--- /dev/null
+From 55251fbdf0146c252ceff146a1bb145546f3e034 Mon Sep 17 00:00:00 2001
+From: Damien Le Moal <dlemoal@kernel.org>
+Date: Thu, 28 Mar 2024 09:43:40 +0900
+Subject: block: Do not force full zone append completion in req_bio_endio()
+
+From: Damien Le Moal <dlemoal@kernel.org>
+
+commit 55251fbdf0146c252ceff146a1bb145546f3e034 upstream.
+
+This reverts commit 748dc0b65ec2b4b7b3dbd7befcc4a54fdcac7988.
+
+Partial zone append completions cannot be supported as there is no
+guarantees that the fragmented data will be written sequentially in the
+same manner as with a full command. Commit 748dc0b65ec2 ("block: fix
+partial zone append completion handling in req_bio_endio()") changed
+req_bio_endio() to always advance a partially failed BIO by its full
+length, but this can lead to incorrect accounting. So revert this
+change and let low level device drivers handle this case by always
+failing completely zone append operations. With this revert, users will
+still see an IO error for a partially completed zone append BIO.
+
+Fixes: 748dc0b65ec2 ("block: fix partial zone append completion handling in req_bio_endio()")
+Cc: stable@vger.kernel.org
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20240328004409.594888-2-dlemoal@kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-mq.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -771,16 +771,11 @@ static void req_bio_endio(struct request
+ /*
+ * Partial zone append completions cannot be supported as the
+ * BIO fragments may end up not being written sequentially.
+- * For such case, force the completed nbytes to be equal to
+- * the BIO size so that bio_advance() sets the BIO remaining
+- * size to 0 and we end up calling bio_endio() before returning.
+ */
+- if (bio->bi_iter.bi_size != nbytes) {
++ if (bio->bi_iter.bi_size != nbytes)
+ bio->bi_status = BLK_STS_IOERR;
+- nbytes = bio->bi_iter.bi_size;
+- } else {
++ else
+ bio->bi_iter.bi_sector = rq->__sector;
+- }
+ }
+
+ bio_advance(bio, nbytes);
--- /dev/null
+From a8b70c7f8600bc77d03c0b032c0662259b9e615e Mon Sep 17 00:00:00 2001
+From: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Date: Wed, 21 Feb 2024 07:35:52 -0800
+Subject: btrfs: zoned: don't skip block groups with 100% zone unusable
+
+From: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+
+commit a8b70c7f8600bc77d03c0b032c0662259b9e615e upstream.
+
+Commit f4a9f219411f ("btrfs: do not delete unused block group if it may be
+used soon") changed the behaviour of deleting unused block-groups on zoned
+filesystems. Starting with this commit, we're using
+btrfs_space_info_used() to calculate the number of used bytes in a
+space_info. But btrfs_space_info_used() also accounts
+btrfs_space_info::bytes_zone_unusable as used bytes.
+
+So if a block group is 100% zone_unusable it is skipped from the deletion
+step.
+
+In order not to skip fully zone_unusable block-groups, also check if the
+block-group has bytes left that can be used on a zoned filesystem.
+
+Fixes: f4a9f219411f ("btrfs: do not delete unused block group if it may be used soon")
+CC: stable@vger.kernel.org # 6.1+
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/block-group.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/btrfs/block-group.c
++++ b/fs/btrfs/block-group.c
+@@ -1550,7 +1550,8 @@ void btrfs_delete_unused_bgs(struct btrf
+ * needing to allocate extents from the block group.
+ */
+ used = btrfs_space_info_used(space_info, true);
+- if (space_info->total_bytes - block_group->length < used) {
++ if (space_info->total_bytes - block_group->length < used &&
++ block_group->zone_unusable < block_group->length) {
+ /*
+ * Add a reference for the list, compensate for the ref
+ * drop under the "next" label for the
--- /dev/null
+From 1ec17ef59168a1a6f1105f5dc517f783839a5302 Mon Sep 17 00:00:00 2001
+From: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Date: Wed, 28 Feb 2024 12:13:27 +0100
+Subject: btrfs: zoned: fix use-after-free in do_zone_finish()
+
+From: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+
+commit 1ec17ef59168a1a6f1105f5dc517f783839a5302 upstream.
+
+Shinichiro reported the following use-after-free triggered by the device
+replace operation in fstests btrfs/070.
+
+ BTRFS info (device nullb1): scrub: finished on devid 1 with status: 0
+ ==================================================================
+ BUG: KASAN: slab-use-after-free in do_zone_finish+0x91a/0xb90 [btrfs]
+ Read of size 8 at addr ffff8881543c8060 by task btrfs-cleaner/3494007
+
+ CPU: 0 PID: 3494007 Comm: btrfs-cleaner Tainted: G W 6.8.0-rc5-kts #1
+ Hardware name: Supermicro Super Server/X11SPi-TF, BIOS 3.3 02/21/2020
+ Call Trace:
+ <TASK>
+ dump_stack_lvl+0x5b/0x90
+ print_report+0xcf/0x670
+ ? __virt_addr_valid+0x200/0x3e0
+ kasan_report+0xd8/0x110
+ ? do_zone_finish+0x91a/0xb90 [btrfs]
+ ? do_zone_finish+0x91a/0xb90 [btrfs]
+ do_zone_finish+0x91a/0xb90 [btrfs]
+ btrfs_delete_unused_bgs+0x5e1/0x1750 [btrfs]
+ ? __pfx_btrfs_delete_unused_bgs+0x10/0x10 [btrfs]
+ ? btrfs_put_root+0x2d/0x220 [btrfs]
+ ? btrfs_clean_one_deleted_snapshot+0x299/0x430 [btrfs]
+ cleaner_kthread+0x21e/0x380 [btrfs]
+ ? __pfx_cleaner_kthread+0x10/0x10 [btrfs]
+ kthread+0x2e3/0x3c0
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork+0x31/0x70
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork_asm+0x1b/0x30
+ </TASK>
+
+ Allocated by task 3493983:
+ kasan_save_stack+0x33/0x60
+ kasan_save_track+0x14/0x30
+ __kasan_kmalloc+0xaa/0xb0
+ btrfs_alloc_device+0xb3/0x4e0 [btrfs]
+ device_list_add.constprop.0+0x993/0x1630 [btrfs]
+ btrfs_scan_one_device+0x219/0x3d0 [btrfs]
+ btrfs_control_ioctl+0x26e/0x310 [btrfs]
+ __x64_sys_ioctl+0x134/0x1b0
+ do_syscall_64+0x99/0x190
+ entry_SYSCALL_64_after_hwframe+0x6e/0x76
+
+ Freed by task 3494056:
+ kasan_save_stack+0x33/0x60
+ kasan_save_track+0x14/0x30
+ kasan_save_free_info+0x3f/0x60
+ poison_slab_object+0x102/0x170
+ __kasan_slab_free+0x32/0x70
+ kfree+0x11b/0x320
+ btrfs_rm_dev_replace_free_srcdev+0xca/0x280 [btrfs]
+ btrfs_dev_replace_finishing+0xd7e/0x14f0 [btrfs]
+ btrfs_dev_replace_by_ioctl+0x1286/0x25a0 [btrfs]
+ btrfs_ioctl+0xb27/0x57d0 [btrfs]
+ __x64_sys_ioctl+0x134/0x1b0
+ do_syscall_64+0x99/0x190
+ entry_SYSCALL_64_after_hwframe+0x6e/0x76
+
+ The buggy address belongs to the object at ffff8881543c8000
+ which belongs to the cache kmalloc-1k of size 1024
+ The buggy address is located 96 bytes inside of
+ freed 1024-byte region [ffff8881543c8000, ffff8881543c8400)
+
+ The buggy address belongs to the physical page:
+ page:00000000fe2c1285 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1543c8
+ head:00000000fe2c1285 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
+ flags: 0x17ffffc0000840(slab|head|node=0|zone=2|lastcpupid=0x1fffff)
+ page_type: 0xffffffff()
+ raw: 0017ffffc0000840 ffff888100042dc0 ffffea0019e8f200 dead000000000002
+ raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
+ page dumped because: kasan: bad access detected
+
+ Memory state around the buggy address:
+ ffff8881543c7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ ffff8881543c7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ >ffff8881543c8000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ^
+ ffff8881543c8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ffff8881543c8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+
+This UAF happens because we're accessing stale zone information of a
+already removed btrfs_device in do_zone_finish().
+
+The sequence of events is as follows:
+
+btrfs_dev_replace_start
+ btrfs_scrub_dev
+ btrfs_dev_replace_finishing
+ btrfs_dev_replace_update_device_in_mapping_tree <-- devices replaced
+ btrfs_rm_dev_replace_free_srcdev
+ btrfs_free_device <-- device freed
+
+cleaner_kthread
+ btrfs_delete_unused_bgs
+ btrfs_zone_finish
+ do_zone_finish <-- refers the freed device
+
+The reason for this is that we're using a cached pointer to the chunk_map
+from the block group, but on device replace this cached pointer can
+contain stale device entries.
+
+The staleness comes from the fact, that btrfs_block_group::physical_map is
+not a pointer to a btrfs_chunk_map but a memory copy of it.
+
+Also take the fs_info::dev_replace::rwsem to prevent
+btrfs_dev_replace_update_device_in_mapping_tree() from changing the device
+underneath us again.
+
+Note: btrfs_dev_replace_update_device_in_mapping_tree() is holding
+fs_info::mapping_tree_lock, but as this is a spinning read/write lock we
+cannot take it as the call to blkdev_zone_mgmt() requires a memory
+allocation which may not sleep.
+But btrfs_dev_replace_update_device_in_mapping_tree() is always called with
+the fs_info::dev_replace::rwsem held in write mode.
+
+Many thanks to Shinichiro for analyzing the bug.
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+CC: stable@vger.kernel.org # 6.8
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/zoned.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/fs/btrfs/zoned.c
++++ b/fs/btrfs/zoned.c
+@@ -1563,11 +1563,7 @@ int btrfs_load_block_group_zone_info(str
+ if (!map)
+ return -EINVAL;
+
+- cache->physical_map = btrfs_clone_chunk_map(map, GFP_NOFS);
+- if (!cache->physical_map) {
+- ret = -ENOMEM;
+- goto out;
+- }
++ cache->physical_map = map;
+
+ zone_info = kcalloc(map->num_stripes, sizeof(*zone_info), GFP_NOFS);
+ if (!zone_info) {
+@@ -1679,7 +1675,6 @@ out:
+ }
+ bitmap_free(active);
+ kfree(zone_info);
+- btrfs_free_chunk_map(map);
+
+ return ret;
+ }
+@@ -2164,6 +2159,7 @@ static int do_zone_finish(struct btrfs_b
+ struct btrfs_chunk_map *map;
+ const bool is_metadata = (block_group->flags &
+ (BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_SYSTEM));
++ struct btrfs_dev_replace *dev_replace = &fs_info->dev_replace;
+ int ret = 0;
+ int i;
+
+@@ -2239,6 +2235,7 @@ static int do_zone_finish(struct btrfs_b
+ btrfs_clear_data_reloc_bg(block_group);
+ spin_unlock(&block_group->lock);
+
++ down_read(&dev_replace->rwsem);
+ map = block_group->physical_map;
+ for (i = 0; i < map->num_stripes; i++) {
+ struct btrfs_device *device = map->stripes[i].dev;
+@@ -2253,13 +2250,16 @@ static int do_zone_finish(struct btrfs_b
+ zinfo->zone_size >> SECTOR_SHIFT,
+ GFP_NOFS);
+
+- if (ret)
++ if (ret) {
++ up_read(&dev_replace->rwsem);
+ return ret;
++ }
+
+ if (!(block_group->flags & BTRFS_BLOCK_GROUP_DATA))
+ zinfo->reserved_active_zones++;
+ btrfs_dev_clear_active_zone(device, physical);
+ }
++ up_read(&dev_replace->rwsem);
+
+ if (!fully_written)
+ btrfs_dec_block_group_ro(block_group);
--- /dev/null
+From 74098a989b9c3370f768140b7783a7aaec2759b3 Mon Sep 17 00:00:00 2001
+From: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Date: Mon, 26 Feb 2024 16:39:13 +0100
+Subject: btrfs: zoned: use zone aware sb location for scrub
+
+From: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+
+commit 74098a989b9c3370f768140b7783a7aaec2759b3 upstream.
+
+At the moment scrub_supers() doesn't grab the super block's location via
+the zoned device aware btrfs_sb_log_location() but via btrfs_sb_offset().
+
+This leads to checksum errors on 'scrub' as we're not accessing the
+correct location of the super block.
+
+So use btrfs_sb_log_location() for getting the super blocks location on
+scrub.
