--- /dev/null
+From f203d4d579da975c2b43750364c81864fd729bef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2024 12:28:12 +0900
+Subject: ACPI: fan: cleanup resources in the error path of .probe()
+
+From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+
+[ Upstream commit c759bc8e9046f9812238f506d70f07d3ea4206d4 ]
+
+Call thermal_cooling_device_unregister() and sysfs_remove_link() in the
+error path of acpi_fan_probe() to fix possible memory leak.
+
+This bug was found by an experimental static analysis tool that I am
+developing.
+
+Fixes: 05a83d972293 ("ACPI: register ACPI Fan as generic thermal cooling device")
+Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+Link: https://patch.msgid.link/20241211032812.210164-1-joe@pf.is.s.u-tokyo.ac.jp
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/fan_core.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/fan_core.c b/drivers/acpi/fan_core.c
+index 52a0b303b70aa..36907331a6691 100644
+--- a/drivers/acpi/fan_core.c
++++ b/drivers/acpi/fan_core.c
+@@ -366,19 +366,25 @@ static int acpi_fan_probe(struct platform_device *pdev)
+ result = sysfs_create_link(&pdev->dev.kobj,
+ &cdev->device.kobj,
+ "thermal_cooling");
+- if (result)
++ if (result) {
+ dev_err(&pdev->dev, "Failed to create sysfs link 'thermal_cooling'\n");
++ goto err_unregister;
++ }
+
+ result = sysfs_create_link(&cdev->device.kobj,
+ &pdev->dev.kobj,
+ "device");
+ if (result) {
+ dev_err(&pdev->dev, "Failed to create sysfs link 'device'\n");
+- goto err_end;
++ goto err_remove_link;
+ }
+
+ return 0;
+
++err_remove_link:
++ sysfs_remove_link(&pdev->dev.kobj, "thermal_cooling");
++err_unregister:
++ thermal_cooling_device_unregister(cdev);
+ err_end:
+ if (fan->acpi4)
+ acpi_fan_delete_attributes(device);
+--
+2.39.5
+
--- /dev/null
+From 1afd7579cfba4323dde08b03e7908ca76bff8fac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2024 20:41:03 +0000
+Subject: afs: Fix directory format encoding struct
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 07a10767853adcbdbf436dc91393b729b52c4e81 ]
+
+The AFS directory format structure, union afs_xdr_dir_block::meta, has too
+many alloc counter slots declared and so pushes the hash table along and
+over the data. This doesn't cause a problem at the moment because I'm
+currently ignoring the hash table and only using the correct number of
+alloc_ctrs in the code anyway. In future, however, I should start using
+the hash table to try and speed up afs_lookup().
+
+Fix this by using the correct constant to declare the counter array.
+
+Fixes: 4ea219a839bf ("afs: Split the directory content defs into a header")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://lore.kernel.org/r/20241216204124.3752367-14-dhowells@redhat.com
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/xdr_fs.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/afs/xdr_fs.h b/fs/afs/xdr_fs.h
+index 8ca8681645077..cc5f143d21a34 100644
+--- a/fs/afs/xdr_fs.h
++++ b/fs/afs/xdr_fs.h
+@@ -88,7 +88,7 @@ union afs_xdr_dir_block {
+
+ struct {
+ struct afs_xdr_dir_hdr hdr;
+- u8 alloc_ctrs[AFS_DIR_MAX_BLOCKS];
++ u8 alloc_ctrs[AFS_DIR_BLOCKS_WITH_CTR];
+ __be16 hashtable[AFS_DIR_HASHTBL_SIZE];
+ } meta;
+
+--
+2.39.5
+
--- /dev/null
+From 1e589fb765f86b7718a3a40c57ecec3b42ed02b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2024 20:41:02 +0000
+Subject: afs: Fix EEXIST error returned from afs_rmdir() to be ENOTEMPTY
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit b49194da2aff2c879dec9c59ef8dec0f2b0809ef ]
+
+AFS servers pass back a code indicating EEXIST when they're asked to remove
+a directory that is not empty rather than ENOTEMPTY because not all the
+systems that an AFS server can run on have the latter error available and
+AFS preexisted the addition of that error in general.
+
+Fix afs_rmdir() to translate EEXIST to ENOTEMPTY.
+
+Fixes: 260a980317da ("[AFS]: Add "directory write" support.")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://lore.kernel.org/r/20241216204124.3752367-13-dhowells@redhat.com
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/dir.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/fs/afs/dir.c b/fs/afs/dir.c
+index 38d5260c4614f..cb537c669a8e8 100644
+--- a/fs/afs/dir.c
++++ b/fs/afs/dir.c
+@@ -1457,7 +1457,12 @@ static int afs_rmdir(struct inode *dir, struct dentry *dentry)
+ op->file[1].vnode = vnode;
+ }
+
+- return afs_do_sync_operation(op);
++ ret = afs_do_sync_operation(op);
++
++ /* Not all systems that can host afs servers have ENOTEMPTY. */
++ if (ret == -EEXIST)
++ ret = -ENOTEMPTY;
++ return ret;
+
+ error:
+ return afs_put_operation(op);
+--
+2.39.5
+
--- /dev/null
+From 04ebf246f9d185c2bc5de446067da0dd442202a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jan 2025 14:46:03 +0000
+Subject: afs: Fix the fallback handling for the YFS.RemoveFile2 RPC call
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit e30458d690f35abb01de8b3cbc09285deb725d00 ]
+
+Fix a pair of bugs in the fallback handling for the YFS.RemoveFile2 RPC
+call:
+
+ (1) Fix the abort code check to also look for RXGEN_OPCODE. The lack of
+ this masks the second bug.
+
+ (2) call->server is now not used for ordinary filesystem RPC calls that
+ have an operation descriptor. Fix to use call->op->server instead.
+
+Fixes: e49c7b2f6de7 ("afs: Build an abstraction around an "operation" concept")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://lore.kernel.org/r/109541.1736865963@warthog.procyon.org.uk
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/yfsclient.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/fs/afs/yfsclient.c b/fs/afs/yfsclient.c
+index 11571cca86c19..01f333e691d64 100644
+--- a/fs/afs/yfsclient.c
++++ b/fs/afs/yfsclient.c
+@@ -655,8 +655,9 @@ static int yfs_deliver_fs_remove_file2(struct afs_call *call)
+ static void yfs_done_fs_remove_file2(struct afs_call *call)
+ {
+ if (call->error == -ECONNABORTED &&
+- call->abort_code == RX_INVALID_OPERATION) {
+- set_bit(AFS_SERVER_FL_NO_RM2, &call->server->flags);
++ (call->abort_code == RX_INVALID_OPERATION ||
++ call->abort_code == RXGEN_OPCODE)) {
++ set_bit(AFS_SERVER_FL_NO_RM2, &call->op->server->flags);
+ call->op->flags |= AFS_OPERATION_DOWNGRADE;
+ }
+ }
+--
+2.39.5
+
--- /dev/null
+From 9892396a387d90b891dcf97116ee144010d21cc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Dec 2024 14:44:01 +0800
+Subject: ALSA: hda/realtek - Fixed headphone distorted sound on Acer Aspire
+ A115-31 laptop
+
+From: Kailang Yang <kailang@realtek.com>
+
+[ Upstream commit 5cb4e5b056772e341b590755a976081776422053 ]
+
+Sound played through headphones is distorted.
+
+Fixes: 34ab5bbc6e82 ("ALSA: hda/realtek - Add Headset Mic supported Acer NB platform")
+Closes: https://lore.kernel.org/linux-sound/e142749b-7714-4733-9452-918fbe328c8f@gmail.com/
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Link: https://lore.kernel.org/0a89b6c18ed94378a105fa61e9f290e4@realtek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index eec488aa7890d..8da964c3856fe 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9583,6 +9583,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x132a, "Acer TravelMate B114-21", ALC233_FIXUP_ACER_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1025, 0x1360, "Acer Aspire A115", ALC255_FIXUP_ACER_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x141f, "Acer Spin SP513-54N", ALC255_FIXUP_ACER_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x142b, "Acer Swift SF314-42", ALC255_FIXUP_ACER_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x1430, "Acer TravelMate B311R-31", ALC256_FIXUP_ACER_MIC_NO_PRESENCE),
+--
+2.39.5
+
--- /dev/null
+From 9d2ca9b015f66f2817d1ec93331cad4b3e25072a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Nov 2024 17:56:48 +0100
+Subject: ARM: at91: pm: change BU Power Switch to automatic mode
+
+From: Nicolas Ferre <nicolas.ferre@microchip.com>
+
+[ Upstream commit 6fc5bdfa872b7da51b5507a1327a17c3db2fcf95 ]
+
+Change how the Backup Unit Power is configured and force the
+automatic/hardware mode.
+This change eliminates the need for software management of the power
+switch, ensuring it transitions to the backup power source before
+entering low power modes.
+
+This is done in the only location where this switch was configured. It's
+usually done in the bootloader.
+
+Previously, the loss of the VDDANA (or VDDIN33) power source was not
+automatically compensated by an alternative power source. This resulted
+in the loss of Backup Unit content, including Backup Self-refresh low
+power mode information, OTP emulation configuration, and boot
+configuration, for instance.
+
+Fixes: ac809e7879b1 ("ARM: at91: pm: switch backup area to vbat in backup mode")
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Link: https://lore.kernel.org/r/20241125165648.509162-1-nicolas.ferre@microchip.com
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-at91/pm.c | 31 ++++++++++++++++++++-----------
+ 1 file changed, 20 insertions(+), 11 deletions(-)
+
+diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
+index 437dd0352fd44..4d0d0d49a7442 100644
+--- a/arch/arm/mach-at91/pm.c
++++ b/arch/arm/mach-at91/pm.c
+@@ -590,7 +590,21 @@ static int at91_suspend_finish(unsigned long val)
+ return 0;
+ }
+
+-static void at91_pm_switch_ba_to_vbat(void)
++/**
++ * at91_pm_switch_ba_to_auto() - Configure Backup Unit Power Switch
++ * to automatic/hardware mode.
++ *
++ * The Backup Unit Power Switch can be managed either by software or hardware.
++ * Enabling hardware mode allows the automatic transition of power between
++ * VDDANA (or VDDIN33) and VDDBU (or VBAT, respectively), based on the
++ * availability of these power sources.
++ *
++ * If the Backup Unit Power Switch is already in automatic mode, no action is
++ * required. If it is in software-controlled mode, it is switched to automatic
++ * mode to enhance safety and eliminate the need for toggling between power
++ * sources.
++ */
++static void at91_pm_switch_ba_to_auto(void)
+ {
+ unsigned int offset = offsetof(struct at91_pm_sfrbu_regs, pswbu);
+ unsigned int val;
+@@ -601,24 +615,19 @@ static void at91_pm_switch_ba_to_vbat(void)
+
+ val = readl(soc_pm.data.sfrbu + offset);
+
+- /* Already on VBAT. */
+- if (!(val & soc_pm.sfrbu_regs.pswbu.state))
++ /* Already on auto/hardware. */
++ if (!(val & soc_pm.sfrbu_regs.pswbu.ctrl))
+ return;
+
+- val &= ~soc_pm.sfrbu_regs.pswbu.softsw;
+- val |= soc_pm.sfrbu_regs.pswbu.key | soc_pm.sfrbu_regs.pswbu.ctrl;
++ val &= ~soc_pm.sfrbu_regs.pswbu.ctrl;
++ val |= soc_pm.sfrbu_regs.pswbu.key;
+ writel(val, soc_pm.data.sfrbu + offset);
+-
+- /* Wait for update. */
+- val = readl(soc_pm.data.sfrbu + offset);
+- while (val & soc_pm.sfrbu_regs.pswbu.state)
+- val = readl(soc_pm.data.sfrbu + offset);
+ }
+
+ static void at91_pm_suspend(suspend_state_t state)
+ {
+ if (soc_pm.data.mode == AT91_PM_BACKUP) {
+- at91_pm_switch_ba_to_vbat();
++ at91_pm_switch_ba_to_auto();
+
+ cpu_suspend(0, at91_suspend_finish);
+
+--
+2.39.5
+
--- /dev/null
+From e2d5f77e51a250adbe5a1f491a5b9095e66fea6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Jun 2024 11:46:33 +0200
+Subject: ARM: dts: mediatek: mt7623: fix IR nodename
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 90234cf9b37c57201a24b78c217a91a8af774109 ]
+
+Fix following validation error:
+arch/arm/boot/dts/mediatek/mt7623a-rfb-emmc.dtb: cir@10013000: $nodename:0: 'cir@10013000' does not match '^ir(-receiver)?(@[a-f0-9]+)?$'
+ from schema $id: http://devicetree.org/schemas/media/mediatek,mt7622-cir.yaml#
+
+Fixes: 91044f38dae7 ("arm: dts: mt7623: add ir nodes to the mt7623.dtsi file")
+Cc: linux-media@vger.kernel.org
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20240617094634.23173-1-zajec5@gmail.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/mt7623.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/mt7623.dtsi b/arch/arm/boot/dts/mt7623.dtsi
+index 25d31e40a5535..74767b6703720 100644
+--- a/arch/arm/boot/dts/mt7623.dtsi
++++ b/arch/arm/boot/dts/mt7623.dtsi
+@@ -309,7 +309,7 @@
+ clock-names = "spi", "wrap";
+ };
+
+- cir: cir@10013000 {
++ cir: ir-receiver@10013000 {
+ compatible = "mediatek,mt7623-cir";
+ reg = <0 0x10013000 0 0x1000>;
+ interrupts = <GIC_SPI 87 IRQ_TYPE_LEVEL_LOW>;
+--
+2.39.5
+
--- /dev/null
+From 62f2b68442c271501a1c858e1eaa06db39458589 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2024 13:24:21 +0800
+Subject: arm64: dts: mediatek: mt8173-elm: Drop regulator-compatible property
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 4b907b3ea5fba240808136cc5599d14b52230b39 ]
+
+The "regulator-compatible" property has been deprecated since 2012 in
+commit 13511def87b9 ("regulator: deprecate regulator-compatible DT
+property"), which is so old it's not even mentioned in the converted
+regulator bindings YAML file. It is also not listed in the MT6397
+regulator bindings. Having them present produces a whole bunch of
+validation errors:
+
+ Unevaluated properties are not allowed ('regulator-compatible' was unexpected)
+
+Drop the "regulator-compatible" property from the board dts. The
+property values are the same as the node name, so everything should
+continue to work.
+
+Fixes: 689b937bedde ("arm64: dts: mediatek: add mt8173 elm and hana board")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20241211052427.4178367-4-wenst@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi | 23 --------------------
+ 1 file changed, 23 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi b/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi
+index e21feb85d822b..6e82aea16c729 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi
+@@ -938,7 +938,6 @@
+ compatible = "mediatek,mt6397-regulator";
+
+ mt6397_vpca15_reg: buck_vpca15 {
+- regulator-compatible = "buck_vpca15";
+ regulator-name = "vpca15";
+ regulator-min-microvolt = < 700000>;
+ regulator-max-microvolt = <1350000>;
+@@ -948,7 +947,6 @@
+ };
+
+ mt6397_vpca7_reg: buck_vpca7 {
+- regulator-compatible = "buck_vpca7";
+ regulator-name = "vpca7";
+ regulator-min-microvolt = < 700000>;
+ regulator-max-microvolt = <1350000>;
+@@ -958,7 +956,6 @@
+ };
+
+ mt6397_vsramca15_reg: buck_vsramca15 {
+- regulator-compatible = "buck_vsramca15";
+ regulator-name = "vsramca15";
+ regulator-min-microvolt = < 700000>;
+ regulator-max-microvolt = <1350000>;
+@@ -967,7 +964,6 @@
+ };
+
+ mt6397_vsramca7_reg: buck_vsramca7 {
+- regulator-compatible = "buck_vsramca7";
+ regulator-name = "vsramca7";
+ regulator-min-microvolt = < 700000>;
+ regulator-max-microvolt = <1350000>;
+@@ -976,7 +972,6 @@
+ };
+
+ mt6397_vcore_reg: buck_vcore {
+- regulator-compatible = "buck_vcore";
+ regulator-name = "vcore";
+ regulator-min-microvolt = < 700000>;
+ regulator-max-microvolt = <1350000>;
+@@ -985,7 +980,6 @@
+ };
+
+ mt6397_vgpu_reg: buck_vgpu {
+- regulator-compatible = "buck_vgpu";
+ regulator-name = "vgpu";
+ regulator-min-microvolt = < 700000>;
+ regulator-max-microvolt = <1350000>;
+@@ -994,7 +988,6 @@
+ };
+
+ mt6397_vdrm_reg: buck_vdrm {
+- regulator-compatible = "buck_vdrm";
+ regulator-name = "vdrm";
+ regulator-min-microvolt = <1200000>;
+ regulator-max-microvolt = <1400000>;
+@@ -1003,7 +996,6 @@
+ };
+
+ mt6397_vio18_reg: buck_vio18 {
+- regulator-compatible = "buck_vio18";
+ regulator-name = "vio18";
+ regulator-min-microvolt = <1620000>;
+ regulator-max-microvolt = <1980000>;
+@@ -1012,18 +1004,15 @@
+ };
+
+ mt6397_vtcxo_reg: ldo_vtcxo {
+- regulator-compatible = "ldo_vtcxo";
+ regulator-name = "vtcxo";
+ regulator-always-on;
+ };
+
+ mt6397_va28_reg: ldo_va28 {
+- regulator-compatible = "ldo_va28";
+ regulator-name = "va28";
+ };
+
+ mt6397_vcama_reg: ldo_vcama {
+- regulator-compatible = "ldo_vcama";
+ regulator-name = "vcama";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+@@ -1031,18 +1020,15 @@
+ };
+
+ mt6397_vio28_reg: ldo_vio28 {
+- regulator-compatible = "ldo_vio28";
+ regulator-name = "vio28";
+ regulator-always-on;
+ };
+
+ mt6397_vusb_reg: ldo_vusb {
+- regulator-compatible = "ldo_vusb";
+ regulator-name = "vusb";
+ };
+
+ mt6397_vmc_reg: ldo_vmc {
+- regulator-compatible = "ldo_vmc";
+ regulator-name = "vmc";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <3300000>;
+@@ -1050,7 +1036,6 @@
+ };
+
+ mt6397_vmch_reg: ldo_vmch {
+- regulator-compatible = "ldo_vmch";
+ regulator-name = "vmch";
+ regulator-min-microvolt = <3000000>;
+ regulator-max-microvolt = <3300000>;
+@@ -1058,7 +1043,6 @@
+ };
+
+ mt6397_vemc_3v3_reg: ldo_vemc3v3 {
+- regulator-compatible = "ldo_vemc3v3";
+ regulator-name = "vemc_3v3";
+ regulator-min-microvolt = <3000000>;
+ regulator-max-microvolt = <3300000>;
+@@ -1066,7 +1050,6 @@
+ };
+
+ mt6397_vgp1_reg: ldo_vgp1 {
+- regulator-compatible = "ldo_vgp1";
+ regulator-name = "vcamd";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+@@ -1074,7 +1057,6 @@
+ };
+
+ mt6397_vgp2_reg: ldo_vgp2 {
+- regulator-compatible = "ldo_vgp2";
+ regulator-name = "vcamio";
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
+@@ -1082,7 +1064,6 @@
+ };
+
+ mt6397_vgp3_reg: ldo_vgp3 {
+- regulator-compatible = "ldo_vgp3";
+ regulator-name = "vcamaf";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+@@ -1090,7 +1071,6 @@
+ };
+
+ mt6397_vgp4_reg: ldo_vgp4 {
+- regulator-compatible = "ldo_vgp4";
+ regulator-name = "vgp4";
+ regulator-min-microvolt = <1200000>;
+ regulator-max-microvolt = <3300000>;
+@@ -1098,7 +1078,6 @@
+ };
+
+ mt6397_vgp5_reg: ldo_vgp5 {
+- regulator-compatible = "ldo_vgp5";
+ regulator-name = "vgp5";
+ regulator-min-microvolt = <1200000>;
+ regulator-max-microvolt = <3000000>;
+@@ -1106,7 +1085,6 @@
+ };
+
+ mt6397_vgp6_reg: ldo_vgp6 {
+- regulator-compatible = "ldo_vgp6";
+ regulator-name = "vgp6";
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
+@@ -1115,7 +1093,6 @@
+ };
+
+ mt6397_vibr_reg: ldo_vibr {
+- regulator-compatible = "ldo_vibr";
+ regulator-name = "vibr";
+ regulator-min-microvolt = <1300000>;
+ regulator-max-microvolt = <3300000>;
+--
+2.39.5
+
--- /dev/null
+From ce366edf156a8b62888d6ccf38b54eabeb066a08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2024 17:26:12 +0800
+Subject: arm64: dts: mediatek: mt8173-elm: Fix MT6397 PMIC sub-node names
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit beb06b727194f68b0a4b5183e50c88265ce185af ]
+
+The MT6397 PMIC bindings specify exact names for its sub-nodes. The
+names used in the current dts don't match, causing a validation error.
+
+Fix up the names. Also drop the label for the regulators node, since
+any reference should be against the individual regulator sub-nodes.
+
+Fixes: 689b937bedde ("arm64: dts: mediatek: add mt8173 elm and hana board")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20241210092614.3951748-1-wenst@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi b/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi
+index 6e82aea16c729..1135ed0bf90c4 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi
+@@ -922,7 +922,7 @@
+ interrupt-controller;
+ #interrupt-cells = <2>;
+
+- clock: mt6397clock {
++ clock: clocks {
+ compatible = "mediatek,mt6397-clk";
+ #clock-cells = <1>;
+ };
+@@ -934,7 +934,7 @@
+ #gpio-cells = <2>;
+ };
+
+- regulator: mt6397regulator {
++ regulators {
+ compatible = "mediatek,mt6397-regulator";
+
+ mt6397_vpca15_reg: buck_vpca15 {
+@@ -1100,7 +1100,7 @@
+ };
+ };
+
+- rtc: mt6397rtc {
++ rtc: rtc {
+ compatible = "mediatek,mt6397-rtc";
+ };
+
+--
+2.39.5
+
--- /dev/null
+From 2b96ec0d8423b60e1f77120722c2f10dbfdb379e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2024 13:24:20 +0800
+Subject: arm64: dts: mediatek: mt8173-evb: Drop regulator-compatible property
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit a6d5983e40f5d5b219337569cdd269727f5a3e2e ]
+
+The "regulator-compatible" property has been deprecated since 2012 in
+commit 13511def87b9 ("regulator: deprecate regulator-compatible DT
+property"), which is so old it's not even mentioned in the converted
+regulator bindings YAML file. It is also not listed in the MT6397
+regulator bindings. Having them present produces a whole bunch of
+validation errors:
+
+ Unevaluated properties are not allowed ('regulator-compatible' was unexpected)
+
+Drop the "regulator-compatible" property from the board dts. The
+property values are the same as the node name, so everything should
+continue to work.
+
+Fixes: 16ea61fc5614 ("arm64: dts: mt8173-evb: Add PMIC support")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20241211052427.4178367-3-wenst@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8173-evb.dts | 23 ---------------------
+ 1 file changed, 23 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts
+index 49c7185243cc1..52b1114ca77e8 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts
+@@ -311,7 +311,6 @@
+ compatible = "mediatek,mt6397-regulator";
+
+ mt6397_vpca15_reg: buck_vpca15 {
+- regulator-compatible = "buck_vpca15";
+ regulator-name = "vpca15";
+ regulator-min-microvolt = < 700000>;
+ regulator-max-microvolt = <1350000>;
+@@ -320,7 +319,6 @@
+ };
+
+ mt6397_vpca7_reg: buck_vpca7 {
+- regulator-compatible = "buck_vpca7";
+ regulator-name = "vpca7";
+ regulator-min-microvolt = < 700000>;
+ regulator-max-microvolt = <1350000>;
+@@ -329,7 +327,6 @@
+ };
+
+ mt6397_vsramca15_reg: buck_vsramca15 {
+- regulator-compatible = "buck_vsramca15";
+ regulator-name = "vsramca15";
+ regulator-min-microvolt = < 700000>;
+ regulator-max-microvolt = <1350000>;
+@@ -338,7 +335,6 @@
+ };
+
+ mt6397_vsramca7_reg: buck_vsramca7 {
+- regulator-compatible = "buck_vsramca7";
+ regulator-name = "vsramca7";
+ regulator-min-microvolt = < 700000>;
+ regulator-max-microvolt = <1350000>;
+@@ -347,7 +343,6 @@
+ };
+
+ mt6397_vcore_reg: buck_vcore {
+- regulator-compatible = "buck_vcore";
+ regulator-name = "vcore";
+ regulator-min-microvolt = < 700000>;
+ regulator-max-microvolt = <1350000>;
+@@ -356,7 +351,6 @@
+ };
+
+ mt6397_vgpu_reg: buck_vgpu {
+- regulator-compatible = "buck_vgpu";
+ regulator-name = "vgpu";
+ regulator-min-microvolt = < 700000>;
+ regulator-max-microvolt = <1350000>;
+@@ -365,7 +359,6 @@
+ };
+
+ mt6397_vdrm_reg: buck_vdrm {
+- regulator-compatible = "buck_vdrm";
+ regulator-name = "vdrm";
+ regulator-min-microvolt = <1200000>;
+ regulator-max-microvolt = <1400000>;
+@@ -374,7 +367,6 @@
+ };
+
+ mt6397_vio18_reg: buck_vio18 {
+- regulator-compatible = "buck_vio18";
+ regulator-name = "vio18";
+ regulator-min-microvolt = <1620000>;
+ regulator-max-microvolt = <1980000>;
+@@ -383,19 +375,16 @@
+ };
+
+ mt6397_vtcxo_reg: ldo_vtcxo {
+- regulator-compatible = "ldo_vtcxo";
+ regulator-name = "vtcxo";
+ regulator-always-on;
+ };
+
+ mt6397_va28_reg: ldo_va28 {
+- regulator-compatible = "ldo_va28";
+ regulator-name = "va28";
+ regulator-always-on;
+ };
+
+ mt6397_vcama_reg: ldo_vcama {
+- regulator-compatible = "ldo_vcama";
+ regulator-name = "vcama";
+ regulator-min-microvolt = <1500000>;
+ regulator-max-microvolt = <2800000>;
+@@ -403,18 +392,15 @@
+ };
+
+ mt6397_vio28_reg: ldo_vio28 {
+- regulator-compatible = "ldo_vio28";
+ regulator-name = "vio28";
+ regulator-always-on;
+ };
+
+ mt6397_vusb_reg: ldo_vusb {
+- regulator-compatible = "ldo_vusb";
+ regulator-name = "vusb";
+ };
+
+ mt6397_vmc_reg: ldo_vmc {
+- regulator-compatible = "ldo_vmc";
+ regulator-name = "vmc";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <3300000>;
+@@ -422,7 +408,6 @@
+ };
+
+ mt6397_vmch_reg: ldo_vmch {
+- regulator-compatible = "ldo_vmch";
+ regulator-name = "vmch";
+ regulator-min-microvolt = <3000000>;
+ regulator-max-microvolt = <3300000>;
+@@ -430,7 +415,6 @@
+ };
+
+ mt6397_vemc_3v3_reg: ldo_vemc3v3 {
+- regulator-compatible = "ldo_vemc3v3";
+ regulator-name = "vemc_3v3";
+ regulator-min-microvolt = <3000000>;
+ regulator-max-microvolt = <3300000>;
+@@ -438,7 +422,6 @@
+ };
+
+ mt6397_vgp1_reg: ldo_vgp1 {
+- regulator-compatible = "ldo_vgp1";
+ regulator-name = "vcamd";
+ regulator-min-microvolt = <1220000>;
+ regulator-max-microvolt = <3300000>;
+@@ -446,7 +429,6 @@
+ };
+
+ mt6397_vgp2_reg: ldo_vgp2 {
+- regulator-compatible = "ldo_vgp2";
+ regulator-name = "vcamio";
+ regulator-min-microvolt = <1000000>;
+ regulator-max-microvolt = <3300000>;
+@@ -454,7 +436,6 @@
+ };
+
+ mt6397_vgp3_reg: ldo_vgp3 {
+- regulator-compatible = "ldo_vgp3";
+ regulator-name = "vcamaf";
+ regulator-min-microvolt = <1200000>;
+ regulator-max-microvolt = <3300000>;
+@@ -462,7 +443,6 @@
+ };
+
+ mt6397_vgp4_reg: ldo_vgp4 {
+- regulator-compatible = "ldo_vgp4";
+ regulator-name = "vgp4";
+ regulator-min-microvolt = <1200000>;
+ regulator-max-microvolt = <3300000>;
+@@ -470,7 +450,6 @@
+ };
+
+ mt6397_vgp5_reg: ldo_vgp5 {
+- regulator-compatible = "ldo_vgp5";
+ regulator-name = "vgp5";
+ regulator-min-microvolt = <1200000>;
+ regulator-max-microvolt = <3000000>;
+@@ -478,7 +457,6 @@
+ };
+
+ mt6397_vgp6_reg: ldo_vgp6 {
+- regulator-compatible = "ldo_vgp6";
+ regulator-name = "vgp6";
+ regulator-min-microvolt = <1200000>;
+ regulator-max-microvolt = <3300000>;
+@@ -486,7 +464,6 @@
+ };
+
+ mt6397_vibr_reg: ldo_vibr {
+- regulator-compatible = "ldo_vibr";
+ regulator-name = "vibr";
+ regulator-min-microvolt = <1300000>;
+ regulator-max-microvolt = <3300000>;
+--
+2.39.5
+
--- /dev/null
+From 6254e26d0f5066d782aaf8978275950803c81be5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2024 17:26:13 +0800
+Subject: arm64: dts: mediatek: mt8173-evb: Fix MT6397 PMIC sub-node names
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 9545ba142865b9099d43c972b9ebcf463606499a ]
+
+The MT6397 PMIC bindings specify exact names for its sub-nodes. The
+names used in the current dts don't match, causing a validation error.
+
+Fix up the names. Also drop the label for the regulators node, since
+any reference should be against the individual regulator sub-nodes.
+
+Fixes: 16ea61fc5614 ("arm64: dts: mt8173-evb: Add PMIC support")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20241210092614.3951748-2-wenst@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8173-evb.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts
+index 52b1114ca77e8..8bc3ea1a7fbcd 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts
+@@ -307,7 +307,7 @@
+ interrupt-controller;
+ #interrupt-cells = <2>;
+
+- mt6397regulator: mt6397regulator {
++ regulators {
+ compatible = "mediatek,mt6397-regulator";
+
+ mt6397_vpca15_reg: buck_vpca15 {
+--
+2.39.5
+
--- /dev/null
+From 78c34d9c1e6f0aca9dcea4128aa9c6b4a9544cf3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2024 05:27:47 +0000
+Subject: arm64: dts: mediatek: mt8183: kenzo: Support second source
+ touchscreen
+
+From: Hsin-Te Yuan <yuanhsinte@chromium.org>
+
+[ Upstream commit 5ec5dc73c5ac0c6e06803dc3b5aea4493e856568 ]
+
+Some kenzo devices use second source touchscreen.
+
+Fixes: 0a9cefe21aec ("arm64: dts: mt8183: Add kukui-jacuzzi-kenzo board")
+Signed-off-by: Hsin-Te Yuan <yuanhsinte@chromium.org>
+Link: https://lore.kernel.org/r/20241213-touchscreen-v3-1-7c1f670913f9@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/mediatek/mt8183-kukui-jacuzzi-kenzo.dts | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-kenzo.dts b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-kenzo.dts
+index 8fa89db03e639..328294245a79d 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-kenzo.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-kenzo.dts
+@@ -11,3 +11,18 @@
+ model = "Google kenzo sku17 board";
+ compatible = "google,juniper-sku17", "google,juniper", "mediatek,mt8183";
+ };
++
++&i2c0 {
++ touchscreen@40 {
++ compatible = "hid-over-i2c";
++ reg = <0x40>;
++
++ pinctrl-names = "default";
++ pinctrl-0 = <&touchscreen_pins>;
++
++ interrupts-extended = <&pio 155 IRQ_TYPE_LEVEL_LOW>;
++
++ post-power-on-delay-ms = <70>;
++ hid-descr-addr = <0x0001>;
++ };
++};
+--
+2.39.5
+
--- /dev/null
+From 13ac283e008a43a257727ee555c0713532fbb644 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Oct 2024 15:02:20 +0800
+Subject: arm64: dts: mediatek: mt8183-kukui-jacuzzi: Drop pp3300_panel voltage
+ settings
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 0b5b1c881a909f17c05ef4b1ccb421e077f6e466 ]
+
+The pp3300_panel fixed regulator is just a load switch. It does not have
+any regulating capabilities. Thus having voltage constraints on it is
+wrong.
+
+Remove the voltage constraints.
+
+Fixes: cabc71b08eb5 ("arm64: dts: mt8183: Add kukui-jacuzzi-damu board")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20241030070224.1006331-2-wenst@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi
+index 629c4b7ecbc62..8e0575f8c1b27 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi
+@@ -39,8 +39,6 @@
+ pp3300_panel: pp3300-panel {
+ compatible = "regulator-fixed";
+ regulator-name = "pp3300_panel";
+- regulator-min-microvolt = <3300000>;
+- regulator-max-microvolt = <3300000>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pp3300_panel_pins>;
+
+--
+2.39.5
+
--- /dev/null
+From 43a3f159e5bb068e7fc928c7167517f7d0ed1a0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2024 05:27:48 +0000
+Subject: arm64: dts: mediatek: mt8183: willow: Support second source
+ touchscreen
+
+From: Hsin-Te Yuan <yuanhsinte@chromium.org>
+
+[ Upstream commit 9594935260d76bffe200bea6cfab6ba0752e70d9 ]
+
+Some willow devices use second source touchscreen.
+
+Fixes: f006bcf1c972 ("arm64: dts: mt8183: Add kukui-jacuzzi-willow board")
+Signed-off-by: Hsin-Te Yuan <yuanhsinte@chromium.org>
+Link: https://lore.kernel.org/r/20241213-touchscreen-v3-2-7c1f670913f9@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/mediatek/mt8183-kukui-jacuzzi-willow.dtsi | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-willow.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-willow.dtsi
+index 76d33540166f9..c942e461a177e 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-willow.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-willow.dtsi
+@@ -6,6 +6,21 @@
+ /dts-v1/;
+ #include "mt8183-kukui-jacuzzi.dtsi"
+
++&i2c0 {
++ touchscreen@40 {
++ compatible = "hid-over-i2c";
++ reg = <0x40>;
++
++ pinctrl-names = "default";
++ pinctrl-0 = <&touchscreen_pins>;
++
++ interrupts-extended = <&pio 155 IRQ_TYPE_LEVEL_LOW>;
++
++ post-power-on-delay-ms = <70>;
++ hid-descr-addr = <0x0001>;
++ };
++};
++
+ &i2c2 {
+ trackpad@2c {
+ compatible = "hid-over-i2c";
+--
+2.39.5
+
--- /dev/null
+From 19db9d4ec2cff57e0f4fbf97c5fed71d38b5bb82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2024 13:24:22 +0800
+Subject: arm64: dts: mediatek: mt8192-asurada: Drop regulator-compatible
+ property
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit d1fb968551c8688652b8b817bb081fdc9c25cd48 ]
+
+The "regulator-compatible" property has been deprecated since 2012 in
+commit 13511def87b9 ("regulator: deprecate regulator-compatible DT
+property"), which is so old it's not even mentioned in the converted
+regulator bindings YAML file. It should not have been used for new
+submissions such as the MT6315.
+
+Drop the "regulator-compatible" property from the board dts. The
+property values are the same as the node name, so everything should
+continue to work.
+
+Fixes: 3183cb62b033 ("arm64: dts: mediatek: asurada: Add SPMI regulators")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20241211052427.4178367-5-wenst@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi b/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi
+index 0814ed6a7272d..7e5230581a1c7 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi
+@@ -901,7 +901,6 @@
+
+ regulators {
+ mt6315_6_vbuck1: vbuck1 {
+- regulator-compatible = "vbuck1";
+ regulator-name = "Vbcpu";
+ regulator-min-microvolt = <400000>;
+ regulator-max-microvolt = <1193750>;
+@@ -911,7 +910,6 @@
+ };
+
+ mt6315_6_vbuck3: vbuck3 {
+- regulator-compatible = "vbuck3";
+ regulator-name = "Vlcpu";
+ regulator-min-microvolt = <400000>;
+ regulator-max-microvolt = <1193750>;
+@@ -928,7 +926,6 @@
+
+ regulators {
+ mt6315_7_vbuck1: vbuck1 {
+- regulator-compatible = "vbuck1";
+ regulator-name = "Vgpu";
+ regulator-min-microvolt = <400000>;
+ regulator-max-microvolt = <800000>;
+--
+2.39.5
+
--- /dev/null
+From d173291aa916185a24bcf77ba68fb38c3b41a21a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2024 13:24:23 +0800
+Subject: arm64: dts: mediatek: mt8195-cherry: Drop regulator-compatible
+ property
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 4dbaa5d5def2c49e44efaa5e796c23d9b904be09 ]
+
+The "regulator-compatible" property has been deprecated since 2012 in
+commit 13511def87b9 ("regulator: deprecate regulator-compatible DT
+property"), which is so old it's not even mentioned in the converted
+regulator bindings YAML file. It should not have been used for new
+submissions such as the MT6315.
+
+Drop the "regulator-compatible" property from the board dts. The
+property values are the same as the node name, so everything should
+continue to work.
+
+Fixes: 260c04d425eb ("arm64: dts: mediatek: cherry: Enable MT6315 regulators on SPMI bus")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20241211052427.4178367-6-wenst@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi b/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi
+index 0243da99d9c69..e4861c6cd78e1 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8195-cherry.dtsi
+@@ -843,7 +843,6 @@
+
+ regulators {
+ mt6315_6_vbuck1: vbuck1 {
+- regulator-compatible = "vbuck1";
+ regulator-name = "Vbcpu";
+ regulator-min-microvolt = <400000>;
+ regulator-max-microvolt = <1193750>;
+@@ -861,7 +860,6 @@
+
+ regulators {
+ mt6315_7_vbuck1: vbuck1 {
+- regulator-compatible = "vbuck1";
+ regulator-name = "Vgpu";
+ regulator-min-microvolt = <400000>;
+ regulator-max-microvolt = <1193750>;
+--
+2.39.5
+
--- /dev/null
+From d89f00849b47b454027a590569ef3d87dddf66f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2024 13:24:24 +0800
+Subject: arm64: dts: mediatek: mt8195-demo: Drop regulator-compatible property
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 2a8af9b95f504260a6d8200a11f0ae5c90e9f787 ]
+
+The "regulator-compatible" property has been deprecated since 2012 in
+commit 13511def87b9 ("regulator: deprecate regulator-compatible DT
+property"), which is so old it's not even mentioned in the converted
+regulator bindings YAML file. It is also not listed in the MT6360
+regulator and charger bindings.
+
+Drop the "regulator-compatible" property from the board dts. The MT6360
+bindings actually require the lowercase name, so with the property
+present the regulators were likely not actually working.
+
+Fixes: 6147314aeedc ("arm64: dts: mediatek: Add device-tree for MT8195 Demo board")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20241211052427.4178367-7-wenst@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8195-demo.dts | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8195-demo.dts b/arch/arm64/boot/dts/mediatek/mt8195-demo.dts
+index 998c2e78168a6..4e1803ab99634 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8195-demo.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8195-demo.dts
+@@ -120,7 +120,6 @@
+ richtek,vinovp-microvolt = <14500000>;
+
+ otg_vbus_regulator: usb-otg-vbus-regulator {
+- regulator-compatible = "usb-otg-vbus";
+ regulator-name = "usb-otg-vbus";
+ regulator-min-microvolt = <4425000>;
+ regulator-max-microvolt = <5825000>;
+@@ -132,7 +131,6 @@
+ LDO_VIN3-supply = <&mt6360_buck2>;
+
+ mt6360_buck1: buck1 {
+- regulator-compatible = "BUCK1";
+ regulator-name = "mt6360,buck1";
+ regulator-min-microvolt = <300000>;
+ regulator-max-microvolt = <1300000>;
+@@ -143,7 +141,6 @@
+ };
+
+ mt6360_buck2: buck2 {
+- regulator-compatible = "BUCK2";
+ regulator-name = "mt6360,buck2";
+ regulator-min-microvolt = <300000>;
+ regulator-max-microvolt = <1300000>;
+@@ -154,7 +151,6 @@
+ };
+
+ mt6360_ldo1: ldo1 {
+- regulator-compatible = "LDO1";
+ regulator-name = "mt6360,ldo1";
+ regulator-min-microvolt = <1200000>;
+ regulator-max-microvolt = <3600000>;
+@@ -163,7 +159,6 @@
+ };
+
+ mt6360_ldo2: ldo2 {
+- regulator-compatible = "LDO2";
+ regulator-name = "mt6360,ldo2";
+ regulator-min-microvolt = <1200000>;
+ regulator-max-microvolt = <3600000>;
+@@ -172,7 +167,6 @@
+ };
+
+ mt6360_ldo3: ldo3 {
+- regulator-compatible = "LDO3";
+ regulator-name = "mt6360,ldo3";
+ regulator-min-microvolt = <1200000>;
+ regulator-max-microvolt = <3600000>;
+@@ -181,7 +175,6 @@
+ };
+
+ mt6360_ldo5: ldo5 {
+- regulator-compatible = "LDO5";
+ regulator-name = "mt6360,ldo5";
+ regulator-min-microvolt = <2700000>;
+ regulator-max-microvolt = <3600000>;
+@@ -190,7 +183,6 @@
+ };
+
+ mt6360_ldo6: ldo6 {
+- regulator-compatible = "LDO6";
+ regulator-name = "mt6360,ldo6";
+ regulator-min-microvolt = <500000>;
+ regulator-max-microvolt = <2100000>;
+@@ -199,7 +191,6 @@
+ };
+
+ mt6360_ldo7: ldo7 {
+- regulator-compatible = "LDO7";
+ regulator-name = "mt6360,ldo7";
+ regulator-min-microvolt = <500000>;
+ regulator-max-microvolt = <2100000>;
+--
+2.39.5
+
--- /dev/null
+From 912153f63a0a65cef6ec1bdddec13483eea87b66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2024 16:05:06 -0300
+Subject: arm64: dts: mediatek: mt8516: add i2c clock-div property
+
+From: Val Packett <val@packett.cool>
+
+[ Upstream commit eb72341fd92b7af510d236e5a8554d855ed38d3c ]
+
+Move the clock-div property from the pumpkin board dtsi to the SoC's
+since it belongs to the SoC itself and is required on other devices.
+
+Fixes: 5236347bde42 ("arm64: dts: mediatek: add dtsi for MT8516")
+Signed-off-by: Val Packett <val@packett.cool>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20241204190524.21862-4-val@packett.cool
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8516.dtsi | 3 +++
+ arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi | 2 --
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8516.dtsi b/arch/arm64/boot/dts/mediatek/mt8516.dtsi
+index 558f7e744113d..0b86863381cf3 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8516.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8516.dtsi
+@@ -345,6 +345,7 @@
+ reg = <0 0x11009000 0 0x90>,
+ <0 0x11000180 0 0x80>;
+ interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_LOW>;
++ clock-div = <2>;
+ clocks = <&topckgen CLK_TOP_I2C0>,
+ <&topckgen CLK_TOP_APDMA>;
+ clock-names = "main", "dma";
+@@ -359,6 +360,7 @@
+ reg = <0 0x1100a000 0 0x90>,
+ <0 0x11000200 0 0x80>;
+ interrupts = <GIC_SPI 81 IRQ_TYPE_LEVEL_LOW>;
++ clock-div = <2>;
+ clocks = <&topckgen CLK_TOP_I2C1>,
+ <&topckgen CLK_TOP_APDMA>;
+ clock-names = "main", "dma";
+@@ -373,6 +375,7 @@
+ reg = <0 0x1100b000 0 0x90>,
+ <0 0x11000280 0 0x80>;
+ interrupts = <GIC_SPI 82 IRQ_TYPE_LEVEL_LOW>;
++ clock-div = <2>;
+ clocks = <&topckgen CLK_TOP_I2C2>,
+ <&topckgen CLK_TOP_APDMA>;
+ clock-names = "main", "dma";
+diff --git a/arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi b/arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi
+index ec8dfb3d1c6d6..a356db5fcc5f3 100644
+--- a/arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi
++++ b/arch/arm64/boot/dts/mediatek/pumpkin-common.dtsi
+@@ -47,7 +47,6 @@
+ };
+
+ &i2c0 {
+- clock-div = <2>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&i2c0_pins_a>;
+ status = "okay";
+@@ -156,7 +155,6 @@
+ };
+
+ &i2c2 {
+- clock-div = <2>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&i2c2_pins_a>;
+ status = "okay";
+--
+2.39.5
+
--- /dev/null
+From d36682dd0f903fba657c55cc7a287828c7f5ada8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2024 16:05:04 -0300
+Subject: arm64: dts: mediatek: mt8516: fix GICv2 range
+
+From: Val Packett <val@packett.cool>
+
+[ Upstream commit e3ee31e4409f051c021a30122f3c470f093a7386 ]
+
+On the MT8167 which is based on the MT8516 DTS, the following error
+was appearing on boot, breaking interrupt operation:
+
+GICv2 detected, but range too small and irqchip.gicv2_force_probe not set
+
+Similar to what's been proposed for MT7622 which has the same issue,
+fix by using the range reported by force_probe.
+
+Link: https://lore.kernel.org/all/YmhNSLgp%2Fyg8Vr1F@makrotopia.org/
+Fixes: 5236347bde42 ("arm64: dts: mediatek: add dtsi for MT8516")
+Signed-off-by: Val Packett <val@packett.cool>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20241204190524.21862-2-val@packett.cool
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8516.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8516.dtsi b/arch/arm64/boot/dts/mediatek/mt8516.dtsi
+index d1b67c82d7617..81ac7f2f710b4 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8516.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8516.dtsi
+@@ -269,7 +269,7 @@
+ interrupt-parent = <&gic>;
+ interrupt-controller;
+ reg = <0 0x10310000 0 0x1000>,
+- <0 0x10320000 0 0x1000>,
++ <0 0x1032f000 0 0x2000>,
+ <0 0x10340000 0 0x2000>,
+ <0 0x10360000 0 0x2000>;
+ interrupts = <GIC_PPI 9
+--
+2.39.5
+
--- /dev/null
+From d074a8bc32172a2879f7853866c47b5063327a0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2024 16:05:05 -0300
+Subject: arm64: dts: mediatek: mt8516: fix wdt irq type
+
+From: Val Packett <val@packett.cool>
+
+[ Upstream commit 03a80442030e7147391738fb6cbe5fa0b3b91bb1 ]
+
+The GICv2 does not support EDGE_FALLING interrupts, so the watchdog
+would refuse to attach due to a failing check coming from the GIC driver.
+
+Fixes: 5236347bde42 ("arm64: dts: mediatek: add dtsi for MT8516")
+Signed-off-by: Val Packett <val@packett.cool>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20241204190524.21862-3-val@packett.cool
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8516.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8516.dtsi b/arch/arm64/boot/dts/mediatek/mt8516.dtsi
+index 81ac7f2f710b4..558f7e744113d 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8516.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8516.dtsi
+@@ -206,7 +206,7 @@
+ compatible = "mediatek,mt8516-wdt",
+ "mediatek,mt6589-wdt";
+ reg = <0 0x10007000 0 0x1000>;
+- interrupts = <GIC_SPI 198 IRQ_TYPE_EDGE_FALLING>;
++ interrupts = <GIC_SPI 198 IRQ_TYPE_LEVEL_LOW>;
+ #reset-cells = <1>;
+ };
+
+--
+2.39.5
+
--- /dev/null
+From ee84f167a41c930c086466b18530d245fc3446ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2024 16:05:07 -0300
+Subject: arm64: dts: mediatek: mt8516: reserve 192 KiB for TF-A
+
+From: Val Packett <val@packett.cool>
+
+[ Upstream commit 2561c7d5d497b988deccc36fe5eac7fd50b937f8 ]
+
+The Android DTB for the related MT8167 reserves 0x30000. This is likely
+correct for MT8516 Android devices as well, and there's never any harm
+in reserving 64KiB more.
+
+Fixes: 5236347bde42 ("arm64: dts: mediatek: add dtsi for MT8516")
+Signed-off-by: Val Packett <val@packett.cool>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20241204190524.21862-5-val@packett.cool
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8516.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8516.dtsi b/arch/arm64/boot/dts/mediatek/mt8516.dtsi
+index 0b86863381cf3..5655f12723f14 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8516.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8516.dtsi
+@@ -144,10 +144,10 @@
+ #size-cells = <2>;
+ ranges;
+
+- /* 128 KiB reserved for ARM Trusted Firmware (BL31) */
++ /* 192 KiB reserved for ARM Trusted Firmware (BL31) */
+ bl31_secmon_reserved: secmon@43000000 {
+ no-map;
+- reg = <0 0x43000000 0 0x20000>;
++ reg = <0 0x43000000 0 0x30000>;
+ };
+ };
+
+--
+2.39.5
+
--- /dev/null
+From 2e5165f908efa491831cad5cfc53b9457a2ad8f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2024 16:16:53 +0800
+Subject: arm64: dts: mt8183: set DMIC one-wire mode on Damu
+
+From: Hsin-Yi Wang <hsinyi@chromium.org>
+
+[ Upstream commit 6c379e8b984815fc8f876e4bc78c4d563f13ddae ]
+
+Sets DMIC one-wire mode on Damu.
+
+Fixes: cabc71b08eb5 ("arm64: dts: mt8183: Add kukui-jacuzzi-damu board")
+Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hsin-Te Yuan <yuanhsinte@chromium.org>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Link: https://lore.kernel.org/r/20241113-damu-v4-1-6911b69610dd@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts
+index 5cbb5a1ae3f2f..ca4196870f9db 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi-damu.dts
+@@ -26,6 +26,10 @@
+ hid-descr-addr = <0x0001>;
+ };
+
++&mt6358codec {
++ mediatek,dmic-mode = <1>; /* one-wire */
++};
++
+ &qca_wifi {
+ qcom,ath10k-calibration-variant = "GO_DAMU";
+ };
+--
+2.39.5
+
--- /dev/null
+From 9e8eb95ad2f9772cab3992141065a444f9c62356 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Dec 2024 12:17:00 +0200
+Subject: arm64: dts: qcom: msm8916: correct sleep clock frequency
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit f088b921890cef28862913e5627bb2e2b5f82125 ]
+
+The MSM8916 platform uses PM8916 to provide sleep clock. According to the
+documentation, that clock has 32.7645 kHz frequency. Correct the sleep
+clock definition.
+
+Fixes: f4fb6aeafaaa ("arm64: dts: qcom: msm8916: Add fixed rate on-board oscillators")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-1-e9b08fbeadd3@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+index 987cebbda0571..571ed1abdad4f 100644
+--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+@@ -109,7 +109,7 @@
+ sleep_clk: sleep-clk {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+- clock-frequency = <32768>;
++ clock-frequency = <32764>;
+ };
+ };
+
+--
+2.39.5
+
--- /dev/null
+From ffa74d514b1947a84efed874818b6a9b8fc217e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Dec 2024 12:17:02 +0200
+Subject: arm64: dts: qcom: msm8994: correct sleep clock frequency
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit a4148d869d47d8c86da0291dd95d411a5ebe90c8 ]
+
+The MSM8994 platform uses PM8994/6 to provide sleep clock. According to the
+documentation, that clock has 32.7645 kHz frequency. Correct the sleep
+clock definition.
+
+Fixes: feeaf56ac78d ("arm64: dts: msm8994 SoC and Huawei Angler (Nexus 6P) support")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-3-e9b08fbeadd3@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8994.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8994.dtsi b/arch/arm64/boot/dts/qcom/msm8994.dtsi
+index 5fe9a9be7903a..0eb8eca13ad9d 100644
+--- a/arch/arm64/boot/dts/qcom/msm8994.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8994.dtsi
+@@ -33,7 +33,7 @@
+ sleep_clk: sleep-clk {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+- clock-frequency = <32768>;
++ clock-frequency = <32764>;
+ clock-output-names = "sleep_clk";
+ };
+ };
+--
+2.39.5
+
--- /dev/null
+From ea6a724ebd0daa98613cc347258c4510883ce142 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Nov 2024 23:12:48 +0100
+Subject: arm64: dts: qcom: msm8994: Describe USB interrupts
+
+From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+
+[ Upstream commit c910544d2234709660d60f80345c285616e73b1c ]
+
+Previously the interrupt lanes were not described, fix that.
+
+Fixes: d9be0bc95f25 ("arm64: dts: qcom: msm8994: Add USB support")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Tested-by: Petr Vorel <petr.vorel@gmail.com>
+Link: https://lore.kernel.org/r/20241129-topic-qcom_usb_dtb_fixup-v1-4-cba24120c058@oss.qualcomm.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8994.dtsi | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8994.dtsi b/arch/arm64/boot/dts/qcom/msm8994.dtsi
+index 3c6c2cf99fb9d..5fe9a9be7903a 100644
+--- a/arch/arm64/boot/dts/qcom/msm8994.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8994.dtsi
+@@ -434,6 +434,15 @@
+ #size-cells = <1>;
+ ranges;
+
++ interrupts = <GIC_SPI 180 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 311 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 133 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 310 IRQ_TYPE_LEVEL_HIGH>;
++ interrupt-names = "pwr_event",
++ "qusb2_phy",
++ "hs_phy_irq",
++ "ss_phy_irq";
++
+ clocks = <&gcc GCC_USB30_MASTER_CLK>,
+ <&gcc GCC_SYS_NOC_USB3_AXI_CLK>,
+ <&gcc GCC_USB30_SLEEP_CLK>,
+--
+2.39.5
+
--- /dev/null
+From 6a8c84af73ad69eebeed8b518a925913dc83f691 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Nov 2024 23:12:47 +0100
+Subject: arm64: dts: qcom: msm8996: Fix up USB3 interrupts
+
+From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+
+[ Upstream commit 9cb9c9f4e1380da317a056afd26d66a835c5796c ]
+
+Add the missing interrupt lines and fix qusb2_phy being an impostor
+of hs_phy_irq.
+
+This happens to also fix warnings such as:
+
+usb@6af8800: interrupt-names: ['hs_phy_irq', 'ss_phy_irq'] is too short
+
+Fixes: 4753492de9df ("arm64: dts: qcom: msm8996: Add usb3 interrupts")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20241129-topic-qcom_usb_dtb_fixup-v1-3-cba24120c058@oss.qualcomm.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8996.dtsi | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+index 3b9a4bf897014..b3ebd0298f645 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+@@ -2968,9 +2968,14 @@
+ #size-cells = <1>;
+ ranges;
+
+- interrupts = <GIC_SPI 347 IRQ_TYPE_LEVEL_HIGH>,
++ interrupts = <GIC_SPI 180 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 347 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 133 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 243 IRQ_TYPE_LEVEL_HIGH>;
+- interrupt-names = "hs_phy_irq", "ss_phy_irq";
++ interrupt-names = "pwr_event",
++ "qusb2_phy",
++ "hs_phy_irq",
++ "ss_phy_irq";
+
+ clocks = <&gcc GCC_SYS_NOC_USB3_AXI_CLK>,
+ <&gcc GCC_USB30_MASTER_CLK>,
+--
+2.39.5
+
--- /dev/null
+From 5c8b4e13355da39c40ad65434534824eb88491b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Oct 2024 04:19:48 +0200
+Subject: arm64: dts: qcom: msm8996-xiaomi-gemini: Fix LP5562 LED1 reg property
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 02e784c5023232c48c6ec79b52ac8929d4e4db34 ]
+
+The LP5562 led@1 reg property should likely be set to 1 to match
+the unit. Fix it.
+
+Fixes: 4ac46b3682c5 ("arm64: dts: qcom: msm8996: xiaomi-gemini: Add support for Xiaomi Mi 5")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20241006022012.366601-1-marex@denx.de
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts b/arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts
+index 3bbafb68ba5c5..543282fe2abbd 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts
++++ b/arch/arm64/boot/dts/qcom/msm8996-xiaomi-gemini.dts
+@@ -65,7 +65,7 @@
+ };
+
+ led@1 {
+- reg = <0>;
++ reg = <1>;
+ chan-name = "button-backlight1";
+ led-cur = /bits/ 8 <0x32>;
+ max-cur = /bits/ 8 <0xC8>;
+--
+2.39.5
+
--- /dev/null
+From c884987db03b9b17c57fc717b2135b80515a83ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Oct 2022 09:54:05 +0200
+Subject: arm64: dts: qcom: pm6150l: add temp sensor and thermal zone config
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Luca Weiss <luca.weiss@fairphone.com>
+
+[ Upstream commit ce1b5eb74b3ef042b1c797f04e8683e7cad34ae6 ]
+
+Add temp-alarm device tree node and a default configuration for the
+corresponding thermal zone for this PMIC. Temperatures are based on
+downstream values, except for trip2 where 125°C is used instead of 145°C
+due to limitations without a configured ADC.
+
+Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221028075405.124809-2-luca.weiss@fairphone.com
+Stable-dep-of: 9180b38d706c ("arm64: dts: qcom: sc7180-trogdor-pompom: rename 5v-choke thermal zone")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/pm6150l.dtsi | 38 +++++++++++++++++++++++++++
+ 1 file changed, 38 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/pm6150l.dtsi b/arch/arm64/boot/dts/qcom/pm6150l.dtsi
+index 06d729ff65a9d..ac3c6456c47c7 100644
+--- a/arch/arm64/boot/dts/qcom/pm6150l.dtsi
++++ b/arch/arm64/boot/dts/qcom/pm6150l.dtsi
+@@ -5,6 +5,37 @@
+ #include <dt-bindings/interrupt-controller/irq.h>
+ #include <dt-bindings/spmi/spmi.h>
+
++/ {
++ thermal-zones {
++ pm6150l-thermal {
++ polling-delay-passive = <0>;
++ polling-delay = <0>;
++
++ thermal-sensors = <&pm6150l_temp>;
++
++ trips {
++ trip0 {
++ temperature = <95000>;
++ hysteresis = <0>;
++ type = "passive";
++ };
++
++ trip1 {
++ temperature = <115000>;
++ hysteresis = <0>;
++ type = "hot";
++ };
++
++ trip2 {
++ temperature = <125000>;
++ hysteresis = <0>;
++ type = "critical";
++ };
++ };
++ };
++ };
++};
++
+ &spmi_bus {
+ pm6150l_lsid4: pmic@4 {
+ compatible = "qcom,pm6150l", "qcom,spmi-pmic";
+@@ -12,6 +43,13 @@
+ #address-cells = <1>;
+ #size-cells = <0>;
+
++ pm6150l_temp: temp-alarm@2400 {
++ compatible = "qcom,spmi-temp-alarm";
++ reg = <0x2400>;
++ interrupts = <0x4 0x24 0x0 IRQ_TYPE_EDGE_BOTH>;
++ #thermal-sensor-cells = <0>;
++ };
++
+ pm6150l_adc: adc@3100 {
+ compatible = "qcom,spmi-adc5";
+ reg = <0x3100>;
+--
+2.39.5
+
--- /dev/null
+From dff59026f0a1a857894a917474cb4fc36a7ba49f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Dec 2022 02:10:20 +0000
+Subject: arm64: dts: qcom: sc7180: Add compat qcom,sc7180-dsi-ctrl
+
+From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+
+[ Upstream commit a45d0641d110e81826710aa92711e1c2eedecb43 ]
+
+Add silicon specific compatible qcom,sc7180-dsi-ctrl to the
+mdss-dsi-ctrl block. This allows us to differentiate the specific bindings
+for sc7180 against the yaml documentation.
+
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221223021025.1646636-14-bryan.odonoghue@linaro.org
+Stable-dep-of: aa09de104d42 ("arm64: dts: qcom: sc7180-trogdor-quackingstick: add missing avee-supply")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7180.dtsi | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi
+index 13fe1c92bf351..b4775159dde0b 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi
+@@ -2985,7 +2985,8 @@
+ };
+
+ dsi0: dsi@ae94000 {
+- compatible = "qcom,mdss-dsi-ctrl";
++ compatible = "qcom,sc7180-dsi-ctrl",
++ "qcom,mdss-dsi-ctrl";
+ reg = <0 0x0ae94000 0 0x400>;
+ reg-names = "dsi_ctrl";
+
+--
+2.39.5
+
--- /dev/null
+From 2c9acda3dd6066a3fc9fae499d7f9c7fac66c7f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 May 2023 14:37:41 +0500
+Subject: arm64: dts: qcom: sc7180: Don't enable lpass clocks by default
+
+From: Nikita Travkin <nikita@trvn.ru>
+
+[ Upstream commit 43926a3cb19180b4fc6cd0d72bbefc7e93592f91 ]
+
+lpass clocks are usually blocked from HLOS by the firmware and
+instead are managed by the ADSP. Mark them as reserved and explicitly
+enable in the CrOS boards that have special, cooperative firmware.
+
+The IDP board gets lpass clocks disabled as it doesn't make use of sound
+anyway and might use Qualcomm firmware that blocks those clocks. [1]
+
+[1] https://lore.kernel.org/all/ZBJhmDd3zK%2FAiwBD@google.com/
+
+Signed-off-by: Nikita Travkin <nikita@trvn.ru>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230515093744.289045-2-nikita@trvn.ru
+Stable-dep-of: aa09de104d42 ("arm64: dts: qcom: sc7180-trogdor-quackingstick: add missing avee-supply")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi | 8 ++++++++
+ arch/arm64/boot/dts/qcom/sc7180.dtsi | 4 ++++
+ 2 files changed, 12 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi
+index f55ce6f2fdc28..75f05ae095be2 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi
+@@ -777,6 +777,10 @@ hp_i2c: &i2c9 {
+ };
+ };
+
++&lpasscc {
++ status = "okay";
++};
++
+ &lpass_cpu {
+ status = "okay";
+
+@@ -802,6 +806,10 @@ hp_i2c: &i2c9 {
+ };
+ };
+
++&lpass_hm {
++ status = "okay";
++};
++
+ &mdp {
+ status = "okay";
+ };
+diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi
+index b4775159dde0b..12982fa848c68 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi
+@@ -3577,6 +3577,8 @@
+ power-domains = <&lpass_hm LPASS_CORE_HM_GDSCR>;
+ #clock-cells = <1>;
+ #power-domain-cells = <1>;
++
++ status = "reserved"; /* Controlled by ADSP */
+ };
+
+ lpass_cpu: lpass@62d87000 {
+@@ -3622,6 +3624,8 @@
+ clock-names = "iface", "bi_tcxo";
+ #clock-cells = <1>;
+ #power-domain-cells = <1>;
++
++ status = "reserved"; /* Controlled by ADSP */
+ };
+ };
+
+--
+2.39.5
+
--- /dev/null
+From 06ecd42b585d205fe43254da228cb62acff5ec57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 May 2023 14:37:42 +0500
+Subject: arm64: dts: qcom: sc7180: Drop redundant disable in mdp
+
+From: Nikita Travkin <nikita@trvn.ru>
+
+[ Upstream commit 39238382c4991d7d9442de4aa6636b19355be1e9 ]
+
+mdss is useless without a display controller which makes explicitly
+enabling mdp redundant. Have it enabled by default to drop the extra
+node for all users.
+
+Signed-off-by: Nikita Travkin <nikita@trvn.ru>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230515093744.289045-3-nikita@trvn.ru
+Stable-dep-of: aa09de104d42 ("arm64: dts: qcom: sc7180-trogdor-quackingstick: add missing avee-supply")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7180-idp.dts | 4 ----
+ arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi | 4 ----
+ arch/arm64/boot/dts/qcom/sc7180.dtsi | 2 --
+ 3 files changed, 10 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7180-idp.dts b/arch/arm64/boot/dts/qcom/sc7180-idp.dts
+index ebb4f4541e14d..02b507691cc33 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180-idp.dts
++++ b/arch/arm64/boot/dts/qcom/sc7180-idp.dts
+@@ -328,10 +328,6 @@
+ vdds-supply = <&vreg_l4a_0p8>;
+ };
+
+-&mdp {
+- status = "okay";
+-};
+-
+ &mdss {
+ status = "okay";
+ };
+diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi
+index 75f05ae095be2..d537b8784b472 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi
+@@ -810,10 +810,6 @@ hp_i2c: &i2c9 {
+ status = "okay";
+ };
+
+-&mdp {
+- status = "okay";
+-};
+-
+ &mdss {
+ status = "okay";
+ };
+diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi
+index 12982fa848c68..3a13cc02c9832 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi
+@@ -2937,8 +2937,6 @@
+ interrupt-parent = <&mdss>;
+ interrupts = <0>;
+
+- status = "disabled";
+-
+ ports {
+ #address-cells = <1>;
+ #size-cells = <0>;
+--
+2.39.5
+
--- /dev/null
+From ec0cbe928f6c15ed0e038e26a6ff25d865e3e2ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Mar 2023 17:57:46 +0200
+Subject: arm64: dts: qcom: sc7180-idp: use just "port" in panel
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 746bda7d9dd9518793034d7008a19e4cf5c3004d ]
+
+The panel bindings expect to have only one port, thus they do not allow
+to use "ports" node:
+
+ sc7180-idp.dtb: panel@0: 'ports' does not match any of the regexes: 'pinctrl-[0-9]+'
+ sc7180-idp.dtb: panel@0: 'port' is a required property
+
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230326155753.92007-4-krzysztof.kozlowski@linaro.org
+Stable-dep-of: aa09de104d42 ("arm64: dts: qcom: sc7180-trogdor-quackingstick: add missing avee-supply")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7180-idp.dts | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7180-idp.dts b/arch/arm64/boot/dts/qcom/sc7180-idp.dts
+index 9dee131b1e245..ebb4f4541e14d 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180-idp.dts
++++ b/arch/arm64/boot/dts/qcom/sc7180-idp.dts
+@@ -306,14 +306,9 @@
+
+ reset-gpios = <&pm6150l_gpio 3 GPIO_ACTIVE_HIGH>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
+- port@0 {
+- reg = <0>;
+- panel0_in: endpoint {
+- remote-endpoint = <&dsi0_out>;
+- };
++ port {
++ panel0_in: endpoint {
++ remote-endpoint = <&dsi0_out>;
+ };
+ };
+ };
+--
+2.39.5
+
--- /dev/null
+From e2c808348fa7fb8b8fca5b75b468fbeb815e2c56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 May 2024 13:59:39 +0200
+Subject: arm64: dts: qcom: sc7180-*: Remove thermal zone polling delays
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 7cd2d9080a6eb281701f7303b1699719640380d0 ]
+
+All of the thermal zone suppliers are interrupt-driven, remove the
+bogus and unnecessary polling that only wastes CPU time.
+
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20240510-topic-msm-polling-cleanup-v2-16-436ca4218da2@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Stable-dep-of: 9180b38d706c ("arm64: dts: qcom: sc7180-trogdor-pompom: rename 5v-choke thermal zone")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/pm6150.dtsi | 2 +-
+ arch/arm64/boot/dts/qcom/pm6150l.dtsi | 3 ---
+ .../boot/dts/qcom/sc7180-trogdor-coachz.dtsi | 1 -
+ .../dts/qcom/sc7180-trogdor-homestar.dtsi | 1 -
+ .../boot/dts/qcom/sc7180-trogdor-pompom.dtsi | 3 ---
+ .../dts/qcom/sc7180-trogdor-wormdingler.dtsi | 1 -
+ arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi | 3 ---
+ arch/arm64/boot/dts/qcom/sc7180.dtsi | 25 -------------------
+ 8 files changed, 1 insertion(+), 38 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/pm6150.dtsi b/arch/arm64/boot/dts/qcom/pm6150.dtsi
+index 8a4972e6a24c1..b45ffd7d3b364 100644
+--- a/arch/arm64/boot/dts/qcom/pm6150.dtsi
++++ b/arch/arm64/boot/dts/qcom/pm6150.dtsi
+@@ -11,7 +11,7 @@
+ thermal-zones {
+ pm6150_thermal: pm6150-thermal {
+ polling-delay-passive = <100>;
+- polling-delay = <0>;
++
+ thermal-sensors = <&pm6150_temp>;
+
+ trips {
+diff --git a/arch/arm64/boot/dts/qcom/pm6150l.dtsi b/arch/arm64/boot/dts/qcom/pm6150l.dtsi
+index ac3c6456c47c7..e7526a7f41e28 100644
+--- a/arch/arm64/boot/dts/qcom/pm6150l.dtsi
++++ b/arch/arm64/boot/dts/qcom/pm6150l.dtsi
+@@ -8,9 +8,6 @@
+ / {
+ thermal-zones {
+ pm6150l-thermal {
+- polling-delay-passive = <0>;
+- polling-delay = <0>;
+-
+ thermal-sensors = <&pm6150l_temp>;
+
+ trips {
+diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi
+index 7ee407f7b6bb5..f98162d3a0812 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi
+@@ -26,7 +26,6 @@
+ thermal-zones {
+ skin_temp_thermal: skin-temp-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&pm6150_adc_tm 1>;
+ sustainable-power = <965>;
+diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-homestar.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor-homestar.dtsi
+index bfab67f4a7c9c..a7b41498ba88c 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-homestar.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-homestar.dtsi
+@@ -43,7 +43,6 @@
+ thermal-zones {
+ skin_temp_thermal: skin-temp-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&pm6150_adc_tm 1>;
+ sustainable-power = <965>;
+diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-pompom.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor-pompom.dtsi
+index a7582fb547eea..d363a8b6906aa 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-pompom.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-pompom.dtsi
+@@ -13,9 +13,6 @@
+ / {
+ thermal-zones {
+ 5v-choke-thermal {
+- polling-delay-passive = <0>;
+- polling-delay = <250>;
+-
+ thermal-sensors = <&pm6150_adc_tm 1>;
+
+ trips {
+diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-wormdingler.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor-wormdingler.dtsi
+index 0b5b0449299bd..ebb64b91c09f7 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-wormdingler.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-wormdingler.dtsi
+@@ -50,7 +50,6 @@
+ thermal-zones {
+ skin_temp_thermal: skin-temp-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&pm6150_adc_tm 1>;
+ sustainable-power = <574>;
+diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi
+index d537b8784b472..06b6774ef0106 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor.dtsi
+@@ -20,9 +20,6 @@
+ / {
+ thermal-zones {
+ charger_thermal: charger-thermal {
+- polling-delay-passive = <0>;
+- polling-delay = <0>;
+-
+ thermal-sensors = <&pm6150_adc_tm 0>;
+
+ trips {
+diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi
+index 3a13cc02c9832..a9f937b068479 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi
+@@ -3630,7 +3630,6 @@
+ thermal-zones {
+ cpu0_thermal: cpu0-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens0 1>;
+ sustainable-power = <1052>;
+@@ -3679,7 +3678,6 @@
+
+ cpu1_thermal: cpu1-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens0 2>;
+ sustainable-power = <1052>;
+@@ -3728,7 +3726,6 @@
+
+ cpu2_thermal: cpu2-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens0 3>;
+ sustainable-power = <1052>;
+@@ -3777,7 +3774,6 @@
+
+ cpu3_thermal: cpu3-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens0 4>;
+ sustainable-power = <1052>;
+@@ -3826,7 +3822,6 @@
+
+ cpu4_thermal: cpu4-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens0 5>;
+ sustainable-power = <1052>;
+@@ -3875,7 +3870,6 @@
+
+ cpu5_thermal: cpu5-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens0 6>;
+ sustainable-power = <1052>;
+@@ -3924,7 +3918,6 @@
+
+ cpu6_thermal: cpu6-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens0 9>;
+ sustainable-power = <1425>;
+@@ -3965,7 +3958,6 @@
+
+ cpu7_thermal: cpu7-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens0 10>;
+ sustainable-power = <1425>;
+@@ -4006,7 +3998,6 @@
+
+ cpu8_thermal: cpu8-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens0 11>;
+ sustainable-power = <1425>;
+@@ -4047,7 +4038,6 @@
+
+ cpu9_thermal: cpu9-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens0 12>;
+ sustainable-power = <1425>;
+@@ -4088,7 +4078,6 @@
+
+ aoss0-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens0 0>;
+
+@@ -4109,7 +4098,6 @@
+
+ cpuss0-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens0 7>;
+
+@@ -4129,7 +4117,6 @@
+
+ cpuss1-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens0 8>;
+
+@@ -4149,7 +4136,6 @@
+
+ gpuss0-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens0 13>;
+
+@@ -4177,7 +4163,6 @@
+
+ gpuss1-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens0 14>;
+
+@@ -4205,7 +4190,6 @@
+
+ aoss1-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens1 0>;
+
+@@ -4226,7 +4210,6 @@
+
+ cwlan-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens1 1>;
+
+@@ -4247,7 +4230,6 @@
+
+ audio-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens1 2>;
+
+@@ -4268,7 +4250,6 @@
+
+ ddr-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens1 3>;
+
+@@ -4289,7 +4270,6 @@
+
+ q6-hvx-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens1 4>;
+
+@@ -4310,7 +4290,6 @@
+
+ camera-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens1 5>;
+
+@@ -4331,7 +4310,6 @@
+
+ mdm-core-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens1 6>;
+
+@@ -4352,7 +4330,6 @@
+
+ mdm-dsp-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens1 7>;
+
+@@ -4373,7 +4350,6 @@
+
+ npu-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens1 8>;
+
+@@ -4394,7 +4370,6 @@
+
+ video-thermal {
+ polling-delay-passive = <250>;
+- polling-delay = <0>;
+
+ thermal-sensors = <&tsens1 9>;
+
+--
+2.39.5
+
--- /dev/null
+From f2f544a5726113670443fec6e98225aaeb8a3e83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Dec 2024 13:44:47 +0100
+Subject: arm64: dts: qcom: sc7180-trogdor-pompom: rename 5v-choke thermal zone
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit 9180b38d706c29ed212181a77999c35ae9ff6879 ]
+
+Rename the 5v-choke thermal zone to satisfy the bindings.
+
+This fixes:
+sc7180-trogdor-pompom-r2-lte.dts: thermal-zones: '5v-choke-thermal' does not match any of the regexes: '^[a-zA-Z][a-zA-Z0-9\\-]{1,10}-thermal$', 'pinctrl-[0-9]+'
+ from schema $id: http://devicetree.org/schemas/thermal/thermal-zones.yaml#
+
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20241230-topic-misc-dt-fixes-v4-4-1e6880e9dda3@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7180-trogdor-pompom.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-pompom.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor-pompom.dtsi
+index d363a8b6906aa..31f91f4e97360 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-pompom.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-pompom.dtsi
+@@ -12,11 +12,11 @@
+
+ / {
+ thermal-zones {
+- 5v-choke-thermal {
++ choke-5v-thermal {
+ thermal-sensors = <&pm6150_adc_tm 1>;
+
+ trips {
+- 5v-choke-crit {
++ choke-5v-crit {
+ temperature = <125000>;
+ hysteresis = <1000>;
+ type = "critical";
+--
+2.39.5
+
--- /dev/null
+From 1783e1c7d1db85a11b13d48797fc20350c638877 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Dec 2024 13:44:46 +0100
+Subject: arm64: dts: qcom: sc7180-trogdor-quackingstick: add missing
+ avee-supply
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit aa09de104d421e7ff8d8cde9af98568ce62a002c ]
+
+The bindings requires the avee-supply, use the same regulator as
+the avdd (positive voltage) which would also provide the negative
+voltage by definition.
+
+The fixes:
+sc7180-trogdor-quackingstick-r0.dts: panel@0: 'avee-supply' is a required property
+ from schema $id: http://devicetree.org/schemas/display/panel/boe,tv101wum-nl6.yaml#
+
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20241230-topic-misc-dt-fixes-v4-3-1e6880e9dda3@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7180-trogdor-quackingstick.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-quackingstick.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor-quackingstick.dtsi
+index 4ec3e578a1120..a2906126242cb 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-quackingstick.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-quackingstick.dtsi
+@@ -60,6 +60,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&lcd_rst>;
+ avdd-supply = <&ppvar_lcd>;
++ avee-supply = <&ppvar_lcd>;
+ pp1800-supply = <&v1p8_disp>;
+ pp3300-supply = <&pp3300_dx_edp>;
+ backlight = <&backlight>;
+--
+2.39.5
+
--- /dev/null
+From 0ab1e4cd4afb330d1895e457ecf6c6851fdc09bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Mar 2023 17:57:47 +0200
+Subject: arm64: dts: qcom: sc7180-trogdor-quackingstick: use just "port" in
+ panel
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 88904a12fbcbd97e56d341080845ce0807164fb5 ]
+
+The panel bindings expect to have only one port, thus they do not allow
+to use "ports" node:
+
+ sc7180-trogdor-quackingstick-r0.dtb: panel@0: 'ports' does not match any of the regexes: 'pinctrl-[0-9]+'
+
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230326155753.92007-5-krzysztof.kozlowski@linaro.org
+Stable-dep-of: aa09de104d42 ("arm64: dts: qcom: sc7180-trogdor-quackingstick: add missing avee-supply")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/qcom/sc7180-trogdor-quackingstick.dtsi | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-quackingstick.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor-quackingstick.dtsi
+index 695b04fe7221f..4ec3e578a1120 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-quackingstick.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-quackingstick.dtsi
+@@ -65,14 +65,9 @@
+ backlight = <&backlight>;
+ rotation = <270>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
+- port@0 {
+- reg = <0>;
+- panel_in: endpoint {
+- remote-endpoint = <&dsi0_out>;
+- };
++ port {
++ panel_in: endpoint {
++ remote-endpoint = <&dsi0_out>;
+ };
+ };
+ };
+--
+2.39.5
+
--- /dev/null
+From 697bbf92dd77a1b1b659e2ee3ac97a82ea16ac07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Mar 2023 17:57:48 +0200
+Subject: arm64: dts: qcom: sc7180-trogdor-wormdingler: use just "port" in
+ panel
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit c28d9029f3b68a42794a0527696c91f7b31e81f3 ]
+
+The panel bindings expect to have only one port, thus they do not allow
+to use "ports" node:
+
+ sc7180-trogdor-wormdingler-rev1-boe.dtb: panel@0: 'ports' does not match any of the regexes: 'pinctrl-[0-9]+'
+
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230326155753.92007-6-krzysztof.kozlowski@linaro.org
+Stable-dep-of: aa09de104d42 ("arm64: dts: qcom: sc7180-trogdor-quackingstick: add missing avee-supply")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/qcom/sc7180-trogdor-wormdingler.dtsi | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-wormdingler.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor-wormdingler.dtsi
+index 6312108e8b3ed..0b5b0449299bd 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-wormdingler.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-wormdingler.dtsi
+@@ -124,14 +124,9 @@
+ backlight = <&backlight>;
+ rotation = <270>;
+
+- ports {
+- #address-cells = <1>;
+- #size-cells = <0>;
+- port@0 {
+- reg = <0>;
+- panel_in: endpoint {
+- remote-endpoint = <&dsi0_out>;
+- };
++ port {
++ panel_in: endpoint {
++ remote-endpoint = <&dsi0_out>;
+ };
+ };
+ };
+--
+2.39.5
+
--- /dev/null
+From 7bd77dedb21fa9ccb94e32cfd1811c28a3615e56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Dec 2024 12:17:07 +0200
+Subject: arm64: dts: qcom: sc7280: correct sleep clock frequency
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit f6ccdca14eac545320ab03d6ca91ca343e7372e5 ]
+
+The SC7280 platform uses PMK8350 to provide sleep clock. According to the
+documentation, that clock has 32.7645 kHz frequency. Correct the sleep
+clock definition.
+
+Fixes: 7a1f4e7f740d ("arm64: dts: qcom: sc7280: Add basic dts/dtsi files for sc7280 soc")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-8-e9b08fbeadd3@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+index b5cd24d59ad9a..b778728390e53 100644
+--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+@@ -79,7 +79,7 @@
+
+ sleep_clk: sleep-clk {
+ compatible = "fixed-clock";
+- clock-frequency = <32000>;
++ clock-frequency = <32764>;
+ #clock-cells = <0>;
+ };
+ };
+--
+2.39.5
+
--- /dev/null
+From 4974c0621806bc406be3fd087b51ed785f18622e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2024 23:19:37 +0100
+Subject: arm64: dts: qcom: sc8280xp: Fix up remoteproc register space sizes
+
+From: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+
+[ Upstream commit 7ec7e327286182c65d0b5b81dff498d620fe9e8c ]
+
+Make sure the remoteproc reg ranges reflect the entire register space
+they refer to.
+
+Since they're unused by the driver, there's no functional change.
+
+Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Link: https://lore.kernel.org/r/20241212-topic-8280_rproc_reg-v1-1-bd1c696e91b0@oss.qualcomm.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+index 7e3aaf5de3f5c..6b0d4bc6c5419 100644
+--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+@@ -1119,7 +1119,7 @@
+
+ remoteproc_adsp: remoteproc@3000000 {
+ compatible = "qcom,sc8280xp-adsp-pas";
+- reg = <0 0x03000000 0 0x100>;
++ reg = <0 0x03000000 0 0x10000>;
+
+ interrupts-extended = <&intc GIC_SPI 162 IRQ_TYPE_LEVEL_HIGH>,
+ <&smp2p_adsp_in 0 IRQ_TYPE_EDGE_RISING>,
+@@ -1806,7 +1806,7 @@
+
+ remoteproc_nsp0: remoteproc@1b300000 {
+ compatible = "qcom,sc8280xp-nsp0-pas";
+- reg = <0 0x1b300000 0 0x100>;
++ reg = <0 0x1b300000 0 0x10000>;
+
+ interrupts-extended = <&intc GIC_SPI 578 IRQ_TYPE_LEVEL_HIGH>,
+ <&smp2p_nsp0_in 0 IRQ_TYPE_EDGE_RISING>,
+@@ -1937,7 +1937,7 @@
+
+ remoteproc_nsp1: remoteproc@21300000 {
+ compatible = "qcom,sc8280xp-nsp1-pas";
+- reg = <0 0x21300000 0 0x100>;
++ reg = <0 0x21300000 0 0x10000>;
+
+ interrupts-extended = <&intc GIC_SPI 887 IRQ_TYPE_LEVEL_HIGH>,
+ <&smp2p_nsp1_in 0 IRQ_TYPE_EDGE_RISING>,
+--
+2.39.5
+
--- /dev/null
+From f79f4afb103ff85a59821da0a411e053e3b64558 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2024 14:29:49 +0200
+Subject: arm64: dts: qcom: sdm845: Fix interrupt types of camss interrupts
+
+From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+
+[ Upstream commit cb96722b728e81ad97f5b5b20dea64cd294a5452 ]
+
+Qualcomm IP catalog says that all CAMSS interrupts is edge rising,
+fix it in the CAMSS device tree node for sdm845 SoC.
+
+Fixes: d48a6698a6b7 ("arm64: dts: qcom: sdm845: Add CAMSS ISP node")
+Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Link: https://lore.kernel.org/r/20241127122950.885982-6-vladimir.zapolskiy@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845.dtsi | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+index 71644b9b8866a..a5df310ce7f39 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+@@ -4234,16 +4234,16 @@
+ "vfe1",
+ "vfe_lite";
+
+- interrupts = <GIC_SPI 464 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 466 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 468 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 477 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 478 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 479 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 448 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 465 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 467 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 469 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_SPI 464 IRQ_TYPE_EDGE_RISING>,
++ <GIC_SPI 466 IRQ_TYPE_EDGE_RISING>,
++ <GIC_SPI 468 IRQ_TYPE_EDGE_RISING>,
++ <GIC_SPI 477 IRQ_TYPE_EDGE_RISING>,
++ <GIC_SPI 478 IRQ_TYPE_EDGE_RISING>,
++ <GIC_SPI 479 IRQ_TYPE_EDGE_RISING>,
++ <GIC_SPI 448 IRQ_TYPE_EDGE_RISING>,
++ <GIC_SPI 465 IRQ_TYPE_EDGE_RISING>,
++ <GIC_SPI 467 IRQ_TYPE_EDGE_RISING>,
++ <GIC_SPI 469 IRQ_TYPE_EDGE_RISING>;
+ interrupt-names = "csid0",
+ "csid1",
+ "csid2",
+--
+2.39.5
+
--- /dev/null
+From d397ceed796121a4ab732c0b2fea33c89ea17040 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Dec 2024 12:17:10 +0200
+Subject: arm64: dts: qcom: sm6125: correct sleep clock frequency
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit b3c547e1507862f0e4d46432b665c5c6e61e14d6 ]
+
+The SM6125 platform uses PM6125 to provide sleep clock. According to the
+documentation, that clock has 32.7645 kHz frequency. Correct the sleep
+clock definition.
+
+Fixes: cff4bbaf2a2d ("arm64: dts: qcom: Add support for SM6125")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-11-e9b08fbeadd3@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm6125.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm6125.dtsi b/arch/arm64/boot/dts/qcom/sm6125.dtsi
+index 271247b371759..a3876a322baa0 100644
+--- a/arch/arm64/boot/dts/qcom/sm6125.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm6125.dtsi
+@@ -27,7 +27,7 @@
+ sleep_clk: sleep-clk {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+- clock-frequency = <32000>;
++ clock-frequency = <32764>;
+ clock-output-names = "sleep_clk";
+ };
+ };
+--
+2.39.5
+
--- /dev/null
+From 6ea359c8275a283aa385b03c1499f4e5e346220b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2024 09:55:01 +0100
+Subject: arm64: dts: qcom: sm7225-fairphone-fp4: Drop extra qcom,msm-id value
+
+From: Luca Weiss <luca.weiss@fairphone.com>
+
+[ Upstream commit 7fb88e0d4dc1a40a29d49b603faa1484334c60f3 ]
+
+The ID 434 is for SM6350 while 459 is for SM7225. Fairphone 4 is only
+SM7225, so drop the unused 434 entry.
+
+Fixes: 4cbea668767d ("arm64: dts: qcom: sm7225: Add device tree for Fairphone 4")
+Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20241220-fp4-msm-id-v1-1-2b75af02032a@fairphone.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts b/arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts
+index 30c94fd4fe61f..be47e34da9906 100644
+--- a/arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts
++++ b/arch/arm64/boot/dts/qcom/sm7225-fairphone-fp4.dts
+@@ -20,7 +20,7 @@
+ chassis-type = "handset";
+
+ /* required for bootloader to select correct board */
+- qcom,msm-id = <434 0x10000>, <459 0x10000>;
++ qcom,msm-id = <459 0x10000>;
+ qcom,board-id = <8 32>;
+
+ aliases {
+--
+2.39.5
+
--- /dev/null
+From c49757f0b23c180aeaa0a15ab6e09ef33ac7d288 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Dec 2024 13:44:49 +0100
+Subject: arm64: dts: qcom: sm8150-microsoft-surface-duo: fix typos in da7280
+ properties
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit 9875adffb87da5c40f4013e55104f5e2fc071c2a ]
+
+The dlg,const-op-mode & dlg,periodic-op-mode were mis-names with twice
+the "dlg," prefix, drop one to match the bindings.
+
+This fixes:
+sm8150-microsoft-surface-duo.dtb: da7280@4a: 'dlg,const-op-mode' is a required property
+ from schema $id: http://devicetree.org/schemas/input/dlg,da7280.yaml#
+m8150-microsoft-surface-duo.dtb: da7280@4a: 'dlg,periodic-op-mode' is a required property
+ from schema $id: http://devicetree.org/schemas/input/dlg,da7280.yaml#
+sm8150-microsoft-surface-duo.dtb: da7280@4a: 'dlg,dlg,const-op-mode', 'dlg,dlg,periodic-op-mode' do not match any of the regexes: 'pinctrl-[0-9]+'
+ from schema $id: http://devicetree.org/schemas/input/dlg,da7280.yaml#
+
+With the dlg,da7280.yaml converted from dlg,da7280.txt at [1].
+
+[1] https://lore.kernel.org/all/20241206-topic-misc-da7280-convert-v2-1-1c3539f75604@linaro.org/
+
+Fixes: d1f781db47a8 ("arm64: dts: qcom: add initial device-tree for Microsoft Surface Duo")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20241230-topic-misc-dt-fixes-v4-6-1e6880e9dda3@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8150-microsoft-surface-duo.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8150-microsoft-surface-duo.dts b/arch/arm64/boot/dts/qcom/sm8150-microsoft-surface-duo.dts
+index 5397fba9417bb..51ddbac3cfe56 100644
+--- a/arch/arm64/boot/dts/qcom/sm8150-microsoft-surface-duo.dts
++++ b/arch/arm64/boot/dts/qcom/sm8150-microsoft-surface-duo.dts
+@@ -376,8 +376,8 @@
+ pinctrl-0 = <&da7280_intr_default>;
+
+ dlg,actuator-type = "LRA";
+- dlg,dlg,const-op-mode = <1>;
+- dlg,dlg,periodic-op-mode = <1>;
++ dlg,const-op-mode = <1>;
++ dlg,periodic-op-mode = <1>;
+ dlg,nom-microvolt = <2000000>;
+ dlg,abs-max-microvolt = <2000000>;
+ dlg,imax-microamp = <129000>;
+--
+2.39.5
+
--- /dev/null
+From a525ec8919dd272584eea57f5ad91056843ab39e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Dec 2024 12:17:12 +0200
+Subject: arm64: dts: qcom: sm8250: correct sleep clock frequency
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 75420e437eed69fa95d1d7c339dad86dea35319a ]
+
+The SM8250 platform uses PM8150 to provide sleep clock. According to the
+documentation, that clock has 32.7645 kHz frequency. Correct the sleep
+clock definition.
+
+Fixes: 9ff8b0591fcf ("arm64: dts: qcom: sm8250: use the right clock-freqency for sleep-clk")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-13-e9b08fbeadd3@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+index c9780b2afd2f5..e0935da96cd6a 100644
+--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+@@ -84,7 +84,7 @@
+
+ sleep_clk: sleep-clk {
+ compatible = "fixed-clock";
+- clock-frequency = <32768>;
++ clock-frequency = <32764>;
+ #clock-cells = <0>;
+ };
+ };
+--
+2.39.5
+
--- /dev/null
+From 44d0e1c000f97562adff0dc0a065f6cf56813f13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2024 14:29:50 +0200
+Subject: arm64: dts: qcom: sm8250: Fix interrupt types of camss interrupts
+
+From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+
+[ Upstream commit 6c7bba42ebc3da56e64d4aec4c4a31dd454e05fd ]
+
+Qualcomm IP catalog says that all CAMSS interrupts is edge rising,
+fix it in the CAMSS device tree node for sm8250 SoC.
+
+Fixes: 30325603b910 ("arm64: dts: qcom: sm8250: camss: Add CAMSS block definition")
+Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Link: https://lore.kernel.org/r/20241127122950.885982-7-vladimir.zapolskiy@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8250.dtsi | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+index e0935da96cd6a..eb500cb67c86c 100644
+--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+@@ -3291,20 +3291,20 @@
+ "vfe_lite0",
+ "vfe_lite1";
+
+- interrupts = <GIC_SPI 477 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 478 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 479 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 448 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 89 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 464 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 466 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 468 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 359 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 465 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 467 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 469 IRQ_TYPE_LEVEL_HIGH>,
+- <GIC_SPI 360 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_SPI 477 IRQ_TYPE_EDGE_RISING>,
++ <GIC_SPI 478 IRQ_TYPE_EDGE_RISING>,
++ <GIC_SPI 479 IRQ_TYPE_EDGE_RISING>,
++ <GIC_SPI 448 IRQ_TYPE_EDGE_RISING>,
++ <GIC_SPI 86 IRQ_TYPE_EDGE_RISING>,
++ <GIC_SPI 89 IRQ_TYPE_EDGE_RISING>,
++ <GIC_SPI 464 IRQ_TYPE_EDGE_RISING>,
++ <GIC_SPI 466 IRQ_TYPE_EDGE_RISING>,
++ <GIC_SPI 468 IRQ_TYPE_EDGE_RISING>,
++ <GIC_SPI 359 IRQ_TYPE_EDGE_RISING>,
++ <GIC_SPI 465 IRQ_TYPE_EDGE_RISING>,
++ <GIC_SPI 467 IRQ_TYPE_EDGE_RISING>,
++ <GIC_SPI 469 IRQ_TYPE_EDGE_RISING>,
++ <GIC_SPI 360 IRQ_TYPE_EDGE_RISING>;
+ interrupt-names = "csiphy0",
+ "csiphy1",
+ "csiphy2",
+--
+2.39.5
+
--- /dev/null
+From 8e4f2b25480793b1da0d0b7cecc82d82aae56399 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Dec 2024 12:17:13 +0200
+Subject: arm64: dts: qcom: sm8350: correct sleep clock frequency
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit f4cc8c75cfc5d06084a31da2ff67e477565f0cae ]
+
+The SM8350 platform uses PMK8350 to provide sleep clock. According to the
+documentation, that clock has 32.7645 kHz frequency. Correct the sleep
+clock definition.
+
+Fixes: b7e8f433a673 ("arm64: dts: qcom: Add basic devicetree support for SM8350 SoC")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-14-e9b08fbeadd3@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8350.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+index 888bf4cd73c31..5e97ede46a3e2 100644
+--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+@@ -34,7 +34,7 @@
+
+ sleep_clk: sleep-clk {
+ compatible = "fixed-clock";
+- clock-frequency = <32000>;
++ clock-frequency = <32764>;
+ #clock-cells = <0>;
+ };
+
+--
+2.39.5
+
--- /dev/null
+From 90c07f5b475d6ba3d99288223117e5100ac5a532 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Dec 2024 12:17:14 +0200
+Subject: arm64: dts: qcom: sm8450: correct sleep clock frequency
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit c375ff3b887abf376607d4769c1114c5e3b6ea72 ]
+
+The SM8450 platform uses PMK8350 to provide sleep clock. According to the
+documentation, that clock has 32.7645 kHz frequency. Correct the sleep
+clock definition.
+
+Fixes: 5188049c9b36 ("arm64: dts: qcom: Add base SM8450 DTSI")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20241224-fix-board-clocks-v3-15-e9b08fbeadd3@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8450.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi
+index aa0977af9411a..46f2e67ce6236 100644
+--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi
+@@ -33,7 +33,7 @@
+ sleep_clk: sleep-clk {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+- clock-frequency = <32000>;
++ clock-frequency = <32764>;
+ };
+ };
+
+--
+2.39.5
+
--- /dev/null
+From b2402487d40dcf501bdd71d0354ffdbf666a46e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2024 14:59:24 -0600
+Subject: arm64: dts: ti: k3-am62: Remove duplicate GICR reg
+
+From: Bryan Brattlof <bb@ti.com>
+
+[ Upstream commit 72c691d77ea5d0c4636fd3e9f0ad80d813c7d1a7 ]
+
+The GIC Redistributor control register range is mapped twice. Remove
+the extra entry from the reg range.
+
+Fixes: f1d17330a5be ("arm64: dts: ti: Introduce base support for AM62x SoC")
+Reported-by: Bin Liu <b-liu@ti.com>
+Signed-off-by: Bryan Brattlof <bb@ti.com>
+Link: https://lore.kernel.org/r/20241210-am62-gic-fixup-v1-1-758b4d5b4a0a@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am62-main.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi
+index eb8690a6be168..04222028e53e2 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi
+@@ -23,7 +23,6 @@
+ interrupt-controller;
+ reg = <0x00 0x01800000 0x00 0x10000>, /* GICD */
+ <0x00 0x01880000 0x00 0xc0000>, /* GICR */
+- <0x00 0x01880000 0x00 0xc0000>, /* GICR */
+ <0x01 0x00000000 0x00 0x2000>, /* GICC */
+ <0x01 0x00010000 0x00 0x1000>, /* GICH */
+ <0x01 0x00020000 0x00 0x2000>; /* GICV */
+--
+2.39.5
+
--- /dev/null
+From addaed4335b6da03ee180ee32e2f4e8b20d8ba72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2024 14:59:25 -0600
+Subject: arm64: dts: ti: k3-am62a: Remove duplicate GICR reg
+
+From: Bryan Brattlof <bb@ti.com>
+
+[ Upstream commit 6f0232577e260cdbc25508e27bb0b75ade7e7ebc ]
+
+The GIC Redistributor control range is mapped twice. Remove the extra
+entry from the reg range.
+
+Fixes: 5fc6b1b62639 ("arm64: dts: ti: Introduce AM62A7 family of SoCs")
+Reported-by: Bin Liu <b-liu@ti.com>
+Signed-off-by: Bryan Brattlof <bb@ti.com>
+Link: https://lore.kernel.org/r/20241210-am62-gic-fixup-v1-2-758b4d5b4a0a@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am62a-main.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi b/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi
+index 9301ea3888021..4b349d73da21f 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi
+@@ -18,7 +18,6 @@
+ compatible = "arm,gic-v3";
+ reg = <0x00 0x01800000 0x00 0x10000>, /* GICD */
+ <0x00 0x01880000 0x00 0xc0000>, /* GICR */
+- <0x00 0x01880000 0x00 0xc0000>, /* GICR */
+ <0x01 0x00000000 0x00 0x2000>, /* GICC */
+ <0x01 0x00010000 0x00 0x1000>, /* GICH */
+ <0x01 0x00020000 0x00 0x2000>; /* GICV */
+--
+2.39.5
+
--- /dev/null
+From fa82c6fc58bf1eeeb6a8a0fe04260773bb9174fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jan 2025 13:22:06 +0100
+Subject: ASoC: Intel: avs: Fix theoretical infinite loop
+
+From: Cezary Rojewski <cezary.rojewski@intel.com>
+
+[ Upstream commit cf4d74256fe103ece7b2647550e6c063048e5682 ]
+
+While 'stack_dump_size' is a u32 bitfield of 16 bits, u32 has a bigger
+upper bound than the type u16 of loop counter 'offset' what in theory
+may lead to infinite loop condition.
