP
+[ 2601.992091] Modules linked in: algif_hash algif_skcipher af_alg btnxpuart(O) pciexxx(O) mlan(O) overlay fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine authenc libdes crct10dif_ce polyval_ce snd_soc_fsl_easrc snd_soc_fsl_asoc_card imx8_media_dev(C) snd_soc_fsl_micfil polyval_generic snd_soc_fsl_xcvr snd_soc_fsl_sai snd_soc_imx_audmux snd_soc_fsl_asrc snd_soc_imx_card snd_soc_imx_hdmi snd_soc_fsl_aud2htx snd_soc_fsl_utils imx_pcm_dma dw_hdmi_cec flexcan can_dev
+[ 2602.001825] CPU: 2 PID: 20060 Comm: hciconfig Tainted: G C O 6.6.23-lts-next-06236-gb586a521770e #1
+[ 2602.010182] Hardware name: NXP i.MX8MPlus EVK board (DT)
+[ 2602.010185] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[ 2602.010191] pc : _raw_spin_lock+0x34/0x68
+[ 2602.010201] lr : free_fw_priv+0x20/0xfc
+[ 2602.020561] sp : ffff800089363b30
+[ 2602.020563] x29: ffff800089363b30 x28: ffff0000d0eb5880 x27: 0000000000000000
+[ 2602.020570] x26: 0000000000000000 x25: ffff0000d728b330 x24: 0000000000000000
+[ 2602.020577] x23: ffff0000dc856f38
+[ 2602.033797] x22: ffff800089363b70 x21: ffff0000dc856000
+[ 2602.033802] x20: ff00312e6f006573 x19: ffff0000d0d9ea80 x18: 0000000000000000
+[ 2602.033809] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaad80dd480
+[ 2602.083320] x14: 0000000000000000 x13: 00000000000001b9 x12: 0000000000000002
+[ 2602.083326] x11: 0000000000000000 x10: 0000000000000a60 x9 : ffff800089363a30
+[ 2602.083333] x8 : ffff0001793d75c0 x7 : ffff0000d6dbc400 x6 : 0000000000000000
+[ 2602.083339] x5 : 00000000410fd030 x4 : 0000000000000000 x3 : 0000000000000001
+[ 2602.083346] x2 : 0000000000000000 x1 : 0000000000000001 x0 : ff00312e6f006573
+[ 2602.083354] Call trace:
+[ 2602.083356] _raw_spin_lock+0x34/0x68
+[ 2602.083364] release_firmware+0x48/0x6c
+[ 2602.083370] nxp_setup+0x3c4/0x540 [btnxpuart]
+[ 2602.083383] hci_dev_open_sync+0xf0/0xa34
+[ 2602.083391] hci_dev_open+0xd8/0x178
+[ 2602.083399] hci_sock_ioctl+0x3b0/0x590
+[ 2602.083405] sock_do_ioctl+0x60/0x118
+[ 2602.083413] sock_ioctl+0x2f4/0x374
+[ 2602.091430] __arm64_sys_ioctl+0xac/0xf0
+[ 2602.091437] invoke_syscall+0x48/0x110
+[ 2602.091445] el0_svc_common.constprop.0+0xc0/0xe0
+[ 2602.091452] do_el0_svc+0x1c/0x28
+[ 2602.091457] el0_svc+0x40/0xe4
+[ 2602.091465] el0t_64_sync_handler+0x120/0x12c
+[ 2602.091470] el0t_64_sync+0x190/0x194
+
+Fixes: e3c4891098c8 ("Bluetooth: btnxpuart: Handle FW Download Abort scenario")
+Fixes: 689ca16e5232 ("Bluetooth: NXP: Add protocol support for NXP Bluetooth chipsets")
+Signed-off-by: Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Bin Lan <bin.lan.cn@windriver.com>
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/btnxpuart.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/bluetooth/btnxpuart.c
++++ b/drivers/bluetooth/btnxpuart.c
+@@ -612,8 +612,10 @@ static int nxp_download_firmware(struct
+ &nxpdev->tx_state),
+ msecs_to_jiffies(60000));
+
+- release_firmware(nxpdev->fw);
+- memset(nxpdev->fw_name, 0, sizeof(nxpdev->fw_name));
++ if (nxpdev->fw && strlen(nxpdev->fw_name)) {