+
+Reported-by: WA AM <waautomata@gmail.com>
+Link: http://lore.kernel.org/linux-btrfs/CANU2Z0EvUzfYxczLgGUiREoMndE9WdQnbaawV5Fv5gNXptPUKw@mail.gmail.com
+CC: stable@vger.kernel.org # 5.15+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: Naohiro Aota <naohiro.aota@wdc.com>
+Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/scrub.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/fs/btrfs/scrub.c
++++ b/fs/btrfs/scrub.c
+@@ -2805,7 +2805,17 @@ static noinline_for_stack int scrub_supe
+ gen = btrfs_get_last_trans_committed(fs_info);
+
+ for (i = 0; i < BTRFS_SUPER_MIRROR_MAX; i++) {
+- bytenr = btrfs_sb_offset(i);
++ ret = btrfs_sb_log_location(scrub_dev, i, 0, &bytenr);
++ if (ret == -ENOENT)
++ break;
++
++ if (ret) {
++ spin_lock(&sctx->stat_lock);
++ sctx->stat.super_errors++;
++ spin_unlock(&sctx->stat_lock);
++ continue;
++ }
++
+ if (bytenr + BTRFS_SUPER_INFO_SIZE >
+ scrub_dev->commit_total_bytes)
+ break;
--- /dev/null
+From edfa93d87fc46913868481fe8ed3fb62c891ffb5 Mon Sep 17 00:00:00 2001
+From: George Shen <george.shen@amd.com>
+Date: Fri, 16 Feb 2024 19:37:03 -0500
+Subject: drm/amd/display: Remove MPC rate control logic from DCN30 and above
+
+From: George Shen <george.shen@amd.com>
+
+commit edfa93d87fc46913868481fe8ed3fb62c891ffb5 upstream.
+
+[Why]
+MPC flow rate control is not needed for DCN30 and above. Current logic
+that uses it can result in underflow for certain edge cases (such as
+DSC N422 + ODM combine + 422 left edge pixel).
+
+[How]
+Remove MPC flow rate control logic and programming for DCN30 and above.
+
+Cc: Mario Limonciello <mario.limonciello@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
+Acked-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: George Shen <george.shen@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn30/dcn30_mpc.c | 54 ++++++++------
+ drivers/gpu/drm/amd/display/dc/dcn30/dcn30_mpc.h | 14 +--
+ drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c | 5 -
+ drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c | 41 ----------
+ drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c | 41 ----------
+ drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c | 41 ----------
+ 6 files changed, 41 insertions(+), 155 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_mpc.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_mpc.c
+@@ -44,6 +44,36 @@
+ #define NUM_ELEMENTS(a) (sizeof(a) / sizeof((a)[0]))
+
+
++void mpc3_mpc_init(struct mpc *mpc)
++{
++ struct dcn30_mpc *mpc30 = TO_DCN30_MPC(mpc);
++ int opp_id;
++
++ mpc1_mpc_init(mpc);
++
++ for (opp_id = 0; opp_id < MAX_OPP; opp_id++) {
++ if (REG(MUX[opp_id]))
++ /* disable mpc out rate and flow control */
++ REG_UPDATE_2(MUX[opp_id], MPC_OUT_RATE_CONTROL_DISABLE,
++ 1, MPC_OUT_FLOW_CONTROL_COUNT, 0);
++ }
++}
++
++void mpc3_mpc_init_single_inst(struct mpc *mpc, unsigned int mpcc_id)
++{
++ struct dcn30_mpc *mpc30 = TO_DCN30_MPC(mpc);
++
++ mpc1_mpc_init_single_inst(mpc, mpcc_id);
++
++ /* assuming mpc out mux is connected to opp with the same index at this
++ * point in time (e.g. transitioning from vbios to driver)
++ */
++ if (mpcc_id < MAX_OPP && REG(MUX[mpcc_id]))
++ /* disable mpc out rate and flow control */
++ REG_UPDATE_2(MUX[mpcc_id], MPC_OUT_RATE_CONTROL_DISABLE,
++ 1, MPC_OUT_FLOW_CONTROL_COUNT, 0);
++}
++
+ bool mpc3_is_dwb_idle(
+ struct mpc *mpc,
+ int dwb_id)
+@@ -80,25 +110,6 @@ void mpc3_disable_dwb_mux(
+ MPC_DWB0_MUX, 0xf);
+ }
+
+-void mpc3_set_out_rate_control(
+- struct mpc *mpc,
+- int opp_id,
+- bool enable,
+- bool rate_2x_mode,
+- struct mpc_dwb_flow_control *flow_control)
+-{
+- struct dcn30_mpc *mpc30 = TO_DCN30_MPC(mpc);
+-
+- REG_UPDATE_2(MUX[opp_id],
+- MPC_OUT_RATE_CONTROL_DISABLE, !enable,
+- MPC_OUT_RATE_CONTROL, rate_2x_mode);
+-
+- if (flow_control)
+- REG_UPDATE_2(MUX[opp_id],
+- MPC_OUT_FLOW_CONTROL_MODE, flow_control->flow_ctrl_mode,
+- MPC_OUT_FLOW_CONTROL_COUNT, flow_control->flow_ctrl_cnt1);
+-}
+-
+ enum dc_lut_mode mpc3_get_ogam_current(struct mpc *mpc, int mpcc_id)
+ {
+ /*Contrary to DCN2 and DCN1 wherein a single status register field holds this info;
+@@ -1386,8 +1397,8 @@ static const struct mpc_funcs dcn30_mpc_
+ .read_mpcc_state = mpc1_read_mpcc_state,
+ .insert_plane = mpc1_insert_plane,
+ .remove_mpcc = mpc1_remove_mpcc,
+- .mpc_init = mpc1_mpc_init,
+- .mpc_init_single_inst = mpc1_mpc_init_single_inst,
++ .mpc_init = mpc3_mpc_init,
++ .mpc_init_single_inst = mpc3_mpc_init_single_inst,
+ .update_blending = mpc2_update_blending,
+ .cursor_lock = mpc1_cursor_lock,
+ .get_mpcc_for_dpp = mpc1_get_mpcc_for_dpp,
+@@ -1404,7 +1415,6 @@ static const struct mpc_funcs dcn30_mpc_
+ .set_dwb_mux = mpc3_set_dwb_mux,
+ .disable_dwb_mux = mpc3_disable_dwb_mux,
+ .is_dwb_idle = mpc3_is_dwb_idle,
+- .set_out_rate_control = mpc3_set_out_rate_control,
+ .set_gamut_remap = mpc3_set_gamut_remap,
+ .program_shaper = mpc3_program_shaper,
+ .acquire_rmu = mpcc3_acquire_rmu,
+--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_mpc.h
++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_mpc.h
+@@ -1007,6 +1007,13 @@ void dcn30_mpc_construct(struct dcn30_mp
+ int num_mpcc,
+ int num_rmu);
+
++void mpc3_mpc_init(
++ struct mpc *mpc);
++
++void mpc3_mpc_init_single_inst(
++ struct mpc *mpc,
++ unsigned int mpcc_id);
++
+ bool mpc3_program_shaper(
+ struct mpc *mpc,
+ const struct pwl_params *params,
+@@ -1074,13 +1081,6 @@ bool mpc3_is_dwb_idle(
+ struct mpc *mpc,
+ int dwb_id);
+
+-void mpc3_set_out_rate_control(
+- struct mpc *mpc,
+- int opp_id,
+- bool enable,
+- bool rate_2x_mode,
+- struct mpc_dwb_flow_control *flow_control);
+-
+ void mpc3_power_on_ogam_lut(
+ struct mpc *mpc, int mpcc_id,
+ bool power_on);
+--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_mpc.c
+@@ -47,7 +47,7 @@ void mpc32_mpc_init(struct mpc *mpc)
+ struct dcn30_mpc *mpc30 = TO_DCN30_MPC(mpc);
+ int mpcc_id;
+
+- mpc1_mpc_init(mpc);
++ mpc3_mpc_init(mpc);
+
+ if (mpc->ctx->dc->debug.enable_mem_low_power.bits.mpc) {
+ if (mpc30->mpc_mask->MPCC_MCM_SHAPER_MEM_LOW_PWR_MODE && mpc30->mpc_mask->MPCC_MCM_3DLUT_MEM_LOW_PWR_MODE) {
+@@ -991,7 +991,7 @@ static const struct mpc_funcs dcn32_mpc_
+ .insert_plane = mpc1_insert_plane,
+ .remove_mpcc = mpc1_remove_mpcc,
+ .mpc_init = mpc32_mpc_init,
+- .mpc_init_single_inst = mpc1_mpc_init_single_inst,
++ .mpc_init_single_inst = mpc3_mpc_init_single_inst,
+ .update_blending = mpc2_update_blending,
+ .cursor_lock = mpc1_cursor_lock,
+ .get_mpcc_for_dpp = mpc1_get_mpcc_for_dpp,
+@@ -1008,7 +1008,6 @@ static const struct mpc_funcs dcn32_mpc_
+ .set_dwb_mux = mpc3_set_dwb_mux,
+ .disable_dwb_mux = mpc3_disable_dwb_mux,
+ .is_dwb_idle = mpc3_is_dwb_idle,
+- .set_out_rate_control = mpc3_set_out_rate_control,
+ .set_gamut_remap = mpc3_set_gamut_remap,
+ .program_shaper = mpc32_program_shaper,
+ .program_3dlut = mpc32_program_3dlut,
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c
+@@ -69,29 +69,6 @@
+ #define FN(reg_name, field_name) \
+ hws->shifts->field_name, hws->masks->field_name
+
+-static int calc_mpc_flow_ctrl_cnt(const struct dc_stream_state *stream,
+- int opp_cnt)
+-{
+- bool hblank_halved = optc2_is_two_pixels_per_containter(&stream->timing);
+- int flow_ctrl_cnt;
+-
+- if (opp_cnt >= 2)
+- hblank_halved = true;
+-
+- flow_ctrl_cnt = stream->timing.h_total - stream->timing.h_addressable -
+- stream->timing.h_border_left -
+- stream->timing.h_border_right;
+-
+- if (hblank_halved)
+- flow_ctrl_cnt /= 2;
+-
+- /* ODM combine 4:1 case */
+- if (opp_cnt == 4)
+- flow_ctrl_cnt /= 2;
+-
+- return flow_ctrl_cnt;
+-}
+-
+ static void update_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable)
+ {
+ struct display_stream_compressor *dsc = pipe_ctx->stream_res.dsc;
+@@ -183,10 +160,6 @@ void dcn314_update_odm(struct dc *dc, st
+ struct pipe_ctx *odm_pipe;
+ int opp_cnt = 0;
+ int opp_inst[MAX_PIPES] = {0};
+- bool rate_control_2x_pclk = (pipe_ctx->stream->timing.flags.INTERLACE || optc2_is_two_pixels_per_containter(&pipe_ctx->stream->timing));
+- struct mpc_dwb_flow_control flow_control;
+- struct mpc *mpc = dc->res_pool->mpc;
+- int i;
+
+ opp_cnt = get_odm_config(pipe_ctx, opp_inst);
+
+@@ -199,20 +172,6 @@ void dcn314_update_odm(struct dc *dc, st
+ pipe_ctx->stream_res.tg->funcs->set_odm_bypass(
+ pipe_ctx->stream_res.tg, &pipe_ctx->stream->timing);
+
+- rate_control_2x_pclk = rate_control_2x_pclk || opp_cnt > 1;
+- flow_control.flow_ctrl_mode = 0;
+- flow_control.flow_ctrl_cnt0 = 0x80;
+- flow_control.flow_ctrl_cnt1 = calc_mpc_flow_ctrl_cnt(pipe_ctx->stream, opp_cnt);
+- if (mpc->funcs->set_out_rate_control) {
+- for (i = 0; i < opp_cnt; ++i) {
+- mpc->funcs->set_out_rate_control(
+- mpc, opp_inst[i],
+- true,
+- rate_control_2x_pclk,
+- &flow_control);
+- }
+- }
+-
+ for (odm_pipe = pipe_ctx->next_odm_pipe; odm_pipe; odm_pipe = odm_pipe->next_odm_pipe) {
+ odm_pipe->stream_res.opp->funcs->opp_pipe_clock_control(
+ odm_pipe->stream_res.opp,
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c
+@@ -966,29 +966,6 @@ void dcn32_init_hw(struct dc *dc)
+ }
+ }
+
+-static int calc_mpc_flow_ctrl_cnt(const struct dc_stream_state *stream,
+- int opp_cnt)
+-{
+- bool hblank_halved = optc2_is_two_pixels_per_containter(&stream->timing);
+- int flow_ctrl_cnt;
+-
+- if (opp_cnt >= 2)
+- hblank_halved = true;
+-
+- flow_ctrl_cnt = stream->timing.h_total - stream->timing.h_addressable -
+- stream->timing.h_border_left -
+- stream->timing.h_border_right;
+-
+- if (hblank_halved)
+- flow_ctrl_cnt /= 2;
+-
+- /* ODM combine 4:1 case */
+- if (opp_cnt == 4)
+- flow_ctrl_cnt /= 2;
+-
+- return flow_ctrl_cnt;
+-}
+-
+ static void update_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable)
+ {
+ struct display_stream_compressor *dsc = pipe_ctx->stream_res.dsc;
+@@ -1103,10 +1080,6 @@ void dcn32_update_odm(struct dc *dc, str
+ struct pipe_ctx *odm_pipe;
+ int opp_cnt = 0;
+ int opp_inst[MAX_PIPES] = {0};
+- bool rate_control_2x_pclk = (pipe_ctx->stream->timing.flags.INTERLACE || optc2_is_two_pixels_per_containter(&pipe_ctx->stream->timing));
+- struct mpc_dwb_flow_control flow_control;
+- struct mpc *mpc = dc->res_pool->mpc;
+- int i;
+
+ opp_cnt = get_odm_config(pipe_ctx, opp_inst);
+
+@@ -1119,20 +1092,6 @@ void dcn32_update_odm(struct dc *dc, str
+ pipe_ctx->stream_res.tg->funcs->set_odm_bypass(
+ pipe_ctx->stream_res.tg, &pipe_ctx->stream->timing);