+
+Found out by Coverity static analyzer.
+
+Fixes: c8c960c10971 ("ASoC: Intel: avs: APL-based platforms support")
+Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Link: https://patch.msgid.link/20250109122216.3667847-4-cezary.rojewski@intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/avs/apl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/avs/apl.c b/sound/soc/intel/avs/apl.c
+index f366478a875de..c4a0b9104151e 100644
+--- a/sound/soc/intel/avs/apl.c
++++ b/sound/soc/intel/avs/apl.c
+@@ -112,7 +112,7 @@ static int apl_coredump(struct avs_dev *adev, union avs_notify_msg *msg)
+ struct apl_log_buffer_layout layout;
+ void __iomem *addr, *buf;
+ size_t dump_size;
+- u16 offset = 0;
++ u32 offset = 0;
+ u8 *dump, *pos;
+
+ dump_size = AVS_FW_REGS_SIZE + msg->ext.coredump.stack_dump_size;
+--
+2.39.5
+
--- /dev/null
+From c2ff58d2de34e10b8c192f590bb19252bf7e45d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2024 19:09:34 +0200
+Subject: ASoC: renesas: rz-ssi: Use only the proper amount of dividers
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+[ Upstream commit 55c209cd4318c701e6e88e0b2512a0f12dd02a7d ]
+
+There is no need to populate the ckdv[] with invalid dividers as that
+part will not be indexed anyway. The ssi->audio_mck/bclk_rate should
+always be >= 0. While at it, change the ckdv type as u8, as the divider
+128 was previously using the s8 sign bit.
+
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Fixes: 03e786bd43410fa9 ("ASoC: sh: Add RZ/G2L SSIF-2 driver")
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20241210170953.2936724-6-claudiu.beznea.uj@bp.renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sh/rz-ssi.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/sound/soc/sh/rz-ssi.c b/sound/soc/sh/rz-ssi.c
+index 5d6bae33ae34c..468050467bb39 100644
+--- a/sound/soc/sh/rz-ssi.c
++++ b/sound/soc/sh/rz-ssi.c
+@@ -244,8 +244,7 @@ static void rz_ssi_stream_quit(struct rz_ssi_priv *ssi,
+ static int rz_ssi_clk_setup(struct rz_ssi_priv *ssi, unsigned int rate,
+ unsigned int channels)
+ {
+- static s8 ckdv[16] = { 1, 2, 4, 8, 16, 32, 64, 128,
+- 6, 12, 24, 48, 96, -1, -1, -1 };
++ static u8 ckdv[] = { 1, 2, 4, 8, 16, 32, 64, 128, 6, 12, 24, 48, 96 };
+ unsigned int channel_bits = 32; /* System Word Length */
+ unsigned long bclk_rate = rate * channels * channel_bits;
+ unsigned int div;
+--
+2.39.5
+
--- /dev/null
+From e5439ba0a51f22c873115d64e6357e52b9359e2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Nov 2024 17:55:29 +0100
+Subject: ASoC: sun4i-spdif: Add clock multiplier settings
+
+From: George Lander <lander@jagmn.com>
+
+[ Upstream commit 0a2319308de88b9e819c0b43d0fccd857123eb31 ]
+
+There have been intermittent issues with the SPDIF output on H3
+and H2+ devices which has been fixed by setting the s_clk to 4
+times the audio pll.
+Add a quirk for the clock multiplier as not every supported SoC
+requires it. Without the multiplier, the audio at normal sampling
+rates was distorted and did not play at higher sampling rates.
+
+Fixes: 1bd92af877ab ("ASoC: sun4i-spdif: Add support for the H3 SoC")
+Signed-off-by: George Lander <lander@jagmn.com>
+Signed-off-by: Marcus Cooper <codekipper@gmail.com>
+Link: https://patch.msgid.link/20241111165600.57219-2-codekipper@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sunxi/sun4i-spdif.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/sunxi/sun4i-spdif.c b/sound/soc/sunxi/sun4i-spdif.c
+index 484b0e7c2defa..84e7b363ac3b1 100644
+--- a/sound/soc/sunxi/sun4i-spdif.c
++++ b/sound/soc/sunxi/sun4i-spdif.c
+@@ -177,6 +177,7 @@ struct sun4i_spdif_quirks {
+ unsigned int reg_dac_txdata;
+ bool has_reset;
+ unsigned int val_fctl_ftx;
++ unsigned int mclk_multiplier;
+ };
+
+ struct sun4i_spdif_dev {
+@@ -314,6 +315,7 @@ static int sun4i_spdif_hw_params(struct snd_pcm_substream *substream,
+ default:
+ return -EINVAL;
+ }
++ mclk *= host->quirks->mclk_multiplier;
+
+ ret = clk_set_rate(host->spdif_clk, mclk);
+ if (ret < 0) {
+@@ -348,6 +350,7 @@ static int sun4i_spdif_hw_params(struct snd_pcm_substream *substream,
+ default:
+ return -EINVAL;
+ }
++ mclk_div *= host->quirks->mclk_multiplier;
+
+ reg_val = 0;
+ reg_val |= SUN4I_SPDIF_TXCFG_ASS;
+@@ -541,24 +544,28 @@ static struct snd_soc_dai_driver sun4i_spdif_dai = {
+ static const struct sun4i_spdif_quirks sun4i_a10_spdif_quirks = {
+ .reg_dac_txdata = SUN4I_SPDIF_TXFIFO,
+ .val_fctl_ftx = SUN4I_SPDIF_FCTL_FTX,
++ .mclk_multiplier = 1,
+ };
+
+ static const struct sun4i_spdif_quirks sun6i_a31_spdif_quirks = {
+ .reg_dac_txdata = SUN4I_SPDIF_TXFIFO,
+ .val_fctl_ftx = SUN4I_SPDIF_FCTL_FTX,
+ .has_reset = true,
++ .mclk_multiplier = 1,
+ };
+
+ static const struct sun4i_spdif_quirks sun8i_h3_spdif_quirks = {
+ .reg_dac_txdata = SUN8I_SPDIF_TXFIFO,
+ .val_fctl_ftx = SUN4I_SPDIF_FCTL_FTX,
+ .has_reset = true,
++ .mclk_multiplier = 4,
+ };
+
+ static const struct sun4i_spdif_quirks sun50i_h6_spdif_quirks = {
+ .reg_dac_txdata = SUN8I_SPDIF_TXFIFO,
+ .val_fctl_ftx = SUN50I_H6_SPDIF_FCTL_FTX,
+ .has_reset = true,
++ .mclk_multiplier = 1,
+ };
+
+ static const struct of_device_id sun4i_spdif_of_match[] = {
+--
+2.39.5
+
--- /dev/null
+From 6ee6965bf29df0c498b8289ebce3a5f82efce7b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jan 2025 21:05:14 +0000
+Subject: ax25: rcu protect dev->ax25_ptr
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 95fc45d1dea8e1253f8ec58abc5befb71553d666 ]
+
+syzbot found a lockdep issue [1].
+
+We should remove ax25 RTNL dependency in ax25_setsockopt()
+
+This should also fix a variety of possible UAF in ax25.
+
+[1]
+
+WARNING: possible circular locking dependency detected
+6.13.0-rc3-syzkaller-00762-g9268abe611b0 #0 Not tainted
+------------------------------------------------------
+syz.5.1818/12806 is trying to acquire lock:
+ ffffffff8fcb3988 (rtnl_mutex){+.+.}-{4:4}, at: ax25_setsockopt+0xa55/0xe90 net/ax25/af_ax25.c:680
+
+but task is already holding lock:
+ ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1618 [inline]
+ ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: ax25_setsockopt+0x209/0xe90 net/ax25/af_ax25.c:574
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #1 (sk_lock-AF_AX25){+.+.}-{0:0}:
+ lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
+ lock_sock_nested+0x48/0x100 net/core/sock.c:3642
+ lock_sock include/net/sock.h:1618 [inline]
+ ax25_kill_by_device net/ax25/af_ax25.c:101 [inline]
+ ax25_device_event+0x24d/0x580 net/ax25/af_ax25.c:146
+ notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85
+ __dev_notify_flags+0x207/0x400
+ dev_change_flags+0xf0/0x1a0 net/core/dev.c:9026
+ dev_ifsioc+0x7c8/0xe70 net/core/dev_ioctl.c:563
+ dev_ioctl+0x719/0x1340 net/core/dev_ioctl.c:820
+ sock_do_ioctl+0x240/0x460 net/socket.c:1234
+ sock_ioctl+0x626/0x8e0 net/socket.c:1339
+ vfs_ioctl fs/ioctl.c:51 [inline]
+ __do_sys_ioctl fs/ioctl.c:906 [inline]
+ __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892
+ do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+ do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+-> #0 (rtnl_mutex){+.+.}-{4:4}:
+ check_prev_add kernel/locking/lockdep.c:3161 [inline]
+ check_prevs_add kernel/locking/lockdep.c:3280 [inline]
+ validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
+ __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226
+ lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
+ __mutex_lock_common kernel/locking/mutex.c:585 [inline]
+ __mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735
+ ax25_setsockopt+0xa55/0xe90 net/ax25/af_ax25.c:680
+ do_sock_setsockopt+0x3af/0x720 net/socket.c:2324
+ __sys_setsockopt net/socket.c:2349 [inline]
+ __do_sys_setsockopt net/socket.c:2355 [inline]
+ __se_sys_setsockopt net/socket.c:2352 [inline]
+ __x64_sys_setsockopt+0x1ee/0x280 net/socket.c:2352
+ do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+ do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+other info that might help us debug this:
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(sk_lock-AF_AX25);
+ lock(rtnl_mutex);
+ lock(sk_lock-AF_AX25);
+ lock(rtnl_mutex);
+
+ *** DEADLOCK ***
+
+1 lock held by syz.5.1818/12806:
+ #0: ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1618 [inline]
+ #0: ffff8880617ac258 (sk_lock-AF_AX25){+.+.}-{0:0}, at: ax25_setsockopt+0x209/0xe90 net/ax25/af_ax25.c:574
+
+stack backtrace:
+CPU: 1 UID: 0 PID: 12806 Comm: syz.5.1818 Not tainted 6.13.0-rc3-syzkaller-00762-g9268abe611b0 #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:94 [inline]
+ dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
+ print_circular_bug+0x13a/0x1b0 kernel/locking/lockdep.c:2074
+ check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2206
+ check_prev_add kernel/locking/lockdep.c:3161 [inline]
+ check_prevs_add kernel/locking/lockdep.c:3280 [inline]
+ validate_chain+0x18ef/0x5920 kernel/locking/lockdep.c:3904
+ __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226
+ lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
+ __mutex_lock_common kernel/locking/mutex.c:585 [inline]
+ __mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735
+ ax25_setsockopt+0xa55/0xe90 net/ax25/af_ax25.c:680
+ do_sock_setsockopt+0x3af/0x720 net/socket.c:2324
+ __sys_setsockopt net/socket.c:2349 [inline]
+ __do_sys_setsockopt net/socket.c:2355 [inline]
+ __se_sys_setsockopt net/socket.c:2352 [inline]
+ __x64_sys_setsockopt+0x1ee/0x280 net/socket.c:2352
+ do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+ do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+RIP: 0033:0x7f7b62385d29
+
+Fixes: c433570458e4 ("ax25: fix a use-after-free in ax25_fillin_cb()")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Link: https://patch.msgid.link/20250103210514.87290-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netdevice.h | 2 +-
+ include/net/ax25.h | 10 +++++-----
+ net/ax25/af_ax25.c | 12 ++++++------
+ net/ax25/ax25_dev.c | 4 ++--
+ net/ax25/ax25_ip.c | 3 ++-
+ net/ax25/ax25_out.c | 22 +++++++++++++++++-----
+ net/ax25/ax25_route.c | 2 ++
+ 7 files changed, 35 insertions(+), 20 deletions(-)
+
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 662183994e885..c75aed1fff7d1 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -2177,7 +2177,7 @@ struct net_device {
+ void *atalk_ptr;
+ #endif
+ #if IS_ENABLED(CONFIG_AX25)
+- void *ax25_ptr;
++ struct ax25_dev __rcu *ax25_ptr;
+ #endif
+ #if IS_ENABLED(CONFIG_CFG80211)
+ struct wireless_dev *ieee80211_ptr;
+diff --git a/include/net/ax25.h b/include/net/ax25.h
+index 1d55e8ee08b4f..e9465aa07a4e7 100644
+--- a/include/net/ax25.h
++++ b/include/net/ax25.h
+@@ -229,6 +229,7 @@ typedef struct ax25_dev {
+ #endif
+ refcount_t refcount;
+ bool device_up;
++ struct rcu_head rcu;
+ } ax25_dev;
+
+ typedef struct ax25_cb {
+@@ -291,9 +292,8 @@ static inline void ax25_dev_hold(ax25_dev *ax25_dev)
+
+ static inline void ax25_dev_put(ax25_dev *ax25_dev)
+ {
+- if (refcount_dec_and_test(&ax25_dev->refcount)) {
+- kfree(ax25_dev);
+- }
++ if (refcount_dec_and_test(&ax25_dev->refcount))
++ kfree_rcu(ax25_dev, rcu);
+ }
+ static inline __be16 ax25_type_trans(struct sk_buff *skb, struct net_device *dev)
+ {
+@@ -336,9 +336,9 @@ void ax25_digi_invert(const ax25_digi *, ax25_digi *);
+ extern spinlock_t ax25_dev_lock;
+
+ #if IS_ENABLED(CONFIG_AX25)
+-static inline ax25_dev *ax25_dev_ax25dev(struct net_device *dev)
++static inline ax25_dev *ax25_dev_ax25dev(const struct net_device *dev)
+ {
+- return dev->ax25_ptr;
++ return rcu_dereference_rtnl(dev->ax25_ptr);
+ }
+ #endif
+
+diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
+index a1e0be8716870..4b96dedcc3c9c 100644
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -467,7 +467,7 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg)
+ goto out_put;
+ }
+
+-static void ax25_fillin_cb_from_dev(ax25_cb *ax25, ax25_dev *ax25_dev)
++static void ax25_fillin_cb_from_dev(ax25_cb *ax25, const ax25_dev *ax25_dev)
+ {
+ ax25->rtt = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T1]) / 2;
+ ax25->t1 = msecs_to_jiffies(ax25_dev->values[AX25_VALUES_T1]);
+@@ -677,22 +677,22 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
+ break;
+ }
+
+- rtnl_lock();
+- dev = __dev_get_by_name(&init_net, devname);
++ rcu_read_lock();
++ dev = dev_get_by_name_rcu(&init_net, devname);
+ if (!dev) {
+- rtnl_unlock();
++ rcu_read_unlock();
+ res = -ENODEV;
+ break;
+ }
+
+ ax25->ax25_dev = ax25_dev_ax25dev(dev);
+ if (!ax25->ax25_dev) {
+- rtnl_unlock();
++ rcu_read_unlock();
+ res = -ENODEV;
+ break;
+ }
+ ax25_fillin_cb(ax25, ax25->ax25_dev);
+- rtnl_unlock();
++ rcu_read_unlock();
+ break;
+
+ default:
+diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c
+index e165fe108bb00..2b4f8df53b765 100644
+--- a/net/ax25/ax25_dev.c
++++ b/net/ax25/ax25_dev.c
+@@ -87,7 +87,7 @@ void ax25_dev_device_up(struct net_device *dev)
+
+ spin_lock_bh(&ax25_dev_lock);
+ list_add(&ax25_dev->list, &ax25_dev_list);
+- dev->ax25_ptr = ax25_dev;
++ rcu_assign_pointer(dev->ax25_ptr, ax25_dev);
+ spin_unlock_bh(&ax25_dev_lock);
+
+ ax25_register_dev_sysctl(ax25_dev);
+@@ -122,7 +122,7 @@ void ax25_dev_device_down(struct net_device *dev)
+ }
+ }
+
+- dev->ax25_ptr = NULL;
++ RCU_INIT_POINTER(dev->ax25_ptr, NULL);
+ spin_unlock_bh(&ax25_dev_lock);
+ netdev_put(dev, &ax25_dev->dev_tracker);
+ ax25_dev_put(ax25_dev);
+diff --git a/net/ax25/ax25_ip.c b/net/ax25/ax25_ip.c
+index 36249776c021e..215d4ccf12b91 100644
+--- a/net/ax25/ax25_ip.c
++++ b/net/ax25/ax25_ip.c
+@@ -122,6 +122,7 @@ netdev_tx_t ax25_ip_xmit(struct sk_buff *skb)
+ if (dev == NULL)
+ dev = skb->dev;
+
++ rcu_read_lock();
+ if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL) {
+ kfree_skb(skb);
+ goto put;
+@@ -202,7 +203,7 @@ netdev_tx_t ax25_ip_xmit(struct sk_buff *skb)
+ ax25_queue_xmit(skb, dev);
+
+ put:
+-
++ rcu_read_unlock();
+ ax25_route_lock_unuse();
+ return NETDEV_TX_OK;
+ }
+diff --git a/net/ax25/ax25_out.c b/net/ax25/ax25_out.c
+index 3db76d2470e95..8bca2ace98e51 100644
+--- a/net/ax25/ax25_out.c
++++ b/net/ax25/ax25_out.c
+@@ -39,10 +39,14 @@ ax25_cb *ax25_send_frame(struct sk_buff *skb, int paclen, const ax25_address *sr
+ * specified.
+ */
+ if (paclen == 0) {
+- if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL)
++ rcu_read_lock();
++ ax25_dev = ax25_dev_ax25dev(dev);
++ if (!ax25_dev) {
++ rcu_read_unlock();
+ return NULL;
+-
++ }
+ paclen = ax25_dev->values[AX25_VALUES_PACLEN];
++ rcu_read_unlock();
+ }
+
+ /*
+@@ -53,13 +57,19 @@ ax25_cb *ax25_send_frame(struct sk_buff *skb, int paclen, const ax25_address *sr
+ return ax25; /* It already existed */
+ }
+
+- if ((ax25_dev = ax25_dev_ax25dev(dev)) == NULL)
++ rcu_read_lock();
++ ax25_dev = ax25_dev_ax25dev(dev);
++ if (!ax25_dev) {
++ rcu_read_unlock();
+ return NULL;
++ }
+
+- if ((ax25 = ax25_create_cb()) == NULL)
++ if ((ax25 = ax25_create_cb()) == NULL) {
++ rcu_read_unlock();
+ return NULL;
+-
++ }
+ ax25_fillin_cb(ax25, ax25_dev);
++ rcu_read_unlock();
+
+ ax25->source_addr = *src;
+ ax25->dest_addr = *dest;
+@@ -358,7 +368,9 @@ void ax25_queue_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ unsigned char *ptr;
+
++ rcu_read_lock();
+ skb->protocol = ax25_type_trans(skb, ax25_fwd_dev(dev));
++ rcu_read_unlock();
+
+ ptr = skb_push(skb, 1);
+ *ptr = 0x00; /* KISS */
+diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c
+index b7c4d656a94b7..69de75db0c9c2 100644
+--- a/net/ax25/ax25_route.c
++++ b/net/ax25/ax25_route.c
+@@ -406,6 +406,7 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
+ ax25_route_lock_unuse();
+ return -EHOSTUNREACH;
+ }
++ rcu_read_lock();
+ if ((ax25->ax25_dev = ax25_dev_ax25dev(ax25_rt->dev)) == NULL) {
+ err = -EHOSTUNREACH;
+ goto put;
+@@ -442,6 +443,7 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
+ }
+
+ put:
++ rcu_read_unlock();
+ ax25_route_lock_unuse();
+ return err;
+ }
+--
+2.39.5
+
--- /dev/null
+From 9ec99546aba7ff3370992369454952223d80f8fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Jan 2025 09:51:59 -0800
+Subject: bgmac: reduce max frame size to support just MTU 1500
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 752e5fcc2e77358936d36ef8e522d6439372e201 ]
+
+bgmac allocates new replacement buffer before handling each received
+frame. Allocating & DMA-preparing 9724 B each time consumes a lot of CPU
+time. Ideally bgmac should just respect currently set MTU but it isn't
+the case right now. For now just revert back to the old limited frame
+size.
+
+This change bumps NAT masquerade speed by ~95%.
+
+Since commit 8218f62c9c9b ("mm: page_frag: use initial zero offset for
+page_frag_alloc_align()"), the bgmac driver fails to open its network
+interface successfully and runs out of memory in the following call
+stack:
+
+bgmac_open
+ -> bgmac_dma_init
+ -> bgmac_dma_rx_skb_for_slot
+ -> netdev_alloc_frag
+
+BGMAC_RX_ALLOC_SIZE = 10048 and PAGE_FRAG_CACHE_MAX_SIZE = 32768.
+
+Eventually we land into __page_frag_alloc_align() with the following
+parameters across multiple successive calls:
+
+__page_frag_alloc_align: fragsz=10048, align_mask=-1, size=32768, offset=0
+__page_frag_alloc_align: fragsz=10048, align_mask=-1, size=32768, offset=10048
+__page_frag_alloc_align: fragsz=10048, align_mask=-1, size=32768, offset=20096
+__page_frag_alloc_align: fragsz=10048, align_mask=-1, size=32768, offset=30144
+
+So in that case we do indeed have offset + fragsz (40192) > size (32768)
+and so we would eventually return NULL. Reverting to the older 1500
+bytes MTU allows the network driver to be usable again.
+
+Fixes: 8c7da63978f1 ("bgmac: configure MTU and add support for frames beyond 8192 byte size")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+[florian: expand commit message about recent commits]
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Link: https://patch.msgid.link/20250127175159.1788246-1-florian.fainelli@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bgmac.h | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bgmac.h b/drivers/net/ethernet/broadcom/bgmac.h
+index d73ef262991d6..6fee9a41839c0 100644
+--- a/drivers/net/ethernet/broadcom/bgmac.h
++++ b/drivers/net/ethernet/broadcom/bgmac.h
+@@ -328,8 +328,7 @@
+ #define BGMAC_RX_FRAME_OFFSET 30 /* There are 2 unused bytes between header and real data */
+ #define BGMAC_RX_BUF_OFFSET (NET_SKB_PAD + NET_IP_ALIGN - \
+ BGMAC_RX_FRAME_OFFSET)
+-/* Jumbo frame size with FCS */
+-#define BGMAC_RX_MAX_FRAME_SIZE 9724
++#define BGMAC_RX_MAX_FRAME_SIZE 1536
+ #define BGMAC_RX_BUF_SIZE (BGMAC_RX_FRAME_OFFSET + BGMAC_RX_MAX_FRAME_SIZE)
+ #define BGMAC_RX_ALLOC_SIZE (SKB_DATA_ALIGN(BGMAC_RX_BUF_SIZE + BGMAC_RX_BUF_OFFSET) + \
+ SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
+--
+2.39.5
+
--- /dev/null
+From bc58762b56854b2db459890ee7161ba1da581ca0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2024 19:04:35 +0800
+Subject: block: retry call probe after request_module in blk_request_module
+
+From: Yang Erkun <yangerkun@huawei.com>
+
+[ Upstream commit 457ef47c08d2979f3e59ce66267485c3faed70c8 ]
+
+Set kernel config:
+
+ CONFIG_BLK_DEV_LOOP=m
+ CONFIG_BLK_DEV_LOOP_MIN_COUNT=0
+
+Do latter:
+
+ mknod loop0 b 7 0
+ exec 4<> loop0
+
+Before commit e418de3abcda ("block: switch gendisk lookup to a simple
+xarray"), lookup_gendisk will first use base_probe to load module loop,
+and then the retry will call loop_probe to prepare the loop disk. Finally
+open for this disk will success. However, after this commit, we lose the
+retry logic, and open will fail with ENXIO. Block device autoloading is
+deprecated and will be removed soon, but maybe we should keep open success
+until we really remove it. So, give a retry to fix it.
+
+Fixes: e418de3abcda ("block: switch gendisk lookup to a simple xarray")
+Suggested-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Yang Erkun <yangerkun@huawei.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20241209110435.3670985-1-yangerkun@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/genhd.c | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/block/genhd.c b/block/genhd.c
+index 8256e11f85b7d..1cb517969607c 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -738,7 +738,7 @@ static ssize_t disk_badblocks_store(struct device *dev,
+ }
+
+ #ifdef CONFIG_BLOCK_LEGACY_AUTOLOAD
+-void blk_request_module(dev_t devt)
++static bool blk_probe_dev(dev_t devt)
+ {
+ unsigned int major = MAJOR(devt);
+ struct blk_major_name **n;
+@@ -748,14 +748,26 @@ void blk_request_module(dev_t devt)
+ if ((*n)->major == major && (*n)->probe) {
+ (*n)->probe(devt);
+ mutex_unlock(&major_names_lock);
+- return;
++ return true;
+ }
+ }
+ mutex_unlock(&major_names_lock);
++ return false;
++}
++
++void blk_request_module(dev_t devt)
++{
++ int error;
++
++ if (blk_probe_dev(devt))
++ return;
+
+- if (request_module("block-major-%d-%d", MAJOR(devt), MINOR(devt)) > 0)
+- /* Make old-style 2.4 aliases work */
+- request_module("block-major-%d", MAJOR(devt));
++ error = request_module("block-major-%d-%d", MAJOR(devt), MINOR(devt));
++ /* Make old-style 2.4 aliases work */
++ if (error > 0)
++ error = request_module("block-major-%d", MAJOR(devt));
++ if (!error)
++ blk_probe_dev(devt);
+ }
+ #endif /* CONFIG_BLOCK_LEGACY_AUTOLOAD */
+
+--
+2.39.5
+
--- /dev/null
+From afdad3fb14237cb60633d857100e23396cdaa3d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2025 10:36:47 +0000
+Subject: bpf: Send signals asynchronously if !preemptible
+
+From: Puranjay Mohan <puranjay@kernel.org>
+
+[ Upstream commit 87c544108b612512b254c8f79aa5c0a8546e2cc4 ]
+
+BPF programs can execute in all kinds of contexts and when a program
+running in a non-preemptible context uses the bpf_send_signal() kfunc,
+it will cause issues because this kfunc can sleep.
+Change `irqs_disabled()` to `!preemptible()`.
+
+Reported-by: syzbot+97da3d7e0112d59971de@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/67486b09.050a0220.253251.0084.GAE@google.com/
+Fixes: 1bc7896e9ef4 ("bpf: Fix deadlock with rq_lock in bpf_send_signal()")
+Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Link: https://lore.kernel.org/r/20250115103647.38487-1-puranjay@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/bpf_trace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index f46903c1142b5..af48f66466e81 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -857,7 +857,7 @@ static int bpf_send_signal_common(u32 sig, enum pid_type type)
+ if (unlikely(is_global_init(current)))
+ return -EPERM;
+
+- if (irqs_disabled()) {
++ if (!preemptible()) {
+ /* Do an early check on signal validity. Otherwise,
+ * the error is lost in deferred irq_work.
+ */
+--
+2.39.5
+
--- /dev/null
+From 2c3b4f13ef0bfd588900baad40a52539eb376d3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jan 2025 13:28:43 -0700
+Subject: bpf: tcp: Mark bpf_load_hdr_opt() arg2 as read-write
+
+From: Daniel Xu <dxu@dxuuu.xyz>
+
+[ Upstream commit 8ac412a3361173e3000b16167af3d1f6f90af613 ]
+
+MEM_WRITE attribute is defined as: "Non-presence of MEM_WRITE means that
+MEM is only being read". bpf_load_hdr_opt() both reads and writes from
+its arg2 - void *search_res.
+
+This matters a lot for the next commit where we more precisely track
+stack accesses. Without this annotation, the verifier will make false
+assumptions about the contents of memory written to by helpers and
+possibly prune valid branches.
+
+Fixes: 6fad274f06f0 ("bpf: Add MEM_WRITE attribute")
+Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
+Link: https://lore.kernel.org/r/730e45f8c39be2a5f3d8c4406cceca9d574cbf14.1736886479.git.dxu@dxuuu.xyz
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index b35615c469e27..370f61f9bf4ba 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -7529,7 +7529,7 @@ static const struct bpf_func_proto bpf_sock_ops_load_hdr_opt_proto = {
+ .gpl_only = false,
+ .ret_type = RET_INTEGER,
+ .arg1_type = ARG_PTR_TO_CTX,
+- .arg2_type = ARG_PTR_TO_MEM,
++ .arg2_type = ARG_PTR_TO_MEM | MEM_WRITE,
+ .arg3_type = ARG_CONST_SIZE,
+ .arg4_type = ARG_ANYTHING,
+ };
+--
+2.39.5
+
--- /dev/null
+From 731abe55c67c849d2ca1122baa608711da2bda50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2024 22:03:43 +0100
+Subject: bpf, vsock: Invoke proto::close on close()
+
+From: Michal Luczaj <mhal@rbox.co>
+
+[ Upstream commit 135ffc7becc82cfb84936ae133da7969220b43b2 ]
+
+vsock defines a BPF callback to be invoked when close() is called. However,
+this callback is never actually executed. As a result, a closed vsock
+socket is not automatically removed from the sockmap/sockhash.
+
+Introduce a dummy vsock_close() and make vsock_release() call proto::close.
+
+Note: changes in __vsock_release() look messy, but it's only due to indent
+level reduction and variables xmas tree reorder.
+
+Fixes: 634f1a7110b4 ("vsock: support sockmap")
+Signed-off-by: Michal Luczaj <mhal@rbox.co>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
+Link: https://lore.kernel.org/r/20241118-vsock-bpf-poll-close-v1-3-f1b9669cacdc@rbox.co
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Stable-dep-of: fcdd2242c023 ("vsock: Keep the binding until socket destruction")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/af_vsock.c | 67 ++++++++++++++++++++++++----------------
+ 1 file changed, 40 insertions(+), 27 deletions(-)
+
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index e0107c873f261..7ad84c6c19c3e 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -116,12 +116,14 @@
+ static int __vsock_bind(struct sock *sk, struct sockaddr_vm *addr);
+ static void vsock_sk_destruct(struct sock *sk);
+ static int vsock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
++static void vsock_close(struct sock *sk, long timeout);
+
+ /* Protocol family. */
+ struct proto vsock_proto = {
+ .name = "AF_VSOCK",
+ .owner = THIS_MODULE,
+ .obj_size = sizeof(struct vsock_sock),
++ .close = vsock_close,
+ #ifdef CONFIG_BPF_SYSCALL
+ .psock_update_sk_prot = vsock_bpf_update_proto,
+ #endif
+@@ -806,39 +808,37 @@ static bool sock_type_connectible(u16 type)
+
+ static void __vsock_release(struct sock *sk, int level)
+ {
+- if (sk) {
+- struct sock *pending;
+- struct vsock_sock *vsk;
+-
+- vsk = vsock_sk(sk);
+- pending = NULL; /* Compiler warning. */
++ struct vsock_sock *vsk;
++ struct sock *pending;
+
+- /* When "level" is SINGLE_DEPTH_NESTING, use the nested
+- * version to avoid the warning "possible recursive locking
+- * detected". When "level" is 0, lock_sock_nested(sk, level)
+- * is the same as lock_sock(sk).
+- */
+- lock_sock_nested(sk, level);
++ vsk = vsock_sk(sk);
++ pending = NULL; /* Compiler warning. */
+
+- if (vsk->transport)
+- vsk->transport->release(vsk);
+- else if (sock_type_connectible(sk->sk_type))
+- vsock_remove_sock(vsk);
++ /* When "level" is SINGLE_DEPTH_NESTING, use the nested
++ * version to avoid the warning "possible recursive locking
++ * detected". When "level" is 0, lock_sock_nested(sk, level)
++ * is the same as lock_sock(sk).
++ */
++ lock_sock_nested(sk, level);
+
+- sock_orphan(sk);
+- sk->sk_shutdown = SHUTDOWN_MASK;
++ if (vsk->transport)
++ vsk->transport->release(vsk);
++ else if (sock_type_connectible(sk->sk_type))
++ vsock_remove_sock(vsk);
+
+- skb_queue_purge(&sk->sk_receive_queue);
++ sock_orphan(sk);
++ sk->sk_shutdown = SHUTDOWN_MASK;
+
+- /* Clean up any sockets that never were accepted. */
+- while ((pending = vsock_dequeue_accept(sk)) != NULL) {
+- __vsock_release(pending, SINGLE_DEPTH_NESTING);
+- sock_put(pending);
+- }
++ skb_queue_purge(&sk->sk_receive_queue);
+
+- release_sock(sk);
+- sock_put(sk);
++ /* Clean up any sockets that never were accepted. */
++ while ((pending = vsock_dequeue_accept(sk)) != NULL) {
++ __vsock_release(pending, SINGLE_DEPTH_NESTING);
++ sock_put(pending);
+ }
++
++ release_sock(sk);
++ sock_put(sk);
+ }
+
+ static void vsock_sk_destruct(struct sock *sk)
+@@ -916,9 +916,22 @@ void vsock_data_ready(struct sock *sk)
+ }
+ EXPORT_SYMBOL_GPL(vsock_data_ready);
+
++/* Dummy callback required by sockmap.
++ * See unconditional call of saved_close() in sock_map_close().
++ */
++static void vsock_close(struct sock *sk, long timeout)
++{
++}
++
+ static int vsock_release(struct socket *sock)
+ {
+- __vsock_release(sock->sk, 0);
++ struct sock *sk = sock->sk;
++
++ if (!sk)
++ return 0;
++
++ sk->sk_prot->close(sk, 0);
++ __vsock_release(sk, 0);
+ sock->sk = NULL;
+ sock->state = SS_FREE;
+
+--
+2.39.5
+
--- /dev/null
+From c6ab3c9e4f04c1ae8b8c758b97c478e65a19047f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2024 23:16:39 -0700
+Subject: clk: analogbits: Fix incorrect calculation of vco rate delta
+
+From: Bo Gan <ganboing@gmail.com>
+
+[ Upstream commit d7f12857f095ef38523399d47e68787b357232f6 ]
+
+In wrpll_configure_for_rate() we try to determine the best PLL
+configuration for a target rate. However, in the loop where we try
+values of R, we should compare the derived `vco` with `target_vco_rate`.
+However, we were in fact comparing it with `target_rate`, which is
+actually after Q shift. This is incorrect, and sometimes can result in
+suboptimal clock rates. Fix it.
+
+Fixes: 7b9487a9a5c4 ("clk: analogbits: add Wide-Range PLL library")
+Signed-off-by: Bo Gan <ganboing@gmail.com>
+Link: https://lore.kernel.org/r/20240830061639.2316-1-ganboing@gmail.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/analogbits/wrpll-cln28hpc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/analogbits/wrpll-cln28hpc.c b/drivers/clk/analogbits/wrpll-cln28hpc.c
+index 09ca823563993..d8ae392959969 100644
+--- a/drivers/clk/analogbits/wrpll-cln28hpc.c
++++ b/drivers/clk/analogbits/wrpll-cln28hpc.c
+@@ -291,7 +291,7 @@ int wrpll_configure_for_rate(struct wrpll_cfg *c, u32 target_rate,
+ vco = vco_pre * f;
+ }
+
+- delta = abs(target_rate - vco);
++ delta = abs(target_vco_rate - vco);
+ if (delta < best_delta) {
+ best_delta = delta;
+ best_r = r;
+--
+2.39.5
+
--- /dev/null
+From 8ed26180d62c0273bbd3c43f94aa1a234af5e203 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Nov 2024 02:36:54 +0100
+Subject: clk: imx8mp: Fix clkout1/2 support
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit a9b7c84d22fb1687d63ca2a386773015cf59436b ]
+
+The CLKOUTn may be fed from PLL1/2/3, but the PLL1/2/3 has to be enabled
+first by setting PLL_CLKE bit 11 in CCM_ANALOG_SYS_PLLn_GEN_CTRL register.
+The CCM_ANALOG_SYS_PLLn_GEN_CTRL bit 11 is modeled by plln_out clock. Fix
+the clock tree and place the clkout1/2 under plln_sel instead of plain plln
+to let the clock subsystem correctly control the bit 11 and enable the PLL
+in case the CLKOUTn is supplied by PLL1/2/3.
+
+Fixes: 43896f56b59e ("clk: imx8mp: add clkout1/2 support")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Link: https://lore.kernel.org/r/20241112013718.333771-1-marex@denx.de
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx8mp.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/imx/clk-imx8mp.c b/drivers/clk/imx/clk-imx8mp.c
+index 2de49bbc40f30..444dfd6adfe68 100644
+--- a/drivers/clk/imx/clk-imx8mp.c
++++ b/drivers/clk/imx/clk-imx8mp.c
+@@ -398,8 +398,9 @@ static const char * const imx8mp_dram_core_sels[] = {"dram_pll_out", "dram_alt_r
+
+ static const char * const imx8mp_clkout_sels[] = {"audio_pll1_out", "audio_pll2_out", "video_pll1_out",
+ "dummy", "dummy", "gpu_pll_out", "vpu_pll_out",
+- "arm_pll_out", "sys_pll1", "sys_pll2", "sys_pll3",
+- "dummy", "dummy", "osc_24m", "dummy", "osc_32k"};
++ "arm_pll_out", "sys_pll1_out", "sys_pll2_out",
++ "sys_pll3_out", "dummy", "dummy", "osc_24m",
++ "dummy", "osc_32k"};
+
+ static struct clk_hw **hws;
+ static struct clk_hw_onecell_data *clk_hw_data;
+--
+2.39.5
+
--- /dev/null
+From 875e9a34c95fb8d13acd021181ec74f8642cc790 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2024 23:19:12 +0530
+Subject: clk: qcom: gcc-sdm845: Do not use shared clk_ops for QUPs
+
+From: Amit Pundir <amit.pundir@linaro.org>
+
+[ Upstream commit f760a4bb5e927a133dcd75f7b69ccae2a331e42c ]
+
+Similar to the earlier fixes meant for sm8x50 and x1e platforms,
+we have to stop using the shared clk ops for sdm845 QUPs as well.
+
+As Stephen Boyd pointed out in earlier fixes, there wasn't a problem
+to mark QUP clks shared until we started parking shared RCGs at clk
+registration time in commit 01a0a6cc8cfd ("clk: qcom: Park shared RCGs
+upon registration"). Parking at init is actually harmful to the UART
+when earlycon is used. If the device is pumping out data while the
+frequency changes and we see garbage on the serial console until the
+driver can probe and actually set a proper frequency.
+
+This patch reverts the QUP clk sharing ops part of commit 06391eddb60a
+("clk: qcom: Add Global Clock controller (GCC) driver for SDM845"), so
+that the QUPs on sdm845 don't get parked during clk registration and
+break UART operations.
+
+Fixes: 01a0a6cc8cfd ("clk: qcom: Park shared RCGs upon registration")
+Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
+Link: https://lore.kernel.org/r/20241209174912.2526928-1-amit.pundir@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-sdm845.c | 32 ++++++++++++++++----------------
+ 1 file changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-sdm845.c b/drivers/clk/qcom/gcc-sdm845.c
+index ef15e8f114027..0ea549d792834 100644
+--- a/drivers/clk/qcom/gcc-sdm845.c
++++ b/drivers/clk/qcom/gcc-sdm845.c
+@@ -455,7 +455,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s0_clk_src_init = {
+ .name = "gcc_qupv3_wrap0_s0_clk_src",
+ .parent_data = gcc_parent_data_0,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap0_s0_clk_src = {
+@@ -471,7 +471,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s1_clk_src_init = {
+ .name = "gcc_qupv3_wrap0_s1_clk_src",
+ .parent_data = gcc_parent_data_0,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap0_s1_clk_src = {
+@@ -487,7 +487,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s2_clk_src_init = {
+ .name = "gcc_qupv3_wrap0_s2_clk_src",
+ .parent_data = gcc_parent_data_0,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap0_s2_clk_src = {
+@@ -503,7 +503,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s3_clk_src_init = {
+ .name = "gcc_qupv3_wrap0_s3_clk_src",
+ .parent_data = gcc_parent_data_0,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap0_s3_clk_src = {
+@@ -519,7 +519,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s4_clk_src_init = {
+ .name = "gcc_qupv3_wrap0_s4_clk_src",
+ .parent_data = gcc_parent_data_0,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap0_s4_clk_src = {
+@@ -535,7 +535,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s5_clk_src_init = {
+ .name = "gcc_qupv3_wrap0_s5_clk_src",
+ .parent_data = gcc_parent_data_0,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap0_s5_clk_src = {
+@@ -551,7 +551,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s6_clk_src_init = {
+ .name = "gcc_qupv3_wrap0_s6_clk_src",
+ .parent_data = gcc_parent_data_0,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap0_s6_clk_src = {
+@@ -567,7 +567,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s7_clk_src_init = {
+ .name = "gcc_qupv3_wrap0_s7_clk_src",
+ .parent_data = gcc_parent_data_0,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap0_s7_clk_src = {
+@@ -583,7 +583,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s0_clk_src_init = {
+ .name = "gcc_qupv3_wrap1_s0_clk_src",
+ .parent_data = gcc_parent_data_0,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap1_s0_clk_src = {
+@@ -599,7 +599,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s1_clk_src_init = {
+ .name = "gcc_qupv3_wrap1_s1_clk_src",
+ .parent_data = gcc_parent_data_0,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap1_s1_clk_src = {
+@@ -615,7 +615,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s2_clk_src_init = {
+ .name = "gcc_qupv3_wrap1_s2_clk_src",
+ .parent_data = gcc_parent_data_0,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap1_s2_clk_src = {
+@@ -631,7 +631,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s3_clk_src_init = {
+ .name = "gcc_qupv3_wrap1_s3_clk_src",
+ .parent_data = gcc_parent_data_0,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap1_s3_clk_src = {
+@@ -647,7 +647,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s4_clk_src_init = {
+ .name = "gcc_qupv3_wrap1_s4_clk_src",
+ .parent_data = gcc_parent_data_0,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap1_s4_clk_src = {
+@@ -663,7 +663,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s5_clk_src_init = {
+ .name = "gcc_qupv3_wrap1_s5_clk_src",
+ .parent_data = gcc_parent_data_0,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap1_s5_clk_src = {
+@@ -679,7 +679,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s6_clk_src_init = {
+ .name = "gcc_qupv3_wrap1_s6_clk_src",
+ .parent_data = gcc_parent_data_0,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap1_s6_clk_src = {
+@@ -695,7 +695,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s7_clk_src_init = {
+ .name = "gcc_qupv3_wrap1_s7_clk_src",
+ .parent_data = gcc_parent_data_0,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
+- .ops = &clk_rcg2_shared_ops,
++ .ops = &clk_rcg2_ops,
+ };
+
+ static struct clk_rcg2 gcc_qupv3_wrap1_s7_clk_src = {
+--
+2.39.5
+
--- /dev/null
+From 8f58ed7877091bb82c486ae5aace409fcedea3e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2025 10:11:07 +0530
+Subject: cpufreq: ACPI: Fix max-frequency computation
+
+From: Gautham R. Shenoy <gautham.shenoy@amd.com>
+
+[ Upstream commit 0834667545962ef1c5e8684ed32b45d9c574acd3 ]
+
+Commit 3c55e94c0ade ("cpufreq: ACPI: Extend frequency tables to cover
+boost frequencies") introduced an assumption in acpi_cpufreq_cpu_init()
+that the first entry in the P-state table was the nominal frequency.
+This assumption is incorrect. The frequency corresponding to the P0
+P-State need not be the same as the nominal frequency advertised via
+CPPC.
+
+Since the driver is using the CPPC.highest_perf and CPPC.nominal_perf
+to compute the boost-ratio, it makes sense to use CPPC.nominal_freq to
+compute the max-frequency. CPPC.nominal_freq is advertised on
+platforms supporting CPPC revisions 3 or higher.
+
+Hence, fallback to using the first entry in the P-State table only on
+platforms that do not advertise CPPC.nominal_freq.
+
+Fixes: 3c55e94c0ade ("cpufreq: ACPI: Extend frequency tables to cover boost frequencies")
+Tested-by: Dhananjay Ugwekar <Dhananjay.Ugwekar@amd.com>
+Signed-off-by: Gautham R. Shenoy <gautham.shenoy@amd.com>
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://patch.msgid.link/20250113044107.566-1-gautham.shenoy@amd.com
+[ rjw: Retain reverse X-mas tree ordering of local variable declarations ]
+[ rjw: Subject and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/acpi-cpufreq.c | 36 +++++++++++++++++++++++++---------
+ 1 file changed, 27 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
+index 1bb2b90ebb21c..72464e4132e2b 100644
+--- a/drivers/cpufreq/acpi-cpufreq.c
++++ b/drivers/cpufreq/acpi-cpufreq.c
+@@ -635,7 +635,14 @@ static int acpi_cpufreq_blacklist(struct cpuinfo_x86 *c)
+ #endif
+
+ #ifdef CONFIG_ACPI_CPPC_LIB
+-static u64 get_max_boost_ratio(unsigned int cpu)
++/*
++ * get_max_boost_ratio: Computes the max_boost_ratio as the ratio
++ * between the highest_perf and the nominal_perf.
++ *
++ * Returns the max_boost_ratio for @cpu. Returns the CPPC nominal
++ * frequency via @nominal_freq if it is non-NULL pointer.
++ */
++static u64 get_max_boost_ratio(unsigned int cpu, u64 *nominal_freq)
+ {
+ struct cppc_perf_caps perf_caps;
+ u64 highest_perf, nominal_perf;
+@@ -658,6 +665,9 @@ static u64 get_max_boost_ratio(unsigned int cpu)
+
+ nominal_perf = perf_caps.nominal_perf;
+
++ if (nominal_freq)
++ *nominal_freq = perf_caps.nominal_freq;
++
+ if (!highest_perf || !nominal_perf) {
+ pr_debug("CPU%d: highest or nominal performance missing\n", cpu);
+ return 0;
+@@ -670,8 +680,12 @@ static u64 get_max_boost_ratio(unsigned int cpu)
+
+ return div_u64(highest_perf << SCHED_CAPACITY_SHIFT, nominal_perf);
+ }
++
+ #else
+-static inline u64 get_max_boost_ratio(unsigned int cpu) { return 0; }
++static inline u64 get_max_boost_ratio(unsigned int cpu, u64 *nominal_freq)
++{
++ return 0;
++}
+ #endif
+
+ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy)
+@@ -681,9 +695,9 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy)
+ struct acpi_cpufreq_data *data;
+ unsigned int cpu = policy->cpu;
+ struct cpuinfo_x86 *c = &cpu_data(cpu);
++ u64 max_boost_ratio, nominal_freq = 0;
+ unsigned int valid_states = 0;
+ unsigned int result = 0;
+- u64 max_boost_ratio;
+ unsigned int i;
+ #ifdef CONFIG_SMP
+ static int blacklisted;
+@@ -833,16 +847,20 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy)
+ }
+ freq_table[valid_states].frequency = CPUFREQ_TABLE_END;
+
+- max_boost_ratio = get_max_boost_ratio(cpu);
++ max_boost_ratio = get_max_boost_ratio(cpu, &nominal_freq);
+ if (max_boost_ratio) {
+- unsigned int freq = freq_table[0].frequency;
++ unsigned int freq = nominal_freq;
+
+ /*
+- * Because the loop above sorts the freq_table entries in the
+- * descending order, freq is the maximum frequency in the table.
+- * Assume that it corresponds to the CPPC nominal frequency and
+- * use it to set cpuinfo.max_freq.
++ * The loop above sorts the freq_table entries in the
++ * descending order. If ACPI CPPC has not advertised
++ * the nominal frequency (this is possible in CPPC
++ * revisions prior to 3), then use the first entry in
++ * the pstate table as a proxy for nominal frequency.
+ */
++ if (!freq)
++ freq = freq_table[0].frequency;
++
+ policy->cpuinfo.max_freq = freq * max_boost_ratio >> SCHED_CAPACITY_SHIFT;
+ } else {
+ /*
+--
+2.39.5
+
--- /dev/null
+From 00c0c7580c4c2d117141cf435ce06ff967fe1f44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2024 17:57:32 -0800
+Subject: cpufreq: schedutil: Fix superfluous updates caused by
+ need_freq_update
+
+From: Sultan Alsawaf (unemployed) <sultan@kerneltoast.com>
+
+[ Upstream commit 8e461a1cb43d69d2fc8a97e61916dce571e6bb31 ]
+
+A redundant frequency update is only truly needed when there is a policy
+limits change with a driver that specifies CPUFREQ_NEED_UPDATE_LIMITS.
+
+In spite of that, drivers specifying CPUFREQ_NEED_UPDATE_LIMITS receive a
+frequency update _all the time_, not just for a policy limits change,
+because need_freq_update is never cleared.
+
+Furthermore, ignore_dl_rate_limit()'s usage of need_freq_update also leads
+to a redundant frequency update, regardless of whether or not the driver
+specifies CPUFREQ_NEED_UPDATE_LIMITS, when the next chosen frequency is the
+same as the current one.
+
+Fix the superfluous updates by only honoring CPUFREQ_NEED_UPDATE_LIMITS
+when there's a policy limits change, and clearing need_freq_update when a
+requisite redundant update occurs.
+
+This is neatly achieved by moving up the CPUFREQ_NEED_UPDATE_LIMITS test
+and instead setting need_freq_update to false in sugov_update_next_freq().
+
+Fixes: 600f5badb78c ("cpufreq: schedutil: Don't skip freq update when limits change")
+Signed-off-by: Sultan Alsawaf (unemployed) <sultan@kerneltoast.com>
+Reviewed-by: Christian Loehle <christian.loehle@arm.com>
+Link: https://patch.msgid.link/20241212015734.41241-2-sultan@kerneltoast.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/cpufreq_schedutil.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
+index 853a07618a3cf..542c0e82a9005 100644
+--- a/kernel/sched/cpufreq_schedutil.c
++++ b/kernel/sched/cpufreq_schedutil.c
+@@ -84,7 +84,7 @@ static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time)
+
+ if (unlikely(sg_policy->limits_changed)) {
+ sg_policy->limits_changed = false;
+- sg_policy->need_freq_update = true;
++ sg_policy->need_freq_update = cpufreq_driver_test_flags(CPUFREQ_NEED_UPDATE_LIMITS);
+ return true;
+ }
+
+@@ -97,7 +97,7 @@ static bool sugov_update_next_freq(struct sugov_policy *sg_policy, u64 time,
+ unsigned int next_freq)
+ {
+ if (sg_policy->need_freq_update)
+- sg_policy->need_freq_update = cpufreq_driver_test_flags(CPUFREQ_NEED_UPDATE_LIMITS);
++ sg_policy->need_freq_update = false;
+ else if (sg_policy->next_freq == next_freq)
+ return false;
+
+--
+2.39.5
+
--- /dev/null
+From 3b0c026a553c4b4ab2548ae952496449fd38cb6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2024 10:14:59 +0800
+Subject: cpupower: fix TSC MHz calculation
+
+From: He Rongguang <herongguang@linux.alibaba.com>
+
+[ Upstream commit 9d6c0e58514f8b57cd9c2c755e41623d6a966025 ]
+
+Commit 'cpupower: Make TSC read per CPU for Mperf monitor' (c2adb1877b7)
+changes TSC counter reads per cpu, but left time diff global (from start
+of all cpus to end of all cpus), thus diff(time) is too large for a
+cpu's tsc counting, resulting in far less than acutal TSC_Mhz and thus
+`cpupower monitor` showing far less than actual cpu realtime frequency.
+
+/proc/cpuinfo shows frequency:
+cat /proc/cpuinfo | egrep -e 'processor' -e 'MHz'
+...
+processor : 171
+cpu MHz : 4108.498
+...
+
+before fix (System 100% busy):
+ | Mperf || Idle_Stats
+ CPU| C0 | Cx | Freq || POLL | C1 | C2
+ 171| 0.77| 99.23| 2279|| 0.00| 0.00| 0.00
+
+after fix (System 100% busy):
+ | Mperf || Idle_Stats
+ CPU| C0 | Cx | Freq || POLL | C1 | C2
+ 171| 0.46| 99.54| 4095|| 0.00| 0.00| 0.00
+
+Fixes: c2adb1877b76 ("cpupower: Make TSC read per CPU for Mperf monitor")
+Signed-off-by: He Rongguang <herongguang@linux.alibaba.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../cpupower/utils/idle_monitor/mperf_monitor.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c b/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c
+index ae6af354a81db..08a399b0be286 100644
+--- a/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c
++++ b/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c
+@@ -33,7 +33,7 @@ static int mperf_get_count_percent(unsigned int self_id, double *percent,
+ unsigned int cpu);
+ static int mperf_get_count_freq(unsigned int id, unsigned long long *count,
+ unsigned int cpu);
+-static struct timespec time_start, time_end;
++static struct timespec *time_start, *time_end;
+
+ static cstate_t mperf_cstates[MPERF_CSTATE_COUNT] = {
+ {
+@@ -174,7 +174,7 @@ static int mperf_get_count_percent(unsigned int id, double *percent,
+ dprint("%s: TSC Ref - mperf_diff: %llu, tsc_diff: %llu\n",
+ mperf_cstates[id].name, mperf_diff, tsc_diff);
+ } else if (max_freq_mode == MAX_FREQ_SYSFS) {
+- timediff = max_frequency * timespec_diff_us(time_start, time_end);
++ timediff = max_frequency * timespec_diff_us(time_start[cpu], time_end[cpu]);
+ *percent = 100.0 * mperf_diff / timediff;
+ dprint("%s: MAXFREQ - mperf_diff: %llu, time_diff: %llu\n",
+ mperf_cstates[id].name, mperf_diff, timediff);
+@@ -207,7 +207,7 @@ static int mperf_get_count_freq(unsigned int id, unsigned long long *count,
+ if (max_freq_mode == MAX_FREQ_TSC_REF) {
+ /* Calculate max_freq from TSC count */
+ tsc_diff = tsc_at_measure_end[cpu] - tsc_at_measure_start[cpu];
+- time_diff = timespec_diff_us(time_start, time_end);
++ time_diff = timespec_diff_us(time_start[cpu], time_end[cpu]);
+ max_frequency = tsc_diff / time_diff;
+ }
+
+@@ -226,9 +226,8 @@ static int mperf_start(void)
+ {
+ int cpu;
+
+- clock_gettime(CLOCK_REALTIME, &time_start);
+-
+ for (cpu = 0; cpu < cpu_count; cpu++) {
++ clock_gettime(CLOCK_REALTIME, &time_start[cpu]);
+ mperf_get_tsc(&tsc_at_measure_start[cpu]);
+ mperf_init_stats(cpu);
+ }
+@@ -243,9 +242,9 @@ static int mperf_stop(void)
+ for (cpu = 0; cpu < cpu_count; cpu++) {
+ mperf_measure_stats(cpu);
+ mperf_get_tsc(&tsc_at_measure_end[cpu]);
++ clock_gettime(CLOCK_REALTIME, &time_end[cpu]);
+ }
+
+- clock_gettime(CLOCK_REALTIME, &time_end);
+ return 0;
+ }
+
+@@ -349,6 +348,8 @@ struct cpuidle_monitor *mperf_register(void)
+ aperf_current_count = calloc(cpu_count, sizeof(unsigned long long));
+ tsc_at_measure_start = calloc(cpu_count, sizeof(unsigned long long));
+ tsc_at_measure_end = calloc(cpu_count, sizeof(unsigned long long));
++ time_start = calloc(cpu_count, sizeof(struct timespec));
++ time_end = calloc(cpu_count, sizeof(struct timespec));
+ mperf_monitor.name_len = strlen(mperf_monitor.name);
+ return &mperf_monitor;
+ }
+@@ -361,6 +362,8 @@ void mperf_unregister(void)
+ free(aperf_current_count);
+ free(tsc_at_measure_start);
+ free(tsc_at_measure_end);
++ free(time_start);
++ free(time_end);
+ free(is_valid);
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 02c3db28cc4e25ef942362ff42c0a6765dd2a8ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2024 17:13:34 +0800
+Subject: crypto: hisilicon/sec2 - fix for aead icv error
+
+From: Wenkai Lin <linwenkai6@hisilicon.com>
+
+[ Upstream commit fd337f852b2677b53d0859a47b58e6e6bd189f30 ]
+
+When the AEAD algorithm is used for encryption or decryption,
+the input authentication length varies, the hardware needs to
+obtain the input length to pass the integrity check verification.
+Currently, the driver uses a fixed authentication length,which
+causes decryption failure, so the length configuration is modified.
+In addition, the step of setting the auth length is unnecessary,
+so it was deleted from the setkey function.
+
+Fixes: 2f072d75d1ab ("crypto: hisilicon - Add aead support on SEC2")
+Signed-off-by: Wenkai Lin <linwenkai6@hisilicon.com>
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/sec2/sec.h | 1 -
+ drivers/crypto/hisilicon/sec2/sec_crypto.c | 101 +++++++++------------
+ drivers/crypto/hisilicon/sec2/sec_crypto.h | 11 ---
+ 3 files changed, 44 insertions(+), 69 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/sec2/sec.h b/drivers/crypto/hisilicon/sec2/sec.h
+index 410c83712e285..714bfd7c28752 100644
+--- a/drivers/crypto/hisilicon/sec2/sec.h
++++ b/drivers/crypto/hisilicon/sec2/sec.h
+@@ -90,7 +90,6 @@ struct sec_auth_ctx {
+ dma_addr_t a_key_dma;
+ u8 *a_key;
+ u8 a_key_len;
+- u8 mac_len;
+ u8 a_alg;
+ bool fallback;
+ struct crypto_shash *hash_tfm;
+diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c
+index 3bfc183a7ec4c..2d77b89bedb52 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_crypto.c
++++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c
+@@ -954,15 +954,14 @@ static int sec_aead_mac_init(struct sec_aead_req *req)
+ struct aead_request *aead_req = req->aead_req;
+ struct crypto_aead *tfm = crypto_aead_reqtfm(aead_req);
+ size_t authsize = crypto_aead_authsize(tfm);
+- u8 *mac_out = req->out_mac;
+ struct scatterlist *sgl = aead_req->src;
++ u8 *mac_out = req->out_mac;
+ size_t copy_size;
+ off_t skip_size;
+
+ /* Copy input mac */
+ skip_size = aead_req->assoclen + aead_req->cryptlen - authsize;
+- copy_size = sg_pcopy_to_buffer(sgl, sg_nents(sgl), mac_out,
+- authsize, skip_size);
++ copy_size = sg_pcopy_to_buffer(sgl, sg_nents(sgl), mac_out, authsize, skip_size);
+ if (unlikely(copy_size != authsize))
+ return -EINVAL;
+
+@@ -1144,7 +1143,6 @@ static int sec_aead_fallback_setkey(struct sec_auth_ctx *a_ctx,
+ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key,
+ const u32 keylen, const enum sec_hash_alg a_alg,
+ const enum sec_calg c_alg,
+- const enum sec_mac_len mac_len,
+ const enum sec_cmode c_mode)
+ {
+ struct sec_ctx *ctx = crypto_aead_ctx(tfm);
+@@ -1156,7 +1154,6 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key,
+
+ ctx->a_ctx.a_alg = a_alg;
+ ctx->c_ctx.c_alg = c_alg;
+- ctx->a_ctx.mac_len = mac_len;
+ c_ctx->c_mode = c_mode;
+
+ if (c_mode == SEC_CMODE_CCM || c_mode == SEC_CMODE_GCM) {
+@@ -1192,10 +1189,9 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key,
+ goto bad_key;
+ }
+
+- if ((ctx->a_ctx.mac_len & SEC_SQE_LEN_RATE_MASK) ||
+- (ctx->a_ctx.a_key_len & SEC_SQE_LEN_RATE_MASK)) {
++ if (ctx->a_ctx.a_key_len & SEC_SQE_LEN_RATE_MASK) {
+ ret = -EINVAL;
+- dev_err(dev, "MAC or AUTH key length error!\n");
++ dev_err(dev, "AUTH key length error!\n");
+ goto bad_key;
+ }
+
+@@ -1207,27 +1203,19 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key,
+ }
+
+
+-#define GEN_SEC_AEAD_SETKEY_FUNC(name, aalg, calg, maclen, cmode) \
+-static int sec_setkey_##name(struct crypto_aead *tfm, const u8 *key, \
+- u32 keylen) \
+-{ \
+- return sec_aead_setkey(tfm, key, keylen, aalg, calg, maclen, cmode);\
+-}
+-
+-GEN_SEC_AEAD_SETKEY_FUNC(aes_cbc_sha1, SEC_A_HMAC_SHA1,
+- SEC_CALG_AES, SEC_HMAC_SHA1_MAC, SEC_CMODE_CBC)
+-GEN_SEC_AEAD_SETKEY_FUNC(aes_cbc_sha256, SEC_A_HMAC_SHA256,
+- SEC_CALG_AES, SEC_HMAC_SHA256_MAC, SEC_CMODE_CBC)
+-GEN_SEC_AEAD_SETKEY_FUNC(aes_cbc_sha512, SEC_A_HMAC_SHA512,
+- SEC_CALG_AES, SEC_HMAC_SHA512_MAC, SEC_CMODE_CBC)
+-GEN_SEC_AEAD_SETKEY_FUNC(aes_ccm, 0, SEC_CALG_AES,
+- SEC_HMAC_CCM_MAC, SEC_CMODE_CCM)
+-GEN_SEC_AEAD_SETKEY_FUNC(aes_gcm, 0, SEC_CALG_AES,
+- SEC_HMAC_GCM_MAC, SEC_CMODE_GCM)
+-GEN_SEC_AEAD_SETKEY_FUNC(sm4_ccm, 0, SEC_CALG_SM4,
+- SEC_HMAC_CCM_MAC, SEC_CMODE_CCM)
+-GEN_SEC_AEAD_SETKEY_FUNC(sm4_gcm, 0, SEC_CALG_SM4,
+- SEC_HMAC_GCM_MAC, SEC_CMODE_GCM)
++#define GEN_SEC_AEAD_SETKEY_FUNC(name, aalg, calg, cmode) \
++static int sec_setkey_##name(struct crypto_aead *tfm, const u8 *key, u32 keylen) \
++{ \
++ return sec_aead_setkey(tfm, key, keylen, aalg, calg, cmode); \
++}
++
++GEN_SEC_AEAD_SETKEY_FUNC(aes_cbc_sha1, SEC_A_HMAC_SHA1, SEC_CALG_AES, SEC_CMODE_CBC)
++GEN_SEC_AEAD_SETKEY_FUNC(aes_cbc_sha256, SEC_A_HMAC_SHA256, SEC_CALG_AES, SEC_CMODE_CBC)
++GEN_SEC_AEAD_SETKEY_FUNC(aes_cbc_sha512, SEC_A_HMAC_SHA512, SEC_CALG_AES, SEC_CMODE_CBC)
++GEN_SEC_AEAD_SETKEY_FUNC(aes_ccm, 0, SEC_CALG_AES, SEC_CMODE_CCM)
++GEN_SEC_AEAD_SETKEY_FUNC(aes_gcm, 0, SEC_CALG_AES, SEC_CMODE_GCM)
++GEN_SEC_AEAD_SETKEY_FUNC(sm4_ccm, 0, SEC_CALG_SM4, SEC_CMODE_CCM)
++GEN_SEC_AEAD_SETKEY_FUNC(sm4_gcm, 0, SEC_CALG_SM4, SEC_CMODE_GCM)
+
+ static int sec_aead_sgl_map(struct sec_ctx *ctx, struct sec_req *req)
+ {
+@@ -1476,9 +1464,10 @@ static void sec_skcipher_callback(struct sec_ctx *ctx, struct sec_req *req,
+ static void set_aead_auth_iv(struct sec_ctx *ctx, struct sec_req *req)
+ {
+ struct aead_request *aead_req = req->aead_req.aead_req;
+- struct sec_cipher_req *c_req = &req->c_req;
++ struct crypto_aead *tfm = crypto_aead_reqtfm(aead_req);
++ size_t authsize = crypto_aead_authsize(tfm);
+ struct sec_aead_req *a_req = &req->aead_req;
+- size_t authsize = ctx->a_ctx.mac_len;
++ struct sec_cipher_req *c_req = &req->c_req;
+ u32 data_size = aead_req->cryptlen;
+ u8 flage = 0;
+ u8 cm, cl;
+@@ -1519,10 +1508,8 @@ static void set_aead_auth_iv(struct sec_ctx *ctx, struct sec_req *req)
+ static void sec_aead_set_iv(struct sec_ctx *ctx, struct sec_req *req)
+ {
+ struct aead_request *aead_req = req->aead_req.aead_req;
+- struct crypto_aead *tfm = crypto_aead_reqtfm(aead_req);
+- size_t authsize = crypto_aead_authsize(tfm);
+- struct sec_cipher_req *c_req = &req->c_req;
+ struct sec_aead_req *a_req = &req->aead_req;
++ struct sec_cipher_req *c_req = &req->c_req;
+
+ memcpy(c_req->c_ivin, aead_req->iv, ctx->c_ctx.ivsize);
+
+@@ -1530,15 +1517,11 @@ static void sec_aead_set_iv(struct sec_ctx *ctx, struct sec_req *req)
+ /*
+ * CCM 16Byte Cipher_IV: {1B_Flage,13B_IV,2B_counter},
+ * the counter must set to 0x01
++ * CCM 16Byte Auth_IV: {1B_AFlage,13B_IV,2B_Ptext_length}
+ */
+- ctx->a_ctx.mac_len = authsize;
+- /* CCM 16Byte Auth_IV: {1B_AFlage,13B_IV,2B_Ptext_length} */
+ set_aead_auth_iv(ctx, req);
+- }
+-
+- /* GCM 12Byte Cipher_IV == Auth_IV */
+- if (ctx->c_ctx.c_mode == SEC_CMODE_GCM) {
+- ctx->a_ctx.mac_len = authsize;
++ } else if (ctx->c_ctx.c_mode == SEC_CMODE_GCM) {
++ /* GCM 12Byte Cipher_IV == Auth_IV */
+ memcpy(a_req->a_ivin, c_req->c_ivin, SEC_AIV_SIZE);
+ }
+ }
+@@ -1548,9 +1531,11 @@ static void sec_auth_bd_fill_xcm(struct sec_auth_ctx *ctx, int dir,
+ {
+ struct sec_aead_req *a_req = &req->aead_req;
+ struct aead_request *aq = a_req->aead_req;
++ struct crypto_aead *tfm = crypto_aead_reqtfm(aq);
++ size_t authsize = crypto_aead_authsize(tfm);
+
+ /* C_ICV_Len is MAC size, 0x4 ~ 0x10 */
+- sec_sqe->type2.icvw_kmode |= cpu_to_le16((u16)ctx->mac_len);
++ sec_sqe->type2.icvw_kmode |= cpu_to_le16((u16)authsize);
+
+ /* mode set to CCM/GCM, don't set {A_Alg, AKey_Len, MAC_Len} */
+ sec_sqe->type2.a_key_addr = sec_sqe->type2.c_key_addr;
+@@ -1574,9 +1559,11 @@ static void sec_auth_bd_fill_xcm_v3(struct sec_auth_ctx *ctx, int dir,
+ {
+ struct sec_aead_req *a_req = &req->aead_req;
+ struct aead_request *aq = a_req->aead_req;
++ struct crypto_aead *tfm = crypto_aead_reqtfm(aq);
++ size_t authsize = crypto_aead_authsize(tfm);
+
+ /* C_ICV_Len is MAC size, 0x4 ~ 0x10 */
+- sqe3->c_icv_key |= cpu_to_le16((u16)ctx->mac_len << SEC_MAC_OFFSET_V3);
++ sqe3->c_icv_key |= cpu_to_le16((u16)authsize << SEC_MAC_OFFSET_V3);
+
+ /* mode set to CCM/GCM, don't set {A_Alg, AKey_Len, MAC_Len} */
+ sqe3->a_key_addr = sqe3->c_key_addr;
+@@ -1600,11 +1587,12 @@ static void sec_auth_bd_fill_ex(struct sec_auth_ctx *ctx, int dir,
+ struct sec_aead_req *a_req = &req->aead_req;
+ struct sec_cipher_req *c_req = &req->c_req;
+ struct aead_request *aq = a_req->aead_req;
++ struct crypto_aead *tfm = crypto_aead_reqtfm(aq);
++ size_t authsize = crypto_aead_authsize(tfm);
+
+ sec_sqe->type2.a_key_addr = cpu_to_le64(ctx->a_key_dma);
+
+- sec_sqe->type2.mac_key_alg =
+- cpu_to_le32(ctx->mac_len / SEC_SQE_LEN_RATE);
++ sec_sqe->type2.mac_key_alg = cpu_to_le32(authsize / SEC_SQE_LEN_RATE);
+
+ sec_sqe->type2.mac_key_alg |=
+ cpu_to_le32((u32)((ctx->a_key_len) /
+@@ -1654,11 +1642,13 @@ static void sec_auth_bd_fill_ex_v3(struct sec_auth_ctx *ctx, int dir,
+ struct sec_aead_req *a_req = &req->aead_req;
+ struct sec_cipher_req *c_req = &req->c_req;
+ struct aead_request *aq = a_req->aead_req;
++ struct crypto_aead *tfm = crypto_aead_reqtfm(aq);
++ size_t authsize = crypto_aead_authsize(tfm);
+
+ sqe3->a_key_addr = cpu_to_le64(ctx->a_key_dma);
+
+ sqe3->auth_mac_key |=
+- cpu_to_le32((u32)(ctx->mac_len /
++ cpu_to_le32((u32)(authsize /
+ SEC_SQE_LEN_RATE) << SEC_MAC_OFFSET_V3);
+
+ sqe3->auth_mac_key |=
+@@ -1709,9 +1699,9 @@ static void sec_aead_callback(struct sec_ctx *c, struct sec_req *req, int err)
+ {
+ struct aead_request *a_req = req->aead_req.aead_req;
+ struct crypto_aead *tfm = crypto_aead_reqtfm(a_req);
++ size_t authsize = crypto_aead_authsize(tfm);
+ struct sec_aead_req *aead_req = &req->aead_req;
+ struct sec_cipher_req *c_req = &req->c_req;
+- size_t authsize = crypto_aead_authsize(tfm);
+ struct sec_qp_ctx *qp_ctx = req->qp_ctx;
+ struct aead_request *backlog_aead_req;
+ struct sec_req *backlog_req;
+@@ -1724,10 +1714,8 @@ static void sec_aead_callback(struct sec_ctx *c, struct sec_req *req, int err)
+ if (!err && c_req->encrypt) {
+ struct scatterlist *sgl = a_req->dst;
+
+- sz = sg_pcopy_from_buffer(sgl, sg_nents(sgl),
+- aead_req->out_mac,
+- authsize, a_req->cryptlen +
+- a_req->assoclen);
++ sz = sg_pcopy_from_buffer(sgl, sg_nents(sgl), aead_req->out_mac,
++ authsize, a_req->cryptlen + a_req->assoclen);
+ if (unlikely(sz != authsize)) {
+ dev_err(c->dev, "copy out mac err!\n");
+ err = -EINVAL;
+@@ -2267,7 +2255,7 @@ static int sec_aead_spec_check(struct sec_ctx *ctx, struct sec_req *sreq)
+ {
+ struct aead_request *req = sreq->aead_req.aead_req;
+ struct crypto_aead *tfm = crypto_aead_reqtfm(req);
+- size_t authsize = crypto_aead_authsize(tfm);
++ size_t sz = crypto_aead_authsize(tfm);
+ u8 c_mode = ctx->c_ctx.c_mode;
+ struct device *dev = ctx->dev;
+ int ret;
+@@ -2278,9 +2266,8 @@ static int sec_aead_spec_check(struct sec_ctx *ctx, struct sec_req *sreq)
+ return -EINVAL;
+ }
+
+- if (unlikely((c_mode == SEC_CMODE_GCM && authsize < DES_BLOCK_SIZE) ||
+- (c_mode == SEC_CMODE_CCM && (authsize < MIN_MAC_LEN ||
+- authsize & MAC_LEN_MASK)))) {
++ if (unlikely((c_mode == SEC_CMODE_GCM && sz < DES_BLOCK_SIZE) ||
++ (c_mode == SEC_CMODE_CCM && (sz < MIN_MAC_LEN || sz & MAC_LEN_MASK)))) {
+ dev_err(dev, "aead input mac length error!\n");
+ return -EINVAL;
+ }
+@@ -2300,7 +2287,7 @@ static int sec_aead_spec_check(struct sec_ctx *ctx, struct sec_req *sreq)
+ if (sreq->c_req.encrypt)
+ sreq->c_req.c_len = req->cryptlen;
+ else
+- sreq->c_req.c_len = req->cryptlen - authsize;
++ sreq->c_req.c_len = req->cryptlen - sz;
+ if (c_mode == SEC_CMODE_CBC) {
+ if (unlikely(sreq->c_req.c_len & (AES_BLOCK_SIZE - 1))) {
+ dev_err(dev, "aead crypto length error!\n");
+@@ -2326,7 +2313,7 @@ static int sec_aead_param_check(struct sec_ctx *ctx, struct sec_req *sreq)
+
+ if (ctx->sec->qm.ver == QM_HW_V2) {
+ if (unlikely(!req->cryptlen || (!sreq->c_req.encrypt &&
+- req->cryptlen <= authsize))) {
++ req->cryptlen <= authsize))) {
+ ctx->a_ctx.fallback = true;
+ return -EINVAL;
+ }
+diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.h b/drivers/crypto/hisilicon/sec2/sec_crypto.h
+index d033f63b583f8..db3fceb88e693 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_crypto.h
++++ b/drivers/crypto/hisilicon/sec2/sec_crypto.h
+@@ -23,17 +23,6 @@ enum sec_hash_alg {
+ SEC_A_HMAC_SHA512 = 0x15,
+ };
+
+-enum sec_mac_len {
+- SEC_HMAC_CCM_MAC = 16,
+- SEC_HMAC_GCM_MAC = 16,
+- SEC_SM3_MAC = 32,
+- SEC_HMAC_SM3_MAC = 32,
+- SEC_HMAC_MD5_MAC = 16,
+- SEC_HMAC_SHA1_MAC = 20,
+- SEC_HMAC_SHA256_MAC = 32,
+- SEC_HMAC_SHA512_MAC = 64,
+-};
+-
+ enum sec_cmode {
+ SEC_CMODE_ECB = 0x0,
+ SEC_CMODE_CBC = 0x1,
+--
+2.39.5
+
--- /dev/null
+From 5d8b4b2fbd3588e3fe6ae3c591a8a49d8ffe3aee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2024 17:13:35 +0800
+Subject: crypto: hisilicon/sec2 - fix for aead invalid authsize
+
+From: Wenkai Lin <linwenkai6@hisilicon.com>
+
+[ Upstream commit a5a9d959936499a3106a1bf3b9070875d0d3dec4 ]
+
+When the digest alg is HMAC-SHAx or another, the authsize may be less
+than 4 bytes and mac_len of the BD is set to zero, the hardware considers
+it a BD configuration error and reports a ras error, so the sec driver
+needs to switch to software calculation in this case, this patch add a
+check for it and remove unnecessary check that has been done by crypto.
+
+Fixes: 2f072d75d1ab ("crypto: hisilicon - Add aead support on SEC2")
+Signed-off-by: Wenkai Lin <linwenkai6@hisilicon.com>
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/sec2/sec.h | 2 +-
+ drivers/crypto/hisilicon/sec2/sec_crypto.c | 64 +++++++++++-----------
+ 2 files changed, 34 insertions(+), 32 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/sec2/sec.h b/drivers/crypto/hisilicon/sec2/sec.h
+index 714bfd7c28752..30c2b1a64695c 100644
+--- a/drivers/crypto/hisilicon/sec2/sec.h
++++ b/drivers/crypto/hisilicon/sec2/sec.h
+@@ -37,6 +37,7 @@ struct sec_aead_req {
+ u8 *a_ivin;
+ dma_addr_t a_ivin_dma;
+ struct aead_request *aead_req;
++ bool fallback;
+ };
+
+ /* SEC request of Crypto */
+@@ -91,7 +92,6 @@ struct sec_auth_ctx {
+ u8 *a_key;
+ u8 a_key_len;
+ u8 a_alg;
+- bool fallback;
+ struct crypto_shash *hash_tfm;
+ struct crypto_aead *fallback_aead_tfm;
+ };
+diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c
+index 2d77b89bedb52..55b95968ecb70 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_crypto.c
++++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c
+@@ -1124,10 +1124,7 @@ static int sec_aead_setauthsize(struct crypto_aead *aead, unsigned int authsize)
+ struct sec_ctx *ctx = crypto_tfm_ctx(tfm);
+ struct sec_auth_ctx *a_ctx = &ctx->a_ctx;
+
+- if (unlikely(a_ctx->fallback_aead_tfm))
+- return crypto_aead_setauthsize(a_ctx->fallback_aead_tfm, authsize);
+-
+- return 0;
++ return crypto_aead_setauthsize(a_ctx->fallback_aead_tfm, authsize);
+ }
+
+ static int sec_aead_fallback_setkey(struct sec_auth_ctx *a_ctx,
+@@ -1164,13 +1161,7 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key,
+ }
+ memcpy(c_ctx->c_key, key, keylen);
+
+- if (unlikely(a_ctx->fallback_aead_tfm)) {
+- ret = sec_aead_fallback_setkey(a_ctx, tfm, key, keylen);
+- if (ret)
+- return ret;
+- }
+-
+- return 0;
++ return sec_aead_fallback_setkey(a_ctx, tfm, key, keylen);
+ }
+
+ ret = crypto_authenc_extractkeys(&keys, key, keylen);
+@@ -1195,6 +1186,12 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key,
+ goto bad_key;
+ }
+
++ ret = sec_aead_fallback_setkey(a_ctx, tfm, key, keylen);
++ if (ret) {
++ dev_err(dev, "set sec fallback key err!\n");
++ goto bad_key;
++ }
++
+ return 0;
+
+ bad_key:
+@@ -1924,8 +1921,10 @@ static void sec_aead_exit(struct crypto_aead *tfm)
+
+ static int sec_aead_ctx_init(struct crypto_aead *tfm, const char *hash_name)
+ {
++ struct aead_alg *alg = crypto_aead_alg(tfm);
+ struct sec_ctx *ctx = crypto_aead_ctx(tfm);
+- struct sec_auth_ctx *auth_ctx = &ctx->a_ctx;
++ struct sec_auth_ctx *a_ctx = &ctx->a_ctx;
++ const char *aead_name = alg->base.cra_name;
+ int ret;
+
+ ret = sec_aead_init(tfm);
+@@ -1934,11 +1933,20 @@ static int sec_aead_ctx_init(struct crypto_aead *tfm, const char *hash_name)
+ return ret;
+ }
+
+- auth_ctx->hash_tfm = crypto_alloc_shash(hash_name, 0, 0);
+- if (IS_ERR(auth_ctx->hash_tfm)) {
++ a_ctx->hash_tfm = crypto_alloc_shash(hash_name, 0, 0);
++ if (IS_ERR(a_ctx->hash_tfm)) {
+ dev_err(ctx->dev, "aead alloc shash error!\n");
+ sec_aead_exit(tfm);
+- return PTR_ERR(auth_ctx->hash_tfm);
++ return PTR_ERR(a_ctx->hash_tfm);
++ }
++
++ a_ctx->fallback_aead_tfm = crypto_alloc_aead(aead_name, 0,
++ CRYPTO_ALG_NEED_FALLBACK | CRYPTO_ALG_ASYNC);
++ if (IS_ERR(a_ctx->fallback_aead_tfm)) {
++ dev_err(ctx->dev, "aead driver alloc fallback tfm error!\n");
++ crypto_free_shash(ctx->a_ctx.hash_tfm);
++ sec_aead_exit(tfm);
++ return PTR_ERR(a_ctx->fallback_aead_tfm);
+ }
+
+ return 0;
+@@ -1948,6 +1956,7 @@ static void sec_aead_ctx_exit(struct crypto_aead *tfm)
+ {
+ struct sec_ctx *ctx = crypto_aead_ctx(tfm);
+
++ crypto_free_aead(ctx->a_ctx.fallback_aead_tfm);
+ crypto_free_shash(ctx->a_ctx.hash_tfm);
+ sec_aead_exit(tfm);
+ }
+@@ -1974,7 +1983,6 @@ static int sec_aead_xcm_ctx_init(struct crypto_aead *tfm)
+ sec_aead_exit(tfm);
+ return PTR_ERR(a_ctx->fallback_aead_tfm);
+ }
+- a_ctx->fallback = false;
+
+ return 0;
+ }
+@@ -2260,15 +2268,15 @@ static int sec_aead_spec_check(struct sec_ctx *ctx, struct sec_req *sreq)
+ struct device *dev = ctx->dev;
+ int ret;
+
+- if (unlikely(req->cryptlen + req->assoclen > MAX_INPUT_DATA_LEN ||
+- req->assoclen > SEC_MAX_AAD_LEN)) {
+- dev_err(dev, "aead input spec error!\n");
++ /* Hardware does not handle cases where authsize is less than 4 bytes */
++ if (unlikely(sz < MIN_MAC_LEN)) {
++ sreq->aead_req.fallback = true;
+ return -EINVAL;
+ }
+
+- if (unlikely((c_mode == SEC_CMODE_GCM && sz < DES_BLOCK_SIZE) ||
+- (c_mode == SEC_CMODE_CCM && (sz < MIN_MAC_LEN || sz & MAC_LEN_MASK)))) {
+- dev_err(dev, "aead input mac length error!\n");
++ if (unlikely(req->cryptlen + req->assoclen > MAX_INPUT_DATA_LEN ||
++ req->assoclen > SEC_MAX_AAD_LEN)) {
++ dev_err(dev, "aead input spec error!\n");
+ return -EINVAL;
+ }
+
+@@ -2314,7 +2322,7 @@ static int sec_aead_param_check(struct sec_ctx *ctx, struct sec_req *sreq)
+ if (ctx->sec->qm.ver == QM_HW_V2) {
+ if (unlikely(!req->cryptlen || (!sreq->c_req.encrypt &&
+ req->cryptlen <= authsize))) {
+- ctx->a_ctx.fallback = true;
++ sreq->aead_req.fallback = true;
+ return -EINVAL;
+ }
+ }
+@@ -2342,16 +2350,9 @@ static int sec_aead_soft_crypto(struct sec_ctx *ctx,
+ bool encrypt)
+ {
+ struct sec_auth_ctx *a_ctx = &ctx->a_ctx;
+- struct device *dev = ctx->dev;
+ struct aead_request *subreq;
+ int ret;
+
+- /* Kunpeng920 aead mode not support input 0 size */
+- if (!a_ctx->fallback_aead_tfm) {
+- dev_err(dev, "aead fallback tfm is NULL!\n");
+- return -EINVAL;
+- }
+-
+ subreq = aead_request_alloc(a_ctx->fallback_aead_tfm, GFP_KERNEL);
+ if (!subreq)
+ return -ENOMEM;
+@@ -2383,10 +2384,11 @@ static int sec_aead_crypto(struct aead_request *a_req, bool encrypt)
+ req->aead_req.aead_req = a_req;
+ req->c_req.encrypt = encrypt;
+ req->ctx = ctx;
++ req->aead_req.fallback = false;
+
+ ret = sec_aead_param_check(ctx, req);
+ if (unlikely(ret)) {
+- if (ctx->a_ctx.fallback)
++ if (req->aead_req.fallback)
+ return sec_aead_soft_crypto(ctx, a_req, encrypt);
+ return -EINVAL;
+ }
+--
+2.39.5
+
--- /dev/null
+From b82e3a7872133185e604a9178e5f3846e161c0c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Dec 2023 15:01:35 +0800
+Subject: crypto: hisilicon/sec2 - optimize the error return process
+
+From: Chenghai Huang <huangchenghai2@huawei.com>
+
+[ Upstream commit 1bed82257b1881b689ee41f14ecb4c20a273cac0 ]
+
+Add the printf of an error message and optimized the handling
+process of ret.
+
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: fd337f852b26 ("crypto: hisilicon/sec2 - fix for aead icv error")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/sec2/sec_crypto.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c
+index 09a20307d01e3..3bfc183a7ec4c 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_crypto.c
++++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c
+@@ -850,6 +850,7 @@ static int sec_skcipher_setkey(struct crypto_skcipher *tfm, const u8 *key,
+ ret = sec_skcipher_aes_sm4_setkey(c_ctx, keylen, c_mode);
+ break;
+ default:
++ dev_err(dev, "sec c_alg err!\n");
+ return -EINVAL;
+ }
+
+@@ -1175,7 +1176,8 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key,
+ return 0;
+ }
+
+- if (crypto_authenc_extractkeys(&keys, key, keylen))
++ ret = crypto_authenc_extractkeys(&keys, key, keylen);
++ if (ret)
+ goto bad_key;
+
+ ret = sec_aead_aes_set_key(c_ctx, &keys);
+@@ -1192,6 +1194,7 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key,
+
+ if ((ctx->a_ctx.mac_len & SEC_SQE_LEN_RATE_MASK) ||
+ (ctx->a_ctx.a_key_len & SEC_SQE_LEN_RATE_MASK)) {
++ ret = -EINVAL;
+ dev_err(dev, "MAC or AUTH key length error!\n");
+ goto bad_key;
+ }
+@@ -1200,7 +1203,7 @@ static int sec_aead_setkey(struct crypto_aead *tfm, const u8 *key,
+
+ bad_key:
+ memzero_explicit(&keys, sizeof(struct crypto_authenc_keys));
+- return -EINVAL;
++ return ret;
+ }
+
+
+--
+2.39.5
+
--- /dev/null
+From 00a057314e034aa84cc46504f0d23267dcccecea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2024 16:27:20 +0900
+Subject: crypto: ixp4xx - fix OF node reference leaks in init_ixp_crypto()
+
+From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+
+[ Upstream commit 472a989029aac2b78ef2f0b18b27c568bf76d104 ]
+
+init_ixp_crypto() calls of_parse_phandle_with_fixed_args() multiple
+times, but does not release all the obtained refcounts. Fix it by adding
+of_node_put() calls.
+
+This bug was found by an experimental static analysis tool that I am
+developing.
+
+Fixes: 76f24b4f46b8 ("crypto: ixp4xx - Add device tree support")
+Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ixp4xx_crypto.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
+index d39a386b31ac7..cfb149302e0a9 100644
+--- a/drivers/crypto/ixp4xx_crypto.c
++++ b/drivers/crypto/ixp4xx_crypto.c
+@@ -469,6 +469,7 @@ static int init_ixp_crypto(struct device *dev)
+ return -ENODEV;
+ }
+ npe_id = npe_spec.args[0];
++ of_node_put(npe_spec.np);
+
+ ret = of_parse_phandle_with_fixed_args(np, "queue-rx", 1, 0,
+ &queue_spec);
+@@ -477,6 +478,7 @@ static int init_ixp_crypto(struct device *dev)
+ return -ENODEV;
+ }
+ recv_qid = queue_spec.args[0];
++ of_node_put(queue_spec.np);
+
+ ret = of_parse_phandle_with_fixed_args(np, "queue-txready", 1, 0,
+ &queue_spec);
+@@ -485,6 +487,7 @@ static int init_ixp_crypto(struct device *dev)
+ return -ENODEV;
+ }
+ send_qid = queue_spec.args[0];
++ of_node_put(queue_spec.np);
+ } else {
+ /*
+ * Hardcoded engine when using platform data, this goes away
+--
+2.39.5
+
--- /dev/null
+From 18d719c275f12bf31a1a6bf4d16ba56c586bccbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2024 11:05:07 +0900
+Subject: dmaengine: ti: edma: fix OF node reference leaks in edma_driver
+
+From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+
+[ Upstream commit e883c64778e5a9905fce955681f8ee38c7197e0f ]
+
+The .probe() of edma_driver calls of_parse_phandle_with_fixed_args() but
+does not release the obtained OF nodes. Thus add a of_node_put() call.
+
+This bug was found by an experimental verification tool that I am
+developing.
+
+Fixes: 1be5336bc7ba ("dmaengine: edma: New device tree binding")
+Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/20241219020507.1983124-3-joe@pf.is.s.u-tokyo.ac.jp
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/ti/edma.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
+index 9212ac9f978f2..89e06c87a258b 100644
+--- a/drivers/dma/ti/edma.c
++++ b/drivers/dma/ti/edma.c
+@@ -209,7 +209,6 @@ struct edma_desc {
+ struct edma_cc;
+
+ struct edma_tc {
+- struct device_node *node;
+ u16 id;
+ };
+
+@@ -2475,13 +2474,13 @@ static int edma_probe(struct platform_device *pdev)
+ if (ret || i == ecc->num_tc)
+ break;
+
+- ecc->tc_list[i].node = tc_args.np;
+ ecc->tc_list[i].id = i;
+ queue_priority_mapping[i][1] = tc_args.args[0];
+ if (queue_priority_mapping[i][1] > lowest_priority) {
+ lowest_priority = queue_priority_mapping[i][1];
+ info->default_queue = i;
+ }
++ of_node_put(tc_args.np);
+ }
+
+ /* See if we have optional dma-channel-mask array */
+--
+2.39.5
+
--- /dev/null
+From b194489fd206dd6c89b30a5ba68eebc6b22f3e13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Dec 2024 11:00:43 +0300
+Subject: drm/amdgpu: Fix potential NULL pointer dereference in
+ atomctrl_get_smc_sclk_range_table
+
+From: Ivan Stepchenko <sid@itb.spb.ru>
+
+[ Upstream commit 357445e28ff004d7f10967aa93ddb4bffa5c3688 ]
+
+The function atomctrl_get_smc_sclk_range_table() does not check the return
+value of smu_atom_get_data_table(). If smu_atom_get_data_table() fails to
+retrieve SMU_Info table, it returns NULL which is later dereferenced.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+In practice this should never happen as this code only gets called
+on polaris chips and the vbios data table will always be present on
+those chips.
+
+Fixes: a23eefa2f461 ("drm/amd/powerplay: enable dpm for baffin.")
+Signed-off-by: Ivan Stepchenko <sid@itb.spb.ru>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c
+index cc3b62f733941..1fbd23922082a 100644
+--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c
++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c
+@@ -1420,6 +1420,8 @@ int atomctrl_get_smc_sclk_range_table(struct pp_hwmgr *hwmgr, struct pp_atom_ctr
+ GetIndexIntoMasterTable(DATA, SMU_Info),
+ &size, &frev, &crev);
+
++ if (!psmu_info)
++ return -EINVAL;
+
+ for (i = 0; i < psmu_info->ucSclkEntryNum; i++) {
+ table->entry[i].ucVco_setting = psmu_info->asSclkFcwRangeEntry[i].ucVco_setting;
+--
+2.39.5
+
--- /dev/null
+From 3c6fb5362883d2bafd1dadd200db05ef2dfbe7e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Dec 2024 18:51:19 +0800
+Subject: drm/bridge: it6505: Change definition of AUX_FIFO_MAX_SIZE
+
+From: Hermes Wu <hermes.wu@ite.com.tw>
+
+[ Upstream commit c14870218c14532b0f0a7805b96a4d3c92d06fb2 ]
+
+The hardware AUX FIFO is 16 bytes
+Change definition of AUX_FIFO_MAX_SIZE to 16
+
+Fixes: b5c84a9edcd4 ("drm/bridge: add it6505 driver")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Hermes Wu <hermes.wu@ite.com.tw>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241230-v7-upstream-v7-1-e0fdd4844703@ite.corp-partner.google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/ite-it6505.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/ite-it6505.c b/drivers/gpu/drm/bridge/ite-it6505.c
+index 5a23277be4445..45596b211fb88 100644
+--- a/drivers/gpu/drm/bridge/ite-it6505.c
++++ b/drivers/gpu/drm/bridge/ite-it6505.c
+@@ -300,7 +300,7 @@
+ #define MAX_CR_LEVEL 0x03
+ #define MAX_EQ_LEVEL 0x03
+ #define AUX_WAIT_TIMEOUT_MS 15
+-#define AUX_FIFO_MAX_SIZE 32
++#define AUX_FIFO_MAX_SIZE 16
+ #define PIXEL_CLK_DELAY 1
+ #define PIXEL_CLK_INVERSE 0
+ #define ADJUST_PHASE_THRESHOLD 80000
+--
+2.39.5
+
--- /dev/null
+From 31e88acb9341f11a3e1b4c4162c1c3afb604a65d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Oct 2023 15:03:12 +0800
+Subject: drm/etnaviv: Drop the 'len' parameter of etnaviv_iommu_map() function
+
+From: Sui Jingfeng <suijingfeng@loongson.cn>
+
+[ Upstream commit 9e2e8a5113bf452081cb1f6a13617e36f5298cbf ]
+
+The 'len' parameter is the 4th argument, because it is not get used, so
+drop it. No functional change.
+
+Signed-off-by: Sui Jingfeng <suijingfeng@loongson.cn>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Stable-dep-of: 9aad03e7f5db ("drm/etnaviv: Drop the offset in page manipulation")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
+index 67bdce5326c6e..b55c599bd36a2 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
+@@ -70,7 +70,7 @@ static int etnaviv_context_map(struct etnaviv_iommu_context *context,
+ }
+
+ static int etnaviv_iommu_map(struct etnaviv_iommu_context *context, u32 iova,
+- struct sg_table *sgt, unsigned len, int prot)
++ struct sg_table *sgt, int prot)
+ { struct scatterlist *sg;
+ unsigned int da = iova;
+ unsigned int i;
+@@ -314,7 +314,7 @@ int etnaviv_iommu_map_gem(struct etnaviv_iommu_context *context,
+ goto unlock;
+
+ mapping->iova = node->start;
+- ret = etnaviv_iommu_map(context, node->start, sgt, etnaviv_obj->base.size,
++ ret = etnaviv_iommu_map(context, node->start, sgt,
+ ETNAVIV_PROT_READ | ETNAVIV_PROT_WRITE);
+
+ if (ret < 0) {
+--
+2.39.5
+
--- /dev/null
+From ea5d1c2cbfb4f8cd51539edd92bb6ba272a7a02d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2024 20:32:44 +0800
+Subject: drm/etnaviv: Drop the offset in page manipulation
+
+From: Sui Jingfeng <sui.jingfeng@linux.dev>
+
+[ Upstream commit 9aad03e7f5db7944d5ee96cd5c595c54be2236e6 ]
+
+The etnaviv driver, both kernel space and user space, assumes that GPU page
+size is 4KiB. Its IOMMU map/unmap 4KiB physical address range once a time.
+If 'sg->offset != 0' is true, then the current implementation will map the
+IOVA to a wrong area, which may lead to coherency problem. Picture 0 and 1
+give the illustration, see below.
+
+ PA start drifted
+ |
+ |<--- 'sg_dma_address(sg) - sg->offset'
+ | .------ sg_dma_address(sg)
+ | | .---- sg_dma_len(sg)
+ |<-sg->offset->| |
+ V |<-->| Another one cpu page
+ +----+----+----+----+ +----+----+----+----+
+ |xxxx| |||||| |||||||||||||||||||||
+ +----+----+----+----+ +----+----+----+----+
+ ^ ^ ^ ^
+ |<--- da_len --->| | |
+ | | | |
+ | .--------------' | |
+ | | .----------------' |
+ | | | .----------------'
+ | | | |
+ | | +----+----+----+----+
+ | | |||||||||||||||||||||
+ | | +----+----+----+----+
+ | |
+ | '--------------. da_len = sg_dma_len(sg) + sg->offset, using
+ | | 'sg_dma_len(sg) + sg->offset' will lead to GPUVA
+ +----+ ~~~~~~~~~~~~~+ collision, but min_t(unsigned int, da_len, va_len)
+ |xxxx| | will clamp it to correct size. But the IOVA will
+ +----+ ~~~~~~~~~~~~~+ be redirect to wrong area.
+ ^
+ | Picture 0: Possibly wrong implementation.
+GPUVA (IOVA)
+
+--------------------------------------------------------------------------
+
+ .------- sg_dma_address(sg)
+ | .---- sg_dma_len(sg)
+ |<-sg->offset->| |
+ | |<-->| another one cpu page
+ +----+----+----+----+ +----+----+----+----+
+ | |||||| |||||||||||||||||||||
+ +----+----+----+----+ +----+----+----+----+
+ ^ ^ ^ ^
+ | | | |
+ .--------------' | | |
+ | | | |
+ | .--------------' | |
+ | | .----------------' |
+ | | | .----------------'
+ | | | |
+ +----+ +----+----+----+----+
+ |||||| ||||||||||||||||||||| The first one is SZ_4K, the second is SZ_16K
+ +----+ +----+----+----+----+
+ ^
+ | Picture 1: Perfectly correct implementation.