++ release_firmware(nxpdev->fw);
++ memset(nxpdev->fw_name, 0, sizeof(nxpdev->fw_name));
++ }
+
+ if (err == 0) {
+ bt_dev_err(hdev, "FW Download Timeout. offset: %d",
+ struct xe_gt *gt = gsc_to_gt(gsc);
+
+ /* Proxy init can take up to 500ms, so wait double that for safety */
-+ return xe_mmio_wait32(>->mmio, HECI_FWSTS1(MTL_GSC_HECI1_BASE),
++ return xe_mmio_wait32(gt, HECI_FWSTS1(MTL_GSC_HECI1_BASE),
+ HECI1_FWSTS1_CURRENT_STATE,
+ HECI1_FWSTS1_PROXY_STATE_NORMAL,
+ USEC_PER_SEC, NULL, false);
--- /dev/null
+From f063a28002e3350088b4577c5640882bf4ea17ea Mon Sep 17 00:00:00 2001
+From: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Date: Fri, 21 Mar 2025 19:10:00 +0100
+Subject: iio: light: opt3001: fix deadlock due to concurrent flag access
+
+From: Luca Ceresoli <luca.ceresoli@bootlin.com>
+
+commit f063a28002e3350088b4577c5640882bf4ea17ea upstream.
+
+The threaded IRQ function in this driver is reading the flag twice: once to
+lock a mutex and once to unlock it. Even though the code setting the flag
+is designed to prevent it, there are subtle cases where the flag could be
+true at the mutex_lock stage and false at the mutex_unlock stage. This
+results in the mutex not being unlocked, resulting in a deadlock.
+
+Fix it by making the opt3001_irq() code generally more robust, reading the
+flag into a variable and using the variable value at both stages.
+
+Fixes: 94a9b7b1809f ("iio: light: add support for TI's opt3001 light sensor")
+Cc: stable@vger.kernel.org
+Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Link: https://patch.msgid.link/20250321-opt3001-irq-fix-v1-1-6c520d851562@bootlin.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+[Fixed conflict while applying on 6.12]
+Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/light/opt3001.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/light/opt3001.c
++++ b/drivers/iio/light/opt3001.c
+@@ -692,8 +692,9 @@ static irqreturn_t opt3001_irq(int irq,
+ struct opt3001 *opt = iio_priv(iio);
+ int ret;
+ bool wake_result_ready_queue = false;
++ bool ok_to_ignore_lock = opt->ok_to_ignore_lock;
+
+- if (!opt->ok_to_ignore_lock)
++ if (!ok_to_ignore_lock)
+ mutex_lock(&opt->lock);
+
+ ret = i2c_smbus_read_word_swapped(opt->client, OPT3001_CONFIGURATION);
+@@ -730,7 +731,7 @@ static irqreturn_t opt3001_irq(int irq,
+ }
+
+ out:
+- if (!opt->ok_to_ignore_lock)
++ if (!ok_to_ignore_lock)
+ mutex_unlock(&opt->lock);
+
+ if (wake_result_ready_queue)
cifs-new-mount-option-for-cifs.upcall-namespace-resolution.patch
drm-xe-gsc-do-not-flush-the-gsc-worker-from-the-reset-path.patch
mm-page_alloc-fix-race-condition-in-unaccepted-memory-handling.patch
+accel-ivpu-rename-ivpu_log_level-to-fw_log_level.patch
+accel-ivpu-reset-fw-log-on-cold-boot.patch
+accel-ivpu-refactor-functions-in-ivpu_fw_log.c.patch
+accel-ivpu-fix-fw-log-printing.patch
+iio-light-opt3001-fix-deadlock-due-to-concurrent-flag-access.patch
+bluetooth-btnxpuart-fix-kernel-panic-during-fw-release.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