+
+- rate_control_2x_pclk = rate_control_2x_pclk || opp_cnt > 1;
+- flow_control.flow_ctrl_mode = 0;
+- flow_control.flow_ctrl_cnt0 = 0x80;
+- flow_control.flow_ctrl_cnt1 = calc_mpc_flow_ctrl_cnt(pipe_ctx->stream, opp_cnt);
+- if (mpc->funcs->set_out_rate_control) {
+- for (i = 0; i < opp_cnt; ++i) {
+- mpc->funcs->set_out_rate_control(
+- mpc, opp_inst[i],
+- true,
+- rate_control_2x_pclk,
+- &flow_control);
+- }
+- }
+-
+ for (odm_pipe = pipe_ctx->next_odm_pipe; odm_pipe; odm_pipe = odm_pipe->next_odm_pipe) {
+ odm_pipe->stream_res.opp->funcs->opp_pipe_clock_control(
+ odm_pipe->stream_res.opp,
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c
+@@ -358,29 +358,6 @@ void dcn35_init_hw(struct dc *dc)
+ }
+ }
+
+-static int calc_mpc_flow_ctrl_cnt(const struct dc_stream_state *stream,
+- int opp_cnt)
+-{
+- bool hblank_halved = optc2_is_two_pixels_per_containter(&stream->timing);
+- int flow_ctrl_cnt;
+-
+- if (opp_cnt >= 2)
+- hblank_halved = true;
+-
+- flow_ctrl_cnt = stream->timing.h_total - stream->timing.h_addressable -
+- stream->timing.h_border_left -
+- stream->timing.h_border_right;
+-
+- if (hblank_halved)
+- flow_ctrl_cnt /= 2;
+-
+- /* ODM combine 4:1 case */
+- if (opp_cnt == 4)
+- flow_ctrl_cnt /= 2;
+-
+- return flow_ctrl_cnt;
+-}
+-
+ static void update_dsc_on_stream(struct pipe_ctx *pipe_ctx, bool enable)
+ {
+ struct display_stream_compressor *dsc = pipe_ctx->stream_res.dsc;
+@@ -474,10 +451,6 @@ void dcn35_update_odm(struct dc *dc, str
+ struct pipe_ctx *odm_pipe;
+ int opp_cnt = 0;
+ int opp_inst[MAX_PIPES] = {0};
+- bool rate_control_2x_pclk = (pipe_ctx->stream->timing.flags.INTERLACE || optc2_is_two_pixels_per_containter(&pipe_ctx->stream->timing));
+- struct mpc_dwb_flow_control flow_control;
+- struct mpc *mpc = dc->res_pool->mpc;
+- int i;
+
+ opp_cnt = get_odm_config(pipe_ctx, opp_inst);
+
+@@ -490,20 +463,6 @@ void dcn35_update_odm(struct dc *dc, str
+ pipe_ctx->stream_res.tg->funcs->set_odm_bypass(
+ pipe_ctx->stream_res.tg, &pipe_ctx->stream->timing);
+
+- rate_control_2x_pclk = rate_control_2x_pclk || opp_cnt > 1;
+- flow_control.flow_ctrl_mode = 0;
+- flow_control.flow_ctrl_cnt0 = 0x80;
+- flow_control.flow_ctrl_cnt1 = calc_mpc_flow_ctrl_cnt(pipe_ctx->stream, opp_cnt);
+- if (mpc->funcs->set_out_rate_control) {
+- for (i = 0; i < opp_cnt; ++i) {
+- mpc->funcs->set_out_rate_control(
+- mpc, opp_inst[i],
+- true,
+- rate_control_2x_pclk,
+- &flow_control);
+- }
+- }
+-
+ for (odm_pipe = pipe_ctx->next_odm_pipe; odm_pipe; odm_pipe = odm_pipe->next_odm_pipe) {
+ odm_pipe->stream_res.opp->funcs->opp_pipe_clock_control(
+ odm_pipe->stream_res.opp,
--- /dev/null
+From 0ccc2b30f4feadc0b1a282dbcc06e396382e5d74 Mon Sep 17 00:00:00 2001
+From: Xi Liu <xi.liu@amd.com>
+Date: Tue, 27 Feb 2024 13:39:00 -0500
+Subject: drm/amd/display: Set DCN351 BB and IP the same as DCN35
+
+From: Xi Liu <xi.liu@amd.com>
+
+commit 0ccc2b30f4feadc0b1a282dbcc06e396382e5d74 upstream.
+
+[WHY & HOW]
+DCN351 and DCN35 should use the same bounding box and IP settings.
+
+Cc: Mario Limonciello <mario.limonciello@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Jun Lei <jun.lei@amd.com>
+Acked-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Xi Liu <xi.liu@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c
++++ b/drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c
+@@ -228,17 +228,13 @@ void dml2_init_socbb_params(struct dml2_
+ break;
+
+ case dml_project_dcn35:
++ case dml_project_dcn351:
+ out->num_chans = 4;
+ out->round_trip_ping_latency_dcfclk_cycles = 106;
+ out->smn_latency_us = 2;
+ out->dispclk_dppclk_vco_speed_mhz = 3600;
+ break;
+
+- case dml_project_dcn351:
+- out->num_chans = 16;
+- out->round_trip_ping_latency_dcfclk_cycles = 1100;
+- out->smn_latency_us = 2;
+- break;
+ }
+ /* ---Overrides if available--- */
+ if (dml2->config.bbox_overrides.dram_num_chan)
--- /dev/null
+From 8678b1060ae2b75feb60b87e5b75e17374e3c1c5 Mon Sep 17 00:00:00 2001
+From: Johannes Weiner <hannes@cmpxchg.org>
+Date: Thu, 7 Mar 2024 17:07:37 -0500
+Subject: drm/amdgpu: fix deadlock while reading mqd from debugfs
+
+From: Johannes Weiner <hannes@cmpxchg.org>
+
+commit 8678b1060ae2b75feb60b87e5b75e17374e3c1c5 upstream.
+
+An errant disk backup on my desktop got into debugfs and triggered the
+following deadlock scenario in the amdgpu debugfs files. The machine
+also hard-resets immediately after those lines are printed (although I
+wasn't able to reproduce that part when reading by hand):
+
+[ 1318.016074][ T1082] ======================================================
+[ 1318.016607][ T1082] WARNING: possible circular locking dependency detected
+[ 1318.017107][ T1082] 6.8.0-rc7-00015-ge0c8221b72c0 #17 Not tainted
+[ 1318.017598][ T1082] ------------------------------------------------------
+[ 1318.018096][ T1082] tar/1082 is trying to acquire lock:
+[ 1318.018585][ T1082] ffff98c44175d6a0 (&mm->mmap_lock){++++}-{3:3}, at: __might_fault+0x40/0x80
+[ 1318.019084][ T1082]
+[ 1318.019084][ T1082] but task is already holding lock:
+[ 1318.020052][ T1082] ffff98c4c13f55f8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: amdgpu_debugfs_mqd_read+0x6a/0x250 [amdgpu]
+[ 1318.020607][ T1082]
+[ 1318.020607][ T1082] which lock already depends on the new lock.
+[ 1318.020607][ T1082]
+[ 1318.022081][ T1082]
+[ 1318.022081][ T1082] the existing dependency chain (in reverse order) is:
+[ 1318.023083][ T1082]
+[ 1318.023083][ T1082] -> #2 (reservation_ww_class_mutex){+.+.}-{3:3}:
+[ 1318.024114][ T1082] __ww_mutex_lock.constprop.0+0xe0/0x12f0
+[ 1318.024639][ T1082] ww_mutex_lock+0x32/0x90
+[ 1318.025161][ T1082] dma_resv_lockdep+0x18a/0x330
+[ 1318.025683][ T1082] do_one_initcall+0x6a/0x350
+[ 1318.026210][ T1082] kernel_init_freeable+0x1a3/0x310
+[ 1318.026728][ T1082] kernel_init+0x15/0x1a0
+[ 1318.027242][ T1082] ret_from_fork+0x2c/0x40
+[ 1318.027759][ T1082] ret_from_fork_asm+0x11/0x20
+[ 1318.028281][ T1082]
+[ 1318.028281][ T1082] -> #1 (reservation_ww_class_acquire){+.+.}-{0:0}:
+[ 1318.029297][ T1082] dma_resv_lockdep+0x16c/0x330
+[ 1318.029790][ T1082] do_one_initcall+0x6a/0x350
+[ 1318.030263][ T1082] kernel_init_freeable+0x1a3/0x310
+[ 1318.030722][ T1082] kernel_init+0x15/0x1a0
+[ 1318.031168][ T1082] ret_from_fork+0x2c/0x40
+[ 1318.031598][ T1082] ret_from_fork_asm+0x11/0x20
+[ 1318.032011][ T1082]
+[ 1318.032011][ T1082] -> #0 (&mm->mmap_lock){++++}-{3:3}:
+[ 1318.032778][ T1082] __lock_acquire+0x14bf/0x2680
+[ 1318.033141][ T1082] lock_acquire+0xcd/0x2c0
+[ 1318.033487][ T1082] __might_fault+0x58/0x80
+[ 1318.033814][ T1082] amdgpu_debugfs_mqd_read+0x103/0x250 [amdgpu]
+[ 1318.034181][ T1082] full_proxy_read+0x55/0x80
+[ 1318.034487][ T1082] vfs_read+0xa7/0x360
+[ 1318.034788][ T1082] ksys_read+0x70/0xf0
+[ 1318.035085][ T1082] do_syscall_64+0x94/0x180
+[ 1318.035375][ T1082] entry_SYSCALL_64_after_hwframe+0x46/0x4e
+[ 1318.035664][ T1082]
+[ 1318.035664][ T1082] other info that might help us debug this:
+[ 1318.035664][ T1082]
+[ 1318.036487][ T1082] Chain exists of:
+[ 1318.036487][ T1082] &mm->mmap_lock --> reservation_ww_class_acquire --> reservation_ww_class_mutex
+[ 1318.036487][ T1082]
+[ 1318.037310][ T1082] Possible unsafe locking scenario:
+[ 1318.037310][ T1082]
+[ 1318.037838][ T1082] CPU0 CPU1
+[ 1318.038101][ T1082] ---- ----
+[ 1318.038350][ T1082] lock(reservation_ww_class_mutex);
+[ 1318.038590][ T1082] lock(reservation_ww_class_acquire);
+[ 1318.038839][ T1082] lock(reservation_ww_class_mutex);
+[ 1318.039083][ T1082] rlock(&mm->mmap_lock);
+[ 1318.039328][ T1082]
+[ 1318.039328][ T1082] *** DEADLOCK ***
+[ 1318.039328][ T1082]
+[ 1318.040029][ T1082] 1 lock held by tar/1082:
+[ 1318.040259][ T1082] #0: ffff98c4c13f55f8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: amdgpu_debugfs_mqd_read+0x6a/0x250 [amdgpu]
+[ 1318.040560][ T1082]
+[ 1318.040560][ T1082] stack backtrace:
+[ 1318.041053][ T1082] CPU: 22 PID: 1082 Comm: tar Not tainted 6.8.0-rc7-00015-ge0c8221b72c0 #17 3316c85d50e282c5643b075d1f01a4f6365e39c2
+[ 1318.041329][ T1082] Hardware name: Gigabyte Technology Co., Ltd. B650 AORUS PRO AX/B650 AORUS PRO AX, BIOS F20 12/14/2023
+[ 1318.041614][ T1082] Call Trace:
+[ 1318.041895][ T1082] <TASK>
+[ 1318.042175][ T1082] dump_stack_lvl+0x4a/0x80
+[ 1318.042460][ T1082] check_noncircular+0x145/0x160
+[ 1318.042743][ T1082] __lock_acquire+0x14bf/0x2680
+[ 1318.043022][ T1082] lock_acquire+0xcd/0x2c0
+[ 1318.043301][ T1082] ? __might_fault+0x40/0x80
+[ 1318.043580][ T1082] ? __might_fault+0x40/0x80
+[ 1318.043856][ T1082] __might_fault+0x58/0x80
+[ 1318.044131][ T1082] ? __might_fault+0x40/0x80
+[ 1318.044408][ T1082] amdgpu_debugfs_mqd_read+0x103/0x250 [amdgpu 8fe2afaa910cbd7654c8cab23563a94d6caebaab]
+[ 1318.044749][ T1082] full_proxy_read+0x55/0x80
+[ 1318.045042][ T1082] vfs_read+0xa7/0x360
+[ 1318.045333][ T1082] ksys_read+0x70/0xf0
+[ 1318.045623][ T1082] do_syscall_64+0x94/0x180
+[ 1318.045913][ T1082] ? do_syscall_64+0xa0/0x180
+[ 1318.046201][ T1082] ? lockdep_hardirqs_on+0x7d/0x100
+[ 1318.046487][ T1082] ? do_syscall_64+0xa0/0x180
+[ 1318.046773][ T1082] ? do_syscall_64+0xa0/0x180
+[ 1318.047057][ T1082] ? do_syscall_64+0xa0/0x180
+[ 1318.047337][ T1082] ? do_syscall_64+0xa0/0x180
+[ 1318.047611][ T1082] entry_SYSCALL_64_after_hwframe+0x46/0x4e
+[ 1318.047887][ T1082] RIP: 0033:0x7f480b70a39d
+[ 1318.048162][ T1082] Code: 91 ba 0d 00 f7 d8 64 89 02 b8 ff ff ff ff eb b2 e8 18 a3 01 00 0f 1f 84 00 00 00 00 00 80 3d a9 3c 0e 00 00 74 17 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 5b c3 66 2e 0f 1f 84 00 00 00 00 00 53 48 83
+[ 1318.048769][ T1082] RSP: 002b:00007ffde77f5c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
+[ 1318.049083][ T1082] RAX: ffffffffffffffda RBX: 0000000000000800 RCX: 00007f480b70a39d
+[ 1318.049392][ T1082] RDX: 0000000000000800 RSI: 000055c9f2120c00 RDI: 0000000000000008
+[ 1318.049703][ T1082] RBP: 0000000000000800 R08: 000055c9f2120a94 R09: 0000000000000007
+[ 1318.050011][ T1082] R10: 0000000000000000 R11: 0000000000000246 R12: 000055c9f2120c00
+[ 1318.050324][ T1082] R13: 0000000000000008 R14: 0000000000000008 R15: 0000000000000800
+[ 1318.050638][ T1082] </TASK>
+
+amdgpu_debugfs_mqd_read() holds a reservation when it calls
+put_user(), which may fault and acquire the mmap_sem. This violates
+the established locking order.