+GPUVA (IOVA)
+
+If sg->offset != 0 is true, IOVA will be mapped to wrong physical address.
+Either because there doesn't contain the data or there contains wrong data.
+Strictly speaking, the memory area that before sg_dma_address(sg) doesn't
+belong to us, and it's likely that the area is being used by other process.
+
+Because we don't want to introduce confusions about which part is visible
+to the GPU, we assumes that the size of GPUVA is always 4KiB aligned. This
+is very relaxed requirement, since we already made the decision that GPU
+page size is 4KiB (as a canonical decision). And softpin feature is landed,
+Mesa's util_vma_heap_alloc() will certainly report correct length of GPUVA
+to kernel with desired alignment ensured.
+
+With above statements agreed, drop the "offset in page" manipulation will
+return us a correct implementation at any case.
+
+Fixes: a8c21a5451d8 ("drm/etnaviv: add initial etnaviv DRM driver")
+Signed-off-by: Sui Jingfeng <sui.jingfeng@linux.dev>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
+index aac24045bea59..20d86b8052574 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
+@@ -82,8 +82,8 @@ static int etnaviv_iommu_map(struct etnaviv_iommu_context *context,
+ return -EINVAL;
+
+ for_each_sgtable_dma_sg(sgt, sg, i) {
+- phys_addr_t pa = sg_dma_address(sg) - sg->offset;
+- unsigned int da_len = sg_dma_len(sg) + sg->offset;
++ phys_addr_t pa = sg_dma_address(sg);
++ unsigned int da_len = sg_dma_len(sg);
+ unsigned int bytes = min_t(unsigned int, da_len, va_len);
+
+ VERB("map[%d]: %08x %pap(%x)", i, iova, &pa, bytes);
+--
+2.39.5
+
--- /dev/null
+From 62c82dba8f17acae93c09380c314d59c9eccbe75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Oct 2023 19:12:03 +0800
+Subject: drm/etnaviv: Drop the second argument of the etnaviv_gem_new_impl()
+
+From: Sui Jingfeng <suijingfeng@loongson.cn>
+
+[ Upstream commit 4c6e6c01d82fc0edd8b47cb1ffbd05289029b005 ]
+
+The mentioned second parameter is the 'u32 size', but it is not get used by
+the etnaviv_gem_new_impl() function, so drop it. No functional change.
+
+Signed-off-by: Sui Jingfeng <suijingfeng@loongson.cn>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Stable-dep-of: 9aad03e7f5db ("drm/etnaviv: Drop the offset in page manipulation")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/etnaviv/etnaviv_gem.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
+index 740680205e8d6..2702ea7699ff9 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
+@@ -556,7 +556,7 @@ static const struct drm_gem_object_funcs etnaviv_gem_object_funcs = {
+ .vm_ops = &vm_ops,
+ };
+
+-static int etnaviv_gem_new_impl(struct drm_device *dev, u32 size, u32 flags,
++static int etnaviv_gem_new_impl(struct drm_device *dev, u32 flags,
+ const struct etnaviv_gem_ops *ops, struct drm_gem_object **obj)
+ {
+ struct etnaviv_gem_object *etnaviv_obj;
+@@ -605,8 +605,7 @@ int etnaviv_gem_new_handle(struct drm_device *dev, struct drm_file *file,
+
+ size = PAGE_ALIGN(size);
+
+- ret = etnaviv_gem_new_impl(dev, size, flags,
+- &etnaviv_gem_shmem_ops, &obj);
++ ret = etnaviv_gem_new_impl(dev, flags, &etnaviv_gem_shmem_ops, &obj);
+ if (ret)
+ goto fail;
+
+@@ -641,7 +640,7 @@ int etnaviv_gem_new_private(struct drm_device *dev, size_t size, u32 flags,
+ struct drm_gem_object *obj;
+ int ret;
+
+- ret = etnaviv_gem_new_impl(dev, size, flags, ops, &obj);
++ ret = etnaviv_gem_new_impl(dev, flags, ops, &obj);
+ if (ret)
+ return ret;
+
+--
+2.39.5
+
--- /dev/null
+From 634ac146a672c5567a28e6f726254faf317378f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 08:41:56 +0800
+Subject: drm/etnaviv: Fix page property being used for non writecombine
+ buffers
+
+From: Sui Jingfeng <sui.jingfeng@linux.dev>
+
+[ Upstream commit 834f304192834d6f0941954f3277ae0ba11a9a86 ]
+
+In the etnaviv_gem_vmap_impl() function, the driver vmap whatever buffers
+with write combine(WC) page property, this is incorrect. Cached buffers
+should be mapped with the cached page property and uncached buffers should
+be mapped with the uncached page property.
+
+Fixes: a0a5ab3e99b8 ("drm/etnaviv: call correct function when trying to vmap a DMABUF")
+Signed-off-by: Sui Jingfeng <sui.jingfeng@linux.dev>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/etnaviv/etnaviv_gem.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
+index 23d5058eca8d8..740680205e8d6 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
+@@ -342,6 +342,7 @@ void *etnaviv_gem_vmap(struct drm_gem_object *obj)
+ static void *etnaviv_gem_vmap_impl(struct etnaviv_gem_object *obj)
+ {
+ struct page **pages;
++ pgprot_t prot;
+
+ lockdep_assert_held(&obj->lock);
+
+@@ -349,8 +350,19 @@ static void *etnaviv_gem_vmap_impl(struct etnaviv_gem_object *obj)
+ if (IS_ERR(pages))
+ return NULL;
+
+- return vmap(pages, obj->base.size >> PAGE_SHIFT,
+- VM_MAP, pgprot_writecombine(PAGE_KERNEL));
++ switch (obj->flags & ETNA_BO_CACHE_MASK) {
++ case ETNA_BO_CACHED:
++ prot = PAGE_KERNEL;
++ break;
++ case ETNA_BO_UNCACHED:
++ prot = pgprot_noncached(PAGE_KERNEL);
++ break;
++ case ETNA_BO_WC:
++ default:
++ prot = pgprot_writecombine(PAGE_KERNEL);
++ }
++
++ return vmap(pages, obj->base.size >> PAGE_SHIFT, VM_MAP, prot);
+ }
+
+ static inline enum dma_data_direction etnaviv_op_to_dma_dir(u32 op)
+--
+2.39.5
+
--- /dev/null
+From 3f9ae03e5df51407fce552850abb325ea722b7b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Oct 2024 04:43:55 +0800
+Subject: drm/etnaviv: Map and unmap GPUVA range with respect to the GPUVA size
+
+From: Sui Jingfeng <sui.jingfeng@linux.dev>
+
+[ Upstream commit 68786b7f49873c69ec332a045a9bf4337d71ec20 ]
+
+Etnaviv assumes that GPU page size is 4KiB, however, GPUVA ranges collision
+when using softpin capable GPUs on a non 4KiB CPU page size configuration.
+The root cause is that kernel side BO takes up bigger address space than
+userspace expect, the size of backing memory of GEM buffer objects are
+required to align to the CPU PAGE_SIZE. Therefore, results in userspace
+allocated GPUVA range fails to be inserted to the specified hole exactly.
+
+To solve this problem, record the GPU visiable size of a BO firstly, then
+map and unmap the SG entry strictly with respect to the total GPUVA size.
+
+Signed-off-by: Sui Jingfeng <sui.jingfeng@linux.dev>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Stable-dep-of: 9aad03e7f5db ("drm/etnaviv: Drop the offset in page manipulation")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 38 +++++++++------------------
+ 1 file changed, 13 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
+index b55c599bd36a2..aac24045bea59 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
+@@ -69,9 +69,11 @@ static int etnaviv_context_map(struct etnaviv_iommu_context *context,
+ return ret;
+ }
+
+-static int etnaviv_iommu_map(struct etnaviv_iommu_context *context, u32 iova,
++static int etnaviv_iommu_map(struct etnaviv_iommu_context *context,
++ u32 iova, unsigned int va_len,
+ struct sg_table *sgt, int prot)
+-{ struct scatterlist *sg;
++{
++ struct scatterlist *sg;
+ unsigned int da = iova;
+ unsigned int i;
+ int ret;
+@@ -81,14 +83,16 @@ static int etnaviv_iommu_map(struct etnaviv_iommu_context *context, u32 iova,
+
+ for_each_sgtable_dma_sg(sgt, sg, i) {
+ phys_addr_t pa = sg_dma_address(sg) - sg->offset;
+- size_t bytes = sg_dma_len(sg) + sg->offset;
++ unsigned int da_len = sg_dma_len(sg) + sg->offset;
++ unsigned int bytes = min_t(unsigned int, da_len, va_len);
+
+- VERB("map[%d]: %08x %pap(%zx)", i, iova, &pa, bytes);
++ VERB("map[%d]: %08x %pap(%x)", i, iova, &pa, bytes);
+
+ ret = etnaviv_context_map(context, da, pa, bytes, prot);
+ if (ret)
+ goto fail;
+
++ va_len -= bytes;
+ da += bytes;
+ }
+
+@@ -104,21 +108,7 @@ static int etnaviv_iommu_map(struct etnaviv_iommu_context *context, u32 iova,
+ static void etnaviv_iommu_unmap(struct etnaviv_iommu_context *context, u32 iova,
+ struct sg_table *sgt, unsigned len)
+ {
+- struct scatterlist *sg;
+- unsigned int da = iova;
+- int i;
+-
+- for_each_sgtable_dma_sg(sgt, sg, i) {
+- size_t bytes = sg_dma_len(sg) + sg->offset;
+-
+- etnaviv_context_unmap(context, da, bytes);
+-
+- VERB("unmap[%d]: %08x(%zx)", i, iova, bytes);
+-
+- BUG_ON(!PAGE_ALIGNED(bytes));
+-
+- da += bytes;
+- }
++ etnaviv_context_unmap(context, iova, len);
+
+ context->flush_seq++;
+ }
+@@ -131,7 +121,7 @@ static void etnaviv_iommu_remove_mapping(struct etnaviv_iommu_context *context,
+ lockdep_assert_held(&context->lock);
+
+ etnaviv_iommu_unmap(context, mapping->vram_node.start,
+- etnaviv_obj->sgt, etnaviv_obj->base.size);
++ etnaviv_obj->sgt, etnaviv_obj->size);
+ drm_mm_remove_node(&mapping->vram_node);
+ }
+
+@@ -305,16 +295,14 @@ int etnaviv_iommu_map_gem(struct etnaviv_iommu_context *context,
+ node = &mapping->vram_node;
+
+ if (va)
+- ret = etnaviv_iommu_insert_exact(context, node,
+- etnaviv_obj->base.size, va);
++ ret = etnaviv_iommu_insert_exact(context, node, etnaviv_obj->size, va);
+ else
+- ret = etnaviv_iommu_find_iova(context, node,
+- etnaviv_obj->base.size);
++ ret = etnaviv_iommu_find_iova(context, node, etnaviv_obj->size);
+ if (ret < 0)
+ goto unlock;
+
+ mapping->iova = node->start;
+- ret = etnaviv_iommu_map(context, node->start, sgt,
++ ret = etnaviv_iommu_map(context, node->start, etnaviv_obj->size, sgt,
+ ETNAVIV_PROT_READ | ETNAVIV_PROT_WRITE);
+
+ if (ret < 0) {
+--
+2.39.5
+
--- /dev/null
+From 49bd8c4d9b174fbc12f15b9df395c941cd7d2d17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Oct 2024 04:43:54 +0800
+Subject: drm/etnaviv: Record GPU visible size of GEM BO separately
+
+From: Sui Jingfeng <sui.jingfeng@linux.dev>
+
+[ Upstream commit b5f1eed853c6ea6a99149fd97fe179f3ebd96a02 ]
+
+The GPU visible size of a GEM BO is not necessarily PAGE_SIZE aligned,
+which happens when CPU page size is not equal to GPU page size. Extra
+precious resources such as GPU page tables and GPU TLBs may being paid
+because of this but never get used.
+
+Track the size of GPU visible part of GEM BO separately, ensure no
+GPUVA range wasting by aligning that size to GPU page size.
+
+Signed-off-by: Sui Jingfeng <sui.jingfeng@linux.dev>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Stable-dep-of: 9aad03e7f5db ("drm/etnaviv: Drop the offset in page manipulation")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/etnaviv/etnaviv_gem.c | 11 +++++------
+ drivers/gpu/drm/etnaviv/etnaviv_gem.h | 5 +++++
+ 2 files changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
+index 2702ea7699ff9..1d49f5b5ec7ef 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
+@@ -556,7 +556,7 @@ static const struct drm_gem_object_funcs etnaviv_gem_object_funcs = {
+ .vm_ops = &vm_ops,
+ };
+
+-static int etnaviv_gem_new_impl(struct drm_device *dev, u32 flags,
++static int etnaviv_gem_new_impl(struct drm_device *dev, u32 size, u32 flags,
+ const struct etnaviv_gem_ops *ops, struct drm_gem_object **obj)
+ {
+ struct etnaviv_gem_object *etnaviv_obj;
+@@ -583,6 +583,7 @@ static int etnaviv_gem_new_impl(struct drm_device *dev, u32 flags,
+ if (!etnaviv_obj)
+ return -ENOMEM;
+
++ etnaviv_obj->size = ALIGN(size, SZ_4K);
+ etnaviv_obj->flags = flags;
+ etnaviv_obj->ops = ops;
+
+@@ -603,15 +604,13 @@ int etnaviv_gem_new_handle(struct drm_device *dev, struct drm_file *file,
+ struct drm_gem_object *obj = NULL;
+ int ret;
+
+- size = PAGE_ALIGN(size);
+-
+- ret = etnaviv_gem_new_impl(dev, flags, &etnaviv_gem_shmem_ops, &obj);
++ ret = etnaviv_gem_new_impl(dev, size, flags, &etnaviv_gem_shmem_ops, &obj);
+ if (ret)
+ goto fail;
+
+ lockdep_set_class(&to_etnaviv_bo(obj)->lock, &etnaviv_shm_lock_class);
+
+- ret = drm_gem_object_init(dev, obj, size);
++ ret = drm_gem_object_init(dev, obj, PAGE_ALIGN(size));
+ if (ret)
+ goto fail;
+
+@@ -640,7 +639,7 @@ int etnaviv_gem_new_private(struct drm_device *dev, size_t size, u32 flags,
+ struct drm_gem_object *obj;
+ int ret;
+
+- ret = etnaviv_gem_new_impl(dev, flags, ops, &obj);
++ ret = etnaviv_gem_new_impl(dev, size, flags, ops, &obj);
+ if (ret)
+ return ret;
+
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.h b/drivers/gpu/drm/etnaviv/etnaviv_gem.h
+index 63688e6e45804..cc247d5e54225 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.h
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.h
+@@ -36,6 +36,11 @@ struct etnaviv_gem_object {
+ const struct etnaviv_gem_ops *ops;
+ struct mutex lock;
+
++ /*
++ * The actual size that is visible to the GPU, not necessarily
++ * PAGE_SIZE aligned, but should be aligned to GPU page size.
++ */
++ u32 size;
+ u32 flags;
+
+ struct list_head gem_node;
+--
+2.39.5
+
--- /dev/null
+From b3d2e7b194d20711ba1e65555b3b88c22538b2d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Dec 2024 12:06:31 +0200
+Subject: drm/msm/dp: set safe_to_exit_level before printing it
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 7dee35d79bb046bfd425aa9e58a82414f67c1cec ]
+
+Rather than printing random garbage from stack and pretending that it is
+the default safe_to_exit_level, set the variable beforehand.
+
+Fixes: d13e36d7d222 ("drm/msm/dp: add audio support for Display Port on MSM")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202411081748.0PPL9MIj-lkp@intel.com/
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/626804/
+Link: https://lore.kernel.org/r/20241202-fd-dp-audio-fixup-v2-1-d9187ea96dad@linaro.org
+Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dp/dp_audio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_audio.c b/drivers/gpu/drm/msm/dp/dp_audio.c
+index 1245c7aa49df8..a2113d6a022b5 100644
+--- a/drivers/gpu/drm/msm/dp/dp_audio.c
++++ b/drivers/gpu/drm/msm/dp/dp_audio.c
+@@ -410,10 +410,10 @@ static void dp_audio_safe_to_exit_level(struct dp_audio_private *audio)
+ safe_to_exit_level = 5;
+ break;
+ default:
++ safe_to_exit_level = 14;
+ drm_dbg_dp(audio->drm_dev,
+ "setting the default safe_to_exit_level = %u\n",
+ safe_to_exit_level);
+- safe_to_exit_level = 14;
+ break;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 77b45936fba8f6986806202987374aba82eae05f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Dec 2024 16:17:04 +0800
+Subject: drm/rockchip: vop2: Check linear format for Cluster windows on
+ rk3566/8
+
+From: Andy Yan <andy.yan@rock-chips.com>
+
+[ Upstream commit df063c0b8ffbdca486ab2f802e716973985d8f86 ]
+
+The Cluster windows on rk3566/8 only support afbc mode.
+
+Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver")
+Signed-off-by: Andy Yan <andy.yan@rock-chips.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241214081719.3330518-6-andyshrk@163.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+index 7619a0c42aada..955ef2caac89f 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+@@ -463,6 +463,16 @@ static bool rockchip_vop2_mod_supported(struct drm_plane *plane, u32 format,
+ if (modifier == DRM_FORMAT_MOD_INVALID)
+ return false;
+
++ if (vop2->data->soc_id == 3568 || vop2->data->soc_id == 3566) {
++ if (vop2_cluster_window(win)) {
++ if (modifier == DRM_FORMAT_MOD_LINEAR) {
++ drm_dbg_kms(vop2->drm,
++ "Cluster window only supports format with afbc\n");
++ return false;
++ }
++ }
++ }
++
+ if (modifier == DRM_FORMAT_MOD_LINEAR)
+ return true;
+
+--
+2.39.5
+
--- /dev/null
+From 29d437384b32c0217606f819a4180e67896fc1a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2024 20:29:15 +0800
+Subject: drm/rockchip: vop2: Fix cluster windows alpha ctrl regsiters offset
+
+From: Andy Yan <andy.yan@rock-chips.com>
+
+[ Upstream commit 17b4b10a0df1a1421d5fbdc03bad0bd3799bc966 ]
+
+The phy_id of cluster windws are not increase one for each window.
+
+Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver")
+Tested-by: Derek Foreman <derek.foreman@collabora.com>
+Signed-off-by: Andy Yan <andy.yan@rock-chips.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241209122943.2781431-6-andyshrk@163.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+index a6071464a543f..71c961e92c12a 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+@@ -1737,7 +1737,6 @@ static int vop2_find_start_mixer_id_for_vp(struct vop2 *vop2, u8 port_id)
+
+ static void vop2_setup_cluster_alpha(struct vop2 *vop2, struct vop2_win *main_win)
+ {
+- u32 offset = (main_win->data->phys_id * 0x10);
+ struct vop2_alpha_config alpha_config;
+ struct vop2_alpha alpha;
+ struct drm_plane_state *bottom_win_pstate;
+@@ -1745,6 +1744,7 @@ static void vop2_setup_cluster_alpha(struct vop2 *vop2, struct vop2_win *main_wi
+ u16 src_glb_alpha_val, dst_glb_alpha_val;
+ bool premulti_en = false;
+ bool swap = false;
++ u32 offset = 0;
+
+ /* At one win mode, win0 is dst/bottom win, and win1 is a all zero src/top win */
+ bottom_win_pstate = main_win->base.state;
+@@ -1763,6 +1763,22 @@ static void vop2_setup_cluster_alpha(struct vop2 *vop2, struct vop2_win *main_wi
+ vop2_parse_alpha(&alpha_config, &alpha);
+
+ alpha.src_color_ctrl.bits.src_dst_swap = swap;
++
++ switch (main_win->data->phys_id) {
++ case ROCKCHIP_VOP2_CLUSTER0:
++ offset = 0x0;
++ break;
++ case ROCKCHIP_VOP2_CLUSTER1:
++ offset = 0x10;
++ break;
++ case ROCKCHIP_VOP2_CLUSTER2:
++ offset = 0x20;
++ break;
++ case ROCKCHIP_VOP2_CLUSTER3:
++ offset = 0x30;
++ break;
++ }
++
+ vop2_writel(vop2, RK3568_CLUSTER0_MIX_SRC_COLOR_CTRL + offset,
+ alpha.src_color_ctrl.val);
+ vop2_writel(vop2, RK3568_CLUSTER0_MIX_DST_COLOR_CTRL + offset,
+--
+2.39.5
+
--- /dev/null
+From 837c384a4843ec3464f2386969efb9a57c0ac361 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2024 20:29:16 +0800
+Subject: drm/rockchip: vop2: Fix the mixer alpha setup for layer 0
+
+From: Andy Yan <andy.yan@rock-chips.com>
+
+[ Upstream commit 6b4dfdcde3573a12b72d2869dabd4ca37ad7e9c7 ]
+
+The alpha setup should start from the second layer, the current calculation
+starts incorrectly from the first layer, a negative offset will be obtained
+in the following formula:
+
+offset = (mixer_id + zpos - 1) * 0x10
+
+Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver")
+Tested-by: Derek Foreman <derek.foreman@collabora.com>
+Signed-off-by: Andy Yan <andy.yan@rock-chips.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241209122943.2781431-7-andyshrk@163.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+index 71c961e92c12a..470a39a278b34 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+@@ -1826,6 +1826,12 @@ static void vop2_setup_alpha(struct vop2_video_port *vp)
+ struct vop2_win *win = to_vop2_win(plane);
+ int zpos = plane->state->normalized_zpos;
+
++ /*
++ * Need to configure alpha from second layer.
++ */
++ if (zpos == 0)
++ continue;
++
+ if (plane->state->pixel_blend_mode == DRM_MODE_BLEND_PREMULTI)
+ premulti_en = 1;
+ else
+--
+2.39.5
+
--- /dev/null
+From c530925f8e1e2f0429bd7a3d667e4ccabb9e6409 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Dec 2024 16:17:01 +0800
+Subject: drm/rockchip: vop2: Fix the windows switch between different layers
+
+From: Andy Yan <andy.yan@rock-chips.com>
+
+[ Upstream commit 0ca953ac226eaffbe1a795f5e517095a8d494921 ]
+
+Every layer of vop2 should bind a window, and we also need to make
+sure that this window is not used by other layer.
+
+0x5 is a reserved layer sel value on rk3568, but it will select
+Cluster3 on rk3588, configure unused layers to 0x5 will lead
+alpha blending error on rk3588.
+
+When we bind a window from layerM to layerN, we move the old window
+on layerN to layerM.
+
+Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver")
+Tested-by: Derek Foreman <derek.foreman@collabora.com>
+Signed-off-by: Andy Yan <andy.yan@rock-chips.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241214081719.3330518-3-andyshrk@163.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 47 ++++++++++++++------
+ 1 file changed, 34 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+index 1068f391b3e64..7619a0c42aada 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+@@ -1920,7 +1920,10 @@ static void vop2_setup_layer_mixer(struct vop2_video_port *vp)
+ struct drm_plane *plane;
+ u32 layer_sel = 0;
+ u32 port_sel;
+- unsigned int nlayer, ofs;
++ u8 layer_id;
++ u8 old_layer_id;
++ u8 layer_sel_id;
++ unsigned int ofs;
+ u32 ovl_ctrl;
+ int i;
+ struct vop2_video_port *vp0 = &vop2->vps[0];
+@@ -1964,9 +1967,30 @@ static void vop2_setup_layer_mixer(struct vop2_video_port *vp)
+ for (i = 0; i < vp->id; i++)
+ ofs += vop2->vps[i].nlayers;
+
+- nlayer = 0;
+ drm_atomic_crtc_for_each_plane(plane, &vp->crtc) {
+ struct vop2_win *win = to_vop2_win(plane);
++ struct vop2_win *old_win;
++
++ layer_id = (u8)(plane->state->normalized_zpos + ofs);
++
++ /*
++ * Find the layer this win bind in old state.
++ */
++ for (old_layer_id = 0; old_layer_id < vop2->data->win_size; old_layer_id++) {
++ layer_sel_id = (layer_sel >> (4 * old_layer_id)) & 0xf;
++ if (layer_sel_id == win->data->layer_sel_id)
++ break;
++ }
++
++ /*
++ * Find the win bind to this layer in old state
++ */
++ for (i = 0; i < vop2->data->win_size; i++) {
++ old_win = &vop2->win[i];
++ layer_sel_id = (layer_sel >> (4 * layer_id)) & 0xf;
++ if (layer_sel_id == old_win->data->layer_sel_id)
++ break;
++ }
+
+ switch (win->data->phys_id) {
+ case ROCKCHIP_VOP2_CLUSTER0:
+@@ -1995,17 +2019,14 @@ static void vop2_setup_layer_mixer(struct vop2_video_port *vp)
+ break;
+ }
+
+- layer_sel &= ~RK3568_OVL_LAYER_SEL__LAYER(plane->state->normalized_zpos + ofs,
+- 0x7);
+- layer_sel |= RK3568_OVL_LAYER_SEL__LAYER(plane->state->normalized_zpos + ofs,
+- win->data->layer_sel_id);
+- nlayer++;
+- }
+-
+- /* configure unused layers to 0x5 (reserved) */
+- for (; nlayer < vp->nlayers; nlayer++) {
+- layer_sel &= ~RK3568_OVL_LAYER_SEL__LAYER(nlayer + ofs, 0x7);
+- layer_sel |= RK3568_OVL_LAYER_SEL__LAYER(nlayer + ofs, 5);
++ layer_sel &= ~RK3568_OVL_LAYER_SEL__LAYER(layer_id, 0x7);
++ layer_sel |= RK3568_OVL_LAYER_SEL__LAYER(layer_id, win->data->layer_sel_id);
++ /*
++ * When we bind a window from layerM to layerN, we also need to move the old
++ * window on layerN to layerM to avoid one window selected by two or more layers.
++ */
++ layer_sel &= ~RK3568_OVL_LAYER_SEL__LAYER(old_layer_id, 0x7);
++ layer_sel |= RK3568_OVL_LAYER_SEL__LAYER(old_layer_id, old_win->data->layer_sel_id);
+ }
+
+ vop2_writel(vop2, RK3568_OVL_LAYER_SEL, layer_sel);
+--
+2.39.5
+
--- /dev/null
+From 3da38e5a5de869a107042a5251ba64de6cc1c3de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Dec 2023 19:58:15 +0800
+Subject: drm/rockchip: vop2: set bg dly and prescan dly at vop2_post_config
+
+From: Andy Yan <andy.yan@rock-chips.com>
+
+[ Upstream commit 075a5b3969becb1ebc2f1d4fa1a1fe9163679273 ]
+
+We need to setup background delay cycle and prescan
+delay cycle when a mode is enable to avoid trigger
+POST_BUF_EMPTY irq on rk3588.
+
+Note: RK356x has no such requirement.
+
+Signed-off-by: Andy Yan <andy.yan@rock-chips.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231211115815.1785131-1-andyshrk@163.com
+Stable-dep-of: 0ca953ac226e ("drm/rockchip: vop2: Fix the windows switch between different layers")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 26 ++++++++------------
+ 1 file changed, 10 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+index f14a3f033953f..1068f391b3e64 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+@@ -1395,8 +1395,18 @@ static void vop2_post_config(struct drm_crtc *crtc)
+ u32 top_margin = 100, bottom_margin = 100;
+ u16 hsize = hdisplay * (left_margin + right_margin) / 200;
+ u16 vsize = vdisplay * (top_margin + bottom_margin) / 200;
++ u16 hsync_len = mode->crtc_hsync_end - mode->crtc_hsync_start;
+ u16 hact_end, vact_end;
+ u32 val;
++ u32 bg_dly;
++ u32 pre_scan_dly;
++
++ bg_dly = vp->data->pre_scan_max_dly[3];
++ vop2_writel(vp->vop2, RK3568_VP_BG_MIX_CTRL(vp->id),
++ FIELD_PREP(RK3568_VP_BG_MIX_CTRL__BG_DLY, bg_dly));
++
++ pre_scan_dly = ((bg_dly + (hdisplay >> 1) - 1) << 16) | hsync_len;
++ vop2_vp_write(vp, RK3568_VP_PRE_SCAN_HTIMING, pre_scan_dly);
+
+ vsize = rounddown(vsize, 2);
+ hsize = rounddown(hsize, 2);
+@@ -1911,11 +1921,6 @@ static void vop2_setup_layer_mixer(struct vop2_video_port *vp)
+ u32 layer_sel = 0;
+ u32 port_sel;
+ unsigned int nlayer, ofs;
+- struct drm_display_mode *adjusted_mode;
+- u16 hsync_len;
+- u16 hdisplay;
+- u32 bg_dly;
+- u32 pre_scan_dly;
+ u32 ovl_ctrl;
+ int i;
+ struct vop2_video_port *vp0 = &vop2->vps[0];
+@@ -1923,17 +1928,6 @@ static void vop2_setup_layer_mixer(struct vop2_video_port *vp)
+ struct vop2_video_port *vp2 = &vop2->vps[2];
+ struct rockchip_crtc_state *vcstate = to_rockchip_crtc_state(vp->crtc.state);
+
+- adjusted_mode = &vp->crtc.state->adjusted_mode;
+- hsync_len = adjusted_mode->crtc_hsync_end - adjusted_mode->crtc_hsync_start;
+- hdisplay = adjusted_mode->crtc_hdisplay;
+-
+- bg_dly = vp->data->pre_scan_max_dly[3];
+- vop2_writel(vop2, RK3568_VP_BG_MIX_CTRL(vp->id),
+- FIELD_PREP(RK3568_VP_BG_MIX_CTRL__BG_DLY, bg_dly));
+-
+- pre_scan_dly = ((bg_dly + (hdisplay >> 1) - 1) << 16) | hsync_len;
+- vop2_vp_write(vp, RK3568_VP_PRE_SCAN_HTIMING, pre_scan_dly);
+-
+ ovl_ctrl = vop2_readl(vop2, RK3568_OVL_CTRL);
+ ovl_ctrl |= RK3568_OVL_CTRL__LAYERSEL_REGDONE_IMD;
+ if (vcstate->yuv_overlay)
+--
+2.39.5
+
--- /dev/null
+From 54e72f7c6d273f496efd8131c840fb707b46f2be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Dec 2023 19:58:05 +0800
+Subject: drm/rockchip: vop2: Set YUV/RGB overlay mode
+
+From: Andy Yan <andy.yan@rock-chips.com>
+
+[ Upstream commit dd49ee4614cfb0b1f627c4353b60cecfe998a374 ]
+
+Set overlay mode register according to the
+output mode is yuv or rgb.
+
+Signed-off-by: Andy Yan <andy.yan@rock-chips.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231211115805.1785073-1-andyshrk@163.com
+Stable-dep-of: 0ca953ac226e ("drm/rockchip: vop2: Fix the windows switch between different layers")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_drv.h | 1 +
+ drivers/gpu/drm/rockchip/rockchip_drm_vop2.c | 17 ++++++++++++++---
+ drivers/gpu/drm/rockchip/rockchip_drm_vop2.h | 1 +
+ 3 files changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_drv.h b/drivers/gpu/drm/rockchip/rockchip_drm_drv.h
+index 1641440837af5..6298e3732887b 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_drv.h
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_drv.h
+@@ -31,6 +31,7 @@ struct rockchip_crtc_state {
+ int output_bpc;
+ int output_flags;
+ bool enable_afbc;
++ bool yuv_overlay;
+ u32 bus_format;
+ u32 bus_flags;
+ int color_space;
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+index 470a39a278b34..f14a3f033953f 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.c
+@@ -1556,6 +1556,8 @@ static void vop2_crtc_atomic_enable(struct drm_crtc *crtc,
+
+ vop2->enable_count++;
+
++ vcstate->yuv_overlay = is_yuv_output(vcstate->bus_format);
++
+ vop2_crtc_enable_irq(vp, VP_INT_POST_BUF_EMPTY);
+
+ polflags = 0;
+@@ -1583,7 +1585,7 @@ static void vop2_crtc_atomic_enable(struct drm_crtc *crtc,
+ if (vop2_output_uv_swap(vcstate->bus_format, vcstate->output_mode))
+ dsp_ctrl |= RK3568_VP_DSP_CTRL__DSP_RB_SWAP;
+
+- if (is_yuv_output(vcstate->bus_format))
++ if (vcstate->yuv_overlay)
+ dsp_ctrl |= RK3568_VP_DSP_CTRL__POST_DSP_OUT_R2Y;
+
+ vop2_dither_setup(crtc, &dsp_ctrl);
+@@ -1914,10 +1916,12 @@ static void vop2_setup_layer_mixer(struct vop2_video_port *vp)
+ u16 hdisplay;
+ u32 bg_dly;
+ u32 pre_scan_dly;
++ u32 ovl_ctrl;
+ int i;
+ struct vop2_video_port *vp0 = &vop2->vps[0];
+ struct vop2_video_port *vp1 = &vop2->vps[1];
+ struct vop2_video_port *vp2 = &vop2->vps[2];
++ struct rockchip_crtc_state *vcstate = to_rockchip_crtc_state(vp->crtc.state);
+
+ adjusted_mode = &vp->crtc.state->adjusted_mode;
+ hsync_len = adjusted_mode->crtc_hsync_end - adjusted_mode->crtc_hsync_start;
+@@ -1930,7 +1934,15 @@ static void vop2_setup_layer_mixer(struct vop2_video_port *vp)
+ pre_scan_dly = ((bg_dly + (hdisplay >> 1) - 1) << 16) | hsync_len;
+ vop2_vp_write(vp, RK3568_VP_PRE_SCAN_HTIMING, pre_scan_dly);
+
+- vop2_writel(vop2, RK3568_OVL_CTRL, 0);
++ ovl_ctrl = vop2_readl(vop2, RK3568_OVL_CTRL);
++ ovl_ctrl |= RK3568_OVL_CTRL__LAYERSEL_REGDONE_IMD;
++ if (vcstate->yuv_overlay)
++ ovl_ctrl |= RK3568_OVL_CTRL__YUV_MODE(vp->id);
++ else
++ ovl_ctrl &= ~RK3568_OVL_CTRL__YUV_MODE(vp->id);
++
++ vop2_writel(vop2, RK3568_OVL_CTRL, ovl_ctrl);
++
+ port_sel = vop2_readl(vop2, RK3568_OVL_PORT_SEL);
+ port_sel &= RK3568_OVL_PORT_SEL__SEL_PORT;
+
+@@ -2004,7 +2016,6 @@ static void vop2_setup_layer_mixer(struct vop2_video_port *vp)
+
+ vop2_writel(vop2, RK3568_OVL_LAYER_SEL, layer_sel);
+ vop2_writel(vop2, RK3568_OVL_PORT_SEL, port_sel);
+- vop2_writel(vop2, RK3568_OVL_CTRL, RK3568_OVL_CTRL__LAYERSEL_REGDONE_IMD);
+ }
+
+ static void vop2_setup_dly_for_windows(struct vop2 *vop2)
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.h b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.h
+index f1234a151130f..18f0573b20002 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop2.h
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop2.h
+@@ -418,6 +418,7 @@ enum dst_factor_mode {
+ #define VOP2_COLOR_KEY_MASK BIT(31)
+
+ #define RK3568_OVL_CTRL__LAYERSEL_REGDONE_IMD BIT(28)
++#define RK3568_OVL_CTRL__YUV_MODE(vp) BIT(vp)
+
+ #define RK3568_VP_BG_MIX_CTRL__BG_DLY GENMASK(31, 24)
+
+--
+2.39.5
+
--- /dev/null
+From 815230b26175b24ffb3dc727910ca1ba56f9470e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Nov 2024 13:44:29 +0100
+Subject: dt-bindings: leds: class-multicolor: Fix path to color definitions
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 609bc99a4452ffbce82d10f024a85d911c42e6cd ]
+
+The LED color definitions have always been in
+include/dt-bindings/leds/common.h in upstream.
+
+Fixes: 5c7f8ffe741daae7 ("dt: bindings: Add multicolor class dt bindings documention")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Acked-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://lore.kernel.org/r/a3c7ea92e90b77032f2e480d46418b087709286d.1731588129.git.geert+renesas@glider.be
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/leds/leds-class-multicolor.yaml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/leds/leds-class-multicolor.yaml b/Documentation/devicetree/bindings/leds/leds-class-multicolor.yaml
+index 31840e33dcf55..3452cc9ef3373 100644
+--- a/Documentation/devicetree/bindings/leds/leds-class-multicolor.yaml
++++ b/Documentation/devicetree/bindings/leds/leds-class-multicolor.yaml
+@@ -27,7 +27,7 @@ properties:
+ description: |
+ For multicolor LED support this property should be defined as either
+ LED_COLOR_ID_RGB or LED_COLOR_ID_MULTI which can be found in
+- include/linux/leds/common.h.
++ include/dt-bindings/leds/common.h.
+ enum: [ 8, 9 ]
+
+ required:
+--
+2.39.5
+
--- /dev/null
+From 10b853acdcb2b824f328ec70d439b34e8cc3061b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Nov 2024 19:01:06 +0200
+Subject: dt-bindings: mfd: bd71815: Fix rsense and typos
+
+From: Matti Vaittinen <mazziesaccount@gmail.com>
+
+[ Upstream commit 6856edf7ead8c54803216a38a7b227bcb3dadff7 ]
+
+The sense resistor used for measuring currents is typically some tens of
+milli Ohms. It has accidentally been documented to be tens of mega Ohms.
+Fix the size of this resistor and a few copy-paste errors while at it.
+
+Drop the unsuitable 'rohm,charger-sense-resistor-ohms' property (which
+can't represent resistors smaller than one Ohm), and introduce a new
+'rohm,charger-sense-resistor-micro-ohms' property with appropriate
+minimum, maximum and default values instead.
+
+Fixes: 4238dc1e6490 ("dt_bindings: mfd: Add ROHM BD71815 PMIC")
+Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com>
+Acked-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://lore.kernel.org/r/0efd8e9de0ae8d62ee4c6b78cc565b04007a245d.1731430700.git.mazziesaccount@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../bindings/mfd/rohm,bd71815-pmic.yaml | 20 +++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/mfd/rohm,bd71815-pmic.yaml b/Documentation/devicetree/bindings/mfd/rohm,bd71815-pmic.yaml
+index fbface720678c..d579992499743 100644
+--- a/Documentation/devicetree/bindings/mfd/rohm,bd71815-pmic.yaml
++++ b/Documentation/devicetree/bindings/mfd/rohm,bd71815-pmic.yaml
+@@ -50,15 +50,15 @@ properties:
+ minimum: 0
+ maximum: 1
+
+- rohm,charger-sense-resistor-ohms:
+- minimum: 10000000
+- maximum: 50000000
++ rohm,charger-sense-resistor-micro-ohms:
++ minimum: 10000
++ maximum: 50000
+ description: |
+- BD71827 and BD71828 have SAR ADC for measuring charging currents.
+- External sense resistor (RSENSE in data sheet) should be used. If
+- something other but 30MOhm resistor is used the resistance value
+- should be given here in Ohms.
+- default: 30000000
++ BD71815 has SAR ADC for measuring charging currents. External sense
++ resistor (RSENSE in data sheet) should be used. If something other
++ but a 30 mOhm resistor is used the resistance value should be given
++ here in micro Ohms.
++ default: 30000
+
+ regulators:
+ $ref: ../regulator/rohm,bd71815-regulator.yaml
+@@ -67,7 +67,7 @@ properties:
+
+ gpio-reserved-ranges:
+ description: |
+- Usage of BD71828 GPIO pins can be changed via OTP. This property can be
++ Usage of BD71815 GPIO pins can be changed via OTP. This property can be
+ used to mark the pins which should not be configured for GPIO. Please see
+ the ../gpio/gpio.txt for more information.
+
+@@ -113,7 +113,7 @@ examples:
+ gpio-controller;
+ #gpio-cells = <2>;
+
+- rohm,charger-sense-resistor-ohms = <10000000>;
++ rohm,charger-sense-resistor-micro-ohms = <10000>;
+
+ regulators {
+ buck1: buck1 {
+--
+2.39.5
+
--- /dev/null
+From 72bcd7e03eabe51452977dcfc2607bf0e7869a1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Nov 2024 16:16:41 +0100
+Subject: dt-bindings: mmc: controller: clarify the address-cells description
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit b2b8e93ec00b8110cb37cbde5400d5abfdaed6a7 ]
+
+The term "slot ID" has nothing to do with the SDIO function number
+which is specified in the reg property of the subnodes, rephrase
+the description to be more accurate.
+
+Fixes: f9b7989859dd ("dt-bindings: mmc: Add YAML schemas for the generic MMC options")
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Acked-by: Rob Herring (Arm) <robh@kernel.org>
+Message-ID: <20241128-topic-amlogic-arm32-upstream-bindings-fixes-convert-meson-mx-sdio-v4-1-11d9f9200a59@linaro.org>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/mmc/mmc-controller.yaml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/mmc/mmc-controller.yaml b/Documentation/devicetree/bindings/mmc/mmc-controller.yaml
+index 802e3ca8be4df..f6bd7d19f4619 100644
+--- a/Documentation/devicetree/bindings/mmc/mmc-controller.yaml
++++ b/Documentation/devicetree/bindings/mmc/mmc-controller.yaml
+@@ -25,7 +25,7 @@ properties:
+ "#address-cells":
+ const: 1
+ description: |
+- The cell is the slot ID if a function subnode is used.
++ The cell is the SDIO function number if a function subnode is used.
+
+ "#size-cells":
+ const: 0
+--
+2.39.5
+
--- /dev/null
+From b8b5a8018e4286aad0d1febadc256c2bafbe4612 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2024 02:15:31 +0800
+Subject: dts: arm64: mediatek: mt8195: Remove MT8183 compatible for OVL
+
+From: Jason-JH.Lin <jason-jh.lin@mediatek.com>
+
+[ Upstream commit ce3dbc46d7e30a84b8e99c730e3172dd5efbf094 ]
+
+The OVL hardware capabilities have changed starting from MT8195,
+making the MT8183 compatible no longer applicable.
+Therefore, it is necessary to remove the MT8183 compatible for OVL.
+
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Jason-JH.Lin <jason-jh.lin@mediatek.com>
+Fixes: b852ee68fd72 ("arm64: dts: mt8195: Add display node for vdosys0")
+Link: https://lore.kernel.org/r/20241219181531.4282-5-jason-jh.lin@mediatek.com
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8195.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+index aa8fbaf15e629..274edce5d5e6e 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+@@ -2000,7 +2000,7 @@
+ };
+
+ ovl0: ovl@1c000000 {
+- compatible = "mediatek,mt8195-disp-ovl", "mediatek,mt8183-disp-ovl";
++ compatible = "mediatek,mt8195-disp-ovl";
+ reg = <0 0x1c000000 0 0x1000>;
+ interrupts = <GIC_SPI 636 IRQ_TYPE_LEVEL_HIGH 0>;
+ power-domains = <&spm MT8195_POWER_DOMAIN_VDOSYS0>;
+--
+2.39.5
+
--- /dev/null
+From 9344f51298f518c5fb8ce196f7bcf010156c15ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2025 15:53:09 -0800
+Subject: efi: sysfb_efi: fix W=1 warnings when EFI is not set
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 19fdc68aa7b90b1d3d600e873a3e050a39e7663d ]
+
+A build with W=1 fails because there are code and data that are not
+needed or used when CONFIG_EFI is not set. Move the "#ifdef CONFIG_EFI"
+block to earlier in the source file so that the unused code/data are
+not built.
+
+drivers/firmware/efi/sysfb_efi.c:345:39: warning: ‘efifb_fwnode_ops’ defined but not used [-Wunused-const-variable=]
+ 345 | static const struct fwnode_operations efifb_fwnode_ops = {
+ | ^~~~~~~~~~~~~~~~
+drivers/firmware/efi/sysfb_efi.c:238:35: warning: ‘efifb_dmi_swap_width_height’ defined but not used [-Wunused-const-variable=]
+ 238 | static const struct dmi_system_id efifb_dmi_swap_width_height[] __initconst = {
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/firmware/efi/sysfb_efi.c:188:35: warning: ‘efifb_dmi_system_table’ defined but not used [-Wunused-const-variable=]
+ 188 | static const struct dmi_system_id efifb_dmi_system_table[] __initconst = {
+ | ^~~~~~~~~~~~~~~~~~~~~~
+
+Fixes: 15d27b15de96 ("efi: sysfb_efi: fix build when EFI is not set")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202501071933.20nlmJJt-lkp@intel.com/
+Cc: David Rheinsberg <david@readahead.eu>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Cc: Javier Martinez Canillas <javierm@redhat.com>
+Cc: Peter Jones <pjones@redhat.com>
+Cc: Simona Vetter <simona@ffwll.ch>
+Cc: linux-fbdev@vger.kernel.org
+Cc: Ard Biesheuvel <ardb@kernel.org>
+Cc: linux-efi@vger.kernel.org
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/sysfb_efi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/efi/sysfb_efi.c b/drivers/firmware/efi/sysfb_efi.c
+index 456d0e5eaf78b..f479680299838 100644
+--- a/drivers/firmware/efi/sysfb_efi.c
++++ b/drivers/firmware/efi/sysfb_efi.c
+@@ -91,6 +91,7 @@ void efifb_setup_from_dmi(struct screen_info *si, const char *opt)
+ _ret_; \
+ })
+
++#ifdef CONFIG_EFI
+ static int __init efifb_set_system(const struct dmi_system_id *id)
+ {
+ struct efifb_dmi_info *info = id->driver_data;
+@@ -346,7 +347,6 @@ static const struct fwnode_operations efifb_fwnode_ops = {
+ .add_links = efifb_add_links,
+ };
+
+-#ifdef CONFIG_EFI
+ static struct fwnode_handle efifb_fwnode;
+
+ __init void sysfb_apply_efi_quirks(void)
+--
+2.39.5
+
--- /dev/null
+From 7c50fe59b5e71268b799fd1af37724a71e887641 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2025 10:15:37 +0900
+Subject: fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device()
+
+From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+
+[ Upstream commit de124b61e179e690277116e6be512e4f422b5dd8 ]
+
+dss_of_port_get_parent_device() leaks an OF node reference when i >= 2
+and struct device_node *np is present. Since of_get_next_parent()
+obtains a reference of the returned OF node, call of_node_put() before
+returning NULL.
+
+This was found by an experimental verifier that I am developing, and no
+runtime test was able to be performed due to that lack of actual
+devices.
+
+Fixes: f76ee892a99e ("omapfb: copy omapdss & displays for omapfb")
+Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/omap2/omapfb/dss/dss-of.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c b/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c
+index 0282d4eef139d..3b16c3342cb77 100644
+--- a/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c
++++ b/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c
+@@ -102,6 +102,7 @@ struct device_node *dss_of_port_get_parent_device(struct device_node *port)
+ np = of_get_next_parent(np);
+ }
+
++ of_node_put(np);
+ return NULL;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From c552da49c6d1fe17b8c0af8e49015c9742362f8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Nov 2024 11:46:36 +0800
+Subject: fs: fix proc_handler for sysctl_nr_open
+
+From: Jinliang Zheng <alexjlzheng@gmail.com>
+
+[ Upstream commit d727935cad9f6f52c8d184968f9720fdc966c669 ]
+
+Use proc_douintvec_minmax() instead of proc_dointvec_minmax() to handle
+sysctl_nr_open, because its data type is unsigned int, not int.
+
+Fixes: 9b80a184eaad ("fs/file: more unsigned file descriptors")
+Signed-off-by: Jinliang Zheng <alexjlzheng@tencent.com>
+Link: https://lore.kernel.org/r/20241124034636.325337-1-alexjlzheng@tencent.com
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/file_table.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/file_table.c b/fs/file_table.c
+index dd88701e54a93..cecc866871bc1 100644
+--- a/fs/file_table.c
++++ b/fs/file_table.c
+@@ -110,7 +110,7 @@ static struct ctl_table fs_stat_sysctls[] = {
+ .data = &sysctl_nr_open,
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+- .proc_handler = proc_dointvec_minmax,
++ .proc_handler = proc_douintvec_minmax,
+ .extra1 = &sysctl_nr_open_min,
+ .extra2 = &sysctl_nr_open_max,
+ },
+--
+2.39.5
+
--- /dev/null
+From 84fbdf4eac4741b4bb3b432c418d8b958b76f07a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2024 11:20:43 +0100
+Subject: genirq: Make handle_enforce_irqctx() unconditionally available
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 8d187a77f04c14fb459a5301d69f733a5a1396bc ]
+
+Commit 1b57d91b969c ("irqchip/gic-v2, v3: Prevent SW resends entirely")
+sett the flag which enforces interrupt handling in interrupt context and
+prevents software base resends for ARM GIC v2/v3.
+
+But it missed that the helper function which checks the flag was hidden
+behind CONFIG_GENERIC_PENDING_IRQ, which is not set by ARM[64].
+
+Make the helper unconditionally available so that the enforcement actually
+works.
+
+Fixes: 1b57d91b969c ("irqchip/gic-v2, v3: Prevent SW resends entirely")
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/all/20241210101811.497716609@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/irq/internals.h | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
+index 5fdc0b5575797..35e85323940c3 100644
+--- a/kernel/irq/internals.h
++++ b/kernel/irq/internals.h
+@@ -429,10 +429,6 @@ static inline struct cpumask *irq_desc_get_pending_mask(struct irq_desc *desc)
+ {
+ return desc->pending_mask;
+ }
+-static inline bool handle_enforce_irqctx(struct irq_data *data)
+-{
+- return irqd_is_handle_enforce_irqctx(data);
+-}
+ bool irq_fixup_move_pending(struct irq_desc *desc, bool force_clear);
+ #else /* CONFIG_GENERIC_PENDING_IRQ */
+ static inline bool irq_can_move_pcntxt(struct irq_data *data)
+@@ -459,11 +455,12 @@ static inline bool irq_fixup_move_pending(struct irq_desc *desc, bool fclear)
+ {
+ return false;
+ }
++#endif /* !CONFIG_GENERIC_PENDING_IRQ */
++
+ static inline bool handle_enforce_irqctx(struct irq_data *data)
+ {
+- return false;
++ return irqd_is_handle_enforce_irqctx(data);
+ }
+-#endif /* !CONFIG_GENERIC_PENDING_IRQ */
+
+ #if !defined(CONFIG_IRQ_DOMAIN) || !defined(CONFIG_IRQ_DOMAIN_HIERARCHY)
+ static inline int irq_domain_activate_irq(struct irq_data *data, bool reserve)
+--
+2.39.5
+
--- /dev/null
+From f26a514f2f2554e5e776348e1837370849d9ad85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2025 23:19:11 +0100
+Subject: gpio: mxc: remove dead code after switch to DT-only
+
+From: Ahmad Fatoum <a.fatoum@pengutronix.de>
+
+[ Upstream commit b049e7abe9001a780d58e78e3833dcceee22f396 ]
+
+struct platform_device::id was only set by board code, but since i.MX
+became a devicetree-only platform, this will always be -1
+(PLATFORM_DEVID_NONE).
+
+Note: of_alias_get_id() returns a negative number on error and base
+treats all negative errors the same, so we need not add any additional
+error handling.
+
+Fixes: 0f2c7af45d7e ("gpio: mxc: Convert the driver to DT-only")
+Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Link: https://lore.kernel.org/r/20250113-b4-imx-gpio-base-warning-v1-3-0a28731a5cf6@pengutronix.de
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-mxc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpio-mxc.c b/drivers/gpio/gpio-mxc.c
+index 853d9aa6b3b1f..d456077c74f2f 100644
+--- a/drivers/gpio/gpio-mxc.c
++++ b/drivers/gpio/gpio-mxc.c
+@@ -445,8 +445,7 @@ static int mxc_gpio_probe(struct platform_device *pdev)
+ port->gc.request = gpiochip_generic_request;
+ port->gc.free = gpiochip_generic_free;
+ port->gc.to_irq = mxc_gpio_to_irq;
+- port->gc.base = (pdev->id < 0) ? of_alias_get_id(np, "gpio") * 32 :
+- pdev->id * 32;
++ port->gc.base = of_alias_get_id(np, "gpio") * 32;
+
+ err = devm_gpiochip_add_data(&pdev->dev, &port->gc, port);
+ if (err)
+--
+2.39.5
+
--- /dev/null
+From 9c84defff0c46fc342bae7e6512e244f37a9ce37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2024 23:22:21 +0100
+Subject: HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding
+ endpoint check
+
+From: Karol Przybylski <karprzy7@gmail.com>
+
+[ Upstream commit 50420d7c79c37a3efe4010ff9b1bb14bc61ebccf ]
+
+syzbot has found a type mismatch between a USB pipe and the transfer
+endpoint, which is triggered by the hid-thrustmaster driver[1].
+There is a number of similar, already fixed issues [2].
+In this case as in others, implementing check for endpoint type fixes the issue.
+
+[1] https://syzkaller.appspot.com/bug?extid=040e8b3db6a96908d470
+[2] https://syzkaller.appspot.com/bug?extid=348331f63b034f89b622
+
+Fixes: c49c33637802 ("HID: support for initialization of some Thrustmaster wheels")
+Reported-by: syzbot+040e8b3db6a96908d470@syzkaller.appspotmail.com
+Tested-by: syzbot+040e8b3db6a96908d470@syzkaller.appspotmail.com
+Signed-off-by: Karol Przybylski <karprzy7@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-thrustmaster.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/hid/hid-thrustmaster.c b/drivers/hid/hid-thrustmaster.c
+index cf1679b0d4fbb..6c3e758bbb09e 100644
+--- a/drivers/hid/hid-thrustmaster.c
++++ b/drivers/hid/hid-thrustmaster.c
+@@ -170,6 +170,14 @@ static void thrustmaster_interrupts(struct hid_device *hdev)
+ ep = &usbif->cur_altsetting->endpoint[1];
+ b_ep = ep->desc.bEndpointAddress;
+
++ /* Are the expected endpoints present? */
++ u8 ep_addr[1] = {b_ep};
++
++ if (!usb_check_int_endpoints(usbif, ep_addr)) {
++ hid_err(hdev, "Unexpected non-int endpoint\n");
++ return;
++ }
++
+ for (i = 0; i < ARRAY_SIZE(setup_arr); ++i) {
+ memcpy(send_buf, setup_arr[i], setup_arr_sizes[i]);
+
+--
+2.39.5
+
--- /dev/null
+From 77efa40648cb6372acc139d6c4ffd900978694e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2024 10:19:32 +0100
+Subject: HID: multitouch: fix support for Goodix PID 0x01e9
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jiri Kosina <jkosina@suse.com>
+
+[ Upstream commit 8ade5e05bd094485ce370fad66a6a3fb6f50bfbc ]
+
+Commit c8000deb68365b ("HID: multitouch: Add support for GT7868Q") added
+support for 0x01e8 and 0x01e9, but the mt_device[] entries were added
+twice for 0x01e8 and there was none added for 0x01e9. Fix that.
+
+Fixes: c8000deb68365b ("HID: multitouch: Add support for GT7868Q")
+Reported-by: He Lugang <helugang@uniontech.com>
+Reported-by: WangYuli <wangyuli@uniontech.com>
+Reported-by: Ulrich Müller <ulm@gentoo.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-multitouch.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index e62104e1a6038..5ad871a7d1a44 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -2072,7 +2072,7 @@ static const struct hid_device_id mt_devices[] = {
+ I2C_DEVICE_ID_GOODIX_01E8) },
+ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU,
+ HID_DEVICE(BUS_I2C, HID_GROUP_ANY, I2C_VENDOR_ID_GOODIX,
+- I2C_DEVICE_ID_GOODIX_01E8) },
++ I2C_DEVICE_ID_GOODIX_01E9) },
+
+ /* GoodTouch panels */
+ { .driver_data = MT_CLS_NSMU,
+--
+2.39.5
+
--- /dev/null
+From 64671ac899ec2d8f14d124ec15c398aac26f2608 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Sep 2024 11:14:10 +0200
+Subject: iavf: allow changing VLAN state without calling PF
+
+From: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+
+[ Upstream commit ee7d79433d783346430ee32f28c9df44a88b3bb6 ]
+
+First case:
+> ip l a l $VF name vlanx type vlan id 100
+> ip l d vlanx
+> ip l a l $VF name vlanx type vlan id 100
+
+As workqueue can be execute after sometime, there is a window to have
+call trace like that:
+- iavf_del_vlan
+- iavf_add_vlan
+- iavf_del_vlans (wq)
+
+It means that our VLAN 100 will change the state from IAVF_VLAN_ACTIVE
+to IAVF_VLAN_REMOVE (iavf_del_vlan). After that in iavf_add_vlan state
+won't be changed because VLAN 100 is on the filter list. The final
+result is that the VLAN 100 filter isn't added in hardware (no
+iavf_add_vlans call).
+
+To fix that change the state if the filter wasn't removed yet directly
+to active. It is save as IAVF_VLAN_REMOVE means that virtchnl message
+wasn't sent yet.
+
+Second case:
+> ip l a l $VF name vlanx type vlan id 100
+Any type of VF reset ex. change trust
+> ip l s $PF vf $VF_NUM trust on
+> ip l d vlanx
+> ip l a l $VF name vlanx type vlan id 100
+
+In case of reset iavf driver is responsible for readding all filters
+that are being used. To do that all VLAN filters state are changed to
+IAVF_VLAN_ADD. Here is even longer window for changing VLAN state from
+kernel side, as workqueue isn't called immediately. We can have call
+trace like that:
+
+- changing to IAVF_VLAN_ADD (after reset)
+- iavf_del_vlan (called from kernel ops)
+- iavf_del_vlans (wq)
+
+Not exsisitng VLAN filters will be removed from hardware. It isn't a
+bug, ice driver will handle it fine. However, we can have call trace
+like that:
+
+- changing to IAVF_VLAN_ADD (after reset)
+- iavf_del_vlan (called from kernel ops)
+- iavf_add_vlan (called from kernel ops)
+- iavf_del_vlans (wq)
+
+With fix for previous case we end up with no VLAN filters in hardware.
+We have to remove VLAN filters if the state is IAVF_VLAN_ADD and delete
+VLAN was called. It is save as IAVF_VLAN_ADD means that virtchnl message
+wasn't sent yet.
+
+Fixes: 0c0da0e95105 ("iavf: refactor VLAN filter states")
+Signed-off-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/iavf/iavf_main.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
+index 53b9fe35d8035..7119bce4c091a 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_main.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
+@@ -830,6 +830,11 @@ iavf_vlan_filter *iavf_add_vlan(struct iavf_adapter *adapter,
+ f->state = IAVF_VLAN_ADD;
+ adapter->num_vlan_filters++;
+ iavf_schedule_aq_request(adapter, IAVF_FLAG_AQ_ADD_VLAN_FILTER);
++ } else if (f->state == IAVF_VLAN_REMOVE) {
++ /* IAVF_VLAN_REMOVE means that VLAN wasn't yet removed.
++ * We can safely only change the state here.
++ */
++ f->state = IAVF_VLAN_ACTIVE;
+ }
+
+ clearout:
+@@ -850,8 +855,18 @@ static void iavf_del_vlan(struct iavf_adapter *adapter, struct iavf_vlan vlan)
+
+ f = iavf_find_vlan(adapter, vlan);
+ if (f) {
+- f->state = IAVF_VLAN_REMOVE;
+- iavf_schedule_aq_request(adapter, IAVF_FLAG_AQ_DEL_VLAN_FILTER);
++ /* IAVF_ADD_VLAN means that VLAN wasn't even added yet.
++ * Remove it from the list.
++ */
++ if (f->state == IAVF_VLAN_ADD) {
++ list_del(&f->list);
++ kfree(f);
++ adapter->num_vlan_filters--;
++ } else {
++ f->state = IAVF_VLAN_REMOVE;
++ iavf_schedule_aq_request(adapter,
++ IAVF_FLAG_AQ_DEL_VLAN_FILTER);
++ }
+ }
+
+ spin_unlock_bh(&adapter->mac_vlan_list_lock);
+--
+2.39.5
+
--- /dev/null
+From 4f6516d9e6c067fc5dd73282af64853c2373e856 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2024 17:56:29 +0000
+Subject: inetpeer: do not get a refcount in inet_getpeer()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit a853c609504e2d1d83e71285e3622fda1f1451d8 ]
+
+All inet_getpeer() callers except ip4_frag_init() don't need
+to acquire a permanent refcount on the inetpeer.
+
+They can switch to full RCU protection.
+
+Move the refcount_inc_not_zero() into ip4_frag_init(),
+so that all the other callers no longer have to
+perform a pair of expensive atomic operations on
+a possibly contended cache line.
+
+inet_putpeer() no longer needs to be exported.
+
+After this patch, my DUT can receive 8,400,000 UDP packets
+per second targeting closed ports, using 50% less cpu cycles
+than before.
+
+Also change two calls to l3mdev_master_ifindex() by
+l3mdev_master_ifindex_rcu() (Ido ideas)
+
+Fixes: 8c2bd38b95f7 ("icmp: change the order of rate limits")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20241215175629.1248773-5-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/icmp.c | 9 ++++-----
+ net/ipv4/inetpeer.c | 8 ++------
+ net/ipv4/ip_fragment.c | 15 ++++++++++-----
+ net/ipv4/route.c | 15 ++++++++-------
+ net/ipv6/icmp.c | 4 ++--
+ net/ipv6/ip6_output.c | 4 ++--
+ net/ipv6/ndisc.c | 6 ++++--
+ 7 files changed, 32 insertions(+), 29 deletions(-)
+
+diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
+index 203734e29d462..a6adf6a2ec4b5 100644
+--- a/net/ipv4/icmp.c
++++ b/net/ipv4/icmp.c
+@@ -316,7 +316,6 @@ static bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt,
+ struct dst_entry *dst = &rt->dst;
+ struct inet_peer *peer;
+ bool rc = true;
+- int vif;
+
+ if (!apply_ratelimit)
+ return true;
+@@ -325,12 +324,12 @@ static bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt,
+ if (dst->dev && (dst->dev->flags&IFF_LOOPBACK))
+ goto out;
+
+- vif = l3mdev_master_ifindex(dst->dev);
+- peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr, vif);
++ rcu_read_lock();
++ peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr,
++ l3mdev_master_ifindex_rcu(dst->dev));
+ rc = inet_peer_xrlim_allow(peer,
+ READ_ONCE(net->ipv4.sysctl_icmp_ratelimit));
+- if (peer)
+- inet_putpeer(peer);
++ rcu_read_unlock();
+ out:
+ if (!rc)
+ __ICMP_INC_STATS(net, ICMP_MIB_RATELIMITHOST);
+diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
+index 596e2c3a8551f..23896b6b8417d 100644
+--- a/net/ipv4/inetpeer.c
++++ b/net/ipv4/inetpeer.c
+@@ -112,8 +112,6 @@ static struct inet_peer *lookup(const struct inetpeer_addr *daddr,
+ p = rb_entry(parent, struct inet_peer, rb_node);
+ cmp = inetpeer_addr_cmp(daddr, &p->daddr);
+ if (cmp == 0) {
+- if (!refcount_inc_not_zero(&p->refcnt))
+- break;
+ now = jiffies;
+ if (READ_ONCE(p->dtime) != now)
+ WRITE_ONCE(p->dtime, now);
+@@ -177,6 +175,7 @@ static void inet_peer_gc(struct inet_peer_base *base,
+ }
+ }
+
++/* Must be called under RCU : No refcount change is done here. */
+ struct inet_peer *inet_getpeer(struct inet_peer_base *base,
+ const struct inetpeer_addr *daddr)
+ {
+@@ -187,10 +186,8 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base,
+ /* Attempt a lockless lookup first.
+ * Because of a concurrent writer, we might not find an existing entry.
+ */
+- rcu_read_lock();
+ seq = read_seqbegin(&base->lock);
+ p = lookup(daddr, base, seq, NULL, &gc_cnt, &parent, &pp);
+- rcu_read_unlock();
+
+ if (p)
+ return p;
+@@ -208,7 +205,7 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base,
+ if (p) {
+ p->daddr = *daddr;
+ p->dtime = (__u32)jiffies;
+- refcount_set(&p->refcnt, 2);
++ refcount_set(&p->refcnt, 1);
+ atomic_set(&p->rid, 0);
+ p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW;
+ p->rate_tokens = 0;
+@@ -236,7 +233,6 @@ void inet_putpeer(struct inet_peer *p)
+ if (refcount_dec_and_test(&p->refcnt))
+ call_rcu(&p->rcu, inetpeer_free_rcu);
+ }
+-EXPORT_SYMBOL_GPL(inet_putpeer);
+
+ /*
+ * Check transmit rate limitation for given message.
+diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
+index 1427a94fc77a0..0ed999fdca2d7 100644
+--- a/net/ipv4/ip_fragment.c
++++ b/net/ipv4/ip_fragment.c
+@@ -82,15 +82,20 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
+ static void ip4_frag_init(struct inet_frag_queue *q, const void *a)
+ {
+ struct ipq *qp = container_of(q, struct ipq, q);
+- struct net *net = q->fqdir->net;
+-
+ const struct frag_v4_compare_key *key = a;
++ struct net *net = q->fqdir->net;
++ struct inet_peer *p = NULL;
+
+ q->key.v4 = *key;
+ qp->ecn = 0;
+- qp->peer = q->fqdir->max_dist ?
+- inet_getpeer_v4(net->ipv4.peers, key->saddr, key->vif) :
+- NULL;
++ if (q->fqdir->max_dist) {
++ rcu_read_lock();
++ p = inet_getpeer_v4(net->ipv4.peers, key->saddr, key->vif);
++ if (p && !refcount_inc_not_zero(&p->refcnt))
++ p = NULL;
++ rcu_read_unlock();
++ }
++ qp->peer = p;
+ }
+
+ static void ip4_frag_free(struct inet_frag_queue *q)
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index ae83b86fb209d..f877a96fd1eb5 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -882,11 +882,11 @@ void ip_rt_send_redirect(struct sk_buff *skb)
+ }
+ log_martians = IN_DEV_LOG_MARTIANS(in_dev);
+ vif = l3mdev_master_ifindex_rcu(rt->dst.dev);
+- rcu_read_unlock();
+
+ net = dev_net(rt->dst.dev);
+ peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr, vif);
+ if (!peer) {
++ rcu_read_unlock();
+ icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST,
+ rt_nexthop(rt, ip_hdr(skb)->daddr));
+ return;
+@@ -905,7 +905,7 @@ void ip_rt_send_redirect(struct sk_buff *skb)
+ */
+ if (peer->n_redirects >= ip_rt_redirect_number) {
+ peer->rate_last = jiffies;
+- goto out_put_peer;
++ goto out_unlock;
+ }
+
+ /* Check for load limit; set rate_last to the latest sent
+@@ -926,8 +926,8 @@ void ip_rt_send_redirect(struct sk_buff *skb)
+ &ip_hdr(skb)->saddr, inet_iif(skb),
+ &ip_hdr(skb)->daddr, &gw);
+ }
+-out_put_peer:
+- inet_putpeer(peer);
++out_unlock:
++ rcu_read_unlock();
+ }
+
+ static int ip_error(struct sk_buff *skb)
+@@ -987,9 +987,9 @@ static int ip_error(struct sk_buff *skb)
+ break;
+ }
+
++ rcu_read_lock();
+ peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr,
+- l3mdev_master_ifindex(skb->dev));
+-
++ l3mdev_master_ifindex_rcu(skb->dev));
+ send = true;
+ if (peer) {
+ now = jiffies;
+@@ -1001,8 +1001,9 @@ static int ip_error(struct sk_buff *skb)
+ peer->rate_tokens -= ip_rt_error_cost;
+ else
+ send = false;
+- inet_putpeer(peer);
+ }
++ rcu_read_unlock();
++
+ if (send)
+ icmp_send(skb, ICMP_DEST_UNREACH, code, 0);
+
+diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
+index ad34482186a9c..7d88fd314c390 100644
+--- a/net/ipv6/icmp.c
++++ b/net/ipv6/icmp.c
+@@ -222,10 +222,10 @@ static bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
+ if (rt->rt6i_dst.plen < 128)
+ tmo >>= ((128 - rt->rt6i_dst.plen)>>5);
+
++ rcu_read_lock();
+ peer = inet_getpeer_v6(net->ipv6.peers, &fl6->daddr);
+ res = inet_peer_xrlim_allow(peer, tmo);
+- if (peer)
+- inet_putpeer(peer);
++ rcu_read_unlock();
+ }
+ if (!res)
+ __ICMP6_INC_STATS(net, ip6_dst_idev(dst),
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 5332aeddf9277..d7f7a714bd232 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -610,6 +610,7 @@ int ip6_forward(struct sk_buff *skb)
+ else
+ target = &hdr->daddr;
+
++ rcu_read_lock();
+ peer = inet_getpeer_v6(net->ipv6.peers, &hdr->daddr);
+
+ /* Limit redirects both by destination (here)
+@@ -617,8 +618,7 @@ int ip6_forward(struct sk_buff *skb)
+ */
+ if (inet_peer_xrlim_allow(peer, 1*HZ))
+ ndisc_send_redirect(skb, target);
+- if (peer)
+- inet_putpeer(peer);
++ rcu_read_unlock();
+ } else {
+ int addrtype = ipv6_addr_type(&hdr->saddr);
+
+diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
+index d1eb0e324b7c0..44d3e6ab0c7d4 100644
+--- a/net/ipv6/ndisc.c
++++ b/net/ipv6/ndisc.c
+@@ -1721,10 +1721,12 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
+ "Redirect: destination is not a neighbour\n");
+ goto release;
+ }
++
++ rcu_read_lock();
+ peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr);
+ ret = inet_peer_xrlim_allow(peer, 1*HZ);
+- if (peer)
+- inet_putpeer(peer);
++ rcu_read_unlock();
++
+ if (!ret)
+ goto release;
+
+--
+2.39.5
+
--- /dev/null
+From 4d1c54a454dafcf6163e57cdc6892aa5056f17c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2024 17:56:27 +0000
+Subject: inetpeer: remove create argument of inet_getpeer()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 7a596a50c4a4eab946aec149171c72321b4934aa ]
+
+All callers of inet_getpeer() want to create an inetpeer.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20241215175629.1248773-3-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: a853c609504e ("inetpeer: do not get a refcount in inet_getpeer()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/inetpeer.h | 7 +++----
+ net/ipv4/inetpeer.c | 11 ++---------
+ 2 files changed, 5 insertions(+), 13 deletions(-)
+
+diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
+index 6f51f81d6cb19..f475757daafba 100644
+--- a/include/net/inetpeer.h
++++ b/include/net/inetpeer.h
+@@ -96,8 +96,7 @@ static inline struct in6_addr *inetpeer_get_addr_v6(struct inetpeer_addr *iaddr)
+
+ /* can be called with or without local BH being disabled */
+ struct inet_peer *inet_getpeer(struct inet_peer_base *base,
+- const struct inetpeer_addr *daddr,
+- int create);
++ const struct inetpeer_addr *daddr);
+
+ static inline struct inet_peer *inet_getpeer_v4(struct inet_peer_base *base,
+ __be32 v4daddr,
+@@ -108,7 +107,7 @@ static inline struct inet_peer *inet_getpeer_v4(struct inet_peer_base *base,
+ daddr.a4.addr = v4daddr;
+ daddr.a4.vif = vif;
+ daddr.family = AF_INET;
+- return inet_getpeer(base, &daddr, 1);
++ return inet_getpeer(base, &daddr);
+ }
+
+ static inline struct inet_peer *inet_getpeer_v6(struct inet_peer_base *base,
+@@ -118,7 +117,7 @@ static inline struct inet_peer *inet_getpeer_v6(struct inet_peer_base *base,
+
+ daddr.a6 = *v6daddr;
+ daddr.family = AF_INET6;
+- return inet_getpeer(base, &daddr, 1);
++ return inet_getpeer(base, &daddr);
+ }
+
+ static inline int inetpeer_addr_cmp(const struct inetpeer_addr *a,
+diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
+index e9fed83e9b3cc..5670571ee5fbe 100644
+--- a/net/ipv4/inetpeer.c
++++ b/net/ipv4/inetpeer.c
+@@ -177,13 +177,11 @@ static void inet_peer_gc(struct inet_peer_base *base,
+ }
+
+ struct inet_peer *inet_getpeer(struct inet_peer_base *base,
+- const struct inetpeer_addr *daddr,
+- int create)
++ const struct inetpeer_addr *daddr)
+ {
+ struct inet_peer *p, *gc_stack[PEER_MAX_GC];
+ struct rb_node **pp, *parent;
+ unsigned int gc_cnt, seq;
+- int invalidated;
+
+ /* Attempt a lockless lookup first.
+ * Because of a concurrent writer, we might not find an existing entry.
+@@ -191,16 +189,11 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base,
+ rcu_read_lock();
+ seq = read_seqbegin(&base->lock);
+ p = lookup(daddr, base, seq, NULL, &gc_cnt, &parent, &pp);
+- invalidated = read_seqretry(&base->lock, seq);
+ rcu_read_unlock();
+
+ if (p)
+ return p;
+
+- /* If no writer did a change during our lookup, we can return early. */
+- if (!create && !invalidated)
+- return NULL;
+-
+ /* retry an exact lookup, taking the lock before.
+ * At least, nodes should be hot in our cache.
+ */
+@@ -209,7 +202,7 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base,
+
+ gc_cnt = 0;
+ p = lookup(daddr, base, seq, gc_stack, &gc_cnt, &parent, &pp);
+- if (!p && create) {
++ if (!p) {
+ p = kmem_cache_alloc(peer_cachep, GFP_ATOMIC);
+ if (p) {
+ p->daddr = *daddr;
+--
+2.39.5
+
--- /dev/null
+From ee0b2d761480e085f7b5eb46d116aae17f21bd16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2024 17:56:26 +0000
+Subject: inetpeer: remove create argument of inet_getpeer_v[46]()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 661cd8fc8e9039819ca0c22e0add52b632240a9e ]
+
+All callers of inet_getpeer_v4() and inet_getpeer_v6()
+want to create an inetpeer.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20241215175629.1248773-2-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: a853c609504e ("inetpeer: do not get a refcount in inet_getpeer()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/inetpeer.h | 9 ++++-----
+ net/ipv4/icmp.c | 2 +-
+ net/ipv4/ip_fragment.c | 2 +-
+ net/ipv4/route.c | 4 ++--
+ net/ipv6/icmp.c | 2 +-
+ net/ipv6/ip6_output.c | 2 +-
+ net/ipv6/ndisc.c | 2 +-
+ 7 files changed, 11 insertions(+), 12 deletions(-)
+
+diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
+index 74ff688568a0c..6f51f81d6cb19 100644
+--- a/include/net/inetpeer.h
++++ b/include/net/inetpeer.h
+@@ -101,25 +101,24 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base,
+
+ static inline struct inet_peer *inet_getpeer_v4(struct inet_peer_base *base,
+ __be32 v4daddr,
+- int vif, int create)
++ int vif)
+ {
+ struct inetpeer_addr daddr;
+
+ daddr.a4.addr = v4daddr;
+ daddr.a4.vif = vif;
+ daddr.family = AF_INET;
+- return inet_getpeer(base, &daddr, create);
++ return inet_getpeer(base, &daddr, 1);
+ }
+
+ static inline struct inet_peer *inet_getpeer_v6(struct inet_peer_base *base,
+- const struct in6_addr *v6daddr,
+- int create)
++ const struct in6_addr *v6daddr)
+ {
+ struct inetpeer_addr daddr;
+
+ daddr.a6 = *v6daddr;
+ daddr.family = AF_INET6;
+- return inet_getpeer(base, &daddr, create);
++ return inet_getpeer(base, &daddr, 1);
+ }
+
+ static inline int inetpeer_addr_cmp(const struct inetpeer_addr *a,
+diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
+index 9dffdd876fef5..203734e29d462 100644
+--- a/net/ipv4/icmp.c
++++ b/net/ipv4/icmp.c
+@@ -326,7 +326,7 @@ static bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt,
+ goto out;
+
+ vif = l3mdev_master_ifindex(dst->dev);
+- peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr, vif, 1);
++ peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr, vif);
+ rc = inet_peer_xrlim_allow(peer,
+ READ_ONCE(net->ipv4.sysctl_icmp_ratelimit));
+ if (peer)
+diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
+index 6c309c1ec3b0f..1427a94fc77a0 100644
+--- a/net/ipv4/ip_fragment.c
++++ b/net/ipv4/ip_fragment.c
+@@ -89,7 +89,7 @@ static void ip4_frag_init(struct inet_frag_queue *q, const void *a)
+ q->key.v4 = *key;
+ qp->ecn = 0;
+ qp->peer = q->fqdir->max_dist ?
+- inet_getpeer_v4(net->ipv4.peers, key->saddr, key->vif, 1) :
++ inet_getpeer_v4(net->ipv4.peers, key->saddr, key->vif) :
+ NULL;
+ }
+
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index fda88894d0205..ae83b86fb209d 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -885,7 +885,7 @@ void ip_rt_send_redirect(struct sk_buff *skb)
+ rcu_read_unlock();
+
+ net = dev_net(rt->dst.dev);
+- peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr, vif, 1);
++ peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr, vif);
+ if (!peer) {
+ icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST,
+ rt_nexthop(rt, ip_hdr(skb)->daddr));
+@@ -988,7 +988,7 @@ static int ip_error(struct sk_buff *skb)
+ }
+
+ peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr,
+- l3mdev_master_ifindex(skb->dev), 1);
++ l3mdev_master_ifindex(skb->dev));
+
+ send = true;
+ if (peer) {
+diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
+index ed8cdf7b8b11e..ad34482186a9c 100644
+--- a/net/ipv6/icmp.c
++++ b/net/ipv6/icmp.c
+@@ -222,7 +222,7 @@ static bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
+ if (rt->rt6i_dst.plen < 128)
+ tmo >>= ((128 - rt->rt6i_dst.plen)>>5);
+
+- peer = inet_getpeer_v6(net->ipv6.peers, &fl6->daddr, 1);
++ peer = inet_getpeer_v6(net->ipv6.peers, &fl6->daddr);
+ res = inet_peer_xrlim_allow(peer, tmo);
+ if (peer)
+ inet_putpeer(peer);
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 4082470803615..5332aeddf9277 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -610,7 +610,7 @@ int ip6_forward(struct sk_buff *skb)
+ else
+ target = &hdr->daddr;
+
+- peer = inet_getpeer_v6(net->ipv6.peers, &hdr->daddr, 1);
++ peer = inet_getpeer_v6(net->ipv6.peers, &hdr->daddr);
+
+ /* Limit redirects both by destination (here)
+ and by source (inside ndisc_send_redirect)
+diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
+index cfb4cf6e66549..d1eb0e324b7c0 100644
+--- a/net/ipv6/ndisc.c
++++ b/net/ipv6/ndisc.c
+@@ -1721,7 +1721,7 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
+ "Redirect: destination is not a neighbour\n");
+ goto release;
+ }
+- peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr, 1);
++ peer = inet_getpeer_v6(net->ipv6.peers, &ipv6_hdr(skb)->saddr);
+ ret = inet_peer_xrlim_allow(peer, 1*HZ);
+ if (peer)
+ inet_putpeer(peer);
+--
+2.39.5
+
--- /dev/null
+From 5bd45ad2e48071f4a6e573fb0708aea01466417e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2024 17:56:28 +0000
+Subject: inetpeer: update inetpeer timestamp in inet_getpeer()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 50b362f21d6c10b0f7939c1482c6a1b43da82f1a ]
+
+inet_putpeer() will be removed in the following patch,
+because we will no longer use refcounts.
+
+Update inetpeer timestamp (p->dtime) at lookup time.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20241215175629.1248773-4-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: a853c609504e ("inetpeer: do not get a refcount in inet_getpeer()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/inetpeer.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
+index 5670571ee5fbe..596e2c3a8551f 100644
+--- a/net/ipv4/inetpeer.c
++++ b/net/ipv4/inetpeer.c
+@@ -98,6 +98,7 @@ static struct inet_peer *lookup(const struct inetpeer_addr *daddr,
+ {
+ struct rb_node **pp, *parent, *next;
+ struct inet_peer *p;
++ u32 now;
+
+ pp = &base->rb_root.rb_node;
+ parent = NULL;
+@@ -113,6 +114,9 @@ static struct inet_peer *lookup(const struct inetpeer_addr *daddr,
+ if (cmp == 0) {
+ if (!refcount_inc_not_zero(&p->refcnt))
+ break;
++ now = jiffies;
++ if (READ_ONCE(p->dtime) != now)
++ WRITE_ONCE(p->dtime, now);
+ return p;
+ }
+ if (gc_stack) {
+@@ -158,9 +162,6 @@ static void inet_peer_gc(struct inet_peer_base *base,
+ for (i = 0; i < gc_cnt; i++) {
+ p = gc_stack[i];
+
+- /* The READ_ONCE() pairs with the WRITE_ONCE()
+- * in inet_putpeer()
+- */
+ delta = (__u32)jiffies - READ_ONCE(p->dtime);
+
+ if (delta < ttl || !refcount_dec_if_one(&p->refcnt))
+@@ -232,11 +233,6 @@ EXPORT_SYMBOL_GPL(inet_getpeer);
+
+ void inet_putpeer(struct inet_peer *p)
+ {
+- /* The WRITE_ONCE() pairs with itself (we run lockless)
+- * and the READ_ONCE() in inet_peer_gc()
+- */
+- WRITE_ONCE(p->dtime, (__u32)jiffies);
+-
+ if (refcount_dec_and_test(&p->refcnt))
+ call_rcu(&p->rcu, inetpeer_free_rcu);
+ }
+--
+2.39.5
+
--- /dev/null
+From 134c958dbaa3737d26bf28a52a4f99ca1351ea1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2025 22:38:20 +0000
+Subject: iommufd/iova_bitmap: Fix shift-out-of-bounds in
+ iova_bitmap_offset_to_index()
+
+From: Qasim Ijaz <qasdev00@gmail.com>
+
+[ Upstream commit e24c1551059268b37f6f40639883eafb281b8b9c ]
+
+Resolve a UBSAN shift-out-of-bounds issue in iova_bitmap_offset_to_index()
+where shifting the constant "1" (of type int) by bitmap->mapped.pgshift
+(an unsigned long value) could result in undefined behavior.
+
+The constant "1" defaults to a 32-bit "int", and when "pgshift" exceeds
+31 (e.g., pgshift = 63) the shift operation overflows, as the result
+cannot be represented in a 32-bit type.
+
+To resolve this, the constant is updated to "1UL", promoting it to an
+unsigned long type to match the operand's type.
+
+Fixes: 58ccf0190d19 ("vfio: Add an IOVA bitmap support")
+Link: https://patch.msgid.link/r/20250113223820.10713-1-qasdev00@gmail.com
+Reported-by: syzbot <syzbot+85992ace37d5b7b51635@syzkaller.appspotmail.com>
+Closes: https://syzkaller.appspot.com/bug?extid=85992ace37d5b7b51635
+Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
+Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/iova_bitmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/vfio/iova_bitmap.c b/drivers/vfio/iova_bitmap.c
+index dfab5b742191a..76ef63b940d96 100644
+--- a/drivers/vfio/iova_bitmap.c
++++ b/drivers/vfio/iova_bitmap.c
+@@ -126,7 +126,7 @@ struct iova_bitmap {
+ static unsigned long iova_bitmap_offset_to_index(struct iova_bitmap *bitmap,
+ unsigned long iova)
+ {
+- unsigned long pgsize = 1 << bitmap->mapped.pgshift;
++ unsigned long pgsize = 1UL << bitmap->mapped.pgshift;
+
+ return iova / (BITS_PER_TYPE(*bitmap->bitmap) * pgsize);
+ }
+--
+2.39.5
+
--- /dev/null
+From 0700010dce56b3fd8b9ce22b92ab0688f385a18b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2024 17:44:19 +0800
+Subject: ipmi: ipmb: Add check devm_kasprintf() returned value
+
+From: Charles Han <hanchunchao@inspur.com>
+
+[ Upstream commit 2378bd0b264ad3a1f76bd957caf33ee0c7945351 ]
+
+devm_kasprintf() can return a NULL pointer on failure but this
+returned value is not checked.
+
+Fixes: 51bd6f291583 ("Add support for IPMB driver")
+Signed-off-by: Charles Han <hanchunchao@inspur.com>
+Message-ID: <20240926094419.25900-1-hanchunchao@inspur.com>
+Signed-off-by: Corey Minyard <corey@minyard.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmb_dev_int.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/char/ipmi/ipmb_dev_int.c b/drivers/char/ipmi/ipmb_dev_int.c
+index a0e9e80d92eeb..d6a4b1671d5bc 100644
+--- a/drivers/char/ipmi/ipmb_dev_int.c
++++ b/drivers/char/ipmi/ipmb_dev_int.c
+@@ -321,6 +321,9 @@ static int ipmb_probe(struct i2c_client *client)
+ ipmb_dev->miscdev.name = devm_kasprintf(&client->dev, GFP_KERNEL,
+ "%s%d", "ipmb-",
+ client->adapter->nr);
++ if (!ipmb_dev->miscdev.name)
++ return -ENOMEM;
++
+ ipmb_dev->miscdev.fops = &ipmb_fops;
+ ipmb_dev->miscdev.parent = &client->dev;
+ ret = misc_register(&ipmb_dev->miscdev);
+--
+2.39.5
+
--- /dev/null
+From 7d8ea4c8caab486d8d3804801e940c69c2c7d56b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jan 2025 18:12:41 +0000
+Subject: ipmr: do not call mr_mfc_uses_dev() for unres entries
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 15a901361ec3fb1c393f91880e1cbf24ec0a88bd ]
+
+syzbot found that calling mr_mfc_uses_dev() for unres entries
+would crash [1], because c->mfc_un.res.minvif / c->mfc_un.res.maxvif
+alias to "struct sk_buff_head unresolved", which contain two pointers.
+
+This code never worked, lets remove it.
+
+[1]
+Unable to handle kernel paging request at virtual address ffff5fff2d536613
+KASAN: maybe wild-memory-access in range [0xfffefff96a9b3098-0xfffefff96a9b309f]
+Modules linked in:
+CPU: 1 UID: 0 PID: 7321 Comm: syz.0.16 Not tainted 6.13.0-rc7-syzkaller-g1950a0af2d55 #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
+pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+ pc : mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline]
+ pc : mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334
+ lr : mr_mfc_uses_dev net/ipv4/ipmr_base.c:289 [inline]
+ lr : mr_table_dump+0x694/0x8b0 net/ipv4/ipmr_base.c:334
+Call trace:
+ mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline] (P)
+ mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334 (P)
+ mr_rtm_dumproute+0x254/0x454 net/ipv4/ipmr_base.c:382
+ ipmr_rtm_dumproute+0x248/0x4b4 net/ipv4/ipmr.c:2648
+ rtnl_dump_all+0x2e4/0x4e8 net/core/rtnetlink.c:4327
+ rtnl_dumpit+0x98/0x1d0 net/core/rtnetlink.c:6791
+ netlink_dump+0x4f0/0xbc0 net/netlink/af_netlink.c:2317
+ netlink_recvmsg+0x56c/0xe64 net/netlink/af_netlink.c:1973
+ sock_recvmsg_nosec net/socket.c:1033 [inline]
+ sock_recvmsg net/socket.c:1055 [inline]
+ sock_read_iter+0x2d8/0x40c net/socket.c:1125
+ new_sync_read fs/read_write.c:484 [inline]
+ vfs_read+0x740/0x970 fs/read_write.c:565
+ ksys_read+0x15c/0x26c fs/read_write.c:708
+
+Fixes: cb167893f41e ("net: Plumb support for filtering ipv4 and ipv6 multicast route dumps")
+Reported-by: syzbot+5cfae50c0e5f2c500013@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/netdev/678fe2d1.050a0220.15cac.00b3.GAE@google.com/T/#u
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250121181241.841212-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ipmr_base.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/net/ipv4/ipmr_base.c b/net/ipv4/ipmr_base.c
+index f0af12a2f70bc..de98ce66d38f3 100644
+--- a/net/ipv4/ipmr_base.c
++++ b/net/ipv4/ipmr_base.c
+@@ -330,9 +330,6 @@ int mr_table_dump(struct mr_table *mrt, struct sk_buff *skb,
+ list_for_each_entry(mfc, &mrt->mfc_unres_queue, list) {
+ if (e < s_e)
+ goto next_entry2;
+- if (filter->dev &&
+- !mr_mfc_uses_dev(mrt, mfc, filter->dev))
+- goto next_entry2;
+
+ err = fill(mrt, skb, NETLINK_CB(cb->skb).portid,
+ cb->nlh->nlmsg_seq, mfc, RTM_NEWROUTE, flags);
+--
+2.39.5
+
--- /dev/null
+From 123587eb4164598163b92fd542b8145f7d0a2b79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Sep 2024 21:07:35 +0800
+Subject: ktest.pl: Remove unused declarations in run_bisect_test function
+
+From: Ba Jing <bajing@cmss.chinamobile.com>
+
+[ Upstream commit 776735b954f49f85fd19e1198efa421fae2ad77c ]
+
+Since $output and $ret are not used in the subsequent code, the declarations
+should be removed.
+
+Fixes: a75fececff3c ("ktest: Added sample.conf, new %default option format")
+Link: https://lore.kernel.org/20240902130735.6034-1-bajing@cmss.chinamobile.com
+Signed-off-by: Ba Jing <bajing@cmss.chinamobile.com>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/ktest/ktest.pl | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
+index 99e17a0a13649..f7f371a91ed97 100755
+--- a/tools/testing/ktest/ktest.pl
++++ b/tools/testing/ktest/ktest.pl
+@@ -2939,8 +2939,6 @@ sub run_bisect_test {
+
+ my $failed = 0;
+ my $result;
+- my $output;
+- my $ret;
+
+ $in_bisect = 1;
+
+--
+2.39.5
+
--- /dev/null
+From 6ddd8c2914835d8427c5409f00dccaaec75daa54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2025 16:39:13 +0100
+Subject: landlock: Handle weird files
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mickaël Salaün <mic@digikod.net>
+
+[ Upstream commit 49440290a0935f428a1e43a5ac8dc275a647ff80 ]
+
+A corrupted filesystem (e.g. bcachefs) might return weird files.
+Instead of throwing a warning and allowing access to such file, treat
+them as regular files.
+
+Cc: Dave Chinner <david@fromorbit.com>
+Cc: Kent Overstreet <kent.overstreet@linux.dev>
+Cc: Paul Moore <paul@paul-moore.com>
+Reported-by: syzbot+34b68f850391452207df@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/r/000000000000a65b35061cffca61@google.com
+Reported-by: syzbot+360866a59e3c80510a62@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/r/67379b3f.050a0220.85a0.0001.GAE@google.com
+Reported-by: Ubisectech Sirius <bugreport@ubisectech.com>
+Closes: https://lore.kernel.org/r/c426821d-8380-46c4-a494-7008bbd7dd13.bugreport@ubisectech.com
+Fixes: cb2c7d1a1776 ("landlock: Support filesystem access-control")
+Reviewed-by: Günther Noack <gnoack3000@gmail.com>
+Link: https://lore.kernel.org/r/20250110153918.241810-1-mic@digikod.net
+Signed-off-by: Mickaël Salaün <mic@digikod.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/landlock/fs.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/security/landlock/fs.c b/security/landlock/fs.c
+index 7b0e5976113c2..7b95afcc6b437 100644
+--- a/security/landlock/fs.c
++++ b/security/landlock/fs.c
+@@ -669,10 +669,6 @@ static inline access_mask_t get_mode_access(const umode_t mode)
+ switch (mode & S_IFMT) {
+ case S_IFLNK:
+ return LANDLOCK_ACCESS_FS_MAKE_SYM;
+- case 0:
+- /* A zero mode translates to S_IFREG. */
+- case S_IFREG:
+- return LANDLOCK_ACCESS_FS_MAKE_REG;
+ case S_IFDIR:
+ return LANDLOCK_ACCESS_FS_MAKE_DIR;
+ case S_IFCHR:
+@@ -683,9 +679,12 @@ static inline access_mask_t get_mode_access(const umode_t mode)
+ return LANDLOCK_ACCESS_FS_MAKE_FIFO;
+ case S_IFSOCK:
+ return LANDLOCK_ACCESS_FS_MAKE_SOCK;
++ case S_IFREG:
++ case 0:
++ /* A zero mode translates to S_IFREG. */
+ default:
+- WARN_ON_ONCE(1);
+- return 0;
++ /* Treats weird files as regular files. */
++ return LANDLOCK_ACCESS_FS_MAKE_REG;
+ }
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 011101288ff81151a2e1e511a5da671e47afb051 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2024 16:49:23 +0900
+Subject: leds: netxbig: Fix an OF node reference leak in
+ netxbig_leds_get_of_pdata()
+
+From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+
+[ Upstream commit 0508316be63bb735f59bdc8fe4527cadb62210ca ]
+
+netxbig_leds_get_of_pdata() does not release the OF node obtained by
+of_parse_phandle() when of_find_device_by_node() fails. Add an
+of_node_put() call to fix the leak.
+
+This bug was found by an experimental static analysis tool that I am
+developing.
+
+Fixes: 9af512e81964 ("leds: netxbig: Convert to use GPIO descriptors")
+Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+Link: https://lore.kernel.org/r/20241216074923.628509-1-joe@pf.is.s.u-tokyo.ac.jp
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-netxbig.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/leds/leds-netxbig.c b/drivers/leds/leds-netxbig.c
+index 77213b79f84d9..6692de0af68f1 100644
+--- a/drivers/leds/leds-netxbig.c
++++ b/drivers/leds/leds-netxbig.c
+@@ -440,6 +440,7 @@ static int netxbig_leds_get_of_pdata(struct device *dev,
+ }
+ gpio_ext_pdev = of_find_device_by_node(gpio_ext_np);
+ if (!gpio_ext_pdev) {
++ of_node_put(gpio_ext_np);
+ dev_err(dev, "Failed to find platform device for gpio-ext\n");
+ return -ENODEV;
+ }
+--
+2.39.5
+
--- /dev/null
+From f4b542fe6de7b70925fe1b4c15f2e1f02352c52d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2024 14:45:58 -0800
+Subject: libbpf: don't adjust USDT semaphore address if .stapsdt.base addr is
+ missing
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 98ebe5ef6f5c4517ba92fb3e56f95827ebea83fd ]
+
+USDT ELF note optionally can record an offset of .stapsdt.base, which is
+used to make adjustments to USDT target attach address. Currently,
+libbpf will do this address adjustment unconditionally if it finds
+.stapsdt.base ELF section in target binary. But there is a corner case
+where .stapsdt.base ELF section is present, but specific USDT note
+doesn't reference it. In such case, libbpf will basically just add base
+address and end up with absolutely incorrect USDT target address.
+
+This adjustment has to be done only if both .stapsdt.sema section is
+present and USDT note is recording a reference to it.
+
+Fixes: 74cc6311cec9 ("libbpf: Add USDT notes parsing and resolution logic")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20241121224558.796110-1-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/usdt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/lib/bpf/usdt.c b/tools/lib/bpf/usdt.c
+index af1cb30556b46..b8e83712a5d72 100644
+--- a/tools/lib/bpf/usdt.c
++++ b/tools/lib/bpf/usdt.c
+@@ -653,7 +653,7 @@ static int collect_usdt_targets(struct usdt_manager *man, Elf *elf, const char *
+ * [0] https://sourceware.org/systemtap/wiki/UserSpaceProbeImplementation
+ */
+ usdt_abs_ip = note.loc_addr;
+- if (base_addr)
++ if (base_addr && note.base_addr)
+ usdt_abs_ip += base_addr - note.base_addr;
+
+ /* When attaching uprobes (which is what USDTs basically are)
+--
+2.39.5
+
--- /dev/null
+From 4616f7584639e438cb98e6bb09d73361e8f00c9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2024 13:59:42 +0000
+Subject: libbpf: Fix segfault due to libelf functions not setting errno
+
+From: Quentin Monnet <qmo@kernel.org>
+
+[ Upstream commit e10500b69c3f3378f3dcfc8c2fe4cdb74fc844f5 ]
+
+Libelf functions do not set errno on failure. Instead, it relies on its
+internal _elf_errno value, that can be retrieved via elf_errno (or the
+corresponding message via elf_errmsg()). From "man libelf":
+
+ If a libelf function encounters an error it will set an internal
+ error code that can be retrieved with elf_errno. Each thread
+ maintains its own separate error code. The meaning of each error
+ code can be determined with elf_errmsg, which returns a string
+ describing the error.
+
+As a consequence, libbpf should not return -errno when a function from
+libelf fails, because an empty value will not be interpreted as an error
+and won't prevent the program to stop. This is visible in
+bpf_linker__add_file(), for example, where we call a succession of
+functions that rely on libelf:
+
+ err = err ?: linker_load_obj_file(linker, filename, opts, &obj);
+ err = err ?: linker_append_sec_data(linker, &obj);
+ err = err ?: linker_append_elf_syms(linker, &obj);
+ err = err ?: linker_append_elf_relos(linker, &obj);
+ err = err ?: linker_append_btf(linker, &obj);
+ err = err ?: linker_append_btf_ext(linker, &obj);
+
+If the object file that we try to process is not, in fact, a correct
+object file, linker_load_obj_file() may fail with errno not being set,
+and return 0. In this case we attempt to run linker_append_elf_sysms()
+and may segfault.