+
+Bounce the mqd data through a kernel buffer to get put_user() out of
+the illegal section.
+
+Fixes: 445d85e3c1df ("drm/amdgpu: add debugfs interface for reading MQDs")
+Cc: stable@vger.kernel.org # v6.5+
+Reviewed-by: Shashank Sharma <shashank.sharma@amd.com>
+Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 46 +++++++++++++++++++------------
+ 1 file changed, 29 insertions(+), 17 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
+@@ -524,46 +524,58 @@ static ssize_t amdgpu_debugfs_mqd_read(s
+ {
+ struct amdgpu_ring *ring = file_inode(f)->i_private;
+ volatile u32 *mqd;
+- int r;
++ u32 *kbuf;
++ int r, i;
+ uint32_t value, result;
+
+ if (*pos & 3 || size & 3)
+ return -EINVAL;
+
+- result = 0;
++ kbuf = kmalloc(ring->mqd_size, GFP_KERNEL);
++ if (!kbuf)
++ return -ENOMEM;
+
+ r = amdgpu_bo_reserve(ring->mqd_obj, false);
+ if (unlikely(r != 0))
+- return r;
++ goto err_free;
+
+ r = amdgpu_bo_kmap(ring->mqd_obj, (void **)&mqd);
+- if (r) {
+- amdgpu_bo_unreserve(ring->mqd_obj);
+- return r;
+- }
++ if (r)
++ goto err_unreserve;
++
++ /*
++ * Copy to local buffer to avoid put_user(), which might fault
++ * and acquire mmap_sem, under reservation_ww_class_mutex.
++ */
++ for (i = 0; i < ring->mqd_size/sizeof(u32); i++)
++ kbuf[i] = mqd[i];
++
++ amdgpu_bo_kunmap(ring->mqd_obj);
++ amdgpu_bo_unreserve(ring->mqd_obj);
+
++ result = 0;
+ while (size) {
+ if (*pos >= ring->mqd_size)
+- goto done;
++ break;
+
+- value = mqd[*pos/4];
++ value = kbuf[*pos/4];
+ r = put_user(value, (uint32_t *)buf);
+ if (r)
+- goto done;
++ goto err_free;
+ buf += 4;
+ result += 4;
+ size -= 4;
+ *pos += 4;
+ }
+
+-done:
+- amdgpu_bo_kunmap(ring->mqd_obj);
+- mqd = NULL;
+- amdgpu_bo_unreserve(ring->mqd_obj);
+- if (r)
+- return r;
+-
++ kfree(kbuf);
+ return result;
++
++err_unreserve:
++ amdgpu_bo_unreserve(ring->mqd_obj);
++err_free:
++ kfree(kbuf);
++ return r;
+ }
+
+ static const struct file_operations amdgpu_debugfs_mqd_fops = {
--- /dev/null
+From 1210e2f1033dc56b666c9f6dfb761a2d3f9f5d6c Mon Sep 17 00:00:00 2001
+From: Eric Huang <jinhuieric.huang@amd.com>
+Date: Wed, 20 Mar 2024 15:53:47 -0400
+Subject: drm/amdkfd: fix TLB flush after unmap for GFX9.4.2
+
+From: Eric Huang <jinhuieric.huang@amd.com>
+
+commit 1210e2f1033dc56b666c9f6dfb761a2d3f9f5d6c upstream.
+
+TLB flush after unmap accidentially was removed on
+gfx9.4.2. It is to add it back.
+
+Signed-off-by: Eric Huang <jinhuieric.huang@amd.com>
+Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+@@ -1473,7 +1473,7 @@ static inline void kfd_flush_tlb(struct
+
+ static inline bool kfd_flush_tlb_after_unmap(struct kfd_dev *dev)
+ {
+- return KFD_GC_VERSION(dev) > IP_VERSION(9, 4, 2) ||
++ return KFD_GC_VERSION(dev) >= IP_VERSION(9, 4, 2) ||
+ (KFD_GC_VERSION(dev) == IP_VERSION(9, 4, 1) && dev->sdma_fw_version >= 18) ||
+ KFD_GC_VERSION(dev) == IP_VERSION(9, 4, 0);
+ }
--- /dev/null
+From 9cbd1dae842737bfafa4b10a87909fa209dde250 Mon Sep 17 00:00:00 2001
+From: Chris Bainbridge <chris.bainbridge@gmail.com>
+Date: Sat, 16 Mar 2024 12:05:59 +0000
+Subject: drm/dp: Fix divide-by-zero regression on DP MST unplug with nouveau
+
+From: Chris Bainbridge <chris.bainbridge@gmail.com>
+
+commit 9cbd1dae842737bfafa4b10a87909fa209dde250 upstream.
+
+Fix a regression when using nouveau and unplugging a StarTech MSTDP122DP
+DisplayPort 1.2 MST hub (the same regression does not appear when using
+a Cable Matters DisplayPort 1.4 MST hub). Trace:
+
+ divide error: 0000 [#1] PREEMPT SMP PTI
+ CPU: 7 PID: 2962 Comm: Xorg Not tainted 6.8.0-rc3+ #744
+ Hardware name: Razer Blade/DANA_MB, BIOS 01.01 08/31/2018
+ RIP: 0010:drm_dp_bw_overhead+0xb4/0x110 [drm_display_helper]
+ Code: c6 b8 01 00 00 00 75 61 01 c6 41 0f af f3 41 0f af f1 c1 e1 04 48 63 c7 31 d2 89 ff 48 8b 5d f8 c9 48 0f af f1 48 8d 44 06 ff <48> f7 f7 31 d2 31 c9 31 f6 31 ff 45 31 c0 45 31 c9 45 31 d2 45 31
+ RSP: 0018:ffffb2c5c211fa30 EFLAGS: 00010206
+ RAX: ffffffffffffffff RBX: 0000000000000000 RCX: 0000000000f59b00
+ RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
+ RBP: ffffb2c5c211fa48 R08: 0000000000000001 R09: 0000000000000020
+ R10: 0000000000000004 R11: 0000000000000000 R12: 0000000000023b4a
+ R13: ffff91d37d165800 R14: ffff91d36fac6d80 R15: ffff91d34a764010
+ FS: 00007f4a1ca3fa80(0000) GS:ffff91d6edbc0000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000559491d49000 CR3: 000000011d180002 CR4: 00000000003706f0
+ Call Trace:
+ <TASK>
+ ? show_regs+0x6d/0x80
+ ? die+0x37/0xa0
+ ? do_trap+0xd4/0xf0
+ ? do_error_trap+0x71/0xb0
+ ? drm_dp_bw_overhead+0xb4/0x110 [drm_display_helper]
+ ? exc_divide_error+0x3a/0x70
+ ? drm_dp_bw_overhead+0xb4/0x110 [drm_display_helper]
+ ? asm_exc_divide_error+0x1b/0x20
+ ? drm_dp_bw_overhead+0xb4/0x110 [drm_display_helper]
+ ? drm_dp_calc_pbn_mode+0x2e/0x70 [drm_display_helper]
+ nv50_msto_atomic_check+0xda/0x120 [nouveau]
+ drm_atomic_helper_check_modeset+0xa87/0xdf0 [drm_kms_helper]
+ drm_atomic_helper_check+0x19/0xa0 [drm_kms_helper]
+ nv50_disp_atomic_check+0x13f/0x2f0 [nouveau]
+ drm_atomic_check_only+0x668/0xb20 [drm]
+ ? drm_connector_list_iter_next+0x86/0xc0 [drm]
+ drm_atomic_commit+0x58/0xd0 [drm]
+ ? __pfx___drm_printfn_info+0x10/0x10 [drm]
+ drm_atomic_connector_commit_dpms+0xd7/0x100 [drm]
+ drm_mode_obj_set_property_ioctl+0x1c5/0x450 [drm]
+ ? __pfx_drm_connector_property_set_ioctl+0x10/0x10 [drm]
+ drm_connector_property_set_ioctl+0x3b/0x60 [drm]
+ drm_ioctl_kernel+0xb9/0x120 [drm]
+ drm_ioctl+0x2d0/0x550 [drm]
+ ? __pfx_drm_connector_property_set_ioctl+0x10/0x10 [drm]
+ nouveau_drm_ioctl+0x61/0xc0 [nouveau]
+ __x64_sys_ioctl+0xa0/0xf0
+ do_syscall_64+0x76/0x140
+ ? do_syscall_64+0x85/0x140
+ ? do_syscall_64+0x85/0x140
+ entry_SYSCALL_64_after_hwframe+0x6e/0x76
+ RIP: 0033:0x7f4a1cd1a94f
+ Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 77 1f 48 8b 44 24 18 64 48 2b 04 25 28 00
+ RSP: 002b:00007ffd2f1df520 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
+ RAX: ffffffffffffffda RBX: 00007ffd2f1df5b0 RCX: 00007f4a1cd1a94f
+ RDX: 00007ffd2f1df5b0 RSI: 00000000c01064ab RDI: 000000000000000f
+ RBP: 00000000c01064ab R08: 000056347932deb8 R09: 000056347a7d99c0
+ R10: 0000000000000000 R11: 0000000000000246 R12: 000056347938a220
+ R13: 000000000000000f R14: 0000563479d9f3f0 R15: 0000000000000000
+ </TASK>
+ Modules linked in: rfcomm xt_conntrack nft_chain_nat xt_MASQUERADE nf_nat nf_conntrack_netlink nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xfrm_user xfrm_algo xt_addrtype nft_compat nf_tables nfnetlink br_netfilter bridge stp llc ccm cmac algif_hash overlay algif_skcipher af_alg bnep binfmt_misc snd_sof_pci_intel_cnl snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_pci snd_sof_xtensa_dsp snd_sof_intel_hda snd_sof snd_sof_utils snd_soc_acpi_intel_match snd_soc_acpi snd_soc_core snd_compress snd_sof_intel_hda_mlink snd_hda_ext_core iwlmvm intel_rapl_msr intel_rapl_common intel_tcc_cooling x86_pkg_temp_thermal intel_powerclamp mac80211 coretemp kvm_intel snd_hda_codec_hdmi kvm snd_hda_codec_realtek snd_hda_codec_generic uvcvideo libarc4 snd_hda_intel snd_intel_dspcfg snd_hda_codec iwlwifi videobuf2_vmalloc videobuf2_memops uvc irqbypass btusb videobuf2_v4l2 snd_seq_midi crct10dif_pclmul hid_multitouch crc32_pclmul snd_seq_midi_event btrtl snd_hwdep videodev polyval_clmulni polyval_generic snd_rawmidi
+ ghash_clmulni_intel aesni_intel btintel crypto_simd snd_hda_core cryptd snd_seq btbcm ee1004 8250_dw videobuf2_common btmtk rapl nls_iso8859_1 mei_hdcp thunderbolt bluetooth intel_cstate wmi_bmof intel_wmi_thunderbolt cfg80211 snd_pcm mc snd_seq_device i2c_i801 r8169 ecdh_generic snd_timer i2c_smbus ecc snd mei_me intel_lpss_pci mei ahci intel_lpss soundcore realtek libahci idma64 intel_pch_thermal i2c_hid_acpi i2c_hid acpi_pad sch_fq_codel msr parport_pc ppdev lp parport efi_pstore ip_tables x_tables autofs4 dm_crypt raid10 raid456 libcrc32c async_raid6_recov async_memcpy async_pq async_xor xor async_tx raid6_pq raid1 raid0 joydev input_leds hid_generic usbhid hid nouveau i915 drm_ttm_helper gpu_sched drm_gpuvm drm_exec i2c_algo_bit drm_buddy ttm drm_display_helper drm_kms_helper cec rc_core drm nvme nvme_core mxm_wmi xhci_pci xhci_pci_renesas video wmi pinctrl_cannonlake mac_hid
+ ---[ end trace 0000000000000000 ]---
+
+Fix this by avoiding the divide if bpp is 0.
+
+Fixes: c1d6a22b7219 ("drm/dp: Add helpers to calculate the link BW overhead")
+Cc: stable@vger.kernel.org
+Acked-by: Imre Deak <imre.deak@intel.com>
+Signed-off-by: Chris Bainbridge <chris.bainbridge@gmail.com>
+Signed-off-by: Imre Deak <imre.deak@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/ZfWLJwYikw2K7B6c@debian.local
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/display/drm_dp_helper.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/gpu/drm/display/drm_dp_helper.c b/drivers/gpu/drm/display/drm_dp_helper.c
+index b1ca3a1100da..26c188ce5f1c 100644
+--- a/drivers/gpu/drm/display/drm_dp_helper.c
++++ b/drivers/gpu/drm/display/drm_dp_helper.c
+@@ -3982,6 +3982,13 @@ int drm_dp_bw_overhead(int lane_count, int hactive,
+ u32 overhead = 1000000;
+ int symbol_cycles;
+
++ if (lane_count == 0 || hactive == 0 || bpp_x16 == 0) {
++ DRM_DEBUG_KMS("Invalid BW overhead params: lane_count %d, hactive %d, bpp_x16 %d.%04d\n",
++ lane_count, hactive,
++ bpp_x16 >> 4, (bpp_x16 & 0xf) * 625);
++ return 0;
++ }
++
+ /*
+ * DP Standard v2.1 2.6.4.1
+ * SSC downspread and ref clock variation margin:
+--
+2.44.0
+
--- /dev/null
+From 4be9075fec0a639384ed19975634b662bfab938f Mon Sep 17 00:00:00 2001
+From: Jocelyn Falempe <jfalempe@redhat.com>
+Date: Tue, 12 Mar 2024 10:35:12 +0100
+Subject: drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed
+
+From: Jocelyn Falempe <jfalempe@redhat.com>
+
+commit 4be9075fec0a639384ed19975634b662bfab938f upstream.
+
+The driver creates /sys/kernel/debug/dri/0/mob_ttm even when the
+corresponding ttm_resource_manager is not allocated.
+This leads to a crash when trying to read from this file.
+
+Add a check to create mob_ttm, system_mob_ttm, and gmr_ttm debug file
+only when the corresponding ttm_resource_manager is allocated.
+
+crash> bt
+PID: 3133409 TASK: ffff8fe4834a5000 CPU: 3 COMMAND: "grep"
+ #0 [ffffb954506b3b20] machine_kexec at ffffffffb2a6bec3
+ #1 [ffffb954506b3b78] __crash_kexec at ffffffffb2bb598a
+ #2 [ffffb954506b3c38] crash_kexec at ffffffffb2bb68c1
+ #3 [ffffb954506b3c50] oops_end at ffffffffb2a2a9b1
+ #4 [ffffb954506b3c70] no_context at ffffffffb2a7e913
+ #5 [ffffb954506b3cc8] __bad_area_nosemaphore at ffffffffb2a7ec8c
+ #6 [ffffb954506b3d10] do_page_fault at ffffffffb2a7f887
+ #7 [ffffb954506b3d40] page_fault at ffffffffb360116e
+ [exception RIP: ttm_resource_manager_debug+0x11]
+ RIP: ffffffffc04afd11 RSP: ffffb954506b3df0 RFLAGS: 00010246
+ RAX: ffff8fe41a6d1200 RBX: 0000000000000000 RCX: 0000000000000940
+ RDX: 0000000000000000 RSI: ffffffffc04b4338 RDI: 0000000000000000
+ RBP: ffffb954506b3e08 R8: ffff8fee3ffad000 R9: 0000000000000000
+ R10: ffff8fe41a76a000 R11: 0000000000000001 R12: 00000000ffffffff
+ R13: 0000000000000001 R14: ffff8fe5bb6f3900 R15: ffff8fe41a6d1200
+ ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
+ #8 [ffffb954506b3e00] ttm_resource_manager_show at ffffffffc04afde7 [ttm]
+ #9 [ffffb954506b3e30] seq_read at ffffffffb2d8f9f3
+ RIP: 00007f4c4eda8985 RSP: 00007ffdbba9e9f8 RFLAGS: 00000246
+ RAX: ffffffffffffffda RBX: 000000000037e000 RCX: 00007f4c4eda8985
+ RDX: 000000000037e000 RSI: 00007f4c41573000 RDI: 0000000000000003
+ RBP: 000000000037e000 R8: 0000000000000000 R9: 000000000037fe30
+ R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4c41573000
+ R13: 0000000000000003 R14: 00007f4c41572010 R15: 0000000000000003
+ ORIG_RAX: 0000000000000000 CS: 0033 SS: 002b
+
+Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>
+Fixes: af4a25bbe5e7 ("drm/vmwgfx: Add debugfs entries for various ttm resource managers")
+Cc: <stable@vger.kernel.org>
+Reviewed-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240312093551.196609-1-jfalempe@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -1444,12 +1444,15 @@ static void vmw_debugfs_resource_manager
+ root, "system_ttm");
+ ttm_resource_manager_create_debugfs(ttm_manager_type(&vmw->bdev, TTM_PL_VRAM),
+ root, "vram_ttm");
+- ttm_resource_manager_create_debugfs(ttm_manager_type(&vmw->bdev, VMW_PL_GMR),
+- root, "gmr_ttm");
+- ttm_resource_manager_create_debugfs(ttm_manager_type(&vmw->bdev, VMW_PL_MOB),
+- root, "mob_ttm");
+- ttm_resource_manager_create_debugfs(ttm_manager_type(&vmw->bdev, VMW_PL_SYSTEM),
+- root, "system_mob_ttm");
++ if (vmw->has_gmr)
++ ttm_resource_manager_create_debugfs(ttm_manager_type(&vmw->bdev, VMW_PL_GMR),
++ root, "gmr_ttm");
++ if (vmw->has_mob) {
++ ttm_resource_manager_create_debugfs(ttm_manager_type(&vmw->bdev, VMW_PL_MOB),
++ root, "mob_ttm");
++ ttm_resource_manager_create_debugfs(ttm_manager_type(&vmw->bdev, VMW_PL_SYSTEM),
++ root, "system_mob_ttm");
++ }
+ }
+
+ static int vmwgfx_pm_notifier(struct notifier_block *nb, unsigned long val,
--- /dev/null
+From 45c30b2923e5c53e0ef057a8a525b0456adde18e Mon Sep 17 00:00:00 2001
+From: Matthew Auld <matthew.auld@intel.com>
+Date: Thu, 21 Mar 2024 11:06:30 +0000
+Subject: drm/xe/query: fix gt_id bounds check
+
+From: Matthew Auld <matthew.auld@intel.com>
+
+commit 45c30b2923e5c53e0ef057a8a525b0456adde18e upstream.
+
+The user provided gt_id should always be less than the
+XE_MAX_GT_PER_TILE.
+
+Fixes: 7793d00d1bf5 ("drm/xe: Correlate engine and cpu timestamps with better accuracy")
+Signed-off-by: Matthew Auld <matthew.auld@intel.com>
+Cc: Nirmoy Das <nirmoy.das@intel.com>
+Cc: <stable@vger.kernel.org> # v6.8+
+Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
+Acked-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240321110629.334701-2-matthew.auld@intel.com
+(cherry picked from commit 4b275f502a0d3668195762fb55fa00e659ad1b0b)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_query.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_query.c b/drivers/gpu/drm/xe/xe_query.c
+index 92bb06c0586e..075f9eaef031 100644
+--- a/drivers/gpu/drm/xe/xe_query.c
++++ b/drivers/gpu/drm/xe/xe_query.c
+@@ -132,7 +132,7 @@ query_engine_cycles(struct xe_device *xe,
+ return -EINVAL;
+
+ eci = &resp.eci;
+- if (eci->gt_id > XE_MAX_GT_PER_TILE)
++ if (eci->gt_id >= XE_MAX_GT_PER_TILE)
+ return -EINVAL;
+
+ gt = xe_device_get_gt(xe, eci->gt_id);
+--
+2.44.0
+
--- /dev/null
+From 2aea94ac14d1e0a8ae9e34febebe208213ba72f7 Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Wed, 20 Mar 2024 11:26:07 -0700
+Subject: exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack()
+
+From: Max Filippov <jcmvbkbc@gmail.com>
+
+commit 2aea94ac14d1e0a8ae9e34febebe208213ba72f7 upstream.
+
+In NOMMU kernel the value of linux_binprm::p is the offset inside the
+temporary program arguments array maintained in separate pages in the
+linux_binprm::page. linux_binprm::exec being a copy of linux_binprm::p
+thus must be adjusted when that array is copied to the user stack.
+Without that adjustment the value passed by the NOMMU kernel to the ELF
+program in the AT_EXECFN entry of the aux array doesn't make any sense
+and it may break programs that try to access memory pointed to by that
+entry.
+
+Adjust linux_binprm::exec before the successful return from the
+transfer_args_to_stack().
+
+Cc: <stable@vger.kernel.org>
+Fixes: b6a2fea39318 ("mm: variable length argument support")
+Fixes: 5edc2a5123a7 ("binfmt_elf_fdpic: wire up AT_EXECFD, AT_EXECFN, AT_SECURE")
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Link: https://lore.kernel.org/r/20240320182607.1472887-1-jcmvbkbc@gmail.com
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/exec.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -895,6 +895,7 @@ int transfer_args_to_stack(struct linux_
+ goto out;
+ }
+
++ bprm->exec += *sp_location - MAX_ARG_PAGES * PAGE_SIZE;
+ *sp_location = sp;
+
+ out:
--- /dev/null
+From a8eb93b42d7e068306ca07f51055cbcde893fea3 Mon Sep 17 00:00:00 2001
+From: Thomas Zimmermann <tzimmermann@suse.de>
+Date: Fri, 22 Mar 2024 09:29:46 +0100
+Subject: fbdev: Select I/O-memory framebuffer ops for SBus
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+commit a8eb93b42d7e068306ca07f51055cbcde893fea3 upstream.
+
+Framebuffer I/O on the Sparc Sbus requires read/write helpers for
+I/O memory. Select FB_IOMEM_FOPS accordingly.
+
+Reported-by: Nick Bowler <nbowler@draconx.ca>
+Closes: https://lore.kernel.org/lkml/5bc21364-41da-a339-676e-5bb0f4faebfb@draconx.ca/
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Fixes: 8813e86f6d82 ("fbdev: Remove default file-I/O implementations")
+Cc: Thomas Zimmermann <tzimmermann@suse.de>
+Cc: Javier Martinez Canillas <javierm@redhat.com>
+Cc: Daniel Vetter <daniel@ffwll.ch>
+Cc: Helge Deller <deller@gmx.de>
+Cc: Sam Ravnborg <sam@ravnborg.org>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Geert Uytterhoeven <geert+renesas@glider.be>
+Cc: linux-fbdev@vger.kernel.org
+Cc: dri-devel@lists.freedesktop.org
+Cc: <stable@vger.kernel.org> # v6.8+
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240322083005.24269-1-tzimmermann@suse.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/Kconfig | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/video/fbdev/Kconfig
++++ b/drivers/video/fbdev/Kconfig
+@@ -501,6 +501,7 @@ config FB_SBUS_HELPERS
+ select FB_CFB_COPYAREA
+ select FB_CFB_FILLRECT
+ select FB_CFB_IMAGEBLIT
++ select FB_IOMEM_FOPS
+
+ config FB_BW2
+ bool "BWtwo support"
+@@ -521,6 +522,7 @@ config FB_CG6
+ depends on (FB = y) && (SPARC && FB_SBUS)
+ select FB_CFB_COPYAREA
+ select FB_CFB_IMAGEBLIT
++ select FB_IOMEM_FOPS
+ help
+ This is the frame buffer device driver for the CGsix (GX, TurboGX)
+ frame buffer.
+@@ -530,6 +532,7 @@ config FB_FFB
+ depends on FB_SBUS && SPARC64
+ select FB_CFB_COPYAREA
+ select FB_CFB_IMAGEBLIT
++ select FB_IOMEM_FOPS
+ help
+ This is the frame buffer device driver for the Creator, Creator3D,
+ and Elite3D graphics boards.
--- /dev/null
+From b34490879baa847d16fc529c8ea6e6d34f004b38 Mon Sep 17 00:00:00 2001
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Date: Mon, 25 Mar 2024 10:02:42 +0100
+Subject: gpio: cdev: sanitize the label before requesting the interrupt
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+commit b34490879baa847d16fc529c8ea6e6d34f004b38 upstream.
+
+When an interrupt is requested, a procfs directory is created under
+"/proc/irq/<irqnum>/<label>" where <label> is the string passed to one of
+the request_irq() variants.
+
+What follows is that the string must not contain the "/" character or
+the procfs mkdir operation will fail. We don't have such constraints for
+GPIO consumer labels which are used verbatim as interrupt labels for
+GPIO irqs. We must therefore sanitize the consumer string before
+requesting the interrupt.
+
+Let's replace all "/" with ":".