+
+This can happen (and was discovered) with bpftool:
+
+ $ bpftool gen object output.o sample_ret0.bpf.c
+ libbpf: failed to get ELF header for sample_ret0.bpf.c: invalid `Elf' handle
+ zsh: segmentation fault (core dumped) bpftool gen object output.o sample_ret0.bpf.c
+
+Fix the issue by returning a non-null error code (-EINVAL) when libelf
+functions fail.
+
+Fixes: faf6ed321cf6 ("libbpf: Add BPF static linker APIs")
+Signed-off-by: Quentin Monnet <qmo@kernel.org>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20241205135942.65262-1-qmo@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/linker.c | 22 ++++++++--------------
+ 1 file changed, 8 insertions(+), 14 deletions(-)
+
+diff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c
+index 7d28f21b007fc..5a99bf6af445b 100644
+--- a/tools/lib/bpf/linker.c
++++ b/tools/lib/bpf/linker.c
+@@ -567,17 +567,15 @@ static int linker_load_obj_file(struct bpf_linker *linker, const char *filename,
+ }
+ obj->elf = elf_begin(obj->fd, ELF_C_READ_MMAP, NULL);
+ if (!obj->elf) {
+- err = -errno;
+ pr_warn_elf("failed to parse ELF file '%s'", filename);
+- return err;
++ return -EINVAL;
+ }
+
+ /* Sanity check ELF file high-level properties */
+ ehdr = elf64_getehdr(obj->elf);
+ if (!ehdr) {
+- err = -errno;
+ pr_warn_elf("failed to get ELF header for %s", filename);
+- return err;
++ return -EINVAL;
+ }
+ if (ehdr->e_ident[EI_DATA] != host_endianness) {
+ err = -EOPNOTSUPP;
+@@ -593,9 +591,8 @@ static int linker_load_obj_file(struct bpf_linker *linker, const char *filename,
+ }
+
+ if (elf_getshdrstrndx(obj->elf, &obj->shstrs_sec_idx)) {
+- err = -errno;
+ pr_warn_elf("failed to get SHSTRTAB section index for %s", filename);
+- return err;
++ return -EINVAL;
+ }
+
+ scn = NULL;
+@@ -605,26 +602,23 @@ static int linker_load_obj_file(struct bpf_linker *linker, const char *filename,
+
+ shdr = elf64_getshdr(scn);
+ if (!shdr) {
+- err = -errno;
+ pr_warn_elf("failed to get section #%zu header for %s",
+ sec_idx, filename);
+- return err;
++ return -EINVAL;
+ }
+
+ sec_name = elf_strptr(obj->elf, obj->shstrs_sec_idx, shdr->sh_name);
+ if (!sec_name) {
+- err = -errno;
+ pr_warn_elf("failed to get section #%zu name for %s",
+ sec_idx, filename);
+- return err;
++ return -EINVAL;
+ }
+
+ data = elf_getdata(scn, 0);
+ if (!data) {
+- err = -errno;
+ pr_warn_elf("failed to get section #%zu (%s) data from %s",
+ sec_idx, sec_name, filename);
+- return err;
++ return -EINVAL;
+ }
+
+ sec = add_src_sec(obj, sec_name);
+@@ -2597,14 +2591,14 @@ int bpf_linker__finalize(struct bpf_linker *linker)
+
+ /* Finalize ELF layout */
+ if (elf_update(linker->elf, ELF_C_NULL) < 0) {
+- err = -errno;
++ err = -EINVAL;
+ pr_warn_elf("failed to finalize ELF layout");
+ return libbpf_err(err);
+ }
+
+ /* Write out final ELF contents */
+ if (elf_update(linker->elf, ELF_C_WRITE) < 0) {
+- err = -errno;
++ err = -EINVAL;
+ pr_warn_elf("failed to write ELF contents");
+ return libbpf_err(err);
+ }
+--
+2.39.5
+
--- /dev/null
+From 3815796b5d685fb8570abbe8514d080b84405e1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Nov 2024 19:18:17 +0000
+Subject: media: camif-core: Add check for clk_enable()
+
+From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+
+[ Upstream commit 77ed2470ac09c2b0a33cf3f98cc51d18ba9ed976 ]
+
+Add check for the return value of clk_enable() to gurantee the success.
+
+Fixes: babde1c243b2 ("[media] V4L: Add driver for S3C24XX/S3C64XX SoC series camera interface")
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../media/platform/samsung/s3c-camif/camif-core.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/samsung/s3c-camif/camif-core.c b/drivers/media/platform/samsung/s3c-camif/camif-core.c
+index 6e8ef86566b78..38c586b01b174 100644
+--- a/drivers/media/platform/samsung/s3c-camif/camif-core.c
++++ b/drivers/media/platform/samsung/s3c-camif/camif-core.c
+@@ -528,10 +528,19 @@ static int s3c_camif_remove(struct platform_device *pdev)
+ static int s3c_camif_runtime_resume(struct device *dev)
+ {
+ struct camif_dev *camif = dev_get_drvdata(dev);
++ int ret;
++
++ ret = clk_enable(camif->clock[CLK_GATE]);
++ if (ret)
++ return ret;
+
+- clk_enable(camif->clock[CLK_GATE]);
+ /* null op on s3c244x */
+- clk_enable(camif->clock[CLK_CAM]);
++ ret = clk_enable(camif->clock[CLK_CAM]);
++ if (ret) {
++ clk_disable(camif->clock[CLK_GATE]);
++ return ret;
++ }
++
+ return 0;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 30122c440a68a97226d27f1ae0e29886774b9924 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2024 22:45:46 +0100
+Subject: media: i2c: imx412: Add missing newline to prints
+
+From: Luca Weiss <luca.weiss@fairphone.com>
+
+[ Upstream commit 33f4a7fba7229232e294f4794503283e44cd03f2 ]
+
+Add trailing \n to dev_dbg and dev_err prints where missing.
+
+Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
+Fixes: 9214e86c0cc1 ("media: i2c: Add imx412 camera sensor driver")
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/imx412.c | 42 +++++++++++++++++++-------------------
+ 1 file changed, 21 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/media/i2c/imx412.c b/drivers/media/i2c/imx412.c
+index 77fa6253ba3e3..ab543bb8a6214 100644
+--- a/drivers/media/i2c/imx412.c
++++ b/drivers/media/i2c/imx412.c
+@@ -549,7 +549,7 @@ static int imx412_update_exp_gain(struct imx412 *imx412, u32 exposure, u32 gain)
+
+ lpfr = imx412->vblank + imx412->cur_mode->height;
+
+- dev_dbg(imx412->dev, "Set exp %u, analog gain %u, lpfr %u",
++ dev_dbg(imx412->dev, "Set exp %u, analog gain %u, lpfr %u\n",
+ exposure, gain, lpfr);
+
+ ret = imx412_write_reg(imx412, IMX412_REG_HOLD, 1, 1);
+@@ -596,7 +596,7 @@ static int imx412_set_ctrl(struct v4l2_ctrl *ctrl)
+ case V4L2_CID_VBLANK:
+ imx412->vblank = imx412->vblank_ctrl->val;
+
+- dev_dbg(imx412->dev, "Received vblank %u, new lpfr %u",
++ dev_dbg(imx412->dev, "Received vblank %u, new lpfr %u\n",
+ imx412->vblank,
+ imx412->vblank + imx412->cur_mode->height);
+
+@@ -615,7 +615,7 @@ static int imx412_set_ctrl(struct v4l2_ctrl *ctrl)
+ exposure = ctrl->val;
+ analog_gain = imx412->again_ctrl->val;
+
+- dev_dbg(imx412->dev, "Received exp %u, analog gain %u",
++ dev_dbg(imx412->dev, "Received exp %u, analog gain %u\n",
+ exposure, analog_gain);
+
+ ret = imx412_update_exp_gain(imx412, exposure, analog_gain);
+@@ -624,7 +624,7 @@ static int imx412_set_ctrl(struct v4l2_ctrl *ctrl)
+
+ break;
+ default:
+- dev_err(imx412->dev, "Invalid control %d", ctrl->id);
++ dev_err(imx412->dev, "Invalid control %d\n", ctrl->id);
+ ret = -EINVAL;
+ }
+
+@@ -805,14 +805,14 @@ static int imx412_start_streaming(struct imx412 *imx412)
+ ret = imx412_write_regs(imx412, reg_list->regs,
+ reg_list->num_of_regs);
+ if (ret) {
+- dev_err(imx412->dev, "fail to write initial registers");
++ dev_err(imx412->dev, "fail to write initial registers\n");
+ return ret;
+ }
+
+ /* Setup handler will write actual exposure and gain */
+ ret = __v4l2_ctrl_handler_setup(imx412->sd.ctrl_handler);
+ if (ret) {
+- dev_err(imx412->dev, "fail to setup handler");
++ dev_err(imx412->dev, "fail to setup handler\n");
+ return ret;
+ }
+
+@@ -823,7 +823,7 @@ static int imx412_start_streaming(struct imx412 *imx412)
+ ret = imx412_write_reg(imx412, IMX412_REG_MODE_SELECT,
+ 1, IMX412_MODE_STREAMING);
+ if (ret) {
+- dev_err(imx412->dev, "fail to start streaming");
++ dev_err(imx412->dev, "fail to start streaming\n");
+ return ret;
+ }
+
+@@ -904,7 +904,7 @@ static int imx412_detect(struct imx412 *imx412)
+ return ret;
+
+ if (val != IMX412_ID) {
+- dev_err(imx412->dev, "chip id mismatch: %x!=%x",
++ dev_err(imx412->dev, "chip id mismatch: %x!=%x\n",
+ IMX412_ID, val);
+ return -ENXIO;
+ }
+@@ -936,7 +936,7 @@ static int imx412_parse_hw_config(struct imx412 *imx412)
+ imx412->reset_gpio = devm_gpiod_get_optional(imx412->dev, "reset",
+ GPIOD_OUT_LOW);
+ if (IS_ERR(imx412->reset_gpio)) {
+- dev_err(imx412->dev, "failed to get reset gpio %ld",
++ dev_err(imx412->dev, "failed to get reset gpio %ld\n",
+ PTR_ERR(imx412->reset_gpio));
+ return PTR_ERR(imx412->reset_gpio);
+ }
+@@ -944,13 +944,13 @@ static int imx412_parse_hw_config(struct imx412 *imx412)
+ /* Get sensor input clock */
+ imx412->inclk = devm_clk_get(imx412->dev, NULL);
+ if (IS_ERR(imx412->inclk)) {
+- dev_err(imx412->dev, "could not get inclk");
++ dev_err(imx412->dev, "could not get inclk\n");
+ return PTR_ERR(imx412->inclk);
+ }
+
+ rate = clk_get_rate(imx412->inclk);
+ if (rate != IMX412_INCLK_RATE) {
+- dev_err(imx412->dev, "inclk frequency mismatch");
++ dev_err(imx412->dev, "inclk frequency mismatch\n");
+ return -EINVAL;
+ }
+
+@@ -975,14 +975,14 @@ static int imx412_parse_hw_config(struct imx412 *imx412)
+
+ if (bus_cfg.bus.mipi_csi2.num_data_lanes != IMX412_NUM_DATA_LANES) {
+ dev_err(imx412->dev,
+- "number of CSI2 data lanes %d is not supported",
++ "number of CSI2 data lanes %d is not supported\n",
+ bus_cfg.bus.mipi_csi2.num_data_lanes);
+ ret = -EINVAL;
+ goto done_endpoint_free;
+ }
+
+ if (!bus_cfg.nr_of_link_frequencies) {
+- dev_err(imx412->dev, "no link frequencies defined");
++ dev_err(imx412->dev, "no link frequencies defined\n");
+ ret = -EINVAL;
+ goto done_endpoint_free;
+ }
+@@ -1040,7 +1040,7 @@ static int imx412_power_on(struct device *dev)
+
+ ret = clk_prepare_enable(imx412->inclk);
+ if (ret) {
+- dev_err(imx412->dev, "fail to enable inclk");
++ dev_err(imx412->dev, "fail to enable inclk\n");
+ goto error_reset;
+ }
+
+@@ -1151,7 +1151,7 @@ static int imx412_init_controls(struct imx412 *imx412)
+ imx412->hblank_ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+
+ if (ctrl_hdlr->error) {
+- dev_err(imx412->dev, "control init failed: %d",
++ dev_err(imx412->dev, "control init failed: %d\n",
+ ctrl_hdlr->error);
+ v4l2_ctrl_handler_free(ctrl_hdlr);
+ return ctrl_hdlr->error;
+@@ -1184,7 +1184,7 @@ static int imx412_probe(struct i2c_client *client)
+
+ ret = imx412_parse_hw_config(imx412);
+ if (ret) {
+- dev_err(imx412->dev, "HW configuration is not supported");
++ dev_err(imx412->dev, "HW configuration is not supported\n");
+ return ret;
+ }
+
+@@ -1192,14 +1192,14 @@ static int imx412_probe(struct i2c_client *client)
+
+ ret = imx412_power_on(imx412->dev);
+ if (ret) {
+- dev_err(imx412->dev, "failed to power-on the sensor");
++ dev_err(imx412->dev, "failed to power-on the sensor\n");
+ goto error_mutex_destroy;
+ }
+
+ /* Check module identity */
+ ret = imx412_detect(imx412);
+ if (ret) {
+- dev_err(imx412->dev, "failed to find sensor: %d", ret);
++ dev_err(imx412->dev, "failed to find sensor: %d\n", ret);
+ goto error_power_off;
+ }
+
+@@ -1209,7 +1209,7 @@ static int imx412_probe(struct i2c_client *client)
+
+ ret = imx412_init_controls(imx412);
+ if (ret) {
+- dev_err(imx412->dev, "failed to init controls: %d", ret);
++ dev_err(imx412->dev, "failed to init controls: %d\n", ret);
+ goto error_power_off;
+ }
+
+@@ -1221,14 +1221,14 @@ static int imx412_probe(struct i2c_client *client)
+ imx412->pad.flags = MEDIA_PAD_FL_SOURCE;
+ ret = media_entity_pads_init(&imx412->sd.entity, 1, &imx412->pad);
+ if (ret) {
+- dev_err(imx412->dev, "failed to init entity pads: %d", ret);
++ dev_err(imx412->dev, "failed to init entity pads: %d\n", ret);
+ goto error_handler_free;
+ }
+
+ ret = v4l2_async_register_subdev_sensor(&imx412->sd);
+ if (ret < 0) {
+ dev_err(imx412->dev,
+- "failed to register async subdev: %d", ret);
++ "failed to register async subdev: %d\n", ret);
+ goto error_media_entity;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 3e8b166e98d8dfc3343d6862f80f7d0ff572b811 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2024 14:55:45 +0000
+Subject: media: i2c: ov9282: Correct the exposure offset
+
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+[ Upstream commit feaf4154d69657af2bf96e6e66cca794f88b1a61 ]
+
+The datasheet lists that "Maximum exposure time is frame
+length -25 row periods, where frame length is set by
+registers {0x380E, 0x380F}".
+However this driver had OV9282_EXPOSURE_OFFSET set to 12
+which allowed that restriction to be violated, and would
+result in very under-exposed images.
+
+Correct the offset.
+
+Fixes: 14ea315bbeb7 ("media: i2c: Add ov9282 camera sensor driver")
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov9282.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/ov9282.c b/drivers/media/i2c/ov9282.c
+index df144a2f6eda3..0ba4edd24d64b 100644
+--- a/drivers/media/i2c/ov9282.c
++++ b/drivers/media/i2c/ov9282.c
+@@ -31,7 +31,7 @@
+ /* Exposure control */
+ #define OV9282_REG_EXPOSURE 0x3500
+ #define OV9282_EXPOSURE_MIN 1
+-#define OV9282_EXPOSURE_OFFSET 12
++#define OV9282_EXPOSURE_OFFSET 25
+ #define OV9282_EXPOSURE_STEP 1
+ #define OV9282_EXPOSURE_DEFAULT 0x0282
+
+--
+2.39.5
+
--- /dev/null
+From f95731cc1a13b71b9e1a38a3550f097e853b2c20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2024 17:10:42 +0800
+Subject: media: lmedm04: Handle errors for lme2510_int_read
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit a2836d3fe220220ff8c495ca9722f89cea8a67e7 ]
+
+Add check for the return value of usb_pipe_endpoint() and
+usb_submit_urb() in order to catch the errors.
+
+Fixes: 15e1ce33182d ("[media] lmedm04: Fix usb_submit_urb BOGUS urb xfer, pipe 1 != type 3 in interrupt urb")
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20240521091042.1769684-1-nichen@iscas.ac.cn
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/dvb-usb-v2/lmedm04.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+index 8a34e6c0d6a6d..f0537b741d135 100644
+--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+@@ -373,6 +373,7 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap)
+ struct dvb_usb_device *d = adap_to_d(adap);
+ struct lme2510_state *lme_int = adap_to_priv(adap);
+ struct usb_host_endpoint *ep;
++ int ret;
+
+ lme_int->lme_urb = usb_alloc_urb(0, GFP_KERNEL);
+
+@@ -390,11 +391,20 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap)
+
+ /* Quirk of pipe reporting PIPE_BULK but behaves as interrupt */
+ ep = usb_pipe_endpoint(d->udev, lme_int->lme_urb->pipe);
++ if (!ep) {
++ usb_free_urb(lme_int->lme_urb);
++ return -ENODEV;
++ }
+
+ if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK)
+ lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa);
+
+- usb_submit_urb(lme_int->lme_urb, GFP_KERNEL);
++ ret = usb_submit_urb(lme_int->lme_urb, GFP_KERNEL);
++ if (ret) {
++ usb_free_urb(lme_int->lme_urb);
++ return ret;
++ }
++
+ info("INT Interrupt Service Started");
+
+ return 0;
+--
+2.39.5
+
--- /dev/null
+From f855e0b1c59a9ca76f7df585ba75e0eed398f7a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2024 21:29:02 +0000
+Subject: media: marvell: Add check for clk_enable()
+
+From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+
+[ Upstream commit 11f68d2ba2e1521a608af773bf788e8cfa260f68 ]
+
+Add check for the return value of clk_enable() to guarantee the success.
+
+Fixes: 81a409bfd551 ("media: marvell-ccic: provide a clock for the sensor")
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+[Sakari Ailus: Fix spelling in commit message.]
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/marvell/mcam-core.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/marvell/mcam-core.c b/drivers/media/platform/marvell/mcam-core.c
+index ad4a7922d0d74..22d1d11cd195a 100644
+--- a/drivers/media/platform/marvell/mcam-core.c
++++ b/drivers/media/platform/marvell/mcam-core.c
+@@ -935,7 +935,12 @@ static int mclk_enable(struct clk_hw *hw)
+ ret = pm_runtime_resume_and_get(cam->dev);
+ if (ret < 0)
+ return ret;
+- clk_enable(cam->clk[0]);
++ ret = clk_enable(cam->clk[0]);
++ if (ret) {
++ pm_runtime_put(cam->dev);
++ return ret;
++ }
++
+ mcam_reg_write(cam, REG_CLKCTRL, (mclk_src << 29) | mclk_div);
+ mcam_ctlr_power_up(cam);
+
+--
+2.39.5
+
--- /dev/null
+From 2268ac359e0fd931bd31144be3eea5f1e1c79951 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Nov 2024 19:18:18 +0000
+Subject: media: mipi-csis: Add check for clk_enable()
+
+From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+
+[ Upstream commit 125ad1aeec77eb55273b420be6894b284a01e4b6 ]
+
+Add check for the return value of clk_enable() to gurantee the success.
+
+Fixes: b5f1220d587d ("[media] v4l: Add v4l2 subdev driver for S5P/EXYNOS4 MIPI-CSI receivers")
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/samsung/exynos4-is/mipi-csis.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/samsung/exynos4-is/mipi-csis.c b/drivers/media/platform/samsung/exynos4-is/mipi-csis.c
+index 6a0d35f33e8c6..f308ef6189863 100644
+--- a/drivers/media/platform/samsung/exynos4-is/mipi-csis.c
++++ b/drivers/media/platform/samsung/exynos4-is/mipi-csis.c
+@@ -940,13 +940,19 @@ static int s5pcsis_pm_resume(struct device *dev, bool runtime)
+ state->supplies);
+ goto unlock;
+ }
+- clk_enable(state->clock[CSIS_CLK_GATE]);
++ ret = clk_enable(state->clock[CSIS_CLK_GATE]);
++ if (ret) {
++ phy_power_off(state->phy);
++ regulator_bulk_disable(CSIS_NUM_SUPPLIES,
++ state->supplies);
++ goto unlock;
++ }
+ }
+ if (state->flags & ST_STREAMING)
+ s5pcsis_start_stream(state);
+
+ state->flags &= ~ST_SUSPENDED;
+- unlock:
++unlock:
+ mutex_unlock(&state->lock);
+ return ret ? -EAGAIN : 0;
+ }
+--
+2.39.5
+
--- /dev/null
+From 93ed2ba7725ee6e9348cdb7da74632617a94dfe4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Nov 2024 14:17:22 +0100
+Subject: media: rc: iguanair: handle timeouts
+
+From: Oliver Neukum <oneukum@suse.com>
+
+[ Upstream commit b98d5000c50544f14bacb248c34e5219fbe81287 ]
+
+In case of a timeout the IO must be cancelled or
+the next IO using the URB will fail and/or overwrite
+an operational URB.
+
+The automatic bisection fails because it arrives
+at a commit that correctly lets the test case run
+without an error.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Fixes: e99a7cfe93fd ("[media] iguanair: reuse existing urb callback for command responses")
+Reported-by: syzbot+ffba8e636870dac0e0c0@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/66f5cc9a.050a0220.46d20.0004.GAE@google.com/
+Tested-by: syzbot+ffba8e636870dac0e0c0@syzkaller.appspotmail.com
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/iguanair.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/rc/iguanair.c b/drivers/media/rc/iguanair.c
+index 276bf3c8a8cb4..8af94246e5916 100644
+--- a/drivers/media/rc/iguanair.c
++++ b/drivers/media/rc/iguanair.c
+@@ -194,8 +194,10 @@ static int iguanair_send(struct iguanair *ir, unsigned size)
+ if (rc)
+ return rc;
+
+- if (wait_for_completion_timeout(&ir->completion, TIMEOUT) == 0)
++ if (wait_for_completion_timeout(&ir->completion, TIMEOUT) == 0) {
++ usb_kill_urb(ir->urb_out);
+ return -ETIMEDOUT;
++ }
+
+ return rc;
+ }
+--
+2.39.5
+
--- /dev/null
+From 98cd40cf3c7b6d8b9b9e7f8bf3ed6408eb4188bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2024 21:39:08 +0000
+Subject: media: uvcvideo: Propagate buf->error to userspace
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+[ Upstream commit 87ce177654e388451850905a1d376658aebe8699 ]
+
+Now we return VB2_BUF_STATE_DONE for valid and invalid frames. Propagate
+the correct value, so the user can know if the frame is valid or not via
+struct v4l2_buffer->flags.
+
+Reported-by: Hans de Goede <hdegoede@redhat.com>
+Closes: https://lore.kernel.org/linux-media/84b0f212-cd88-46bb-8e6f-b94ec3eccba6@redhat.com
+Fixes: 6998b6fb4b1c ("[media] uvcvideo: Use videobuf2-vmalloc")
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20241218-uvc-deprecate-v2-1-ab814139e983@chromium.org
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/uvc/uvc_queue.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/uvc/uvc_queue.c b/drivers/media/usb/uvc/uvc_queue.c
+index 16fa17bbd15ea..83ed7821fa2a7 100644
+--- a/drivers/media/usb/uvc/uvc_queue.c
++++ b/drivers/media/usb/uvc/uvc_queue.c
+@@ -483,7 +483,8 @@ static void uvc_queue_buffer_complete(struct kref *ref)
+
+ buf->state = buf->error ? UVC_BUF_STATE_ERROR : UVC_BUF_STATE_DONE;
+ vb2_set_plane_payload(&buf->buf.vb2_buf, 0, buf->bytesused);
+- vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_DONE);
++ vb2_buffer_done(&buf->buf.vb2_buf, buf->error ? VB2_BUF_STATE_ERROR :
++ VB2_BUF_STATE_DONE);
+ }
+
+ /*
+--
+2.39.5
+
--- /dev/null
+From 8672abbaa8bce9d016b3ec9d627dd9c1aafe4a7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2024 18:14:34 +0900
+Subject: memory: tegra20-emc: fix an OF node reference bug in
+ tegra_emc_find_node_by_ram_code()
+
+From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+
+[ Upstream commit b9784e5cde1f9fb83661a70e580e381ae1264d12 ]
+
+As of_find_node_by_name() release the reference of the argument device
+node, tegra_emc_find_node_by_ram_code() releases some device nodes while
+still in use, resulting in possible UAFs. According to the bindings and
+the in-tree DTS files, the "emc-tables" node is always device's child
+node with the property "nvidia,use-ram-code", and the "lpddr2" node is a
+child of the "emc-tables" node. Thus utilize the
+for_each_child_of_node() macro and of_get_child_by_name() instead of
+of_find_node_by_name() to simplify the code.
+
+This bug was found by an experimental verification tool that I am
+developing.
+
+Fixes: 96e5da7c8424 ("memory: tegra: Introduce Tegra20 EMC driver")
+Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+Link: https://lore.kernel.org/r/20241217091434.1993597-1-joe@pf.is.s.u-tokyo.ac.jp
+Link: https://lore.kernel.org/r/20241218024415.2494267-3-joe@pf.is.s.u-tokyo.ac.jp
+[krzysztof: applied v1, adjust the commit msg to incorporate v2 parts]
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/tegra/tegra20-emc.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/memory/tegra/tegra20-emc.c b/drivers/memory/tegra/tegra20-emc.c
+index d1f01f80dcbdf..a68e281b78961 100644
+--- a/drivers/memory/tegra/tegra20-emc.c
++++ b/drivers/memory/tegra/tegra20-emc.c
+@@ -477,14 +477,15 @@ tegra_emc_find_node_by_ram_code(struct tegra_emc *emc)
+
+ ram_code = tegra_read_ram_code();
+
+- for (np = of_find_node_by_name(dev->of_node, "emc-tables"); np;
+- np = of_find_node_by_name(np, "emc-tables")) {
++ for_each_child_of_node(dev->of_node, np) {
++ if (!of_node_name_eq(np, "emc-tables"))
++ continue;
+ err = of_property_read_u32(np, "nvidia,ram-code", &value);
+ if (err || value != ram_code) {
+ struct device_node *lpddr2_np;
+ bool cfg_mismatches = false;
+
+- lpddr2_np = of_find_node_by_name(np, "lpddr2");
++ lpddr2_np = of_get_child_by_name(np, "lpddr2");
+ if (lpddr2_np) {
+ const struct lpddr2_info *info;
+
+@@ -521,7 +522,6 @@ tegra_emc_find_node_by_ram_code(struct tegra_emc *emc)
+ }
+
+ if (cfg_mismatches) {
+- of_node_put(np);
+ continue;
+ }
+ }
+--
+2.39.5
+
--- /dev/null
+From b6a44db041527bb2f4fb157b856730cb727cb144 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jun 2024 12:55:43 +0100
+Subject: mfd: syscon: Add of_syscon_register_regmap() API
+
+From: Peter Griffin <peter.griffin@linaro.org>
+
+[ Upstream commit 769cb63166d90f1fadafa4352f180cbd96b6cb77 ]
+
+The of_syscon_register_regmap() API allows an externally created regmap
+to be registered with syscon. This regmap can then be returned to client
+drivers using the syscon_regmap_lookup_by_phandle() APIs.
+
+The API is used by platforms where mmio access to the syscon registers is
+not possible, and a underlying soc driver like exynos-pmu provides a SoC
+specific regmap that can issue a SMC or hypervisor call to write the
+register.
+
+This approach keeps the SoC complexities out of syscon, but allows common
+drivers such as syscon-poweroff, syscon-reboot and friends that are used
+by many SoCs already to be re-used.
+
+Signed-off-by: Peter Griffin <peter.griffin@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Sam Protsenko <semen.protsenko@linaro.org>
+Tested-by: Will McVicker <willmcvicker@google.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20240621115544.1655458-2-peter.griffin@linaro.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Stable-dep-of: 805f7aaf7fee ("mfd: syscon: Fix race in device_node_get_regmap()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/syscon.c | 48 ++++++++++++++++++++++++++++++++++++++
+ include/linux/mfd/syscon.h | 8 +++++++
+ 2 files changed, 56 insertions(+)
+
+diff --git a/drivers/mfd/syscon.c b/drivers/mfd/syscon.c
+index ecfe151220919..1ce8f6f9d7f54 100644
+--- a/drivers/mfd/syscon.c
++++ b/drivers/mfd/syscon.c
+@@ -177,6 +177,54 @@ static struct regmap *device_node_get_regmap(struct device_node *np,
+ return syscon->regmap;
+ }
+
++/**
++ * of_syscon_register_regmap() - Register regmap for specified device node
++ * @np: Device tree node
++ * @regmap: Pointer to regmap object
++ *
++ * Register an externally created regmap object with syscon for the specified
++ * device tree node. This regmap will then be returned to client drivers using
++ * the syscon_regmap_lookup_by_phandle() API.
++ *
++ * Return: 0 on success, negative error code on failure.
++ */
++int of_syscon_register_regmap(struct device_node *np, struct regmap *regmap)
++{
++ struct syscon *entry, *syscon = NULL;
++ int ret;
++
++ if (!np || !regmap)
++ return -EINVAL;
++
++ syscon = kzalloc(sizeof(*syscon), GFP_KERNEL);
++ if (!syscon)
++ return -ENOMEM;
++
++ /* check if syscon entry already exists */
++ spin_lock(&syscon_list_slock);
++
++ list_for_each_entry(entry, &syscon_list, list)
++ if (entry->np == np) {
++ ret = -EEXIST;
++ goto err_unlock;
++ }
++
++ syscon->regmap = regmap;
++ syscon->np = np;
++
++ /* register the regmap in syscon list */
++ list_add_tail(&syscon->list, &syscon_list);
++ spin_unlock(&syscon_list_slock);
++
++ return 0;
++
++err_unlock:
++ spin_unlock(&syscon_list_slock);
++ kfree(syscon);
++ return ret;
++}
++EXPORT_SYMBOL_GPL(of_syscon_register_regmap);
++
+ struct regmap *device_node_to_regmap(struct device_node *np)
+ {
+ return device_node_get_regmap(np, false);
+diff --git a/include/linux/mfd/syscon.h b/include/linux/mfd/syscon.h
+index c315903f6dab3..aad9c6b504636 100644
+--- a/include/linux/mfd/syscon.h
++++ b/include/linux/mfd/syscon.h
+@@ -28,6 +28,8 @@ struct regmap *syscon_regmap_lookup_by_phandle_args(struct device_node *np,
+ unsigned int *out_args);
+ struct regmap *syscon_regmap_lookup_by_phandle_optional(struct device_node *np,
+ const char *property);
++int of_syscon_register_regmap(struct device_node *np,
++ struct regmap *regmap);
+ #else
+ static inline struct regmap *device_node_to_regmap(struct device_node *np)
+ {
+@@ -67,6 +69,12 @@ static inline struct regmap *syscon_regmap_lookup_by_phandle_optional(
+ return NULL;
+ }
+
++static inline int of_syscon_register_regmap(struct device_node *np,
++ struct regmap *regmap)
++{
++ return -EOPNOTSUPP;
++}
++
+ #endif
+
+ #endif /* __LINUX_MFD_SYSCON_H__ */
+--
+2.39.5
+
--- /dev/null
+From 07f72c399eb2d6e87ef333fc1b592bc36ad201a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2024 12:11:40 -0600
+Subject: mfd: syscon: Fix race in device_node_get_regmap()
+
+From: Rob Herring (Arm) <robh@kernel.org>
+
+[ Upstream commit 805f7aaf7fee14a57b56af01d270edf6c10765e8 ]
+
+It is possible for multiple, simultaneous callers calling
+device_node_get_regmap() with the same node to fail to find an entry in
+the syscon_list. There is a period of time while the first caller is
+calling of_syscon_register() that subsequent callers also fail to find
+an entry in the syscon_list and then call of_syscon_register() a second
+time.
+
+Fix this by keeping the lock held until after of_syscon_register()
+completes and adds the node to syscon_list. Convert the spinlock to a
+mutex as many of the functions called in of_syscon_register() such as
+kzalloc() and of_clk_get() may sleep.
+
+Fixes: bdb0066df96e ("mfd: syscon: Decouple syscon interface from platform devices")
+Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Tested-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Tested-by: Will McVicker <willmcvicker@google.com>
+Tested-by: Pankaj Dubey <pankaj.dubey@samsung.com>
+Reviewed-by: Pankaj Dubey <pankaj.dubey@samsung.com>
+Link: https://lore.kernel.org/r/20241217-syscon-fixes-v2-1-4f56d750541d@kernel.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/syscon.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/mfd/syscon.c b/drivers/mfd/syscon.c
+index cc7b07882fee4..8302cd63a73d0 100644
+--- a/drivers/mfd/syscon.c
++++ b/drivers/mfd/syscon.c
+@@ -15,6 +15,7 @@
+ #include <linux/io.h>
+ #include <linux/init.h>
+ #include <linux/list.h>
++#include <linux/mutex.h>
+ #include <linux/of.h>
+ #include <linux/of_address.h>
+ #include <linux/of_platform.h>
+@@ -26,7 +27,7 @@
+
+ static struct platform_driver syscon_driver;
+
+-static DEFINE_SPINLOCK(syscon_list_slock);
++static DEFINE_MUTEX(syscon_list_lock);
+ static LIST_HEAD(syscon_list);
+
+ struct syscon {
+@@ -51,6 +52,8 @@ static struct syscon *of_syscon_register(struct device_node *np, bool check_clk)
+ struct regmap_config syscon_config = syscon_regmap_config;
+ struct resource res;
+
++ WARN_ON(!mutex_is_locked(&syscon_list_lock));
++
+ struct syscon *syscon __free(kfree) = kzalloc(sizeof(*syscon), GFP_KERNEL);
+ if (!syscon)
+ return ERR_PTR(-ENOMEM);
+@@ -131,9 +134,7 @@ static struct syscon *of_syscon_register(struct device_node *np, bool check_clk)
+ syscon->regmap = regmap;
+ syscon->np = np;
+
+- spin_lock(&syscon_list_slock);
+ list_add_tail(&syscon->list, &syscon_list);
+- spin_unlock(&syscon_list_slock);
+
+ return_ptr(syscon);
+
+@@ -152,7 +153,7 @@ static struct regmap *device_node_get_regmap(struct device_node *np,
+ {
+ struct syscon *entry, *syscon = NULL;
+
+- spin_lock(&syscon_list_slock);
++ mutex_lock(&syscon_list_lock);
+
+ list_for_each_entry(entry, &syscon_list, list)
+ if (entry->np == np) {
+@@ -160,11 +161,11 @@ static struct regmap *device_node_get_regmap(struct device_node *np,
+ break;
+ }
+
+- spin_unlock(&syscon_list_slock);
+-
+ if (!syscon)
+ syscon = of_syscon_register(np, check_clk);
+
++ mutex_unlock(&syscon_list_lock);
++
+ if (IS_ERR(syscon))
+ return ERR_CAST(syscon);
+
+@@ -195,7 +196,7 @@ int of_syscon_register_regmap(struct device_node *np, struct regmap *regmap)
+ return -ENOMEM;
+
+ /* check if syscon entry already exists */
+- spin_lock(&syscon_list_slock);
++ mutex_lock(&syscon_list_lock);
+
+ list_for_each_entry(entry, &syscon_list, list)
+ if (entry->np == np) {
+@@ -208,12 +209,12 @@ int of_syscon_register_regmap(struct device_node *np, struct regmap *regmap)
+
+ /* register the regmap in syscon list */
+ list_add_tail(&syscon->list, &syscon_list);
+- spin_unlock(&syscon_list_slock);
++ mutex_unlock(&syscon_list_lock);
+
+ return 0;
+
+ err_unlock:
+- spin_unlock(&syscon_list_slock);
++ mutex_unlock(&syscon_list_lock);
+ kfree(syscon);
+ return ret;
+ }
+--
+2.39.5
+
--- /dev/null
+From c3fcccf458cae3d3dd3343eb69c203635d717094 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Feb 2024 11:50:11 +0000
+Subject: mfd: syscon: Remove extern from function prototypes
+
+From: Peter Griffin <peter.griffin@linaro.org>
+
+[ Upstream commit 0db017f8edd9b9af818bc1d68ba578df1b4c4628 ]
+
+The kernel coding style does not require 'extern' in function prototypes
+in .h files, so remove them as they are not needed.
+
+To avoid checkpatch warnings such as
+CHECK: Lines should not end with a '('
++struct regmap *syscon_regmap_lookup_by_phandle(
+
+The indentation is also updated. No functional changes in this patch.
+
+Signed-off-by: Peter Griffin <peter.griffin@linaro.org>
+Link: https://lore.kernel.org/r/20240220115012.471689-3-peter.griffin@linaro.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Stable-dep-of: 805f7aaf7fee ("mfd: syscon: Fix race in device_node_get_regmap()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mfd/syscon.h | 25 +++++++++++--------------
+ 1 file changed, 11 insertions(+), 14 deletions(-)
+
+diff --git a/include/linux/mfd/syscon.h b/include/linux/mfd/syscon.h
+index fecc2fa2a3647..c315903f6dab3 100644
+--- a/include/linux/mfd/syscon.h
++++ b/include/linux/mfd/syscon.h
+@@ -17,20 +17,17 @@
+ struct device_node;
+
+ #ifdef CONFIG_MFD_SYSCON
+-extern struct regmap *device_node_to_regmap(struct device_node *np);
+-extern struct regmap *syscon_node_to_regmap(struct device_node *np);
+-extern struct regmap *syscon_regmap_lookup_by_compatible(const char *s);
+-extern struct regmap *syscon_regmap_lookup_by_phandle(
+- struct device_node *np,
+- const char *property);
+-extern struct regmap *syscon_regmap_lookup_by_phandle_args(
+- struct device_node *np,
+- const char *property,
+- int arg_count,
+- unsigned int *out_args);
+-extern struct regmap *syscon_regmap_lookup_by_phandle_optional(
+- struct device_node *np,
+- const char *property);
++struct regmap *device_node_to_regmap(struct device_node *np);
++struct regmap *syscon_node_to_regmap(struct device_node *np);
++struct regmap *syscon_regmap_lookup_by_compatible(const char *s);
++struct regmap *syscon_regmap_lookup_by_phandle(struct device_node *np,
++ const char *property);
++struct regmap *syscon_regmap_lookup_by_phandle_args(struct device_node *np,
++ const char *property,
++ int arg_count,
++ unsigned int *out_args);
++struct regmap *syscon_regmap_lookup_by_phandle_optional(struct device_node *np,
++ const char *property);
+ #else
+ static inline struct regmap *device_node_to_regmap(struct device_node *np)
+ {
+--
+2.39.5
+
--- /dev/null
+From 4303645393b179d46f66c328d5309ca8dfa3c84b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Jul 2024 13:48:23 +0200
+Subject: mfd: syscon: Use scoped variables with memory allocators to simplify
+ error paths
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 82f898f47112bc7b787cb9ce8803c4e2f9f60c89 ]
+
+Allocate the memory with scoped/cleanup.h to reduce error handling and
+make the code a bit simpler.
+
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20240707114823.9175-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Stable-dep-of: 805f7aaf7fee ("mfd: syscon: Fix race in device_node_get_regmap()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/syscon.c | 20 +++++++-------------
+ 1 file changed, 7 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/mfd/syscon.c b/drivers/mfd/syscon.c
+index 1ce8f6f9d7f54..cc7b07882fee4 100644
+--- a/drivers/mfd/syscon.c
++++ b/drivers/mfd/syscon.c
+@@ -8,6 +8,7 @@
+ * Author: Dong Aisheng <dong.aisheng@linaro.org>
+ */
+
++#include <linux/cleanup.h>
+ #include <linux/clk.h>
+ #include <linux/err.h>
+ #include <linux/hwspinlock.h>
+@@ -43,7 +44,6 @@ static const struct regmap_config syscon_regmap_config = {
+ static struct syscon *of_syscon_register(struct device_node *np, bool check_clk)
+ {
+ struct clk *clk;
+- struct syscon *syscon;
+ struct regmap *regmap;
+ void __iomem *base;
+ u32 reg_io_width;
+@@ -51,20 +51,16 @@ static struct syscon *of_syscon_register(struct device_node *np, bool check_clk)
+ struct regmap_config syscon_config = syscon_regmap_config;
+ struct resource res;
+
+- syscon = kzalloc(sizeof(*syscon), GFP_KERNEL);
++ struct syscon *syscon __free(kfree) = kzalloc(sizeof(*syscon), GFP_KERNEL);
+ if (!syscon)
+ return ERR_PTR(-ENOMEM);
+
+- if (of_address_to_resource(np, 0, &res)) {
+- ret = -ENOMEM;
+- goto err_map;
+- }
++ if (of_address_to_resource(np, 0, &res))
++ return ERR_PTR(-ENOMEM);
+
+ base = of_iomap(np, 0);
+- if (!base) {
+- ret = -ENOMEM;
+- goto err_map;
+- }
++ if (!base)
++ return ERR_PTR(-ENOMEM);
+
+ /* Parse the device's DT node for an endianness specification */
+ if (of_property_read_bool(np, "big-endian"))
+@@ -139,7 +135,7 @@ static struct syscon *of_syscon_register(struct device_node *np, bool check_clk)
+ list_add_tail(&syscon->list, &syscon_list);
+ spin_unlock(&syscon_list_slock);
+
+- return syscon;
++ return_ptr(syscon);
+
+ err_attach:
+ if (!IS_ERR(clk))
+@@ -148,8 +144,6 @@ static struct syscon *of_syscon_register(struct device_node *np, bool check_clk)
+ regmap_exit(regmap);
+ err_regmap:
+ iounmap(base);
+-err_map:
+- kfree(syscon);
+ return ERR_PTR(ret);
+ }
+
+--
+2.39.5
+
--- /dev/null
+From b7946cf97e11aca51bb7bb94225b73362461e460 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2025 10:04:30 +0100
+Subject: module: Extend the preempt disabled section in
+ dereference_symbol_descriptor().
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit a145c848d69f9c6f32008d8319edaa133360dd74 ]
+
+dereference_symbol_descriptor() needs to obtain the module pointer
+belonging to pointer in order to resolve that pointer.
+The returned mod pointer is obtained under RCU-sched/ preempt_disable()
+guarantees and needs to be used within this section to ensure that the
+module is not removed in the meantime.
+
+Extend the preempt_disable() section to also cover
+dereference_module_function_descriptor().
+
+Fixes: 04b8eb7a4ccd9 ("symbol lookup: introduce dereference_symbol_descriptor()")
+Cc: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
+Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
+Cc: Helge Deller <deller@gmx.de>
+Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Naveen N Rao <naveen@kernel.org>
+Cc: Nicholas Piggin <npiggin@gmail.com>
+Cc: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
+Cc: linux-parisc@vger.kernel.org
+Cc: linuxppc-dev@lists.ozlabs.org
+Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Link: https://lore.kernel.org/r/20250108090457.512198-2-bigeasy@linutronix.de
+Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/kallsyms.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/kallsyms.h b/include/linux/kallsyms.h
+index 0cd33be7142ad..6d10bd2b9e0fe 100644
+--- a/include/linux/kallsyms.h
++++ b/include/linux/kallsyms.h
+@@ -57,10 +57,10 @@ static inline void *dereference_symbol_descriptor(void *ptr)
+
+ preempt_disable();
+ mod = __module_address((unsigned long)ptr);
+- preempt_enable();
+
+ if (mod)
+ ptr = dereference_module_function_descriptor(mod, ptr);
++ preempt_enable();
+ #endif
+ return ptr;
+ }
+--
+2.39.5
+
--- /dev/null
+From bbdb6b9ab9ecf56b137b990b1fe03b5371e8eb9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Oct 2023 22:01:32 +0200
+Subject: mtd: hyperbus: hbmc-am654: Convert to platform remove callback
+ returning void
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 59bd56760df17506bc2f828f19b40a2243edd0d0 ]
+
+The .remove() callback for a platform driver returns an int which makes
+many driver authors wrongly assume it's possible to do error handling by
+returning an error code. However the value returned is ignored (apart
+from emitting a warning) and this typically results in resource leaks.
+
+To improve here there is a quest to make the remove callback return
+void. In the first step of this quest all drivers are converted to
+.remove_new(), which already returns void. Eventually after all drivers
+are converted, .remove_new() will be renamed to .remove().
+
+Trivially convert this driver from always returning zero in the remove
+callback to the void returning variant.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Acked-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Link: https://lore.kernel.org/linux-mtd/20231008200143.196369-10-u.kleine-koenig@pengutronix.de
+Stable-dep-of: bf5821909eb9 ("mtd: hyperbus: hbmc-am654: fix an OF node reference leak")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/hyperbus/hbmc-am654.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mtd/hyperbus/hbmc-am654.c b/drivers/mtd/hyperbus/hbmc-am654.c
+index a6161ce340d4e..dbe3eb361cca2 100644
+--- a/drivers/mtd/hyperbus/hbmc-am654.c
++++ b/drivers/mtd/hyperbus/hbmc-am654.c
+@@ -229,7 +229,7 @@ static int am654_hbmc_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+-static int am654_hbmc_remove(struct platform_device *pdev)
++static void am654_hbmc_remove(struct platform_device *pdev)
+ {
+ struct am654_hbmc_priv *priv = platform_get_drvdata(pdev);
+ struct am654_hbmc_device_priv *dev_priv = priv->hbdev.priv;
+@@ -241,8 +241,6 @@ static int am654_hbmc_remove(struct platform_device *pdev)
+
+ if (dev_priv->rx_chan)
+ dma_release_channel(dev_priv->rx_chan);
+-
+- return 0;
+ }
+
+ static const struct of_device_id am654_hbmc_dt_ids[] = {
+@@ -256,7 +254,7 @@ MODULE_DEVICE_TABLE(of, am654_hbmc_dt_ids);
+
+ static struct platform_driver am654_hbmc_platform_driver = {
+ .probe = am654_hbmc_probe,
+- .remove = am654_hbmc_remove,
++ .remove_new = am654_hbmc_remove,
+ .driver = {
+ .name = "hbmc-am654",
+ .of_match_table = am654_hbmc_dt_ids,
+--
+2.39.5
+
--- /dev/null
+From 75f6975f58f2acb6b1e7bdb9f06419f0607f3848 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2024 22:38:09 +0900
+Subject: mtd: hyperbus: hbmc-am654: fix an OF node reference leak
+
+From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+
+[ Upstream commit bf5821909eb9c7f5d07d5c6e852ead2c373c94a0 ]
+
+In am654_hbmc_platform_driver, .remove() and the error path of .probe()
+do not decrement the refcount of an OF node obtained by
+ of_get_next_child(). Fix this by adding of_node_put() calls.
+
+Fixes: aca31ce96814 ("mtd: hyperbus: hbmc-am654: Fix direct mapping setup flash access")
+Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/hyperbus/hbmc-am654.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mtd/hyperbus/hbmc-am654.c b/drivers/mtd/hyperbus/hbmc-am654.c
+index dbe3eb361cca2..4b6cbee23fe89 100644
+--- a/drivers/mtd/hyperbus/hbmc-am654.c
++++ b/drivers/mtd/hyperbus/hbmc-am654.c
+@@ -174,26 +174,30 @@ static int am654_hbmc_probe(struct platform_device *pdev)
+ priv->hbdev.np = of_get_next_child(np, NULL);
+ ret = of_address_to_resource(priv->hbdev.np, 0, &res);
+ if (ret)
+- return ret;
++ goto put_node;
+
+ if (of_property_read_bool(dev->of_node, "mux-controls")) {
+ struct mux_control *control = devm_mux_control_get(dev, NULL);
+
+- if (IS_ERR(control))
+- return PTR_ERR(control);
++ if (IS_ERR(control)) {
++ ret = PTR_ERR(control);
++ goto put_node;
++ }
+
+ ret = mux_control_select(control, 1);
+ if (ret) {
+ dev_err(dev, "Failed to select HBMC mux\n");
+- return ret;
++ goto put_node;
+ }
+ priv->mux_ctrl = control;
+ }
+
+ priv->hbdev.map.size = resource_size(&res);
+ priv->hbdev.map.virt = devm_ioremap_resource(dev, &res);
+- if (IS_ERR(priv->hbdev.map.virt))
+- return PTR_ERR(priv->hbdev.map.virt);
++ if (IS_ERR(priv->hbdev.map.virt)) {
++ ret = PTR_ERR(priv->hbdev.map.virt);
++ goto disable_mux;
++ }
+
+ priv->ctlr.dev = dev;
+ priv->ctlr.ops = &am654_hbmc_ops;
+@@ -226,6 +230,8 @@ static int am654_hbmc_probe(struct platform_device *pdev)
+ disable_mux:
+ if (priv->mux_ctrl)
+ mux_control_deselect(priv->mux_ctrl);
++put_node:
++ of_node_put(priv->hbdev.np);
+ return ret;
+ }
+
+@@ -241,6 +247,7 @@ static void am654_hbmc_remove(struct platform_device *pdev)
+
+ if (dev_priv->rx_chan)
+ dma_release_channel(dev_priv->rx_chan);
++ of_node_put(priv->hbdev.np);
+ }
+
+ static const struct of_device_id am654_hbmc_dt_ids[] = {
+--
+2.39.5
+
--- /dev/null
+From 29474b13e1e5c5310fde08ce17b5397026eaeebc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jan 2025 17:28:59 +0800
+Subject: nbd: don't allow reconnect after disconnect
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 844b8cdc681612ff24df62cdefddeab5772fadf1 ]
+
+Following process can cause nbd_config UAF:
+
+1) grab nbd_config temporarily;
+
+2) nbd_genl_disconnect() flush all recv_work() and release the
+initial reference:
+
+ nbd_genl_disconnect
+ nbd_disconnect_and_put
+ nbd_disconnect
+ flush_workqueue(nbd->recv_workq)
+ if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, ...))
+ nbd_config_put
+ -> due to step 1), reference is still not zero
+
+3) nbd_genl_reconfigure() queue recv_work() again;
+
+ nbd_genl_reconfigure
+ config = nbd_get_config_unlocked(nbd)
+ if (!config)
+ -> succeed
+ if (!test_bit(NBD_RT_BOUND, ...))
+ -> succeed
+ nbd_reconnect_socket
+ queue_work(nbd->recv_workq, &args->work)
+
+4) step 1) release the reference;
+
+5) Finially, recv_work() will trigger UAF:
+
+ recv_work
+ nbd_config_put(nbd)
+ -> nbd_config is freed
+ atomic_dec(&config->recv_threads)
+ -> UAF
+
+Fix the problem by clearing NBD_RT_BOUND in nbd_genl_disconnect(), so
+that nbd_genl_reconfigure() will fail.
+
+Fixes: b7aa3d39385d ("nbd: add a reconfigure netlink command")
+Reported-by: syzbot+6b0df248918b92c33e6a@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/675bfb65.050a0220.1a2d0d.0006.GAE@google.com/
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20250103092859.3574648-1-yukuai1@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/nbd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 1f3cd5de41172..7f6ef0a2b4a5c 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -2133,6 +2133,7 @@ static void nbd_disconnect_and_put(struct nbd_device *nbd)
+ flush_workqueue(nbd->recv_workq);
+ nbd_clear_que(nbd);
+ nbd->task_setup = NULL;
++ clear_bit(NBD_RT_BOUND, &nbd->config->runtime_flags);
+ mutex_unlock(&nbd->config_lock);
+
+ if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF,
+--
+2.39.5
+
--- /dev/null
+From 6f244da22e4b84f05c542b5e9d3afc5028314fb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2025 10:21:57 +0100
+Subject: net: avoid race between device unregistration and ethnl ops
+
+From: Antoine Tenart <atenart@kernel.org>
+
+[ Upstream commit 12e070eb6964b341b41677fd260af5a305316a1f ]
+
+The following trace can be seen if a device is being unregistered while
+its number of channels are being modified.
+
+ DEBUG_LOCKS_WARN_ON(lock->magic != lock)
+ WARNING: CPU: 3 PID: 3754 at kernel/locking/mutex.c:564 __mutex_lock+0xc8a/0x1120
+ CPU: 3 UID: 0 PID: 3754 Comm: ethtool Not tainted 6.13.0-rc6+ #771
+ RIP: 0010:__mutex_lock+0xc8a/0x1120
+ Call Trace:
+ <TASK>
+ ethtool_check_max_channel+0x1ea/0x880
+ ethnl_set_channels+0x3c3/0xb10
+ ethnl_default_set_doit+0x306/0x650
+ genl_family_rcv_msg_doit+0x1e3/0x2c0
+ genl_rcv_msg+0x432/0x6f0
+ netlink_rcv_skb+0x13d/0x3b0
+ genl_rcv+0x28/0x40
+ netlink_unicast+0x42e/0x720
+ netlink_sendmsg+0x765/0xc20
+ __sys_sendto+0x3ac/0x420
+ __x64_sys_sendto+0xe0/0x1c0
+ do_syscall_64+0x95/0x180
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+This is because unregister_netdevice_many_notify might run before the
+rtnl lock section of ethnl operations, eg. set_channels in the above
+example. In this example the rss lock would be destroyed by the device
+unregistration path before being used again, but in general running
+ethnl operations while dismantle has started is not a good idea.
+
+Fix this by denying any operation on devices being unregistered. A check
+was already there in ethnl_ops_begin, but not wide enough.
+
+Note that the same issue cannot be seen on the ioctl version
+(__dev_ethtool) because the device reference is retrieved from within
+the rtnl lock section there. Once dismantle started, the net device is
+unlisted and no reference will be found.
+
+Fixes: dde91ccfa25f ("ethtool: do not perform operations on net devices being unregistered")
+Signed-off-by: Antoine Tenart <atenart@kernel.org>
+Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Reviewed-by: Edward Cree <ecree.xilinx@gmail.com>
+Link: https://patch.msgid.link/20250116092159.50890-1-atenart@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ethtool/netlink.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ethtool/netlink.c b/net/ethtool/netlink.c
+index fc4ccecf9495c..e5efdf2817eff 100644
+--- a/net/ethtool/netlink.c
++++ b/net/ethtool/netlink.c
+@@ -41,7 +41,7 @@ int ethnl_ops_begin(struct net_device *dev)
+ pm_runtime_get_sync(dev->dev.parent);
+
+ if (!netif_device_present(dev) ||
+- dev->reg_state == NETREG_UNREGISTERING) {
++ dev->reg_state >= NETREG_UNREGISTERING) {
+ ret = -ENODEV;
+ goto err;
+ }
+--
+2.39.5
+
--- /dev/null
+From af5d9d79e64c7fe567d74bcd00070d164dd61099 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jan 2025 15:42:13 -0600
+Subject: net: davicom: fix UAF in dm9000_drv_remove
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chenyuan Yang <chenyuan0y@gmail.com>
+
+[ Upstream commit 19e65c45a1507a1a2926649d2db3583ed9d55fd9 ]
+
+dm is netdev private data and it cannot be
+used after free_netdev() call. Using dm after free_netdev()
+can cause UAF bug. Fix it by moving free_netdev() at the end of the
+function.
+
+This is similar to the issue fixed in commit
+ad297cd2db89 ("net: qcom/emac: fix UAF in emac_remove").
+
+This bug is detected by our static analysis tool.
+
+Fixes: cf9e60aa69ae ("net: davicom: Fix regulator not turned off on driver removal")
+Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com>
+CC: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://patch.msgid.link/20250123214213.623518-1-chenyuan0y@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/davicom/dm9000.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
+index b21e56de61671..c79d97f4ee900 100644
+--- a/drivers/net/ethernet/davicom/dm9000.c
++++ b/drivers/net/ethernet/davicom/dm9000.c
+@@ -1778,10 +1778,11 @@ dm9000_drv_remove(struct platform_device *pdev)
+
+ unregister_netdev(ndev);
+ dm9000_release_board(pdev, dm);
+- free_netdev(ndev); /* free device structure */
+ if (dm->power_supply)
+ regulator_disable(dm->power_supply);
+
++ free_netdev(ndev); /* free device structure */
++
+ dev_dbg(&pdev->dev, "released and freed device\n");
+ return 0;
+ }
+--
+2.39.5
+
--- /dev/null
+From ebb326f99887a83b7dd0f07c0fb1a3a500f18e7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2025 15:54:49 +0200
+Subject: net: ethernet: ti: am65-cpsw: fix freeing IRQ in
+ am65_cpsw_nuss_remove_tx_chns()
+
+From: Roger Quadros <rogerq@kernel.org>
+
+[ Upstream commit 4395a44acb15850e492dd1de9ec4b6479d96bc80 ]
+
+When getting the IRQ we use k3_udma_glue_tx_get_irq() which returns
+negative error value on error. So not NULL check is not sufficient
+to deteremine if IRQ is valid. Check that IRQ is greater then zero
+to ensure it is valid.
+
+There is no issue at probe time but at runtime user can invoke
+.set_channels which results in the following call chain.
+am65_cpsw_set_channels()
+ am65_cpsw_nuss_update_tx_rx_chns()
+ am65_cpsw_nuss_remove_tx_chns()
+ am65_cpsw_nuss_init_tx_chns()
+
+At this point if am65_cpsw_nuss_init_tx_chns() fails due to
+k3_udma_glue_tx_get_irq() then tx_chn->irq will be set to a
+negative value.
+
+Then, at subsequent .set_channels with higher channel count we
+will attempt to free an invalid IRQ in am65_cpsw_nuss_remove_tx_chns()
+leading to a kernel warning.
+
+The issue is present in the original commit that introduced this driver,
+although there, am65_cpsw_nuss_update_tx_rx_chns() existed as
+am65_cpsw_nuss_update_tx_chns().
+
+Fixes: 93a76530316a ("net: ethernet: ti: introduce am65x/j721e gigabit eth subsystem driver")
+Signed-off-by: Roger Quadros <rogerq@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Siddharth Vadapalli <s-vadapalli@ti.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ti/am65-cpsw-nuss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+index 33df06a2de13a..32828d4ac64ce 100644
+--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c
++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+@@ -1541,7 +1541,7 @@ void am65_cpsw_nuss_remove_tx_chns(struct am65_cpsw_common *common)
+ for (i = 0; i < common->tx_ch_num; i++) {
+ struct am65_cpsw_tx_chn *tx_chn = &common->tx_chns[i];
+
+- if (tx_chn->irq)
++ if (tx_chn->irq > 0)
+ devm_free_irq(dev, tx_chn->irq, tx_chn);
+
+ netif_napi_del(&tx_chn->napi_tx);
+--
+2.39.5
+
--- /dev/null
+From a5f081f6bc3f23c685f08a3ea7c6d93984478961 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2025 14:24:30 +0530
+Subject: net: fec: implement TSO descriptor cleanup
+
+From: Dheeraj Reddy Jonnalagadda <dheeraj.linuxdev@gmail.com>
+
+[ Upstream commit 61dc1fd9205bc9d9918aa933a847b08e80b4dc20 ]
+
+Implement cleanup of descriptors in the TSO error path of
+fec_enet_txq_submit_tso(). The cleanup
+
+- Unmaps DMA buffers for data descriptors skipping TSO header
+- Clears all buffer descriptors
+- Handles extended descriptors by clearing cbd_esc when enabled
+
+Fixes: 79f339125ea3 ("net: fec: Add software TSO support")
+Signed-off-by: Dheeraj Reddy Jonnalagadda <dheeraj.linuxdev@gmail.com>
+Reviewed-by: Wei Fang <wei.fang@nxp.com>
+Link: https://patch.msgid.link/20250120085430.99318-1-dheeraj.linuxdev@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fec_main.c | 31 ++++++++++++++++++++++-
+ 1 file changed, 30 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index aeab6c28892f2..018ce4f4be6f3 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -818,6 +818,8 @@ static int fec_enet_txq_submit_tso(struct fec_enet_priv_tx_q *txq,
+ struct fec_enet_private *fep = netdev_priv(ndev);
+ int hdr_len, total_len, data_left;
+ struct bufdesc *bdp = txq->bd.cur;
++ struct bufdesc *tmp_bdp;
++ struct bufdesc_ex *ebdp;
+ struct tso_t tso;
+ unsigned int index = 0;
+ int ret;
+@@ -891,7 +893,34 @@ static int fec_enet_txq_submit_tso(struct fec_enet_priv_tx_q *txq,
+ return 0;
+
+ err_release:
+- /* TODO: Release all used data descriptors for TSO */
++ /* Release all used data descriptors for TSO */
++ tmp_bdp = txq->bd.cur;
++
++ while (tmp_bdp != bdp) {
++ /* Unmap data buffers */
++ if (tmp_bdp->cbd_bufaddr &&
++ !IS_TSO_HEADER(txq, fec32_to_cpu(tmp_bdp->cbd_bufaddr)))
++ dma_unmap_single(&fep->pdev->dev,
++ fec32_to_cpu(tmp_bdp->cbd_bufaddr),
++ fec16_to_cpu(tmp_bdp->cbd_datlen),
++ DMA_TO_DEVICE);
++
++ /* Clear standard buffer descriptor fields */
++ tmp_bdp->cbd_sc = 0;
++ tmp_bdp->cbd_datlen = 0;
++ tmp_bdp->cbd_bufaddr = 0;
++
++ /* Handle extended descriptor if enabled */
++ if (fep->bufdesc_ex) {
++ ebdp = (struct bufdesc_ex *)tmp_bdp;
++ ebdp->cbd_esc = 0;
++ }
++
++ tmp_bdp = fec_enet_get_nextdesc(tmp_bdp, &txq->bd);
++ }
++
++ dev_kfree_skb_any(skb);
++
+ return ret;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 4bfb1a1f67b37848d833f2d09a1a432923dc9248 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Jan 2025 17:47:41 +0800
+Subject: net: hns3: fix oops when unload drivers paralleling
+
+From: Jian Shen <shenjian15@huawei.com>
+
+[ Upstream commit 92e5995773774a3e70257e9c95ea03518268bea5 ]
+
+When unload hclge driver, it tries to disable sriov first for each
+ae_dev node from hnae3_ae_dev_list. If user unloads hns3 driver at
+the time, because it removes all the ae_dev nodes, and it may cause
+oops.
+
+But we can't simply use hnae3_common_lock for this. Because in the
+process flow of pci_disable_sriov(), it will trigger the remove flow
+of VF, which will also take hnae3_common_lock.
+
+To fixes it, introduce a new mutex to protect the unload process.
+
+Fixes: 0dd8a25f355b ("net: hns3: disable sriov before unload hclge layer")
+Signed-off-by: Jian Shen <shenjian15@huawei.com>
+Signed-off-by: Jijie Shao <shaojijie@huawei.com>
+Link: https://patch.msgid.link/20250118094741.3046663-1-shaojijie@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hnae3.c | 15 +++++++++++++++
+ drivers/net/ethernet/hisilicon/hns3/hnae3.h | 2 ++
+ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 ++
+ .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 ++
+ .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 2 ++
+ 5 files changed, 23 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.c b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+index 9a63fbc694083..b25fb400f4767 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+@@ -40,6 +40,21 @@ EXPORT_SYMBOL(hnae3_unregister_ae_algo_prepare);
+ */
+ static DEFINE_MUTEX(hnae3_common_lock);
+
++/* ensure the drivers being unloaded one by one */
++static DEFINE_MUTEX(hnae3_unload_lock);
++
++void hnae3_acquire_unload_lock(void)
++{
++ mutex_lock(&hnae3_unload_lock);
++}
++EXPORT_SYMBOL(hnae3_acquire_unload_lock);
++
++void hnae3_release_unload_lock(void)
++{
++ mutex_unlock(&hnae3_unload_lock);
++}
++EXPORT_SYMBOL(hnae3_release_unload_lock);
++
+ static bool hnae3_client_match(enum hnae3_client_type client_type)
+ {
+ if (client_type == HNAE3_CLIENT_KNIC ||
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+index 60b8d61af07f9..7f993b3f8038b 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+@@ -929,4 +929,6 @@ int hnae3_register_client(struct hnae3_client *client);
+ void hnae3_set_client_init_flag(struct hnae3_client *client,
+ struct hnae3_ae_dev *ae_dev,
+ unsigned int inited);
++void hnae3_acquire_unload_lock(void);
++void hnae3_release_unload_lock(void);
+ #endif
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 0377a056aaecc..9d27fad9f35fe 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -6007,9 +6007,11 @@ module_init(hns3_init_module);
+ */
+ static void __exit hns3_exit_module(void)
+ {
++ hnae3_acquire_unload_lock();
+ pci_unregister_driver(&hns3_driver);
+ hnae3_unregister_client(&client);
+ hns3_dbg_unregister_debugfs();
++ hnae3_release_unload_lock();
+ }
+ module_exit(hns3_exit_module);
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 45bd5c79e4da8..ed1b49a360165 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -13250,9 +13250,11 @@ static int __init hclge_init(void)
+
+ static void __exit hclge_exit(void)
+ {
++ hnae3_acquire_unload_lock();
+ hnae3_unregister_ae_algo_prepare(&ae_algo);
+ hnae3_unregister_ae_algo(&ae_algo);
+ destroy_workqueue(hclge_wq);
++ hnae3_release_unload_lock();
+ }
+ module_init(hclge_init);
+ module_exit(hclge_exit);
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+index aebb104f4c290..06493853b2b49 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -3468,8 +3468,10 @@ static int __init hclgevf_init(void)
+
+ static void __exit hclgevf_exit(void)
+ {
++ hnae3_acquire_unload_lock();
+ hnae3_unregister_ae_algo(&ae_algovf);
+ destroy_workqueue(hclgevf_wq);
++ hnae3_release_unload_lock();
+ }
+ module_init(hclgevf_init);
+ module_exit(hclgevf_exit);
+--
+2.39.5
+
--- /dev/null
+From 53539e5d601001abe76488722638d4010d5335ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jan 2025 13:00:07 +0000
+Subject: net: hsr: fix fill_frame_info() regression vs VLAN packets
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 0f5697f1a3f99bc2b674b8aa3c5da822c5673c11 ]
+
+Stephan Wurm reported that my recent patch broke VLAN support.
+
+Apparently skb->mac_len is not correct for VLAN traffic as
+shown by debug traces [1].
+
+Use instead pskb_may_pull() to make sure the expected header
+is present in skb->head.
+
+Many thanks to Stephan for his help.
+
+[1]
+kernel: skb len=170 headroom=2 headlen=170 tailroom=20
+ mac=(2,14) mac_len=14 net=(16,-1) trans=-1
+ shinfo(txflags=0 nr_frags=0 gso(size=0 type=0 segs=0))
+ csum(0x0 start=0 offset=0 ip_summed=0 complete_sw=0 valid=0 level=0)
+ hash(0x0 sw=0 l4=0) proto=0x0000 pkttype=0 iif=0
+ priority=0x0 mark=0x0 alloc_cpu=0 vlan_all=0x0
+ encapsulation=0 inner(proto=0x0000, mac=0, net=0, trans=0)
+kernel: dev name=prp0 feat=0x0000000000007000
+kernel: sk family=17 type=3 proto=0
+kernel: skb headroom: 00000000: 74 00
+kernel: skb linear: 00000000: 01 0c cd 01 00 01 00 d0 93 53 9c cb 81 00 80 00
+kernel: skb linear: 00000010: 88 b8 00 01 00 98 00 00 00 00 61 81 8d 80 16 52
+kernel: skb linear: 00000020: 45 47 44 4e 43 54 52 4c 2f 4c 4c 4e 30 24 47 4f
+kernel: skb linear: 00000030: 24 47 6f 43 62 81 01 14 82 16 52 45 47 44 4e 43
+kernel: skb linear: 00000040: 54 52 4c 2f 4c 4c 4e 30 24 44 73 47 6f 6f 73 65
+kernel: skb linear: 00000050: 83 07 47 6f 49 64 65 6e 74 84 08 67 8d f5 93 7e
+kernel: skb linear: 00000060: 76 c8 00 85 01 01 86 01 00 87 01 00 88 01 01 89
+kernel: skb linear: 00000070: 01 00 8a 01 02 ab 33 a2 15 83 01 00 84 03 03 00
+kernel: skb linear: 00000080: 00 91 08 67 8d f5 92 77 4b c6 1f 83 01 00 a2 1a
+kernel: skb linear: 00000090: a2 06 85 01 00 83 01 00 84 03 03 00 00 91 08 67
+kernel: skb linear: 000000a0: 8d f5 92 77 4b c6 1f 83 01 00
+kernel: skb tailroom: 00000000: 80 18 02 00 fe 4e 00 00 01 01 08 0a 4f fd 5e d1
+kernel: skb tailroom: 00000010: 4f fd 5e cd
+
+Fixes: b9653d19e556 ("net: hsr: avoid potential out-of-bound access in fill_frame_info()")
+Reported-by: Stephan Wurm <stephan.wurm@a-eberle.de>
+Tested-by: Stephan Wurm <stephan.wurm@a-eberle.de>
+Closes: https://lore.kernel.org/netdev/Z4o_UC0HweBHJ_cw@PC-LX-SteWu/
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250129130007.644084-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/hsr/hsr_forward.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
+index 2790f3964d6bd..9317f96127c1b 100644
+--- a/net/hsr/hsr_forward.c
++++ b/net/hsr/hsr_forward.c
+@@ -588,9 +588,12 @@ static int fill_frame_info(struct hsr_frame_info *frame,
+ frame->is_vlan = true;
+
+ if (frame->is_vlan) {
+- if (skb->mac_len < offsetofend(struct hsr_vlan_ethhdr, vlanhdr))
++ /* Note: skb->mac_len might be wrong here. */
++ if (!pskb_may_pull(skb,
++ skb_mac_offset(skb) +
++ offsetofend(struct hsr_vlan_ethhdr, vlanhdr)))
+ return -EINVAL;
+- vlan_hdr = (struct hsr_vlan_ethhdr *)ethhdr;
++ vlan_hdr = (struct hsr_vlan_ethhdr *)skb_mac_header(skb);
+ proto = vlan_hdr->vlanhdr.h_vlan_encapsulated_proto;
+ /* FIXME: */
+ netdev_warn_once(skb->dev, "VLAN not yet supported");
+--
+2.39.5
+
--- /dev/null
+From 890c62ce6f1ca78ec7d00cef82e0b69146a57ba8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2025 22:30:53 +0800
+Subject: net: let net.core.dev_weight always be non-zero
+
+From: Liu Jian <liujian56@huawei.com>
+
+[ Upstream commit d1f9f79fa2af8e3b45cffdeef66e05833480148a ]
+
+The following problem was encountered during stability test:
+
+(NULL net_device): NAPI poll function process_backlog+0x0/0x530 \
+ returned 1, exceeding its budget of 0.
+------------[ cut here ]------------
+list_add double add: new=ffff88905f746f48, prev=ffff88905f746f48, \
+ next=ffff88905f746e40.
+WARNING: CPU: 18 PID: 5462 at lib/list_debug.c:35 \
+ __list_add_valid_or_report+0xf3/0x130
+CPU: 18 UID: 0 PID: 5462 Comm: ping Kdump: loaded Not tainted 6.13.0-rc7+
+RIP: 0010:__list_add_valid_or_report+0xf3/0x130
+Call Trace:
+? __warn+0xcd/0x250
+? __list_add_valid_or_report+0xf3/0x130
+enqueue_to_backlog+0x923/0x1070
+netif_rx_internal+0x92/0x2b0
+__netif_rx+0x15/0x170
+loopback_xmit+0x2ef/0x450
+dev_hard_start_xmit+0x103/0x490
+__dev_queue_xmit+0xeac/0x1950
+ip_finish_output2+0x6cc/0x1620
+ip_output+0x161/0x270
+ip_push_pending_frames+0x155/0x1a0
+raw_sendmsg+0xe13/0x1550
+__sys_sendto+0x3bf/0x4e0
+__x64_sys_sendto+0xdc/0x1b0
+do_syscall_64+0x5b/0x170
+entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+The reproduction command is as follows:
+ sysctl -w net.core.dev_weight=0
+ ping 127.0.0.1
+
+This is because when the napi's weight is set to 0, process_backlog() may
+return 0 and clear the NAPI_STATE_SCHED bit of napi->state, causing this
+napi to be re-polled in net_rx_action() until __do_softirq() times out.
+Since the NAPI_STATE_SCHED bit has been cleared, napi_schedule_rps() can
+be retriggered in enqueue_to_backlog(), causing this issue.
+
+Making the napi's weight always non-zero solves this problem.
+
+Triggering this issue requires system-wide admin (setting is
+not namespaced).
+
+Fixes: e38766054509 ("[NET]: Fix sysctl net.core.dev_weight")
+Fixes: 3d48b53fb2ae ("net: dev_weight: TX/RX orthogonality")
+Signed-off-by: Liu Jian <liujian56@huawei.com>
+Link: https://patch.msgid.link/20250116143053.4146855-1-liujian56@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sysctl_net_core.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
+index d281d5343ff4a..47ca6d3ddbb56 100644
+--- a/net/core/sysctl_net_core.c
++++ b/net/core/sysctl_net_core.c
+@@ -238,7 +238,7 @@ static int proc_do_dev_weight(struct ctl_table *table, int write,
+ int ret, weight;
+
+ mutex_lock(&dev_weight_mutex);
+- ret = proc_dointvec(table, write, buffer, lenp, ppos);
++ ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
+ if (!ret && write) {
+ weight = READ_ONCE(weight_p);
+ WRITE_ONCE(dev_rx_weight, weight * dev_weight_rx_bias);
+@@ -363,6 +363,7 @@ static struct ctl_table net_core_table[] = {
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_do_dev_weight,
++ .extra1 = SYSCTL_ONE,
+ },
+ {
+ .procname = "dev_weight_rx_bias",
+@@ -370,6 +371,7 @@ static struct ctl_table net_core_table[] = {
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_do_dev_weight,
++ .extra1 = SYSCTL_ONE,
+ },
+ {
+ .procname = "dev_weight_tx_bias",
+@@ -377,6 +379,7 @@ static struct ctl_table net_core_table[] = {
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_do_dev_weight,
++ .extra1 = SYSCTL_ONE,
+ },
+ {
+ .procname = "netdev_max_backlog",
+--
+2.39.5
+
--- /dev/null
+From 17b0a11171294c164e92871fc99caa246ce83293 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2025 14:33:16 +0200
+Subject: net/mlxfw: Drop hard coded max FW flash image size
+
+From: Maher Sanalla <msanalla@nvidia.com>
+
+[ Upstream commit 70d81f25cc92cc4e914516c9935ae752f27d78ad ]
+
+Currently, mlxfw kernel module limits FW flash image size to be
+10MB at most, preventing the ability to burn recent BlueField-3
+FW that exceeds the said size limit.
+
+Thus, drop the hard coded limit. Instead, rely on FW's
+max_component_size threshold that is reported in MCQI register
+as the size limit for FW image.
+
+Fixes: 410ed13cae39 ("Add the mlxfw module for Mellanox firmware flash process")
+Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
+Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Tested-by: Ido Schimmel <idosch@nvidia.com>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Link: https://patch.msgid.link/1737030796-1441634-1-git-send-email-moshe@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c
+index 46245e0b24623..43c84900369a3 100644
+--- a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c
++++ b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c
+@@ -14,7 +14,6 @@
+ #define MLXFW_FSM_STATE_WAIT_TIMEOUT_MS 30000
+ #define MLXFW_FSM_STATE_WAIT_ROUNDS \
+ (MLXFW_FSM_STATE_WAIT_TIMEOUT_MS / MLXFW_FSM_STATE_WAIT_CYCLE_MS)
+-#define MLXFW_FSM_MAX_COMPONENT_SIZE (10 * (1 << 20))
+
+ static const int mlxfw_fsm_state_errno[] = {
+ [MLXFW_FSM_STATE_ERR_ERROR] = -EIO,
+@@ -229,7 +228,6 @@ static int mlxfw_flash_component(struct mlxfw_dev *mlxfw_dev,
+ return err;
+ }
+
+- comp_max_size = min_t(u32, comp_max_size, MLXFW_FSM_MAX_COMPONENT_SIZE);
+ if (comp->data_size > comp_max_size) {
+ MLXFW_ERR_MSG(mlxfw_dev, extack,
+ "Component size is bigger than limit", -EINVAL);
+--
+2.39.5
+
--- /dev/null
+From 01b164b6f46b550f09eaf61c2c205d288aa46ed1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2025 14:45:03 -0800
+Subject: net: netdevsim: try to close UDP port harness races
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 50bf398e1ceacb9a7f85bd3bdca065ebe5cb6159 ]
+
+syzbot discovered that we remove the debugfs files after we free
+the netdev. Try to clean up the relevant dir while the device
+is still around.
+
+Reported-by: syzbot+2e5de9e3ab986b71d2bf@syzkaller.appspotmail.com
+Fixes: 424be63ad831 ("netdevsim: add UDP tunnel port offload support")
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Link: https://patch.msgid.link/20250122224503.762705-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/netdevsim/netdevsim.h | 1 +
+ drivers/net/netdevsim/udp_tunnels.c | 23 +++++++++++--------
+ .../drivers/net/netdevsim/udp_tunnel_nic.sh | 16 ++++++-------
+ 3 files changed, 23 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/net/netdevsim/netdevsim.h b/drivers/net/netdevsim/netdevsim.h
+index 7d8ed8d8df5c9..02e3518e9a7e2 100644
+--- a/drivers/net/netdevsim/netdevsim.h
++++ b/drivers/net/netdevsim/netdevsim.h
+@@ -98,6 +98,7 @@ struct netdevsim {
+ u32 sleep;
+ u32 __ports[2][NSIM_UDP_TUNNEL_N_PORTS];
+ u32 (*ports)[NSIM_UDP_TUNNEL_N_PORTS];
++ struct dentry *ddir;
+ struct debugfs_u32_array dfs_ports[2];
+ } udp_ports;
+
+diff --git a/drivers/net/netdevsim/udp_tunnels.c b/drivers/net/netdevsim/udp_tunnels.c
+index 02dc3123eb6c1..640b4983a9a0d 100644
+--- a/drivers/net/netdevsim/udp_tunnels.c
++++ b/drivers/net/netdevsim/udp_tunnels.c
+@@ -112,9 +112,11 @@ nsim_udp_tunnels_info_reset_write(struct file *file, const char __user *data,
+ struct net_device *dev = file->private_data;
+ struct netdevsim *ns = netdev_priv(dev);
+
+- memset(ns->udp_ports.ports, 0, sizeof(ns->udp_ports.__ports));
+ rtnl_lock();
+- udp_tunnel_nic_reset_ntf(dev);
++ if (dev->reg_state == NETREG_REGISTERED) {
++ memset(ns->udp_ports.ports, 0, sizeof(ns->udp_ports.__ports));
++ udp_tunnel_nic_reset_ntf(dev);
++ }
+ rtnl_unlock();
+
+ return count;
+@@ -144,23 +146,23 @@ int nsim_udp_tunnels_info_create(struct nsim_dev *nsim_dev,
+ else
+ ns->udp_ports.ports = nsim_dev->udp_ports.__ports;
+
+- debugfs_create_u32("udp_ports_inject_error", 0600,
+- ns->nsim_dev_port->ddir,
++ ns->udp_ports.ddir = debugfs_create_dir("udp_ports",
++ ns->nsim_dev_port->ddir);
++
++ debugfs_create_u32("inject_error", 0600, ns->udp_ports.ddir,
+ &ns->udp_ports.inject_error);
+
+ ns->udp_ports.dfs_ports[0].array = ns->udp_ports.ports[0];
+ ns->udp_ports.dfs_ports[0].n_elements = NSIM_UDP_TUNNEL_N_PORTS;
+- debugfs_create_u32_array("udp_ports_table0", 0400,
+- ns->nsim_dev_port->ddir,
++ debugfs_create_u32_array("table0", 0400, ns->udp_ports.ddir,
+ &ns->udp_ports.dfs_ports[0]);
+
+ ns->udp_ports.dfs_ports[1].array = ns->udp_ports.ports[1];
+ ns->udp_ports.dfs_ports[1].n_elements = NSIM_UDP_TUNNEL_N_PORTS;
+- debugfs_create_u32_array("udp_ports_table1", 0400,
+- ns->nsim_dev_port->ddir,
++ debugfs_create_u32_array("table1", 0400, ns->udp_ports.ddir,
+ &ns->udp_ports.dfs_ports[1]);
+
+- debugfs_create_file("udp_ports_reset", 0200, ns->nsim_dev_port->ddir,
++ debugfs_create_file("reset", 0200, ns->udp_ports.ddir,
+ dev, &nsim_udp_tunnels_info_reset_fops);
+
+ /* Note: it's not normal to allocate the info struct like this!
+@@ -196,6 +198,9 @@ int nsim_udp_tunnels_info_create(struct nsim_dev *nsim_dev,
+
+ void nsim_udp_tunnels_info_destroy(struct net_device *dev)
+ {
++ struct netdevsim *ns = netdev_priv(dev);
++
++ debugfs_remove_recursive(ns->udp_ports.ddir);
+ kfree(dev->udp_tunnel_nic_info);
+ dev->udp_tunnel_nic_info = NULL;
+ }
+diff --git a/tools/testing/selftests/drivers/net/netdevsim/udp_tunnel_nic.sh b/tools/testing/selftests/drivers/net/netdevsim/udp_tunnel_nic.sh
+index 185b02d2d4cd1..7af78990b5bb6 100755
+--- a/tools/testing/selftests/drivers/net/netdevsim/udp_tunnel_nic.sh
++++ b/tools/testing/selftests/drivers/net/netdevsim/udp_tunnel_nic.sh
+@@ -142,7 +142,7 @@ function pre_ethtool {
+ }
+
+ function check_table {
+- local path=$NSIM_DEV_DFS/ports/$port/udp_ports_table$1
++ local path=$NSIM_DEV_DFS/ports/$port/udp_ports/table$1
+ local -n expected=$2
+ local last=$3
+
+@@ -212,7 +212,7 @@ function check_tables {
+ }
+
+ function print_table {
+- local path=$NSIM_DEV_DFS/ports/$port/udp_ports_table$1
++ local path=$NSIM_DEV_DFS/ports/$port/udp_ports/table$1
+ read -a have < $path
+
+ tree $NSIM_DEV_DFS/
+@@ -640,7 +640,7 @@ for port in 0 1; do
+ NSIM_NETDEV=`get_netdev_name old_netdevs`
+ ifconfig $NSIM_NETDEV up
+
+- echo 110 > $NSIM_DEV_DFS/ports/$port/udp_ports_inject_error
++ echo 110 > $NSIM_DEV_DFS/ports/$port/udp_ports/inject_error
+
+ msg="1 - create VxLANs v6"
+ exp0=( 0 0 0 0 )
+@@ -662,7 +662,7 @@ for port in 0 1; do
+ new_geneve gnv0 20000
+
+ msg="2 - destroy GENEVE"
+- echo 2 > $NSIM_DEV_DFS/ports/$port/udp_ports_inject_error
++ echo 2 > $NSIM_DEV_DFS/ports/$port/udp_ports/inject_error
+ exp1=( `mke 20000 2` 0 0 0 )
+ del_dev gnv0
+
+@@ -763,7 +763,7 @@ for port in 0 1; do
+ msg="create VxLANs v4"
+ new_vxlan vxlan0 10000 $NSIM_NETDEV
+
+- echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports_reset
++ echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports/reset
+ check_tables
+
+ msg="NIC device goes down"
+@@ -774,7 +774,7 @@ for port in 0 1; do
+ fi
+ check_tables
+
+- echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports_reset
++ echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports/reset
+ check_tables
+
+ msg="NIC device goes up again"
+@@ -788,7 +788,7 @@ for port in 0 1; do
+ del_dev vxlan0
+ check_tables
+
+- echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports_reset
++ echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports/reset
+ check_tables
+
+ msg="destroy NIC"
+@@ -895,7 +895,7 @@ msg="vacate VxLAN in overflow table"
+ exp0=( `mke 10000 1` `mke 10004 1` 0 `mke 10003 1` )
+ del_dev vxlan2
+
+-echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports_reset
++echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports/reset
+ check_tables
+
+ msg="tunnels destroyed 2"
+--
+2.39.5
+
--- /dev/null
+From a8893cfbe73fda6d9eceb84d651818ef14df8e8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2025 18:02:44 +0000
+Subject: net: rose: fix timer races against user threads
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 5de7665e0a0746b5ad7943554b34db8f8614a196 ]
+
+Rose timers only acquire the socket spinlock, without
+checking if the socket is owned by one user thread.
+
+Add a check and rearm the timers if needed.
+
+BUG: KASAN: slab-use-after-free in rose_timer_expiry+0x31d/0x360 net/rose/rose_timer.c:174
+Read of size 2 at addr ffff88802f09b82a by task swapper/0/0
+
+CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5-syzkaller-00172-gd1bf27c4e176 #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
+Call Trace:
+ <IRQ>
+ __dump_stack lib/dump_stack.c:94 [inline]
+ dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
+ print_address_description mm/kasan/report.c:378 [inline]
+ print_report+0x169/0x550 mm/kasan/report.c:489
+ kasan_report+0x143/0x180 mm/kasan/report.c:602
+ rose_timer_expiry+0x31d/0x360 net/rose/rose_timer.c:174
+ call_timer_fn+0x187/0x650 kernel/time/timer.c:1793
+ expire_timers kernel/time/timer.c:1844 [inline]
+ __run_timers kernel/time/timer.c:2418 [inline]
+ __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2430
+ run_timer_base kernel/time/timer.c:2439 [inline]
+ run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449
+ handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
+ __do_softirq kernel/softirq.c:595 [inline]
+ invoke_softirq kernel/softirq.c:435 [inline]
+ __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
+ irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
+ instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
+ sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
+ </IRQ>
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20250122180244.1861468-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rose/rose_timer.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/net/rose/rose_timer.c b/net/rose/rose_timer.c
+index f06ddbed3fed6..1525773e94aa1 100644
+--- a/net/rose/rose_timer.c
++++ b/net/rose/rose_timer.c
+@@ -122,6 +122,10 @@ static void rose_heartbeat_expiry(struct timer_list *t)
+ struct rose_sock *rose = rose_sk(sk);
+
+ bh_lock_sock(sk);
++ if (sock_owned_by_user(sk)) {
++ sk_reset_timer(sk, &sk->sk_timer, jiffies + HZ/20);
++ goto out;
++ }
+ switch (rose->state) {
+ case ROSE_STATE_0:
+ /* Magic here: If we listen() and a new link dies before it
+@@ -152,6 +156,7 @@ static void rose_heartbeat_expiry(struct timer_list *t)
+ }
+
+ rose_start_heartbeat(sk);
++out:
+ bh_unlock_sock(sk);
+ sock_put(sk);
+ }
+@@ -162,6 +167,10 @@ static void rose_timer_expiry(struct timer_list *t)
+ struct sock *sk = &rose->sock;
+
+ bh_lock_sock(sk);
++ if (sock_owned_by_user(sk)) {
++ sk_reset_timer(sk, &rose->timer, jiffies + HZ/20);
++ goto out;
++ }
+ switch (rose->state) {
+ case ROSE_STATE_1: /* T1 */
+ case ROSE_STATE_4: /* T2 */
+@@ -182,6 +191,7 @@ static void rose_timer_expiry(struct timer_list *t)
+ }
+ break;
+ }
++out:
+ bh_unlock_sock(sk);
+ sock_put(sk);
+ }
+@@ -192,6 +202,10 @@ static void rose_idletimer_expiry(struct timer_list *t)
+ struct sock *sk = &rose->sock;
+
+ bh_lock_sock(sk);
++ if (sock_owned_by_user(sk)) {
++ sk_reset_timer(sk, &rose->idletimer, jiffies + HZ/20);
++ goto out;
++ }
+ rose_clear_queues(sk);
+
+ rose_write_internal(sk, ROSE_CLEAR_REQUEST);
+@@ -207,6 +221,7 @@ static void rose_idletimer_expiry(struct timer_list *t)
+ sk->sk_state_change(sk);
+ sock_set_flag(sk, SOCK_DEAD);
+ }
++out:
+ bh_unlock_sock(sk);
+ sock_put(sk);
+ }
+--
+2.39.5
+
--- /dev/null
+From 7cb5b0f8613a6d56c77347806862b41af5898a7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2025 08:42:20 -0800
+Subject: net/rose: prevent integer overflows in rose_setsockopt()
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit d640627663bfe7d8963c7615316d7d4ef60f3b0b ]
+
+In case of possible unpredictably large arguments passed to
+rose_setsockopt() and multiplied by extra values on top of that,
+integer overflows may occur.
+
+Do the safest minimum and fix these issues by checking the
+contents of 'opt' and returning -EINVAL if they are too large. Also,
+switch to unsigned int and remove useless check for negative 'opt'
+in ROSE_IDLE case.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Link: https://patch.msgid.link/20250115164220.19954-1-n.zhandarovich@fintech.ru
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rose/af_rose.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
+index 29b74a569e0b0..8b0f249c94570 100644
+--- a/net/rose/af_rose.c
++++ b/net/rose/af_rose.c
+@@ -397,15 +397,15 @@ static int rose_setsockopt(struct socket *sock, int level, int optname,
+ {
+ struct sock *sk = sock->sk;
+ struct rose_sock *rose = rose_sk(sk);
+- int opt;
++ unsigned int opt;
+
+ if (level != SOL_ROSE)
+ return -ENOPROTOOPT;
+
+- if (optlen < sizeof(int))
++ if (optlen < sizeof(unsigned int))
+ return -EINVAL;
+
+- if (copy_from_sockptr(&opt, optval, sizeof(int)))
++ if (copy_from_sockptr(&opt, optval, sizeof(unsigned int)))
+ return -EFAULT;
+
+ switch (optname) {
+@@ -414,31 +414,31 @@ static int rose_setsockopt(struct socket *sock, int level, int optname,
+ return 0;
+
+ case ROSE_T1:
+- if (opt < 1)
++ if (opt < 1 || opt > UINT_MAX / HZ)
+ return -EINVAL;
+ rose->t1 = opt * HZ;
+ return 0;
+
+ case ROSE_T2:
+- if (opt < 1)
++ if (opt < 1 || opt > UINT_MAX / HZ)
+ return -EINVAL;
+ rose->t2 = opt * HZ;
+ return 0;
+
+ case ROSE_T3:
+- if (opt < 1)
++ if (opt < 1 || opt > UINT_MAX / HZ)
+ return -EINVAL;
+ rose->t3 = opt * HZ;
+ return 0;
+
+ case ROSE_HOLDBACK:
+- if (opt < 1)
++ if (opt < 1 || opt > UINT_MAX / HZ)
+ return -EINVAL;
+ rose->hb = opt * HZ;
+ return 0;
+
+ case ROSE_IDLE:
+- if (opt < 0)
++ if (opt > UINT_MAX / (60 * HZ))
+ return -EINVAL;
+ rose->idle = opt * 60 * HZ;
+ return 0;
+--
+2.39.5
+
--- /dev/null
+From 5f67a648160aa8e5a4d2832ede7a0b9c0a1e12c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2025 17:37:13 -0800
+Subject: net: sched: Disallow replacing of child qdisc from one parent to
+ another
+
+From: Jamal Hadi Salim <jhs@mojatatu.com>
+
+[ Upstream commit bc50835e83f60f56e9bec2b392fb5544f250fb6f ]
+
+Lion Ackermann was able to create a UAF which can be abused for privilege
+escalation with the following script
+
+Step 1. create root qdisc
+tc qdisc add dev lo root handle 1:0 drr
+
+step2. a class for packet aggregation do demonstrate uaf
+tc class add dev lo classid 1:1 drr
+
+step3. a class for nesting
+tc class add dev lo classid 1:2 drr
+
+step4. a class to graft qdisc to
+tc class add dev lo classid 1:3 drr
+
+step5.
+tc qdisc add dev lo parent 1:1 handle 2:0 plug limit 1024
+
+step6.
+tc qdisc add dev lo parent 1:2 handle 3:0 drr
+
+step7.
+tc class add dev lo classid 3:1 drr
+
+step 8.
+tc qdisc add dev lo parent 3:1 handle 4:0 pfifo
+
+step 9. Display the class/qdisc layout
+
+tc class ls dev lo
+ class drr 1:1 root leaf 2: quantum 64Kb
+ class drr 1:2 root leaf 3: quantum 64Kb
+ class drr 3:1 root leaf 4: quantum 64Kb
+
+tc qdisc ls
+ qdisc drr 1: dev lo root refcnt 2
+ qdisc plug 2: dev lo parent 1:1
+ qdisc pfifo 4: dev lo parent 3:1 limit 1000p
+ qdisc drr 3: dev lo parent 1:2
+
+step10. trigger the bug <=== prevented by this patch
+tc qdisc replace dev lo parent 1:3 handle 4:0
+
+step 11. Redisplay again the qdiscs/classes
+
+tc class ls dev lo
+ class drr 1:1 root leaf 2: quantum 64Kb
+ class drr 1:2 root leaf 3: quantum 64Kb
+ class drr 1:3 root leaf 4: quantum 64Kb
+ class drr 3:1 root leaf 4: quantum 64Kb
+
+tc qdisc ls
+ qdisc drr 1: dev lo root refcnt 2
+ qdisc plug 2: dev lo parent 1:1
+ qdisc pfifo 4: dev lo parent 3:1 refcnt 2 limit 1000p
+ qdisc drr 3: dev lo parent 1:2
+
+Observe that a) parent for 4:0 does not change despite the replace request.
+There can only be one parent. b) refcount has gone up by two for 4:0 and
+c) both class 1:3 and 3:1 are pointing to it.
+
+Step 12. send one packet to plug
+echo "" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10001))
+step13. send one packet to the grafted fifo
+echo "" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10003))
+
+step14. lets trigger the uaf
+tc class delete dev lo classid 1:3
+tc class delete dev lo classid 1:1
+
+The semantics of "replace" is for a del/add _on the same node_ and not
+a delete from one node(3:1) and add to another node (1:3) as in step10.
+While we could "fix" with a more complex approach there could be
+consequences to expectations so the patch takes the preventive approach of
+"disallow such config".
+
+Joint work with Lion Ackermann <nnamrec@gmail.com>
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250116013713.900000-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_api.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
+index fe053e717260e..cb379849c51a4 100644
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -1638,6 +1638,10 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
+ q = qdisc_lookup(dev, tcm->tcm_handle);
+ if (!q)
+ goto create_n_graft;
++ if (q->parent != tcm->tcm_parent) {
++ NL_SET_ERR_MSG(extack, "Cannot move an existing qdisc to a different parent");
++ return -EINVAL;
++ }
+ if (n->nlmsg_flags & NLM_F_EXCL) {
+ NL_SET_ERR_MSG(extack, "Exclusivity flag on, cannot override");
+ return -EEXIST;
+--
+2.39.5
+
--- /dev/null
+From 162a2cea22a3b6d079dd80a0ab0dc90cfb44b7f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jan 2025 10:50:47 +0100
+Subject: net: sh_eth: Fix missing rtnl lock in suspend/resume path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kory Maincent <kory.maincent@bootlin.com>
+
+[ Upstream commit b95102215a8d0987789715ce11c0d4ec031cbfbe ]
+
+Fix the suspend/resume path by ensuring the rtnl lock is held where
+required. Calls to sh_eth_close, sh_eth_open and wol operations must be
+performed under the rtnl lock to prevent conflicts with ongoing ndo
+operations.
+
+Fixes: b71af04676e9 ("sh_eth: add more PM methods")
+Tested-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/renesas/sh_eth.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index 14dc5833c465c..5f4297e83aafe 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -3473,10 +3473,12 @@ static int sh_eth_suspend(struct device *dev)
+
+ netif_device_detach(ndev);
+
++ rtnl_lock();
+ if (mdp->wol_enabled)
+ ret = sh_eth_wol_setup(ndev);
+ else
+ ret = sh_eth_close(ndev);
++ rtnl_unlock();
+
+ return ret;
+ }
+@@ -3490,10 +3492,12 @@ static int sh_eth_resume(struct device *dev)
+ if (!netif_running(ndev))
+ return 0;
+
++ rtnl_lock();
+ if (mdp->wol_enabled)
+ ret = sh_eth_wol_restore(ndev);
+ else
+ ret = sh_eth_open(ndev);
++ rtnl_unlock();
+
+ if (ret < 0)
+ return ret;
+--
+2.39.5
+
--- /dev/null
+From c4b95a2fbb4941a133ede69d1fc389c29b1b0d4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jan 2025 22:32:01 +0800
+Subject: net/smc: fix data error when recvmsg with MSG_PEEK flag
+
+From: Guangguan Wang <guangguan.wang@linux.alibaba.com>
+
+[ Upstream commit a4b6539038c1aa1ae871aacf6e41b566c3613993 ]
+
+When recvmsg with MSG_PEEK flag, the data will be copied to
+user's buffer without advancing consume cursor and without
+reducing the length of rx available data. Once the expected
+peek length is larger than the value of bytes_to_rcv, in the
+loop of do while in smc_rx_recvmsg, the first loop will copy
+bytes_to_rcv bytes of data from the position local_tx_ctrl.cons,
+the second loop will copy the min(bytes_to_rcv, read_remaining)
+bytes from the position local_tx_ctrl.cons again because of the
+lacking of process with advancing consume cursor and reducing
+the length of available data. So do the subsequent loops. The
+data copied in the second loop and the subsequent loops will
+result in data error, as it should not be copied if no more data
+arrives and it should be copied from the position advancing
+bytes_to_rcv bytes from the local_tx_ctrl.cons if more data arrives.