+
+Cc: stable@vger.kernel.org
+Reported-by: Stefan Wahren <wahrenst@gmx.net>
+Closes: https://lore.kernel.org/linux-gpio/39fe95cb-aa83-4b8b-8cab-63947a726754@gmx.net/
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Reviewed-by: Kent Gibson <warthog618@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpiolib-cdev.c | 38 ++++++++++++++++++++++++++++++++------
+ 1 file changed, 32 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpio/gpiolib-cdev.c
++++ b/drivers/gpio/gpiolib-cdev.c
+@@ -1089,10 +1089,20 @@ static u32 gpio_v2_line_config_debounce_
+ return 0;
+ }
+
++static inline char *make_irq_label(const char *orig)
++{
++ return kstrdup_and_replace(orig, '/', ':', GFP_KERNEL);
++}
++
++static inline void free_irq_label(const char *label)
++{
++ kfree(label);
++}
++
+ static void edge_detector_stop(struct line *line)
+ {
+ if (line->irq) {
+- free_irq(line->irq, line);
++ free_irq_label(free_irq(line->irq, line));
+ line->irq = 0;
+ }
+
+@@ -1116,6 +1126,7 @@ static int edge_detector_setup(struct li
+ unsigned long irqflags = 0;
+ u64 eflags;
+ int irq, ret;
++ char *label;
+
+ eflags = edflags & GPIO_V2_LINE_EDGE_FLAGS;
+ if (eflags && !kfifo_initialized(&line->req->events)) {
+@@ -1152,11 +1163,17 @@ static int edge_detector_setup(struct li
+ IRQF_TRIGGER_RISING : IRQF_TRIGGER_FALLING;
+ irqflags |= IRQF_ONESHOT;
+
++ label = make_irq_label(line->req->label);
++ if (!label)
++ return -ENOMEM;
++
+ /* Request a thread to read the events */
+ ret = request_threaded_irq(irq, edge_irq_handler, edge_irq_thread,
+- irqflags, line->req->label, line);
+- if (ret)
++ irqflags, label, line);
++ if (ret) {
++ free_irq_label(label);
+ return ret;
++ }
+
+ line->irq = irq;
+ return 0;
+@@ -1979,7 +1996,7 @@ static void lineevent_free(struct lineev
+ blocking_notifier_chain_unregister(&le->gdev->device_notifier,
+ &le->device_unregistered_nb);
+ if (le->irq)
+- free_irq(le->irq, le);
++ free_irq_label(free_irq(le->irq, le));
+ if (le->desc)
+ gpiod_free(le->desc);
+ kfree(le->label);
+@@ -2120,6 +2137,7 @@ static int lineevent_create(struct gpio_
+ int fd;
+ int ret;
+ int irq, irqflags = 0;
++ char *label;
+
+ if (copy_from_user(&eventreq, ip, sizeof(eventreq)))
+ return -EFAULT;
+@@ -2204,15 +2222,23 @@ static int lineevent_create(struct gpio_
+ if (ret)
+ goto out_free_le;
+
++ label = make_irq_label(le->label);
++ if (!label) {
++ ret = -ENOMEM;
++ goto out_free_le;
++ }
++
+ /* Request a thread to read the events */
+ ret = request_threaded_irq(irq,
+ lineevent_irq_handler,
+ lineevent_irq_thread,
+ irqflags,
+- le->label,
++ label,
+ le);
+- if (ret)
++ if (ret) {
++ free_irq_label(label);
+ goto out_free_le;
++ }
+
+ le->irq = irq;
+
--- /dev/null
+From 549aa9678a0b3981d4821bf244579d9937650562 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Tue, 19 Mar 2024 17:37:46 -0700
+Subject: hexagon: vmlinux.lds.S: handle attributes section
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+commit 549aa9678a0b3981d4821bf244579d9937650562 upstream.
+
+After the linked LLVM change, the build fails with
+CONFIG_LD_ORPHAN_WARN_LEVEL="error", which happens with allmodconfig:
+
+ ld.lld: error: vmlinux.a(init/main.o):(.hexagon.attributes) is being placed in '.hexagon.attributes'
+
+Handle the attributes section in a similar manner as arm and riscv by
+adding it after the primary ELF_DETAILS grouping in vmlinux.lds.S, which
+fixes the error.
+
+Link: https://lkml.kernel.org/r/20240319-hexagon-handle-attributes-section-vmlinux-lds-s-v1-1-59855dab8872@kernel.org
+Fixes: 113616ec5b64 ("hexagon: select ARCH_WANT_LD_ORPHAN_WARN")
+Link: https://github.com/llvm/llvm-project/commit/31f4b329c8234fab9afa59494d7f8bdaeaefeaad
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Reviewed-by: Brian Cain <bcain@quicinc.com>
+Cc: Bill Wendling <morbo@google.com>
+Cc: Justin Stitt <justinstitt@google.com>
+Cc: Nick Desaulniers <ndesaulniers@google.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/hexagon/kernel/vmlinux.lds.S | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/hexagon/kernel/vmlinux.lds.S
++++ b/arch/hexagon/kernel/vmlinux.lds.S
+@@ -63,6 +63,7 @@ SECTIONS
+ STABS_DEBUG
+ DWARF_DEBUG
+ ELF_DETAILS
++ .hexagon.attributes 0 : { *(.hexagon.attributes) }
+
+ DISCARDS
+ }
--- /dev/null
+From d5d39c707a4cf0bcc84680178677b97aa2cb2627 Mon Sep 17 00:00:00 2001
+From: Johannes Weiner <hannes@cmpxchg.org>
+Date: Fri, 15 Mar 2024 05:55:56 -0400
+Subject: mm: cachestat: fix two shmem bugs
+
+From: Johannes Weiner <hannes@cmpxchg.org>
+
+commit d5d39c707a4cf0bcc84680178677b97aa2cb2627 upstream.
+
+When cachestat on shmem races with swapping and invalidation, there
+are two possible bugs:
+
+1) A swapin error can have resulted in a poisoned swap entry in the
+ shmem inode's xarray. Calling get_shadow_from_swap_cache() on it
+ will result in an out-of-bounds access to swapper_spaces[].
+
+ Validate the entry with non_swap_entry() before going further.
+
+2) When we find a valid swap entry in the shmem's inode, the shadow
+ entry in the swapcache might not exist yet: swap IO is still in
+ progress and we're before __remove_mapping; swapin, invalidation,
+ or swapoff have removed the shadow from swapcache after we saw the
+ shmem swap entry.
+
+ This will send a NULL to workingset_test_recent(). The latter
+ purely operates on pointer bits, so it won't crash - node 0, memcg
+ ID 0, eviction timestamp 0, etc. are all valid inputs - but it's a
+ bogus test. In theory that could result in a false "recently
+ evicted" count.
+
+ Such a false positive wouldn't be the end of the world. But for
+ code clarity and (future) robustness, be explicit about this case.
+
+ Bail on get_shadow_from_swap_cache() returning NULL.
+
+Link: https://lkml.kernel.org/r/20240315095556.GC581298@cmpxchg.org
+Fixes: cf264e1329fb ("cachestat: implement cachestat syscall")
+Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
+Reported-by: Chengming Zhou <chengming.zhou@linux.dev> [Bug #1]
+Reported-by: Jann Horn <jannh@google.com> [Bug #2]
+Reviewed-by: Chengming Zhou <chengming.zhou@linux.dev>
+Reviewed-by: Nhat Pham <nphamcs@gmail.com>
+Cc: <stable@vger.kernel.org> [v6.5+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/filemap.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -4153,7 +4153,23 @@ static void filemap_cachestat(struct add
+ /* shmem file - in swap cache */
+ swp_entry_t swp = radix_to_swp_entry(folio);
+
++ /* swapin error results in poisoned entry */
++ if (non_swap_entry(swp))
++ goto resched;
++
++ /*
++ * Getting a swap entry from the shmem
++ * inode means we beat
++ * shmem_unuse(). rcu_read_lock()
++ * ensures swapoff waits for us before
++ * freeing the swapper space. However,
++ * we can race with swapping and
++ * invalidation, so there might not be
++ * a shadow in the swapcache (yet).
++ */
+ shadow = get_shadow_from_swap_cache(swp);
++ if (!shadow)
++ goto resched;
+ }
+ #endif
+ if (workingset_test_recent(shadow, true, &workingset))
--- /dev/null
+From cf55a7acd1ed38afe43bba1c8a0935b51d1dc014 Mon Sep 17 00:00:00 2001
+From: Mikko Rapeli <mikko.rapeli@linaro.org>
+Date: Wed, 13 Mar 2024 15:37:44 +0200
+Subject: mmc: core: Avoid negative index with array access
+
+From: Mikko Rapeli <mikko.rapeli@linaro.org>
+
+commit cf55a7acd1ed38afe43bba1c8a0935b51d1dc014 upstream.
+
+Commit 4d0c8d0aef63 ("mmc: core: Use mrq.sbc in close-ended ffu") assigns
+prev_idata = idatas[i - 1], but doesn't check that the iterator i is
+greater than zero. Let's fix this by adding a check.
+
+Fixes: 4d0c8d0aef63 ("mmc: core: Use mrq.sbc in close-ended ffu")
+Link: https://lore.kernel.org/all/20231129092535.3278-1-avri.altman@wdc.com/
+Cc: stable@vger.kernel.org
+Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+Tested-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Link: https://lore.kernel.org/r/20240313133744.2405325-2-mikko.rapeli@linaro.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/core/block.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -488,7 +488,7 @@ static int __mmc_blk_ioctl_cmd(struct mm
+ if (idata->flags & MMC_BLK_IOC_DROP)
+ return 0;
+
+- if (idata->flags & MMC_BLK_IOC_SBC)
++ if (idata->flags & MMC_BLK_IOC_SBC && i > 0)
+ prev_idata = idatas[i - 1];
+
+ /*
--- /dev/null
+From 0cdfe5b0bf295c0dee97436a8ed13336933a0211 Mon Sep 17 00:00:00 2001
+From: Mikko Rapeli <mikko.rapeli@linaro.org>
+Date: Wed, 13 Mar 2024 15:37:43 +0200
+Subject: mmc: core: Initialize mmc_blk_ioc_data
+
+From: Mikko Rapeli <mikko.rapeli@linaro.org>
+
+commit 0cdfe5b0bf295c0dee97436a8ed13336933a0211 upstream.
+
+Commit 4d0c8d0aef63 ("mmc: core: Use mrq.sbc in close-ended ffu") adds
+flags uint to struct mmc_blk_ioc_data, but it does not get initialized for
+RPMB ioctls which now fails.
+
+Let's fix this by always initializing the struct and flags to zero.
+
+Fixes: 4d0c8d0aef63 ("mmc: core: Use mrq.sbc in close-ended ffu")
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218587
+Link: https://lore.kernel.org/all/20231129092535.3278-1-avri.altman@wdc.com/
+Cc: stable@vger.kernel.org
+Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Tested-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Link: https://lore.kernel.org/r/20240313133744.2405325-1-mikko.rapeli@linaro.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/core/block.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -413,7 +413,7 @@ static struct mmc_blk_ioc_data *mmc_blk_
+ struct mmc_blk_ioc_data *idata;
+ int err;
+
+- idata = kmalloc(sizeof(*idata), GFP_KERNEL);
++ idata = kzalloc(sizeof(*idata), GFP_KERNEL);
+ if (!idata) {
+ err = -ENOMEM;
+ goto out;
--- /dev/null
+From f9e2a5b00a35f2c064dc679808bc8db5cc779ed6 Mon Sep 17 00:00:00 2001
+From: Romain Naour <romain.naour@skf.com>
+Date: Sat, 16 Mar 2024 00:44:44 +0100
+Subject: mmc: sdhci-omap: re-tuning is needed after a pm transition to support emmc HS200 mode
+
+From: Romain Naour <romain.naour@skf.com>
+
+commit f9e2a5b00a35f2c064dc679808bc8db5cc779ed6 upstream.
+
+"PM runtime functions" was been added in sdhci-omap driver in commit
+f433e8aac6b9 ("mmc: sdhci-omap: Implement PM runtime functions") along
+with "card power off and enable aggressive PM" in commit 3edf588e7fe0
+("mmc: sdhci-omap: Allow SDIO card power off and enable aggressive PM").
+
+Since then, the sdhci-omap driver doesn't work using mmc-hs200 mode
+due to the tuning values being lost during a pm transition.
+
+As for the sdhci_am654 driver, request a new tuning sequence before
+suspend (sdhci_omap_runtime_suspend()), otherwise the device will
+trigger cache flush error:
+
+ mmc1: cache flush error -110 (ETIMEDOUT)
+ mmc1: error -110 doing aggressive suspend
+
+followed by I/O errors produced by fdisk -l /dev/mmcblk1boot1:
+
+ I/O error, dev mmcblk1boot0, sector 64384 op 0x0:(READ) flags 0x80700 phys_seg 1
+ prio class 2
+ I/O error, dev mmcblk1boot1, sector 64384 op 0x0:(READ) flags 0x80700 phys_seg 1
+ prio class 2
+ I/O error, dev mmcblk1boot1, sector 64384 op 0x0:(READ) flags 0x0 phys_seg 1
+ prio class 2
+ Buffer I/O error on dev mmcblk1boot1, logical block 8048, async page read
+ I/O error, dev mmcblk1boot0, sector 64384 op 0x0:(READ) flags 0x0 phys_seg 1
+ prio class 2
+ Buffer I/O error on dev mmcblk1boot0, logical block 8048, async page read
+
+Don't re-tune if auto retuning is supported in HW (when SDHCI_TUNING_MODE_3
+is available).
+
+Link: https://lore.kernel.org/all/2e5f1997-564c-44e4-b357-6343e0dae7ab@smile.fr
+Fixes: f433e8aac6b9 ("mmc: sdhci-omap: Implement PM runtime functions")
+Signed-off-by: Romain Naour <romain.naour@skf.com>
+Reviewed-by: Tony Lindgren <tony@atomide.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20240315234444.816978-1-romain.naour@smile.fr
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci-omap.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/mmc/host/sdhci-omap.c
++++ b/drivers/mmc/host/sdhci-omap.c
+@@ -1439,6 +1439,9 @@ static int __maybe_unused sdhci_omap_run
+ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ struct sdhci_omap_host *omap_host = sdhci_pltfm_priv(pltfm_host);
+
++ if (host->tuning_mode != SDHCI_TUNING_MODE_3)
++ mmc_retune_needed(host->mmc);
++
+ if (omap_host->con != -EINVAL)
+ sdhci_runtime_suspend_host(host);
+
--- /dev/null
+From 3a38a829c8bc27d78552c28e582eb1d885d07d11 Mon Sep 17 00:00:00 2001
+From: Claus Hansen Ries <chr@terma.com>
+Date: Thu, 21 Mar 2024 13:08:59 +0000
+Subject: net: ll_temac: platform_get_resource replaced by wrong function
+
+From: Claus Hansen Ries <chr@terma.com>
+
+commit 3a38a829c8bc27d78552c28e582eb1d885d07d11 upstream.