+
+This issue can be reproduce by the following python script:
+server.py:
+import socket
+import time
+server_ip = '0.0.0.0'
+server_port = 12346
+server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+server_socket.bind((server_ip, server_port))
+server_socket.listen(1)
+print('Server is running and listening for connections...')
+conn, addr = server_socket.accept()
+print('Connected by', addr)
+while True:
+ data = conn.recv(1024)
+ if not data:
+ break
+ print('Received request:', data.decode())
+ conn.sendall(b'Hello, client!\n')
+ time.sleep(5)
+ conn.sendall(b'Hello, again!\n')
+conn.close()
+
+client.py:
+import socket
+server_ip = '<server ip>'
+server_port = 12346
+resp=b'Hello, client!\nHello, again!\n'
+client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+client_socket.connect((server_ip, server_port))
+request = 'Hello, server!'
+client_socket.sendall(request.encode())
+peek_data = client_socket.recv(len(resp),
+ socket.MSG_PEEK | socket.MSG_WAITALL)
+print('Peeked data:', peek_data.decode())
+client_socket.close()
+
+Fixes: 952310ccf2d8 ("smc: receive data from RMBE")
+Reported-by: D. Wythe <alibuda@linux.alibaba.com>
+Signed-off-by: Guangguan Wang <guangguan.wang@linux.alibaba.com>
+Link: https://patch.msgid.link/20250104143201.35529-1-guangguan.wang@linux.alibaba.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/af_smc.c | 2 +-
+ net/smc/smc_rx.c | 37 +++++++++++++++++++++----------------
+ net/smc/smc_rx.h | 8 ++++----
+ 3 files changed, 26 insertions(+), 21 deletions(-)
+
+diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
+index e2bdd6aa3d89c..c951e5c483b51 100644
+--- a/net/smc/af_smc.c
++++ b/net/smc/af_smc.c
+@@ -2645,7 +2645,7 @@ static int smc_accept(struct socket *sock, struct socket *new_sock,
+ release_sock(clcsk);
+ } else if (!atomic_read(&smc_sk(nsk)->conn.bytes_to_rcv)) {
+ lock_sock(nsk);
+- smc_rx_wait(smc_sk(nsk), &timeo, smc_rx_data_available);
++ smc_rx_wait(smc_sk(nsk), &timeo, 0, smc_rx_data_available);
+ release_sock(nsk);
+ }
+ }
+diff --git a/net/smc/smc_rx.c b/net/smc/smc_rx.c
+index ffcc9996a3da3..e57002d2ac372 100644
+--- a/net/smc/smc_rx.c
++++ b/net/smc/smc_rx.c
+@@ -234,22 +234,23 @@ static int smc_rx_splice(struct pipe_inode_info *pipe, char *src, size_t len,
+ return -ENOMEM;
+ }
+
+-static int smc_rx_data_available_and_no_splice_pend(struct smc_connection *conn)
++static int smc_rx_data_available_and_no_splice_pend(struct smc_connection *conn, size_t peeked)
+ {
+- return atomic_read(&conn->bytes_to_rcv) &&
++ return smc_rx_data_available(conn, peeked) &&
+ !atomic_read(&conn->splice_pending);
+ }
+
+ /* blocks rcvbuf consumer until >=len bytes available or timeout or interrupted
+ * @smc smc socket
+ * @timeo pointer to max seconds to wait, pointer to value 0 for no timeout
++ * @peeked number of bytes already peeked
+ * @fcrit add'l criterion to evaluate as function pointer
+ * Returns:
+ * 1 if at least 1 byte available in rcvbuf or if socket error/shutdown.
+ * 0 otherwise (nothing in rcvbuf nor timeout, e.g. interrupted).
+ */
+-int smc_rx_wait(struct smc_sock *smc, long *timeo,
+- int (*fcrit)(struct smc_connection *conn))
++int smc_rx_wait(struct smc_sock *smc, long *timeo, size_t peeked,
++ int (*fcrit)(struct smc_connection *conn, size_t baseline))
+ {
+ DEFINE_WAIT_FUNC(wait, woken_wake_function);
+ struct smc_connection *conn = &smc->conn;
+@@ -258,7 +259,7 @@ int smc_rx_wait(struct smc_sock *smc, long *timeo,
+ struct sock *sk = &smc->sk;
+ int rc;
+
+- if (fcrit(conn))
++ if (fcrit(conn, peeked))
+ return 1;
+ sk_set_bit(SOCKWQ_ASYNC_WAITDATA, sk);
+ add_wait_queue(sk_sleep(sk), &wait);
+@@ -267,7 +268,7 @@ int smc_rx_wait(struct smc_sock *smc, long *timeo,
+ cflags->peer_conn_abort ||
+ READ_ONCE(sk->sk_shutdown) & RCV_SHUTDOWN ||
+ conn->killed ||
+- fcrit(conn),
++ fcrit(conn, peeked),
+ &wait);
+ remove_wait_queue(sk_sleep(sk), &wait);
+ sk_clear_bit(SOCKWQ_ASYNC_WAITDATA, sk);
+@@ -318,11 +319,11 @@ static int smc_rx_recv_urg(struct smc_sock *smc, struct msghdr *msg, int len,
+ return -EAGAIN;
+ }
+
+-static bool smc_rx_recvmsg_data_available(struct smc_sock *smc)
++static bool smc_rx_recvmsg_data_available(struct smc_sock *smc, size_t peeked)
+ {
+ struct smc_connection *conn = &smc->conn;
+
+- if (smc_rx_data_available(conn))
++ if (smc_rx_data_available(conn, peeked))
+ return true;
+ else if (conn->urg_state == SMC_URG_VALID)
+ /* we received a single urgent Byte - skip */
+@@ -340,10 +341,10 @@ static bool smc_rx_recvmsg_data_available(struct smc_sock *smc)
+ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg,
+ struct pipe_inode_info *pipe, size_t len, int flags)
+ {
+- size_t copylen, read_done = 0, read_remaining = len;
++ size_t copylen, read_done = 0, read_remaining = len, peeked_bytes = 0;
+ size_t chunk_len, chunk_off, chunk_len_sum;
+ struct smc_connection *conn = &smc->conn;
+- int (*func)(struct smc_connection *conn);
++ int (*func)(struct smc_connection *conn, size_t baseline);
+ union smc_host_cursor cons;
+ int readable, chunk;
+ char *rcvbuf_base;
+@@ -380,14 +381,14 @@ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg,
+ if (conn->killed)
+ break;
+
+- if (smc_rx_recvmsg_data_available(smc))
++ if (smc_rx_recvmsg_data_available(smc, peeked_bytes))
+ goto copy;
+
+ if (sk->sk_shutdown & RCV_SHUTDOWN) {
+ /* smc_cdc_msg_recv_action() could have run after
+ * above smc_rx_recvmsg_data_available()
+ */
+- if (smc_rx_recvmsg_data_available(smc))
++ if (smc_rx_recvmsg_data_available(smc, peeked_bytes))
+ goto copy;
+ break;
+ }
+@@ -421,26 +422,28 @@ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg,
+ }
+ }
+
+- if (!smc_rx_data_available(conn)) {
+- smc_rx_wait(smc, &timeo, smc_rx_data_available);
++ if (!smc_rx_data_available(conn, peeked_bytes)) {
++ smc_rx_wait(smc, &timeo, peeked_bytes, smc_rx_data_available);
+ continue;
+ }
+
+ copy:
+ /* initialize variables for 1st iteration of subsequent loop */
+ /* could be just 1 byte, even after waiting on data above */
+- readable = atomic_read(&conn->bytes_to_rcv);
++ readable = smc_rx_data_available(conn, peeked_bytes);
+ splbytes = atomic_read(&conn->splice_pending);
+ if (!readable || (msg && splbytes)) {
+ if (splbytes)
+ func = smc_rx_data_available_and_no_splice_pend;
+ else
+ func = smc_rx_data_available;
+- smc_rx_wait(smc, &timeo, func);
++ smc_rx_wait(smc, &timeo, peeked_bytes, func);
+ continue;
+ }
+
+ smc_curs_copy(&cons, &conn->local_tx_ctrl.cons, conn);
++ if ((flags & MSG_PEEK) && peeked_bytes)
++ smc_curs_add(conn->rmb_desc->len, &cons, peeked_bytes);
+ /* subsequent splice() calls pick up where previous left */
+ if (splbytes)
+ smc_curs_add(conn->rmb_desc->len, &cons, splbytes);
+@@ -476,6 +479,8 @@ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg,
+ }
+ read_remaining -= chunk_len;
+ read_done += chunk_len;
++ if (flags & MSG_PEEK)
++ peeked_bytes += chunk_len;
+
+ if (chunk_len_sum == copylen)
+ break; /* either on 1st or 2nd iteration */
+diff --git a/net/smc/smc_rx.h b/net/smc/smc_rx.h
+index db823c97d824e..994f5e42d1ba2 100644
+--- a/net/smc/smc_rx.h
++++ b/net/smc/smc_rx.h
+@@ -21,11 +21,11 @@ void smc_rx_init(struct smc_sock *smc);
+
+ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg,
+ struct pipe_inode_info *pipe, size_t len, int flags);
+-int smc_rx_wait(struct smc_sock *smc, long *timeo,
+- int (*fcrit)(struct smc_connection *conn));
+-static inline int smc_rx_data_available(struct smc_connection *conn)
++int smc_rx_wait(struct smc_sock *smc, long *timeo, size_t peeked,
++ int (*fcrit)(struct smc_connection *conn, size_t baseline));
++static inline int smc_rx_data_available(struct smc_connection *conn, size_t peeked)
+ {
+- return atomic_read(&conn->bytes_to_rcv);
++ return atomic_read(&conn->bytes_to_rcv) - peeked;
+ }
+
+ #endif /* SMC_RX_H */
+--
+2.39.5
+
--- /dev/null
+From 501cc8939a0a040e70062d35755c7128ee1261e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Apr 2024 18:00:15 +0000
+Subject: net_sched: sch_sfq: annotate data-races around q->perturb_period
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit a17ef9e6c2c1cf0fc6cd6ca6a9ce525c67d1da7f ]
+
+sfq_perturbation() reads q->perturb_period locklessly.
+Add annotations to fix potential issues.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://lore.kernel.org/r/20240430180015.3111398-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 10685681bafc ("net_sched: sch_sfq: don't allow 1 packet limit")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_sfq.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
+index 66dcb18638fea..ed362eefeea9a 100644
+--- a/net/sched/sch_sfq.c
++++ b/net/sched/sch_sfq.c
+@@ -608,6 +608,7 @@ static void sfq_perturbation(struct timer_list *t)
+ struct Qdisc *sch = q->sch;
+ spinlock_t *root_lock;
+ siphash_key_t nkey;
++ int period;
+
+ get_random_bytes(&nkey, sizeof(nkey));
+ rcu_read_lock();
+@@ -618,8 +619,12 @@ static void sfq_perturbation(struct timer_list *t)
+ sfq_rehash(sch);
+ spin_unlock(root_lock);
+
+- if (q->perturb_period)
+- mod_timer(&q->perturb_timer, jiffies + q->perturb_period);
++ /* q->perturb_period can change under us from
++ * sfq_change() and sfq_destroy().
++ */
++ period = READ_ONCE(q->perturb_period);
++ if (period)
++ mod_timer(&q->perturb_timer, jiffies + period);
+ rcu_read_unlock();
+ }
+
+@@ -662,7 +667,7 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt)
+ q->quantum = ctl->quantum;
+ q->scaled_quantum = SFQ_ALLOT_SIZE(q->quantum);
+ }
+- q->perturb_period = ctl->perturb_period * HZ;
++ WRITE_ONCE(q->perturb_period, ctl->perturb_period * HZ);
+ if (ctl->flows)
+ q->maxflows = min_t(u32, ctl->flows, SFQ_MAX_FLOWS);
+ if (ctl->divisor) {
+@@ -724,7 +729,7 @@ static void sfq_destroy(struct Qdisc *sch)
+ struct sfq_sched_data *q = qdisc_priv(sch);
+
+ tcf_block_put(q->block);
+- q->perturb_period = 0;
++ WRITE_ONCE(q->perturb_period, 0);
+ del_timer_sync(&q->perturb_timer);
+ sfq_free(q->ht);
+ sfq_free(q->slots);
+--
+2.39.5
+
--- /dev/null
+From 143ba087bd3d00da40c578471cadf0a066e46d89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2024 19:05:19 -0800
+Subject: net_sched: sch_sfq: don't allow 1 packet limit
+
+From: Octavian Purdila <tavip@google.com>
+
+[ Upstream commit 10685681bafce6febb39770f3387621bf5d67d0b ]
+
+The current implementation does not work correctly with a limit of
+1. iproute2 actually checks for this and this patch adds the check in
+kernel as well.
+
+This fixes the following syzkaller reported crash:
+
+UBSAN: array-index-out-of-bounds in net/sched/sch_sfq.c:210:6
+index 65535 is out of range for type 'struct sfq_head[128]'
+CPU: 0 PID: 2569 Comm: syz-executor101 Not tainted 5.10.0-smp-DEV #1
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
+Call Trace:
+ __dump_stack lib/dump_stack.c:79 [inline]
+ dump_stack+0x125/0x19f lib/dump_stack.c:120
+ ubsan_epilogue lib/ubsan.c:148 [inline]
+ __ubsan_handle_out_of_bounds+0xed/0x120 lib/ubsan.c:347
+ sfq_link net/sched/sch_sfq.c:210 [inline]
+ sfq_dec+0x528/0x600 net/sched/sch_sfq.c:238
+ sfq_dequeue+0x39b/0x9d0 net/sched/sch_sfq.c:500
+ sfq_reset+0x13/0x50 net/sched/sch_sfq.c:525
+ qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026
+ tbf_reset+0x3d/0x100 net/sched/sch_tbf.c:319
+ qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026
+ dev_reset_queue+0x8c/0x140 net/sched/sch_generic.c:1296
+ netdev_for_each_tx_queue include/linux/netdevice.h:2350 [inline]
+ dev_deactivate_many+0x6dc/0xc20 net/sched/sch_generic.c:1362
+ __dev_close_many+0x214/0x350 net/core/dev.c:1468
+ dev_close_many+0x207/0x510 net/core/dev.c:1506
+ unregister_netdevice_many+0x40f/0x16b0 net/core/dev.c:10738
+ unregister_netdevice_queue+0x2be/0x310 net/core/dev.c:10695
+ unregister_netdevice include/linux/netdevice.h:2893 [inline]
+ __tun_detach+0x6b6/0x1600 drivers/net/tun.c:689
+ tun_detach drivers/net/tun.c:705 [inline]
+ tun_chr_close+0x104/0x1b0 drivers/net/tun.c:3640
+ __fput+0x203/0x840 fs/file_table.c:280
+ task_work_run+0x129/0x1b0 kernel/task_work.c:185
+ exit_task_work include/linux/task_work.h:33 [inline]
+ do_exit+0x5ce/0x2200 kernel/exit.c:931
+ do_group_exit+0x144/0x310 kernel/exit.c:1046
+ __do_sys_exit_group kernel/exit.c:1057 [inline]
+ __se_sys_exit_group kernel/exit.c:1055 [inline]
+ __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1055
+ do_syscall_64+0x6c/0xd0
+ entry_SYSCALL_64_after_hwframe+0x61/0xcb
+RIP: 0033:0x7fe5e7b52479
+Code: Unable to access opcode bytes at RIP 0x7fe5e7b5244f.
+RSP: 002b:00007ffd3c800398 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
+RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe5e7b52479
+RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
+RBP: 00007fe5e7bcd2d0 R08: ffffffffffffffb8 R09: 0000000000000014
+R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe5e7bcd2d0
+R13: 0000000000000000 R14: 00007fe5e7bcdd20 R15: 00007fe5e7b24270
+
+The crash can be also be reproduced with the following (with a tc
+recompiled to allow for sfq limits of 1):
+
+tc qdisc add dev dummy0 handle 1: root tbf rate 1Kbit burst 100b lat 1s
+../iproute2-6.9.0/tc/tc qdisc add dev dummy0 handle 2: parent 1:10 sfq limit 1
+ifconfig dummy0 up
+ping -I dummy0 -f -c2 -W0.1 8.8.8.8
+sleep 1
+
+Scenario that triggers the crash:
+
+* the first packet is sent and queued in TBF and SFQ; qdisc qlen is 1
+
+* TBF dequeues: it peeks from SFQ which moves the packet to the
+ gso_skb list and keeps qdisc qlen set to 1. TBF is out of tokens so
+ it schedules itself for later.
+
+* the second packet is sent and TBF tries to queues it to SFQ. qdisc
+ qlen is now 2 and because the SFQ limit is 1 the packet is dropped
+ by SFQ. At this point qlen is 1, and all of the SFQ slots are empty,
+ however q->tail is not NULL.
+
+At this point, assuming no more packets are queued, when sch_dequeue
+runs again it will decrement the qlen for the current empty slot
+causing an underflow and the subsequent out of bounds access.
+
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Octavian Purdila <tavip@google.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20241204030520.2084663-2-tavip@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_sfq.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
+index 7d4feae2fae36..60754f366ab7b 100644
+--- a/net/sched/sch_sfq.c
++++ b/net/sched/sch_sfq.c
+@@ -652,6 +652,10 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt,
+ if (!p)
+ return -ENOMEM;
+ }
++ if (ctl->limit == 1) {
++ NL_SET_ERR_MSG_MOD(extack, "invalid limit");
++ return -EINVAL;
++ }
+ sch_tree_lock(sch);
+ if (ctl->quantum)
+ q->quantum = ctl->quantum;
+--
+2.39.5
+
--- /dev/null
+From dadf692cee6e54883486804e88c1e202812e2706 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 11:16:03 +0000
+Subject: net_sched: sch_sfq: handle bigger packets
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit e4650d7ae4252f67e997a632adfae0dd74d3a99a ]
+
+SFQ has an assumption on dealing with packets smaller than 64KB.
+
+Even before BIG TCP, TCA_STAB can provide arbitrary big values
+in qdisc_pkt_len(skb)
+
+It is time to switch (struct sfq_slot)->allot to a 32bit field.
+
+sizeof(struct sfq_slot) is now 64 bytes, giving better cache locality.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Link: https://patch.msgid.link/20241008111603.653140-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 10685681bafc ("net_sched: sch_sfq: don't allow 1 packet limit")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_sfq.c | 39 +++++++++++++--------------------------
+ 1 file changed, 13 insertions(+), 26 deletions(-)
+
+diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
+index ed362eefeea9a..7d4feae2fae36 100644
+--- a/net/sched/sch_sfq.c
++++ b/net/sched/sch_sfq.c
+@@ -77,12 +77,6 @@
+ #define SFQ_EMPTY_SLOT 0xffff
+ #define SFQ_DEFAULT_HASH_DIVISOR 1024
+
+-/* We use 16 bits to store allot, and want to handle packets up to 64K
+- * Scale allot by 8 (1<<3) so that no overflow occurs.
+- */
+-#define SFQ_ALLOT_SHIFT 3
+-#define SFQ_ALLOT_SIZE(X) DIV_ROUND_UP(X, 1 << SFQ_ALLOT_SHIFT)
+-
+ /* This type should contain at least SFQ_MAX_DEPTH + 1 + SFQ_MAX_FLOWS values */
+ typedef u16 sfq_index;
+
+@@ -104,7 +98,7 @@ struct sfq_slot {
+ sfq_index next; /* next slot in sfq RR chain */
+ struct sfq_head dep; /* anchor in dep[] chains */
+ unsigned short hash; /* hash value (index in ht[]) */
+- short allot; /* credit for this slot */
++ int allot; /* credit for this slot */
+
+ unsigned int backlog;
+ struct red_vars vars;
+@@ -120,7 +114,6 @@ struct sfq_sched_data {
+ siphash_key_t perturbation;
+ u8 cur_depth; /* depth of longest slot */
+ u8 flags;
+- unsigned short scaled_quantum; /* SFQ_ALLOT_SIZE(quantum) */
+ struct tcf_proto __rcu *filter_list;
+ struct tcf_block *block;
+ sfq_index *ht; /* Hash table ('divisor' slots) */
+@@ -456,7 +449,7 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free)
+ */
+ q->tail = slot;
+ /* We could use a bigger initial quantum for new flows */
+- slot->allot = q->scaled_quantum;
++ slot->allot = q->quantum;
+ }
+ if (++sch->q.qlen <= q->limit)
+ return NET_XMIT_SUCCESS;
+@@ -493,7 +486,7 @@ sfq_dequeue(struct Qdisc *sch)
+ slot = &q->slots[a];
+ if (slot->allot <= 0) {
+ q->tail = slot;
+- slot->allot += q->scaled_quantum;
++ slot->allot += q->quantum;
+ goto next_slot;
+ }
+ skb = slot_dequeue_head(slot);
+@@ -512,7 +505,7 @@ sfq_dequeue(struct Qdisc *sch)
+ }
+ q->tail->next = next_a;
+ } else {
+- slot->allot -= SFQ_ALLOT_SIZE(qdisc_pkt_len(skb));
++ slot->allot -= qdisc_pkt_len(skb);
+ }
+ return skb;
+ }
+@@ -595,7 +588,7 @@ static void sfq_rehash(struct Qdisc *sch)
+ q->tail->next = x;
+ }
+ q->tail = slot;
+- slot->allot = q->scaled_quantum;
++ slot->allot = q->quantum;
+ }
+ }
+ sch->q.qlen -= dropped;
+@@ -628,7 +621,8 @@ static void sfq_perturbation(struct timer_list *t)
+ rcu_read_unlock();
+ }
+
+-static int sfq_change(struct Qdisc *sch, struct nlattr *opt)
++static int sfq_change(struct Qdisc *sch, struct nlattr *opt,
++ struct netlink_ext_ack *extack)
+ {
+ struct sfq_sched_data *q = qdisc_priv(sch);
+ struct tc_sfq_qopt *ctl = nla_data(opt);
+@@ -646,14 +640,10 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt)
+ (!is_power_of_2(ctl->divisor) || ctl->divisor > 65536))
+ return -EINVAL;
+
+- /* slot->allot is a short, make sure quantum is not too big. */
+- if (ctl->quantum) {
+- unsigned int scaled = SFQ_ALLOT_SIZE(ctl->quantum);
+-
+- if (scaled <= 0 || scaled > SHRT_MAX)
+- return -EINVAL;
++ if ((int)ctl->quantum < 0) {
++ NL_SET_ERR_MSG_MOD(extack, "invalid quantum");
++ return -EINVAL;
+ }
+-
+ if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max,
+ ctl_v1->Wlog, ctl_v1->Scell_log, NULL))
+ return -EINVAL;
+@@ -663,10 +653,8 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt)
+ return -ENOMEM;
+ }
+ sch_tree_lock(sch);
+- if (ctl->quantum) {
++ if (ctl->quantum)
+ q->quantum = ctl->quantum;
+- q->scaled_quantum = SFQ_ALLOT_SIZE(q->quantum);
+- }
+ WRITE_ONCE(q->perturb_period, ctl->perturb_period * HZ);
+ if (ctl->flows)
+ q->maxflows = min_t(u32, ctl->flows, SFQ_MAX_FLOWS);
+@@ -762,12 +750,11 @@ static int sfq_init(struct Qdisc *sch, struct nlattr *opt,
+ q->divisor = SFQ_DEFAULT_HASH_DIVISOR;
+ q->maxflows = SFQ_DEFAULT_FLOWS;
+ q->quantum = psched_mtu(qdisc_dev(sch));
+- q->scaled_quantum = SFQ_ALLOT_SIZE(q->quantum);
+ q->perturb_period = 0;
+ get_random_bytes(&q->perturbation, sizeof(q->perturbation));
+
+ if (opt) {
+- int err = sfq_change(sch, opt);
++ int err = sfq_change(sch, opt, extack);
+ if (err)
+ return err;
+ }
+@@ -878,7 +865,7 @@ static int sfq_dump_class_stats(struct Qdisc *sch, unsigned long cl,
+ if (idx != SFQ_EMPTY_SLOT) {
+ const struct sfq_slot *slot = &q->slots[idx];
+
+- xstats.allot = slot->allot << SFQ_ALLOT_SHIFT;
++ xstats.allot = slot->allot;
+ qs.qlen = slot->qlen;
+ qs.backlog = slot->backlog;
+ }
+--
+2.39.5
+
--- /dev/null
+From 1bfbf3205b67f3e5251428facbe5313356279054 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jan 2025 00:50:34 +0100
+Subject: netfilter: nft_flow_offload: update tcp state flags under lock
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 7a4b61406395291ffb7220a10e8951a9a8684819 ]
+
+The conntrack entry is already public, there is a small chance that another
+CPU is handling a packet in reply direction and racing with the tcp state
+update.
+
+Move this under ct spinlock.
+
+This is done once, when ct is about to be offloaded, so this should
+not result in a noticeable performance hit.
+
+Fixes: 8437a6209f76 ("netfilter: nft_flow_offload: set liberal tracking mode for tcp")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_flow_offload.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
+index 7a8707632a815..9d335aa58907d 100644
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -288,6 +288,15 @@ static bool nft_flow_offload_skip(struct sk_buff *skb, int family)
+ return false;
+ }
+
++static void flow_offload_ct_tcp(struct nf_conn *ct)
++{
++ /* conntrack will not see all packets, disable tcp window validation. */
++ spin_lock_bh(&ct->lock);
++ ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
++ ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
++ spin_unlock_bh(&ct->lock);
++}
++
+ static void nft_flow_offload_eval(const struct nft_expr *expr,
+ struct nft_regs *regs,
+ const struct nft_pktinfo *pkt)
+@@ -355,11 +364,8 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
+ goto err_flow_alloc;
+
+ flow_offload_route_init(flow, &route);
+-
+- if (tcph) {
+- ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
+- ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
+- }
++ if (tcph)
++ flow_offload_ct_tcp(ct);
+
+ ret = flow_offload_add(flowtable, flow);
+ if (ret < 0)
+--
+2.39.5
+
--- /dev/null
+From 6599b279fd1e8b08d88e088c8a2139cc0301c7f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2024 11:52:00 -0500
+Subject: NFSv4.2: fix COPY_NOTIFY xdr buf size calculation
+
+From: Olga Kornievskaia <okorniev@redhat.com>
+
+[ Upstream commit e8380c2d06055665b3df6c03964911375d7f9290 ]
+
+We need to include sequence size in the compound.
+
+Fixes: 0491567b51ef ("NFS: add COPY_NOTIFY operation")
+Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs42xdr.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/nfs/nfs42xdr.c b/fs/nfs/nfs42xdr.c
+index 20aa5e746497d..fd51fd1cf5ff7 100644
+--- a/fs/nfs/nfs42xdr.c
++++ b/fs/nfs/nfs42xdr.c
+@@ -129,9 +129,11 @@
+ decode_putfh_maxsz + \
+ decode_offload_cancel_maxsz)
+ #define NFS4_enc_copy_notify_sz (compound_encode_hdr_maxsz + \
++ encode_sequence_maxsz + \
+ encode_putfh_maxsz + \
+ encode_copy_notify_maxsz)
+ #define NFS4_dec_copy_notify_sz (compound_decode_hdr_maxsz + \
++ decode_sequence_maxsz + \
+ decode_putfh_maxsz + \
+ decode_copy_notify_maxsz)
+ #define NFS4_enc_deallocate_sz (compound_encode_hdr_maxsz + \
+--
+2.39.5
+
--- /dev/null
+From a3393422de2ee95f3b79bcdf448ae1d9aa4f495f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2024 11:52:01 -0500
+Subject: NFSv4.2: mark OFFLOAD_CANCEL MOVEABLE
+
+From: Olga Kornievskaia <okorniev@redhat.com>
+
+[ Upstream commit 668135b9348c53fd205f5e07d11e82b10f31b55b ]
+
+OFFLOAD_CANCEL should be marked MOVEABLE for when we need to move
+tasks off a non-functional transport.
+
+Fixes: c975c2092657 ("NFS send OFFLOAD_CANCEL when COPY killed")
+Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs42proc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
+index 89c32a963dd15..923ccd3b540f5 100644
+--- a/fs/nfs/nfs42proc.c
++++ b/fs/nfs/nfs42proc.c
+@@ -551,7 +551,7 @@ static int nfs42_do_offload_cancel_async(struct file *dst,
+ .rpc_message = &msg,
+ .callback_ops = &nfs42_offload_cancel_ops,
+ .workqueue = nfsiod_workqueue,
+- .flags = RPC_TASK_ASYNC,
++ .flags = RPC_TASK_ASYNC | RPC_TASK_MOVEABLE,
+ };
+ int status;
+
+--
+2.39.5
+
--- /dev/null
+From 33f3384382a9c44c640c2e47f724e2939a65c946 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2024 13:00:47 +0100
+Subject: nvme: Add error check for xa_store in nvme_get_effects_log
+
+From: Keisuke Nishimura <keisuke.nishimura@inria.fr>
+
+[ Upstream commit ac32057acc7f3d7a238dafaa9b2aa2bc9750080e ]
+
+The xa_store() may fail due to memory allocation failure because there
+is no guarantee that the index csi is already used. This fix adds an
+error check of the return value of xa_store() in nvme_get_effects_log().
+
+Fixes: 1cf7a12e09aa ("nvme: use an xarray to lookup the Commands Supported and Effects log")
+Signed-off-by: Keisuke Nishimura <keisuke.nishimura@inria.fr>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 92ffeb6605618..abca395385b2e 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3099,7 +3099,7 @@ int nvme_get_log(struct nvme_ctrl *ctrl, u32 nsid, u8 log_page, u8 lsp, u8 csi,
+ static int nvme_get_effects_log(struct nvme_ctrl *ctrl, u8 csi,
+ struct nvme_effects_log **log)
+ {
+- struct nvme_effects_log *cel = xa_load(&ctrl->cels, csi);
++ struct nvme_effects_log *old, *cel = xa_load(&ctrl->cels, csi);
+ int ret;
+
+ if (cel)
+@@ -3116,7 +3116,11 @@ static int nvme_get_effects_log(struct nvme_ctrl *ctrl, u8 csi,
+ return ret;
+ }
+
+- xa_store(&ctrl->cels, csi, cel, GFP_KERNEL);
++ old = xa_store(&ctrl->cels, csi, cel, GFP_KERNEL);
++ if (xa_is_err(old)) {
++ kfree(cel);
++ return xa_err(old);
++ }
+ out:
+ *log = cel;
+ return 0;
+--
+2.39.5
+
--- /dev/null
+From a7a1be0802cc91d4e4f64261396afcd96cf8204e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jan 2025 22:06:53 +0800
+Subject: ocfs2: mark dquot as inactive if failed to start trans while
+ releasing dquot
+
+From: Su Yue <glass.su@suse.com>
+
+[ Upstream commit 276c61385f6bc3223a5ecd307cf4aba2dfbb9a31 ]
+
+While running fstests generic/329, the kernel workqueue
+quota_release_workfn is dead looping in calling ocfs2_release_dquot().
+The ocfs2 state is already readonly but ocfs2_release_dquot wants to
+start a transaction but fails and returns.
+
+=====================================================================
+[ 2918.123602 ][ T275 ] On-disk corruption discovered. Please run
+fsck.ocfs2 once the filesystem is unmounted.
+[ 2918.124034 ][ T275 ] (kworker/u135:1,275,11):ocfs2_release_dquot:765
+ERROR: status = -30
+[ 2918.124452 ][ T275 ] (kworker/u135:1,275,11):ocfs2_release_dquot:795
+ERROR: status = -30
+[ 2918.124883 ][ T275 ] (kworker/u135:1,275,11):ocfs2_start_trans:357
+ERROR: status = -30
+[ 2918.125276 ][ T275 ] OCFS2: abort (device dm-0): ocfs2_start_trans:
+Detected aborted journal
+[ 2918.125710 ][ T275 ] On-disk corruption discovered. Please run
+fsck.ocfs2 once the filesystem is unmounted.
+=====================================================================
+
+ocfs2_release_dquot() is much like dquot_release(), which is called by
+ext4 to handle similar situation. So here fix it by marking the dquot as
+inactive like what dquot_release() does.
+
+Link: https://lkml.kernel.org/r/20250106140653.92292-1-glass.su@suse.com
+Fixes: 9e33d69f553a ("ocfs2: Implementation of local and global quota file handling")
+Signed-off-by: Su Yue <glass.su@suse.com>
+Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Jun Piao <piaojun@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/quota_global.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c
+index 0dffd6a44d39d..24b031dc44ee1 100644
+--- a/fs/ocfs2/quota_global.c
++++ b/fs/ocfs2/quota_global.c
+@@ -749,6 +749,11 @@ static int ocfs2_release_dquot(struct dquot *dquot)
+ handle = ocfs2_start_trans(osb,
+ ocfs2_calc_qdel_credits(dquot->dq_sb, dquot->dq_id.type));
+ if (IS_ERR(handle)) {
++ /*
++ * Mark dquot as inactive to avoid endless cycle in
++ * quota_release_workfn().
++ */
++ clear_bit(DQ_ACTIVE_B, &dquot->dq_flags);
+ status = PTR_ERR(handle);
+ mlog_errno(status);
+ goto out_ilock;
+--
+2.39.5
+
--- /dev/null
+From 4c5d28a78c8483cb9751930ce9d7958b6a407df9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jan 2025 21:27:01 +0800
+Subject: of: reserved-memory: Do not make kmemleak ignore freed address
+
+From: Zijun Hu <quic_zijuhu@quicinc.com>
+
+[ Upstream commit 29091a52562bca4d6e678dd8f0085dac119d6a21 ]
+
+early_init_dt_alloc_reserved_memory_arch() will free address @base when
+suffers memblock_mark_nomap() error, but it still makes kmemleak ignore
+the freed address @base via kmemleak_ignore_phys().
+
+That is unnecessary, besides, also causes unnecessary warning messages:
+
+kmemleak_ignore_phys()
+ -> make_black_object()
+ -> paint_ptr()
+ -> kmemleak_warn() // warning message here.
+
+Fix by avoiding kmemleak_ignore_phys() when suffer the error.
+
+Fixes: 658aafc8139c ("memblock: exclude MEMBLOCK_NOMAP regions from kmemleak")
+Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
+Link: https://lore.kernel.org/r/20250109-of_core_fix-v4-10-db8a72415b8c@quicinc.com
+Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/of_reserved_mem.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
+index f90975e004469..5a5d24eeb5f34 100644
+--- a/drivers/of/of_reserved_mem.c
++++ b/drivers/of/of_reserved_mem.c
+@@ -50,7 +50,8 @@ static int __init early_init_dt_alloc_reserved_memory_arch(phys_addr_t size,
+ memblock_phys_free(base, size);
+ }
+
+- kmemleak_ignore_phys(base);
++ if (!err)
++ kmemleak_ignore_phys(base);
+
+ return err;
+ }
+--
+2.39.5
+
--- /dev/null
+From 12cb9e1e4a41bd1c6a384e3a6ba058165bc8ee96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jul 2023 13:41:20 +0530
+Subject: OPP: Add dev_pm_opp_find_freq_exact_indexed()
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+[ Upstream commit a5893928bb179d67ca1d44a8f66c990480ba541d ]
+
+The indexed version of the API is added for other floor and ceil, add
+the same for exact as well for completeness.
+
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Stable-dep-of: b44b9bc7cab2 ("OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/opp/core.c | 28 ++++++++++++++++++++++++++++
+ include/linux/pm_opp.h | 11 +++++++++++
+ 2 files changed, 39 insertions(+)
+
+diff --git a/drivers/opp/core.c b/drivers/opp/core.c
+index 1483d10627fba..e1d9eddf26833 100644
+--- a/drivers/opp/core.c
++++ b/drivers/opp/core.c
+@@ -641,6 +641,34 @@ struct dev_pm_opp *dev_pm_opp_find_freq_exact(struct device *dev,
+ }
+ EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_exact);
+
++/**
++ * dev_pm_opp_find_freq_exact_indexed() - Search for an exact freq for the
++ * clock corresponding to the index
++ * @dev: Device for which we do this operation
++ * @freq: frequency to search for
++ * @index: Clock index
++ * @available: true/false - match for available opp
++ *
++ * Search for the matching exact OPP for the clock corresponding to the
++ * specified index from a starting freq for a device.
++ *
++ * Return: matching *opp , else returns ERR_PTR in case of error and should be
++ * handled using IS_ERR. Error return values can be:
++ * EINVAL: for bad pointer
++ * ERANGE: no match found for search
++ * ENODEV: if device not found in list of registered devices
++ *
++ * The callers are required to call dev_pm_opp_put() for the returned OPP after
++ * use.
++ */
++struct dev_pm_opp *
++dev_pm_opp_find_freq_exact_indexed(struct device *dev, unsigned long freq,
++ u32 index, bool available)
++{
++ return _find_key_exact(dev, freq, index, available, _read_freq, NULL);
++}
++EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_exact_indexed);
++
+ static noinline struct dev_pm_opp *_find_freq_ceil(struct opp_table *opp_table,
+ unsigned long *freq)
+ {
+diff --git a/include/linux/pm_opp.h b/include/linux/pm_opp.h
+index a13a1705df57b..23e4e4eaaa427 100644
+--- a/include/linux/pm_opp.h
++++ b/include/linux/pm_opp.h
+@@ -124,6 +124,10 @@ struct dev_pm_opp *dev_pm_opp_find_freq_exact(struct device *dev,
+ unsigned long freq,
+ bool available);
+
++struct dev_pm_opp *
++dev_pm_opp_find_freq_exact_indexed(struct device *dev, unsigned long freq,
++ u32 index, bool available);
++
+ struct dev_pm_opp *dev_pm_opp_find_freq_floor(struct device *dev,
+ unsigned long *freq);
+
+@@ -268,6 +272,13 @@ static inline struct dev_pm_opp *dev_pm_opp_find_freq_exact(struct device *dev,
+ return ERR_PTR(-EOPNOTSUPP);
+ }
+
++static inline struct dev_pm_opp *
++dev_pm_opp_find_freq_exact_indexed(struct device *dev, unsigned long freq,
++ u32 index, bool available)
++{
++ return ERR_PTR(-EOPNOTSUPP);
++}
++
+ static inline struct dev_pm_opp *dev_pm_opp_find_freq_floor(struct device *dev,
+ unsigned long *freq)
+ {
+--
+2.39.5
+
--- /dev/null
+From 1044e851dcc6353ec98624771566428bf1663f07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2024 09:12:59 +0100
+Subject: OPP: add index check to assert to avoid buffer overflow in
+ _read_freq()
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit d659bc68ed489022ea33342cfbda2911a81e7a0d ]
+
+Pass the freq index to the assert function to make sure
+we do not read a freq out of the opp->rates[] table when called
+from the indexed variants:
+dev_pm_opp_find_freq_exact_indexed() or
+dev_pm_opp_find_freq_ceil/floor_indexed().
+
+Add a secondary parameter to the assert function, unused
+for assert_single_clk() then add assert_clk_index() which
+will check for the clock index when called from the _indexed()
+find functions.
+
+Fixes: 142e17c1c2b4 ("OPP: Introduce dev_pm_opp_find_freq_{ceil/floor}_indexed() APIs")
+Fixes: a5893928bb17 ("OPP: Add dev_pm_opp_find_freq_exact_indexed()")
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Stable-dep-of: b44b9bc7cab2 ("OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/opp/core.c | 42 +++++++++++++++++++++++++++---------------
+ 1 file changed, 27 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/opp/core.c b/drivers/opp/core.c
+index 83ff32b7f4793..53286063df558 100644
+--- a/drivers/opp/core.c
++++ b/drivers/opp/core.c
+@@ -104,11 +104,21 @@ struct opp_table *_find_opp_table(struct device *dev)
+ * representation in the OPP table and manage the clock configuration themselves
+ * in an platform specific way.
+ */
+-static bool assert_single_clk(struct opp_table *opp_table)
++static bool assert_single_clk(struct opp_table *opp_table,
++ unsigned int __always_unused index)
+ {
+ return !WARN_ON(opp_table->clk_count > 1);
+ }
+
++/*
++ * Returns true if clock table is large enough to contain the clock index.
++ */
++static bool assert_clk_index(struct opp_table *opp_table,
++ unsigned int index)
++{
++ return opp_table->clk_count > index;
++}
++
+ /**
+ * dev_pm_opp_get_voltage() - Gets the voltage corresponding to an opp
+ * @opp: opp for which voltage has to be returned for
+@@ -496,12 +506,12 @@ static struct dev_pm_opp *_opp_table_find_key(struct opp_table *opp_table,
+ unsigned long (*read)(struct dev_pm_opp *opp, int index),
+ bool (*compare)(struct dev_pm_opp **opp, struct dev_pm_opp *temp_opp,
+ unsigned long opp_key, unsigned long key),
+- bool (*assert)(struct opp_table *opp_table))
++ bool (*assert)(struct opp_table *opp_table, unsigned int index))
+ {
+ struct dev_pm_opp *temp_opp, *opp = ERR_PTR(-ERANGE);
+
+ /* Assert that the requirement is met */
+- if (assert && !assert(opp_table))
++ if (assert && !assert(opp_table, index))
+ return ERR_PTR(-EINVAL);
+
+ mutex_lock(&opp_table->lock);
+@@ -529,7 +539,7 @@ _find_key(struct device *dev, unsigned long *key, int index, bool available,
+ unsigned long (*read)(struct dev_pm_opp *opp, int index),
+ bool (*compare)(struct dev_pm_opp **opp, struct dev_pm_opp *temp_opp,
+ unsigned long opp_key, unsigned long key),
+- bool (*assert)(struct opp_table *opp_table))
++ bool (*assert)(struct opp_table *opp_table, unsigned int index))
+ {
+ struct opp_table *opp_table;
+ struct dev_pm_opp *opp;
+@@ -552,7 +562,7 @@ _find_key(struct device *dev, unsigned long *key, int index, bool available,
+ static struct dev_pm_opp *_find_key_exact(struct device *dev,
+ unsigned long key, int index, bool available,
+ unsigned long (*read)(struct dev_pm_opp *opp, int index),
+- bool (*assert)(struct opp_table *opp_table))
++ bool (*assert)(struct opp_table *opp_table, unsigned int index))
+ {
+ /*
+ * The value of key will be updated here, but will be ignored as the
+@@ -565,7 +575,7 @@ static struct dev_pm_opp *_find_key_exact(struct device *dev,
+ static struct dev_pm_opp *_opp_table_find_key_ceil(struct opp_table *opp_table,
+ unsigned long *key, int index, bool available,
+ unsigned long (*read)(struct dev_pm_opp *opp, int index),
+- bool (*assert)(struct opp_table *opp_table))
++ bool (*assert)(struct opp_table *opp_table, unsigned int index))
+ {
+ return _opp_table_find_key(opp_table, key, index, available, read,
+ _compare_ceil, assert);
+@@ -574,7 +584,7 @@ static struct dev_pm_opp *_opp_table_find_key_ceil(struct opp_table *opp_table,
+ static struct dev_pm_opp *_find_key_ceil(struct device *dev, unsigned long *key,
+ int index, bool available,
+ unsigned long (*read)(struct dev_pm_opp *opp, int index),
+- bool (*assert)(struct opp_table *opp_table))
++ bool (*assert)(struct opp_table *opp_table, unsigned int index))
+ {
+ return _find_key(dev, key, index, available, read, _compare_ceil,
+ assert);
+@@ -583,7 +593,7 @@ static struct dev_pm_opp *_find_key_ceil(struct device *dev, unsigned long *key,
+ static struct dev_pm_opp *_find_key_floor(struct device *dev,
+ unsigned long *key, int index, bool available,
+ unsigned long (*read)(struct dev_pm_opp *opp, int index),
+- bool (*assert)(struct opp_table *opp_table))
++ bool (*assert)(struct opp_table *opp_table, unsigned int index))
+ {
+ return _find_key(dev, key, index, available, read, _compare_floor,
+ assert);
+@@ -644,7 +654,8 @@ struct dev_pm_opp *
+ dev_pm_opp_find_freq_exact_indexed(struct device *dev, unsigned long freq,
+ u32 index, bool available)
+ {
+- return _find_key_exact(dev, freq, index, available, _read_freq, NULL);
++ return _find_key_exact(dev, freq, index, available, _read_freq,
++ assert_clk_index);
+ }
+ EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_exact_indexed);
+
+@@ -704,7 +715,8 @@ struct dev_pm_opp *
+ dev_pm_opp_find_freq_ceil_indexed(struct device *dev, unsigned long *freq,
+ u32 index)
+ {
+- return _find_key_ceil(dev, freq, index, true, _read_freq, NULL);
++ return _find_key_ceil(dev, freq, index, true, _read_freq,
++ assert_clk_index);
+ }
+ EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_ceil_indexed);
+
+@@ -757,7 +769,7 @@ struct dev_pm_opp *
+ dev_pm_opp_find_freq_floor_indexed(struct device *dev, unsigned long *freq,
+ u32 index)
+ {
+- return _find_key_floor(dev, freq, index, true, _read_freq, NULL);
++ return _find_key_floor(dev, freq, index, true, _read_freq, assert_clk_index);
+ }
+ EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_floor_indexed);
+
+@@ -1671,7 +1683,7 @@ void dev_pm_opp_remove(struct device *dev, unsigned long freq)
+ if (IS_ERR(opp_table))
+ return;
+
+- if (!assert_single_clk(opp_table))
++ if (!assert_single_clk(opp_table, 0))
+ goto put_table;
+
+ mutex_lock(&opp_table->lock);
+@@ -2022,7 +2034,7 @@ int _opp_add_v1(struct opp_table *opp_table, struct device *dev,
+ unsigned long tol;
+ int ret;
+
+- if (!assert_single_clk(opp_table))
++ if (!assert_single_clk(opp_table, 0))
+ return -EINVAL;
+
+ new_opp = _opp_allocate(opp_table);
+@@ -2878,7 +2890,7 @@ static int _opp_set_availability(struct device *dev, unsigned long freq,
+ return r;
+ }
+
+- if (!assert_single_clk(opp_table)) {
++ if (!assert_single_clk(opp_table, 0)) {
+ r = -EINVAL;
+ goto put_table;
+ }
+@@ -2954,7 +2966,7 @@ int dev_pm_opp_adjust_voltage(struct device *dev, unsigned long freq,
+ return r;
+ }
+
+- if (!assert_single_clk(opp_table)) {
++ if (!assert_single_clk(opp_table, 0)) {
+ r = -EINVAL;
+ goto put_table;
+ }
+--
+2.39.5
+
--- /dev/null
+From 9c71f75ba029771bdc29701d464c8c484e0cf3da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2024 09:13:00 +0100
+Subject: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit b44b9bc7cab2967c3d6a791b1cd542c89fc07f0e ]
+
+If a driver calls dev_pm_opp_find_bw_ceil/floor() the retrieve bandwidth
+from the OPP table but the bandwidth table was not created because the
+interconnect properties were missing in the OPP consumer node, the
+kernel will crash with:
+
+Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004
+...
+pc : _read_bw+0x8/0x10
+lr : _opp_table_find_key+0x9c/0x174
+...
+Call trace:
+ _read_bw+0x8/0x10 (P)
+ _opp_table_find_key+0x9c/0x174 (L)
+ _find_key+0x98/0x168
+ dev_pm_opp_find_bw_ceil+0x50/0x88
+...
+
+In order to fix the crash, create an assert function to check
+if the bandwidth table was created before trying to get a
+bandwidth with _read_bw().
+
+Fixes: add1dc094a74 ("OPP: Use generic key finding helpers for bandwidth key")
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/opp/core.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/opp/core.c b/drivers/opp/core.c
+index 53286063df558..4211cfb27350f 100644
+--- a/drivers/opp/core.c
++++ b/drivers/opp/core.c
+@@ -119,6 +119,15 @@ static bool assert_clk_index(struct opp_table *opp_table,
+ return opp_table->clk_count > index;
+ }
+
++/*
++ * Returns true if bandwidth table is large enough to contain the bandwidth index.
++ */
++static bool assert_bandwidth_index(struct opp_table *opp_table,
++ unsigned int index)
++{
++ return opp_table->path_count > index;
++}
++
+ /**
+ * dev_pm_opp_get_voltage() - Gets the voltage corresponding to an opp
+ * @opp: opp for which voltage has to be returned for
+@@ -847,7 +856,8 @@ struct dev_pm_opp *dev_pm_opp_find_bw_ceil(struct device *dev, unsigned int *bw,
+ unsigned long temp = *bw;
+ struct dev_pm_opp *opp;
+
+- opp = _find_key_ceil(dev, &temp, index, true, _read_bw, NULL);
++ opp = _find_key_ceil(dev, &temp, index, true, _read_bw,
++ assert_bandwidth_index);
+ *bw = temp;
+ return opp;
+ }
+@@ -878,7 +888,8 @@ struct dev_pm_opp *dev_pm_opp_find_bw_floor(struct device *dev,
+ unsigned long temp = *bw;
+ struct dev_pm_opp *opp;
+
+- opp = _find_key_floor(dev, &temp, index, true, _read_bw, NULL);
++ opp = _find_key_floor(dev, &temp, index, true, _read_bw,
++ assert_bandwidth_index);
+ *bw = temp;
+ return opp;
+ }
+--
+2.39.5
+
--- /dev/null
+From 6290710f6a0c1636de15285d96ce7a4a92d2196d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jul 2023 11:10:52 +0530
+Subject: OPP: Introduce dev_pm_opp_find_freq_{ceil/floor}_indexed() APIs
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 142e17c1c2b48e3fb4f024e62ab6dee18f268694 ]
+
+In the case of devices with multiple clocks, drivers need to specify the
+clock index for the OPP framework to find the OPP corresponding to the
+floor/ceil of the supplied frequency. So let's introduce the two new APIs
+accepting the clock index as an argument.
+
+These APIs use the exising _find_key_ceil() helper by supplying the clock
+index to it.
+
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+[ Viresh: Rearranged definitions in pm_opp.h ]
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Stable-dep-of: b44b9bc7cab2 ("OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/opp/core.c | 56 ++++++++++++++++++++++++++++++++++++++++++
+ include/linux/pm_opp.h | 18 ++++++++++++++
+ 2 files changed, 74 insertions(+)
+
+diff --git a/drivers/opp/core.c b/drivers/opp/core.c
+index 71d3e3ba909a3..8775f9d71f90a 100644
+--- a/drivers/opp/core.c
++++ b/drivers/opp/core.c
+@@ -653,6 +653,34 @@ struct dev_pm_opp *dev_pm_opp_find_freq_ceil(struct device *dev,
+ }
+ EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_ceil);
+
++/**
++ * dev_pm_opp_find_freq_ceil_indexed() - Search for a rounded ceil freq for the
++ * clock corresponding to the index
++ * @dev: Device for which we do this operation
++ * @freq: Start frequency
++ * @index: Clock index
++ *
++ * Search for the matching ceil *available* OPP for the clock corresponding to
++ * the specified index from a starting freq for a device.
++ *
++ * Return: matching *opp and refreshes *freq accordingly, else returns
++ * ERR_PTR in case of error and should be handled using IS_ERR. Error return
++ * values can be:
++ * EINVAL: for bad pointer
++ * ERANGE: no match found for search
++ * ENODEV: if device not found in list of registered devices
++ *
++ * The callers are required to call dev_pm_opp_put() for the returned OPP after
++ * use.
++ */
++struct dev_pm_opp *
++dev_pm_opp_find_freq_ceil_indexed(struct device *dev, unsigned long *freq,
++ u32 index)
++{
++ return _find_key_ceil(dev, freq, index, true, _read_freq, NULL);
++}
++EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_ceil_indexed);
++
+ /**
+ * dev_pm_opp_find_freq_floor() - Search for a rounded floor freq
+ * @dev: device for which we do this operation
+@@ -678,6 +706,34 @@ struct dev_pm_opp *dev_pm_opp_find_freq_floor(struct device *dev,
+ }
+ EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_floor);
+
++/**
++ * dev_pm_opp_find_freq_floor_indexed() - Search for a rounded floor freq for the
++ * clock corresponding to the index
++ * @dev: Device for which we do this operation
++ * @freq: Start frequency
++ * @index: Clock index
++ *
++ * Search for the matching floor *available* OPP for the clock corresponding to
++ * the specified index from a starting freq for a device.
++ *
++ * Return: matching *opp and refreshes *freq accordingly, else returns
++ * ERR_PTR in case of error and should be handled using IS_ERR. Error return
++ * values can be:
++ * EINVAL: for bad pointer
++ * ERANGE: no match found for search
++ * ENODEV: if device not found in list of registered devices
++ *
++ * The callers are required to call dev_pm_opp_put() for the returned OPP after
++ * use.
++ */
++struct dev_pm_opp *
++dev_pm_opp_find_freq_floor_indexed(struct device *dev, unsigned long *freq,
++ u32 index)
++{
++ return _find_key_floor(dev, freq, index, true, _read_freq, NULL);
++}
++EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_floor_indexed);
++
+ /**
+ * dev_pm_opp_find_level_exact() - search for an exact level
+ * @dev: device for which we do this operation
+diff --git a/include/linux/pm_opp.h b/include/linux/pm_opp.h
+index 3821f50b9b89c..2617f2c51f29d 100644
+--- a/include/linux/pm_opp.h
++++ b/include/linux/pm_opp.h
+@@ -125,9 +125,15 @@ struct dev_pm_opp *dev_pm_opp_find_freq_exact(struct device *dev,
+ struct dev_pm_opp *dev_pm_opp_find_freq_floor(struct device *dev,
+ unsigned long *freq);
+
++struct dev_pm_opp *dev_pm_opp_find_freq_floor_indexed(struct device *dev,
++ unsigned long *freq, u32 index);
++
+ struct dev_pm_opp *dev_pm_opp_find_freq_ceil(struct device *dev,
+ unsigned long *freq);
+
++struct dev_pm_opp *dev_pm_opp_find_freq_ceil_indexed(struct device *dev,
++ unsigned long *freq, u32 index);
++
+ struct dev_pm_opp *dev_pm_opp_find_level_exact(struct device *dev,
+ unsigned int level);
+
+@@ -261,12 +267,24 @@ static inline struct dev_pm_opp *dev_pm_opp_find_freq_floor(struct device *dev,
+ return ERR_PTR(-EOPNOTSUPP);
+ }
+
++static inline struct dev_pm_opp *
++dev_pm_opp_find_freq_floor_indexed(struct device *dev, unsigned long *freq, u32 index)
++{
++ return ERR_PTR(-EOPNOTSUPP);
++}
++
+ static inline struct dev_pm_opp *dev_pm_opp_find_freq_ceil(struct device *dev,
+ unsigned long *freq)
+ {
+ return ERR_PTR(-EOPNOTSUPP);
+ }
+
++static inline struct dev_pm_opp *
++dev_pm_opp_find_freq_ceil_indexed(struct device *dev, unsigned long *freq, u32 index)
++{
++ return ERR_PTR(-EOPNOTSUPP);
++}
++
+ static inline struct dev_pm_opp *dev_pm_opp_find_level_exact(struct device *dev,
+ unsigned int level)
+ {
+--
+2.39.5
+
--- /dev/null
+From 512ce2bdd202da97c25c9decf635af184612c5f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jul 2023 11:10:53 +0530
+Subject: OPP: Introduce dev_pm_opp_get_freq_indexed() API
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 5f756d03e2c7db63c1df7148d7b1739f29ff1532 ]
+
+In the case of devices with multiple clocks, drivers need to specify the
+frequency index for the OPP framework to get the specific frequency within
+the required OPP. So let's introduce the dev_pm_opp_get_freq_indexed() API
+accepting the frequency index as an argument.
+
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+[ Viresh: Fixed potential access to NULL opp pointer ]
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Stable-dep-of: b44b9bc7cab2 ("OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/opp/core.c | 20 ++++++++++++++++++++
+ include/linux/pm_opp.h | 7 +++++++
+ 2 files changed, 27 insertions(+)
+
+diff --git a/drivers/opp/core.c b/drivers/opp/core.c
+index 8775f9d71f90a..1483d10627fba 100644
+--- a/drivers/opp/core.c
++++ b/drivers/opp/core.c
+@@ -200,6 +200,26 @@ unsigned long dev_pm_opp_get_freq(struct dev_pm_opp *opp)
+ }
+ EXPORT_SYMBOL_GPL(dev_pm_opp_get_freq);
+
++/**
++ * dev_pm_opp_get_freq_indexed() - Gets the frequency corresponding to an
++ * available opp with specified index
++ * @opp: opp for which frequency has to be returned for
++ * @index: index of the frequency within the required opp
++ *
++ * Return: frequency in hertz corresponding to the opp with specified index,
++ * else return 0
++ */
++unsigned long dev_pm_opp_get_freq_indexed(struct dev_pm_opp *opp, u32 index)
++{
++ if (IS_ERR_OR_NULL(opp) || index >= opp->opp_table->clk_count) {
++ pr_err("%s: Invalid parameters\n", __func__);
++ return 0;
++ }
++
++ return opp->rates[index];
++}
++EXPORT_SYMBOL_GPL(dev_pm_opp_get_freq_indexed);
++
+ /**
+ * dev_pm_opp_get_level() - Gets the level corresponding to an available opp
+ * @opp: opp for which level value has to be returned for
+diff --git a/include/linux/pm_opp.h b/include/linux/pm_opp.h
+index 2617f2c51f29d..a13a1705df57b 100644
+--- a/include/linux/pm_opp.h
++++ b/include/linux/pm_opp.h
+@@ -105,6 +105,8 @@ unsigned long dev_pm_opp_get_power(struct dev_pm_opp *opp);
+
+ unsigned long dev_pm_opp_get_freq(struct dev_pm_opp *opp);
+
++unsigned long dev_pm_opp_get_freq_indexed(struct dev_pm_opp *opp, u32 index);
++
+ unsigned int dev_pm_opp_get_level(struct dev_pm_opp *opp);
+
+ unsigned int dev_pm_opp_get_required_pstate(struct dev_pm_opp *opp,
+@@ -213,6 +215,11 @@ static inline unsigned long dev_pm_opp_get_freq(struct dev_pm_opp *opp)
+ return 0;
+ }
+
++static inline unsigned long dev_pm_opp_get_freq_indexed(struct dev_pm_opp *opp, u32 index)
++{
++ return 0;
++}
++
+ static inline unsigned int dev_pm_opp_get_level(struct dev_pm_opp *opp)
+ {
+ return 0;
+--
+2.39.5
+
--- /dev/null
+From 87d44d6cf4eb06313e077643450af88e0376484b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2025 14:44:53 +0900
+Subject: OPP: OF: Fix an OF node leak in _opp_add_static_v2()
+
+From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+
+[ Upstream commit 1d38eb7f7b26261a0b642f6e0923269c7c000a97 ]
+
+_opp_add_static_v2() leaks the obtained OF node reference when
+_of_opp_alloc_required_opps() fails. Add an of_node_put() call in the
+error path.
+
+Fixes: 3466ea2cd6b6 ("OPP: Don't drop opp->np reference while it is still in use")
+Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/opp/of.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/opp/of.c b/drivers/opp/of.c
+index 605d68673f928..c1b2d8927845c 100644
+--- a/drivers/opp/of.c
++++ b/drivers/opp/of.c
+@@ -950,7 +950,7 @@ static struct dev_pm_opp *_opp_add_static_v2(struct opp_table *opp_table,
+
+ ret = _of_opp_alloc_required_opps(opp_table, new_opp);
+ if (ret)
+- goto free_opp;
++ goto put_node;
+
+ if (!of_property_read_u32(np, "clock-latency-ns", &val))
+ new_opp->clock_latency_ns = val;
+@@ -1003,6 +1003,8 @@ static struct dev_pm_opp *_opp_add_static_v2(struct opp_table *opp_table,
+
+ free_required_opps:
+ _of_opp_free_required_opps(opp_table, new_opp);
++put_node:
++ of_node_put(np);
+ free_opp:
+ _opp_free(new_opp);
+
+--
+2.39.5
+
--- /dev/null
+From e462ade0bb0b28010f9c70c17428a642369f594a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jul 2023 13:34:54 +0530
+Subject: OPP: Rearrange entries in pm_opp.h
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+[ Upstream commit 754833b3194c30dad5af0145e25192a8e29521ab ]
+
+Rearrange the helper function declarations / definitions to keep them in
+order of freq, level and then bw.
+
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Stable-dep-of: b44b9bc7cab2 ("OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/pm_opp.h | 28 +++++++++++++++-------------
+ 1 file changed, 15 insertions(+), 13 deletions(-)
+
+diff --git a/include/linux/pm_opp.h b/include/linux/pm_opp.h
+index dc1fb58907929..3821f50b9b89c 100644
+--- a/include/linux/pm_opp.h
++++ b/include/linux/pm_opp.h
+@@ -121,17 +121,19 @@ unsigned long dev_pm_opp_get_suspend_opp_freq(struct device *dev);
+ struct dev_pm_opp *dev_pm_opp_find_freq_exact(struct device *dev,
+ unsigned long freq,
+ bool available);
++
+ struct dev_pm_opp *dev_pm_opp_find_freq_floor(struct device *dev,
+ unsigned long *freq);
+
++struct dev_pm_opp *dev_pm_opp_find_freq_ceil(struct device *dev,
++ unsigned long *freq);
++
+ struct dev_pm_opp *dev_pm_opp_find_level_exact(struct device *dev,
+ unsigned int level);
++
+ struct dev_pm_opp *dev_pm_opp_find_level_ceil(struct device *dev,
+ unsigned int *level);
+
+-struct dev_pm_opp *dev_pm_opp_find_freq_ceil(struct device *dev,
+- unsigned long *freq);
+-
+ struct dev_pm_opp *dev_pm_opp_find_bw_ceil(struct device *dev,
+ unsigned int *bw, int index);
+
+@@ -247,32 +249,32 @@ static inline unsigned long dev_pm_opp_get_suspend_opp_freq(struct device *dev)
+ return 0;
+ }
+
+-static inline struct dev_pm_opp *dev_pm_opp_find_level_exact(struct device *dev,
+- unsigned int level)
++static inline struct dev_pm_opp *dev_pm_opp_find_freq_exact(struct device *dev,
++ unsigned long freq, bool available)
+ {
+ return ERR_PTR(-EOPNOTSUPP);
+ }
+
+-static inline struct dev_pm_opp *dev_pm_opp_find_level_ceil(struct device *dev,
+- unsigned int *level)
++static inline struct dev_pm_opp *dev_pm_opp_find_freq_floor(struct device *dev,
++ unsigned long *freq)
+ {
+ return ERR_PTR(-EOPNOTSUPP);
+ }
+
+-static inline struct dev_pm_opp *dev_pm_opp_find_freq_exact(struct device *dev,
+- unsigned long freq, bool available)
++static inline struct dev_pm_opp *dev_pm_opp_find_freq_ceil(struct device *dev,
++ unsigned long *freq)
+ {
+ return ERR_PTR(-EOPNOTSUPP);
+ }
+
+-static inline struct dev_pm_opp *dev_pm_opp_find_freq_floor(struct device *dev,
+- unsigned long *freq)
++static inline struct dev_pm_opp *dev_pm_opp_find_level_exact(struct device *dev,
++ unsigned int level)
+ {
+ return ERR_PTR(-EOPNOTSUPP);
+ }
+
+-static inline struct dev_pm_opp *dev_pm_opp_find_freq_ceil(struct device *dev,
+- unsigned long *freq)
++static inline struct dev_pm_opp *dev_pm_opp_find_level_ceil(struct device *dev,
++ unsigned int *level)
+ {
+ return ERR_PTR(-EOPNOTSUPP);
+ }
+--
+2.39.5
+
--- /dev/null
+From 74683634649b9fa559136d372cab1f2434f3da42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jul 2023 14:55:07 +0530
+Subject: OPP: Reuse dev_pm_opp_get_freq_indexed()
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+[ Upstream commit 746de8255076c9924ffa51baad9822adddccb94e ]
+
+Reuse dev_pm_opp_get_freq_indexed() from dev_pm_opp_get_freq().
+
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Stable-dep-of: b44b9bc7cab2 ("OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/opp/core.c | 21 ---------------------
+ include/linux/pm_opp.h | 12 +++++-------
+ 2 files changed, 5 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/opp/core.c b/drivers/opp/core.c
+index e1d9eddf26833..83ff32b7f4793 100644
+--- a/drivers/opp/core.c
++++ b/drivers/opp/core.c
+@@ -179,27 +179,6 @@ unsigned long dev_pm_opp_get_power(struct dev_pm_opp *opp)
+ }
+ EXPORT_SYMBOL_GPL(dev_pm_opp_get_power);
+
+-/**
+- * dev_pm_opp_get_freq() - Gets the frequency corresponding to an available opp
+- * @opp: opp for which frequency has to be returned for
+- *
+- * Return: frequency in hertz corresponding to the opp, else
+- * return 0
+- */
+-unsigned long dev_pm_opp_get_freq(struct dev_pm_opp *opp)
+-{
+- if (IS_ERR_OR_NULL(opp)) {
+- pr_err("%s: Invalid parameters\n", __func__);
+- return 0;
+- }
+-
+- if (!assert_single_clk(opp->opp_table))
+- return 0;
+-
+- return opp->rates[0];
+-}
+-EXPORT_SYMBOL_GPL(dev_pm_opp_get_freq);
+-
+ /**
+ * dev_pm_opp_get_freq_indexed() - Gets the frequency corresponding to an
+ * available opp with specified index
+diff --git a/include/linux/pm_opp.h b/include/linux/pm_opp.h
+index 23e4e4eaaa427..91f87d7e807cb 100644
+--- a/include/linux/pm_opp.h
++++ b/include/linux/pm_opp.h
+@@ -103,8 +103,6 @@ int dev_pm_opp_get_supplies(struct dev_pm_opp *opp, struct dev_pm_opp_supply *su
+
+ unsigned long dev_pm_opp_get_power(struct dev_pm_opp *opp);
+
+-unsigned long dev_pm_opp_get_freq(struct dev_pm_opp *opp);
+-
+ unsigned long dev_pm_opp_get_freq_indexed(struct dev_pm_opp *opp, u32 index);
+
+ unsigned int dev_pm_opp_get_level(struct dev_pm_opp *opp);
+@@ -214,11 +212,6 @@ static inline unsigned long dev_pm_opp_get_power(struct dev_pm_opp *opp)
+ return 0;
+ }
+
+-static inline unsigned long dev_pm_opp_get_freq(struct dev_pm_opp *opp)
+-{
+- return 0;
+-}
+-
+ static inline unsigned long dev_pm_opp_get_freq_indexed(struct dev_pm_opp *opp, u32 index)
+ {
+ return 0;
+@@ -669,4 +662,9 @@ static inline void dev_pm_opp_put_prop_name(int token)
+ dev_pm_opp_clear_config(token);
+ }
+
++static inline unsigned long dev_pm_opp_get_freq(struct dev_pm_opp *opp)
++{
++ return dev_pm_opp_get_freq_indexed(opp, 0);
++}
++
+ #endif /* __LINUX_OPP_H__ */
+--
+2.39.5
+
--- /dev/null
+From 7c679a8a89f268110935bd480eafb04c2f2cd36a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2025 06:16:37 +0000
+Subject: padata: add pd get/put refcnt helper
+
+From: Chen Ridong <chenridong@huawei.com>
+
+[ Upstream commit ae154202cc6a189b035359f3c4e143d5c24d5352 ]
+
+Add helpers for pd to get/put refcnt to make code consice.
+
+Signed-off-by: Chen Ridong <chenridong@huawei.com>
+Acked-by: Daniel Jordan <daniel.m.jordan@oracle.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: dd7d37ccf6b1 ("padata: avoid UAF for reorder_work")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/padata.c | 27 ++++++++++++++++++++-------
+ 1 file changed, 20 insertions(+), 7 deletions(-)
+
+diff --git a/kernel/padata.c b/kernel/padata.c
+index 5f3069907d497..b3f9ecb3b6711 100644
+--- a/kernel/padata.c
++++ b/kernel/padata.c
+@@ -47,6 +47,22 @@ struct padata_mt_job_state {
+ static void padata_free_pd(struct parallel_data *pd);
+ static void __init padata_mt_helper(struct work_struct *work);
+
++static inline void padata_get_pd(struct parallel_data *pd)
++{
++ refcount_inc(&pd->refcnt);
++}
++
++static inline void padata_put_pd_cnt(struct parallel_data *pd, int cnt)
++{
++ if (refcount_sub_and_test(cnt, &pd->refcnt))
++ padata_free_pd(pd);
++}
++
++static inline void padata_put_pd(struct parallel_data *pd)
++{
++ padata_put_pd_cnt(pd, 1);
++}
++
+ static int padata_index_to_cpu(struct parallel_data *pd, int cpu_index)
+ {
+ int cpu, target_cpu;
+@@ -198,7 +214,7 @@ int padata_do_parallel(struct padata_shell *ps,
+ if ((pinst->flags & PADATA_RESET))
+ goto out;
+
+- refcount_inc(&pd->refcnt);
++ padata_get_pd(pd);
+ padata->pd = pd;
+ padata->cb_cpu = *cb_cpu;
+
+@@ -372,8 +388,7 @@ static void padata_serial_worker(struct work_struct *serial_work)
+ }
+ local_bh_enable();
+
+- if (refcount_sub_and_test(cnt, &pd->refcnt))
+- padata_free_pd(pd);
++ padata_put_pd_cnt(pd, cnt);
+ }
+
+ /**
+@@ -670,8 +685,7 @@ static int padata_replace(struct padata_instance *pinst)
+ synchronize_rcu();
+
+ list_for_each_entry_continue_reverse(ps, &pinst->pslist, list)
+- if (refcount_dec_and_test(&ps->opd->refcnt))
+- padata_free_pd(ps->opd);
++ padata_put_pd(ps->opd);
+
+ pinst->flags &= ~PADATA_RESET;
+
+@@ -1119,8 +1133,7 @@ void padata_free_shell(struct padata_shell *ps)
+ mutex_lock(&ps->pinst->lock);
+ list_del(&ps->list);
+ pd = rcu_dereference_protected(ps->pd, 1);
+- if (refcount_dec_and_test(&pd->refcnt))
+- padata_free_pd(pd);
++ padata_put_pd(pd);
+ mutex_unlock(&ps->pinst->lock);
+
+ kfree(ps);
+--
+2.39.5
+
--- /dev/null
+From 8d3f2152e646b3489a177b00247f0ef4b1060b5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2025 06:16:39 +0000
+Subject: padata: avoid UAF for reorder_work
+
+From: Chen Ridong <chenridong@huawei.com>
+
+[ Upstream commit dd7d37ccf6b11f3d95e797ebe4e9e886d0332600 ]
+
+Although the previous patch can avoid ps and ps UAF for _do_serial, it
+can not avoid potential UAF issue for reorder_work. This issue can
+happen just as below:
+
+crypto_request crypto_request crypto_del_alg
+padata_do_serial
+ ...
+ padata_reorder
+ // processes all remaining
+ // requests then breaks
+ while (1) {
+ if (!padata)
+ break;
+ ...
+ }
+
+ padata_do_serial
+ // new request added
+ list_add
+ // sees the new request
+ queue_work(reorder_work)
+ padata_reorder
+ queue_work_on(squeue->work)
+...
+
+ <kworker context>
+ padata_serial_worker
+ // completes new request,
+ // no more outstanding
+ // requests
+
+ crypto_del_alg
+ // free pd
+
+<kworker context>
+invoke_padata_reorder
+ // UAF of pd
+
+To avoid UAF for 'reorder_work', get 'pd' ref before put 'reorder_work'
+into the 'serial_wq' and put 'pd' ref until the 'serial_wq' finish.
+
+Fixes: bbefa1dd6a6d ("crypto: pcrypt - Avoid deadlock by using per-instance padata queues")
+Signed-off-by: Chen Ridong <chenridong@huawei.com>
+Acked-by: Daniel Jordan <daniel.m.jordan@oracle.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/padata.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/padata.c b/kernel/padata.c
+index b3f9ecb3b6711..e2bef90e6fd0c 100644
+--- a/kernel/padata.c
++++ b/kernel/padata.c
+@@ -344,8 +344,14 @@ static void padata_reorder(struct parallel_data *pd)
+ smp_mb();
+
+ reorder = per_cpu_ptr(pd->reorder_list, pd->cpu);
+- if (!list_empty(&reorder->list) && padata_find_next(pd, false))
++ if (!list_empty(&reorder->list) && padata_find_next(pd, false)) {
++ /*
++ * Other context(eg. the padata_serial_worker) can finish the request.
++ * To avoid UAF issue, add pd ref here, and put pd ref after reorder_work finish.
++ */
++ padata_get_pd(pd);
+ queue_work(pinst->serial_wq, &pd->reorder_work);
++ }
+ }
+
+ static void invoke_padata_reorder(struct work_struct *work)
+@@ -356,6 +362,8 @@ static void invoke_padata_reorder(struct work_struct *work)
+ pd = container_of(work, struct parallel_data, reorder_work);
+ padata_reorder(pd);
+ local_bh_enable();
++ /* Pairs with putting the reorder_work in the serial_wq */
++ padata_put_pd(pd);
+ }
+
+ static void padata_serial_worker(struct work_struct *serial_work)
+--
+2.39.5
+
--- /dev/null
+From 0feea803ee6e2f47ef24264f988380c58273f847 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Dec 2024 23:32:01 +0100
+Subject: padata: fix sysfs store callback check
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <linux@weissschuh.net>
+
+[ Upstream commit 9ff6e943bce67d125781fe4780a5d6f072dc44c0 ]
+
+padata_sysfs_store() was copied from padata_sysfs_show() but this check
+was not adapted. Today there is no attribute which can fail this
+check, but if there is one it may as well be correct.
+
+Fixes: 5e017dc3f8bc ("padata: Added sysfs primitives to padata subsystem")
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/padata.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/padata.c b/kernel/padata.c
+index 3e7bf1bbc6c26..46b75d6b3618c 100644
+--- a/kernel/padata.c
++++ b/kernel/padata.c
+@@ -959,7 +959,7 @@ static ssize_t padata_sysfs_store(struct kobject *kobj, struct attribute *attr,
+
+ pinst = kobj2pinst(kobj);
+ pentry = attr2pentry(attr);
+- if (pentry->show)
++ if (pentry->store)
+ ret = pentry->store(pinst, attr, buf, count);
+
+ return ret;
+--
+2.39.5
+
--- /dev/null
+From 18fc3e979939e40c10de907c578dc564e176366c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2025 06:16:38 +0000
+Subject: padata: fix UAF in padata_reorder
+
+From: Chen Ridong <chenridong@huawei.com>
+
+[ Upstream commit e01780ea4661172734118d2a5f41bc9720765668 ]
+
+A bug was found when run ltp test:
+
+BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0
+Read of size 4 at addr ffff88bbfe003524 by task kworker/u113:2/3039206
+
+CPU: 0 PID: 3039206 Comm: kworker/u113:2 Kdump: loaded Not tainted 6.6.0+
+Workqueue: pdecrypt_parallel padata_parallel_worker
+Call Trace:
+<TASK>
+dump_stack_lvl+0x32/0x50
+print_address_description.constprop.0+0x6b/0x3d0
+print_report+0xdd/0x2c0
+kasan_report+0xa5/0xd0
+padata_find_next+0x29/0x1a0
+padata_reorder+0x131/0x220
+padata_parallel_worker+0x3d/0xc0
+process_one_work+0x2ec/0x5a0
+
+If 'mdelay(10)' is added before calling 'padata_find_next' in the
+'padata_reorder' function, this issue could be reproduced easily with
+ltp test (pcrypt_aead01).
+
+This can be explained as bellow:
+
+pcrypt_aead_encrypt
+...
+padata_do_parallel
+refcount_inc(&pd->refcnt); // add refcnt
+...
+padata_do_serial
+padata_reorder // pd
+while (1) {
+padata_find_next(pd, true); // using pd
+queue_work_on
+...
+padata_serial_worker crypto_del_alg
+padata_put_pd_cnt // sub refcnt
+ padata_free_shell
+ padata_put_pd(ps->pd);
+ // pd is freed
+// loop again, but pd is freed
+// call padata_find_next, UAF
+}
+
+In the padata_reorder function, when it loops in 'while', if the alg is
+deleted, the refcnt may be decreased to 0 before entering
+'padata_find_next', which leads to UAF.
+
+As mentioned in [1], do_serial is supposed to be called with BHs disabled
+and always happen under RCU protection, to address this issue, add
+synchronize_rcu() in 'padata_free_shell' wait for all _do_serial calls
+to finish.
+
+[1] https://lore.kernel.org/all/20221028160401.cccypv4euxikusiq@parnassus.localdomain/
+[2] https://lore.kernel.org/linux-kernel/jfjz5d7zwbytztackem7ibzalm5lnxldi2eofeiczqmqs2m7o6@fq426cwnjtkm/
+Fixes: b128a3040935 ("padata: allocate workqueue internally")
+Signed-off-by: Chen Ridong <chenridong@huawei.com>
+Signed-off-by: Qu Zicheng <quzicheng@huawei.com>
+Acked-by: Daniel Jordan <daniel.m.jordan@oracle.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/padata.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/kernel/padata.c b/kernel/padata.c
+index 46b75d6b3618c..5f3069907d497 100644
+--- a/kernel/padata.c
++++ b/kernel/padata.c
+@@ -1110,6 +1110,12 @@ void padata_free_shell(struct padata_shell *ps)
+ if (!ps)
+ return;
+
++ /*
++ * Wait for all _do_serial calls to finish to avoid touching
++ * freed pd's and ps's.
++ */
++ synchronize_rcu();
++
+ mutex_lock(&ps->pinst->lock);
+ list_del(&ps->list);
+ pd = rcu_dereference_protected(ps->pd, 1);
+--
+2.39.5
+
--- /dev/null
+From cf08011099a65cf276fc7476b1829b634a3ff6ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2025 22:27:58 -0800
+Subject: partitions: ldm: remove the initial kernel-doc notation
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit e494e451611a3de6ae95f99e8339210c157d70fb ]
+
+Remove the file's first comment describing what the file is.
+This comment is not in kernel-doc format so it causes a kernel-doc
+warning.
+
+ldm.h:13: warning: expecting prototype for ldm(). Prototype was for _FS_PT_LDM_H_() instead
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Richard Russon (FlatCap) <ldm@flatcap.org>
+Cc: linux-ntfs-dev@lists.sourceforge.net
+Cc: Jens Axboe <axboe@kernel.dk>
+Link: https://lore.kernel.org/r/20250111062758.910458-1-rdunlap@infradead.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/partitions/ldm.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block/partitions/ldm.h b/block/partitions/ldm.h
+index 0a747a0c782d5..f98dbee941497 100644
+--- a/block/partitions/ldm.h
++++ b/block/partitions/ldm.h
+@@ -1,5 +1,5 @@
+ // SPDX-License-Identifier: GPL-2.0-or-later
+-/**
++/*
+ * ldm - Part of the Linux-NTFS project.
+ *
+ * Copyright (C) 2001,2002 Richard Russon <ldm@flatcap.org>
+--
+2.39.5
+
--- /dev/null
+From c5e73b1485bb2daf987f4e0e49f221d049b3a122 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2024 22:00:18 +0800
+Subject: PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy()
+
+From: Zijun Hu <quic_zijuhu@quicinc.com>
+
+[ Upstream commit d4929755e4d02bd3de3ae5569dab69cb9502c54f ]
+
+The devm_pci_epc_destroy() comment says destroys the EPC device, but it
+does not actually do that since devres_destroy() does not call
+devm_pci_epc_release(), and it also can not fully undo what the API
+devm_pci_epc_create() does, so it is faulty.
+
+Fortunately, the faulty API has not been used by current kernel tree. Use
+devres_release() instead of devres_destroy() so the EPC device will be
+released.
+
+Link: https://lore.kernel.org/r/20241210-pci-epc-core_fix-v3-1-4d86dd573e4b@quicinc.com
+Fixes: 5e8cb4033807 ("PCI: endpoint: Add EP core layer to enable EP controller and EP functions")
+Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/endpoint/pci-epc-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/endpoint/pci-epc-core.c b/drivers/pci/endpoint/pci-epc-core.c
+index f5a5ec80d1943..eb502426ea6c0 100644
+--- a/drivers/pci/endpoint/pci-epc-core.c
++++ b/drivers/pci/endpoint/pci-epc-core.c
+@@ -740,7 +740,7 @@ void devm_pci_epc_destroy(struct device *dev, struct pci_epc *epc)
+ {
+ int r;
+
+- r = devres_destroy(dev, devm_pci_epc_release, devm_pci_epc_match,
++ r = devres_release(dev, devm_pci_epc_release, devm_pci_epc_match,
+ epc);
+ dev_WARN_ONCE(dev, r, "couldn't find PCI EPC resource\n");
+ }
+--
+2.39.5
+
--- /dev/null
+From 2c8224dd4d463c64cdb31b07d583b1aedb6d8267 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2025 22:46:47 +0530
+Subject: PCI: endpoint: pci-epf-test: Fix check for DMA MEMCPY test
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 235c2b197a8de2887f13990094a3343d2392155b ]
+
+Currently, if DMA MEMCPY test is requested by the host, and if the endpoint
+DMA controller supports DMA_PRIVATE, the test will fail. This is not
+correct since there is no check for DMA_MEMCPY capability and the DMA
+controller can support both DMA_PRIVATE and DMA_MEMCPY.
+
+Fix the check and also reword the error message.
+
+Link: https://lore.kernel.org/r/20250116171650.33585-2-manivannan.sadhasivam@linaro.org
+Fixes: 8353813c88ef ("PCI: endpoint: Enable DMA tests for endpoints with DMA capabilities")
+Reported-by: Niklas Cassel <cassel@kernel.org>
+Closes: https://lore.kernel.org/linux-pci/Z3QtEihbiKIGogWA@ryzen
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Niklas Cassel <cassel@kernel.org>
+Reviewed-by: Niklas Cassel <cassel@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/endpoint/functions/pci-epf-test.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c
+index 950fe67f2d3cc..bcf4f2ca82b3f 100644
+--- a/drivers/pci/endpoint/functions/pci-epf-test.c
++++ b/drivers/pci/endpoint/functions/pci-epf-test.c
+@@ -373,8 +373,8 @@ static int pci_epf_test_copy(struct pci_epf_test *epf_test)
+
+ ktime_get_ts64(&start);
+ if (reg->flags & FLAG_USE_DMA) {
+- if (epf_test->dma_private) {
+- dev_err(dev, "Cannot transfer data using DMA\n");
++ if (!dma_has_cap(DMA_MEMCPY, epf_test->dma_chan_tx->device->cap_mask)) {
++ dev_err(dev, "DMA controller doesn't support MEMCPY\n");
+ ret = -EINVAL;
+ goto err_map_addr;
+ }
+--
+2.39.5
+
--- /dev/null
+From 040aa443755a913c95c4433b057de4bef3d1ba58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Dec 2024 08:08:41 -0800
+Subject: PCI: endpoint: pci-epf-test: Set dma_chan_rx pointer to NULL on error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mohamed Khalfella <khalfella@gmail.com>
+
+[ Upstream commit b1b1f4b12969130c0a6ec0cf0299460cb01e799c ]
+
+If dma_chan_tx allocation fails, set dma_chan_rx to NULL after it is
+freed.
+
+Link: https://lore.kernel.org/r/20241227160841.92382-1-khalfella@gmail.com
+Fixes: 8353813c88ef ("PCI: endpoint: Enable DMA tests for endpoints with DMA capabilities")
+Signed-off-by: Mohamed Khalfella <khalfella@gmail.com>
+[kwilczynski: commit log]
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Niklas Cassel <cassel@kernel.org>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/endpoint/functions/pci-epf-test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c
+index 2e8a4de2ababd..be10d7b976e94 100644
+--- a/drivers/pci/endpoint/functions/pci-epf-test.c
++++ b/drivers/pci/endpoint/functions/pci-epf-test.c
+@@ -251,7 +251,7 @@ static int pci_epf_test_init_dma_chan(struct pci_epf_test *epf_test)
+
+ fail_back_rx:
+ dma_release_channel(epf_test->dma_chan_rx);
+- epf_test->dma_chan_tx = NULL;
++ epf_test->dma_chan_rx = NULL;
+
+ fail_back_tx:
+ dma_cap_zero(mask);
+--
+2.39.5
+
--- /dev/null
+From bdc4a09f49feb9529610a739d7b8157d177daa2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Apr 2023 11:35:37 +0900
+Subject: PCI: epf-test: Simplify DMA support checks
+
+From: Damien Le Moal <dlemoal@kernel.org>
+
+[ Upstream commit 2566cbea69ab8dad4996ab4b4840fd952e62e5b4 ]
+
+There is no need to have each read, write and copy test functions check
+for the FLAG_USE_DMA flag against the DMA support status indicated by
+epf_test->dma_supported. Move this test to the command handler function
+pci_epf_test_cmd_handler() to check once for all cases.
+
+Link: https://lore.kernel.org/r/20230415023542.77601-13-dlemoal@kernel.org
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Stable-dep-of: 235c2b197a8d ("PCI: endpoint: pci-epf-test: Fix check for DMA MEMCPY test")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/endpoint/functions/pci-epf-test.c | 45 +++++++------------
+ 1 file changed, 15 insertions(+), 30 deletions(-)
+
+diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c
+index be10d7b976e94..950fe67f2d3cc 100644
+--- a/drivers/pci/endpoint/functions/pci-epf-test.c
++++ b/drivers/pci/endpoint/functions/pci-epf-test.c
+@@ -328,7 +328,6 @@ static void pci_epf_test_print_rate(const char *ops, u64 size,
+ static int pci_epf_test_copy(struct pci_epf_test *epf_test)
+ {
+ int ret;
+- bool use_dma;
+ void __iomem *src_addr;
+ void __iomem *dst_addr;
+ phys_addr_t src_phys_addr;
+@@ -373,14 +372,7 @@ static int pci_epf_test_copy(struct pci_epf_test *epf_test)
+ }
+
+ ktime_get_ts64(&start);
+- use_dma = !!(reg->flags & FLAG_USE_DMA);
+- if (use_dma) {
+- if (!epf_test->dma_supported) {
+- dev_err(dev, "Cannot transfer data using DMA\n");
+- ret = -EINVAL;
+- goto err_map_addr;
+- }
+-
++ if (reg->flags & FLAG_USE_DMA) {
+ if (epf_test->dma_private) {
+ dev_err(dev, "Cannot transfer data using DMA\n");
+ ret = -EINVAL;
+@@ -406,7 +398,8 @@ static int pci_epf_test_copy(struct pci_epf_test *epf_test)
+ kfree(buf);
+ }
+ ktime_get_ts64(&end);
+- pci_epf_test_print_rate("COPY", reg->size, &start, &end, use_dma);
++ pci_epf_test_print_rate("COPY", reg->size, &start, &end,
++ reg->flags & FLAG_USE_DMA);
+
+ err_map_addr:
+ pci_epc_unmap_addr(epc, epf->func_no, epf->vfunc_no, dst_phys_addr);
+@@ -430,7 +423,6 @@ static int pci_epf_test_read(struct pci_epf_test *epf_test)
+ void __iomem *src_addr;
+ void *buf;
+ u32 crc32;
+- bool use_dma;
+ phys_addr_t phys_addr;
+ phys_addr_t dst_phys_addr;
+ struct timespec64 start, end;
+@@ -463,14 +455,7 @@ static int pci_epf_test_read(struct pci_epf_test *epf_test)
+ goto err_map_addr;
+ }
+
+- use_dma = !!(reg->flags & FLAG_USE_DMA);
+- if (use_dma) {
+- if (!epf_test->dma_supported) {
+- dev_err(dev, "Cannot transfer data using DMA\n");
+- ret = -EINVAL;
+- goto err_dma_map;
+- }
+-
++ if (reg->flags & FLAG_USE_DMA) {
+ dst_phys_addr = dma_map_single(dma_dev, buf, reg->size,
+ DMA_FROM_DEVICE);
+ if (dma_mapping_error(dma_dev, dst_phys_addr)) {
+@@ -495,7 +480,8 @@ static int pci_epf_test_read(struct pci_epf_test *epf_test)
+ ktime_get_ts64(&end);
+ }
+
+- pci_epf_test_print_rate("READ", reg->size, &start, &end, use_dma);
++ pci_epf_test_print_rate("READ", reg->size, &start, &end,
++ reg->flags & FLAG_USE_DMA);
+
+ crc32 = crc32_le(~0, buf, reg->size);
+ if (crc32 != reg->checksum)
+@@ -519,7 +505,6 @@ static int pci_epf_test_write(struct pci_epf_test *epf_test)
+ int ret;
+ void __iomem *dst_addr;
+ void *buf;
+- bool use_dma;
+ phys_addr_t phys_addr;
+ phys_addr_t src_phys_addr;
+ struct timespec64 start, end;
+@@ -555,14 +540,7 @@ static int pci_epf_test_write(struct pci_epf_test *epf_test)
+ get_random_bytes(buf, reg->size);
+ reg->checksum = crc32_le(~0, buf, reg->size);
+
+- use_dma = !!(reg->flags & FLAG_USE_DMA);
+- if (use_dma) {
+- if (!epf_test->dma_supported) {
+- dev_err(dev, "Cannot transfer data using DMA\n");
+- ret = -EINVAL;
+- goto err_dma_map;
+- }
+-
++ if (reg->flags & FLAG_USE_DMA) {
+ src_phys_addr = dma_map_single(dma_dev, buf, reg->size,
+ DMA_TO_DEVICE);
+ if (dma_mapping_error(dma_dev, src_phys_addr)) {
+@@ -589,7 +567,8 @@ static int pci_epf_test_write(struct pci_epf_test *epf_test)
+ ktime_get_ts64(&end);
+ }
+
+- pci_epf_test_print_rate("WRITE", reg->size, &start, &end, use_dma);
++ pci_epf_test_print_rate("WRITE", reg->size, &start, &end,
++ reg->flags & FLAG_USE_DMA);
+
+ /*
+ * wait 1ms inorder for the write to complete. Without this delay L3
+@@ -660,6 +639,12 @@ static void pci_epf_test_cmd_handler(struct work_struct *work)
+ reg->command = 0;
+ reg->status = 0;
+
++ if ((READ_ONCE(reg->flags) & FLAG_USE_DMA) &&
++ !epf_test->dma_supported) {
++ dev_err(dev, "Cannot transfer data using DMA\n");
++ goto reset_handler;
++ }
++
+ if (reg->irq_type > IRQ_TYPE_MSIX) {
+ dev_err(dev, "Failed to detect IRQ type\n");
+ goto reset_handler;
+--
+2.39.5
+
--- /dev/null
+From 0e21a51ba9f02dba4976da866fb4180582b2f0f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jan 2025 08:50:18 +0800
+Subject: PCI: rcar-ep: Fix incorrect variable used when calling
+ devm_request_mem_region()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: King Dix <kingdix10@qq.com>
+
+[ Upstream commit 2d2da5a4c1b4509f6f7e5a8db015cd420144beb4 ]
+
+The rcar_pcie_parse_outbound_ranges() uses the devm_request_mem_region()
+macro to request a needed resource. A string variable that lives on the
+stack is then used to store a dynamically computed resource name, which
+is then passed on as one of the macro arguments. This can lead to
+undefined behavior.
+
+Depending on the current contents of the memory, the manifestations of
+errors may vary. One possible output may be as follows:
+
+ $ cat /proc/iomem
+ 30000000-37ffffff :
+ 38000000-3fffffff :
+
+Sometimes, garbage may appear after the colon.
+
+In very rare cases, if no NULL-terminator is found in memory, the system
+might crash because the string iterator will overrun which can lead to
+access of unmapped memory above the stack.
+
+Thus, fix this by replacing outbound_name with the name of the previously
+requested resource. With the changes applied, the output will be as
+follows:
+
+ $ cat /proc/iomem
+ 30000000-37ffffff : memory2
+ 38000000-3fffffff : memory3
+
+Fixes: 2a6d0d63d999 ("PCI: rcar: Add endpoint mode support")
+Link: https://lore.kernel.org/r/tencent_DBDCC19D60F361119E76919ADAB25EC13C06@qq.com
+Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Signed-off-by: King Dix <kingdix10@qq.com>
+[kwilczynski: commit log]
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-rcar-ep.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/pcie-rcar-ep.c b/drivers/pci/controller/pcie-rcar-ep.c
+index f9682df1da619..209719fb6ddcc 100644
+--- a/drivers/pci/controller/pcie-rcar-ep.c
++++ b/drivers/pci/controller/pcie-rcar-ep.c
+@@ -107,7 +107,7 @@ static int rcar_pcie_parse_outbound_ranges(struct rcar_pcie_endpoint *ep,
+ }
+ if (!devm_request_mem_region(&pdev->dev, res->start,
+ resource_size(res),
+- outbound_name)) {
++ res->name)) {
+ dev_err(pcie->dev, "Cannot request memory region %s.\n",
+ outbound_name);
+ return -EIO;
+--
+2.39.5
+
--- /dev/null
+From 1cb46c5d7b0058d0d0ef5bdddfb52612184f1560 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2024 16:45:00 +0800
+Subject: perf bpf: Fix two memory leakages when calling
+ perf_env__insert_bpf_prog_info()
+
+From: Zhongqiu Han <quic_zhonhan@quicinc.com>
+
+[ Upstream commit 03edb7020bb920f1935c3f30acad0bb27fdb99af ]
+
+If perf_env__insert_bpf_prog_info() returns false due to a duplicate bpf
+prog info node insertion, the temporary info_node and info_linear memory
+will leak. Add a check to ensure the memory is freed if the function
+returns false.
+
+Fixes: d56354dc49091e33 ("perf tools: Save bpf_prog_info and BTF of new BPF programs")
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Zhongqiu Han <quic_zhonhan@quicinc.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Song Liu <song@kernel.org>
+Cc: Yicong Yang <yangyicong@hisilicon.com>
+Link: https://lore.kernel.org/r/20241205084500.823660-4-quic_zhonhan@quicinc.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/bpf-event.c | 10 ++++++++--
+ tools/perf/util/env.c | 8 ++++++--
+ tools/perf/util/env.h | 2 +-
+ 3 files changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c
+index 91c7bfa82a50a..6cc1b9adc65c6 100644
+--- a/tools/perf/util/bpf-event.c
++++ b/tools/perf/util/bpf-event.c
+@@ -352,7 +352,10 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_session *session,
+ }
+
+ info_node->info_linear = info_linear;
+- perf_env__insert_bpf_prog_info(env, info_node);
++ if (!perf_env__insert_bpf_prog_info(env, info_node)) {
++ free(info_linear);
++ free(info_node);
++ }
+ info_linear = NULL;
+
+ /*
+@@ -540,7 +543,10 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id)
+ info_node = malloc(sizeof(struct bpf_prog_info_node));
+ if (info_node) {
+ info_node->info_linear = info_linear;
+- perf_env__insert_bpf_prog_info(env, info_node);
++ if (!perf_env__insert_bpf_prog_info(env, info_node)) {
++ free(info_linear);
++ free(info_node);
++ }
+ } else
+ free(info_linear);
+
+diff --git a/tools/perf/util/env.c b/tools/perf/util/env.c
+index a0393f9c5fda7..fa08f82f88e7a 100644
+--- a/tools/perf/util/env.c
++++ b/tools/perf/util/env.c
+@@ -19,12 +19,16 @@ struct perf_env perf_env;
+ #include "bpf-utils.h"
+ #include <bpf/libbpf.h>
+
+-void perf_env__insert_bpf_prog_info(struct perf_env *env,
++bool perf_env__insert_bpf_prog_info(struct perf_env *env,
+ struct bpf_prog_info_node *info_node)
+ {
++ bool ret;
++
+ down_write(&env->bpf_progs.lock);
+- __perf_env__insert_bpf_prog_info(env, info_node);
++ ret = __perf_env__insert_bpf_prog_info(env, info_node);
+ up_write(&env->bpf_progs.lock);
++
++ return ret;
+ }
+
+ bool __perf_env__insert_bpf_prog_info(struct perf_env *env, struct bpf_prog_info_node *info_node)
+diff --git a/tools/perf/util/env.h b/tools/perf/util/env.h
+index 7d1360ff79fd8..bc2d0ef351997 100644
+--- a/tools/perf/util/env.h
++++ b/tools/perf/util/env.h
+@@ -166,7 +166,7 @@ int perf_env__nr_cpus_avail(struct perf_env *env);
+ void perf_env__init(struct perf_env *env);
+ bool __perf_env__insert_bpf_prog_info(struct perf_env *env,
+ struct bpf_prog_info_node *info_node);
+-void perf_env__insert_bpf_prog_info(struct perf_env *env,
++bool perf_env__insert_bpf_prog_info(struct perf_env *env,
+ struct bpf_prog_info_node *info_node);
+ struct bpf_prog_info_node *perf_env__find_bpf_prog_info(struct perf_env *env,
+ __u32 prog_id);
+--
+2.39.5
+
--- /dev/null
+From 20db316d87f44a522782c521228d0508ecd756da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2024 16:44:58 +0800
+Subject: perf header: Fix one memory leakage in process_bpf_btf()
+
+From: Zhongqiu Han <quic_zhonhan@quicinc.com>
+
+[ Upstream commit 875d22980a062521beed7b5df71fb13a1af15d83 ]
+
+If __perf_env__insert_btf() returns false due to a duplicate btf node
+insertion, the temporary node will leak. Add a check to ensure the memory
+is freed if the function returns false.