+
+The function platform_get_resource was replaced with
+devm_platform_ioremap_resource_byname and is called using 0 as name.
+
+This eventually ends up in platform_get_resource_byname in the call
+stack, where it causes a null pointer in strcmp.
+
+ if (type == resource_type(r) && !strcmp(r->name, name))
+
+It should have been replaced with devm_platform_ioremap_resource.
+
+Fixes: bd69058f50d5 ("net: ll_temac: Use devm_platform_ioremap_resource_byname()")
+Signed-off-by: Claus Hansen Ries <chr@terma.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://lore.kernel.org/r/cca18f9c630a41c18487729770b492bb@terma.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/xilinx/ll_temac_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
+@@ -1443,7 +1443,7 @@ static int temac_probe(struct platform_d
+ }
+
+ /* map device registers */
+- lp->regs = devm_platform_ioremap_resource_byname(pdev, 0);
++ lp->regs = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(lp->regs)) {
+ dev_err(&pdev->dev, "could not map TEMAC registers\n");
+ return -ENOMEM;
--- /dev/null
+From 6a4aee277740d04ac0fd54cfa17cc28261932ddc Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 25 Mar 2024 20:06:19 +0100
+Subject: net: phy: qcom: at803x: fix kernel panic with at8031_probe
+
+From: Christian Marangi <ansuelsmth@gmail.com>
+
+commit 6a4aee277740d04ac0fd54cfa17cc28261932ddc upstream.
+
+On reworking and splitting the at803x driver, in splitting function of
+at803x PHYs it was added a NULL dereference bug where priv is referenced
+before it's actually allocated and then is tried to write to for the
+is_1000basex and is_fiber variables in the case of at8031, writing on
+the wrong address.
+
+Fix this by correctly setting priv local variable only after
+at803x_probe is called and actually allocates priv in the phydev struct.
+
+Reported-by: William Wortel <wwortel@dorpstraat.com>
+Cc: <stable@vger.kernel.org>
+Fixes: 25d2ba94005f ("net: phy: at803x: move specific at8031 probe mode check to dedicated probe")
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/20240325190621.2665-1-ansuelsmth@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/at803x.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/phy/at803x.c
++++ b/drivers/net/phy/at803x.c
+@@ -1503,7 +1503,7 @@ static int at8031_parse_dt(struct phy_de
+
+ static int at8031_probe(struct phy_device *phydev)
+ {
+- struct at803x_priv *priv = phydev->priv;
++ struct at803x_priv *priv;
+ int mode_cfg;
+ int ccr;
+ int ret;
+@@ -1512,6 +1512,8 @@ static int at8031_probe(struct phy_devic
+ if (ret)
+ return ret;
+
++ priv = phydev->priv;
++
+ /* Only supported on AR8031/AR8033, the AR8030/AR8035 use strapping
+ * options.
+ */
--- /dev/null
+From ea2c09283b44d1a3732a195a9b257d56779c8863 Mon Sep 17 00:00:00 2001
+From: Herve Codina <herve.codina@bootlin.com>
+Date: Mon, 25 Mar 2024 09:25:05 +0100
+Subject: net: wan: framer: Add missing static inline qualifiers
+
+From: Herve Codina <herve.codina@bootlin.com>
+
+commit ea2c09283b44d1a3732a195a9b257d56779c8863 upstream.
+
+Compilation with CONFIG_GENERIC_FRAMER disabled lead to the following
+warnings:
+ framer.h:184:16: warning: no previous prototype for function 'framer_get' [-Wmissing-prototypes]
+ 184 | struct framer *framer_get(struct device *dev, const char *con_id)
+ framer.h:184:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
+ 184 | struct framer *framer_get(struct device *dev, const char *con_id)
+ framer.h:189:6: warning: no previous prototype for function 'framer_put' [-Wmissing-prototypes]
+ 189 | void framer_put(struct device *dev, struct framer *framer)
+ framer.h:189:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
+ 189 | void framer_put(struct device *dev, struct framer *framer)
+
+Add missing 'static inline' qualifiers for these functions.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202403241110.hfJqeJRu-lkp@intel.com/
+Fixes: 82c944d05b1a ("net: wan: Add framer framework support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Herve Codina <herve.codina@bootlin.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/framer/framer.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/linux/framer/framer.h
++++ b/include/linux/framer/framer.h
+@@ -181,12 +181,12 @@ static inline int framer_notifier_unregi
+ return -ENOSYS;
+ }
+
+-struct framer *framer_get(struct device *dev, const char *con_id)
++static inline struct framer *framer_get(struct device *dev, const char *con_id)
+ {
+ return ERR_PTR(-ENOSYS);
+ }
+
+-void framer_put(struct device *dev, struct framer *framer)
++static inline void framer_put(struct device *dev, struct framer *framer)
+ {
+ }
+
--- /dev/null
+From 16e87fe23d4af6df920406494ced5c0f4354567b Mon Sep 17 00:00:00 2001
+From: Duoming Zhou <duoming@zju.edu.cn>
+Date: Wed, 6 Mar 2024 13:01:04 +0800
+Subject: nouveau/dmem: handle kcalloc() allocation failure
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+commit 16e87fe23d4af6df920406494ced5c0f4354567b upstream.
+
+The kcalloc() in nouveau_dmem_evict_chunk() will return null if
+the physical memory has run out. As a result, if we dereference
+src_pfns, dst_pfns or dma_addrs, the null pointer dereference bugs
+will happen.
+
+Moreover, the GPU is going away. If the kcalloc() fails, we could not
+evict all pages mapping a chunk. So this patch adds a __GFP_NOFAIL
+flag in kcalloc().
+
+Finally, as there is no need to have physically contiguous memory,
+this patch switches kcalloc() to kvcalloc() in order to avoid
+failing allocations.
+
+CC: <stable@vger.kernel.org> # v6.1
+Fixes: 249881232e14 ("nouveau/dmem: evict device private memory during release")
+Suggested-by: Danilo Krummrich <dakr@redhat.com>
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Signed-off-by: Danilo Krummrich <dakr@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240306050104.11259-1-duoming@zju.edu.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_dmem.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_dmem.c
++++ b/drivers/gpu/drm/nouveau/nouveau_dmem.c
+@@ -378,9 +378,9 @@ nouveau_dmem_evict_chunk(struct nouveau_
+ dma_addr_t *dma_addrs;
+ struct nouveau_fence *fence;
+
+- src_pfns = kcalloc(npages, sizeof(*src_pfns), GFP_KERNEL);
+- dst_pfns = kcalloc(npages, sizeof(*dst_pfns), GFP_KERNEL);
+- dma_addrs = kcalloc(npages, sizeof(*dma_addrs), GFP_KERNEL);
++ src_pfns = kvcalloc(npages, sizeof(*src_pfns), GFP_KERNEL | __GFP_NOFAIL);
++ dst_pfns = kvcalloc(npages, sizeof(*dst_pfns), GFP_KERNEL | __GFP_NOFAIL);
++ dma_addrs = kvcalloc(npages, sizeof(*dma_addrs), GFP_KERNEL | __GFP_NOFAIL);
+
+ migrate_device_range(src_pfns, chunk->pagemap.range.start >> PAGE_SHIFT,
+ npages);
+@@ -406,11 +406,11 @@ nouveau_dmem_evict_chunk(struct nouveau_
+ migrate_device_pages(src_pfns, dst_pfns, npages);
+ nouveau_dmem_fence_done(&fence);
+ migrate_device_finalize(src_pfns, dst_pfns, npages);
+- kfree(src_pfns);
+- kfree(dst_pfns);
++ kvfree(src_pfns);
++ kvfree(dst_pfns);
+ for (i = 0; i < npages; i++)
+ dma_unmap_page(chunk->drm->dev->dev, dma_addrs[i], PAGE_SIZE, DMA_BIDIRECTIONAL);
+- kfree(dma_addrs);
++ kvfree(dma_addrs);
+ }
+
+ void
--- /dev/null
+From 78aca9ee5e012e130dbfbd7191bc2302b0cf3b37 Mon Sep 17 00:00:00 2001
+From: Harry Wentland <harry.wentland@amd.com>
+Date: Tue, 12 Mar 2024 11:21:32 -0400
+Subject: Revert "drm/amd/display: Fix sending VSC (+ colorimetry) packets for DP/eDP displays without PSR"
+
+From: Harry Wentland <harry.wentland@amd.com>
+
+commit 78aca9ee5e012e130dbfbd7191bc2302b0cf3b37 upstream.
+
+This causes flicker on a bunch of eDP panels. The info_packet code
+also caused regressions on other OSes that we haven't' seen on Linux
+yet, but that is likely due to the fact that we haven't had a chance
+to test those environments on Linux.
+
+We'll need to revisit this.
+
+This reverts commit 202260f64519e591b5cd99626e441b6559f571a3.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3207
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3151
+Signed-off-by: Harry Wentland <harry.wentland@amd.com>
+Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 8 ++----
+ drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c | 13 +++-------
+ 2 files changed, 8 insertions(+), 13 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -6256,9 +6256,8 @@ create_stream_for_sink(struct drm_connec
+
+ if (stream->signal == SIGNAL_TYPE_HDMI_TYPE_A)
+ mod_build_hf_vsif_infopacket(stream, &stream->vsp_infopacket);
+- else if (stream->signal == SIGNAL_TYPE_DISPLAY_PORT ||
+- stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST ||
+- stream->signal == SIGNAL_TYPE_EDP) {
++
++ if (stream->link->psr_settings.psr_feature_enabled || stream->link->replay_settings.replay_feature_enabled) {
+ //
+ // should decide stream support vsc sdp colorimetry capability
+ // before building vsc info packet
+@@ -6274,9 +6273,8 @@ create_stream_for_sink(struct drm_connec
+ if (stream->out_transfer_func->tf == TRANSFER_FUNCTION_GAMMA22)
+ tf = TRANSFER_FUNC_GAMMA_22;
+ mod_build_vsc_infopacket(stream, &stream->vsc_infopacket, stream->output_color_space, tf);
++ aconnector->psr_skip_count = AMDGPU_DM_PSR_ENTRY_DELAY;
+
+- if (stream->link->psr_settings.psr_feature_enabled)
+- aconnector->psr_skip_count = AMDGPU_DM_PSR_ENTRY_DELAY;
+ }
+ finish:
+ dc_sink_release(sink);
+--- a/drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c
++++ b/drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c
+@@ -147,15 +147,12 @@ void mod_build_vsc_infopacket(const stru
+ }
+
+ /* VSC packet set to 4 for PSR-SU, or 2 for PSR1 */
+- if (stream->link->psr_settings.psr_feature_enabled) {
+- if (stream->link->psr_settings.psr_version == DC_PSR_VERSION_SU_1)
+- vsc_packet_revision = vsc_packet_rev4;
+- else if (stream->link->psr_settings.psr_version == DC_PSR_VERSION_1)
+- vsc_packet_revision = vsc_packet_rev2;
+- }
+-
+- if (stream->link->replay_settings.config.replay_supported)
++ if (stream->link->psr_settings.psr_version == DC_PSR_VERSION_SU_1)
++ vsc_packet_revision = vsc_packet_rev4;
++ else if (stream->link->replay_settings.config.replay_supported)
+ vsc_packet_revision = vsc_packet_rev4;
++ else if (stream->link->psr_settings.psr_version == DC_PSR_VERSION_1)
++ vsc_packet_revision = vsc_packet_rev2;
+
+ /* Update to revision 5 for extended colorimetry support */
+ if (stream->use_vsc_sdp_for_colorimetry)
--- /dev/null
+From f67cf45deedb118af302534643627ce59074e8eb Mon Sep 17 00:00:00 2001
+From: Daniel Lezcano <daniel.lezcano@linaro.org>
+Date: Mon, 25 Mar 2024 23:24:24 +0100
+Subject: Revert "thermal: core: Don't update trip points inside the hysteresis range"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Lezcano <daniel.lezcano@linaro.org>
+
+commit f67cf45deedb118af302534643627ce59074e8eb upstream.
+
+It has been reported the commit cf3986f8c01d3 introduced a regression
+when the temperature is wavering in the hysteresis region. The
+mitigation stops leading to an uncontrolled temperature increase until
+reaching the critical trip point.
+
+Here what happens:
+
+ * 'throttle' is when the current temperature is greater than the trip
+ point temperature
+ * 'target' is the mitigation level
+ * 'passive' is positive when there is a mitigation, zero otherwise
+ * these values are computed in the step_wise governor
+
+Configuration:
+
+ trip point 1: temp=95°C, hyst=5°C (passive)
+ trip point 2: temp=115°C, hyst=0°C (critical)
+ governor: step_wise
+
+ 1. The temperature crosses the way up the trip point 1 at 95°C
+
+ - trend=raising
+ - throttle=1, target=1
+ - passive=1
+ - set_trips: low=90°C, high=115°C
+
+ 2. The temperature decreases but stays in the hysteresis region at
+ 93°C
+
+ - trend=dropping
+ - throttle=0, target=0
+ - passive=1
+
+ Before cf3986f8c01d3
+ - set_trips: low=90°C, high=95°C
+
+ After cf3986f8c01d3
+ - set_trips: low=90°C, high=115°C
+
+ 3. The temperature increases a bit but stays in the hysteresis region
+ at 94°C (so below the trip point 1 temp 95°C)
+
+ - trend=raising
+ - throttle=0, target=0
+ - passive=1
+
+ Before cf3986f8c01d3
+ - set_trips: low=90°C, high=95°C
+
+ After cf3986f8c01d3
+ - set_trips: low=90°C, high=115°C
+
+ 4. The temperature decreases but stays in the hysteresis region at
+ 93°C
+
+ - trend=dropping
+ - throttle=0, target=THERMAL_NO_TARGET
+ - passive=0
+
+ Before cf3986f8c01d3
+ - set_trips: low=90°C, high=95°C
+
+ After cf3986f8c01d3
+ - set_trips: low=90°C, high=115°C
+
+At this point, the 'passive' value is zero, there is no mitigation,
+the temperature is in the hysteresis region, the next trip point is
+115°C. As 'passive' is zero, the timer to monitor the thermal zone is
+disabled. Consequently if the temperature continues to increase, no
+mitigation will happen and it will reach the 115°C trip point and
+reboot.