+
+Fixes: a70a1123174ab592 ("perf bpf: Save BTF information as headers to perf.data")
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Zhongqiu Han <quic_zhonhan@quicinc.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Song Liu <song@kernel.org>
+Cc: Yicong Yang <yangyicong@hisilicon.com>
+Link: https://lore.kernel.org/r/20241205084500.823660-2-quic_zhonhan@quicinc.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/header.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
+index b2b0293567f07..c4c8a04f3acad 100644
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -3183,7 +3183,8 @@ static int process_bpf_btf(struct feat_fd *ff, void *data __maybe_unused)
+ if (__do_read(ff, node->data, data_size))
+ goto out;
+
+- __perf_env__insert_btf(env, node);
++ if (!__perf_env__insert_btf(env, node))
++ free(node);
+ node = NULL;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From e8dfc951682d02f9012e43493830f27f921e4257 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2024 16:44:59 +0800
+Subject: perf header: Fix one memory leakage in process_bpf_prog_info()
+
+From: Zhongqiu Han <quic_zhonhan@quicinc.com>
+
+[ Upstream commit a7da6c7030e1aec32f0a41c7b4fa70ec96042019 ]
+
+Function __perf_env__insert_bpf_prog_info() will return without inserting
+bpf prog info node into perf env again due to a duplicate bpf prog info
+node insertion, causing the temporary info_linear and info_node memory to
+leak. Modify the return type of this function to bool and add a check to
+ensure the memory is freed if the function returns false.
+
+Fixes: 606f972b1361f477 ("perf bpf: Save bpf_prog_info information as headers to perf.data")
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Zhongqiu Han <quic_zhonhan@quicinc.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Song Liu <song@kernel.org>
+Cc: Yicong Yang <yangyicong@hisilicon.com>
+Link: https://lore.kernel.org/r/20241205084500.823660-3-quic_zhonhan@quicinc.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/env.c | 5 +++--
+ tools/perf/util/env.h | 2 +-
+ tools/perf/util/header.c | 5 ++++-
+ 3 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/tools/perf/util/env.c b/tools/perf/util/env.c
+index 5d878bae7d9a5..a0393f9c5fda7 100644
+--- a/tools/perf/util/env.c
++++ b/tools/perf/util/env.c
+@@ -27,7 +27,7 @@ void perf_env__insert_bpf_prog_info(struct perf_env *env,
+ up_write(&env->bpf_progs.lock);
+ }
+
+-void __perf_env__insert_bpf_prog_info(struct perf_env *env, struct bpf_prog_info_node *info_node)
++bool __perf_env__insert_bpf_prog_info(struct perf_env *env, struct bpf_prog_info_node *info_node)
+ {
+ __u32 prog_id = info_node->info_linear->info.id;
+ struct bpf_prog_info_node *node;
+@@ -45,13 +45,14 @@ void __perf_env__insert_bpf_prog_info(struct perf_env *env, struct bpf_prog_info
+ p = &(*p)->rb_right;
+ } else {
+ pr_debug("duplicated bpf prog info %u\n", prog_id);
+- return;
++ return false;
+ }
+ }
+
+ rb_link_node(&info_node->rb_node, parent, p);
+ rb_insert_color(&info_node->rb_node, &env->bpf_progs.infos);
+ env->bpf_progs.infos_cnt++;
++ return true;
+ }
+
+ struct bpf_prog_info_node *perf_env__find_bpf_prog_info(struct perf_env *env,
+diff --git a/tools/perf/util/env.h b/tools/perf/util/env.h
+index 359eff51cb85b..7d1360ff79fd8 100644
+--- a/tools/perf/util/env.h
++++ b/tools/perf/util/env.h
+@@ -164,7 +164,7 @@ const char *perf_env__raw_arch(struct perf_env *env);
+ int perf_env__nr_cpus_avail(struct perf_env *env);
+
+ void perf_env__init(struct perf_env *env);
+-void __perf_env__insert_bpf_prog_info(struct perf_env *env,
++bool __perf_env__insert_bpf_prog_info(struct perf_env *env,
+ struct bpf_prog_info_node *info_node);
+ void perf_env__insert_bpf_prog_info(struct perf_env *env,
+ struct bpf_prog_info_node *info_node);
+diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
+index c4c8a04f3acad..f0885d9781cf2 100644
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -3136,7 +3136,10 @@ static int process_bpf_prog_info(struct feat_fd *ff, void *data __maybe_unused)
+ /* after reading from file, translate offset to address */
+ bpil_offs_to_addr(info_linear);
+ info_node->info_linear = info_linear;
+- __perf_env__insert_bpf_prog_info(env, info_node);
++ if (!__perf_env__insert_bpf_prog_info(env, info_node)) {
++ free(info_linear);
++ free(info_node);
++ }
+ }
+
+ up_write(&env->bpf_progs.lock);
+--
+2.39.5
+
--- /dev/null
+From 88760f049944cf7bdfa95ac171d832fb95459a7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2025 10:15:24 +0100
+Subject: perf machine: Don't ignore _etext when not a text symbol
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 7a93786c306296f15e728b1dbd949a319e4e3d19 ]
+
+Depending on how vmlinux.lds is written, _etext might be the very first
+data symbol instead of the very last text symbol.
+
+Don't require it to be a text symbol, accept any symbol type.
+
+Comitter notes:
+
+See the first Link for further discussion, but it all boils down to
+this:
+
+ ---
+ # grep -e _stext -e _etext -e _edata /proc/kallsyms
+ c0000000 T _stext
+ c08b8000 D _etext
+
+ So there is no _edata and _etext is not text
+
+ $ ppc-linux-objdump -x vmlinux | grep -e _stext -e _etext -e _edata
+ c0000000 g .head.text 00000000 _stext
+ c08b8000 g .rodata 00000000 _etext
+ c1378000 g .sbss 00000000 _edata
+ ---
+
+Fixes: ed9adb2035b5be58 ("perf machine: Read also the end of the kernel")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: linuxppc-dev@lists.ozlabs.org
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Song Liu <songliubraving@fb.com>
+Link: https://lore.kernel.org/r/b3ee1994d95257cb7f2de037c5030ba7d1bed404.1736327613.git.christophe.leroy@csgroup.eu
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/machine.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
+index d8a2b80086e66..1b4a2f911a20e 100644
+--- a/tools/perf/util/machine.c
++++ b/tools/perf/util/machine.c
+@@ -1173,7 +1173,7 @@ static int machine__get_running_kernel_start(struct machine *machine,
+
+ err = kallsyms__get_symbol_start(filename, "_edata", &addr);
+ if (err)
+- err = kallsyms__get_function_start(filename, "_etext", &addr);
++ err = kallsyms__get_symbol_start(filename, "_etext", &addr);
+ if (!err)
+ *end = addr;
+
+--
+2.39.5
+
--- /dev/null
+From cdad98c919c61ad1f50e7186a47c177def970d42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jul 2023 17:19:29 -0700
+Subject: perf machine: Include data symbols in the kernel map
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+[ Upstream commit 69a87a32f5cd8b262cb2195b045f96c63aede734 ]
+
+When 'perf record -d' is used, it needs data mmaps to symbolize global
+data. But it missed to collect kernel data maps so it cannot symbolize
+them. Instead of having a separate map, just increase the kernel map
+size to include the data section.
+
+Probably we can have a separate kernel map for data, but the current
+code assumes a single kernel map. So it'd require more changes in other
+places and looks error-prone. I decided not to go that way for now.
+
+Also it seems the kernel module size already includes the data section.
+
+For example, my system has the following.
+
+ $ grep -e _stext -e _etext -e _edata /proc/kallsyms
+ ffffffff99800000 T _stext
+ ffffffff9a601ac8 T _etext
+ ffffffff9b446a00 D _edata
+
+Size of the text section is (0x9a601ac8 - 0x99800000 = 0xe01ac8) and
+size including data section is (0x9b446a00 - 0x99800000 = 0x1c46a00).
+
+Before:
+ $ perf record -d true
+
+ $ perf report -D | grep MMAP | head -1
+ 0 0 0x460 [0x60]: PERF_RECORD_MMAP -1/0: [0xffffffff99800000(0xe01ac8) @ 0xffffffff99800000]: x [kernel.kallsyms]_text
+ ^^^^^^^^
+ here
+After:
+ $ perf report -D | grep MMAP | head -1
+ 0 0 0x460 [0x60]: PERF_RECORD_MMAP -1/0: [0xffffffff99800000(0x1c46a00) @ 0xffffffff99800000]: x [kernel.kallsyms]_text
+ ^^^^^^^^^
+
+Instead of just replacing it to _edata, try _edata first and then fall
+back to _etext just in case.
+
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20230725001929.368041-2-namhyung@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Stable-dep-of: 7a93786c3062 ("perf machine: Don't ignore _etext when not a text symbol")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/machine.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
+index 9cd52f50ea7ac..d8a2b80086e66 100644
+--- a/tools/perf/util/machine.c
++++ b/tools/perf/util/machine.c
+@@ -1171,7 +1171,9 @@ static int machine__get_running_kernel_start(struct machine *machine,
+
+ *start = addr;
+
+- err = kallsyms__get_function_start(filename, "_etext", &addr);
++ err = kallsyms__get_symbol_start(filename, "_edata", &addr);
++ if (err)
++ err = kallsyms__get_function_start(filename, "_etext", &addr);
+ if (!err)
+ *end = addr;
+
+--
+2.39.5
+
--- /dev/null
+From 7b5a08abd943a4f5c10e267f6e73f9132c56c504 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2024 17:48:28 -0300
+Subject: perf namespaces: Fixup the nsinfo__in_pidns() return type, its bool
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit 64a7617efd5ae1d57a75e464d7134eec947c3fe3 ]
+
+When adding support for refconunt checking a cut'n'paste made this
+function, that is just an accessor to a bool member of 'struct nsinfo',
+return a pid_t, when that member is a boolean, fix it.
+
+Fixes: bcaf0a97858de7ab ("perf namespaces: Add functions to access nsinfo")
+Reported-by: Francesco Nigro <fnigro@redhat.com>
+Reported-by: Ilan Green <igreen@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Clark Williams <williams@redhat.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Yonatan Goldschmidt <yonatan.goldschmidt@granulate.io>
+Link: https://lore.kernel.org/r/20241206204828.507527-6-acme@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/namespaces.c | 2 +-
+ tools/perf/util/namespaces.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/namespaces.c b/tools/perf/util/namespaces.c
+index fe59c2b9cd624..33cf78a4a28b5 100644
+--- a/tools/perf/util/namespaces.c
++++ b/tools/perf/util/namespaces.c
+@@ -237,7 +237,7 @@ pid_t nsinfo__pid(const struct nsinfo *nsi)
+ return nsi->pid;
+ }
+
+-pid_t nsinfo__in_pidns(const struct nsinfo *nsi)
++bool nsinfo__in_pidns(const struct nsinfo *nsi)
+ {
+ return nsi->in_pidns;
+ }
+diff --git a/tools/perf/util/namespaces.h b/tools/perf/util/namespaces.h
+index 62a9145a6ffba..c108972a97ef5 100644
+--- a/tools/perf/util/namespaces.h
++++ b/tools/perf/util/namespaces.h
+@@ -57,7 +57,7 @@ void nsinfo__clear_need_setns(struct nsinfo *nsi);
+ pid_t nsinfo__tgid(const struct nsinfo *nsi);
+ pid_t nsinfo__nstgid(const struct nsinfo *nsi);
+ pid_t nsinfo__pid(const struct nsinfo *nsi);
+-pid_t nsinfo__in_pidns(const struct nsinfo *nsi);
++bool nsinfo__in_pidns(const struct nsinfo *nsi);
+ void nsinfo__set_in_pidns(struct nsinfo *nsi);
+
+ void nsinfo__mountns_enter(struct nsinfo *nsi, struct nscookie *nc);
+--
+2.39.5
+
--- /dev/null
+From 303bfc857a4c9fd81b32561eb1317a60d6840639 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2024 17:48:26 -0300
+Subject: perf namespaces: Introduce nsinfo__set_in_pidns()
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit 9c6a585d257f6845731f4e36b45fe42b5c3162f5 ]
+
+When we're processing a perf.data file we will, for every thread in that
+file do a machine__findnew_thread(machine, pid, tid) that when that pid
+is seen for the first time will create a 'struct thread' representing
+it.
+
+That in turn will call nsinfo__new() -> nsinfo__init() and there it will
+assume we're running live, which is wrong and will need to be addressed
+in a followup patch.
+
+The nsinfo__new() assumes that if we can't access that thread it has
+already finished and will ignore the -1 return from nsinfo__init(), just
+taking notes to avoid trying to enter in that namespace, since it isn't
+there anymore, a race.
+
+When doing this from 'perf inject', tho, we can fill in parts of that
+nsinfo from what we get from the PERF_RECORD_MMAP2 (pid, tid) and in the
+jitdump file name, that has the form of jit-<PID>.dump.
+
+So if the pid in the jitdump file name is not the one in the
+PERF_RECORD_MMAP2, we can assume that its the pid of the process
+_inside_ the namespace, and that perf was runing outside that namespace.
+
+This will be done in the following patch.
+
+Reported-by: Francesco Nigro <fnigro@redhat.com>
+Reported-by: Ilan Green <igreen@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Clark Williams <williams@redhat.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Yonatan Goldschmidt <yonatan.goldschmidt@granulate.io>
+Link: https://lore.kernel.org/r/20241206204828.507527-4-acme@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Stable-dep-of: 64a7617efd5a ("perf namespaces: Fixup the nsinfo__in_pidns() return type, its bool")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/namespaces.c | 5 +++++
+ tools/perf/util/namespaces.h | 1 +
+ 2 files changed, 6 insertions(+)
+
+diff --git a/tools/perf/util/namespaces.c b/tools/perf/util/namespaces.c
+index dd536220cdb9e..fe59c2b9cd624 100644
+--- a/tools/perf/util/namespaces.c
++++ b/tools/perf/util/namespaces.c
+@@ -242,6 +242,11 @@ pid_t nsinfo__in_pidns(const struct nsinfo *nsi)
+ return nsi->in_pidns;
+ }
+
++void nsinfo__set_in_pidns(struct nsinfo *nsi)
++{
++ RC_CHK_ACCESS(nsi)->in_pidns = true;
++}
++
+ void nsinfo__mountns_enter(struct nsinfo *nsi,
+ struct nscookie *nc)
+ {
+diff --git a/tools/perf/util/namespaces.h b/tools/perf/util/namespaces.h
+index 567829262c428..62a9145a6ffba 100644
+--- a/tools/perf/util/namespaces.h
++++ b/tools/perf/util/namespaces.h
+@@ -58,6 +58,7 @@ pid_t nsinfo__tgid(const struct nsinfo *nsi);
+ pid_t nsinfo__nstgid(const struct nsinfo *nsi);
+ pid_t nsinfo__pid(const struct nsinfo *nsi);
+ pid_t nsinfo__in_pidns(const struct nsinfo *nsi);
++void nsinfo__set_in_pidns(struct nsinfo *nsi);
+
+ void nsinfo__mountns_enter(struct nsinfo *nsi, struct nscookie *nc);
+ void nsinfo__mountns_exit(struct nscookie *nc);
+--
+2.39.5
+
--- /dev/null
+From 253afbb89e241691c6d8602fd945340f74b33a3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jan 2025 23:22:19 +0800
+Subject: perf report: Fix misleading help message about --demangle
+
+From: Jiachen Zhang <me@jcix.top>
+
+[ Upstream commit ac0ac75189a4d6a29a2765a7adbb62bc6cc650c7 ]
+
+The wrong help message may mislead users. This commit fixes it.
+
+Fixes: 328ccdace8855289 ("perf report: Add --no-demangle option")
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Jiachen Zhang <me@jcix.top>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung.kim@lge.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20250109152220.1869581-1-me@jcix.top
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-report.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
+index 155f119b3db5c..64e38a81bc0a0 100644
+--- a/tools/perf/builtin-report.c
++++ b/tools/perf/builtin-report.c
+@@ -1335,7 +1335,7 @@ int cmd_report(int argc, const char **argv)
+ OPT_STRING(0, "objdump", &report.annotation_opts.objdump_path, "path",
+ "objdump binary to use for disassembly and annotations"),
+ OPT_BOOLEAN(0, "demangle", &symbol_conf.demangle,
+- "Disable symbol demangling"),
++ "Symbol demangling. Enabled by default, use --no-demangle to disable."),
+ OPT_BOOLEAN(0, "demangle-kernel", &symbol_conf.demangle_kernel,
+ "Enable kernel symbol demangling"),
+ OPT_BOOLEAN(0, "mem-mode", &report.mem_mode, "mem access profile"),
+--
+2.39.5
+
--- /dev/null
+From 9dd7ca0f76572d327e4f222aff1b730515a7ff73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jan 2025 16:50:39 -0300
+Subject: perf top: Don't complain about lack of vmlinux when not resolving
+ some kernel samples
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit 058b38ccd2af9e5c95590b018e8425fa148d7aca ]
+
+Recently we got a case where a kernel sample wasn't being resolved due
+to a bug that was not setting the end address on kernel functions
+implemented in assembly (see Link: tag), and then those were not being
+found by machine__resolve() -> map__find_symbol().
+
+So we ended up with:
+
+ # perf top --stdio
+ PerfTop: 0 irqs/s kernel: 0% exact: 0% lost: 0/0 drop: 0/0 [cycles/P]
+ -----------------------------------------------------------------------
+
+ Warning:
+ A vmlinux file was not found.
+ Kernel samples will not be resolved.
+ ^Z
+ [1]+ Stopped perf top --stdio
+ #
+
+But then resolving all other kernel symbols.
+
+So just fixup the logic to only print that warning when there are no
+symbols in the kernel map.
+
+Fixes: d88205db9caa0e9d ("perf dso: Add dso__has_symbols() method")
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Link: https://lore.kernel.org/lkml/Z3buKhcCsZi3_aGb@x1
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-top.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
+index f9917848cdad0..d24e495062a84 100644
+--- a/tools/perf/builtin-top.c
++++ b/tools/perf/builtin-top.c
+@@ -807,7 +807,7 @@ static void perf_event__process_sample(struct perf_tool *tool,
+ * invalid --vmlinux ;-)
+ */
+ if (!machine->kptr_restrict_warned && !top->vmlinux_warned &&
+- __map__is_kernel(al.map) && map__has_symbols(al.map)) {
++ __map__is_kernel(al.map) && !map__has_symbols(al.map)) {
+ if (symbol_conf.vmlinux_name) {
+ char serr[256];
+ dso__strerror_load(al.map->dso, serr, sizeof(serr));
+--
+2.39.5
+
--- /dev/null
+From 39ad847ae3da86c623f9b5212f52b4a793f23d06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jan 2025 18:55:19 -0800
+Subject: perf trace: Fix runtime error of index out of bounds
+
+From: Howard Chu <howardchu95@gmail.com>
+
+[ Upstream commit c7b87ce0dd10b64b68a0b22cb83bbd556e28fe81 ]
+
+libtraceevent parses and returns an array of argument fields, sometimes
+larger than RAW_SYSCALL_ARGS_NUM (6) because it includes "__syscall_nr",
+idx will traverse to index 6 (7th element) whereas sc->fmt->arg holds 6
+elements max, creating an out-of-bounds access. This runtime error is
+found by UBsan. The error message:
+
+ $ sudo UBSAN_OPTIONS=print_stacktrace=1 ./perf trace -a --max-events=1
+ builtin-trace.c:1966:35: runtime error: index 6 out of bounds for type 'syscall_arg_fmt [6]'
+ #0 0x5c04956be5fe in syscall__alloc_arg_fmts /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:1966
+ #1 0x5c04956c0510 in trace__read_syscall_info /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:2110
+ #2 0x5c04956c372b in trace__syscall_info /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:2436
+ #3 0x5c04956d2f39 in trace__init_syscalls_bpf_prog_array_maps /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:3897
+ #4 0x5c04956d6d25 in trace__run /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:4335
+ #5 0x5c04956e112e in cmd_trace /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:5502
+ #6 0x5c04956eda7d in run_builtin /home/howard/hw/linux-perf/tools/perf/perf.c:351
+ #7 0x5c04956ee0a8 in handle_internal_command /home/howard/hw/linux-perf/tools/perf/perf.c:404
+ #8 0x5c04956ee37f in run_argv /home/howard/hw/linux-perf/tools/perf/perf.c:448
+ #9 0x5c04956ee8e9 in main /home/howard/hw/linux-perf/tools/perf/perf.c:556
+ #10 0x79eb3622a3b7 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
+ #11 0x79eb3622a47a in __libc_start_main_impl ../csu/libc-start.c:360
+ #12 0x5c04955422d4 in _start (/home/howard/hw/linux-perf/tools/perf/perf+0x4e02d4) (BuildId: 5b6cab2d59e96a4341741765ad6914a4d784dbc6)
+
+ 0.000 ( 0.014 ms): Chrome_ChildIO/117244 write(fd: 238, buf: !, count: 1) = 1
+
+Fixes: 5e58fcfaf4c6 ("perf trace: Allow allocating sc->arg_fmt even without the syscall tracepoint")
+Signed-off-by: Howard Chu <howardchu95@gmail.com>
+Link: https://lore.kernel.org/r/20250122025519.361873-1-howardchu95@gmail.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-trace.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
+index 441655e659c2b..4655e82c81e69 100644
+--- a/tools/perf/builtin-trace.c
++++ b/tools/perf/builtin-trace.c
+@@ -1822,8 +1822,12 @@ static int trace__read_syscall_info(struct trace *trace, int id)
+ return PTR_ERR(sc->tp_format);
+ }
+
++ /*
++ * The tracepoint format contains __syscall_nr field, so it's one more
++ * than the actual number of syscall arguments.
++ */
+ if (syscall__alloc_arg_fmts(sc, IS_ERR(sc->tp_format) ?
+- RAW_SYSCALL_ARGS_NUM : sc->tp_format->format.nr_fields))
++ RAW_SYSCALL_ARGS_NUM : sc->tp_format->format.nr_fields - 1))
+ return -ENOMEM;
+
+ sc->args = sc->tp_format->format.fields;
+--
+2.39.5
+
--- /dev/null
+From f8b3d0032bb5b365eb71c90d3641b1b136b69cc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jan 2025 17:06:59 -0500
+Subject: pinctrl: stm32: Add check for clk_enable()
+
+From: Mingwei Zheng <zmw12306@gmail.com>
+
+[ Upstream commit 451bc9aea9a1a6fe53969e81a5cb1bd785c0d989 ]
+
+Convert the driver to clk_bulk*() API.
+Add check for the return value of clk_bulk_enable() to catch
+the potential error.
+
+Fixes: 05d8af449d93 ("pinctrl: stm32: Keep pinctrl block clock enabled when LEVEL IRQ requested")
+Signed-off-by: Mingwei Zheng <zmw12306@gmail.com>
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Reviewed-by: Antonio Borneo <antonio.borneo@foss.st.com>
+Link: https://lore.kernel.org/20250106220659.2640365-1-zmw12306@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/stm32/pinctrl-stm32.c | 76 +++++++++++++--------------
+ 1 file changed, 38 insertions(+), 38 deletions(-)
+
+diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
+index 755dcf1fa767e..a4f628675dbb7 100644
+--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
+@@ -85,7 +85,6 @@ struct stm32_pinctrl_group {
+
+ struct stm32_gpio_bank {
+ void __iomem *base;
+- struct clk *clk;
+ struct reset_control *rstc;
+ spinlock_t lock;
+ struct gpio_chip gpio_chip;
+@@ -107,6 +106,7 @@ struct stm32_pinctrl {
+ unsigned ngroups;
+ const char **grp_names;
+ struct stm32_gpio_bank *banks;
++ struct clk_bulk_data *clks;
+ unsigned nbanks;
+ const struct stm32_pinctrl_match_data *match_data;
+ struct irq_domain *domain;
+@@ -1318,12 +1318,6 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl, struct fwnode
+ if (IS_ERR(bank->base))
+ return PTR_ERR(bank->base);
+
+- err = clk_prepare_enable(bank->clk);
+- if (err) {
+- dev_err(dev, "failed to prepare_enable clk (%d)\n", err);
+- return err;
+- }
+-
+ bank->gpio_chip = stm32_gpio_template;
+
+ fwnode_property_read_string(fwnode, "st,bank-name", &bank->gpio_chip.label);
+@@ -1370,26 +1364,20 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl, struct fwnode
+ bank->fwnode, &stm32_gpio_domain_ops,
+ bank);
+
+- if (!bank->domain) {
+- err = -ENODEV;
+- goto err_clk;
+- }
++ if (!bank->domain)
++ return -ENODEV;
+ }
+
+ names = devm_kcalloc(dev, npins, sizeof(char *), GFP_KERNEL);
+- if (!names) {
+- err = -ENOMEM;
+- goto err_clk;
+- }
++ if (!names)
++ return -ENOMEM;
+
+ for (i = 0; i < npins; i++) {
+ stm32_pin = stm32_pctrl_get_desc_pin_from_gpio(pctl, bank, i);
+ if (stm32_pin && stm32_pin->pin.name) {
+ names[i] = devm_kasprintf(dev, GFP_KERNEL, "%s", stm32_pin->pin.name);
+- if (!names[i]) {
+- err = -ENOMEM;
+- goto err_clk;
+- }
++ if (!names[i])
++ return -ENOMEM;
+ } else {
+ names[i] = NULL;
+ }
+@@ -1400,15 +1388,11 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl, struct fwnode
+ err = gpiochip_add_data(&bank->gpio_chip, bank);
+ if (err) {
+ dev_err(dev, "Failed to add gpiochip(%d)!\n", bank_nr);
+- goto err_clk;
++ return err;
+ }
+
+ dev_info(dev, "%s bank added\n", bank->gpio_chip.label);
+ return 0;
+-
+-err_clk:
+- clk_disable_unprepare(bank->clk);
+- return err;
+ }
+
+ static struct irq_domain *stm32_pctrl_get_irq_domain(struct platform_device *pdev)
+@@ -1636,6 +1620,11 @@ int stm32_pctl_probe(struct platform_device *pdev)
+ if (!pctl->banks)
+ return -ENOMEM;
+
++ pctl->clks = devm_kcalloc(dev, banks, sizeof(*pctl->clks),
++ GFP_KERNEL);
++ if (!pctl->clks)
++ return -ENOMEM;
++
+ i = 0;
+ for_each_gpiochip_node(dev, child) {
+ struct stm32_gpio_bank *bank = &pctl->banks[i];
+@@ -1647,24 +1636,27 @@ int stm32_pctl_probe(struct platform_device *pdev)
+ return -EPROBE_DEFER;
+ }
+
+- bank->clk = of_clk_get_by_name(np, NULL);
+- if (IS_ERR(bank->clk)) {
++ pctl->clks[i].clk = of_clk_get_by_name(np, NULL);
++ if (IS_ERR(pctl->clks[i].clk)) {
+ fwnode_handle_put(child);
+- return dev_err_probe(dev, PTR_ERR(bank->clk),
++ return dev_err_probe(dev, PTR_ERR(pctl->clks[i].clk),
+ "failed to get clk\n");
+ }
++ pctl->clks[i].id = "pctl";
+ i++;
+ }
+
++ ret = clk_bulk_prepare_enable(banks, pctl->clks);
++ if (ret) {
++ dev_err(dev, "failed to prepare_enable clk (%d)\n", ret);
++ return ret;
++ }
++
+ for_each_gpiochip_node(dev, child) {
+ ret = stm32_gpiolib_register_bank(pctl, child);
+ if (ret) {
+ fwnode_handle_put(child);
+-
+- for (i = 0; i < pctl->nbanks; i++)
+- clk_disable_unprepare(pctl->banks[i].clk);
+-
+- return ret;
++ goto err_register;
+ }
+
+ pctl->nbanks++;
+@@ -1673,6 +1665,15 @@ int stm32_pctl_probe(struct platform_device *pdev)
+ dev_info(dev, "Pinctrl STM32 initialized\n");
+
+ return 0;
++err_register:
++ for (i = 0; i < pctl->nbanks; i++) {
++ struct stm32_gpio_bank *bank = &pctl->banks[i];
++
++ gpiochip_remove(&bank->gpio_chip);
++ }
++
++ clk_bulk_disable_unprepare(banks, pctl->clks);
++ return ret;
+ }
+
+ static int __maybe_unused stm32_pinctrl_restore_gpio_regs(
+@@ -1741,10 +1742,8 @@ static int __maybe_unused stm32_pinctrl_restore_gpio_regs(
+ int __maybe_unused stm32_pinctrl_suspend(struct device *dev)
+ {
+ struct stm32_pinctrl *pctl = dev_get_drvdata(dev);
+- int i;
+
+- for (i = 0; i < pctl->nbanks; i++)
+- clk_disable(pctl->banks[i].clk);
++ clk_bulk_disable(pctl->nbanks, pctl->clks);
+
+ return 0;
+ }
+@@ -1753,10 +1752,11 @@ int __maybe_unused stm32_pinctrl_resume(struct device *dev)
+ {
+ struct stm32_pinctrl *pctl = dev_get_drvdata(dev);
+ struct stm32_pinctrl_group *g = pctl->groups;
+- int i;
++ int i, ret;
+
+- for (i = 0; i < pctl->nbanks; i++)
+- clk_enable(pctl->banks[i].clk);
++ ret = clk_bulk_enable(pctl->nbanks, pctl->clks);
++ if (ret)
++ return ret;
+
+ for (i = 0; i < pctl->ngroups; i++, g++)
+ stm32_pinctrl_restore_gpio_regs(pctl, g->pin);
+--
+2.39.5
+
--- /dev/null
+From 6b30806ec574128c2ef974dd16712c0f0fc04aee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Oct 2023 08:08:07 +0000
+Subject: pinctrl: stm32: Add check for devm_kcalloc
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit b0eeba527e704d6023a6cd9103f929226e326b03 ]
+
+Add check for the return value of devm_kcalloc() and return the error
+if it fails in order to avoid NULL pointer dereference.
+
+Fixes: 32c170ff15b0 ("pinctrl: stm32: set default gpio line names using pin names")
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Acked-by: Valentin Caron <valentin.caron@foss.st.com>
+Link: https://lore.kernel.org/r/20231031080807.3600656-1-nichen@iscas.ac.cn
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Stable-dep-of: 451bc9aea9a1 ("pinctrl: stm32: Add check for clk_enable()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/stm32/pinctrl-stm32.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
+index ae2b146544758..7599c66abdf06 100644
+--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
+@@ -1377,6 +1377,11 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl, struct fwnode
+ }
+
+ names = devm_kcalloc(dev, npins, sizeof(char *), GFP_KERNEL);
++ if (!names) {
++ err = -ENOMEM;
++ goto err_clk;
++ }
++
+ for (i = 0; i < npins; i++) {
+ stm32_pin = stm32_pctrl_get_desc_pin_from_gpio(pctl, bank, i);
+ if (stm32_pin && stm32_pin->pin.name)
+--
+2.39.5
+
--- /dev/null
+From 915e9dc6c6986f43793298446bc263378686f781 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2024 18:03:26 +0800
+Subject: pinctrl: stm32: check devm_kasprintf() returned value
+
+From: Ma Ke <make24@iscas.ac.cn>
+
+[ Upstream commit b0f0e3f0552a566def55c844b0d44250c58e4df6 ]
+
+devm_kasprintf() can return a NULL pointer on failure but this returned
+value is not checked. Fix this lack and check the returned value.
+
+Found by code review.
+
+Cc: stable@vger.kernel.org
+Fixes: 32c170ff15b0 ("pinctrl: stm32: set default gpio line names using pin names")
+Signed-off-by: Ma Ke <make24@iscas.ac.cn>
+Link: https://lore.kernel.org/20240906100326.624445-1-make24@iscas.ac.cn
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Stable-dep-of: 451bc9aea9a1 ("pinctrl: stm32: Add check for clk_enable()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/stm32/pinctrl-stm32.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
+index 7599c66abdf06..755dcf1fa767e 100644
+--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
+@@ -1384,10 +1384,15 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl, struct fwnode
+
+ for (i = 0; i < npins; i++) {
+ stm32_pin = stm32_pctrl_get_desc_pin_from_gpio(pctl, bank, i);
+- if (stm32_pin && stm32_pin->pin.name)
++ if (stm32_pin && stm32_pin->pin.name) {
+ names[i] = devm_kasprintf(dev, GFP_KERNEL, "%s", stm32_pin->pin.name);
+- else
++ if (!names[i]) {
++ err = -ENOMEM;
++ goto err_clk;
++ }
++ } else {
+ names[i] = NULL;
++ }
+ }
+
+ bank->gpio_chip.names = (const char * const *)names;
+--
+2.39.5
+
--- /dev/null
+From 5929326ccfcc43d5e6c38c1b42eff5517666af44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jun 2023 12:43:49 +0200
+Subject: pinctrl: stm32: set default gpio line names using pin names
+
+From: Valentin Caron <valentin.caron@foss.st.com>
+
+[ Upstream commit 32c170ff15b044579b1f8b8cdabf543406dde9da ]
+
+Add stm32_pctrl_get_desc_pin_from_gpio function to find a stm32 pin
+descriptor which is matching with a gpio.
+Most of the time pin number is equal to pin index in array. So the first
+part of the function is useful to speed up.
+
+And during gpio bank register, we set default gpio names with pin names.
+
+Signed-off-by: Valentin Caron <valentin.caron@foss.st.com>
+Acked-by: Alexandre TORGUE <alexandre.torgue@foss.st.com>
+Link: https://lore.kernel.org/r/20230620104349.834687-1-valentin.caron@foss.st.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Stable-dep-of: 451bc9aea9a1 ("pinctrl: stm32: Add check for clk_enable()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/stm32/pinctrl-stm32.c | 35 +++++++++++++++++++++++++++
+ 1 file changed, 35 insertions(+)
+
+diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
+index e198233c10bad..ae2b146544758 100644
+--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
+@@ -1273,6 +1273,28 @@ static const struct pinconf_ops stm32_pconf_ops = {
+ .pin_config_dbg_show = stm32_pconf_dbg_show,
+ };
+
++static struct stm32_desc_pin *stm32_pctrl_get_desc_pin_from_gpio(struct stm32_pinctrl *pctl,
++ struct stm32_gpio_bank *bank,
++ unsigned int offset)
++{
++ unsigned int stm32_pin_nb = bank->bank_nr * STM32_GPIO_PINS_PER_BANK + offset;
++ struct stm32_desc_pin *pin_desc;
++ int i;
++
++ /* With few exceptions (e.g. bank 'Z'), pin number matches with pin index in array */
++ pin_desc = pctl->pins + stm32_pin_nb;
++ if (pin_desc->pin.number == stm32_pin_nb)
++ return pin_desc;
++
++ /* Otherwise, loop all array to find the pin with the right number */
++ for (i = 0; i < pctl->npins; i++) {
++ pin_desc = pctl->pins + i;
++ if (pin_desc->pin.number == stm32_pin_nb)
++ return pin_desc;
++ }
++ return NULL;
++}
++
+ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl, struct fwnode_handle *fwnode)
+ {
+ struct stm32_gpio_bank *bank = &pctl->banks[pctl->nbanks];
+@@ -1283,6 +1305,8 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl, struct fwnode
+ struct resource res;
+ int npins = STM32_GPIO_PINS_PER_BANK;
+ int bank_nr, err, i = 0;
++ struct stm32_desc_pin *stm32_pin;
++ char **names;
+
+ if (!IS_ERR(bank->rstc))
+ reset_control_deassert(bank->rstc);
+@@ -1352,6 +1376,17 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl, struct fwnode
+ }
+ }
+
++ names = devm_kcalloc(dev, npins, sizeof(char *), GFP_KERNEL);
++ for (i = 0; i < npins; i++) {
++ stm32_pin = stm32_pctrl_get_desc_pin_from_gpio(pctl, bank, i);
++ if (stm32_pin && stm32_pin->pin.name)
++ names[i] = devm_kasprintf(dev, GFP_KERNEL, "%s", stm32_pin->pin.name);
++ else
++ names[i] = NULL;
++ }
++
++ bank->gpio_chip.names = (const char * const *)names;
++
+ err = gpiochip_add_data(&bank->gpio_chip, bank);
+ if (err) {
+ dev_err(dev, "Failed to add gpiochip(%d)!\n", bank_nr);
+--
+2.39.5
+
--- /dev/null
+From 9f190d15e641cb122a8d307f7f780801bbeec049 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Jan 2025 22:32:05 +0800
+Subject: PM: hibernate: Add error handling for syscore_suspend()
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+[ Upstream commit e20a70c572539a486dbd91b225fa6a194a5e2122 ]
+
+In hibernation_platform_enter(), the code did not check the
+return value of syscore_suspend(), potentially leading to a
+situation where syscore_resume() would be called even if
+syscore_suspend() failed. This could cause unpredictable
+behavior or system instability.
+
+Modify the code sequence in question to properly handle errors returned
+by syscore_suspend(). If an error occurs in the suspend path, the code
+now jumps to label 'Enable_irqs' skipping the syscore_resume() call and
+only enabling interrupts after setting the system state to SYSTEM_RUNNING.
+
+Fixes: 40dc166cb5dd ("PM / Core: Introduce struct syscore_ops for core subsystems PM")
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Link: https://patch.msgid.link/20250119143205.2103-1-vulab@iscas.ac.cn
+[ rjw: Changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/power/hibernate.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
+index 30d1274f03f62..ec34c96514b36 100644
+--- a/kernel/power/hibernate.c
++++ b/kernel/power/hibernate.c
+@@ -599,7 +599,11 @@ int hibernation_platform_enter(void)
+
+ local_irq_disable();
+ system_state = SYSTEM_SUSPEND;
+- syscore_suspend();
++
++ error = syscore_suspend();
++ if (error)
++ goto Enable_irqs;
++
+ if (pm_wakeup_pending()) {
+ error = -EAGAIN;
+ goto Power_up;
+@@ -611,6 +615,7 @@ int hibernation_platform_enter(void)
+
+ Power_up:
+ syscore_resume();
++ Enable_irqs:
+ system_state = SYSTEM_RUNNING;
+ local_irq_enable();
+
+--
+2.39.5
+
--- /dev/null
+From e3acb3160dd133197b9ae1d36d7ad2c8b3a1f1c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2025 20:24:41 +0100
+Subject: PM: sleep: core: Synchronize runtime PM status of parents and
+ children
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 3775fc538f535a7c5adaf11990c7932a0bd1f9eb ]
+
+Commit 6e176bf8d461 ("PM: sleep: core: Do not skip callbacks in the
+resume phase") overlooked the case in which the parent of a device with
+DPM_FLAG_SMART_SUSPEND set did not use that flag and could be runtime-
+suspended before a transition into a system-wide sleep state. In that
+case, if the child is resumed during the subsequent transition from
+that state into the working state, its runtime PM status will be set to
+RPM_ACTIVE, but the runtime PM status of the parent will not be updated
+accordingly, even though the parent will be resumed too, because of the
+dev_pm_skip_suspend() check in device_resume_noirq().
+
+Address this problem by tracking the need to set the runtime PM status
+to RPM_ACTIVE during system-wide resume transitions for devices with
+DPM_FLAG_SMART_SUSPEND set and all of the devices depended on by them.
+
+Fixes: 6e176bf8d461 ("PM: sleep: core: Do not skip callbacks in the resume phase")
+Closes: https://lore.kernel.org/linux-pm/Z30p2Etwf3F2AUvD@hovoldconsulting.com/
+Reported-by: Johan Hovold <johan@kernel.org>
+Tested-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
+Tested-by: Johan Hovold <johan+linaro@kernel.org>
+Link: https://patch.msgid.link/12619233.O9o76ZdvQC@rjwysocki.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/main.c | 29 ++++++++++++++++++++---------
+ include/linux/pm.h | 1 +
+ 2 files changed, 21 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index fadcd0379dc2d..fd2d975de536f 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -614,13 +614,15 @@ static void device_resume_noirq(struct device *dev, pm_message_t state, bool asy
+ * so change its status accordingly.
+ *
+ * Otherwise, the device is going to be resumed, so set its PM-runtime
+- * status to "active", but do that only if DPM_FLAG_SMART_SUSPEND is set
+- * to avoid confusing drivers that don't use it.
++ * status to "active" unless its power.set_active flag is clear, in
++ * which case it is not necessary to update its PM-runtime status.
+ */
+- if (skip_resume)
++ if (skip_resume) {
+ pm_runtime_set_suspended(dev);
+- else if (dev_pm_skip_suspend(dev))
++ } else if (dev->power.set_active) {
+ pm_runtime_set_active(dev);
++ dev->power.set_active = false;
++ }
+
+ if (dev->pm_domain) {
+ info = "noirq power domain ";
+@@ -1170,18 +1172,24 @@ static pm_message_t resume_event(pm_message_t sleep_state)
+ return PMSG_ON;
+ }
+
+-static void dpm_superior_set_must_resume(struct device *dev)
++static void dpm_superior_set_must_resume(struct device *dev, bool set_active)
+ {
+ struct device_link *link;
+ int idx;
+
+- if (dev->parent)
++ if (dev->parent) {
+ dev->parent->power.must_resume = true;
++ if (set_active)
++ dev->parent->power.set_active = true;
++ }
+
+ idx = device_links_read_lock();
+
+- list_for_each_entry_rcu_locked(link, &dev->links.suppliers, c_node)
++ list_for_each_entry_rcu_locked(link, &dev->links.suppliers, c_node) {
+ link->supplier->power.must_resume = true;
++ if (set_active)
++ link->supplier->power.set_active = true;
++ }
+
+ device_links_read_unlock(idx);
+ }
+@@ -1257,8 +1265,11 @@ static int __device_suspend_noirq(struct device *dev, pm_message_t state, bool a
+ dev->power.may_skip_resume))
+ dev->power.must_resume = true;
+
+- if (dev->power.must_resume)
+- dpm_superior_set_must_resume(dev);
++ if (dev->power.must_resume) {
++ dev->power.set_active = dev->power.set_active ||
++ dev_pm_test_driver_flags(dev, DPM_FLAG_SMART_SUSPEND);
++ dpm_superior_set_must_resume(dev, dev->power.set_active);
++ }
+
+ Complete:
+ complete_all(&dev->power.completion);
+diff --git a/include/linux/pm.h b/include/linux/pm.h
+index 39e7a7c6016f7..c46f4b6b6241d 100644
+--- a/include/linux/pm.h
++++ b/include/linux/pm.h
+@@ -655,6 +655,7 @@ struct dev_pm_info {
+ bool no_pm_callbacks:1; /* Owned by the PM core */
+ bool async_in_progress:1; /* Owned by the PM core */
+ bool must_resume:1; /* Owned by the PM core */
++ bool set_active:1; /* Owned by the PM core */
+ bool may_skip_resume:1; /* Set by subsystems */
+ #else
+ bool should_wakeup:1;
+--
+2.39.5
+
--- /dev/null
+From 4359a38f3f1b57a16412a59fa23d2ee64a524fdf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jan 2024 17:59:22 +0100
+Subject: PM: sleep: Restore asynchronous device resume optimization
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 3e999770ac1c7c31a70685dd5b88e89473509e9c ]
+
+Before commit 7839d0078e0d ("PM: sleep: Fix possible deadlocks in core
+system-wide PM code"), the resume of devices that were allowed to resume
+asynchronously was scheduled before starting the resume of the other
+devices, so the former did not have to wait for the latter unless
+functional dependencies were present.
+
+Commit 7839d0078e0d removed that optimization in order to address a
+correctness issue, but it can be restored with the help of a new device
+power management flag, so do that now.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com>
+Stable-dep-of: 3775fc538f53 ("PM: sleep: core: Synchronize runtime PM status of parents and children")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/main.c | 117 +++++++++++++++++++++-----------------
+ include/linux/pm.h | 1 +
+ 2 files changed, 65 insertions(+), 53 deletions(-)
+
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index 9c5a5f4dba5a6..fadcd0379dc2d 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -579,7 +579,7 @@ bool dev_pm_skip_resume(struct device *dev)
+ }
+
+ /**
+- * __device_resume_noirq - Execute a "noirq resume" callback for given device.
++ * device_resume_noirq - Execute a "noirq resume" callback for given device.
+ * @dev: Device to handle.
+ * @state: PM transition of the system being carried out.
+ * @async: If true, the device is being resumed asynchronously.
+@@ -587,7 +587,7 @@ bool dev_pm_skip_resume(struct device *dev)
+ * The driver of @dev will not receive interrupts while this function is being
+ * executed.
+ */
+-static void __device_resume_noirq(struct device *dev, pm_message_t state, bool async)
++static void device_resume_noirq(struct device *dev, pm_message_t state, bool async)
+ {
+ pm_callback_t callback = NULL;
+ const char *info = NULL;
+@@ -674,16 +674,22 @@ static bool dpm_async_fn(struct device *dev, async_func_t func)
+ {
+ reinit_completion(&dev->power.completion);
+
+- if (!is_async(dev))
+- return false;
+-
+- get_device(dev);
++ if (is_async(dev)) {
++ dev->power.async_in_progress = true;
+
+- if (async_schedule_dev_nocall(func, dev))
+- return true;
++ get_device(dev);
+
+- put_device(dev);
++ if (async_schedule_dev_nocall(func, dev))
++ return true;
+
++ put_device(dev);
++ }
++ /*
++ * Because async_schedule_dev_nocall() above has returned false or it
++ * has not been called at all, func() is not running and it is safe to
++ * update the async_in_progress flag without extra synchronization.
++ */
++ dev->power.async_in_progress = false;
+ return false;
+ }
+
+@@ -691,18 +697,10 @@ static void async_resume_noirq(void *data, async_cookie_t cookie)
+ {
+ struct device *dev = data;
+
+- __device_resume_noirq(dev, pm_transition, true);
++ device_resume_noirq(dev, pm_transition, true);
+ put_device(dev);
+ }
+
+-static void device_resume_noirq(struct device *dev)
+-{
+- if (dpm_async_fn(dev, async_resume_noirq))
+- return;
+-
+- __device_resume_noirq(dev, pm_transition, false);
+-}
+-
+ static void dpm_noirq_resume_devices(pm_message_t state)
+ {
+ struct device *dev;
+@@ -712,18 +710,28 @@ static void dpm_noirq_resume_devices(pm_message_t state)
+ mutex_lock(&dpm_list_mtx);
+ pm_transition = state;
+
++ /*
++ * Trigger the resume of "async" devices upfront so they don't have to
++ * wait for the "non-async" ones they don't depend on.
++ */
++ list_for_each_entry(dev, &dpm_noirq_list, power.entry)
++ dpm_async_fn(dev, async_resume_noirq);
++
+ while (!list_empty(&dpm_noirq_list)) {
+ dev = to_device(dpm_noirq_list.next);
+- get_device(dev);
+ list_move_tail(&dev->power.entry, &dpm_late_early_list);
+
+- mutex_unlock(&dpm_list_mtx);
++ if (!dev->power.async_in_progress) {
++ get_device(dev);
+
+- device_resume_noirq(dev);
++ mutex_unlock(&dpm_list_mtx);
+
+- put_device(dev);
++ device_resume_noirq(dev, state, false);
+
+- mutex_lock(&dpm_list_mtx);
++ put_device(dev);
++
++ mutex_lock(&dpm_list_mtx);
++ }
+ }
+ mutex_unlock(&dpm_list_mtx);
+ async_synchronize_full();
+@@ -747,14 +755,14 @@ void dpm_resume_noirq(pm_message_t state)
+ }
+
+ /**
+- * __device_resume_early - Execute an "early resume" callback for given device.
++ * device_resume_early - Execute an "early resume" callback for given device.
+ * @dev: Device to handle.
+ * @state: PM transition of the system being carried out.
+ * @async: If true, the device is being resumed asynchronously.
+ *
+ * Runtime PM is disabled for @dev while this function is being executed.
+ */
+-static void __device_resume_early(struct device *dev, pm_message_t state, bool async)
++static void device_resume_early(struct device *dev, pm_message_t state, bool async)
+ {
+ pm_callback_t callback = NULL;
+ const char *info = NULL;
+@@ -820,18 +828,10 @@ static void async_resume_early(void *data, async_cookie_t cookie)
+ {
+ struct device *dev = data;
+
+- __device_resume_early(dev, pm_transition, true);
++ device_resume_early(dev, pm_transition, true);
+ put_device(dev);
+ }
+
+-static void device_resume_early(struct device *dev)
+-{
+- if (dpm_async_fn(dev, async_resume_early))
+- return;
+-
+- __device_resume_early(dev, pm_transition, false);
+-}
+-
+ /**
+ * dpm_resume_early - Execute "early resume" callbacks for all devices.
+ * @state: PM transition of the system being carried out.
+@@ -845,18 +845,28 @@ void dpm_resume_early(pm_message_t state)
+ mutex_lock(&dpm_list_mtx);
+ pm_transition = state;
+
++ /*
++ * Trigger the resume of "async" devices upfront so they don't have to
++ * wait for the "non-async" ones they don't depend on.
++ */
++ list_for_each_entry(dev, &dpm_late_early_list, power.entry)
++ dpm_async_fn(dev, async_resume_early);
++
+ while (!list_empty(&dpm_late_early_list)) {
+ dev = to_device(dpm_late_early_list.next);
+- get_device(dev);
+ list_move_tail(&dev->power.entry, &dpm_suspended_list);
+
+- mutex_unlock(&dpm_list_mtx);
++ if (!dev->power.async_in_progress) {
++ get_device(dev);
+
+- device_resume_early(dev);
++ mutex_unlock(&dpm_list_mtx);
+
+- put_device(dev);
++ device_resume_early(dev, state, false);
+
+- mutex_lock(&dpm_list_mtx);
++ put_device(dev);
++
++ mutex_lock(&dpm_list_mtx);
++ }
+ }
+ mutex_unlock(&dpm_list_mtx);
+ async_synchronize_full();
+@@ -876,12 +886,12 @@ void dpm_resume_start(pm_message_t state)
+ EXPORT_SYMBOL_GPL(dpm_resume_start);
+
+ /**
+- * __device_resume - Execute "resume" callbacks for given device.
++ * device_resume - Execute "resume" callbacks for given device.
+ * @dev: Device to handle.
+ * @state: PM transition of the system being carried out.
+ * @async: If true, the device is being resumed asynchronously.
+ */
+-static void __device_resume(struct device *dev, pm_message_t state, bool async)
++static void device_resume(struct device *dev, pm_message_t state, bool async)
+ {
+ pm_callback_t callback = NULL;
+ const char *info = NULL;
+@@ -975,18 +985,10 @@ static void async_resume(void *data, async_cookie_t cookie)
+ {
+ struct device *dev = data;
+
+- __device_resume(dev, pm_transition, true);
++ device_resume(dev, pm_transition, true);
+ put_device(dev);
+ }
+
+-static void device_resume(struct device *dev)
+-{
+- if (dpm_async_fn(dev, async_resume))
+- return;
+-
+- __device_resume(dev, pm_transition, false);
+-}
+-
+ /**
+ * dpm_resume - Execute "resume" callbacks for non-sysdev devices.
+ * @state: PM transition of the system being carried out.
+@@ -1006,16 +1008,25 @@ void dpm_resume(pm_message_t state)
+ pm_transition = state;
+ async_error = 0;
+
++ /*
++ * Trigger the resume of "async" devices upfront so they don't have to
++ * wait for the "non-async" ones they don't depend on.
++ */
++ list_for_each_entry(dev, &dpm_suspended_list, power.entry)
++ dpm_async_fn(dev, async_resume);
++
+ while (!list_empty(&dpm_suspended_list)) {
+ dev = to_device(dpm_suspended_list.next);
+
+ get_device(dev);
+
+- mutex_unlock(&dpm_list_mtx);
++ if (!dev->power.async_in_progress) {
++ mutex_unlock(&dpm_list_mtx);
+
+- device_resume(dev);
++ device_resume(dev, state, false);
+
+- mutex_lock(&dpm_list_mtx);
++ mutex_lock(&dpm_list_mtx);
++ }
+
+ if (!list_empty(&dev->power.entry))
+ list_move_tail(&dev->power.entry, &dpm_prepared_list);
+diff --git a/include/linux/pm.h b/include/linux/pm.h
+index 93cd34f00822c..bfc441099d8ea 100644
+--- a/include/linux/pm.h
++++ b/include/linux/pm.h
+@@ -653,6 +653,7 @@ struct dev_pm_info {
+ bool wakeup_path:1;
+ bool syscore:1;
+ bool no_pm_callbacks:1; /* Owned by the PM core */
++ bool async_in_progress:1; /* Owned by the PM core */
+ unsigned int must_resume:1; /* Owned by the PM core */
+ unsigned int may_skip_resume:1; /* Set by subsystems */
+ #else
+--
+2.39.5
+
--- /dev/null
+From be53be67be3d256fa4d7c77c694df6c33eb96b0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jan 2024 17:11:26 +0100
+Subject: PM: sleep: Use bool for all 1-bit fields in struct dev_pm_info
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit b017500ab53c06441ff7d3a681484e37039b4f57 ]
+
+For some 1-bit fields in struct dev_pm_info the data type is bool, while
+for some other 1-bit fields in there it is unsigned int, and these
+differences are somewhat arbitrary.
+
+For consistency, change the data type of the latter to bool, so that all
+of the 1-bit fields in struct dev_pm_info fields are bool.
+
+No intentional functional impact.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 3775fc538f53 ("PM: sleep: core: Synchronize runtime PM status of parents and children")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/pm.h | 30 +++++++++++++++---------------
+ 1 file changed, 15 insertions(+), 15 deletions(-)
+
+diff --git a/include/linux/pm.h b/include/linux/pm.h
+index bfc441099d8ea..39e7a7c6016f7 100644
+--- a/include/linux/pm.h
++++ b/include/linux/pm.h
+@@ -634,8 +634,8 @@ struct pm_subsys_data {
+
+ struct dev_pm_info {
+ pm_message_t power_state;
+- unsigned int can_wakeup:1;
+- unsigned int async_suspend:1;
++ bool can_wakeup:1;
++ bool async_suspend:1;
+ bool in_dpm_list:1; /* Owned by the PM core */
+ bool is_prepared:1; /* Owned by the PM core */
+ bool is_suspended:1; /* Ditto */
+@@ -654,10 +654,10 @@ struct dev_pm_info {
+ bool syscore:1;
+ bool no_pm_callbacks:1; /* Owned by the PM core */
+ bool async_in_progress:1; /* Owned by the PM core */
+- unsigned int must_resume:1; /* Owned by the PM core */
+- unsigned int may_skip_resume:1; /* Set by subsystems */
++ bool must_resume:1; /* Owned by the PM core */
++ bool may_skip_resume:1; /* Set by subsystems */
+ #else
+- unsigned int should_wakeup:1;
++ bool should_wakeup:1;
+ #endif
+ #ifdef CONFIG_PM
+ struct hrtimer suspend_timer;
+@@ -668,17 +668,17 @@ struct dev_pm_info {
+ atomic_t usage_count;
+ atomic_t child_count;
+ unsigned int disable_depth:3;
+- unsigned int idle_notification:1;
+- unsigned int request_pending:1;
+- unsigned int deferred_resume:1;
+- unsigned int needs_force_resume:1;
+- unsigned int runtime_auto:1;
++ bool idle_notification:1;
++ bool request_pending:1;
++ bool deferred_resume:1;
++ bool needs_force_resume:1;
++ bool runtime_auto:1;
+ bool ignore_children:1;
+- unsigned int no_callbacks:1;
+- unsigned int irq_safe:1;
+- unsigned int use_autosuspend:1;
+- unsigned int timer_autosuspends:1;
+- unsigned int memalloc_noio:1;
++ bool no_callbacks:1;
++ bool irq_safe:1;
++ bool use_autosuspend:1;
++ bool timer_autosuspends:1;
++ bool memalloc_noio:1;
+ unsigned int links_count;
+ enum rpm_request request;
+ enum rpm_status runtime_status;
+--
+2.39.5
+
--- /dev/null
+From 2d209e37fda896ad663d945f9b954ac0937bf99a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2024 13:16:40 +0530
+Subject: powerpc/book3s64/hugetlb: Fix disabling hugetlb when fadump is active
+
+From: Sourabh Jain <sourabhjain@linux.ibm.com>
+
+[ Upstream commit d629d7a8efc33d05d62f4805c0ffb44727e3d99f ]
+
+Commit 8597538712eb ("powerpc/fadump: Do not use hugepages when fadump
+is active") disabled hugetlb support when fadump is active by returning
+early from hugetlbpage_init():arch/powerpc/mm/hugetlbpage.c and not
+populating hpage_shift/HPAGE_SHIFT.
+
+Later, commit 2354ad252b66 ("powerpc/mm: Update default hugetlb size
+early") moved the allocation of hpage_shift/HPAGE_SHIFT to early boot,
+which inadvertently re-enabled hugetlb support when fadump is active.
+
+Fix this by implementing hugepages_supported() on powerpc. This ensures
+that disabling hugetlb for the fadump kernel is independent of
+hpage_shift/HPAGE_SHIFT.
+
+Fixes: 2354ad252b66 ("powerpc/mm: Update default hugetlb size early")
+Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Signed-off-by: Sourabh Jain <sourabhjain@linux.ibm.com>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/20241217074640.1064510-1-sourabhjain@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/hugetlb.h | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/arch/powerpc/include/asm/hugetlb.h b/arch/powerpc/include/asm/hugetlb.h
+index ea71f7245a63e..8d8f4909ae1a4 100644
+--- a/arch/powerpc/include/asm/hugetlb.h
++++ b/arch/powerpc/include/asm/hugetlb.h
+@@ -15,6 +15,15 @@
+
+ extern bool hugetlb_disabled;
+
++static inline bool hugepages_supported(void)
++{
++ if (hugetlb_disabled)
++ return false;
++
++ return HPAGE_SHIFT != 0;
++}
++#define hugepages_supported hugepages_supported
++
+ void __init hugetlbpage_init_defaultsize(void);
+
+ int slice_is_hugepage_only_range(struct mm_struct *mm, unsigned long addr,
+--
+2.39.5
+
--- /dev/null
+From da6fc95786721962d2a30c8394b22bcb3a6e26bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Jan 2025 13:19:21 +0200
+Subject: pstore/blk: trivial typo fixes
+
+From: Eugen Hristev <eugen.hristev@linaro.org>
+
+[ Upstream commit 542243af7182efaeaf6d0f4643f7de437541a9af ]
+
+Fix trivial typos in comments.
+
+Fixes: 2a03ddbde1e1 ("pstore/blk: Move verify_size() macro out of function")
+Fixes: 17639f67c1d6 ("pstore/blk: Introduce backend for block devices")
+Signed-off-by: Eugen Hristev <eugen.hristev@linaro.org>
+Link: https://lore.kernel.org/r/20250101111921.850406-1-eugen.hristev@linaro.org
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pstore/blk.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/pstore/blk.c b/fs/pstore/blk.c
+index 4ae0cfcd15f20..c6911c9997628 100644
+--- a/fs/pstore/blk.c
++++ b/fs/pstore/blk.c
+@@ -89,7 +89,7 @@ static struct pstore_device_info *pstore_device_info;
+ _##name_ = check_size(name, alignsize); \
+ else \
+ _##name_ = 0; \
+- /* Synchronize module parameters with resuls. */ \
++ /* Synchronize module parameters with results. */ \
+ name = _##name_ / 1024; \
+ dev->zone.name = _##name_; \
+ }
+@@ -121,7 +121,7 @@ static int __register_pstore_device(struct pstore_device_info *dev)
+ if (pstore_device_info)
+ return -EBUSY;
+
+- /* zero means not limit on which backends to attempt to store. */
++ /* zero means no limit on which backends attempt to store. */
+ if (!dev->flags)
+ dev->flags = UINT_MAX;
+
+--
+2.39.5
+
--- /dev/null
+From ef4edaa27e4bcdb29b45daf043d7327b939852d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2024 17:47:52 -0500
+Subject: pwm: stm32: Add check for clk_enable()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mingwei Zheng <zmw12306@gmail.com>
+
+[ Upstream commit e8c59791ebb60790c74b2c3ab520f04a8a57219a ]
+
+Add check for the return value of clk_enable() to catch the potential
+error.
+
+Fixes: 19f1016ea960 ("pwm: stm32: Fix enable count for clk in .probe()")
+Signed-off-by: Mingwei Zheng <zmw12306@gmail.com>
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Link: https://lore.kernel.org/r/20241215224752.220318-1-zmw12306@gmail.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-stm32.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-stm32.c b/drivers/pwm/pwm-stm32.c
+index 2070d107c6328..fda7d76f08b1b 100644
+--- a/drivers/pwm/pwm-stm32.c
++++ b/drivers/pwm/pwm-stm32.c
+@@ -631,8 +631,11 @@ static int stm32_pwm_probe(struct platform_device *pdev)
+ priv->chip.npwm = stm32_pwm_detect_channels(priv, &num_enabled);
+
+ /* Initialize clock refcount to number of enabled PWM channels. */
+- for (i = 0; i < num_enabled; i++)
+- clk_enable(priv->clk);
++ for (i = 0; i < num_enabled; i++) {
++ ret = clk_enable(priv->clk);
++ if (ret)
++ return ret;
++ }
+
+ ret = pwmchip_add(&priv->chip);
+ if (ret < 0)
+--
+2.39.5
+
--- /dev/null
+From 5a047cb8202a2786ba89358d0d5c3b804ed8c664 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2024 16:53:18 -0500
+Subject: pwm: stm32-lp: Add check for clk_enable()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mingwei Zheng <zmw12306@gmail.com>
+
+[ Upstream commit cce16e7f6216227964cda25f5f23634bce2c500f ]
+
+Add check for the return value of clk_enable() to catch the potential
+error.
+We used APP-Miner to find it.
+
+Fixes: e70a540b4e02 ("pwm: Add STM32 LPTimer PWM driver")
+Signed-off-by: Mingwei Zheng <zmw12306@gmail.com>
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Link: https://lore.kernel.org/r/20241206215318.3402860-1-zmw12306@gmail.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-stm32-lp.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-stm32-lp.c b/drivers/pwm/pwm-stm32-lp.c
+index 31a185c6b8da4..7f477082db1d7 100644
+--- a/drivers/pwm/pwm-stm32-lp.c
++++ b/drivers/pwm/pwm-stm32-lp.c
+@@ -169,8 +169,12 @@ static int stm32_pwm_lp_get_state(struct pwm_chip *chip,
+ regmap_read(priv->regmap, STM32_LPTIM_CR, &val);
+ state->enabled = !!FIELD_GET(STM32_LPTIM_ENABLE, val);
+ /* Keep PWM counter clock refcount in sync with PWM initial state */
+- if (state->enabled)
+- clk_enable(priv->clk);
++ if (state->enabled) {
++ int ret = clk_enable(priv->clk);
++
++ if (ret)
++ return ret;
++ }
+
+ regmap_read(priv->regmap, STM32_LPTIM_CFGR, &val);
+ presc = FIELD_GET(STM32_LPTIM_PRESC, val);
+--
+2.39.5
+
--- /dev/null
+From 9e5869375086f32660f00b24c33f8f13d8c3c37f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Nov 2024 13:01:37 +0300
+Subject: rdma/cxgb4: Prevent potential integer overflow on 32bit
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit bd96a3935e89486304461a21752f824fc25e0f0b ]
+
+The "gl->tot_len" variable is controlled by the user. It comes from
+process_responses(). On 32bit systems, the "gl->tot_len + sizeof(struct
+cpl_pass_accept_req) + sizeof(struct rss_header)" addition could have an
+integer wrapping bug. Use size_add() to prevent this.
+
+Fixes: 1cab775c3e75 ("RDMA/cxgb4: Fix LE hash collision bug for passive open connection")
+Link: https://patch.msgid.link/r/86b404e1-4a75-4a35-a34e-e3054fa554c7@stanley.mountain
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/device.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
+index 80970a1738f8a..034b85c422555 100644
+--- a/drivers/infiniband/hw/cxgb4/device.c
++++ b/drivers/infiniband/hw/cxgb4/device.c
+@@ -1114,8 +1114,10 @@ static inline struct sk_buff *copy_gl_to_skb_pkt(const struct pkt_gl *gl,
+ * The math here assumes sizeof cpl_pass_accept_req >= sizeof
+ * cpl_rx_pkt.
+ */
+- skb = alloc_skb(gl->tot_len + sizeof(struct cpl_pass_accept_req) +
+- sizeof(struct rss_header) - pktshift, GFP_ATOMIC);
++ skb = alloc_skb(size_add(gl->tot_len,
++ sizeof(struct cpl_pass_accept_req) +
++ sizeof(struct rss_header)) - pktshift,
++ GFP_ATOMIC);
+ if (unlikely(!skb))
+ return NULL;
+
+--
+2.39.5
+
--- /dev/null
+From caaff8812898a8fbe9f8c9c4a3149b5e99131507 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Nov 2023 20:34:48 +0800
+Subject: RDMA/hns: Add debugfs to hns RoCE
+
+From: Junxian Huang <huangjunxian6@hisilicon.com>
+
+[ Upstream commit ca7ad04cd5d2f8070cd34c2c428cea36de516afc ]
+
+Add debugfs to hns RoCE. This patch only adds an empty directory
+"hns_roce" to debugs root directory.
+
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://lore.kernel.org/r/20231114123449.1106162-3-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Stable-dep-of: 8977b561216c ("RDMA/hns: Clean up the legacy CONFIG_INFINIBAND_HNS")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/Makefile | 3 +-
+ drivers/infiniband/hw/hns/hns_roce_debugfs.c | 63 ++++++++++++++++++++
+ drivers/infiniband/hw/hns/hns_roce_debugfs.h | 27 +++++++++
+ drivers/infiniband/hw/hns/hns_roce_device.h | 2 +
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +
+ drivers/infiniband/hw/hns/hns_roce_main.c | 3 +
+ 6 files changed, 99 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/infiniband/hw/hns/hns_roce_debugfs.c
+ create mode 100644 drivers/infiniband/hw/hns/hns_roce_debugfs.h
+
+diff --git a/drivers/infiniband/hw/hns/Makefile b/drivers/infiniband/hw/hns/Makefile
+index a7d259238305b..be1e1cdbcfa8a 100644
+--- a/drivers/infiniband/hw/hns/Makefile
++++ b/drivers/infiniband/hw/hns/Makefile
+@@ -7,7 +7,8 @@ ccflags-y := -I $(srctree)/drivers/net/ethernet/hisilicon/hns3
+
+ hns-roce-objs := hns_roce_main.o hns_roce_cmd.o hns_roce_pd.o \
+ hns_roce_ah.o hns_roce_hem.o hns_roce_mr.o hns_roce_qp.o \
+- hns_roce_cq.o hns_roce_alloc.o hns_roce_db.o hns_roce_srq.o hns_roce_restrack.o
++ hns_roce_cq.o hns_roce_alloc.o hns_roce_db.o hns_roce_srq.o hns_roce_restrack.o \
++ hns_roce_debugfs.o
+
+ ifdef CONFIG_INFINIBAND_HNS_HIP08
+ hns-roce-hw-v2-objs := hns_roce_hw_v2.o $(hns-roce-objs)
+diff --git a/drivers/infiniband/hw/hns/hns_roce_debugfs.c b/drivers/infiniband/hw/hns/hns_roce_debugfs.c
+new file mode 100644
+index 0000000000000..79825570cc353
+--- /dev/null
++++ b/drivers/infiniband/hw/hns/hns_roce_debugfs.c
+@@ -0,0 +1,63 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Copyright (c) 2023 Hisilicon Limited.
++ */
++
++#include <linux/debugfs.h>
++#include <linux/device.h>
++
++#include "hns_roce_device.h"
++
++static struct dentry *hns_roce_dbgfs_root;
++
++static int hns_debugfs_seqfile_open(struct inode *inode, struct file *f)
++{
++ struct hns_debugfs_seqfile *seqfile = inode->i_private;
++
++ return single_open(f, seqfile->read, seqfile->data);
++}
++
++static const struct file_operations hns_debugfs_seqfile_fops = {
++ .owner = THIS_MODULE,
++ .open = hns_debugfs_seqfile_open,
++ .release = single_release,
++ .read = seq_read,
++ .llseek = seq_lseek
++};
++
++static void init_debugfs_seqfile(struct hns_debugfs_seqfile *seq,
++ const char *name, struct dentry *parent,
++ int (*read_fn)(struct seq_file *, void *),
++ void *data)
++{
++ debugfs_create_file(name, 0400, parent, seq, &hns_debugfs_seqfile_fops);
++
++ seq->read = read_fn;
++ seq->data = data;
++}
++
++/* debugfs for device */
++void hns_roce_register_debugfs(struct hns_roce_dev *hr_dev)
++{
++ struct hns_roce_dev_debugfs *dbgfs = &hr_dev->dbgfs;
++
++ dbgfs->root = debugfs_create_dir(dev_name(&hr_dev->ib_dev.dev),
++ hns_roce_dbgfs_root);
++}
++
++void hns_roce_unregister_debugfs(struct hns_roce_dev *hr_dev)
++{
++ debugfs_remove_recursive(hr_dev->dbgfs.root);
++}
++
++/* debugfs for hns module */
++void hns_roce_init_debugfs(void)
++{
++ hns_roce_dbgfs_root = debugfs_create_dir("hns_roce", NULL);
++}
++
++void hns_roce_cleanup_debugfs(void)
++{
++ debugfs_remove_recursive(hns_roce_dbgfs_root);
++ hns_roce_dbgfs_root = NULL;
++}
+diff --git a/drivers/infiniband/hw/hns/hns_roce_debugfs.h b/drivers/infiniband/hw/hns/hns_roce_debugfs.h
+new file mode 100644
+index 0000000000000..ece71fe6730c0
+--- /dev/null
++++ b/drivers/infiniband/hw/hns/hns_roce_debugfs.h
+@@ -0,0 +1,27 @@
++/* SPDX-License-Identifier: GPL-2.0+ */
++/*
++ * Copyright (c) 2023 Hisilicon Limited.
++ */
++
++#ifndef __HNS_ROCE_DEBUGFS_H
++#define __HNS_ROCE_DEBUGFS_H
++
++/* debugfs seqfile */
++struct hns_debugfs_seqfile {
++ int (*read)(struct seq_file *seq, void *data);
++ void *data;
++};
++
++/* Debugfs for device */
++struct hns_roce_dev_debugfs {
++ struct dentry *root;
++};
++
++struct hns_roce_dev;
++
++void hns_roce_init_debugfs(void);
++void hns_roce_cleanup_debugfs(void);
++void hns_roce_register_debugfs(struct hns_roce_dev *hr_dev);
++void hns_roce_unregister_debugfs(struct hns_roce_dev *hr_dev);
++
++#endif
+diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h
+index 0607970013536..e43c607162886 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_device.h
++++ b/drivers/infiniband/hw/hns/hns_roce_device.h
+@@ -35,6 +35,7 @@
+
+ #include <rdma/ib_verbs.h>
+ #include <rdma/hns-abi.h>
++#include "hns_roce_debugfs.h"
+
+ #define PCI_REVISION_ID_HIP08 0x21
+ #define PCI_REVISION_ID_HIP09 0x30
+@@ -969,6 +970,7 @@ struct hns_roce_dev {
+ u32 is_vf;
+ u32 cong_algo_tmpl_id;
+ u64 dwqe_page;
++ struct hns_roce_dev_debugfs dbgfs;
+ };
+
+ static inline struct hns_roce_dev *to_hr_dev(struct ib_device *ib_dev)
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index ab0dca9d199ab..3c6f6a031f497 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -7105,12 +7105,14 @@ static struct hnae3_client hns_roce_hw_v2_client = {
+
+ static int __init hns_roce_hw_v2_init(void)
+ {
++ hns_roce_init_debugfs();
+ return hnae3_register_client(&hns_roce_hw_v2_client);
+ }
+
+ static void __exit hns_roce_hw_v2_exit(void)
+ {
+ hnae3_unregister_client(&hns_roce_hw_v2_client);
++ hns_roce_cleanup_debugfs();
+ }
+
+ module_init(hns_roce_hw_v2_init);
+diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c
+index afe7523eca909..f77c79a89f4e9 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_main.c
++++ b/drivers/infiniband/hw/hns/hns_roce_main.c
+@@ -989,6 +989,8 @@ int hns_roce_init(struct hns_roce_dev *hr_dev)
+ if (ret)
+ goto error_failed_register_device;
+
++ hns_roce_register_debugfs(hr_dev);
++
+ return 0;
+
+ error_failed_register_device:
+@@ -1018,6 +1020,7 @@ int hns_roce_init(struct hns_roce_dev *hr_dev)
+
+ void hns_roce_exit(struct hns_roce_dev *hr_dev)
+ {
++ hns_roce_unregister_debugfs(hr_dev);
+ hns_roce_unregister_device(hr_dev);
+
+ if (hr_dev->hw->hw_exit)
+--
+2.39.5
+
--- /dev/null
+From b4a8e011dafdaee8b8148457b577e76f264428ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jan 2025 19:12:11 +0800
+Subject: RDMA/hns: Clean up the legacy CONFIG_INFINIBAND_HNS
+
+From: Junxian Huang <huangjunxian6@hisilicon.com>
+
+[ Upstream commit 8977b561216c7e693d61c6442657e33f134bfeb5 ]
+
+hns driver used to support hip06 and hip08 devices with
+CONFIG_INFINIBAND_HNS_HIP06 and CONFIG_INFINIBAND_HNS_HIP08
+respectively, which both depended on CONFIG_INFINIBAND_HNS.
+
+But we no longer provide support for hip06 and only support
+hip08 and higher since the commit in fixes line, so there is
+no need to have CONFIG_INFINIBAND_HNS any more. Remove it and
+only keep CONFIG_INFINIBAND_HNS_HIP08.
+
+Fixes: 38d220882426 ("RDMA/hns: Remove support for HIP06")
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://patch.msgid.link/20250106111211.3945051-1-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/Makefile | 2 +-
+ drivers/infiniband/hw/hns/Kconfig | 20 +++++---------------
+ drivers/infiniband/hw/hns/Makefile | 9 +++------
+ 3 files changed, 9 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/infiniband/hw/Makefile b/drivers/infiniband/hw/Makefile
+index 6b3a88046125a..ba1d07277e2db 100644
+--- a/drivers/infiniband/hw/Makefile
++++ b/drivers/infiniband/hw/Makefile
+@@ -10,7 +10,7 @@ obj-$(CONFIG_INFINIBAND_OCRDMA) += ocrdma/
+ obj-$(CONFIG_INFINIBAND_VMWARE_PVRDMA) += vmw_pvrdma/
+ obj-$(CONFIG_INFINIBAND_USNIC) += usnic/
+ obj-$(CONFIG_INFINIBAND_HFI1) += hfi1/
+-obj-$(CONFIG_INFINIBAND_HNS) += hns/
++obj-$(CONFIG_INFINIBAND_HNS_HIP08) += hns/
+ obj-$(CONFIG_INFINIBAND_QEDR) += qedr/
+ obj-$(CONFIG_INFINIBAND_BNXT_RE) += bnxt_re/
+ obj-$(CONFIG_INFINIBAND_ERDMA) += erdma/
+diff --git a/drivers/infiniband/hw/hns/Kconfig b/drivers/infiniband/hw/hns/Kconfig
+index ab3fbba70789c..44cdb706fe276 100644
+--- a/drivers/infiniband/hw/hns/Kconfig
++++ b/drivers/infiniband/hw/hns/Kconfig
+@@ -1,21 +1,11 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+-config INFINIBAND_HNS
+- tristate "HNS RoCE Driver"
+- depends on NET_VENDOR_HISILICON
+- depends on ARM64 || (COMPILE_TEST && 64BIT)
+- depends on (HNS_DSAF && HNS_ENET) || HNS3
+- help
+- This is a RoCE/RDMA driver for the Hisilicon RoCE engine.
+-
+- To compile HIP08 driver as module, choose M here.
+-
+ config INFINIBAND_HNS_HIP08
+- bool "Hisilicon Hip08 Family RoCE support"
+- depends on INFINIBAND_HNS && PCI && HNS3
+- depends on INFINIBAND_HNS=m || HNS3=y
++ tristate "Hisilicon Hip08 Family RoCE support"
++ depends on ARM64 || (COMPILE_TEST && 64BIT)
++ depends on PCI && HNS3
+ help
+ RoCE driver support for Hisilicon RoCE engine in Hisilicon Hip08 SoC.
+ The RoCE engine is a PCI device.
+
+- To compile this driver, choose Y here: if INFINIBAND_HNS is m, this
+- module will be called hns-roce-hw-v2.
++ To compile this driver, choose M here. This module will be called
++ hns-roce-hw-v2.
+diff --git a/drivers/infiniband/hw/hns/Makefile b/drivers/infiniband/hw/hns/Makefile
+index be1e1cdbcfa8a..7917af8e6380e 100644
+--- a/drivers/infiniband/hw/hns/Makefile
++++ b/drivers/infiniband/hw/hns/Makefile
+@@ -5,12 +5,9 @@
+
+ ccflags-y := -I $(srctree)/drivers/net/ethernet/hisilicon/hns3
+
+-hns-roce-objs := hns_roce_main.o hns_roce_cmd.o hns_roce_pd.o \
++hns-roce-hw-v2-objs := hns_roce_main.o hns_roce_cmd.o hns_roce_pd.o \
+ hns_roce_ah.o hns_roce_hem.o hns_roce_mr.o hns_roce_qp.o \
+ hns_roce_cq.o hns_roce_alloc.o hns_roce_db.o hns_roce_srq.o hns_roce_restrack.o \
+- hns_roce_debugfs.o
++ hns_roce_debugfs.o hns_roce_hw_v2.o
+
+-ifdef CONFIG_INFINIBAND_HNS_HIP08
+-hns-roce-hw-v2-objs := hns_roce_hw_v2.o $(hns-roce-objs)
+-obj-$(CONFIG_INFINIBAND_HNS) += hns-roce-hw-v2.o
+-endif
++obj-$(CONFIG_INFINIBAND_HNS_HIP08) += hns-roce-hw-v2.o
+--
+2.39.5
+
--- /dev/null
+From 48ec02e9f1e51d48d469bda43940ea63a0788cba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2024 15:44:25 +0200
+Subject: RDMA/mlx4: Avoid false error about access to uninitialized gids array
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit 1f53d88cbb0dcc7df235bf6611ae632b254fccd8 ]
+
+Smatch generates the following false error report:
+drivers/infiniband/hw/mlx4/main.c:393 mlx4_ib_del_gid() error: uninitialized symbol 'gids'.
+
+Traditionally, we are not changing kernel code and asking people to fix
+the tools. However in this case, the fix can be done by simply rearranging
+the code to be more clear.
+
+Fixes: e26be1bfef81 ("IB/mlx4: Implement ib_device callbacks")
+Link: https://patch.msgid.link/6a3a1577463da16962463fcf62883a87506e9b62.1733233426.git.leonro@nvidia.com
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx4/main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
+index ba47874f90d38..7c3dc86ab7f04 100644
+--- a/drivers/infiniband/hw/mlx4/main.c
++++ b/drivers/infiniband/hw/mlx4/main.c
+@@ -384,10 +384,10 @@ static int mlx4_ib_del_gid(const struct ib_gid_attr *attr, void **context)
+ }
+ spin_unlock_bh(&iboe->lock);
+
+- if (!ret && hw_update) {
++ if (gids)
+ ret = mlx4_ib_update_gids(gids, ibdev, attr->port_num);
+- kfree(gids);
+- }
++
++ kfree(gids);
+ return ret;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 87d33f0893bc9183c82994c703fd67eee528b351 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jan 2025 20:27:10 +0200
+Subject: RDMA/mlx5: Fix indirect mkey ODP page count
+
+From: Michael Guralnik <michaelgur@nvidia.com>
+
+[ Upstream commit 235f238402194a78ac5fb882a46717eac817e5d1 ]
+
+Restrict the check for the number of pages handled during an ODP page
+fault to direct mkeys.
+Perform the check right after handling the page fault and don't
+propagate the number of handled pages to callers.
+
+Indirect mkeys and their associated direct mkeys can have different
+start addresses. As a result, the calculation of the number of pages to
+handle for an indirect mkey may not match the actual page fault
+handling done on the direct mkey.
+
+For example:
+A 4K sized page fault on a KSM mkey that has a start address that is not
+aligned to a page will result a calculation that assumes the number of
+pages required to handle are 2.
+While the underlying MTT might be aligned will require fetching only a
+single page.
+Thus, do the calculation and compare number of pages handled only per
+direct mkey.
+
+Fixes: db570d7deafb ("IB/mlx5: Add ODP support to MW")
+Signed-off-by: Michael Guralnik <michaelgur@nvidia.com>
+Reviewed-by: Artemy Kovalyov <artemyko@nvidia.com>
+Link: https://patch.msgid.link/86c483d9e75ce8fe14e9ff85b62df72b779f8ab1.1736187990.git.leon@kernel.org
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/odp.c | 32 +++++++++++++++-----------------
+ 1 file changed, 15 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
+index d3cada2ae5a5b..87fbee8061003 100644
+--- a/drivers/infiniband/hw/mlx5/odp.c
++++ b/drivers/infiniband/hw/mlx5/odp.c
+@@ -808,8 +808,7 @@ static bool mkey_is_eq(struct mlx5_ib_mkey *mmkey, u32 key)
+ /*
+ * Handle a single data segment in a page-fault WQE or RDMA region.
+ *
+- * Returns number of OS pages retrieved on success. The caller may continue to
+- * the next data segment.
++ * Returns zero on success. The caller may continue to the next data segment.
+ * Can return the following error codes:
+ * -EAGAIN to designate a temporary error. The caller will abort handling the
+ * page fault and resolve it.
+@@ -822,7 +821,7 @@ static int pagefault_single_data_segment(struct mlx5_ib_dev *dev,
+ u32 *bytes_committed,
+ u32 *bytes_mapped)
+ {
+- int npages = 0, ret, i, outlen, cur_outlen = 0, depth = 0;
++ int ret, i, outlen, cur_outlen = 0, depth = 0, pages_in_range;
+ struct pf_frame *head = NULL, *frame;
+ struct mlx5_ib_mkey *mmkey;
+ struct mlx5_ib_mr *mr;
+@@ -865,13 +864,20 @@ static int pagefault_single_data_segment(struct mlx5_ib_dev *dev,
+ case MLX5_MKEY_MR:
+ mr = container_of(mmkey, struct mlx5_ib_mr, mmkey);
+
++ pages_in_range = (ALIGN(io_virt + bcnt, PAGE_SIZE) -
++ (io_virt & PAGE_MASK)) >>
++ PAGE_SHIFT;
+ ret = pagefault_mr(mr, io_virt, bcnt, bytes_mapped, 0, false);
+ if (ret < 0)
+ goto end;
+
+ mlx5_update_odp_stats(mr, faults, ret);
+
+- npages += ret;
++ if (ret < pages_in_range) {
++ ret = -EFAULT;
++ goto end;
++ }
++
+ ret = 0;
+ break;
+
+@@ -962,7 +968,7 @@ static int pagefault_single_data_segment(struct mlx5_ib_dev *dev,
+ kfree(out);
+
+ *bytes_committed = 0;
+- return ret ? ret : npages;
++ return ret;
+ }
+
+ /*
+@@ -981,8 +987,7 @@ static int pagefault_single_data_segment(struct mlx5_ib_dev *dev,
+ * the committed bytes).
+ * @receive_queue: receive WQE end of sg list
+ *
+- * Returns the number of pages loaded if positive, zero for an empty WQE, or a
+- * negative error code.
++ * Returns zero for success or a negative error code.
+ */
+ static int pagefault_data_segments(struct mlx5_ib_dev *dev,
+ struct mlx5_pagefault *pfault,
+@@ -990,7 +995,7 @@ static int pagefault_data_segments(struct mlx5_ib_dev *dev,
+ void *wqe_end, u32 *bytes_mapped,
+ u32 *total_wqe_bytes, bool receive_queue)
+ {
+- int ret = 0, npages = 0;
++ int ret = 0;
+ u64 io_virt;
+ u32 key;
+ u32 byte_count;
+@@ -1046,10 +1051,9 @@ static int pagefault_data_segments(struct mlx5_ib_dev *dev,
+ bytes_mapped);
+ if (ret < 0)
+ break;
+- npages += ret;
+ }
+
+- return ret < 0 ? ret : npages;
++ return ret;
+ }
+
+ /*
+@@ -1285,12 +1289,6 @@ static void mlx5_ib_mr_wqe_pfault_handler(struct mlx5_ib_dev *dev,
+ free_page((unsigned long)wqe_start);
+ }
+
+-static int pages_in_range(u64 address, u32 length)
+-{
+- return (ALIGN(address + length, PAGE_SIZE) -
+- (address & PAGE_MASK)) >> PAGE_SHIFT;
+-}
+-
+ static void mlx5_ib_mr_rdma_pfault_handler(struct mlx5_ib_dev *dev,
+ struct mlx5_pagefault *pfault)
+ {
+@@ -1329,7 +1327,7 @@ static void mlx5_ib_mr_rdma_pfault_handler(struct mlx5_ib_dev *dev,
+ if (ret == -EAGAIN) {
+ /* We're racing with an invalidation, don't prefetch */
+ prefetch_activated = 0;
+- } else if (ret < 0 || pages_in_range(address, length) > ret) {
++ } else if (ret < 0) {
+ mlx5_ib_page_fault_resume(dev, pfault, 1);
+ if (ret != -ENOENT)
+ mlx5_ib_dbg(dev, "PAGE FAULT error %d. QP 0x%x, type: 0x%x\n",
+--
+2.39.5
+
--- /dev/null
+From 41e67ef1b3fc7ba7f64903b73addf6b58b680fc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2025 17:09:27 +0100
+Subject: RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]"
+
+From: Zhu Yanjun <yanjun.zhu@linux.dev>
+
+[ Upstream commit edc4ef0e0154096d6c0cf5e06af6fc330dbad9d1 ]
+
+The Call Trace is as below:
+"
+ <TASK>
+ ? show_regs.cold+0x1a/0x1f
+ ? __rxe_cleanup+0x12c/0x170 [rdma_rxe]
+ ? __warn+0x84/0xd0
+ ? __rxe_cleanup+0x12c/0x170 [rdma_rxe]
+ ? report_bug+0x105/0x180
+ ? handle_bug+0x46/0x80
+ ? exc_invalid_op+0x19/0x70
+ ? asm_exc_invalid_op+0x1b/0x20
+ ? __rxe_cleanup+0x12c/0x170 [rdma_rxe]
+ ? __rxe_cleanup+0x124/0x170 [rdma_rxe]
+ rxe_destroy_qp.cold+0x24/0x29 [rdma_rxe]
+ ib_destroy_qp_user+0x118/0x190 [ib_core]
+ rdma_destroy_qp.cold+0x43/0x5e [rdma_cm]
+ rtrs_cq_qp_destroy.cold+0x1d/0x2b [rtrs_core]
+ rtrs_srv_close_work.cold+0x1b/0x31 [rtrs_server]
+ process_one_work+0x21d/0x3f0
+ worker_thread+0x4a/0x3c0
+ ? process_one_work+0x3f0/0x3f0
+ kthread+0xf0/0x120
+ ? kthread_complete_and_exit+0x20/0x20
+ ret_from_fork+0x22/0x30
+ </TASK>
+"
+When too many rdma resources are allocated, rxe needs more time to
+handle these rdma resources. Sometimes with the current timeout, rxe
+can not release the rdma resources correctly.
+
+Compared with other rdma drivers, a bigger timeout is used.
+
+Fixes: 215d0a755e1b ("RDMA/rxe: Stop lookup of partially built objects")
+Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Link: https://patch.msgid.link/20250110160927.55014-1-yanjun.zhu@linux.dev
+Tested-by: Joe Klein <joe.klein812@gmail.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_pool.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c
+index 1151c0b5cceab..02cf5e851eb0f 100644
+--- a/drivers/infiniband/sw/rxe/rxe_pool.c
++++ b/drivers/infiniband/sw/rxe/rxe_pool.c
+@@ -221,7 +221,6 @@ int __rxe_cleanup(struct rxe_pool_elem *elem, bool sleepable)
+ {
+ struct rxe_pool *pool = elem->pool;
+ struct xarray *xa = &pool->xa;
+- static int timeout = RXE_POOL_TIMEOUT;
+ int ret, err = 0;
+ void *xa_ret;
+
+@@ -245,19 +244,19 @@ int __rxe_cleanup(struct rxe_pool_elem *elem, bool sleepable)
+ * return to rdma-core
+ */
+ if (sleepable) {
+- if (!completion_done(&elem->complete) && timeout) {
++ if (!completion_done(&elem->complete)) {
+ ret = wait_for_completion_timeout(&elem->complete,
+- timeout);
++ msecs_to_jiffies(50000));
+
+ /* Shouldn't happen. There are still references to
+ * the object but, rather than deadlock, free the
+ * object or pass back to rdma-core.
+ */
+ if (WARN_ON(!ret))
+- err = -EINVAL;
++ err = -ETIMEDOUT;
+ }
+ } else {
+- unsigned long until = jiffies + timeout;
++ unsigned long until = jiffies + RXE_POOL_TIMEOUT;
+
+ /* AH objects are unique in that the destroy_ah verb
+ * can be called in atomic context. This delay
+@@ -269,7 +268,7 @@ int __rxe_cleanup(struct rxe_pool_elem *elem, bool sleepable)
+ mdelay(1);
+
+ if (WARN_ON(!completion_done(&elem->complete)))
+- err = -EINVAL;
++ err = -ETIMEDOUT;
+ }
+
+ if (pool->cleanup)
+--
+2.39.5
+
--- /dev/null
+From f25397a0ffc0461671c36c0545f06dedf9eb2bd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2024 15:55:38 +0800
+Subject: RDMA/srp: Fix error handling in srp_add_port
+
+From: Ma Ke <make_ruc2021@163.com>
+
+[ Upstream commit a3cbf68c69611188cd304229e346bffdabfd4277 ]
+
+As comment of device_add() says, if device_add() succeeds, you should
+call device_del() when you want to get rid of it. If device_add() has
+not succeeded, use only put_device() to drop the reference count.
+
+Add a put_device() call before returning from the function to decrement
+reference count for cleanup.
+
+Found by code review.
+
+Fixes: c8e4c2397655 ("RDMA/srp: Rework the srp_add_port() error path")
+Signed-off-by: Ma Ke <make_ruc2021@163.com>
+Link: https://patch.msgid.link/20241217075538.2909996-1-make_ruc2021@163.com
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/srp/ib_srp.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index c4dcef76e9646..8df23ab974c16 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -3983,7 +3983,6 @@ static struct srp_host *srp_add_port(struct srp_device *device, u32 port)
+ return host;
+
+ put_host:
+- device_del(&host->dev);
+ put_device(&host->dev);
+ return NULL;
+ }
+--
+2.39.5
+
--- /dev/null
+From 445b4f7194a99489238cfa5c88f53eaf49f19789 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2025 08:20:19 +0100
+Subject: regulator: core: Add missing newline character
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 155c569fa4c3b340fbf8571a0e42dd415c025377 ]
+
+dev_err_probe() error messages need newline character.
+
+Fixes: 6eabfc018e8d ("regulator: core: Allow specifying an initial load w/ the bulk API")
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://patch.msgid.link/20250122072019.1926093-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 518b64b2d69bc..fc52551aa265e 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -4897,7 +4897,7 @@ int regulator_bulk_get(struct device *dev, int num_consumers,
+ consumers[i].supply);
+ if (IS_ERR(consumers[i].consumer)) {
+ ret = dev_err_probe(dev, PTR_ERR(consumers[i].consumer),
+- "Failed to get supply '%s'",
++ "Failed to get supply '%s'\n",
+ consumers[i].supply);
+ consumers[i].consumer = NULL;
+ goto err;
+--
+2.39.5
+
--- /dev/null
+From 46909d8accad993b18c5b9a724126eee93040003 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2024 13:24:19 +0800
+Subject: regulator: dt-bindings: mt6315: Drop regulator-compatible property
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 08242719a8af603db54a2a79234a8fe600680105 ]
+
+The "regulator-compatible" property has been deprecated since 2012 in
+commit 13511def87b9 ("regulator: deprecate regulator-compatible DT
+property"), which is so old it's not even mentioned in the converted
+regulator bindings YAML file. It should not have been used for new
+submissions such as the MT6315.
+
+Drop the property from the MT6315 regulator binding and its examples.
+
+Fixes: 977fb5b58469 ("regulator: document binding for MT6315 regulator")
+Fixes: 6d435a94ba5b ("regulator: mt6315: Enforce regulator-compatible, not name")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://patch.msgid.link/20241211052427.4178367-2-wenst@chromium.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/regulator/mt6315-regulator.yaml | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/regulator/mt6315-regulator.yaml b/Documentation/devicetree/bindings/regulator/mt6315-regulator.yaml
+index 364b58730be2b..796c09f24f3e6 100644
+--- a/Documentation/devicetree/bindings/regulator/mt6315-regulator.yaml
++++ b/Documentation/devicetree/bindings/regulator/mt6315-regulator.yaml
+@@ -31,10 +31,6 @@ properties:
+ $ref: "regulator.yaml#"
+ unevaluatedProperties: false
+
+- properties:
+- regulator-compatible:
+- pattern: "^vbuck[1-4]$"
+-
+ additionalProperties: false
+
+ required:
+@@ -52,7 +48,6 @@ examples:
+
+ regulators {
+ vbuck1 {
+- regulator-compatible = "vbuck1";
+ regulator-min-microvolt = <300000>;
+ regulator-max-microvolt = <1193750>;
+ regulator-enable-ramp-delay = <256>;
+@@ -60,7 +55,6 @@ examples:
+ };
+
+ vbuck3 {
+- regulator-compatible = "vbuck3";
+ regulator-min-microvolt = <300000>;
+ regulator-max-microvolt = <1193750>;
+ regulator-enable-ramp-delay = <256>;
+--
+2.39.5
+
--- /dev/null
+From 1a0012512237d65f1bf67279303f45bba85caf5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jan 2025 17:04:53 +0900
+Subject: regulator: of: Implement the unwind path of of_regulator_match()
+
+From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+
+[ Upstream commit dddca3b2fc676113c58b04aaefe84bfb958ac83e ]
+
+of_regulator_match() does not release the OF node reference in the error
+path, resulting in an OF node leak. Therefore, call of_node_put() on the
+obtained nodes before returning the EINVAL error.
+
+Since it is possible that some drivers call this function and do not
+exit on failure, such as s2mps11_pmic_driver, clear the init_data and
+of_node in the error path.
+
+This was reported by an experimental verification tool that I am
+developing. As I do not have access to actual devices nor the QEMU board
+configuration to test drivers that call this function, no runtime test
+was able to be performed.
+
+Fixes: 1c8fa58f4750 ("regulator: Add generic DT parsing for regulators")
+Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+Link: https://patch.msgid.link/20250104080453.2153592-1-joe@pf.is.s.u-tokyo.ac.jp
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/of_regulator.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c
+index 59e71fd0db439..f23c12f4ffbfa 100644
+--- a/drivers/regulator/of_regulator.c
++++ b/drivers/regulator/of_regulator.c
+@@ -435,7 +435,7 @@ int of_regulator_match(struct device *dev, struct device_node *node,
+ "failed to parse DT for regulator %pOFn\n",
+ child);
+ of_node_put(child);
+- return -EINVAL;
++ goto err_put;
+ }
+ match->of_node = of_node_get(child);
+ count++;
+@@ -444,6 +444,18 @@ int of_regulator_match(struct device *dev, struct device_node *node,
+ }
+
+ return count;
++
++err_put:
++ for (i = 0; i < num_matches; i++) {
++ struct of_regulator_match *match = &matches[i];
++
++ match->init_data = NULL;
++ if (match->of_node) {
++ of_node_put(match->of_node);
++ match->of_node = NULL;
++ }
++ }
++ return -EINVAL;
+ }
+ EXPORT_SYMBOL_GPL(of_regulator_match);
+
+--
+2.39.5
+
--- /dev/null
+From dc594a8dfeacd52ff1686e1fbde608286023fe4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2024 20:34:58 +0100
+Subject: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 3ab8c5ed4f84fa20cd16794fe8dc31f633fbc70c ]
+
+The nvmem interface supports variable buffer sizes, while the regmap
+interface operates with fixed-size storage. If an nvmem client uses a
+buffer size less than 4 bytes, regmap_read will write out of bounds
+as it expects the buffer to point at an unsigned int.
+
+Fix this by using an intermediary unsigned int to hold the value.
+
+Fixes: fadfd092ee91 ("rtc: pcf85063: add nvram support")
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Link: https://lore.kernel.org/r/20241218-rtc-pcf85063-stack-corruption-v1-1-12fd0ee0f046@pengutronix.de
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pcf85063.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-pcf85063.c b/drivers/rtc/rtc-pcf85063.c
+index 754e03984f986..6ffdc10b32d32 100644
+--- a/drivers/rtc/rtc-pcf85063.c
++++ b/drivers/rtc/rtc-pcf85063.c
+@@ -322,7 +322,16 @@ static const struct rtc_class_ops pcf85063_rtc_ops = {
+ static int pcf85063_nvmem_read(void *priv, unsigned int offset,
+ void *val, size_t bytes)
+ {
+- return regmap_read(priv, PCF85063_REG_RAM, val);
++ unsigned int tmp;
++ int ret;
++
++ ret = regmap_read(priv, PCF85063_REG_RAM, &tmp);
++ if (ret < 0)
++ return ret;
++
++ *(u8 *)val = tmp;
++
++ return 0;
+ }
+
+ static int pcf85063_nvmem_write(void *priv, unsigned int offset,
+--
+2.39.5
+
--- /dev/null
+From f7a31f5647493bf250e32b5bb5b81ea3ce6d2dbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2024 21:29:56 -0600
+Subject: samples/landlock: Fix possible NULL dereference in parse_path()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Zichen Xie <zichenxie0106@gmail.com>
+
+[ Upstream commit 078bf9438a31567e2c0587159ccefde835fb1ced ]
+
+malloc() may return NULL, leading to NULL dereference. Add a NULL
+check.
+
+Fixes: ba84b0bf5a16 ("samples/landlock: Add a sandbox manager example")
+Signed-off-by: Zichen Xie <zichenxie0106@gmail.com>
+Link: https://lore.kernel.org/r/20241128032955.11711-1-zichenxie0106@gmail.com
+[mic: Simplify fix]
+Signed-off-by: Mickaël Salaün <mic@digikod.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/landlock/sandboxer.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c
+index f29bb3c722307..ce9b77bc167b1 100644
+--- a/samples/landlock/sandboxer.c
++++ b/samples/landlock/sandboxer.c
+@@ -65,6 +65,9 @@ static int parse_path(char *env_path, const char ***const path_list)
+ }
+ }
+ *path_list = malloc(num_paths * sizeof(**path_list));
++ if (!*path_list)
++ return -1;
++
+ for (i = 0; i < num_paths; i++)
+ (*path_list)[i] = strsep(&env_path, ENV_PATH_TOKEN);
+
+@@ -99,6 +102,10 @@ static int populate_ruleset(const char *const env_var, const int ruleset_fd,
+ env_path_name = strdup(env_path_name);
+ unsetenv(env_var);
+ num_paths = parse_path(env_path_name, &path_list);
++ if (num_paths < 0) {
++ fprintf(stderr, "Failed to allocate memory\n");
++ goto out_free_name;
++ }
+ if (num_paths == 1 && path_list[0][0] == '\0') {
+ /*
+ * Allows to not use all possible restrictions (e.g. use
+--
+2.39.5
+
--- /dev/null
+From fe7365a9ff434a6edbe94589a47e912b93ac1186 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2024 06:32:19 +0000
+Subject: sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit a430d99e349026d53e2557b7b22bd2ebd61fe12a ]
+
+In /proc/schedstat, lb_hot_gained reports the number hot tasks pulled
+during load balance. This value is incremented in can_migrate_task()
+if the task is migratable and hot. After incrementing the value,
+load balancer can still decide not to migrate this task leading to wrong
+accounting. Fix this by incrementing stats when hot tasks are detached.
+This issue only exists in detach_tasks() where we can decide to not
+migrate hot task even if it is migratable. However, in detach_one_task(),
+we migrate it unconditionally.
+
+[Swapnil: Handled the case where nr_failed_migrations_hot was not accounted properly and wrote commit log]
+
+Fixes: d31980846f96 ("sched: Move up affinity check to mitigate useless redoing overhead")
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reported-by: "Gautham R. Shenoy" <gautham.shenoy@amd.com>
+Not-yet-signed-off-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Swapnil Sapkal <swapnil.sapkal@amd.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20241220063224.17767-2-swapnil.sapkal@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sched.h | 1 +
+ kernel/sched/fair.c | 17 +++++++++++++----
+ 2 files changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 6c82d71fab113..4dc764f3d26f5 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -888,6 +888,7 @@ struct task_struct {
+ unsigned sched_reset_on_fork:1;
+ unsigned sched_contributes_to_load:1;
+ unsigned sched_migrated:1;
++ unsigned sched_task_hot:1;
+
+ /* Force alignment to the next boundary: */
+ unsigned :0;
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index cf3bbddd4b7fc..eedbe66e05273 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -8317,6 +8317,8 @@ int can_migrate_task(struct task_struct *p, struct lb_env *env)
+ int tsk_cache_hot;
+
+ lockdep_assert_rq_held(env->src_rq);
++ if (p->sched_task_hot)
++ p->sched_task_hot = 0;
+
+ /*
+ * We do not migrate tasks that are:
+@@ -8389,10 +8391,8 @@ int can_migrate_task(struct task_struct *p, struct lb_env *env)
+
+ if (tsk_cache_hot <= 0 ||
+ env->sd->nr_balance_failed > env->sd->cache_nice_tries) {
+- if (tsk_cache_hot == 1) {
+- schedstat_inc(env->sd->lb_hot_gained[env->idle]);
+- schedstat_inc(p->stats.nr_forced_migrations);
+- }
++ if (tsk_cache_hot == 1)
++ p->sched_task_hot = 1;
+ return 1;
+ }
+
+@@ -8407,6 +8407,12 @@ static void detach_task(struct task_struct *p, struct lb_env *env)
+ {
+ lockdep_assert_rq_held(env->src_rq);
+
++ if (p->sched_task_hot) {
++ p->sched_task_hot = 0;
++ schedstat_inc(env->sd->lb_hot_gained[env->idle]);
++ schedstat_inc(p->stats.nr_forced_migrations);
++ }
++
+ deactivate_task(env->src_rq, p, DEQUEUE_NOCLOCK);
+ set_task_cpu(p, env->dst_cpu);
+ }
+@@ -8567,6 +8573,9 @@ static int detach_tasks(struct lb_env *env)
+
+ continue;
+ next:
++ if (p->sched_task_hot)
++ schedstat_inc(p->stats.nr_failed_migrations_hot);
++
+ list_move(&p->se.group_node, tasks);
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 8c3963a7a694007864917926be335df6aac13f0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Sep 2022 16:19:31 +0800
+Subject: sched/psi: Use task->psi_flags to clear in CPU migration
+
+From: Chengming Zhou <zhouchengming@bytedance.com>
+
+[ Upstream commit 52b33d87b9197c51e8ffdc61873739d90dd0a16f ]
+
+The commit d583d360a620 ("psi: Fix psi state corruption when schedule()
+races with cgroup move") fixed a race problem by making cgroup_move_task()
+use task->psi_flags instead of looking at the scheduler state.
+
+We can extend task->psi_flags usage to CPU migration, which should be
+a minor optimization for performance and code simplicity.
+
+Signed-off-by: Chengming Zhou <zhouchengming@bytedance.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Acked-by: Johannes Weiner <hannes@cmpxchg.org>
+Link: https://lore.kernel.org/r/20220926081931.45420-1-zhouchengming@bytedance.com
+Stable-dep-of: a430d99e3490 ("sched/fair: Fix value reported by hot tasks pulled in /proc/schedstat")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sched.h | 3 ---
+ kernel/sched/core.c | 2 +-
+ kernel/sched/stats.h | 22 ++++------------------
+ 3 files changed, 5 insertions(+), 22 deletions(-)
+
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index e87a68b136da9..6c82d71fab113 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -888,9 +888,6 @@ struct task_struct {
+ unsigned sched_reset_on_fork:1;
+ unsigned sched_contributes_to_load:1;
+ unsigned sched_migrated:1;
+-#ifdef CONFIG_PSI
+- unsigned sched_psi_wake_requeue:1;
+-#endif
+
+ /* Force alignment to the next boundary: */
+ unsigned :0;
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 54af671e8d510..f54d2da2f9a67 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -2049,7 +2049,7 @@ static inline void enqueue_task(struct rq *rq, struct task_struct *p, int flags)
+
+ if (!(flags & ENQUEUE_RESTORE)) {
+ sched_info_enqueue(rq, p);
+- psi_enqueue(p, flags & ENQUEUE_WAKEUP);
++ psi_enqueue(p, (flags & ENQUEUE_WAKEUP) && !(flags & ENQUEUE_MIGRATED));
+ }
+
+ uclamp_rq_inc(rq, p);
+diff --git a/kernel/sched/stats.h b/kernel/sched/stats.h
+index b49a96fad1d2f..b02dfc3229510 100644
+--- a/kernel/sched/stats.h
++++ b/kernel/sched/stats.h
+@@ -132,11 +132,9 @@ static inline void psi_enqueue(struct task_struct *p, bool wakeup)
+ if (p->in_memstall)
+ set |= TSK_MEMSTALL_RUNNING;
+
+- if (!wakeup || p->sched_psi_wake_requeue) {
++ if (!wakeup) {
+ if (p->in_memstall)
+ set |= TSK_MEMSTALL;
+- if (p->sched_psi_wake_requeue)
+- p->sched_psi_wake_requeue = 0;
+ } else {
+ if (p->in_iowait)
+ clear |= TSK_IOWAIT;
+@@ -147,8 +145,6 @@ static inline void psi_enqueue(struct task_struct *p, bool wakeup)
+
+ static inline void psi_dequeue(struct task_struct *p, bool sleep)
+ {
+- int clear = TSK_RUNNING;
+-
+ if (static_branch_likely(&psi_disabled))
+ return;
+
+@@ -161,10 +157,7 @@ static inline void psi_dequeue(struct task_struct *p, bool sleep)
+ if (sleep)
+ return;
+
+- if (p->in_memstall)
+- clear |= (TSK_MEMSTALL | TSK_MEMSTALL_RUNNING);
+-
+- psi_task_change(p, clear, 0);
++ psi_task_change(p, p->psi_flags, 0);
+ }
+
+ static inline void psi_ttwu_dequeue(struct task_struct *p)
+@@ -176,19 +169,12 @@ static inline void psi_ttwu_dequeue(struct task_struct *p)
+ * deregister its sleep-persistent psi states from the old
+ * queue, and let psi_enqueue() know it has to requeue.
+ */
+- if (unlikely(p->in_iowait || p->in_memstall)) {
++ if (unlikely(p->psi_flags)) {
+ struct rq_flags rf;
+ struct rq *rq;
+- int clear = 0;
+-
+- if (p->in_iowait)
+- clear |= TSK_IOWAIT;
+- if (p->in_memstall)
+- clear |= TSK_MEMSTALL;
+
+ rq = __task_rq_lock(p, &rf);
+- psi_task_change(p, clear, 0);
+- p->sched_psi_wake_requeue = 1;
++ psi_task_change(p, p->psi_flags, 0);
+ __task_rq_unlock(rq, &rf);
+ }
+ }
+--
+2.39.5
+
--- /dev/null
+From ddb3f3e63cd30937b1200984a2dbea776fa9fdbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2024 23:18:12 +0100
+Subject: scsi: mpt3sas: Set ioc->manu_pg11.EEDPTagMode directly to 1
+
+From: Paul Menzel <pmenzel@molgen.mpg.de>
+
+[ Upstream commit ad7c3c0cb8f61d6d5a48b83e62ca4a9fd2f26153 ]
+
+Currently, the code does:
+
+ if (x == 0) {
+ x &= ~0x3;
+ x |= 0x1;
+ }
+
+Zeroing bits 0 and 1 of a variable that is 0 is not necessary. So directly
+set the variable to 1.
+
+Cc: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS")
+Signed-off-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Link: https://lore.kernel.org/r/20241212221817.78940-2-pmenzel@molgen.mpg.de
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
+index 5c13358416c42..b5a3694bfe7f2 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -5649,8 +5649,7 @@ _base_static_config_pages(struct MPT3SAS_ADAPTER *ioc)
+ if (!ioc->is_gen35_ioc && ioc->manu_pg11.EEDPTagMode == 0) {
+ pr_err("%s: overriding NVDATA EEDPTagMode setting\n",
+ ioc->name);
+- ioc->manu_pg11.EEDPTagMode &= ~0x3;
+- ioc->manu_pg11.EEDPTagMode |= 0x1;
++ ioc->manu_pg11.EEDPTagMode = 0x1;
+ mpt3sas_config_set_manufacturing_pg11(ioc, &mpi_reply,
+ &ioc->manu_pg11);
+ }
+--
+2.39.5
+
--- /dev/null
+From 8315dc40c34af66e0e7b9b632f234ef63a36c6be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2024 09:42:13 +0800
+Subject: scsi: ufs: bsg: Delete bsg_dev when setting up bsg fails
+
+From: Guixin Liu <kanie@linux.alibaba.com>
+
+[ Upstream commit fcf247deb3c3e1c6be5774e3fa03bbd018eff1a9 ]
+
+We should remove the bsg device when bsg_setup_queue() fails to release the
+resources.
+
+Fixes: df032bf27a41 ("scsi: ufs: Add a bsg endpoint that supports UPIUs")
+Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
+Link: https://lore.kernel.org/r/20241218014214.64533-2-kanie@linux.alibaba.com
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufs_bsg.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c
+index b99e3f3dc4efd..87d89136cab90 100644
+--- a/drivers/ufs/core/ufs_bsg.c
++++ b/drivers/ufs/core/ufs_bsg.c
+@@ -219,6 +219,7 @@ int ufs_bsg_probe(struct ufs_hba *hba)
+ q = bsg_setup_queue(bsg_dev, dev_name(bsg_dev), ufs_bsg_request, NULL, 0);
+ if (IS_ERR(q)) {
+ ret = PTR_ERR(q);
++ device_del(bsg_dev);
+ goto out;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 79df2e106ded3ef51a4cc91fb6146d83cb4d4b18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2025 09:37:24 +0100
+Subject: select: Fix unbalanced user_access_end()
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 344af27715ddbf357cf76978d674428b88f8e92d ]
+
+While working on implementing user access validation on powerpc
+I got the following warnings on a pmac32_defconfig build:
+
+ CC fs/select.o
+ fs/select.o: warning: objtool: sys_pselect6+0x1bc: redundant UACCESS disable
+ fs/select.o: warning: objtool: sys_pselect6_time32+0x1bc: redundant UACCESS disable
+
+On powerpc/32s, user_read_access_begin/end() are no-ops, but the
+failure path has a user_access_end() instead of user_read_access_end()
+which means an access end without any prior access begin.
+
+Replace that user_access_end() by user_read_access_end().
+
+Fixes: 7e71609f64ec ("pselect6() and friends: take handling the combined 6th/7th args into helper")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Link: https://lore.kernel.org/r/a7139e28d767a13e667ee3c79599a8047222ef36.1736751221.git.christophe.leroy@csgroup.eu
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/select.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/select.c b/fs/select.c
+index d4d881d439dcd..3f730b8581f65 100644
+--- a/fs/select.c
++++ b/fs/select.c
+@@ -788,7 +788,7 @@ static inline int get_sigset_argpack(struct sigset_argpack *to,
+ }
+ return 0;
+ Efault:
+- user_access_end();
++ user_read_access_end();
+ return -EFAULT;
+ }
+
+@@ -1361,7 +1361,7 @@ static inline int get_compat_sigset_argpack(struct compat_sigset_argpack *to,
+ }
+ return 0;
+ Efault:
+- user_access_end();
++ user_read_access_end();
+ return -EFAULT;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 4fd6bc844984805f726ca713a430ae9d1a80b42a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2025 19:07:57 +0200
+Subject: selftests: harness: fix printing of mismatch values in __EXPECT()
+
+From: Dmitry V. Levin <ldv@strace.io>
+
+[ Upstream commit 02bc220dc6dc7c56edc4859bc5dd2c08b95d5fb5 ]
+
+intptr_t and uintptr_t are not big enough types on 32-bit architectures
+when printing 64-bit values, resulting to the following incorrect
+diagnostic output:
+
+ # get_syscall_info.c:209:get_syscall_info:Expected exp_args[2] (3134324433) == info.entry.args[1] (3134324433)
+
+Replace intptr_t and uintptr_t with intmax_t and uintmax_t, respectively.
+With this fix, the same test produces more usable diagnostic output:
+
+ # get_syscall_info.c:209:get_syscall_info:Expected exp_args[2] (3134324433) == info.entry.args[1] (18446744072548908753)
+
+Link: https://lore.kernel.org/r/20250108170757.GA6723@strace.io
+Fixes: b5bb6d3068ea ("selftests/seccomp: fix 32-bit build warnings")
+Signed-off-by: Dmitry V. Levin <ldv@strace.io>
+Reviewed-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/kselftest_harness.h | 24 ++++++++++-----------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/tools/testing/selftests/kselftest_harness.h b/tools/testing/selftests/kselftest_harness.h
+index 584687c3286dd..9d1379da59dfe 100644
+--- a/tools/testing/selftests/kselftest_harness.h
++++ b/tools/testing/selftests/kselftest_harness.h
+@@ -709,33 +709,33 @@
+ /* Report with actual signedness to avoid weird output. */ \
+ switch (is_signed_type(__exp) * 2 + is_signed_type(__seen)) { \
+ case 0: { \
+- unsigned long long __exp_print = (uintptr_t)__exp; \
+- unsigned long long __seen_print = (uintptr_t)__seen; \
+- __TH_LOG("Expected %s (%llu) %s %s (%llu)", \
++ uintmax_t __exp_print = (uintmax_t)__exp; \
++ uintmax_t __seen_print = (uintmax_t)__seen; \
++ __TH_LOG("Expected %s (%ju) %s %s (%ju)", \
+ _expected_str, __exp_print, #_t, \
+ _seen_str, __seen_print); \
+ break; \
+ } \
+ case 1: { \
+- unsigned long long __exp_print = (uintptr_t)__exp; \
+- long long __seen_print = (intptr_t)__seen; \
+- __TH_LOG("Expected %s (%llu) %s %s (%lld)", \
++ uintmax_t __exp_print = (uintmax_t)__exp; \
++ intmax_t __seen_print = (intmax_t)__seen; \
++ __TH_LOG("Expected %s (%ju) %s %s (%jd)", \
+ _expected_str, __exp_print, #_t, \
+ _seen_str, __seen_print); \
+ break; \
+ } \
+ case 2: { \
+- long long __exp_print = (intptr_t)__exp; \
+- unsigned long long __seen_print = (uintptr_t)__seen; \
+- __TH_LOG("Expected %s (%lld) %s %s (%llu)", \
++ intmax_t __exp_print = (intmax_t)__exp; \
++ uintmax_t __seen_print = (uintmax_t)__seen; \
++ __TH_LOG("Expected %s (%jd) %s %s (%ju)", \
+ _expected_str, __exp_print, #_t, \
+ _seen_str, __seen_print); \
+ break; \
+ } \
+ case 3: { \
+- long long __exp_print = (intptr_t)__exp; \
+- long long __seen_print = (intptr_t)__seen; \
+- __TH_LOG("Expected %s (%lld) %s %s (%lld)", \
++ intmax_t __exp_print = (intmax_t)__exp; \
++ intmax_t __seen_print = (intmax_t)__seen; \
++ __TH_LOG("Expected %s (%jd) %s %s (%jd)", \
+ _expected_str, __exp_print, #_t, \
+ _seen_str, __seen_print); \
+ break; \
+--
+2.39.5
+
--- /dev/null
+From 15b65b6e7806b16e59c01785f8107164dbe51e8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2025 16:43:28 +0100
+Subject: selftests/landlock: Fix error message
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mickaël Salaün <mic@digikod.net>
+
+[ Upstream commit 2107c35128ad751b201eb92fe91443450d9e5c37 ]
+
+The global variable errno may not be set in test_execute(). Do not use
+it in related error message.
+
+Cc: Günther Noack <gnoack@google.com>
+Fixes: e1199815b47b ("selftests/landlock: Add user space tests")
+Link: https://lore.kernel.org/r/20250108154338.1129069-21-mic@digikod.net
+Signed-off-by: Mickaël Salaün <mic@digikod.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/landlock/fs_test.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/landlock/fs_test.c b/tools/testing/selftests/landlock/fs_test.c
+index f2c3bffa6ea51..864309ebb0b4c 100644
+--- a/tools/testing/selftests/landlock/fs_test.c
++++ b/tools/testing/selftests/landlock/fs_test.c
+@@ -1775,8 +1775,7 @@ static void test_execute(struct __test_metadata *const _metadata, const int err,
+ ASSERT_EQ(1, WIFEXITED(status));
+ ASSERT_EQ(err ? 2 : 0, WEXITSTATUS(status))
+ {
+- TH_LOG("Unexpected return code for \"%s\": %s", path,
+- strerror(errno));
++ TH_LOG("Unexpected return code for \"%s\"", path);
+ };
+ }
+
+--
+2.39.5
+
--- /dev/null
+From c653e1678971678ff31e7f43d15453c3135e7efa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2024 22:43:47 +1100
+Subject: selftests/powerpc: Fix argument order to timer_sub()
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit 2bf66e66d2e6feece6175ec09ec590a0a8563bdd ]
+
+Commit c814bf958926 ("powerpc/selftests: Use timersub() for
+gettimeofday()"), got the order of arguments to timersub() wrong,
+leading to a negative time delta being reported, eg:
+
+ test: gettimeofday
+ tags: git_version:v6.12-rc5-409-gdddf291c3030
+ time = -3.297781
+ success: gettimeofday
+
+The correct order is minuend, subtrahend, which in this case is end,
+start. Which gives:
+
+ test: gettimeofday
+ tags: git_version:v6.12-rc5-409-gdddf291c3030-dirty
+ time = 3.300650
+ success: gettimeofday
+
+Fixes: c814bf958926 ("powerpc/selftests: Use timersub() for gettimeofday()")
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/20241218114347.428108-1-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/powerpc/benchmarks/gettimeofday.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/powerpc/benchmarks/gettimeofday.c b/tools/testing/selftests/powerpc/benchmarks/gettimeofday.c
+index 580fcac0a09f3..b71ef8a493ed1 100644
+--- a/tools/testing/selftests/powerpc/benchmarks/gettimeofday.c
++++ b/tools/testing/selftests/powerpc/benchmarks/gettimeofday.c
+@@ -20,7 +20,7 @@ static int test_gettimeofday(void)
+ gettimeofday(&tv_end, NULL);
+ }
+
+- timersub(&tv_start, &tv_end, &tv_diff);
++ timersub(&tv_end, &tv_start, &tv_diff);
+
+ printf("time = %.6f\n", tv_diff.tv_sec + (tv_diff.tv_usec) * 1e-6);
+
+--
+2.39.5
+
--- /dev/null
+From 83c4c0d9765428d87651d23cb734b88b71d99955 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2024 10:02:56 +0100
+Subject: selftests: timers: clocksource-switch: Adapt progress to kselftest
+ framework
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 8694e6a7f7dba23d3abd9f5a96f64d161704c7b1 ]
+
+When adapting the test to the kselftest framework, a few printf() calls
+indicating test progress were not updated.
+
+Fix this by replacing these printf() calls by ksft_print_msg() calls.
+
+Link: https://lore.kernel.org/r/7dd4b9ab6e43268846e250878ebf25ae6d3d01ce.1733994134.git.geert+renesas@glider.be
+Fixes: ce7d101750ff ("selftests: timers: clocksource-switch: adapt to kselftest framework")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/timers/clocksource-switch.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/timers/clocksource-switch.c b/tools/testing/selftests/timers/clocksource-switch.c
+index c5264594064c8..83faa4e354e38 100644
+--- a/tools/testing/selftests/timers/clocksource-switch.c
++++ b/tools/testing/selftests/timers/clocksource-switch.c
+@@ -156,8 +156,8 @@ int main(int argc, char **argv)
+ /* Check everything is sane before we start switching asynchronously */
+ if (do_sanity_check) {
+ for (i = 0; i < count; i++) {
+- printf("Validating clocksource %s\n",
+- clocksource_list[i]);
++ ksft_print_msg("Validating clocksource %s\n",
++ clocksource_list[i]);
+ if (change_clocksource(clocksource_list[i])) {
+ status = -1;
+ goto out;
+@@ -169,7 +169,7 @@ int main(int argc, char **argv)
+ }
+ }
+
+- printf("Running Asynchronous Switching Tests...\n");
++ ksft_print_msg("Running Asynchronous Switching Tests...\n");
+ pid = fork();
+ if (!pid)
+ return run_tests(runtime);
+--
+2.39.5
+
--- /dev/null
+From cce0113666701a652e32e47bdeee4a2892b82a37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2025 22:32:57 +0106
+Subject: serial: 8250: Adjust the timeout for FIFO mode
+
+From: John Ogness <john.ogness@linutronix.de>
+
+[ Upstream commit d91f98be26510f5f81ec66425bb0306d1ccd571a ]
+
+After a console has written a record into UART_TX, it uses
+wait_for_xmitr() to wait until the data has been sent out before
+returning. However, wait_for_xmitr() will timeout after 10ms,
+regardless if the data has been transmitted or not.
+
+For single bytes, this timeout is sufficient even at very slow
+baud rates, such as 1200bps. However, when FIFO mode is used,
+there may be 64 bytes pushed into the FIFO at once. At a baud
+rate of 115200bps, the 10ms timeout is still sufficient. But
+when using lower baud rates (such as 57600bps), the timeout
+is _not_ sufficient. This causes longer lines to be cut off,
+resulting in lost and horribly misformatted output on the
+console.
+
+When using FIFO mode, take the number of bytes into account to
+determine an appropriate maximum timeout. Increasing the timeout
+does not affect performance since ideally the timeout never
+occurs.
+
+Fixes: 8f3631f0f6eb ("serial/8250: Use fifo in 8250 console driver")
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Wander Lairson Costa <wander@redhat.com>
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Link: https://lore.kernel.org/r/20250107212702.169493-2-john.ogness@linutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_port.c | 32 +++++++++++++++++++++++------
+ 1 file changed, 26 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index c744feabd7cdd..fb1ea2f448910 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -2091,7 +2091,8 @@ static void serial8250_break_ctl(struct uart_port *port, int break_state)
+ serial8250_rpm_put(up);
+ }
+
+-static void wait_for_lsr(struct uart_8250_port *up, int bits)
++/* Returns true if @bits were set, false on timeout */
++static bool wait_for_lsr(struct uart_8250_port *up, int bits)
+ {
+ unsigned int status, tmout = 10000;
+
+@@ -2106,11 +2107,11 @@ static void wait_for_lsr(struct uart_8250_port *up, int bits)
+ udelay(1);
+ touch_nmi_watchdog();
+ }
++
++ return (tmout != 0);
+ }
+
+-/*
+- * Wait for transmitter & holding register to empty
+- */
++/* Wait for transmitter and holding register to empty with timeout */
+ static void wait_for_xmitr(struct uart_8250_port *up, int bits)
+ {
+ unsigned int tmout;
+@@ -3349,6 +3350,16 @@ static void serial8250_console_restore(struct uart_8250_port *up)
+ serial8250_out_MCR(up, up->mcr | UART_MCR_DTR | UART_MCR_RTS);
+ }
+
++static void fifo_wait_for_lsr(struct uart_8250_port *up, unsigned int count)
++{
++ unsigned int i;
++
++ for (i = 0; i < count; i++) {
++ if (wait_for_lsr(up, UART_LSR_THRE))
++ return;
++ }
++}
++
+ /*
+ * Print a string to the serial port using the device FIFO
+ *
+@@ -3358,13 +3369,15 @@ static void serial8250_console_restore(struct uart_8250_port *up)
+ static void serial8250_console_fifo_write(struct uart_8250_port *up,
+ const char *s, unsigned int count)
+ {
+- int i;
+ const char *end = s + count;
+ unsigned int fifosize = up->tx_loadsz;
++ unsigned int tx_count = 0;
+ bool cr_sent = false;
++ unsigned int i;
+
+ while (s != end) {
+- wait_for_lsr(up, UART_LSR_THRE);
++ /* Allow timeout for each byte of a possibly full FIFO */
++ fifo_wait_for_lsr(up, fifosize);
+
+ for (i = 0; i < fifosize && s != end; ++i) {
+ if (*s == '\n' && !cr_sent) {
+@@ -3375,7 +3388,14 @@ static void serial8250_console_fifo_write(struct uart_8250_port *up,
+ cr_sent = false;
+ }
+ }
++ tx_count = i;
+ }
++
++ /*
++ * Allow timeout for each byte written since the caller will only wait
++ * for UART_LSR_BOTH_EMPTY using the timeout of a single character
++ */
++ fifo_wait_for_lsr(up, tx_count);
+ }
+
+ /*
+--
+2.39.5
+
--- /dev/null
+powerpc-book3s64-hugetlb-fix-disabling-hugetlb-when-.patch
+afs-fix-eexist-error-returned-from-afs_rmdir-to-be-e.patch
+afs-fix-directory-format-encoding-struct.patch
+fs-fix-proc_handler-for-sysctl_nr_open.patch
+block-retry-call-probe-after-request_module-in-blk_r.patch
+nbd-don-t-allow-reconnect-after-disconnect.patch
+pstore-blk-trivial-typo-fixes.patch
+nvme-add-error-check-for-xa_store-in-nvme_get_effect.patch
+selftests-powerpc-fix-argument-order-to-timer_sub.patch
+partitions-ldm-remove-the-initial-kernel-doc-notatio.patch
+select-fix-unbalanced-user_access_end.patch
+afs-fix-the-fallback-handling-for-the-yfs.removefile.patch
+sched-psi-use-task-psi_flags-to-clear-in-cpu-migrati.patch
+sched-fair-fix-value-reported-by-hot-tasks-pulled-in.patch
+drm-msm-dp-set-safe_to_exit_level-before-printing-it.patch
+drm-etnaviv-fix-page-property-being-used-for-non-wri.patch
+drm-etnaviv-drop-the-second-argument-of-the-etnaviv_.patch
+drm-etnaviv-drop-the-len-parameter-of-etnaviv_iommu_.patch
+drm-etnaviv-record-gpu-visible-size-of-gem-bo-separa.patch
+drm-etnaviv-map-and-unmap-gpuva-range-with-respect-t.patch
+drm-etnaviv-drop-the-offset-in-page-manipulation.patch
+drm-amdgpu-fix-potential-null-pointer-dereference-in.patch
+drm-rockchip-vop2-fix-cluster-windows-alpha-ctrl-reg.patch
+drm-rockchip-vop2-fix-the-mixer-alpha-setup-for-laye.patch
+drm-rockchip-vop2-set-yuv-rgb-overlay-mode.patch
+drm-rockchip-vop2-set-bg-dly-and-prescan-dly-at-vop2.patch
+drm-rockchip-vop2-fix-the-windows-switch-between-dif.patch
+drm-rockchip-vop2-check-linear-format-for-cluster-wi.patch
+opp-rearrange-entries-in-pm_opp.h.patch
+opp-introduce-dev_pm_opp_find_freq_-ceil-floor-_inde.patch
+opp-introduce-dev_pm_opp_get_freq_indexed-api.patch
+opp-add-dev_pm_opp_find_freq_exact_indexed.patch
+opp-reuse-dev_pm_opp_get_freq_indexed.patch
+opp-add-index-check-to-assert-to-avoid-buffer-overfl.patch
+opp-fix-dev_pm_opp_find_bw_-when-bandwidth-table-not.patch
+drm-bridge-it6505-change-definition-of-aux_fifo_max_.patch
+genirq-make-handle_enforce_irqctx-unconditionally-av.patch
+ipmi-ipmb-add-check-devm_kasprintf-returned-value.patch
+wifi-ath11k-fix-unexpected-return-buffer-manager-err.patch
+wifi-rtlwifi-do-not-complete-firmware-loading-needle.patch
+wifi-rtlwifi-rtl8192se-rise-completion-of-firmware-l.patch
+wifi-rtlwifi-wait-for-firmware-loading-before-releas.patch
+wifi-rtlwifi-fix-init_sw_vars-leak-when-probe-fails.patch
+wifi-rtlwifi-usb-fix-workqueue-leak-when-probe-fails.patch
+wifi-wcn36xx-fix-channel-survey-memory-allocation-si.patch
+net_sched-sch_sfq-annotate-data-races-around-q-pertu.patch
+net_sched-sch_sfq-handle-bigger-packets.patch
+net_sched-sch_sfq-don-t-allow-1-packet-limit.patch
+spi-zynq-qspi-add-check-for-clk_enable.patch
+dt-bindings-mmc-controller-clarify-the-address-cells.patch
+dt-bindings-leds-class-multicolor-fix-path-to-color-.patch
+wifi-rtlwifi-remove-unused-timer-and-related-code.patch
+wifi-rtlwifi-remove-unused-dualmac-control-leftovers.patch
+wifi-rtlwifi-remove-unused-check_buddy_priv.patch
+wifi-rtlwifi-destroy-workqueue-at-rtl_deinit_core.patch
+wifi-rtlwifi-fix-memory-leaks-and-invalid-access-at-.patch
+wifi-rtlwifi-pci-wait-for-firmware-loading-before-re.patch
+hid-multitouch-fix-support-for-goodix-pid-0x01e9.patch
+regulator-dt-bindings-mt6315-drop-regulator-compatib.patch
+acpi-fan-cleanup-resources-in-the-error-path-of-.pro.patch
+cpupower-fix-tsc-mhz-calculation.patch
+dt-bindings-mfd-bd71815-fix-rsense-and-typos.patch
+leds-netxbig-fix-an-of-node-reference-leak-in-netxbi.patch
+inetpeer-remove-create-argument-of-inet_getpeer_v-46.patch
+inetpeer-remove-create-argument-of-inet_getpeer.patch
+inetpeer-update-inetpeer-timestamp-in-inet_getpeer.patch
+inetpeer-do-not-get-a-refcount-in-inet_getpeer.patch
+pwm-stm32-lp-add-check-for-clk_enable.patch
+cpufreq-schedutil-fix-superfluous-updates-caused-by-.patch
+udp-deal-with-race-between-udp-socket-address-change.patch
+clk-imx8mp-fix-clkout1-2-support.patch
+team-prevent-adding-a-device-which-is-already-a-team.patch
+regulator-of-implement-the-unwind-path-of-of_regulat.patch
+ax25-rcu-protect-dev-ax25_ptr.patch
+opp-of-fix-an-of-node-leak-in-_opp_add_static_v2.patch
+clk-qcom-gcc-sdm845-do-not-use-shared-clk_ops-for-qu.patch
+hid-hid-thrustmaster-fix-warning-in-thrustmaster_pro.patch
+mfd-syscon-remove-extern-from-function-prototypes.patch
+mfd-syscon-add-of_syscon_register_regmap-api.patch
+mfd-syscon-use-scoped-variables-with-memory-allocato.patch
+mfd-syscon-fix-race-in-device_node_get_regmap.patch
+samples-landlock-fix-possible-null-dereference-in-pa.patch
+wifi-wlcore-fix-unbalanced-pm_runtime-calls.patch
+wifi-mac80211-prohibit-deactivating-all-links.patch
+wifi-mac80211-fix-common-size-calculation-for-ml-ele.patch
+net-smc-fix-data-error-when-recvmsg-with-msg_peek-fl.patch
+landlock-handle-weird-files.patch
+wifi-mt76-mt76u_vendor_request-do-not-print-error-me.patch
+wifi-mt76-connac-introduce-unified-event-table.patch
+wifi-mt76-connac-add-more-bss-info-command-tags.patch
+wifi-mt76-introduce-rxwi-and-rx-token-utility-routin.patch
+wifi-mt76-add-wed-rx-support-to-mt76_dma_-add-get-_b.patch
+wifi-mt76-mt7921-fix-using-incorrect-group-cipher-af.patch
+wifi-mt76-mt7915-fix-register-mapping.patch
+cpufreq-acpi-fix-max-frequency-computation.patch
+selftests-timers-clocksource-switch-adapt-progress-t.patch
+selftests-harness-fix-printing-of-mismatch-values-in.patch
+wifi-cfg80211-handle-specific-bssid-in-6ghz-scanning.patch
+wifi-cfg80211-adjust-allocation-of-colocated-ap-data.patch
+clk-analogbits-fix-incorrect-calculation-of-vco-rate.patch
+pwm-stm32-add-check-for-clk_enable.patch
+selftests-landlock-fix-error-message.patch
+net-let-net.core.dev_weight-always-be-non-zero.patch
+net-mlxfw-drop-hard-coded-max-fw-flash-image-size.patch
+net-avoid-race-between-device-unregistration-and-eth.patch
+net-sched-disallow-replacing-of-child-qdisc-from-one.patch
+netfilter-nft_flow_offload-update-tcp-state-flags-un.patch
+net-ethernet-ti-am65-cpsw-fix-freeing-irq-in-am65_cp.patch
+tcp_cubic-fix-incorrect-hystart-round-start-detectio.patch
+net-rose-prevent-integer-overflows-in-rose_setsockop.patch
+libbpf-don-t-adjust-usdt-semaphore-address-if-.staps.patch
+tools-testing-selftests-bpf-test_tc_tunnel.sh-fix-wa.patch
+libbpf-fix-segfault-due-to-libelf-functions-not-sett.patch
+asoc-sun4i-spdif-add-clock-multiplier-settings.patch
+perf-header-fix-one-memory-leakage-in-process_bpf_bt.patch
+perf-header-fix-one-memory-leakage-in-process_bpf_pr.patch
+perf-bpf-fix-two-memory-leakages-when-calling-perf_e.patch
+asoc-renesas-rz-ssi-use-only-the-proper-amount-of-di.patch
+ktest.pl-remove-unused-declarations-in-run_bisect_te.patch
+crypto-hisilicon-sec2-optimize-the-error-return-proc.patch
+crypto-hisilicon-sec2-fix-for-aead-icv-error.patch
+crypto-hisilicon-sec2-fix-for-aead-invalid-authsize.patch
+crypto-ixp4xx-fix-of-node-reference-leaks-in-init_ix.patch
+padata-fix-sysfs-store-callback-check.patch
+perf-top-don-t-complain-about-lack-of-vmlinux-when-n.patch
+perf-machine-include-data-symbols-in-the-kernel-map.patch
+perf-machine-don-t-ignore-_etext-when-not-a-text-sym.patch
+perf-namespaces-introduce-nsinfo__set_in_pidns.patch
+perf-namespaces-fixup-the-nsinfo__in_pidns-return-ty.patch
+asoc-intel-avs-fix-theoretical-infinite-loop.patch
+perf-report-fix-misleading-help-message-about-demang.patch
+pinctrl-stm32-set-default-gpio-line-names-using-pin-.patch
+pinctrl-stm32-add-check-for-devm_kcalloc.patch
+pinctrl-stm32-check-devm_kasprintf-returned-value.patch
+pinctrl-stm32-add-check-for-clk_enable.patch
+bpf-send-signals-asynchronously-if-preemptible.patch
+bpf-tcp-mark-bpf_load_hdr_opt-arg2-as-read-write.patch
+alsa-hda-realtek-fixed-headphone-distorted-sound-on-.patch
+padata-fix-uaf-in-padata_reorder.patch
+padata-add-pd-get-put-refcnt-helper.patch
+padata-avoid-uaf-for-reorder_work.patch
+smb-client-fix-oops-due-to-unset-link-speed.patch
+soc-atmel-fix-device_node-release-in-atmel_soc_devic.patch
+arm-at91-pm-change-bu-power-switch-to-automatic-mode.patch
+arm64-dts-mt8183-set-dmic-one-wire-mode-on-damu.patch
+arm64-dts-mediatek-mt8516-fix-gicv2-range.patch
+arm64-dts-mediatek-mt8516-fix-wdt-irq-type.patch
+arm64-dts-mediatek-mt8516-add-i2c-clock-div-property.patch
+arm64-dts-mediatek-mt8516-reserve-192-kib-for-tf-a.patch
+rdma-mlx4-avoid-false-error-about-access-to-uninitia.patch
+rdma-cxgb4-prevent-potential-integer-overflow-on-32b.patch
+arm64-dts-mediatek-mt8173-evb-drop-regulator-compati.patch
+arm64-dts-mediatek-mt8173-elm-drop-regulator-compati.patch
+arm64-dts-mediatek-mt8192-asurada-drop-regulator-com.patch
+arm64-dts-mediatek-mt8195-cherry-drop-regulator-comp.patch
+arm64-dts-mediatek-mt8195-demo-drop-regulator-compat.patch
+arm64-dts-mediatek-mt8173-elm-fix-mt6397-pmic-sub-no.patch
+arm64-dts-mediatek-mt8173-evb-fix-mt6397-pmic-sub-no.patch
+arm64-dts-mediatek-mt8183-kenzo-support-second-sourc.patch
+arm64-dts-mediatek-mt8183-willow-support-second-sour.patch
+rdma-srp-fix-error-handling-in-srp_add_port.patch
+memory-tegra20-emc-fix-an-of-node-reference-bug-in-t.patch
+arm64-dts-mediatek-mt8183-kukui-jacuzzi-drop-pp3300_.patch
+arm64-dts-qcom-msm8996-xiaomi-gemini-fix-lp5562-led1.patch
+arm64-dts-qcom-msm8996-fix-up-usb3-interrupts.patch
+arm64-dts-qcom-msm8994-describe-usb-interrupts.patch
+arm64-dts-qcom-sm7225-fairphone-fp4-drop-extra-qcom-.patch
+arm64-dts-qcom-msm8916-correct-sleep-clock-frequency.patch
+arm64-dts-qcom-msm8994-correct-sleep-clock-frequency.patch
+arm64-dts-qcom-sc7280-correct-sleep-clock-frequency.patch
+arm64-dts-qcom-sm6125-correct-sleep-clock-frequency.patch
+arm64-dts-qcom-sm8250-correct-sleep-clock-frequency.patch
+arm64-dts-qcom-sm8350-correct-sleep-clock-frequency.patch
+arm64-dts-qcom-sm8450-correct-sleep-clock-frequency.patch
+arm64-dts-ti-k3-am62-remove-duplicate-gicr-reg.patch
+arm64-dts-ti-k3-am62a-remove-duplicate-gicr-reg.patch
+rdma-hns-add-debugfs-to-hns-roce.patch
+rdma-hns-clean-up-the-legacy-config_infiniband_hns.patch
+arm64-dts-qcom-sc7180-add-compat-qcom-sc7180-dsi-ctr.patch
+arm64-dts-qcom-sc7180-idp-use-just-port-in-panel.patch
+arm64-dts-qcom-sc7180-trogdor-quackingstick-use-just.patch
+arm64-dts-qcom-sc7180-trogdor-wormdingler-use-just-p.patch
+arm64-dts-qcom-sc7180-don-t-enable-lpass-clocks-by-d.patch
+arm64-dts-qcom-sc7180-drop-redundant-disable-in-mdp.patch
+arm64-dts-qcom-sc7180-trogdor-quackingstick-add-miss.patch
+arm64-dts-qcom-pm6150l-add-temp-sensor-and-thermal-z.patch
+arm64-dts-qcom-sc7180-remove-thermal-zone-polling-de.patch
+arm64-dts-qcom-sc7180-trogdor-pompom-rename-5v-choke.patch
+arm64-dts-qcom-sm8150-microsoft-surface-duo-fix-typo.patch
+arm64-dts-qcom-sc8280xp-fix-up-remoteproc-register-s.patch
+dts-arm64-mediatek-mt8195-remove-mt8183-compatible-f.patch
+arm64-dts-qcom-sdm845-fix-interrupt-types-of-camss-i.patch
+arm64-dts-qcom-sm8250-fix-interrupt-types-of-camss-i.patch
+arm-dts-mediatek-mt7623-fix-ir-nodename.patch
+fbdev-omapfb-fix-an-of-node-leak-in-dss_of_port_get_.patch
+rdma-mlx5-fix-indirect-mkey-odp-page-count.patch
+of-reserved-memory-do-not-make-kmemleak-ignore-freed.patch
+efi-sysfb_efi-fix-w-1-warnings-when-efi-is-not-set.patch
+rdma-rxe-fix-the-warning-__rxe_cleanup-0x12c-0x170-r.patch
+iommufd-iova_bitmap-fix-shift-out-of-bounds-in-iova_.patch
+media-rc-iguanair-handle-timeouts.patch
+media-lmedm04-handle-errors-for-lme2510_int_read.patch
+pci-endpoint-destroy-the-epc-device-in-devm_pci_epc_.patch
+media-marvell-add-check-for-clk_enable.patch
+media-i2c-imx412-add-missing-newline-to-prints.patch
+media-i2c-ov9282-correct-the-exposure-offset.patch
+media-mipi-csis-add-check-for-clk_enable.patch
+media-camif-core-add-check-for-clk_enable.patch
+media-uvcvideo-propagate-buf-error-to-userspace.patch
+mtd-hyperbus-hbmc-am654-convert-to-platform-remove-c.patch
+mtd-hyperbus-hbmc-am654-fix-an-of-node-reference-lea.patch
+staging-media-imx-fix-of-node-leak-in-imx_media_add_.patch
+pci-rcar-ep-fix-incorrect-variable-used-when-calling.patch
+pci-endpoint-pci-epf-test-set-dma_chan_rx-pointer-to.patch
+pci-epf-test-simplify-dma-support-checks.patch
+pci-endpoint-pci-epf-test-fix-check-for-dma-memcpy-t.patch
+scsi-mpt3sas-set-ioc-manu_pg11.eedptagmode-directly-.patch
+scsi-ufs-bsg-delete-bsg_dev-when-setting-up-bsg-fail.patch
+ocfs2-mark-dquot-as-inactive-if-failed-to-start-tran.patch
+module-extend-the-preempt-disabled-section-in-derefe.patch
+serial-8250-adjust-the-timeout-for-fifo-mode.patch
+nfsv4.2-fix-copy_notify-xdr-buf-size-calculation.patch
+nfsv4.2-mark-offload_cancel-moveable.patch
+tools-bootconfig-fix-the-wrong-format-specifier.patch
+xfrm-replay-fix-the-update-of-replay_esn-oseq_hi-for.patch
+dmaengine-ti-edma-fix-of-node-reference-leaks-in-edm.patch
+rtc-pcf85063-fix-potential-oob-write-in-pcf85063-nvm.patch
+ubifs-skip-dumping-tnc-tree-when-zroot-is-null.patch
+regulator-core-add-missing-newline-character.patch
+net-hns3-fix-oops-when-unload-drivers-paralleling.patch
+gpio-mxc-remove-dead-code-after-switch-to-dt-only.patch
+net-fec-implement-tso-descriptor-cleanup.patch
+ipmr-do-not-call-mr_mfc_uses_dev-for-unres-entries.patch
+pm-hibernate-add-error-handling-for-syscore_suspend.patch
+iavf-allow-changing-vlan-state-without-calling-pf.patch
+net-rose-fix-timer-races-against-user-threads.patch
+net-netdevsim-try-to-close-udp-port-harness-races.patch
+vxlan-fix-uninit-value-in-vxlan_vnifilter_dump.patch
+net-davicom-fix-uaf-in-dm9000_drv_remove.patch
+perf-trace-fix-runtime-error-of-index-out-of-bounds.patch
+pm-sleep-restore-asynchronous-device-resume-optimiza.patch
+pm-sleep-use-bool-for-all-1-bit-fields-in-struct-dev.patch
+pm-sleep-core-synchronize-runtime-pm-status-of-paren.patch
+vsock-support-sockmap.patch
+bpf-vsock-invoke-proto-close-on-close.patch
+vsock-keep-the-binding-until-socket-destruction.patch
+vsock-allow-retrying-on-connect-failure.patch
+bgmac-reduce-max-frame-size-to-support-just-mtu-1500.patch
+net-sh_eth-fix-missing-rtnl-lock-in-suspend-resume-p.patch
+net-hsr-fix-fill_frame_info-regression-vs-vlan-packe.patch
--- /dev/null
+From f69661a9912080ecb0567be34ddb07f257dde6d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2025 14:29:03 -0300
+Subject: smb: client: fix oops due to unset link speed
+
+From: Paulo Alcantara <pc@manguebit.com>
+
+[ Upstream commit be7a6a77669588bfa5022a470989702bbbb11e7f ]
+
+It isn't guaranteed that NETWORK_INTERFACE_INFO::LinkSpeed will always
+be set by the server, so the client must handle any values and then
+prevent oopses like below from happening:
+
+Oops: divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI
+CPU: 0 UID: 0 PID: 1323 Comm: cat Not tainted 6.13.0-rc7 #2
+Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41
+04/01/2014
+RIP: 0010:cifs_debug_data_proc_show+0xa45/0x1460 [cifs] Code: 00 00 48
+89 df e8 3b cd 1b c1 41 f6 44 24 2c 04 0f 84 50 01 00 00 48 89 ef e8
+e7 d0 1b c1 49 8b 44 24 18 31 d2 49 8d 7c 24 28 <48> f7 74 24 18 48 89
+c3 e8 6e cf 1b c1 41 8b 6c 24 28 49 8d 7c 24
+RSP: 0018:ffffc90001817be0 EFLAGS: 00010246
+RAX: 0000000000000000 RBX: ffff88811230022c RCX: ffffffffc041bd99
+RDX: 0000000000000000 RSI: 0000000000000567 RDI: ffff888112300228
+RBP: ffff888112300218 R08: fffff52000302f5f R09: ffffed1022fa58ac
+R10: ffff888117d2c566 R11: 00000000fffffffe R12: ffff888112300200
+R13: 000000012a15343f R14: 0000000000000001 R15: ffff888113f2db58
+FS: 00007fe27119e740(0000) GS:ffff888148600000(0000)
+knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007fe2633c5000 CR3: 0000000124da0000 CR4: 0000000000750ef0
+PKRU: 55555554
+Call Trace:
+ <TASK>
+ ? __die_body.cold+0x19/0x27
+ ? die+0x2e/0x50
+ ? do_trap+0x159/0x1b0
+ ? cifs_debug_data_proc_show+0xa45/0x1460 [cifs]
+ ? do_error_trap+0x90/0x130
+ ? cifs_debug_data_proc_show+0xa45/0x1460 [cifs]
+ ? exc_divide_error+0x39/0x50
+ ? cifs_debug_data_proc_show+0xa45/0x1460 [cifs]
+ ? asm_exc_divide_error+0x1a/0x20
+ ? cifs_debug_data_proc_show+0xa39/0x1460 [cifs]
+ ? cifs_debug_data_proc_show+0xa45/0x1460 [cifs]
+ ? seq_read_iter+0x42e/0x790
+ seq_read_iter+0x19a/0x790
+ proc_reg_read_iter+0xbe/0x110
+ ? __pfx_proc_reg_read_iter+0x10/0x10
+ vfs_read+0x469/0x570
+ ? do_user_addr_fault+0x398/0x760
+ ? __pfx_vfs_read+0x10/0x10
+ ? find_held_lock+0x8a/0xa0
+ ? __pfx_lock_release+0x10/0x10
+ ksys_read+0xd3/0x170
+ ? __pfx_ksys_read+0x10/0x10
+ ? __rcu_read_unlock+0x50/0x270
+ ? mark_held_locks+0x1a/0x90
+ do_syscall_64+0xbb/0x1d0
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+RIP: 0033:0x7fe271288911
+Code: 00 48 8b 15 01 25 10 00 f7 d8 64 89 02 b8 ff ff ff ff eb bd e8
+20 ad 01 00 f3 0f 1e fa 80 3d b5 a7 10 00 00 74 13 31 c0 0f 05 <48> 3d
+00 f0 ff ff 77 4f c3 66 0f 1f 44 00 00 55 48 89 e5 48 83 ec
+RSP: 002b:00007ffe87c079d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
+RAX: ffffffffffffffda RBX: 0000000000040000 RCX: 00007fe271288911
+RDX: 0000000000040000 RSI: 00007fe2633c6000 RDI: 0000000000000003
+RBP: 00007ffe87c07a00 R08: 0000000000000000 R09: 00007fe2713e6380
+R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000040000
+R13: 00007fe2633c6000 R14: 0000000000000003 R15: 0000000000000000
+ </TASK>
+
+Fix this by setting cifs_server_iface::speed to a sane value (1Gbps)
+by default when link speed is unset.
+
+Cc: Shyam Prasad N <nspmangalore@gmail.com>
+Cc: Tom Talpey <tom@talpey.com>
+Fixes: a6d8fb54a515 ("cifs: distribute channels across interfaces based on speed")
+Reported-by: Frank Sorenson <sorenson@redhat.com>
+Reported-by: Jay Shin <jaeshin@redhat.com>
+Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2ops.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
+index 4b9cd9893ac61..e368b10a9034d 100644
+--- a/fs/smb/client/smb2ops.c
++++ b/fs/smb/client/smb2ops.c
+@@ -615,7 +615,8 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
+
+ while (bytes_left >= (ssize_t)sizeof(*p)) {
+ memset(&tmp_iface, 0, sizeof(tmp_iface));
+- tmp_iface.speed = le64_to_cpu(p->LinkSpeed);
++ /* default to 1Gbps when link speed is unset */
++ tmp_iface.speed = le64_to_cpu(p->LinkSpeed) ?: 1000000000;
+ tmp_iface.rdma_capable = le32_to_cpu(p->Capability & RDMA_CAPABLE) ? 1 : 0;
+ tmp_iface.rss_capable = le32_to_cpu(p->Capability & RSS_CAPABLE) ? 1 : 0;
+
+--
+2.39.5
+
--- /dev/null
+From 568df357c67bd1932bd2328e9c14b07e40eed801 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2024 13:33:36 +0100
+Subject: soc: atmel: fix device_node release in atmel_soc_device_init()
+
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+
+[ Upstream commit d3455ab798100f40af77123e7c2443ec979c546b ]
+
+A device_node acquired via of_find_node_by_path() requires explicit
+calls to of_node_put() when it is no longer needed to avoid leaking the
+resource.
+
+Instead of adding the missing calls to of_node_put() in all execution
+paths, use the cleanup attribute for 'np' by means of the __free()
+macro, which automatically calls of_node_put() when the variable goes
+out of scope.
+
+Fixes: 960ddf70cc11 ("drivers: soc: atmel: Avoid calling at91_soc_init on non AT91 SoCs")
+Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Link: https://lore.kernel.org/r/20241031-soc-atmel-soc-cleanup-v2-1-73f2d235fd98@gmail.com
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/atmel/soc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/atmel/soc.c b/drivers/soc/atmel/soc.c
+index dae8a2e0f7455..78cb2c4bd3929 100644
+--- a/drivers/soc/atmel/soc.c
++++ b/drivers/soc/atmel/soc.c
+@@ -367,7 +367,7 @@ static const struct of_device_id at91_soc_allowed_list[] __initconst = {
+
+ static int __init atmel_soc_device_init(void)
+ {
+- struct device_node *np = of_find_node_by_path("/");
++ struct device_node *np __free(device_node) = of_find_node_by_path("/");
+
+ if (!of_match_node(at91_soc_allowed_list, np))
+ return 0;
+--
+2.39.5
+
--- /dev/null
+From fe344e6b5b2c20fcd7616728a3a83c8bd017f9c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2024 20:52:06 -0500
+Subject: spi: zynq-qspi: Add check for clk_enable()
+
+From: Mingwei Zheng <zmw12306@gmail.com>
+
+[ Upstream commit 8332e667099712e05ec87ba2058af394b51ebdc9 ]
+
+Add check for the return value of clk_enable() to catch the potential
+error.
+
+Fixes: c618a90dcaf3 ("spi: zynq-qspi: Drop GPIO header")
+Signed-off-by: Mingwei Zheng <zmw12306@gmail.com>
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Link: https://patch.msgid.link/20241207015206.3689364-1-zmw12306@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-zynq-qspi.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-zynq-qspi.c b/drivers/spi/spi-zynq-qspi.c
+index 78f31b61a2aac..77ea6b5223483 100644
+--- a/drivers/spi/spi-zynq-qspi.c
++++ b/drivers/spi/spi-zynq-qspi.c
+@@ -379,12 +379,21 @@ static int zynq_qspi_setup_op(struct spi_device *spi)
+ {
+ struct spi_controller *ctlr = spi->master;
+ struct zynq_qspi *qspi = spi_controller_get_devdata(ctlr);
++ int ret;
+
+ if (ctlr->busy)
+ return -EBUSY;
+
+- clk_enable(qspi->refclk);
+- clk_enable(qspi->pclk);
++ ret = clk_enable(qspi->refclk);
++ if (ret)
++ return ret;
++
++ ret = clk_enable(qspi->pclk);
++ if (ret) {
++ clk_disable(qspi->refclk);
++ return ret;
++ }
++
+ zynq_qspi_write(qspi, ZYNQ_QSPI_ENABLE_OFFSET,
+ ZYNQ_QSPI_ENABLE_ENABLE_MASK);
+
+--
+2.39.5
+
--- /dev/null
+From 64250ece35528abeedef340052fe818aa153b60b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Dec 2024 12:54:11 +0900
+Subject: staging: media: imx: fix OF node leak in imx_media_add_of_subdevs()
+
+From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+
+[ Upstream commit 094f5c315f756b19198e6c401aa821ac0e868750 ]
+
+imx_media_add_of_subdevs() calls of_parse_phandle() and passes the
+obtained node to imx_media_of_add_csi(). The passed node is used in
+v4l2_async_nf_add_fwnode(), which increments the refcount of the node.
+Therefore, while the current implementation only releases the node when
+imx_media_of_add_csi() fails, but should always release it. Call
+of_node_put() right after imx_media_of_add_csi().
+
+Fixes: dee747f88167 ("media: imx: Don't register IPU subdevs/links if CSI port missing")
+Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/imx/imx-media-of.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/staging/media/imx/imx-media-of.c b/drivers/staging/media/imx/imx-media-of.c
+index 59f1eb7b62bcd..3771bc410dff7 100644
+--- a/drivers/staging/media/imx/imx-media-of.c
++++ b/drivers/staging/media/imx/imx-media-of.c
+@@ -55,22 +55,18 @@ int imx_media_add_of_subdevs(struct imx_media_dev *imxmd,
+ break;
+
+ ret = imx_media_of_add_csi(imxmd, csi_np);
++ of_node_put(csi_np);
+ if (ret) {
+ /* unavailable or already added is not an error */
+ if (ret == -ENODEV || ret == -EEXIST) {
+- of_node_put(csi_np);
+ continue;
+ }
+
+ /* other error, can't continue */
+- goto err_out;
++ return ret;
+ }
+ }
+
+ return 0;
+-
+-err_out:
+- of_node_put(csi_np);
+- return ret;
+ }
+ EXPORT_SYMBOL_GPL(imx_media_add_of_subdevs);
+--
+2.39.5
+
--- /dev/null
+From 72d5f89df9ae47eb9fe94642e8293565862f3ce8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jan 2025 21:37:51 +0000
+Subject: tcp_cubic: fix incorrect HyStart round start detection
+
+From: Mahdi Arghavani <ma.arghavani@yahoo.com>
+
+[ Upstream commit 25c1a9ca53db5780757e7f53e688b8f916821baa ]
+
+I noticed that HyStart incorrectly marks the start of rounds,
+leading to inaccurate measurements of ACK train lengths and
+resetting the `ca->sample_cnt` variable. This inaccuracy can impact
+HyStart's functionality in terminating exponential cwnd growth during
+Slow-Start, potentially degrading TCP performance.
+
+The issue arises because the changes introduced in commit 4e1fddc98d25
+("tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited flows")
+moved the caller of the `bictcp_hystart_reset` function inside the `hystart_update` function.
+This modification added an additional condition for triggering the caller,
+requiring that (tcp_snd_cwnd(tp) >= hystart_low_window) must also
+be satisfied before invoking `bictcp_hystart_reset`.
+
+This fix ensures that `bictcp_hystart_reset` is correctly called
+at the start of a new round, regardless of the congestion window size.
+This is achieved by moving the condition
+(tcp_snd_cwnd(tp) >= hystart_low_window)
+from before calling `bictcp_hystart_reset` to after it.
+
+I tested with a client and a server connected through two Linux software routers.
+In this setup, the minimum RTT was 150 ms, the bottleneck bandwidth was 50 Mbps,
+and the bottleneck buffer size was 1 BDP, calculated as (50M / 1514 / 8) * 0.150 = 619 packets.
+I conducted the test twice, transferring data from the server to the client for 1.5 seconds.
+Before the patch was applied, HYSTART-DELAY stopped the exponential growth of cwnd when
+cwnd = 516, and the bottleneck link was not yet saturated (516 < 619).
+After the patch was applied, HYSTART-ACK-TRAIN stopped the exponential growth of cwnd when
+cwnd = 632, and the bottleneck link was saturated (632 > 619).
+In this test, applying the patch resulted in 300 KB more data delivered.
+
+Fixes: 4e1fddc98d25 ("tcp_cubic: fix spurious Hystart ACK train detections for not-cwnd-limited flows")
+Signed-off-by: Mahdi Arghavani <ma.arghavani@yahoo.com>
+Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
+Cc: Neal Cardwell <ncardwell@google.com>
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: Haibo Zhang <haibo.zhang@otago.ac.nz>
+Cc: David Eyers <david.eyers@otago.ac.nz>
+Cc: Abbas Arghavani <abbas.arghavani@mdu.se>
+Reviewed-by: Neal Cardwell <ncardwell@google.com>
+Tested-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_cubic.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
+index 768c10c1f6498..b7c140874d97e 100644
+--- a/net/ipv4/tcp_cubic.c
++++ b/net/ipv4/tcp_cubic.c
+@@ -392,6 +392,10 @@ static void hystart_update(struct sock *sk, u32 delay)
+ if (after(tp->snd_una, ca->end_seq))
+ bictcp_hystart_reset(sk);
+
++ /* hystart triggers when cwnd is larger than some threshold */
++ if (tcp_snd_cwnd(tp) < hystart_low_window)
++ return;
++
+ if (hystart_detect & HYSTART_ACK_TRAIN) {
+ u32 now = bictcp_clock_us(sk);
+
+@@ -467,9 +471,7 @@ static void cubictcp_acked(struct sock *sk, const struct ack_sample *sample)
+ if (ca->delay_min == 0 || ca->delay_min > delay)
+ ca->delay_min = delay;
+
+- /* hystart triggers when cwnd is larger than some threshold */
+- if (!ca->found && tcp_in_slow_start(tp) && hystart &&
+- tcp_snd_cwnd(tp) >= hystart_low_window)
++ if (!ca->found && tcp_in_slow_start(tp) && hystart)
+ hystart_update(sk, delay);
+ }
+
+--
+2.39.5
+
--- /dev/null
+From ce96f8e3efd1a40f78cfc6d26f3be081a1228d45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Dec 2024 12:56:47 -0800
+Subject: team: prevent adding a device which is already a team device lower
+
+From: Octavian Purdila <tavip@google.com>
+
+[ Upstream commit 3fff5da4ca2164bb4d0f1e6cd33f6eb8a0e73e50 ]
+
+Prevent adding a device which is already a team device lower,
+e.g. adding veth0 if vlan1 was already added and veth0 is a lower of
+vlan1.
+
+This is not useful in practice and can lead to recursive locking:
+
+$ ip link add veth0 type veth peer name veth1
+$ ip link set veth0 up
+$ ip link set veth1 up
+$ ip link add link veth0 name veth0.1 type vlan protocol 802.1Q id 1
+$ ip link add team0 type team
+$ ip link set veth0.1 down
+$ ip link set veth0.1 master team0
+team0: Port device veth0.1 added
+$ ip link set veth0 down
+$ ip link set veth0 master team0
+
+============================================
+WARNING: possible recursive locking detected
+6.13.0-rc2-virtme-00441-ga14a429069bb #46 Not tainted
+--------------------------------------------
+ip/7684 is trying to acquire lock:
+ffff888016848e00 (team->team_lock_key){+.+.}-{4:4}, at: team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)
+
+but task is already holding lock:
+ffff888016848e00 (team->team_lock_key){+.+.}-{4:4}, at: team_add_slave (drivers/net/team/team_core.c:1147 drivers/net/team/team_core.c:1977)
+
+other info that might help us debug this:
+Possible unsafe locking scenario:
+
+CPU0
+----
+lock(team->team_lock_key);
+lock(team->team_lock_key);
+
+*** DEADLOCK ***
+
+May be due to missing lock nesting notation
+
+2 locks held by ip/7684:
+
+stack backtrace:
+CPU: 3 UID: 0 PID: 7684 Comm: ip Not tainted 6.13.0-rc2-virtme-00441-ga14a429069bb #46
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
+Call Trace:
+<TASK>
+dump_stack_lvl (lib/dump_stack.c:122)
+print_deadlock_bug.cold (kernel/locking/lockdep.c:3040)
+__lock_acquire (kernel/locking/lockdep.c:3893 kernel/locking/lockdep.c:5226)
+? netlink_broadcast_filtered (net/netlink/af_netlink.c:1548)
+lock_acquire.part.0 (kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5851)
+? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)
+? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 2))
+? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)
+? lock_acquire (kernel/locking/lockdep.c:5822)
+? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)
+__mutex_lock (kernel/locking/mutex.c:587 kernel/locking/mutex.c:735)
+? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)
+? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)
+? fib_sync_up (net/ipv4/fib_semantics.c:2167)
+? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)
+team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)
+notifier_call_chain (kernel/notifier.c:85)
+call_netdevice_notifiers_info (net/core/dev.c:1996)
+__dev_notify_flags (net/core/dev.c:8993)
+? __dev_change_flags (net/core/dev.c:8975)
+dev_change_flags (net/core/dev.c:9027)
+vlan_device_event (net/8021q/vlan.c:85 net/8021q/vlan.c:470)
+? br_device_event (net/bridge/br.c:143)
+notifier_call_chain (kernel/notifier.c:85)
+call_netdevice_notifiers_info (net/core/dev.c:1996)
+dev_open (net/core/dev.c:1519 net/core/dev.c:1505)
+team_add_slave (drivers/net/team/team_core.c:1219 drivers/net/team/team_core.c:1977)
+? __pfx_team_add_slave (drivers/net/team/team_core.c:1972)
+do_set_master (net/core/rtnetlink.c:2917)
+do_setlink.isra.0 (net/core/rtnetlink.c:3117)
+
+Reported-by: syzbot+3c47b5843403a45aef57@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=3c47b5843403a45aef57
+Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device")
+Signed-off-by: Octavian Purdila <tavip@google.com>
+Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/team/team.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index 872640a9e73a1..b23aa3c8bdf8e 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -1171,6 +1171,13 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
+ return -EBUSY;
+ }
+
++ if (netdev_has_upper_dev(port_dev, dev)) {
++ NL_SET_ERR_MSG(extack, "Device is already a lower device of the team interface");
++ netdev_err(dev, "Device %s is already a lower device of the team interface\n",
++ portname);
++ return -EBUSY;
++ }
++
+ if (port_dev->features & NETIF_F_VLAN_CHALLENGED &&
+ vlan_uses_dev(dev)) {
+ NL_SET_ERR_MSG(extack, "Device is VLAN challenged and team device has VLAN set up");
+--
+2.39.5
+
--- /dev/null
+From 613a5f99bf2540151e6346a38f4b2ea778951592 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2025 23:27:01 +0900
+Subject: tools/bootconfig: Fix the wrong format specifier
+
+From: Luo Yifan <luoyifan@cmss.chinamobile.com>
+
+[ Upstream commit f6ab7384d554ba80ff4793259d75535874b366f5 ]
+
+Use '%u' instead of '%d' for unsigned int.
+
+Link: https://lore.kernel.org/all/20241105011048.201629-1-luoyifan@cmss.chinamobile.com/
+
+Fixes: 973780011106 ("tools/bootconfig: Suppress non-error messages")
+Signed-off-by: Luo Yifan <luoyifan@cmss.chinamobile.com>
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bootconfig/main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/bootconfig/main.c b/tools/bootconfig/main.c
+index 156b62a163c5a..8a48cc2536f56 100644
+--- a/tools/bootconfig/main.c
++++ b/tools/bootconfig/main.c
+@@ -226,7 +226,7 @@ static int load_xbc_from_initrd(int fd, char **buf)
+ /* Wrong Checksum */
+ rcsum = xbc_calc_checksum(*buf, size);
+ if (csum != rcsum) {
+- pr_err("checksum error: %d != %d\n", csum, rcsum);
++ pr_err("checksum error: %u != %u\n", csum, rcsum);
+ return -EINVAL;
+ }
+
+@@ -395,7 +395,7 @@ static int apply_xbc(const char *path, const char *xbc_path)
+ xbc_get_info(&ret, NULL);
+ printf("\tNumber of nodes: %d\n", ret);
+ printf("\tSize: %u bytes\n", (unsigned int)size);
+- printf("\tChecksum: %d\n", (unsigned int)csum);
++ printf("\tChecksum: %u\n", (unsigned int)csum);
+
+ /* TODO: Check the options by schema */
+ xbc_exit();
+--
+2.39.5
+
--- /dev/null
+From 5042122995d0c53db6756e96fe71013727b5dfb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Dec 2024 12:45:30 -0800
+Subject: tools/testing/selftests/bpf/test_tc_tunnel.sh: Fix wait for server
+ bind
+
+From: Marco Leogrande <leogrande@google.com>
+
+[ Upstream commit e2f0791124a1b6ca8d570110cbd487969d9d41ef ]
+
+Commit f803bcf9208a ("selftests/bpf: Prevent client connect before
+server bind in test_tc_tunnel.sh") added code that waits for the
+netcat server to start before the netcat client attempts to connect to
+it. However, not all calls to 'server_listen' were guarded.
+
+This patch adds the existing 'wait_for_port' guard after the remaining
+call to 'server_listen'.
+
+Fixes: f803bcf9208a ("selftests/bpf: Prevent client connect before server bind in test_tc_tunnel.sh")
+Signed-off-by: Marco Leogrande <leogrande@google.com>
+Acked-by: Stanislav Fomichev <sdf@fomichev.me>
+Link: https://lore.kernel.org/r/20241202204530.1143448-1-leogrande@google.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_tc_tunnel.sh | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/bpf/test_tc_tunnel.sh b/tools/testing/selftests/bpf/test_tc_tunnel.sh
+index 365a2c7a89bad..8766e88b5a407 100755
+--- a/tools/testing/selftests/bpf/test_tc_tunnel.sh
++++ b/tools/testing/selftests/bpf/test_tc_tunnel.sh
+@@ -296,6 +296,7 @@ else
+ client_connect
+ verify_data
+ server_listen
++ wait_for_port ${port} ${netcat_opt}
+ fi
+
+ # bpf_skb_net_shrink does not take tunnel flags yet, cannot update L3.
+--
+2.39.5
+
--- /dev/null
+From c27611e70f8f3f0e8d625ac8cddc9f3c5f2bd495 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Dec 2024 16:18:23 +0800
+Subject: ubifs: skip dumping tnc tree when zroot is null
+
+From: pangliyuan <pangliyuan1@huawei.com>
+
+[ Upstream commit bdb0ca39e0acccf6771db49c3f94ed787d05f2d7 ]
+
+Clearing slab cache will free all znode in memory and make
+c->zroot.znode = NULL, then dumping tnc tree will access
+c->zroot.znode which cause null pointer dereference.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=219624#c0
+Fixes: 1e51764a3c2a ("UBIFS: add new flash file system")
+Signed-off-by: pangliyuan <pangliyuan1@huawei.com>
+Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ubifs/debug.c | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
+index 3f128b9fdfbb2..9613725ed1935 100644
+--- a/fs/ubifs/debug.c
++++ b/fs/ubifs/debug.c
+@@ -946,16 +946,20 @@ void ubifs_dump_tnc(struct ubifs_info *c)
+
+ pr_err("\n");
+ pr_err("(pid %d) start dumping TNC tree\n", current->pid);
+- znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, NULL);
+- level = znode->level;
+- pr_err("== Level %d ==\n", level);
+- while (znode) {
+- if (level != znode->level) {
+- level = znode->level;
+- pr_err("== Level %d ==\n", level);
++ if (c->zroot.znode) {
++ znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, NULL);
++ level = znode->level;
++ pr_err("== Level %d ==\n", level);
++ while (znode) {
++ if (level != znode->level) {
++ level = znode->level;
++ pr_err("== Level %d ==\n", level);
++ }
++ ubifs_dump_znode(c, znode);
++ znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, znode);
+ }
+- ubifs_dump_znode(c, znode);
+- znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, znode);
++ } else {
++ pr_err("empty TNC tree in memory\n");
+ }
+ pr_err("(pid %d) finish dumping TNC tree\n", current->pid);
+ }
+--
+2.39.5
+
--- /dev/null
+From 0fd40ef9fdca8dbf4b28a79714526444054f084e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2024 17:21:16 +0100
+Subject: udp: Deal with race between UDP socket address change and rehash
+
+From: Stefano Brivio <sbrivio@redhat.com>
+
+[ Upstream commit a502ea6fa94b1f7be72a24bcf9e3f5f6b7e6e90c ]
+
+If a UDP socket changes its local address while it's receiving
+datagrams, as a result of connect(), there is a period during which
+a lookup operation might fail to find it, after the address is changed
+but before the secondary hash (port and address) and the four-tuple
+hash (local and remote ports and addresses) are updated.
+
+Secondary hash chains were introduced by commit 30fff9231fad ("udp:
+bind() optimisation") and, as a result, a rehash operation became
+needed to make a bound socket reachable again after a connect().
+
+This operation was introduced by commit 719f835853a9 ("udp: add
+rehash on connect()") which isn't however a complete fix: the
+socket will be found once the rehashing completes, but not while
+it's pending.
+
+This is noticeable with a socat(1) server in UDP4-LISTEN mode, and a
+client sending datagrams to it. After the server receives the first
+datagram (cf. _xioopen_ipdgram_listen()), it issues a connect() to
+the address of the sender, in order to set up a directed flow.
+
+Now, if the client, running on a different CPU thread, happens to
+send a (subsequent) datagram while the server's socket changes its
+address, but is not rehashed yet, this will result in a failed
+lookup and a port unreachable error delivered to the client, as
+apparent from the following reproducer:
+
+ LEN=$(($(cat /proc/sys/net/core/wmem_default) / 4))
+ dd if=/dev/urandom bs=1 count=${LEN} of=tmp.in
+
+ while :; do
+ taskset -c 1 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc &
+ sleep 0.1 || sleep 1
+ taskset -c 2 socat OPEN:tmp.in UDP4:localhost:1337,shut-null
+ wait
+ done
+
+where the client will eventually get ECONNREFUSED on a write()
+(typically the second or third one of a given iteration):
+
+ 2024/11/13 21:28:23 socat[46901] E write(6, 0x556db2e3c000, 8192): Connection refused
+
+This issue was first observed as a seldom failure in Podman's tests
+checking UDP functionality while using pasta(1) to connect the
+container's network namespace, which leads us to a reproducer with
+the lookup error resulting in an ICMP packet on a tap device:
+
+ LOCAL_ADDR="$(ip -j -4 addr show|jq -rM '.[] | .addr_info[0] | select(.scope == "global").local')"
+
+ while :; do
+ ./pasta --config-net -p pasta.pcap -u 1337 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc &
+ sleep 0.2 || sleep 1
+ socat OPEN:tmp.in UDP4:${LOCAL_ADDR}:1337,shut-null
+ wait
+ cmp tmp.in tmp.out
+ done
+
+Once this fails:
+
+ tmp.in tmp.out differ: char 8193, line 29
+
+we can finally have a look at what's going on:
+
+ $ tshark -r pasta.pcap
+ 1 0.000000 :: ? ff02::16 ICMPv6 110 Multicast Listener Report Message v2
+ 2 0.168690 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192
+ 3 0.168767 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192
+ 4 0.168806 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192
+ 5 0.168827 c6:47:05:8d:dc:04 ? Broadcast ARP 42 Who has 88.198.0.161? Tell 88.198.0.164
+ 6 0.168851 9a:55:9a:55:9a:55 ? c6:47:05:8d:dc:04 ARP 42 88.198.0.161 is at 9a:55:9a:55:9a:55
+ 7 0.168875 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192
+ 8 0.168896 88.198.0.164 ? 88.198.0.161 ICMP 590 Destination unreachable (Port unreachable)
+ 9 0.168926 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192
+ 10 0.168959 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192
+ 11 0.168989 88.198.0.161 ? 88.198.0.164 UDP 4138 60260 ? 1337 Len=4096
+ 12 0.169010 88.198.0.161 ? 88.198.0.164 UDP 42 60260 ? 1337 Len=0
+
+On the third datagram received, the network namespace of the container
+initiates an ARP lookup to deliver the ICMP message.
+
+In another variant of this reproducer, starting the client with:
+
+ strace -f pasta --config-net -u 1337 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc 2>strace.log &
+
+and connecting to the socat server using a loopback address:
+
+ socat OPEN:tmp.in UDP4:localhost:1337,shut-null
+
+we can more clearly observe a sendmmsg() call failing after the
+first datagram is delivered:
+
+ [pid 278012] connect(173, 0x7fff96c95fc0, 16) = 0
+ [...]
+ [pid 278012] recvmmsg(173, 0x7fff96c96020, 1024, MSG_DONTWAIT, NULL) = -1 EAGAIN (Resource temporarily unavailable)
+ [pid 278012] sendmmsg(173, 0x561c5ad0a720, 1, MSG_NOSIGNAL) = 1
+ [...]
+ [pid 278012] sendmmsg(173, 0x561c5ad0a720, 1, MSG_NOSIGNAL) = -1 ECONNREFUSED (Connection refused)
+
+and, somewhat confusingly, after a connect() on the same socket
+succeeded.
+
+Until commit 4cdeeee9252a ("net: udp: prefer listeners bound to an
+address"), the race between receive address change and lookup didn't
+actually cause visible issues, because, once the lookup based on the
+secondary hash chain failed, we would still attempt a lookup based on
+the primary hash (destination port only), and find the socket with the
+outdated secondary hash.
+
+That change, however, dropped port-only lookups altogether, as side
+effect, making the race visible.
+
+To fix this, while avoiding the need to make address changes and
+rehash atomic against lookups, reintroduce primary hash lookups as
+fallback, if lookups based on four-tuple and secondary hashes fail.
+
+To this end, introduce a simplified lookup implementation, which
+doesn't take care of SO_REUSEPORT groups: if we have one, there are
+multiple sockets that would match the four-tuple or secondary hash,
+meaning that we can't run into this race at all.
+
+v2:
+ - instead of synchronising lookup operations against address change
+ plus rehash, reintroduce a simplified version of the original
+ primary hash lookup as fallback
+
+v1:
+ - fix build with CONFIG_IPV6=n: add ifdef around sk_v6_rcv_saddr
+ usage (Kuniyuki Iwashima)
+ - directly use sk_rcv_saddr for IPv4 receive addresses instead of
+ fetching inet_rcv_saddr (Kuniyuki Iwashima)
+ - move inet_update_saddr() to inet_hashtables.h and use that
+ to set IPv4/IPv6 addresses as suitable (Kuniyuki Iwashima)
+ - rebase onto net-next, update commit message accordingly
+
+Reported-by: Ed Santiago <santiago@redhat.com>
+Link: https://github.com/containers/podman/issues/24147
+Analysed-by: David Gibson <david@gibson.dropbear.id.au>
+Fixes: 30fff9231fad ("udp: bind() optimisation")
+Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/udp.c | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++
+ net/ipv6/udp.c | 50 ++++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 106 insertions(+)
+
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 3f9c4b74fdc0c..20c3983ab34e9 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -414,6 +414,49 @@ u32 udp_ehashfn(const struct net *net, const __be32 laddr, const __u16 lport,
+ udp_ehash_secret + net_hash_mix(net));
+ }
+
++/**
++ * udp4_lib_lookup1() - Simplified lookup using primary hash (destination port)
++ * @net: Network namespace
++ * @saddr: Source address, network order
++ * @sport: Source port, network order
++ * @daddr: Destination address, network order
++ * @hnum: Destination port, host order
++ * @dif: Destination interface index
++ * @sdif: Destination bridge port index, if relevant
++ * @udptable: Set of UDP hash tables
++ *
++ * Simplified lookup to be used as fallback if no sockets are found due to a
++ * potential race between (receive) address change, and lookup happening before
++ * the rehash operation. This function ignores SO_REUSEPORT groups while scoring
++ * result sockets, because if we have one, we don't need the fallback at all.
++ *
++ * Called under rcu_read_lock().
++ *
++ * Return: socket with highest matching score if any, NULL if none
++ */
++static struct sock *udp4_lib_lookup1(const struct net *net,
++ __be32 saddr, __be16 sport,
++ __be32 daddr, unsigned int hnum,
++ int dif, int sdif,
++ const struct udp_table *udptable)
++{
++ unsigned int slot = udp_hashfn(net, hnum, udptable->mask);
++ struct udp_hslot *hslot = &udptable->hash[slot];
++ struct sock *sk, *result = NULL;
++ int score, badness = 0;
++
++ sk_for_each_rcu(sk, &hslot->head) {
++ score = compute_score(sk, net,
++ saddr, sport, daddr, hnum, dif, sdif);
++ if (score > badness) {
++ result = sk;
++ badness = score;
++ }
++ }
++
++ return result;
++}
++
+ /* called with rcu_read_lock() */
+ static struct sock *udp4_lib_lookup2(struct net *net,
+ __be32 saddr, __be16 sport,
+@@ -541,6 +584,19 @@ struct sock *__udp4_lib_lookup(struct net *net, __be32 saddr,
+ result = udp4_lib_lookup2(net, saddr, sport,
+ htonl(INADDR_ANY), hnum, dif, sdif,
+ hslot2, skb);
++ if (!IS_ERR_OR_NULL(result))
++ goto done;
++
++ /* Primary hash (destination port) lookup as fallback for this race:
++ * 1. __ip4_datagram_connect() sets sk_rcv_saddr
++ * 2. lookup (this function): new sk_rcv_saddr, hashes not updated yet
++ * 3. rehash operation updating _secondary and four-tuple_ hashes
++ * The primary hash doesn't need an update after 1., so, thanks to this
++ * further step, 1. and 3. don't need to be atomic against the lookup.
++ */
++ result = udp4_lib_lookup1(net, saddr, sport, daddr, hnum, dif, sdif,
++ udptable);
++
+ done:
+ if (IS_ERR(result))
+ return NULL;
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index f55d08d2096ae..78361e5da8477 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -160,6 +160,49 @@ static int compute_score(struct sock *sk, struct net *net,
+ return score;
+ }
+
++/**
++ * udp6_lib_lookup1() - Simplified lookup using primary hash (destination port)
++ * @net: Network namespace
++ * @saddr: Source address, network order
++ * @sport: Source port, network order
++ * @daddr: Destination address, network order
++ * @hnum: Destination port, host order
++ * @dif: Destination interface index
++ * @sdif: Destination bridge port index, if relevant
++ * @udptable: Set of UDP hash tables
++ *
++ * Simplified lookup to be used as fallback if no sockets are found due to a
++ * potential race between (receive) address change, and lookup happening before
++ * the rehash operation. This function ignores SO_REUSEPORT groups while scoring
++ * result sockets, because if we have one, we don't need the fallback at all.
++ *
++ * Called under rcu_read_lock().
++ *
++ * Return: socket with highest matching score if any, NULL if none
++ */
++static struct sock *udp6_lib_lookup1(const struct net *net,
++ const struct in6_addr *saddr, __be16 sport,
++ const struct in6_addr *daddr,
++ unsigned int hnum, int dif, int sdif,
++ const struct udp_table *udptable)
++{
++ unsigned int slot = udp_hashfn(net, hnum, udptable->mask);
++ struct udp_hslot *hslot = &udptable->hash[slot];
++ struct sock *sk, *result = NULL;
++ int score, badness = 0;
++
++ sk_for_each_rcu(sk, &hslot->head) {
++ score = compute_score(sk, net,
++ saddr, sport, daddr, hnum, dif, sdif);
++ if (score > badness) {
++ result = sk;
++ badness = score;
++ }
++ }
++
++ return result;
++}
++
+ /* called with rcu_read_lock() */
+ static struct sock *udp6_lib_lookup2(struct net *net,
+ const struct in6_addr *saddr, __be16 sport,
+@@ -288,6 +331,13 @@ struct sock *__udp6_lib_lookup(struct net *net,
+ result = udp6_lib_lookup2(net, saddr, sport,
+ &in6addr_any, hnum, dif, sdif,
+ hslot2, skb);
++ if (!IS_ERR_OR_NULL(result))
++ goto done;
++
++ /* Cover address change/lookup/rehash race: see __udp4_lib_lookup() */
++ result = udp6_lib_lookup1(net, saddr, sport, daddr, hnum, dif, sdif,
++ udptable);
++
+ done:
+ if (IS_ERR(result))
+ return NULL;
+--
+2.39.5
+
--- /dev/null
+From d3a46a60470293c3ad53c23cb2ac32a8ae18e156 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2025 14:15:28 +0100
+Subject: vsock: Allow retrying on connect() failure
+
+From: Michal Luczaj <mhal@rbox.co>
+
+[ Upstream commit aa388c72113b7458127b709bdd7d3628af26e9b4 ]
+
+sk_err is set when a (connectible) connect() fails. Effectively, this makes
+an otherwise still healthy SS_UNCONNECTED socket impossible to use for any
+subsequent connection attempts.
+
+Clear sk_err upon trying to establish a connection.
+
+Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
+Signed-off-by: Michal Luczaj <mhal@rbox.co>
+Link: https://patch.msgid.link/20250128-vsock-transport-vs-autobind-v3-2-1cf57065b770@rbox.co
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/af_vsock.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index a224769566589..0194bcf7e242d 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -1453,6 +1453,11 @@ static int vsock_connect(struct socket *sock, struct sockaddr *addr,
+ if (err < 0)
+ goto out;
+
++ /* sk_err might have been set as a result of an earlier
++ * (failed) connect attempt.
++ */
++ sk->sk_err = 0;
++
+ /* Mark sock as connecting and set the error code to in
+ * progress in case this is a non-blocking connect.
+ */
+--
+2.39.5
+
--- /dev/null
+From dd8cb65af0ef10d3d6f6aca093a9d405bc6378f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2025 14:15:27 +0100
+Subject: vsock: Keep the binding until socket destruction
+
+From: Michal Luczaj <mhal@rbox.co>
+
+[ Upstream commit fcdd2242c0231032fc84e1404315c245ae56322a ]
+
+Preserve sockets bindings; this includes both resulting from an explicit
+bind() and those implicitly bound through autobind during connect().
+
+Prevents socket unbinding during a transport reassignment, which fixes a
+use-after-free:
+
+ 1. vsock_create() (refcnt=1) calls vsock_insert_unbound() (refcnt=2)
+ 2. transport->release() calls vsock_remove_bound() without checking if
+ sk was bound and moved to bound list (refcnt=1)
+ 3. vsock_bind() assumes sk is in unbound list and before
+ __vsock_insert_bound(vsock_bound_sockets()) calls
+ __vsock_remove_bound() which does:
+ list_del_init(&vsk->bound_table); // nop
+ sock_put(&vsk->sk); // refcnt=0
+
+BUG: KASAN: slab-use-after-free in __vsock_bind+0x62e/0x730
+Read of size 4 at addr ffff88816b46a74c by task a.out/2057
+ dump_stack_lvl+0x68/0x90
+ print_report+0x174/0x4f6
+ kasan_report+0xb9/0x190
+ __vsock_bind+0x62e/0x730
+ vsock_bind+0x97/0xe0
+ __sys_bind+0x154/0x1f0
+ __x64_sys_bind+0x6e/0xb0
+ do_syscall_64+0x93/0x1b0
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+Allocated by task 2057:
+ kasan_save_stack+0x1e/0x40
+ kasan_save_track+0x10/0x30
+ __kasan_slab_alloc+0x85/0x90
+ kmem_cache_alloc_noprof+0x131/0x450
+ sk_prot_alloc+0x5b/0x220
+ sk_alloc+0x2c/0x870
+ __vsock_create.constprop.0+0x2e/0xb60
+ vsock_create+0xe4/0x420
+ __sock_create+0x241/0x650
+ __sys_socket+0xf2/0x1a0
+ __x64_sys_socket+0x6e/0xb0
+ do_syscall_64+0x93/0x1b0
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+Freed by task 2057:
+ kasan_save_stack+0x1e/0x40
+ kasan_save_track+0x10/0x30
+ kasan_save_free_info+0x37/0x60
+ __kasan_slab_free+0x4b/0x70
+ kmem_cache_free+0x1a1/0x590
+ __sk_destruct+0x388/0x5a0
+ __vsock_bind+0x5e1/0x730
+ vsock_bind+0x97/0xe0
+ __sys_bind+0x154/0x1f0
+ __x64_sys_bind+0x6e/0xb0
+ do_syscall_64+0x93/0x1b0
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+refcount_t: addition on 0; use-after-free.
+WARNING: CPU: 7 PID: 2057 at lib/refcount.c:25 refcount_warn_saturate+0xce/0x150
+RIP: 0010:refcount_warn_saturate+0xce/0x150
+ __vsock_bind+0x66d/0x730
+ vsock_bind+0x97/0xe0
+ __sys_bind+0x154/0x1f0
+ __x64_sys_bind+0x6e/0xb0
+ do_syscall_64+0x93/0x1b0
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+refcount_t: underflow; use-after-free.
+WARNING: CPU: 7 PID: 2057 at lib/refcount.c:28 refcount_warn_saturate+0xee/0x150
+RIP: 0010:refcount_warn_saturate+0xee/0x150
+ vsock_remove_bound+0x187/0x1e0
+ __vsock_release+0x383/0x4a0
+ vsock_release+0x90/0x120
+ __sock_release+0xa3/0x250
+ sock_close+0x14/0x20
+ __fput+0x359/0xa80
+ task_work_run+0x107/0x1d0
+ do_exit+0x847/0x2560
+ do_group_exit+0xb8/0x250
+ __x64_sys_exit_group+0x3a/0x50
+ x64_sys_call+0xfec/0x14f0
+ do_syscall_64+0x93/0x1b0
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+Fixes: c0cfa2d8a788 ("vsock: add multi-transports support")
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: Michal Luczaj <mhal@rbox.co>
+Link: https://patch.msgid.link/20250128-vsock-transport-vs-autobind-v3-1-1cf57065b770@rbox.co
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/af_vsock.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index 7ad84c6c19c3e..a224769566589 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -336,7 +336,10 @@ EXPORT_SYMBOL_GPL(vsock_find_connected_socket);
+
+ void vsock_remove_sock(struct vsock_sock *vsk)
+ {
+- vsock_remove_bound(vsk);
++ /* Transport reassignment must not remove the binding. */
++ if (sock_flag(sk_vsock(vsk), SOCK_DEAD))
++ vsock_remove_bound(vsk);
++
+ vsock_remove_connected(vsk);
+ }
+ EXPORT_SYMBOL_GPL(vsock_remove_sock);
+@@ -821,12 +824,13 @@ static void __vsock_release(struct sock *sk, int level)
+ */
+ lock_sock_nested(sk, level);
+
++ sock_orphan(sk);
++
+ if (vsk->transport)
+ vsk->transport->release(vsk);
+ else if (sock_type_connectible(sk->sk_type))
+ vsock_remove_sock(vsk);
+
+- sock_orphan(sk);
+ sk->sk_shutdown = SHUTDOWN_MASK;
+
+ skb_queue_purge(&sk->sk_receive_queue);
+--
+2.39.5
+
--- /dev/null
+From 97555d996913bcb2fe19b9e57c856045aa05c737 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Mar 2023 19:11:51 +0000
+Subject: vsock: support sockmap
+
+From: Bobby Eshleman <bobby.eshleman@bytedance.com>
+
+[ Upstream commit 634f1a7110b439c65fd8a809171c1d2d28bcea6f ]
+
+This patch adds sockmap support for vsock sockets. It is intended to be
+usable by all transports, but only the virtio and loopback transports
+are implemented.
+
+SOCK_STREAM, SOCK_DGRAM, and SOCK_SEQPACKET are all supported.
+
+Signed-off-by: Bobby Eshleman <bobby.eshleman@bytedance.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Stable-dep-of: fcdd2242c023 ("vsock: Keep the binding until socket destruction")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vsock.c | 1 +
+ include/linux/virtio_vsock.h | 1 +
+ include/net/af_vsock.h | 17 +++
+ net/vmw_vsock/Makefile | 1 +
+ net/vmw_vsock/af_vsock.c | 64 ++++++++-
+ net/vmw_vsock/virtio_transport.c | 2 +
+ net/vmw_vsock/virtio_transport_common.c | 25 ++++
+ net/vmw_vsock/vsock_bpf.c | 174 ++++++++++++++++++++++++
+ net/vmw_vsock/vsock_loopback.c | 2 +
+ 9 files changed, 281 insertions(+), 6 deletions(-)
+ create mode 100644 net/vmw_vsock/vsock_bpf.c
+
+diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
+index c00f5821d6ecb..3248612e3f1bb 100644
+--- a/drivers/vhost/vsock.c
++++ b/drivers/vhost/vsock.c
+@@ -439,6 +439,7 @@ static struct virtio_transport vhost_transport = {
+ .notify_send_post_enqueue = virtio_transport_notify_send_post_enqueue,
+ .notify_buffer_size = virtio_transport_notify_buffer_size,
+
++ .read_skb = virtio_transport_read_skb,
+ },
+
+ .send_pkt = vhost_transport_send_pkt,
+diff --git a/include/linux/virtio_vsock.h b/include/linux/virtio_vsock.h
+index 3f9c166113063..c58453699ee98 100644
+--- a/include/linux/virtio_vsock.h
++++ b/include/linux/virtio_vsock.h
+@@ -245,4 +245,5 @@ u32 virtio_transport_get_credit(struct virtio_vsock_sock *vvs, u32 wanted);
+ void virtio_transport_put_credit(struct virtio_vsock_sock *vvs, u32 credit);
+ void virtio_transport_deliver_tap_pkt(struct sk_buff *skb);
+ int virtio_transport_purge_skbs(void *vsk, struct sk_buff_head *list);
++int virtio_transport_read_skb(struct vsock_sock *vsk, skb_read_actor_t read_actor);
+ #endif /* _LINUX_VIRTIO_VSOCK_H */
+diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h
+index 568a87c5e0d0f..0e7504a42925f 100644
+--- a/include/net/af_vsock.h
++++ b/include/net/af_vsock.h
+@@ -75,6 +75,7 @@ struct vsock_sock {
+ void *trans;
+ };
+
++s64 vsock_connectible_has_data(struct vsock_sock *vsk);
+ s64 vsock_stream_has_data(struct vsock_sock *vsk);
+ s64 vsock_stream_has_space(struct vsock_sock *vsk);
+ struct sock *vsock_create_connected(struct sock *parent);
+@@ -173,6 +174,9 @@ struct vsock_transport {
+
+ /* Addressing. */
+ u32 (*get_local_cid)(void);
++
++ /* Read a single skb */
++ int (*read_skb)(struct vsock_sock *, skb_read_actor_t);
+ };
+
+ /**** CORE ****/
+@@ -225,5 +229,18 @@ int vsock_init_tap(void);
+ int vsock_add_tap(struct vsock_tap *vt);
+ int vsock_remove_tap(struct vsock_tap *vt);
+ void vsock_deliver_tap(struct sk_buff *build_skb(void *opaque), void *opaque);
++int vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
++ int flags);
++int vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
++ size_t len, int flags);
++
++#ifdef CONFIG_BPF_SYSCALL
++extern struct proto vsock_proto;
++int vsock_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool restore);
++void __init vsock_bpf_build_proto(void);
++#else
++static inline void __init vsock_bpf_build_proto(void)
++{}
++#endif
+
+ #endif /* __AF_VSOCK_H__ */
+diff --git a/net/vmw_vsock/Makefile b/net/vmw_vsock/Makefile
+index 6a943ec95c4a5..5da74c4a9f1d1 100644
+--- a/net/vmw_vsock/Makefile
++++ b/net/vmw_vsock/Makefile
+@@ -8,6 +8,7 @@ obj-$(CONFIG_HYPERV_VSOCKETS) += hv_sock.o
+ obj-$(CONFIG_VSOCKETS_LOOPBACK) += vsock_loopback.o
+
+ vsock-y += af_vsock.o af_vsock_tap.o vsock_addr.o
++vsock-$(CONFIG_BPF_SYSCALL) += vsock_bpf.o
+
+ vsock_diag-y += diag.o
+
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index 88b5702a0a47c..e0107c873f261 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -118,10 +118,13 @@ static void vsock_sk_destruct(struct sock *sk);
+ static int vsock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
+
+ /* Protocol family. */
+-static struct proto vsock_proto = {
++struct proto vsock_proto = {
+ .name = "AF_VSOCK",
+ .owner = THIS_MODULE,
+ .obj_size = sizeof(struct vsock_sock),
++#ifdef CONFIG_BPF_SYSCALL
++ .psock_update_sk_prot = vsock_bpf_update_proto,
++#endif
+ };
+
+ /* The default peer timeout indicates how long we will wait for a peer response
+@@ -880,7 +883,7 @@ s64 vsock_stream_has_data(struct vsock_sock *vsk)
+ }
+ EXPORT_SYMBOL_GPL(vsock_stream_has_data);
+
+-static s64 vsock_connectible_has_data(struct vsock_sock *vsk)
++s64 vsock_connectible_has_data(struct vsock_sock *vsk)
+ {
+ struct sock *sk = sk_vsock(vsk);
+
+@@ -892,6 +895,7 @@ static s64 vsock_connectible_has_data(struct vsock_sock *vsk)
+ else
+ return vsock_stream_has_data(vsk);
+ }
++EXPORT_SYMBOL_GPL(vsock_connectible_has_data);
+
+ s64 vsock_stream_has_space(struct vsock_sock *vsk)
+ {
+@@ -1152,6 +1156,13 @@ static __poll_t vsock_poll(struct file *file, struct socket *sock,
+ return mask;
+ }
+
++static int vsock_read_skb(struct sock *sk, skb_read_actor_t read_actor)
++{
++ struct vsock_sock *vsk = vsock_sk(sk);
++
++ return vsk->transport->read_skb(vsk, read_actor);
++}
++
+ static int vsock_dgram_sendmsg(struct socket *sock, struct msghdr *msg,
+ size_t len)
+ {
+@@ -1263,18 +1274,42 @@ static int vsock_dgram_connect(struct socket *sock,
+ memcpy(&vsk->remote_addr, remote_addr, sizeof(vsk->remote_addr));
+ sock->state = SS_CONNECTED;
+
++ /* sock map disallows redirection of non-TCP sockets with sk_state !=
++ * TCP_ESTABLISHED (see sock_map_redirect_allowed()), so we set
++ * TCP_ESTABLISHED here to allow redirection of connected vsock dgrams.
++ *
++ * This doesn't seem to be abnormal state for datagram sockets, as the
++ * same approach can be see in other datagram socket types as well
++ * (such as unix sockets).
++ */
++ sk->sk_state = TCP_ESTABLISHED;
++
+ out:
+ release_sock(sk);
+ return err;
+ }
+
+-static int vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
+- size_t len, int flags)
++int vsock_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
++ size_t len, int flags)
+ {
+- struct vsock_sock *vsk = vsock_sk(sock->sk);
++#ifdef CONFIG_BPF_SYSCALL
++ const struct proto *prot;
++#endif
++ struct vsock_sock *vsk;
++ struct sock *sk;
++
++ sk = sock->sk;
++ vsk = vsock_sk(sk);
++
++#ifdef CONFIG_BPF_SYSCALL
++ prot = READ_ONCE(sk->sk_prot);
++ if (prot != &vsock_proto)
++ return prot->recvmsg(sk, msg, len, flags, NULL);
++#endif
+
+ return vsk->transport->dgram_dequeue(vsk, msg, len, flags);
+ }
++EXPORT_SYMBOL_GPL(vsock_dgram_recvmsg);
+
+ static const struct proto_ops vsock_dgram_ops = {
+ .family = PF_VSOCK,
+@@ -1293,6 +1328,7 @@ static const struct proto_ops vsock_dgram_ops = {
+ .recvmsg = vsock_dgram_recvmsg,
+ .mmap = sock_no_mmap,
+ .sendpage = sock_no_sendpage,
++ .read_skb = vsock_read_skb,
+ };
+
+ static int vsock_transport_cancel_pkt(struct vsock_sock *vsk)
+@@ -2106,13 +2142,16 @@ static int __vsock_seqpacket_recvmsg(struct sock *sk, struct msghdr *msg,
+ return err;
+ }
+
+-static int
++int
+ vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ int flags)
+ {
+ struct sock *sk;
+ struct vsock_sock *vsk;
+ const struct vsock_transport *transport;
++#ifdef CONFIG_BPF_SYSCALL
++ const struct proto *prot;
++#endif
+ int err;
+
+ sk = sock->sk;
+@@ -2163,6 +2202,14 @@ vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ goto out;
+ }
+
++#ifdef CONFIG_BPF_SYSCALL
++ prot = READ_ONCE(sk->sk_prot);
++ if (prot != &vsock_proto) {
++ release_sock(sk);
++ return prot->recvmsg(sk, msg, len, flags, NULL);
++ }
++#endif
++
+ if (sk->sk_type == SOCK_STREAM)
+ err = __vsock_stream_recvmsg(sk, msg, len, flags);
+ else
+@@ -2172,6 +2219,7 @@ vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ release_sock(sk);
+ return err;
+ }
++EXPORT_SYMBOL_GPL(vsock_connectible_recvmsg);
+
+ static int vsock_set_rcvlowat(struct sock *sk, int val)
+ {
+@@ -2212,6 +2260,7 @@ static const struct proto_ops vsock_stream_ops = {
+ .mmap = sock_no_mmap,
+ .sendpage = sock_no_sendpage,
+ .set_rcvlowat = vsock_set_rcvlowat,
++ .read_skb = vsock_read_skb,
+ };
+
+ static const struct proto_ops vsock_seqpacket_ops = {
+@@ -2233,6 +2282,7 @@ static const struct proto_ops vsock_seqpacket_ops = {
+ .recvmsg = vsock_connectible_recvmsg,
+ .mmap = sock_no_mmap,
+ .sendpage = sock_no_sendpage,
++ .read_skb = vsock_read_skb,
+ };
+
+ static int vsock_create(struct net *net, struct socket *sock,
+@@ -2372,6 +2422,8 @@ static int __init vsock_init(void)
+ goto err_unregister_proto;
+ }
+
++ vsock_bpf_build_proto();
++
+ return 0;
+
+ err_unregister_proto:
+diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
+index 5434c9f11d28d..21d1fad4ad0e2 100644
+--- a/net/vmw_vsock/virtio_transport.c
++++ b/net/vmw_vsock/virtio_transport.c
+@@ -458,6 +458,8 @@ static struct virtio_transport virtio_transport = {
+ .notify_send_pre_enqueue = virtio_transport_notify_send_pre_enqueue,
+ .notify_send_post_enqueue = virtio_transport_notify_send_post_enqueue,
+ .notify_buffer_size = virtio_transport_notify_buffer_size,
++
++ .read_skb = virtio_transport_read_skb,
+ },
+
+ .send_pkt = virtio_transport_send_pkt,
+diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
+index a65da57fe26fd..a713a21abf59c 100644
+--- a/net/vmw_vsock/virtio_transport_common.c
++++ b/net/vmw_vsock/virtio_transport_common.c
+@@ -1435,6 +1435,31 @@ int virtio_transport_purge_skbs(void *vsk, struct sk_buff_head *queue)
+ }
+ EXPORT_SYMBOL_GPL(virtio_transport_purge_skbs);
+
++int virtio_transport_read_skb(struct vsock_sock *vsk, skb_read_actor_t recv_actor)
++{
++ struct virtio_vsock_sock *vvs = vsk->trans;
++ struct sock *sk = sk_vsock(vsk);
++ struct sk_buff *skb;
++ int off = 0;
++ int copied;
++ int err;
++
++ spin_lock_bh(&vvs->rx_lock);
++ /* Use __skb_recv_datagram() for race-free handling of the receive. It
++ * works for types other than dgrams.
++ */
++ skb = __skb_recv_datagram(sk, &vvs->rx_queue, MSG_DONTWAIT, &off, &err);
++ spin_unlock_bh(&vvs->rx_lock);
++
++ if (!skb)
++ return err;
++
++ copied = recv_actor(sk, skb);
++ kfree_skb(skb);
++ return copied;
++}
++EXPORT_SYMBOL_GPL(virtio_transport_read_skb);
++
+ MODULE_LICENSE("GPL v2");
+ MODULE_AUTHOR("Asias He");
+ MODULE_DESCRIPTION("common code for virtio vsock");
+diff --git a/net/vmw_vsock/vsock_bpf.c b/net/vmw_vsock/vsock_bpf.c
+new file mode 100644
+index 0000000000000..a3c97546ab84a
+--- /dev/null
++++ b/net/vmw_vsock/vsock_bpf.c
+@@ -0,0 +1,174 @@
++// SPDX-License-Identifier: GPL-2.0
++/* Copyright (c) 2022 Bobby Eshleman <bobby.eshleman@bytedance.com>
++ *
++ * Based off of net/unix/unix_bpf.c
++ */
++
++#include <linux/bpf.h>
++#include <linux/module.h>
++#include <linux/skmsg.h>
++#include <linux/socket.h>
++#include <linux/wait.h>
++#include <net/af_vsock.h>
++#include <net/sock.h>
++
++#define vsock_sk_has_data(__sk, __psock) \
++ ({ !skb_queue_empty(&(__sk)->sk_receive_queue) || \
++ !skb_queue_empty(&(__psock)->ingress_skb) || \
++ !list_empty(&(__psock)->ingress_msg); \
++ })
++
++static struct proto *vsock_prot_saved __read_mostly;
++static DEFINE_SPINLOCK(vsock_prot_lock);
++static struct proto vsock_bpf_prot;
++
++static bool vsock_has_data(struct sock *sk, struct sk_psock *psock)
++{
++ struct vsock_sock *vsk = vsock_sk(sk);
++ s64 ret;
++
++ ret = vsock_connectible_has_data(vsk);
++ if (ret > 0)
++ return true;
++
++ return vsock_sk_has_data(sk, psock);
++}
++
++static bool vsock_msg_wait_data(struct sock *sk, struct sk_psock *psock, long timeo)
++{
++ bool ret;
++
++ DEFINE_WAIT_FUNC(wait, woken_wake_function);
++
++ if (sk->sk_shutdown & RCV_SHUTDOWN)
++ return true;
++
++ if (!timeo)
++ return false;
++
++ add_wait_queue(sk_sleep(sk), &wait);
++ sk_set_bit(SOCKWQ_ASYNC_WAITDATA, sk);
++ ret = vsock_has_data(sk, psock);
++ if (!ret) {
++ wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
++ ret = vsock_has_data(sk, psock);
++ }
++ sk_clear_bit(SOCKWQ_ASYNC_WAITDATA, sk);
++ remove_wait_queue(sk_sleep(sk), &wait);
++ return ret;
++}
++
++static int __vsock_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int flags)
++{
++ struct socket *sock = sk->sk_socket;
++ int err;
++
++ if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET)
++ err = vsock_connectible_recvmsg(sock, msg, len, flags);
++ else if (sk->sk_type == SOCK_DGRAM)
++ err = vsock_dgram_recvmsg(sock, msg, len, flags);
++ else
++ err = -EPROTOTYPE;
++
++ return err;
++}
++
++static int vsock_bpf_recvmsg(struct sock *sk, struct msghdr *msg,
++ size_t len, int flags, int *addr_len)
++{
++ struct sk_psock *psock;
++ int copied;
++
++ psock = sk_psock_get(sk);
++ if (unlikely(!psock))
++ return __vsock_recvmsg(sk, msg, len, flags);
++
++ lock_sock(sk);
++ if (vsock_has_data(sk, psock) && sk_psock_queue_empty(psock)) {
++ release_sock(sk);
++ sk_psock_put(sk, psock);
++ return __vsock_recvmsg(sk, msg, len, flags);
++ }
++
++ copied = sk_msg_recvmsg(sk, psock, msg, len, flags);
++ while (copied == 0) {
++ long timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
++
++ if (!vsock_msg_wait_data(sk, psock, timeo)) {
++ copied = -EAGAIN;
++ break;
++ }
++
++ if (sk_psock_queue_empty(psock)) {
++ release_sock(sk);
++ sk_psock_put(sk, psock);
++ return __vsock_recvmsg(sk, msg, len, flags);
++ }
++
++ copied = sk_msg_recvmsg(sk, psock, msg, len, flags);
++ }
++
++ release_sock(sk);
++ sk_psock_put(sk, psock);
++
++ return copied;
++}
++
++/* Copy of original proto with updated sock_map methods */
++static struct proto vsock_bpf_prot = {
++ .close = sock_map_close,
++ .recvmsg = vsock_bpf_recvmsg,
++ .sock_is_readable = sk_msg_is_readable,
++ .unhash = sock_map_unhash,
++};
++
++static void vsock_bpf_rebuild_protos(struct proto *prot, const struct proto *base)
++{
++ *prot = *base;
++ prot->close = sock_map_close;
++ prot->recvmsg = vsock_bpf_recvmsg;
++ prot->sock_is_readable = sk_msg_is_readable;
++}
++
++static void vsock_bpf_check_needs_rebuild(struct proto *ops)
++{
++ /* Paired with the smp_store_release() below. */
++ if (unlikely(ops != smp_load_acquire(&vsock_prot_saved))) {
++ spin_lock_bh(&vsock_prot_lock);
++ if (likely(ops != vsock_prot_saved)) {
++ vsock_bpf_rebuild_protos(&vsock_bpf_prot, ops);
++ /* Make sure proto function pointers are updated before publishing the
++ * pointer to the struct.
++ */
++ smp_store_release(&vsock_prot_saved, ops);
++ }
++ spin_unlock_bh(&vsock_prot_lock);
++ }
++}
++
++int vsock_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool restore)
++{
++ struct vsock_sock *vsk;
++
++ if (restore) {
++ sk->sk_write_space = psock->saved_write_space;
++ sock_replace_proto(sk, psock->sk_proto);
++ return 0;
++ }
++
++ vsk = vsock_sk(sk);
++ if (!vsk->transport)
++ return -ENODEV;
++
++ if (!vsk->transport->read_skb)
++ return -EOPNOTSUPP;
++
++ vsock_bpf_check_needs_rebuild(psock->sk_proto);
++ sock_replace_proto(sk, &vsock_bpf_prot);
++ return 0;
++}
++
++void __init vsock_bpf_build_proto(void)
++{
++ vsock_bpf_rebuild_protos(&vsock_bpf_prot, &vsock_proto);
++}
+diff --git a/net/vmw_vsock/vsock_loopback.c b/net/vmw_vsock/vsock_loopback.c
+index 89905c092645a..e3afc0c866f55 100644
+--- a/net/vmw_vsock/vsock_loopback.c
++++ b/net/vmw_vsock/vsock_loopback.c
+@@ -91,6 +91,8 @@ static struct virtio_transport loopback_transport = {
+ .notify_send_pre_enqueue = virtio_transport_notify_send_pre_enqueue,
+ .notify_send_post_enqueue = virtio_transport_notify_send_post_enqueue,
+ .notify_buffer_size = virtio_transport_notify_buffer_size,
++
++ .read_skb = virtio_transport_read_skb,
+ },
+
+ .send_pkt = vsock_loopback_send_pkt,
+--
+2.39.5
+
--- /dev/null
+From e00993b9e1a86441bb1f44a4a8944ebb1c2bb764 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jan 2025 23:57:46 +0900
+Subject: vxlan: Fix uninit-value in vxlan_vnifilter_dump()
+
+From: Shigeru Yoshida <syoshida@redhat.com>
+
+[ Upstream commit 5066293b9b7046a906eff60e3949a887ae185a43 ]
+
+KMSAN reported an uninit-value access in vxlan_vnifilter_dump() [1].
+
+If the length of the netlink message payload is less than
+sizeof(struct tunnel_msg), vxlan_vnifilter_dump() accesses bytes
+beyond the message. This can lead to uninit-value access. Fix this by
+returning an error in such situations.
+
+[1]
+BUG: KMSAN: uninit-value in vxlan_vnifilter_dump+0x328/0x920 drivers/net/vxlan/vxlan_vnifilter.c:422
+ vxlan_vnifilter_dump+0x328/0x920 drivers/net/vxlan/vxlan_vnifilter.c:422
+ rtnl_dumpit+0xd5/0x2f0 net/core/rtnetlink.c:6786
+ netlink_dump+0x93e/0x15f0 net/netlink/af_netlink.c:2317
+ __netlink_dump_start+0x716/0xd60 net/netlink/af_netlink.c:2432
+ netlink_dump_start include/linux/netlink.h:340 [inline]
+ rtnetlink_dump_start net/core/rtnetlink.c:6815 [inline]
+ rtnetlink_rcv_msg+0x1256/0x14a0 net/core/rtnetlink.c:6882
+ netlink_rcv_skb+0x467/0x660 net/netlink/af_netlink.c:2542
+ rtnetlink_rcv+0x35/0x40 net/core/rtnetlink.c:6944
+ netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline]
+ netlink_unicast+0xed6/0x1290 net/netlink/af_netlink.c:1347
+ netlink_sendmsg+0x1092/0x1230 net/netlink/af_netlink.c:1891
+ sock_sendmsg_nosec net/socket.c:711 [inline]
+ __sock_sendmsg+0x330/0x3d0 net/socket.c:726
+ ____sys_sendmsg+0x7f4/0xb50 net/socket.c:2583
+ ___sys_sendmsg+0x271/0x3b0 net/socket.c:2637
+ __sys_sendmsg net/socket.c:2669 [inline]
+ __do_sys_sendmsg net/socket.c:2674 [inline]
+ __se_sys_sendmsg net/socket.c:2672 [inline]
+ __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2672
+ x64_sys_call+0x3878/0x3d90 arch/x86/include/generated/asm/syscalls_64.h:47
+ do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+ do_syscall_64+0xd9/0x1d0 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Uninit was created at:
+ slab_post_alloc_hook mm/slub.c:4110 [inline]
+ slab_alloc_node mm/slub.c:4153 [inline]
+ kmem_cache_alloc_node_noprof+0x800/0xe80 mm/slub.c:4205
+ kmalloc_reserve+0x13b/0x4b0 net/core/skbuff.c:587
+ __alloc_skb+0x347/0x7d0 net/core/skbuff.c:678
+ alloc_skb include/linux/skbuff.h:1323 [inline]
+ netlink_alloc_large_skb+0xa5/0x280 net/netlink/af_netlink.c:1196
+ netlink_sendmsg+0xac9/0x1230 net/netlink/af_netlink.c:1866
+ sock_sendmsg_nosec net/socket.c:711 [inline]
+ __sock_sendmsg+0x330/0x3d0 net/socket.c:726
+ ____sys_sendmsg+0x7f4/0xb50 net/socket.c:2583
+ ___sys_sendmsg+0x271/0x3b0 net/socket.c:2637
+ __sys_sendmsg net/socket.c:2669 [inline]
+ __do_sys_sendmsg net/socket.c:2674 [inline]
+ __se_sys_sendmsg net/socket.c:2672 [inline]
+ __x64_sys_sendmsg+0x211/0x3e0 net/socket.c:2672
+ x64_sys_call+0x3878/0x3d90 arch/x86/include/generated/asm/syscalls_64.h:47
+ do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+ do_syscall_64+0xd9/0x1d0 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+CPU: 0 UID: 0 PID: 30991 Comm: syz.4.10630 Not tainted 6.12.0-10694-gc44daa7e3c73 #29
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014
+
+Fixes: f9c4bb0b245c ("vxlan: vni filtering support on collect metadata device")
+Reported-by: syzkaller <syzkaller@googlegroups.com>
+Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://patch.msgid.link/20250123145746.785768-1-syoshida@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/vxlan/vxlan_vnifilter.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/vxlan/vxlan_vnifilter.c b/drivers/net/vxlan/vxlan_vnifilter.c
+index 3d113d709d194..1ffc00e270802 100644
+--- a/drivers/net/vxlan/vxlan_vnifilter.c
++++ b/drivers/net/vxlan/vxlan_vnifilter.c
+@@ -411,6 +411,11 @@ static int vxlan_vnifilter_dump(struct sk_buff *skb, struct netlink_callback *cb
+ struct tunnel_msg *tmsg;
+ struct net_device *dev;
+
++ if (cb->nlh->nlmsg_len < nlmsg_msg_size(sizeof(struct tunnel_msg))) {
++ NL_SET_ERR_MSG(cb->extack, "Invalid msg length");
++ return -EINVAL;
++ }
++
+ tmsg = nlmsg_data(cb->nlh);
+
+ if (tmsg->flags & ~TUNNEL_MSG_VALID_USER_FLAGS) {
+--
+2.39.5
+
--- /dev/null
+From bba00c467ad593cb39e3fcca7e2ea6567b28f38c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Oct 2024 17:16:25 +0530
+Subject: wifi: ath11k: Fix unexpected return buffer manager error for
+ WCN6750/WCN6855
+
+From: Balaji Pothunoori <quic_bpothuno@quicinc.com>
+
+[ Upstream commit 78e154d42f2c72905fe66a400847e1b2b101b7b2 ]
+
+The following error messages were encountered while parsing fragmented RX
+packets for WCN6750/WCN6855:
+
+ath11k 17a10040.wifi: invalid return buffer manager 4
+
+This issue arose due to a hardcoded check for HAL_RX_BUF_RBM_SW3_BM
+introduced in 'commit 71c748b5e01e ("ath11k: Fix unexpected return buffer
+manager error for QCA6390")'
+
+For WCN6750 and WCN6855, the return buffer manager ID should be
+HAL_RX_BUF_RBM_SW1_BM. The incorrect conditional check caused fragmented
+packets to be dropped, resulting in the above error log.
+
+Fix this by adding a check for HAL_RX_BUF_RBM_SW1_BM.
+
+Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.2.0.c2-00258-QCAMSLSWPL-1
+Tested-on: WCN6855 hw2.1 WLAN.HSP.1.1-04479-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1
+
+Fixes: 71c748b5e01e ("ath11k: Fix unexpected return buffer manager error for QCA6390")
+Signed-off-by: Balaji Pothunoori <quic_bpothuno@quicinc.com>
+Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Acked-by: Kalle Valo <kvalo@kernel.org>
+Link: https://patch.msgid.link/20241030114625.2416942-1-quic_bpothuno@quicinc.com
+Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 1 +
+ drivers/net/wireless/ath/ath11k/hal_rx.c | 3 ++-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c
+index d01616d06a326..2f6b22708b53f 100644
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -3795,6 +3795,7 @@ int ath11k_dp_process_rx_err(struct ath11k_base *ab, struct napi_struct *napi,
+ ath11k_hal_rx_msdu_link_info_get(link_desc_va, &num_msdus, msdu_cookies,
+ &rbm);
+ if (rbm != HAL_RX_BUF_RBM_WBM_IDLE_DESC_LIST &&
++ rbm != HAL_RX_BUF_RBM_SW1_BM &&
+ rbm != HAL_RX_BUF_RBM_SW3_BM) {
+ ab->soc_stats.invalid_rbm++;
+ ath11k_warn(ab, "invalid return buffer manager %d\n", rbm);
+diff --git a/drivers/net/wireless/ath/ath11k/hal_rx.c b/drivers/net/wireless/ath/ath11k/hal_rx.c
+index 7f39c6fb7408c..d1785e71ffc98 100644
+--- a/drivers/net/wireless/ath/ath11k/hal_rx.c
++++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
+@@ -371,7 +371,8 @@ int ath11k_hal_wbm_desc_parse_err(struct ath11k_base *ab, void *desc,
+
+ ret_buf_mgr = FIELD_GET(BUFFER_ADDR_INFO1_RET_BUF_MGR,
+ wbm_desc->buf_addr_info.info1);
+- if (ret_buf_mgr != HAL_RX_BUF_RBM_SW3_BM) {
++ if (ret_buf_mgr != HAL_RX_BUF_RBM_SW1_BM &&
++ ret_buf_mgr != HAL_RX_BUF_RBM_SW3_BM) {
+ ab->soc_stats.invalid_rbm++;
+ return -EINVAL;
+ }
+--
+2.39.5
+
--- /dev/null
+From b3873793c8fe17829c3f8ced1c6c04be5db07974 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2025 18:54:17 +0300
+Subject: wifi: cfg80211: adjust allocation of colocated AP data
+
+From: Dmitry Antipov <dmantipov@yandex.ru>
+
+[ Upstream commit 1a0d24775cdee2b8dc14bfa4f4418c930ab1ac57 ]
+
+In 'cfg80211_scan_6ghz()', an instances of 'struct cfg80211_colocated_ap'
+are allocated as if they would have 'ssid' as trailing VLA member. Since
+this is not so, extra IEEE80211_MAX_SSID_LEN bytes are not needed.
+Briefly tested with KUnit.
+
+Fixes: c8cb5b854b40 ("nl80211/cfg80211: support 6 GHz scanning")
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Link: https://patch.msgid.link/20250113155417.552587-1-dmantipov@yandex.ru
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/scan.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/net/wireless/scan.c b/net/wireless/scan.c
+index 42514768bcb10..810293f160a8c 100644
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -824,9 +824,7 @@ static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev)
+ if (ret)
+ continue;
+
+- entry = kzalloc(sizeof(*entry) + IEEE80211_MAX_SSID_LEN,
+- GFP_ATOMIC);
+-
++ entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
+ if (!entry)
+ continue;
+
+--
+2.39.5
+
--- /dev/null
+From 9e3a327152a30abc235329ff824d4f4d206edd9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Sep 2023 17:35:30 +0300
+Subject: wifi: cfg80211: Handle specific BSSID in 6GHz scanning
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit 0fca7784b7a14d4ede64f479662afb98876ec7f8 ]
+
+When the scan parameters for a 6GHz scan specify a unicast
+BSSID address, and the corresponding AP is found in the scan
+list, add a corresponding entry in the collocated AP list,
+so this AP would be directly probed even if it was not
+advertised as a collocated AP.
+
+This is needed for handling a scan request that is intended
+for a ML probe flow, where user space can requests a scan
+to retrieve information for other links in the AP MLD.
+
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230928172905.54b954bc02ad.I1c072793d3d77a4c8fbbc64b4db5cce1bbb00382@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Stable-dep-of: 1a0d24775cde ("wifi: cfg80211: adjust allocation of colocated AP data")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/scan.c | 37 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+
+diff --git a/net/wireless/scan.c b/net/wireless/scan.c
+index 398b6bab4b60e..42514768bcb10 100644
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -799,10 +799,47 @@ static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev)
+ list_for_each_entry(intbss, &rdev->bss_list, list) {
+ struct cfg80211_bss *res = &intbss->pub;
+ const struct cfg80211_bss_ies *ies;
++ const struct element *ssid_elem;
++ struct cfg80211_colocated_ap *entry;
++ u32 s_ssid_tmp;
++ int ret;
+
+ ies = rcu_access_pointer(res->ies);
+ count += cfg80211_parse_colocated_ap(ies,
+ &coloc_ap_list);
++
++ /* In case the scan request specified a specific BSSID
++ * and the BSS is found and operating on 6GHz band then
++ * add this AP to the collocated APs list.
++ * This is relevant for ML probe requests when the lower
++ * band APs have not been discovered.
++ */
++ if (is_broadcast_ether_addr(rdev_req->bssid) ||
++ !ether_addr_equal(rdev_req->bssid, res->bssid) ||
++ res->channel->band != NL80211_BAND_6GHZ)
++ continue;
++
++ ret = cfg80211_calc_short_ssid(ies, &ssid_elem,
++ &s_ssid_tmp);
++ if (ret)
++ continue;
++
++ entry = kzalloc(sizeof(*entry) + IEEE80211_MAX_SSID_LEN,
++ GFP_ATOMIC);
++
++ if (!entry)
++ continue;
++
++ memcpy(entry->bssid, res->bssid, ETH_ALEN);
++ entry->short_ssid = s_ssid_tmp;
++ memcpy(entry->ssid, ssid_elem->data,
++ ssid_elem->datalen);
++ entry->ssid_len = ssid_elem->datalen;
++ entry->short_ssid_valid = true;
++ entry->center_freq = res->channel->center_freq;
++
++ list_add_tail(&entry->list, &coloc_ap_list);
++ count++;
+ }
+ spin_unlock_bh(&rdev->bss_lock);
+ }
+--
+2.39.5
+
--- /dev/null
+From e6fd958ba35e83685601f479dc3d003c25ddaef2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jan 2025 16:20:00 +0200
+Subject: wifi: mac80211: Fix common size calculation for ML element
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit 19aa842dcbb5860509b7e1b7745dbae0b791f6c4 ]
+
+When the ML type is EPCS the control bitmap is reserved, the length
+is always 7 and is captured by the 1st octet after the control.
+
+Fixes: 0f48b8b88aa9 ("wifi: ieee80211: add definitions for multi-link element")
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250102161730.5790376754a7.I381208cbb72b1be2a88239509294099e9337e254@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/ieee80211.h | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
+index 160230bb1a9ce..8e00918b15b49 100644
+--- a/include/linux/ieee80211.h
++++ b/include/linux/ieee80211.h
+@@ -4571,28 +4571,24 @@ static inline u8 ieee80211_mle_common_size(const u8 *data)
+ {
+ const struct ieee80211_multi_link_elem *mle = (const void *)data;
+ u16 control = le16_to_cpu(mle->control);
+- u8 common = 0;
+
+ switch (u16_get_bits(control, IEEE80211_ML_CONTROL_TYPE)) {
+ case IEEE80211_ML_CONTROL_TYPE_BASIC:
+ case IEEE80211_ML_CONTROL_TYPE_PREQ:
+ case IEEE80211_ML_CONTROL_TYPE_TDLS:
+ case IEEE80211_ML_CONTROL_TYPE_RECONF:
++ case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS:
+ /*
+ * The length is the first octet pointed by mle->variable so no
+ * need to add anything
+ */
+ break;
+- case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS:
+- if (control & IEEE80211_MLC_PRIO_ACCESS_PRES_AP_MLD_MAC_ADDR)
+- common += ETH_ALEN;
+- return common;
+ default:
+ WARN_ON(1);
+ return 0;
+ }
+
+- return sizeof(*mle) + common + mle->variable[0];
++ return sizeof(*mle) + mle->variable[0];
+ }
+
+ /**
+@@ -4645,8 +4641,7 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, u8 len)
+ check_common_len = true;
+ break;
+ case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS:
+- if (control & IEEE80211_MLC_PRIO_ACCESS_PRES_AP_MLD_MAC_ADDR)
+- common += ETH_ALEN;
++ common = ETH_ALEN + 1;
+ break;
+ default:
+ /* we don't know this type */
+--
+2.39.5
+
--- /dev/null
+From d44e5a8567e48c62c9c569f440749f019ffede2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Dec 2024 09:14:07 +0100
+Subject: wifi: mac80211: prohibit deactivating all links
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 7553477cbfd784b128297f9ed43751688415bbaa ]
+
+In the internal API this calls this is a WARN_ON, but that
+should remain since internally we want to know about bugs
+that may cause this. Prevent deactivating all links in the
+debugfs write directly.
+
+Reported-by: syzbot+0c5d8e65f23569a8ffec@syzkaller.appspotmail.com
+Fixes: 3d9011029227 ("wifi: mac80211: implement link switching")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Link: https://patch.msgid.link/20241230091408.505bd125c35a.Ic3c1f9572b980a952a444cad62b09b9c6721732b@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/debugfs_netdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
+index 8ced615add712..f8416965c2198 100644
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -588,7 +588,7 @@ static ssize_t ieee80211_if_parse_active_links(struct ieee80211_sub_if_data *sda
+ {
+ u16 active_links;
+
+- if (kstrtou16(buf, 0, &active_links))
++ if (kstrtou16(buf, 0, &active_links) || !active_links)
+ return -EINVAL;
+
+ return ieee80211_set_active_links(&sdata->vif, active_links) ?: buflen;
+--
+2.39.5
+
--- /dev/null
+From 89dbd781ce984f8e1d2d4a09f56f12ed927f237b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Nov 2022 16:40:35 +0100
+Subject: wifi: mt76: add WED RX support to mt76_dma_{add,get}_buf
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit cd372b8c99c5a5cf6a464acebb7e4a79af7ec8ae ]
+
+Introduce the capability to configure RX WED in mt76_dma_{add,get}_buf
+utility routines.
+
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Co-developed-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Stable-dep-of: aa566ac6b727 ("wifi: mt76: mt7921: fix using incorrect group cipher after disconnection.")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/dma.c | 125 +++++++++++++++-------
+ drivers/net/wireless/mediatek/mt76/mt76.h | 2 +
+ 2 files changed, 88 insertions(+), 39 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
+index 25e110852e1f2..5c626249d4d90 100644
+--- a/drivers/net/wireless/mediatek/mt76/dma.c
++++ b/drivers/net/wireless/mediatek/mt76/dma.c
+@@ -215,11 +215,6 @@ mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
+ u32 ctrl;
+ int i, idx = -1;
+
+- if (txwi) {
+- q->entry[q->head].txwi = DMA_DUMMY_DATA;
+- q->entry[q->head].skip_buf0 = true;
+- }
+-
+ for (i = 0; i < nbufs; i += 2, buf += 2) {
+ u32 buf0 = buf[0].addr, buf1 = 0;
+
+@@ -229,28 +224,48 @@ mt76_dma_add_buf(struct mt76_dev *dev, struct mt76_queue *q,
+ desc = &q->desc[idx];
+ entry = &q->entry[idx];
+
+- if (buf[0].skip_unmap)
+- entry->skip_buf0 = true;
+- entry->skip_buf1 = i == nbufs - 1;
+-
+- entry->dma_addr[0] = buf[0].addr;
+- entry->dma_len[0] = buf[0].len;
+-
+- ctrl = FIELD_PREP(MT_DMA_CTL_SD_LEN0, buf[0].len);
+- if (i < nbufs - 1) {
+- entry->dma_addr[1] = buf[1].addr;
+- entry->dma_len[1] = buf[1].len;
+- buf1 = buf[1].addr;
+- ctrl |= FIELD_PREP(MT_DMA_CTL_SD_LEN1, buf[1].len);
+- if (buf[1].skip_unmap)
+- entry->skip_buf1 = true;
++ if ((q->flags & MT_QFLAG_WED) &&
++ FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
++ struct mt76_txwi_cache *t = txwi;
++ int rx_token;
++
++ if (!t)
++ return -ENOMEM;
++
++ rx_token = mt76_rx_token_consume(dev, (void *)skb, t,
++ buf[0].addr);
++ buf1 |= FIELD_PREP(MT_DMA_CTL_TOKEN, rx_token);
++ ctrl = FIELD_PREP(MT_DMA_CTL_SD_LEN0, buf[0].len) |
++ MT_DMA_CTL_TO_HOST;
++ } else {
++ if (txwi) {
++ q->entry[q->head].txwi = DMA_DUMMY_DATA;
++ q->entry[q->head].skip_buf0 = true;
++ }
++
++ if (buf[0].skip_unmap)
++ entry->skip_buf0 = true;
++ entry->skip_buf1 = i == nbufs - 1;
++
++ entry->dma_addr[0] = buf[0].addr;
++ entry->dma_len[0] = buf[0].len;
++
++ ctrl = FIELD_PREP(MT_DMA_CTL_SD_LEN0, buf[0].len);
++ if (i < nbufs - 1) {
++ entry->dma_addr[1] = buf[1].addr;
++ entry->dma_len[1] = buf[1].len;
++ buf1 = buf[1].addr;
++ ctrl |= FIELD_PREP(MT_DMA_CTL_SD_LEN1, buf[1].len);
++ if (buf[1].skip_unmap)
++ entry->skip_buf1 = true;
++ }
++
++ if (i == nbufs - 1)
++ ctrl |= MT_DMA_CTL_LAST_SEC0;
++ else if (i == nbufs - 2)
++ ctrl |= MT_DMA_CTL_LAST_SEC1;
+ }
+
+- if (i == nbufs - 1)
+- ctrl |= MT_DMA_CTL_LAST_SEC0;
+- else if (i == nbufs - 2)
+- ctrl |= MT_DMA_CTL_LAST_SEC1;
+-
+ WRITE_ONCE(desc->buf0, cpu_to_le32(buf0));
+ WRITE_ONCE(desc->buf1, cpu_to_le32(buf1));
+ WRITE_ONCE(desc->info, cpu_to_le32(info));
+@@ -339,33 +354,60 @@ mt76_dma_tx_cleanup(struct mt76_dev *dev, struct mt76_queue *q, bool flush)
+
+ static void *
+ mt76_dma_get_buf(struct mt76_dev *dev, struct mt76_queue *q, int idx,
+- int *len, u32 *info, bool *more)
++ int *len, u32 *info, bool *more, bool *drop)
+ {
+ struct mt76_queue_entry *e = &q->entry[idx];
+ struct mt76_desc *desc = &q->desc[idx];
+- dma_addr_t buf_addr;
+- void *buf = e->buf;
+- int buf_len = SKB_WITH_OVERHEAD(q->buf_size);
++ void *buf;
+
+- buf_addr = e->dma_addr[0];
+ if (len) {
+- u32 ctl = le32_to_cpu(READ_ONCE(desc->ctrl));
+- *len = FIELD_GET(MT_DMA_CTL_SD_LEN0, ctl);
+- *more = !(ctl & MT_DMA_CTL_LAST_SEC0);
++ u32 ctrl = le32_to_cpu(READ_ONCE(desc->ctrl));
++ *len = FIELD_GET(MT_DMA_CTL_SD_LEN0, ctrl);
++ *more = !(ctrl & MT_DMA_CTL_LAST_SEC0);
+ }
+
+ if (info)
+ *info = le32_to_cpu(desc->info);
+
+- dma_unmap_single(dev->dma_dev, buf_addr, buf_len, DMA_FROM_DEVICE);
+- e->buf = NULL;
++ if ((q->flags & MT_QFLAG_WED) &&
++ FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) == MT76_WED_Q_RX) {
++ u32 token = FIELD_GET(MT_DMA_CTL_TOKEN,
++ le32_to_cpu(desc->buf1));
++ struct mt76_txwi_cache *t = mt76_rx_token_release(dev, token);
++
++ if (!t)
++ return NULL;
++
++ dma_unmap_single(dev->dma_dev, t->dma_addr,
++ SKB_WITH_OVERHEAD(q->buf_size),
++ DMA_FROM_DEVICE);
++
++ buf = t->ptr;
++ t->dma_addr = 0;
++ t->ptr = NULL;
++
++ mt76_put_rxwi(dev, t);
++
++ if (drop) {
++ u32 ctrl = le32_to_cpu(READ_ONCE(desc->ctrl));
++
++ *drop = !!(ctrl & (MT_DMA_CTL_TO_HOST_A |
++ MT_DMA_CTL_DROP));
++ }
++ } else {
++ buf = e->buf;
++ e->buf = NULL;
++ dma_unmap_single(dev->dma_dev, e->dma_addr[0],
++ SKB_WITH_OVERHEAD(q->buf_size),
++ DMA_FROM_DEVICE);
++ }
+
+ return buf;
+ }
+
+ static void *
+ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
+- int *len, u32 *info, bool *more)
++ int *len, u32 *info, bool *more, bool *drop)
+ {
+ int idx = q->tail;
+
+@@ -381,7 +423,7 @@ mt76_dma_dequeue(struct mt76_dev *dev, struct mt76_queue *q, bool flush,
+ q->tail = (q->tail + 1) % q->ndesc;
+ q->queued--;
+
+- return mt76_dma_get_buf(dev, q, idx, len, info, more);
++ return mt76_dma_get_buf(dev, q, idx, len, info, more, drop);
+ }
+
+ static int
+@@ -644,7 +686,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
+ spin_lock_bh(&q->lock);
+
+ do {
+- buf = mt76_dma_dequeue(dev, q, true, NULL, NULL, &more);
++ buf = mt76_dma_dequeue(dev, q, true, NULL, NULL, &more, NULL);
+ if (!buf)
+ break;
+
+@@ -726,6 +768,7 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+ }
+
+ while (done < budget) {
++ bool drop = false;
+ u32 info;
+
+ if (check_ddone) {
+@@ -736,10 +779,14 @@ mt76_dma_rx_process(struct mt76_dev *dev, struct mt76_queue *q, int budget)
+ break;
+ }
+
+- data = mt76_dma_dequeue(dev, q, false, &len, &info, &more);
++ data = mt76_dma_dequeue(dev, q, false, &len, &info, &more,
++ &drop);
+ if (!data)
+ break;
+
++ if (drop)
++ goto free_frag;
++
+ if (q->rx_head)
+ data_len = q->buf_size;
+ else
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
+index a8c281a3951a4..3873c5ad75174 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76.h
++++ b/drivers/net/wireless/mediatek/mt76/mt76.h
+@@ -35,6 +35,7 @@
+ FIELD_PREP(MT_QFLAG_WED_TYPE, _type) | \
+ FIELD_PREP(MT_QFLAG_WED_RING, _n))
+ #define MT_WED_Q_TX(_n) __MT_WED_Q(MT76_WED_Q_TX, _n)
++#define MT_WED_Q_RX(_n) __MT_WED_Q(MT76_WED_Q_RX, _n)
+ #define MT_WED_Q_TXFREE __MT_WED_Q(MT76_WED_Q_TXFREE, 0)
+
+ struct mt76_dev;
+@@ -56,6 +57,7 @@ enum mt76_bus_type {
+ enum mt76_wed_type {
+ MT76_WED_Q_TX,
+ MT76_WED_Q_TXFREE,
++ MT76_WED_Q_RX,
+ };
+
+ struct mt76_bus_ops {
+--
+2.39.5
+
--- /dev/null
+From c5205bb7fcb7102ec9f99b80530f6b05a3951450 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Nov 2022 17:35:22 +0800
+Subject: wifi: mt76: connac: add more bss info command tags
+
+From: Shayne Chen <shayne.chen@mediatek.com>
+
+[ Upstream commit 9c402ac1c517907ae375d71dd2fee4703efc8bb4 ]
+
+Add bss info tags which will be used in new chipset.
+This is a preliminary patch to add mt7996 chipset support.
+
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Stable-dep-of: aa566ac6b727 ("wifi: mt76: mt7921: fix using incorrect group cipher after disconnection.")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
+index e04f98d443261..a3162fbda14dc 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
+@@ -1212,14 +1212,23 @@ enum {
+
+ enum {
+ UNI_BSS_INFO_BASIC = 0,
++ UNI_BSS_INFO_RA = 1,
+ UNI_BSS_INFO_RLM = 2,
+ UNI_BSS_INFO_BSS_COLOR = 4,
+ UNI_BSS_INFO_HE_BASIC = 5,
+ UNI_BSS_INFO_BCN_CONTENT = 7,
++ UNI_BSS_INFO_BCN_CSA = 8,
++ UNI_BSS_INFO_BCN_BCC = 9,
++ UNI_BSS_INFO_BCN_MBSSID = 10,
++ UNI_BSS_INFO_RATE = 11,
+ UNI_BSS_INFO_QBSS = 15,
++ UNI_BSS_INFO_SEC = 16,
++ UNI_BSS_INFO_TXCMD = 18,
+ UNI_BSS_INFO_UAPSD = 19,
+ UNI_BSS_INFO_PS = 21,
+ UNI_BSS_INFO_BCNFT = 22,
++ UNI_BSS_INFO_OFFLOAD = 25,
++ UNI_BSS_INFO_MLD = 26,
+ };
+
+ enum {
+--
+2.39.5
+
--- /dev/null
+From d6097b6a5f269c626a56d42f10371fb1ab34e1fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Nov 2022 17:35:21 +0800
+Subject: wifi: mt76: connac: introduce unified event table
+
+From: Shayne Chen <shayne.chen@mediatek.com>
+
+[ Upstream commit ec361f7e415297dc07254e93ac6af1dbce4af87b ]
+
+Add event IDs and related bit fields for unified event support.
+This is a preliminary patch to add mt7996 chipset support.
+
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Stable-dep-of: aa566ac6b727 ("wifi: mt76: mt7921: fix using incorrect group cipher after disconnection.")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
+index 718f427d8f6b2..e04f98d443261 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
+@@ -981,6 +981,17 @@ enum {
+ MCU_EXT_EVENT_MURU_CTRL = 0x9f,
+ };
+
++/* unified event table */
++enum {
++ MCU_UNI_EVENT_RESULT = 0x01,
++ MCU_UNI_EVENT_FW_LOG_2_HOST = 0x04,
++ MCU_UNI_EVENT_IE_COUNTDOWN = 0x09,
++ MCU_UNI_EVENT_RDD_REPORT = 0x11,
++};
++
++#define MCU_UNI_CMD_EVENT BIT(1)
++#define MCU_UNI_CMD_UNSOLICITED_EVENT BIT(2)
++
+ enum {
+ MCU_Q_QUERY,
+ MCU_Q_SET,
+--
+2.39.5
+
--- /dev/null
+From 566d7640bf25b99ac90175adf8cc36d6ab087060 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Nov 2022 16:40:34 +0100
+Subject: wifi: mt76: introduce rxwi and rx token utility routines
+
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+
+[ Upstream commit 2666bece0905a3e8ccb792602dbc76a63aaafe4b ]
+
+This is a preliminary patch to introduce WED RX support for mt7915.
+
+Tested-by: Daniel Golle <daniel@makrotopia.org>
+Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Stable-dep-of: aa566ac6b727 ("wifi: mt76: mt7921: fix using incorrect group cipher after disconnection.")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/dma.c | 68 +++++++++++++++++++
+ drivers/net/wireless/mediatek/mt76/dma.h | 8 +++
+ drivers/net/wireless/mediatek/mt76/mac80211.c | 5 ++
+ drivers/net/wireless/mediatek/mt76/mt76.h | 16 ++++-
+ drivers/net/wireless/mediatek/mt76/tx.c | 30 ++++++++
+ 5 files changed, 126 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
+index c406cb1a102ff..25e110852e1f2 100644
+--- a/drivers/net/wireless/mediatek/mt76/dma.c
++++ b/drivers/net/wireless/mediatek/mt76/dma.c
+@@ -59,6 +59,19 @@ mt76_alloc_txwi(struct mt76_dev *dev)
+ return t;
+ }
+
++static struct mt76_txwi_cache *
++mt76_alloc_rxwi(struct mt76_dev *dev)
++{
++ struct mt76_txwi_cache *t;
++
++ t = kzalloc(L1_CACHE_ALIGN(sizeof(*t)), GFP_ATOMIC);
++ if (!t)
++ return NULL;
++
++ t->ptr = NULL;
++ return t;
++}
++
+ static struct mt76_txwi_cache *
+ __mt76_get_txwi(struct mt76_dev *dev)
+ {
+@@ -75,6 +88,22 @@ __mt76_get_txwi(struct mt76_dev *dev)
+ return t;
+ }
+
++static struct mt76_txwi_cache *
++__mt76_get_rxwi(struct mt76_dev *dev)
++{
++ struct mt76_txwi_cache *t = NULL;
++
++ spin_lock(&dev->wed_lock);
++ if (!list_empty(&dev->rxwi_cache)) {
++ t = list_first_entry(&dev->rxwi_cache, struct mt76_txwi_cache,
++ list);
++ list_del(&t->list);
++ }
++ spin_unlock(&dev->wed_lock);
++
++ return t;
++}
++
+ static struct mt76_txwi_cache *
+ mt76_get_txwi(struct mt76_dev *dev)
+ {
+@@ -86,6 +115,18 @@ mt76_get_txwi(struct mt76_dev *dev)
+ return mt76_alloc_txwi(dev);
+ }
+
++struct mt76_txwi_cache *
++mt76_get_rxwi(struct mt76_dev *dev)
++{
++ struct mt76_txwi_cache *t = __mt76_get_rxwi(dev);
++
++ if (t)
++ return t;
++
++ return mt76_alloc_rxwi(dev);
++}
++EXPORT_SYMBOL_GPL(mt76_get_rxwi);
++
+ void
+ mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
+ {
+@@ -98,6 +139,18 @@ mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
+ }
+ EXPORT_SYMBOL_GPL(mt76_put_txwi);
+
++void
++mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t)
++{
++ if (!t)
++ return;
++
++ spin_lock(&dev->wed_lock);
++ list_add(&t->list, &dev->rxwi_cache);
++ spin_unlock(&dev->wed_lock);
++}
++EXPORT_SYMBOL_GPL(mt76_put_rxwi);
++
+ static void
+ mt76_free_pending_txwi(struct mt76_dev *dev)
+ {
+@@ -112,6 +165,20 @@ mt76_free_pending_txwi(struct mt76_dev *dev)
+ local_bh_enable();
+ }
+
++static void
++mt76_free_pending_rxwi(struct mt76_dev *dev)
++{
++ struct mt76_txwi_cache *t;
++
++ local_bh_disable();
++ while ((t = __mt76_get_rxwi(dev)) != NULL) {
++ if (t->ptr)
++ skb_free_frag(t->ptr);
++ kfree(t);
++ }
++ local_bh_enable();
++}
++
+ static void
+ mt76_dma_sync_idx(struct mt76_dev *dev, struct mt76_queue *q)
+ {
+@@ -811,6 +878,7 @@ void mt76_dma_cleanup(struct mt76_dev *dev)
+ }
+
+ mt76_free_pending_txwi(dev);
++ mt76_free_pending_rxwi(dev);
+
+ if (mtk_wed_device_active(&dev->mmio.wed))
+ mtk_wed_device_detach(&dev->mmio.wed);
+diff --git a/drivers/net/wireless/mediatek/mt76/dma.h b/drivers/net/wireless/mediatek/mt76/dma.h
+index fdf786f975ea3..53c6ce2528b2f 100644
+--- a/drivers/net/wireless/mediatek/mt76/dma.h
++++ b/drivers/net/wireless/mediatek/mt76/dma.h
+@@ -15,6 +15,14 @@
+ #define MT_DMA_CTL_SD_LEN0 GENMASK(29, 16)
+ #define MT_DMA_CTL_LAST_SEC0 BIT(30)
+ #define MT_DMA_CTL_DMA_DONE BIT(31)
++#define MT_DMA_CTL_TO_HOST BIT(8)
++#define MT_DMA_CTL_TO_HOST_A BIT(12)
++#define MT_DMA_CTL_DROP BIT(14)
++#define MT_DMA_CTL_TOKEN GENMASK(31, 16)
++
++#define MT_DMA_PPE_CPU_REASON GENMASK(15, 11)
++#define MT_DMA_PPE_ENTRY GENMASK(30, 16)
++#define MT_DMA_INFO_PPE_VLD BIT(31)
+
+ #define MT_DMA_HDR_LEN 4
+ #define MT_RX_INFO_LEN 4
+diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
+index 82fce4b1d581b..8eb02167ba2cb 100644
+--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
++++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
+@@ -572,6 +572,7 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
+ spin_lock_init(&dev->lock);
+ spin_lock_init(&dev->cc_lock);
+ spin_lock_init(&dev->status_lock);
++ spin_lock_init(&dev->wed_lock);
+ mutex_init(&dev->mutex);
+ init_waitqueue_head(&dev->tx_wait);
+
+@@ -594,9 +595,13 @@ mt76_alloc_device(struct device *pdev, unsigned int size,
+ spin_lock_init(&dev->token_lock);
+ idr_init(&dev->token);
+
++ spin_lock_init(&dev->rx_token_lock);
++ idr_init(&dev->rx_token);
++
+ INIT_LIST_HEAD(&dev->wcid_list);
+
+ INIT_LIST_HEAD(&dev->txwi_cache);
++ INIT_LIST_HEAD(&dev->rxwi_cache);
+ dev->token_size = dev->drv->token_size;
+
+ for (i = 0; i < ARRAY_SIZE(dev->q_rx); i++)
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
+index 5b03e3b33d546..a8c281a3951a4 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76.h
++++ b/drivers/net/wireless/mediatek/mt76/mt76.h
+@@ -339,7 +339,10 @@ struct mt76_txwi_cache {
+ struct list_head list;
+ dma_addr_t dma_addr;
+
+- struct sk_buff *skb;
++ union {
++ struct sk_buff *skb;
++ void *ptr;
++ };
+ };
+
+ struct mt76_rx_tid {
+@@ -738,6 +741,7 @@ struct mt76_dev {
+
+ struct ieee80211_hw *hw;
+
++ spinlock_t wed_lock;
+ spinlock_t lock;
+ spinlock_t cc_lock;
+
+@@ -764,6 +768,7 @@ struct mt76_dev {
+ struct sk_buff_head rx_skb[__MT_RXQ_MAX];
+
+ struct list_head txwi_cache;
++ struct list_head rxwi_cache;
+ struct mt76_queue *q_mcu[__MT_MCUQ_MAX];
+ struct mt76_queue q_rx[__MT_RXQ_MAX];
+ const struct mt76_queue_ops *queue_ops;
+@@ -778,6 +783,10 @@ struct mt76_dev {
+ u16 token_count;
+ u16 token_size;
+
++ spinlock_t rx_token_lock;
++ struct idr rx_token;
++ u16 rx_token_size;
++
+ wait_queue_head_t tx_wait;
+ /* spinclock used to protect wcid pktid linked list */
+ spinlock_t status_lock;
+@@ -1262,6 +1271,8 @@ mt76_tx_status_get_hw(struct mt76_dev *dev, struct sk_buff *skb)
+ }
+
+ void mt76_put_txwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
++void mt76_put_rxwi(struct mt76_dev *dev, struct mt76_txwi_cache *t);
++struct mt76_txwi_cache *mt76_get_rxwi(struct mt76_dev *dev);
+ void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
+ struct napi_struct *napi);
+ void mt76_rx_poll_complete(struct mt76_dev *dev, enum mt76_rxq_id q,
+@@ -1406,6 +1417,9 @@ struct mt76_txwi_cache *
+ mt76_token_release(struct mt76_dev *dev, int token, bool *wake);
+ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi);
+ void __mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked);
++struct mt76_txwi_cache *mt76_rx_token_release(struct mt76_dev *dev, int token);
++int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
++ struct mt76_txwi_cache *r, dma_addr_t phys);
+
+ static inline void mt76_set_tx_blocked(struct mt76_dev *dev, bool blocked)
+ {
+diff --git a/drivers/net/wireless/mediatek/mt76/tx.c b/drivers/net/wireless/mediatek/mt76/tx.c
+index 4482e4ff78044..f265a5f80c50e 100644
+--- a/drivers/net/wireless/mediatek/mt76/tx.c
++++ b/drivers/net/wireless/mediatek/mt76/tx.c
+@@ -760,6 +760,23 @@ int mt76_token_consume(struct mt76_dev *dev, struct mt76_txwi_cache **ptxwi)
+ }
+ EXPORT_SYMBOL_GPL(mt76_token_consume);
+
++int mt76_rx_token_consume(struct mt76_dev *dev, void *ptr,
++ struct mt76_txwi_cache *t, dma_addr_t phys)
++{
++ int token;
++
++ spin_lock_bh(&dev->rx_token_lock);
++ token = idr_alloc(&dev->rx_token, t, 0, dev->rx_token_size,
++ GFP_ATOMIC);
++ spin_unlock_bh(&dev->rx_token_lock);
++
++ t->ptr = ptr;
++ t->dma_addr = phys;
++
++ return token;
++}
++EXPORT_SYMBOL_GPL(mt76_rx_token_consume);
++
+ struct mt76_txwi_cache *
+ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
+ {
+@@ -788,3 +805,16 @@ mt76_token_release(struct mt76_dev *dev, int token, bool *wake)
+ return txwi;
+ }
+ EXPORT_SYMBOL_GPL(mt76_token_release);
++
++struct mt76_txwi_cache *
++mt76_rx_token_release(struct mt76_dev *dev, int token)
++{
++ struct mt76_txwi_cache *t;
++
++ spin_lock_bh(&dev->rx_token_lock);
++ t = idr_remove(&dev->rx_token, token);
++ spin_unlock_bh(&dev->rx_token_lock);
++
++ return t;
++}
++EXPORT_SYMBOL_GPL(mt76_rx_token_release);
+--
+2.39.5
+
--- /dev/null
+From c4ec5a4e67636e00506bf36532aeb63ec8674958 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2025 15:02:41 +0800
+Subject: wifi: mt76: mt76u_vendor_request: Do not print error messages when
+ -EPROTO
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: WangYuli <wangyuli@uniontech.com>
+
+[ Upstream commit f1b1e133a770fcdbd89551651232b034d2f7a27a ]
+
+When initializing the network card, unplugging the device will
+trigger an -EPROTO error, resulting in a flood of error messages
+being printed frantically.
+
+The exception is printed as follows：
+
+ mt76x2u 2-2.4:1.0: vendor request req:47 off:9018 failed:-71
+ mt76x2u 2-2.4:1.0: vendor request req:47 off:9018 failed:-71
+ ...
+
+It will continue to print more than 2000 times for about 5 minutes,
+causing the usb device to be unable to be disconnected. During this
+period, the usb port cannot recognize the new device because the old
+device has not disconnected.
+
+There may be other operating methods that cause -EPROTO, but -EPROTO is
+a low-level hardware error. It is unwise to repeat vendor requests
+expecting to read correct data. It is a better choice to treat -EPROTO
+and -ENODEV the same way.
+
+Similar to commit 9b0f100c1970 ("mt76: usb: process URBs with status
+EPROTO properly") do no schedule rx_worker for urb marked with status
+set -EPROTO. I also reproduced this situation when plugging and
+unplugging the device, and this patch is effective.
+
+Just do not vendor request again for urb marked with status set -EPROTO.
+
+Link: https://lore.kernel.org/all/531681bd-30f5-4a70-a156-bf8754b8e072@intel.com/
+Link: https://lore.kernel.org/all/D4B9CC1FFC0CBAC3+20250105040607.154706-1-wangyuli@uniontech.com/
+Fixes: b40b15e1521f ("mt76: add usb support to mt76 layer")
+Co-developed-by: Xu Rao <raoxu@uniontech.com>
+Signed-off-by: Xu Rao <raoxu@uniontech.com>
+Signed-off-by: WangYuli <wangyuli@uniontech.com>
+Link: https://patch.msgid.link/9DD7DE7AAB497CB7+20250113070241.63590-1-wangyuli@uniontech.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/usb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c
+index 0597df2729a62..1e2133670291c 100644
+--- a/drivers/net/wireless/mediatek/mt76/usb.c
++++ b/drivers/net/wireless/mediatek/mt76/usb.c
+@@ -33,9 +33,9 @@ int __mt76u_vendor_request(struct mt76_dev *dev, u8 req, u8 req_type,
+
+ ret = usb_control_msg(udev, pipe, req, req_type, val,
+ offset, buf, len, MT_VEND_REQ_TOUT_MS);
+- if (ret == -ENODEV)
++ if (ret == -ENODEV || ret == -EPROTO)
+ set_bit(MT76_REMOVED, &dev->phy.state);
+- if (ret >= 0 || ret == -ENODEV)
++ if (ret >= 0 || ret == -ENODEV || ret == -EPROTO)
+ return ret;
+ usleep_range(5000, 10000);
+ }
+--
+2.39.5
+
--- /dev/null
+From 3d48fe73a3a3251316d2397ce3bf296532385003 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jan 2025 19:04:35 +0800
+Subject: wifi: mt76: mt7915: fix register mapping
+
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+
+[ Upstream commit dd1649ef966bb87053c17385ea2cfd1758f5385b ]
+
+Bypass the entry when ofs is equal to dev->reg.map[i].size.
+Without this patch, it would get incorrect register mapping when the CR
+address is located at the boundary of an entry.
+
+Fixes: cd4c314a65d3 ("mt76: mt7915: refine register definition")
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: Shengyu Qu <wiagn233@outlook.com>
+Link: https://patch.msgid.link/OSZPR01MB843401EAA1DA6BD7AEF356F298132@OSZPR01MB8434.jpnprd01.prod.outlook.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/mmio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c
+index bc68ede64ddbb..74f5321611c45 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c
+@@ -423,7 +423,7 @@ static u32 __mt7915_reg_addr(struct mt7915_dev *dev, u32 addr)
+ continue;
+
+ ofs = addr - dev->reg.map[i].phys;
+- if (ofs > dev->reg.map[i].size)
++ if (ofs >= dev->reg.map[i].size)
+ continue;
+
+ return dev->reg.map[i].maps + ofs;
+--
+2.39.5
+
--- /dev/null
+From 7c2eabb8cab6e3d9fe0bdae8cf209936545aa57b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Aug 2024 10:43:35 +0800
+Subject: wifi: mt76: mt7921: fix using incorrect group cipher after
+ disconnection.
+
+From: Michael Lo <michael.lo@mediatek.com>
+
+[ Upstream commit aa566ac6b7272e7ea5359cb682bdca36d2fc7e73 ]
+
+To avoid incorrect cipher after disconnection, we should
+do the key deletion process in this case.
+
+Fixes: e6db67fa871d ("wifi: mt76: ignore key disable commands")
+Signed-off-by: Michael Lo <michael.lo@mediatek.com>
+Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+Tested-by: David Ruth <druth@chromium.org>
+Reviewed-by: David Ruth <druth@chromium.org>
+Link: https://patch.msgid.link/20240801024335.12981-1-mingyen.hsieh@mediatek.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/main.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+index 172ba7199485d..5070cc23917bd 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+@@ -469,7 +469,13 @@ static int mt7921_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ } else {
+ if (idx == *wcid_keyidx)
+ *wcid_keyidx = -1;
+- goto out;
++
++ /* For security issue we don't trigger the key deletion when
++ * reassociating. But we should trigger the deletion process
++ * to avoid using incorrect cipher after disconnection,
++ */
++ if (vif->type != NL80211_IFTYPE_STATION || vif->cfg.assoc)
++ goto out;
+ }
+
+ mt76_wcid_key_setup(&dev->mt76, wcid, key);
+--
+2.39.5
+
--- /dev/null
+From 61bada776f0f6c6d158a2708837e5603a87a5ea9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2024 14:37:11 -0300
+Subject: wifi: rtlwifi: destroy workqueue at rtl_deinit_core
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit d8ece6fc3694657e4886191b32ca1690af11adda ]
+
+rtl_wq is allocated at rtl_init_core, so it makes more sense to destroy it
+at rtl_deinit_core. In the case of USB, where _rtl_usb_init does not
+require anything to be undone, that is fine. But for PCI, rtl_pci_init,
+which is called after rtl_init_core, needs to deallocate data, but only if
+it has been called.
+
+That means that destroying the workqueue needs to be done whether
+rtl_pci_init has been called or not. And since rtl_pci_deinit was doing it,
+it has to be moved out of there.
+
+It makes more sense to move it to rtl_deinit_core and have it done in both
+cases, USB and PCI.
+
+Since this is a requirement for a followup memory leak fix, mark this as
+fixing such memory leak.
+
+Fixes: 0c8173385e54 ("rtl8192ce: Add new driver")
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20241206173713.3222187-3-cascardo@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/base.c | 6 ++++++
+ drivers/net/wireless/realtek/rtlwifi/pci.c | 2 --
+ drivers/net/wireless/realtek/rtlwifi/usb.c | 5 -----
+ 3 files changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
+index e69845545f6a2..25570ec0918ef 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/base.c
++++ b/drivers/net/wireless/realtek/rtlwifi/base.c
+@@ -575,9 +575,15 @@ static void rtl_free_entries_from_ack_queue(struct ieee80211_hw *hw,
+
+ void rtl_deinit_core(struct ieee80211_hw *hw)
+ {
++ struct rtl_priv *rtlpriv = rtl_priv(hw);
++
+ rtl_c2hcmd_launcher(hw, 0);
+ rtl_free_entries_from_scan_list(hw);
+ rtl_free_entries_from_ack_queue(hw, false);
++ if (rtlpriv->works.rtl_wq) {
++ destroy_workqueue(rtlpriv->works.rtl_wq);
++ rtlpriv->works.rtl_wq = NULL;
++ }
+ }
+ EXPORT_SYMBOL_GPL(rtl_deinit_core);
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index 071537ee7165d..c44850394fd27 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -1657,8 +1657,6 @@ static void rtl_pci_deinit(struct ieee80211_hw *hw)
+ synchronize_irq(rtlpci->pdev->irq);
+ tasklet_kill(&rtlpriv->works.irq_tasklet);
+ cancel_work_sync(&rtlpriv->works.lps_change_work);
+-
+- destroy_workqueue(rtlpriv->works.rtl_wq);
+ }
+
+ static int rtl_pci_init(struct ieee80211_hw *hw, struct pci_dev *pdev)
+diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
+index 04590d16874c4..68dc0e6af6b1b 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
+@@ -679,11 +679,6 @@ static void _rtl_usb_cleanup_rx(struct ieee80211_hw *hw)
+ tasklet_kill(&rtlusb->rx_work_tasklet);
+ cancel_work_sync(&rtlpriv->works.lps_change_work);
+
+- if (rtlpriv->works.rtl_wq) {
+- destroy_workqueue(rtlpriv->works.rtl_wq);
+- rtlpriv->works.rtl_wq = NULL;
+- }
+-
+ skb_queue_purge(&rtlusb->rx_queue);
+
+ while ((urb = usb_get_from_anchor(&rtlusb->rx_cleanup_urbs))) {
+--
+2.39.5
+
--- /dev/null
+From 889431a96c8e5a8e83ef6cbddf1ddb7e292619f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 10:33:18 -0300
+Subject: wifi: rtlwifi: do not complete firmware loading needlessly
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit e73e11d303940119e41850a0452a0deda2cc4eb5 ]
+
+The only code waiting for completion is driver removal, which will not be
+called when probe returns a failure. So this completion is unnecessary.
+
+Fixes: b0302aba812b ("rtlwifi: Convert to asynchronous firmware load")
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20241107133322.855112-2-cascardo@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/pci.c | 1 -
+ drivers/net/wireless/realtek/rtlwifi/usb.c | 1 -
+ 2 files changed, 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index 6116c1bec1558..1707d00b49698 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -2273,7 +2273,6 @@ int rtl_pci_probe(struct pci_dev *pdev,
+ pci_iounmap(pdev, (void __iomem *)rtlpriv->io.pci_mem_start);
+
+ pci_release_regions(pdev);
+- complete(&rtlpriv->firmware_loading_complete);
+
+ fail1:
+ if (hw)
+diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
+index a8eebafb9a7ee..c2a3c88ea1fcc 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
+@@ -1085,7 +1085,6 @@ int rtl_usb_probe(struct usb_interface *intf,
+ error_out2:
+ _rtl_usb_io_handler_release(hw);
+ usb_put_dev(udev);
+- complete(&rtlpriv->firmware_loading_complete);
+ kfree(rtlpriv->usb_data);
+ ieee80211_free_hw(hw);
+ return -ENODEV;
+--
+2.39.5
+
--- /dev/null
+From 598bd8122f7f4b94302c60766d0263ce5c8faa86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 10:33:21 -0300
+Subject: wifi: rtlwifi: fix init_sw_vars leak when probe fails
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit 00260350aed80c002df270c805ca443ec9a719a6 ]
+
+If ieee80211_register_hw fails, the memory allocated for the firmware will
+not be released. Call deinit_sw_vars as the function that undoes the
+allocationes done by init_sw_vars.
+
+Fixes: cefe3dfdb9f5 ("rtl8192cu: Call ieee80211_register_hw from rtl_usb_probe")
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20241107133322.855112-5-cascardo@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
+index 038d9bb652b64..1753eccbefdd9 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
+@@ -1082,6 +1082,7 @@ int rtl_usb_probe(struct usb_interface *intf,
+
+ error_init_vars:
+ wait_for_completion(&rtlpriv->firmware_loading_complete);
++ rtlpriv->cfg->ops->deinit_sw_vars(hw);
+ error_out:
+ rtl_deinit_core(hw);
+ error_out2:
+--
+2.39.5
+
--- /dev/null
+From 88a7a3f8898805a448fd175c471b6d78d8971ade Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2024 14:37:12 -0300
+Subject: wifi: rtlwifi: fix memory leaks and invalid access at probe error
+ path
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit e7ceefbfd8d447abc8aca8ab993a942803522c06 ]
+
+Deinitialize at reverse order when probe fails.
+
+When init_sw_vars fails, rtl_deinit_core should not be called, specially
+now that it destroys the rtl_wq workqueue.
+
+And call rtl_pci_deinit and deinit_sw_vars, otherwise, memory will be
+leaked.
+
+Remove pci_set_drvdata call as it will already be cleaned up by the core
+driver code and could lead to memory leaks too. cf. commit 8d450935ae7f
+("wireless: rtlwifi: remove unnecessary pci_set_drvdata()") and
+commit 3d86b93064c7 ("rtlwifi: Fix PCI probe error path orphaned memory").
+
+Fixes: 0c8173385e54 ("rtl8192ce: Add new driver")
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20241206173713.3222187-4-cascardo@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/pci.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index c44850394fd27..737ab425da995 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -2167,7 +2167,7 @@ int rtl_pci_probe(struct pci_dev *pdev,
+ if (rtlpriv->cfg->ops->init_sw_vars(hw)) {
+ pr_err("Can't init_sw_vars\n");
+ err = -ENODEV;
+- goto fail3;
++ goto fail2;
+ }
+ rtlpriv->cfg->ops->init_sw_leds(hw);
+
+@@ -2185,14 +2185,14 @@ int rtl_pci_probe(struct pci_dev *pdev,
+ err = rtl_pci_init(hw, pdev);
+ if (err) {
+ pr_err("Failed to init PCI\n");
+- goto fail3;
++ goto fail4;
+ }
+
+ err = ieee80211_register_hw(hw);
+ if (err) {
+ pr_err("Can't register mac80211 hw.\n");
+ err = -ENODEV;
+- goto fail3;
++ goto fail5;
+ }
+ rtlpriv->mac80211.mac80211_registered = 1;
+
+@@ -2215,9 +2215,12 @@ int rtl_pci_probe(struct pci_dev *pdev,
+ set_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status);
+ return 0;
+
+-fail3:
+- pci_set_drvdata(pdev, NULL);
++fail5:
++ rtl_pci_deinit(hw);
++fail4:
+ rtl_deinit_core(hw);
++fail3:
++ rtlpriv->cfg->ops->deinit_sw_vars(hw);
+
+ fail2:
+ if (rtlpriv->io.pci_mem_start != 0)
+--
+2.39.5
+
--- /dev/null
+From cea676b90b8383d0ea62cddf994ec8d09260a09a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2024 14:37:13 -0300
+Subject: wifi: rtlwifi: pci: wait for firmware loading before releasing memory
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit b59b86c5d08be7d761c04affcbcec8184738c200 ]
+
+At probe error path, the firmware loading work may have already been
+queued. In such a case, it will try to access memory allocated by the probe
+function, which is about to be released. In such paths, wait for the
+firmware worker to finish before releasing memory.
+
+Fixes: 3d86b93064c7 ("rtlwifi: Fix PCI probe error path orphaned memory")
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20241206173713.3222187-5-cascardo@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index 737ab425da995..2a1bc168f7715 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -2220,6 +2220,7 @@ int rtl_pci_probe(struct pci_dev *pdev,
+ fail4:
+ rtl_deinit_core(hw);
+ fail3:
++ wait_for_completion(&rtlpriv->firmware_loading_complete);
+ rtlpriv->cfg->ops->deinit_sw_vars(hw);
+
+ fail2:
+--
+2.39.5
+
--- /dev/null
+From 34a326118c94b75150ecac2eb12a53fa2466df4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2024 14:37:10 -0300
+Subject: wifi: rtlwifi: remove unused check_buddy_priv
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit 2fdac64c3c35858aa8ac5caa70b232e03456e120 ]
+
+Commit 2461c7d60f9f ("rtlwifi: Update header file") introduced a global
+list of private data structures.
+
+Later on, commit 26634c4b1868 ("rtlwifi Modify existing bits to match
+vendor version 2013.02.07") started adding the private data to that list at
+probe time and added a hook, check_buddy_priv to find the private data from
+a similar device.
+
+However, that function was never used.
+
+Besides, though there is a lock for that list, it is never used. And when
+the probe fails, the private data is never removed from the list. This
+would cause a second probe to access freed memory.
+
+Remove the unused hook, structures and members, which will prevent the
+potential race condition on the list and its corruption during a second
+probe when probe fails.
+
+Fixes: 26634c4b1868 ("rtlwifi Modify existing bits to match vendor version 2013.02.07")
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20241206173713.3222187-2-cascardo@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/base.c | 7 ----
+ drivers/net/wireless/realtek/rtlwifi/base.h | 1 -
+ drivers/net/wireless/realtek/rtlwifi/pci.c | 44 ---------------------
+ drivers/net/wireless/realtek/rtlwifi/wifi.h | 12 ------
+ 4 files changed, 64 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
+index 44846e96b2abe..e69845545f6a2 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/base.c
++++ b/drivers/net/wireless/realtek/rtlwifi/base.c
+@@ -2710,9 +2710,6 @@ MODULE_AUTHOR("Larry Finger <Larry.FInger@lwfinger.net>");
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Realtek 802.11n PCI wireless core");
+
+-struct rtl_global_var rtl_global_var = {};
+-EXPORT_SYMBOL_GPL(rtl_global_var);
+-
+ static int __init rtl_core_module_init(void)
+ {
+ BUILD_BUG_ON(TX_PWR_BY_RATE_NUM_RATE < TX_PWR_BY_RATE_NUM_SECTION);
+@@ -2726,10 +2723,6 @@ static int __init rtl_core_module_init(void)
+ /* add debugfs */
+ rtl_debugfs_add_topdir();
+
+- /* init some global vars */
+- INIT_LIST_HEAD(&rtl_global_var.glb_priv_list);
+- spin_lock_init(&rtl_global_var.glb_list_lock);
+-
+ return 0;
+ }
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/base.h b/drivers/net/wireless/realtek/rtlwifi/base.h
+index f081a9a90563f..f3a6a43a42eca 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/base.h
++++ b/drivers/net/wireless/realtek/rtlwifi/base.h
+@@ -124,7 +124,6 @@ int rtl_send_smps_action(struct ieee80211_hw *hw,
+ u8 *rtl_find_ie(u8 *data, unsigned int len, u8 ie);
+ void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len);
+ u8 rtl_tid_to_ac(u8 tid);
+-extern struct rtl_global_var rtl_global_var;
+ void rtl_phy_scan_operation_backup(struct ieee80211_hw *hw, u8 operation);
+
+ #endif
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index 99504e3daf6cf..071537ee7165d 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -295,46 +295,6 @@ static bool rtl_pci_get_amd_l1_patch(struct ieee80211_hw *hw)
+ return status;
+ }
+
+-static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw,
+- struct rtl_priv **buddy_priv)
+-{
+- struct rtl_priv *rtlpriv = rtl_priv(hw);
+- struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw);
+- struct rtl_priv *tpriv = NULL, *iter;
+- struct rtl_pci_priv *tpcipriv = NULL;
+-
+- if (!list_empty(&rtlpriv->glb_var->glb_priv_list)) {
+- list_for_each_entry(iter, &rtlpriv->glb_var->glb_priv_list,
+- list) {
+- tpcipriv = (struct rtl_pci_priv *)iter->priv;
+- rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
+- "pcipriv->ndis_adapter.funcnumber %x\n",
+- pcipriv->ndis_adapter.funcnumber);
+- rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
+- "tpcipriv->ndis_adapter.funcnumber %x\n",
+- tpcipriv->ndis_adapter.funcnumber);
+-
+- if (pcipriv->ndis_adapter.busnumber ==
+- tpcipriv->ndis_adapter.busnumber &&
+- pcipriv->ndis_adapter.devnumber ==
+- tpcipriv->ndis_adapter.devnumber &&
+- pcipriv->ndis_adapter.funcnumber !=
+- tpcipriv->ndis_adapter.funcnumber) {
+- tpriv = iter;
+- break;
+- }
+- }
+- }
+-
+- rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
+- "find_buddy_priv %d\n", tpriv != NULL);
+-
+- if (tpriv)
+- *buddy_priv = tpriv;
+-
+- return tpriv != NULL;
+-}
+-
+ static void rtl_pci_parse_configuration(struct pci_dev *pdev,
+ struct ieee80211_hw *hw)
+ {
+@@ -2013,7 +1973,6 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev,
+ pcipriv->ndis_adapter.amd_l1_patch);
+
+ rtl_pci_parse_configuration(pdev, hw);
+- list_add_tail(&rtlpriv->list, &rtlpriv->glb_var->glb_priv_list);
+
+ return true;
+ }
+@@ -2160,7 +2119,6 @@ int rtl_pci_probe(struct pci_dev *pdev,
+ rtlpriv->rtlhal.interface = INTF_PCI;
+ rtlpriv->cfg = (struct rtl_hal_cfg *)(id->driver_data);
+ rtlpriv->intf_ops = &rtl_pci_ops;
+- rtlpriv->glb_var = &rtl_global_var;
+ rtl_efuse_ops_init(hw);
+
+ /* MEM map */
+@@ -2318,7 +2276,6 @@ void rtl_pci_disconnect(struct pci_dev *pdev)
+ if (rtlpci->using_msi)
+ pci_disable_msi(rtlpci->pdev);
+
+- list_del(&rtlpriv->list);
+ if (rtlpriv->io.pci_mem_start != 0) {
+ pci_iounmap(pdev, (void __iomem *)rtlpriv->io.pci_mem_start);
+ pci_release_regions(pdev);
+@@ -2378,7 +2335,6 @@ const struct rtl_intf_ops rtl_pci_ops = {
+ .read_efuse_byte = read_efuse_byte,
+ .adapter_start = rtl_pci_start,
+ .adapter_stop = rtl_pci_stop,
+- .check_buddy_priv = rtl_pci_check_buddy_priv,
+ .adapter_tx = rtl_pci_tx,
+ .flush = rtl_pci_flush,
+ .reset_trx_ring = rtl_pci_reset_trx_ring,
+diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h
+index d461c22aa9ed7..a8b5db365a30e 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h
+@@ -2335,8 +2335,6 @@ struct rtl_intf_ops {
+ void (*read_efuse_byte)(struct ieee80211_hw *hw, u16 _offset, u8 *pbuf);
+ int (*adapter_start)(struct ieee80211_hw *hw);
+ void (*adapter_stop)(struct ieee80211_hw *hw);
+- bool (*check_buddy_priv)(struct ieee80211_hw *hw,
+- struct rtl_priv **buddy_priv);
+
+ int (*adapter_tx)(struct ieee80211_hw *hw,
+ struct ieee80211_sta *sta,
+@@ -2580,14 +2578,6 @@ struct dig_t {
+ u32 rssi_max;
+ };
+
+-struct rtl_global_var {
+- /* from this list we can get
+- * other adapter's rtl_priv
+- */
+- struct list_head glb_priv_list;
+- spinlock_t glb_list_lock;
+-};
+-
+ #define IN_4WAY_TIMEOUT_TIME (30 * MSEC_PER_SEC) /* 30 seconds */
+
+ struct rtl_btc_info {
+@@ -2733,9 +2723,7 @@ struct rtl_scan_list {
+ struct rtl_priv {
+ struct ieee80211_hw *hw;
+ struct completion firmware_loading_complete;
+- struct list_head list;
+ struct rtl_priv *buddy_priv;
+- struct rtl_global_var *glb_var;
+ struct rtl_dmsp_ctl dmsp_ctl;
+ struct rtl_locks locks;
+ struct rtl_works works;
+--
+2.39.5
+
--- /dev/null
+From bed9528fede270c11f0788189629cff730721891 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jun 2023 09:59:40 +0300
+Subject: wifi: rtlwifi: remove unused dualmac control leftovers
+
+From: Dmitry Antipov <dmantipov@yandex.ru>
+
+[ Upstream commit 557123259200b30863e1b6a8f24a8c8060b6fc1d ]
+
+Remove 'struct rtl_dualmac_easy_concurrent_ctl' of 'struct rtl_priv'
+and related code in '_rtl_pci_tx_chk_waitq()'.
+
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230602065940.149198-2-dmantipov@yandex.ru
+Stable-dep-of: 2fdac64c3c35 ("wifi: rtlwifi: remove unused check_buddy_priv")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/pci.c | 5 -----
+ drivers/net/wireless/realtek/rtlwifi/wifi.h | 9 ---------
+ 2 files changed, 14 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index 1707d00b49698..99504e3daf6cf 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -443,11 +443,6 @@ static void _rtl_pci_tx_chk_waitq(struct ieee80211_hw *hw)
+ if (!rtlpriv->rtlhal.earlymode_enable)
+ return;
+
+- if (rtlpriv->dm.supp_phymode_switch &&
+- (rtlpriv->easy_concurrent_ctl.switch_in_process ||
+- (rtlpriv->buddy_priv &&
+- rtlpriv->buddy_priv->easy_concurrent_ctl.switch_in_process)))
+- return;
+ /* we just use em for BE/BK/VI/VO */
+ for (tid = 7; tid >= 0; tid--) {
+ u8 hw_queue = ac_to_hwq[rtl_tid_to_ac(tid)];
+diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h
+index 1991cffd3dd4a..d461c22aa9ed7 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h
+@@ -2496,14 +2496,6 @@ struct rtl_debug {
+ #define MIMO_PS_DYNAMIC 1
+ #define MIMO_PS_NOLIMIT 3
+
+-struct rtl_dualmac_easy_concurrent_ctl {
+- enum band_type currentbandtype_backfordmdp;
+- bool close_bbandrf_for_dmsp;
+- bool change_to_dmdp;
+- bool change_to_dmsp;
+- bool switch_in_process;
+-};
+-
+ struct rtl_dmsp_ctl {
+ bool activescan_for_slaveofdmsp;
+ bool scan_for_anothermac_fordmsp;
+@@ -2744,7 +2736,6 @@ struct rtl_priv {
+ struct list_head list;
+ struct rtl_priv *buddy_priv;
+ struct rtl_global_var *glb_var;
+- struct rtl_dualmac_easy_concurrent_ctl easy_concurrent_ctl;
+ struct rtl_dmsp_ctl dmsp_ctl;
+ struct rtl_locks locks;
+ struct rtl_works works;
+--
+2.39.5
+
--- /dev/null
+From 1df290448c16c19633b74fc34fe09e28c2b80253 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jun 2023 09:59:39 +0300
+Subject: wifi: rtlwifi: remove unused timer and related code
+
+From: Dmitry Antipov <dmantipov@yandex.ru>
+
+[ Upstream commit 358b94f0a7cadd2ec7824531d54dadaa8b71de04 ]
+
+Drop unused 'dualmac_easyconcurrent_retrytimer' of 'struct rtl_works',
+corresponding 'rtl_easy_concurrent_retrytimer_callback()' handler,
+'dualmac_easy_concurrent' function pointer of 'struct rtl_hal_ops'
+and related call to 'timer_setup()' in '_rtl_init_deferred_work()'.
+
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230602065940.149198-1-dmantipov@yandex.ru
+Stable-dep-of: 2fdac64c3c35 ("wifi: rtlwifi: remove unused check_buddy_priv")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/base.c | 16 +---------------
+ drivers/net/wireless/realtek/rtlwifi/base.h | 1 -
+ drivers/net/wireless/realtek/rtlwifi/wifi.h | 2 --
+ 3 files changed, 1 insertion(+), 18 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
+index 9e7e98b55eff8..44846e96b2abe 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/base.c
++++ b/drivers/net/wireless/realtek/rtlwifi/base.c
+@@ -452,8 +452,7 @@ static int _rtl_init_deferred_work(struct ieee80211_hw *hw)
+ /* <1> timer */
+ timer_setup(&rtlpriv->works.watchdog_timer,
+ rtl_watch_dog_timer_callback, 0);
+- timer_setup(&rtlpriv->works.dualmac_easyconcurrent_retrytimer,
+- rtl_easy_concurrent_retrytimer_callback, 0);
++
+ /* <2> work queue */
+ rtlpriv->works.hw = hw;
+ rtlpriv->works.rtl_wq = wq;
+@@ -2366,19 +2365,6 @@ static void rtl_c2hcmd_wq_callback(struct work_struct *work)
+ rtl_c2hcmd_launcher(hw, 1);
+ }
+
+-void rtl_easy_concurrent_retrytimer_callback(struct timer_list *t)
+-{
+- struct rtl_priv *rtlpriv =
+- from_timer(rtlpriv, t, works.dualmac_easyconcurrent_retrytimer);
+- struct ieee80211_hw *hw = rtlpriv->hw;
+- struct rtl_priv *buddy_priv = rtlpriv->buddy_priv;
+-
+- if (buddy_priv == NULL)
+- return;
+-
+- rtlpriv->cfg->ops->dualmac_easy_concurrent(hw);
+-}
+-
+ /*********************************************************
+ *
+ * frame process functions
+diff --git a/drivers/net/wireless/realtek/rtlwifi/base.h b/drivers/net/wireless/realtek/rtlwifi/base.h
+index 0e4f8a8ae3a5f..f081a9a90563f 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/base.h
++++ b/drivers/net/wireless/realtek/rtlwifi/base.h
+@@ -124,7 +124,6 @@ int rtl_send_smps_action(struct ieee80211_hw *hw,
+ u8 *rtl_find_ie(u8 *data, unsigned int len, u8 ie);
+ void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len);
+ u8 rtl_tid_to_ac(u8 tid);
+-void rtl_easy_concurrent_retrytimer_callback(struct timer_list *t);
+ extern struct rtl_global_var rtl_global_var;
+ void rtl_phy_scan_operation_backup(struct ieee80211_hw *hw, u8 operation);
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h
+index 0bac788ccd6e3..1991cffd3dd4a 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h
+@@ -2300,7 +2300,6 @@ struct rtl_hal_ops {
+ u32 regaddr, u32 bitmask, u32 data);
+ void (*linked_set_reg)(struct ieee80211_hw *hw);
+ void (*chk_switch_dmdp)(struct ieee80211_hw *hw);
+- void (*dualmac_easy_concurrent)(struct ieee80211_hw *hw);
+ void (*dualmac_switch_to_dmdp)(struct ieee80211_hw *hw);
+ bool (*phy_rf6052_config)(struct ieee80211_hw *hw);
+ void (*phy_rf6052_set_cck_txpower)(struct ieee80211_hw *hw,
+@@ -2465,7 +2464,6 @@ struct rtl_works {
+
+ /*timer */
+ struct timer_list watchdog_timer;
+- struct timer_list dualmac_easyconcurrent_retrytimer;
+ struct timer_list fw_clockoff_timer;
+ struct timer_list fast_antenna_training_timer;
+ /*task */
+--
+2.39.5
+
--- /dev/null
+From 6ef5f8ac3f25a189efbe6444523d9cfc00c54002 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 10:33:19 -0300
+Subject: wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last
+ step
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit 8559a9e0c457729fe3edb3176bbf7c7874f482b0 ]
+
+Just like in commit 4dfde294b979 ("rtlwifi: rise completion at the last
+step of firmware callback"), only signal completion once the function is
+finished. Otherwise, the module removal waiting for the completion could
+free the memory that the callback will still use before returning.
+
+Fixes: b0302aba812b ("rtlwifi: Convert to asynchronous firmware load")
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20241107133322.855112-3-cascardo@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c
+index 6d352a3161b8f..60d97e73ca28e 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c
+@@ -67,22 +67,23 @@ static void rtl92se_fw_cb(const struct firmware *firmware, void *context)
+
+ rtl_dbg(rtlpriv, COMP_ERR, DBG_LOUD,
+ "Firmware callback routine entered!\n");
+- complete(&rtlpriv->firmware_loading_complete);
+ if (!firmware) {
+ pr_err("Firmware %s not available\n", fw_name);
+ rtlpriv->max_fw_size = 0;
+- return;
++ goto exit;
+ }
+ if (firmware->size > rtlpriv->max_fw_size) {
+ pr_err("Firmware is too big!\n");
+ rtlpriv->max_fw_size = 0;
+ release_firmware(firmware);
+- return;
++ goto exit;
+ }
+ pfirmware = (struct rt_firmware *)rtlpriv->rtlhal.pfirmware;
+ memcpy(pfirmware->sz_fw_tmpbuffer, firmware->data, firmware->size);
+ pfirmware->sz_fw_tmpbufferlen = firmware->size;
+ release_firmware(firmware);
++exit:
++ complete(&rtlpriv->firmware_loading_complete);
+ }
+
+ static int rtl92s_init_sw_vars(struct ieee80211_hw *hw)
+--
+2.39.5
+
--- /dev/null
+From a7abcf662fccf0e2a7ed1542192028ec964914ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 10:33:22 -0300
+Subject: wifi: rtlwifi: usb: fix workqueue leak when probe fails
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit f79bc5c67867c19ce2762e7934c20dbb835ed82c ]
+
+rtl_init_core creates a workqueue that is then assigned to rtl_wq.
+rtl_deinit_core does not destroy it. It is left to rtl_usb_deinit, which
+must be called in the probe error path.
+
+Fixes: 2ca20f79e0d8 ("rtlwifi: Add usb driver")
+Fixes: 851639fdaeac ("rtlwifi: Modify some USB de-initialize code.")
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20241107133322.855112-6-cascardo@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
+index 1753eccbefdd9..04590d16874c4 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
+@@ -1084,6 +1084,7 @@ int rtl_usb_probe(struct usb_interface *intf,
+ wait_for_completion(&rtlpriv->firmware_loading_complete);
+ rtlpriv->cfg->ops->deinit_sw_vars(hw);
+ error_out:
++ rtl_usb_deinit(hw);
+ rtl_deinit_core(hw);
+ error_out2:
+ _rtl_usb_io_handler_release(hw);
+--
+2.39.5
+
--- /dev/null
+From 9738bfbe5a0b8cb4743ec5fb824cf70d48ceccf4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 10:33:20 -0300
+Subject: wifi: rtlwifi: wait for firmware loading before releasing memory
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit b4b26642b31ef282df6ff7ea8531985edfdef12a ]
+
+At probe error path, the firmware loading work may have already been
+queued. In such a case, it will try to access memory allocated by the probe
+function, which is about to be released. In such paths, wait for the
+firmware worker to finish before releasing memory.
+
+Fixes: a7f7c15e945a ("rtlwifi: rtl8192cu: Free ieee80211_hw if probing fails")
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20241107133322.855112-4-cascardo@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/usb.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
+index c2a3c88ea1fcc..038d9bb652b64 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
+@@ -1073,13 +1073,15 @@ int rtl_usb_probe(struct usb_interface *intf,
+ err = ieee80211_register_hw(hw);
+ if (err) {
+ pr_err("Can't register mac80211 hw.\n");
+- goto error_out;
++ goto error_init_vars;
+ }
+ rtlpriv->mac80211.mac80211_registered = 1;
+
+ set_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status);
+ return 0;
+
++error_init_vars:
++ wait_for_completion(&rtlpriv->firmware_loading_complete);
+ error_out:
+ rtl_deinit_core(hw);
+ error_out2:
+--
+2.39.5
+
--- /dev/null
+From 238e42afebb3b397b7e1bca5214fb420fa33e96a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 21:00:35 +0100
+Subject: wifi: wcn36xx: fix channel survey memory allocation size
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Barnabás Czémán <barnabas.czeman@mainlining.org>
+
+[ Upstream commit 6200d947f050efdba4090dfefd8a01981363d954 ]
+
+KASAN reported a memory allocation issue in wcn->chan_survey
+due to incorrect size calculation.
+This commit uses kcalloc to allocate memory for wcn->chan_survey,
+ensuring proper initialization and preventing the use of uninitialized
+values when there are no frames on the channel.
+
+Fixes: 29696e0aa413 ("wcn36xx: Track SNR and RSSI for each RX frame")
+Signed-off-by: Barnabás Czémán <barnabas.czeman@mainlining.org>
+Acked-by: Loic Poulain <loic.poulain@linaro.org>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Link: https://patch.msgid.link/20241104-wcn36xx-memory-allocation-v1-1-5ec901cf37b6@mainlining.org
+Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/wcn36xx/main.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
+index 6b8d2889d73f4..b3a685f2ddd2d 100644
+--- a/drivers/net/wireless/ath/wcn36xx/main.c
++++ b/drivers/net/wireless/ath/wcn36xx/main.c
+@@ -1585,7 +1585,10 @@ static int wcn36xx_probe(struct platform_device *pdev)
+ }
+
+ n_channels = wcn_band_2ghz.n_channels + wcn_band_5ghz.n_channels;
+- wcn->chan_survey = devm_kmalloc(wcn->dev, n_channels, GFP_KERNEL);
++ wcn->chan_survey = devm_kcalloc(wcn->dev,
++ n_channels,
++ sizeof(struct wcn36xx_chan_survey),
++ GFP_KERNEL);
+ if (!wcn->chan_survey) {
+ ret = -ENOMEM;
+ goto out_wq;
+--
+2.39.5
+
--- /dev/null
+From 2d0bb4b8328b3c8f7df0ed2dcba7121bfae5a4f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jan 2025 20:55:07 +0100
+Subject: wifi: wlcore: fix unbalanced pm_runtime calls
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit 996c934c8c196144af386c4385f61fcd5349af28 ]
+
+If firmware boot failes, runtime pm is put too often:
+[12092.708099] wlcore: ERROR firmware boot failed despite 3 retries
+[12092.708099] wl18xx_driver wl18xx.1.auto: Runtime PM usage count underflow!
+Fix that by redirecting all error gotos before runtime_get so that runtime is
+not put.
+
+Fixes: c40aad28a3cf ("wlcore: Make sure firmware is initialized in wl1271_op_add_interface()")
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Reviewed-by: Michael Nemanov <michael.nemanov@ti.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://patch.msgid.link/20250104195507.402673-1-akemnade@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ti/wlcore/main.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
+index 28c0f06e311f7..b88ceb1f9800c 100644
+--- a/drivers/net/wireless/ti/wlcore/main.c
++++ b/drivers/net/wireless/ti/wlcore/main.c
+@@ -2533,24 +2533,24 @@ static int wl1271_op_add_interface(struct ieee80211_hw *hw,
+ if (test_bit(WL1271_FLAG_RECOVERY_IN_PROGRESS, &wl->flags) ||
+ test_bit(WLVIF_FLAG_INITIALIZED, &wlvif->flags)) {
+ ret = -EBUSY;
+- goto out;
++ goto out_unlock;
+ }
+
+
+ ret = wl12xx_init_vif_data(wl, vif);
+ if (ret < 0)
+- goto out;
++ goto out_unlock;
+
+ wlvif->wl = wl;
+ role_type = wl12xx_get_role_type(wl, wlvif);
+ if (role_type == WL12XX_INVALID_ROLE_TYPE) {
+ ret = -EINVAL;
+- goto out;
++ goto out_unlock;
+ }
+
+ ret = wlcore_allocate_hw_queue_base(wl, wlvif);
+ if (ret < 0)
+- goto out;
++ goto out_unlock;
+
+ /*
+ * TODO: after the nvs issue will be solved, move this block
+@@ -2565,7 +2565,7 @@ static int wl1271_op_add_interface(struct ieee80211_hw *hw,
+
+ ret = wl12xx_init_fw(wl);
+ if (ret < 0)
+- goto out;
++ goto out_unlock;
+ }
+
+ /*
+--
+2.39.5
+
--- /dev/null
+From d34846d707f5f17c6903898c9880794f0fc109a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Nov 2024 14:10:31 +0200
+Subject: xfrm: replay: Fix the update of replay_esn->oseq_hi for GSO
+
+From: Jianbo Liu <jianbol@nvidia.com>
+
+[ Upstream commit c05c5e5aa163f4682ca97a2f0536575fc7dbdecb ]
+
+When skb needs GSO and wrap around happens, if xo->seq.low (seqno of
+the first skb segment) is before the last seq number but oseq (seqno
+of the last segment) is after it, xo->seq.low is still bigger than
+replay_esn->oseq while oseq is smaller than it, so the update of
+replay_esn->oseq_hi is missed for this case wrap around because of
+the change in the cited commit.
+
+For example, if sending a packet with gso_segs=3 while old
+replay_esn->oseq=0xfffffffe, we calculate:
+ xo->seq.low = 0xfffffffe + 1 = 0x0xffffffff
+ oseq = 0xfffffffe + 3 = 0x1
+(oseq < replay_esn->oseq) is true, but (xo->seq.low <
+replay_esn->oseq) is false, so replay_esn->oseq_hi is not incremented.
+
+To fix this issue, change the outer checking back for the update of
+replay_esn->oseq_hi. And add new checking inside for the update of
+packet's oseq_hi.
+
+Fixes: 4b549ccce941 ("xfrm: replay: Fix ESN wrap around for GSO")
+Signed-off-by: Jianbo Liu <jianbol@nvidia.com>
+Reviewed-by: Patrisious Haddad <phaddad@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_replay.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
+index ce56d659c55a6..7f52bb2e14c13 100644
+--- a/net/xfrm/xfrm_replay.c
++++ b/net/xfrm/xfrm_replay.c
+@@ -714,10 +714,12 @@ static int xfrm_replay_overflow_offload_esn(struct xfrm_state *x, struct sk_buff
+ oseq += skb_shinfo(skb)->gso_segs;
+ }
+
+- if (unlikely(xo->seq.low < replay_esn->oseq)) {
+- XFRM_SKB_CB(skb)->seq.output.hi = ++oseq_hi;
+- xo->seq.hi = oseq_hi;
+- replay_esn->oseq_hi = oseq_hi;
++ if (unlikely(oseq < replay_esn->oseq)) {
++ replay_esn->oseq_hi = ++oseq_hi;
++ if (xo->seq.low < replay_esn->oseq) {
++ XFRM_SKB_CB(skb)->seq.output.hi = oseq_hi;
++ xo->seq.hi = oseq_hi;
++ }
+ if (replay_esn->oseq_hi == 0) {
+ replay_esn->oseq--;
+ replay_esn->oseq_hi--;
+--
+2.39.5
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