+
+Before the optimization, the high boundary would have been 95°C, thus
+triggering the mitigation again and rearming the polling timer.
+
+The optimization make sense but given the current implementation of
+the step_wise governor collaborating via this 'passive' flag with the
+core framework it can not work.
+
+From a higher perspective it seems like there is a problem between the
+governor which sets a variable to be used by the core framework. That
+sounds akward and it would make much more sense if the core framework
+controls the governor and not the opposite. But as the devil hides in
+the details, there are some subtilities to be addressed before.
+
+Elaborating those would be out of the scope this changelog. So let's
+stay simple and revert the change first to fixup all broken mobile
+platforms.
+
+This reverts commit cf3986f8c01d3 ("thermal: core: Don't update trip
+points inside the hysteresis range") and takes a conflict with commit
+0c0c4740c9d26 ("0c0c4740c9d2 thermal: trip: Use for_each_trip() in
+__thermal_zone_set_trips()") in drivers/thermal/thermal_trip.c into
+account.
+
+Fixes: cf3986f8c01d3 ("thermal: core: Don't update trip points inside the hysteresis range")
+Reported-by: Manaf Meethalavalappu Pallikunhi <quic_manafm@quicinc.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Acked-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Cc: 6.7+ <stable@vger.kernel.org> # 6.7+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/thermal/thermal_trip.c | 19 ++-----------------
+ 1 file changed, 2 insertions(+), 17 deletions(-)
+
+--- a/drivers/thermal/thermal_trip.c
++++ b/drivers/thermal/thermal_trip.c
+@@ -65,7 +65,6 @@ void __thermal_zone_set_trips(struct the
+ {
+ const struct thermal_trip *trip;
+ int low = -INT_MAX, high = INT_MAX;
+- bool same_trip = false;
+ int ret;
+
+ lockdep_assert_held(&tz->lock);
+@@ -74,36 +73,22 @@ void __thermal_zone_set_trips(struct the
+ return;
+
+ for_each_trip(tz, trip) {
+- bool low_set = false;
+ int trip_low;
+
+ trip_low = trip->temperature - trip->hysteresis;
+
+- if (trip_low < tz->temperature && trip_low > low) {
++ if (trip_low < tz->temperature && trip_low > low)
+ low = trip_low;
+- low_set = true;
+- same_trip = false;
+- }
+
+ if (trip->temperature > tz->temperature &&
+- trip->temperature < high) {
++ trip->temperature < high)
+ high = trip->temperature;
+- same_trip = low_set;
+- }
+ }
+
+ /* No need to change trip points */
+ if (tz->prev_low_trip == low && tz->prev_high_trip == high)
+ return;
+
+- /*
+- * If "high" and "low" are the same, skip the change unless this is the
+- * first time.
+- */
+- if (same_trip && (tz->prev_low_trip != -INT_MAX ||
+- tz->prev_high_trip != INT_MAX))
+- return;
+-
+ tz->prev_low_trip = low;
+ tz->prev_high_trip = high;
+
--- /dev/null
+From 03749309909935070253accab314288d332a204d Mon Sep 17 00:00:00 2001
+From: Liming Sun <limings@nvidia.com>
+Date: Tue, 19 Mar 2024 12:16:16 -0400
+Subject: sdhci-of-dwcmshc: disable PM runtime in dwcmshc_remove()
+
+From: Liming Sun <limings@nvidia.com>
+
+commit 03749309909935070253accab314288d332a204d upstream.
+
+This commit disables PM runtime in dwcmshc_remove() to avoid the
+error message below when reloading the sdhci-of-dwcmshc.ko
+
+ sdhci-dwcmshc MLNXBF30:00: Unbalanced pm_runtime_enable!
+
+Fixes: 48fe8fadbe5e ("mmc: sdhci-of-dwcmshc: Add runtime PM operations")
+Reviewed-by: David Thompson <davthompson@nvidia.com>
+Signed-off-by: Liming Sun <limings@nvidia.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/b9155963ffb12d18375002bf9ac9a3f98b727fc8.1710854108.git.limings@nvidia.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci-of-dwcmshc.c | 28 +++++++++++++++++-----------
+ 1 file changed, 17 insertions(+), 11 deletions(-)
+
+--- a/drivers/mmc/host/sdhci-of-dwcmshc.c
++++ b/drivers/mmc/host/sdhci-of-dwcmshc.c
+@@ -933,6 +933,17 @@ free_pltfm:
+ return err;
+ }
+
++static void dwcmshc_disable_card_clk(struct sdhci_host *host)
++{
++ u16 ctrl;
++
++ ctrl = sdhci_readw(host, SDHCI_CLOCK_CONTROL);
++ if (ctrl & SDHCI_CLOCK_CARD_EN) {
++ ctrl &= ~SDHCI_CLOCK_CARD_EN;
++ sdhci_writew(host, ctrl, SDHCI_CLOCK_CONTROL);
++ }
++}
++
+ static void dwcmshc_remove(struct platform_device *pdev)
+ {
+ struct sdhci_host *host = platform_get_drvdata(pdev);
+@@ -940,8 +951,14 @@ static void dwcmshc_remove(struct platfo
+ struct dwcmshc_priv *priv = sdhci_pltfm_priv(pltfm_host);
+ struct rk35xx_priv *rk_priv = priv->priv;
+
++ pm_runtime_get_sync(&pdev->dev);
++ pm_runtime_disable(&pdev->dev);
++ pm_runtime_put_noidle(&pdev->dev);
++
+ sdhci_remove_host(host, 0);
+
++ dwcmshc_disable_card_clk(host);
++
+ clk_disable_unprepare(pltfm_host->clk);
+ clk_disable_unprepare(priv->bus_clk);
+ if (rk_priv)
+@@ -1032,17 +1049,6 @@ static void dwcmshc_enable_card_clk(stru
+ sdhci_writew(host, ctrl, SDHCI_CLOCK_CONTROL);
+ }
+ }
+-
+-static void dwcmshc_disable_card_clk(struct sdhci_host *host)
+-{
+- u16 ctrl;
+-
+- ctrl = sdhci_readw(host, SDHCI_CLOCK_CONTROL);
+- if (ctrl & SDHCI_CLOCK_CARD_EN) {
+- ctrl &= ~SDHCI_CLOCK_CARD_EN;
+- sdhci_writew(host, ctrl, SDHCI_CLOCK_CONTROL);
+- }
+-}
+
+ static int dwcmshc_runtime_suspend(struct device *dev)
+ {
--- /dev/null
+From 8c864371b2a15a23ce35aa7e2bd241baaad6fbe8 Mon Sep 17 00:00:00 2001
+From: Edward Liaw <edliaw@google.com>
+Date: Mon, 25 Mar 2024 19:40:52 +0000
+Subject: selftests/mm: fix ARM related issue with fork after pthread_create
+
+From: Edward Liaw <edliaw@google.com>
+
+commit 8c864371b2a15a23ce35aa7e2bd241baaad6fbe8 upstream.
+
+Following issue was observed while running the uffd-unit-tests selftest
+on ARM devices. On x86_64 no issues were detected:
+
+pthread_create followed by fork caused deadlock in certain cases wherein
+fork required some work to be completed by the created thread. Used
+synchronization to ensure that created thread's start function has started
+before invoking fork.
+
+[edliaw@google.com: refactored to use atomic_bool]
+Link: https://lkml.kernel.org/r/20240325194100.775052-1-edliaw@google.com
+Fixes: 760aee0b71e3 ("selftests/mm: add tests for RO pinning vs fork()")
+Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
+Signed-off-by: Edward Liaw <edliaw@google.com>
+Cc: Peter Xu <peterx@redhat.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/mm/uffd-common.c | 3 +++
+ tools/testing/selftests/mm/uffd-common.h | 2 ++
+ tools/testing/selftests/mm/uffd-unit-tests.c | 10 ++++++++++
+ 3 files changed, 15 insertions(+)
+
+--- a/tools/testing/selftests/mm/uffd-common.c
++++ b/tools/testing/selftests/mm/uffd-common.c
+@@ -18,6 +18,7 @@ bool test_uffdio_wp = true;
+ unsigned long long *count_verify;
+ uffd_test_ops_t *uffd_test_ops;
+ uffd_test_case_ops_t *uffd_test_case_ops;
++atomic_bool ready_for_fork;
+
+ static int uffd_mem_fd_create(off_t mem_size, bool hugetlb)
+ {
+@@ -518,6 +519,8 @@ void *uffd_poll_thread(void *arg)
+ pollfd[1].fd = pipefd[cpu*2];
+ pollfd[1].events = POLLIN;
+
++ ready_for_fork = true;
++
+ for (;;) {
+ ret = poll(pollfd, 2, -1);
+ if (ret <= 0) {
+--- a/tools/testing/selftests/mm/uffd-common.h
++++ b/tools/testing/selftests/mm/uffd-common.h
+@@ -32,6 +32,7 @@
+ #include <inttypes.h>
+ #include <stdint.h>
+ #include <sys/random.h>
++#include <stdatomic.h>
+
+ #include "../kselftest.h"
+ #include "vm_util.h"
+@@ -103,6 +104,7 @@ extern bool map_shared;
+ extern bool test_uffdio_wp;
+ extern unsigned long long *count_verify;
+ extern volatile bool test_uffdio_copy_eexist;
++extern atomic_bool ready_for_fork;
+
+ extern uffd_test_ops_t anon_uffd_test_ops;
+ extern uffd_test_ops_t shmem_uffd_test_ops;
+--- a/tools/testing/selftests/mm/uffd-unit-tests.c
++++ b/tools/testing/selftests/mm/uffd-unit-tests.c
+@@ -775,6 +775,8 @@ static void uffd_sigbus_test_common(bool
+ char c;
+ struct uffd_args args = { 0 };
+
++ ready_for_fork = false;
++
+ fcntl(uffd, F_SETFL, uffd_flags | O_NONBLOCK);
+
+ if (uffd_register(uffd, area_dst, nr_pages * page_size,
+@@ -790,6 +792,9 @@ static void uffd_sigbus_test_common(bool
+ if (pthread_create(&uffd_mon, NULL, uffd_poll_thread, &args))
+ err("uffd_poll_thread create");
+
++ while (!ready_for_fork)
++ ; /* Wait for the poll_thread to start executing before forking */
++
+ pid = fork();
+ if (pid < 0)
+ err("fork");
+@@ -829,6 +834,8 @@ static void uffd_events_test_common(bool
+ char c;
+ struct uffd_args args = { 0 };
+
++ ready_for_fork = false;
++
+ fcntl(uffd, F_SETFL, uffd_flags | O_NONBLOCK);
+ if (uffd_register(uffd, area_dst, nr_pages * page_size,
+ true, wp, false))
+@@ -838,6 +845,9 @@ static void uffd_events_test_common(bool
+ if (pthread_create(&uffd_mon, NULL, uffd_poll_thread, &args))
+ err("uffd_poll_thread create");
+
++ while (!ready_for_fork)
++ ; /* Wait for the poll_thread to start executing before forking */
++
+ pid = fork();
+ if (pid < 0)
+ err("fork");
--- /dev/null
+From 105840ebd76d8dbc1a7d734748ae320076f3201e Mon Sep 17 00:00:00 2001
+From: Edward Liaw <edliaw@google.com>
+Date: Thu, 21 Mar 2024 23:20:21 +0000
+Subject: selftests/mm: sigbus-wp test requires UFFD_FEATURE_WP_HUGETLBFS_SHMEM
+
+From: Edward Liaw <edliaw@google.com>
+
+commit 105840ebd76d8dbc1a7d734748ae320076f3201e upstream.
+
+The sigbus-wp test requires the UFFD_FEATURE_WP_HUGETLBFS_SHMEM flag for
+shmem and hugetlb targets. Otherwise it is not backwards compatible with
+kernels <5.19 and fails with EINVAL.
+
+Link: https://lkml.kernel.org/r/20240321232023.2064975-1-edliaw@google.com
+Fixes: 73c1ea939b65 ("selftests/mm: move uffd sig/events tests into uffd unit tests")
+Signed-off-by: Edward Liaw <edliaw@google.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: Peter Xu <peterx@redhat.com
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/mm/uffd-unit-tests.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/tools/testing/selftests/mm/uffd-unit-tests.c
++++ b/tools/testing/selftests/mm/uffd-unit-tests.c
+@@ -1427,7 +1427,8 @@ uffd_test_case_t uffd_tests[] = {
+ .uffd_fn = uffd_sigbus_wp_test,
+ .mem_targets = MEM_ALL,
+ .uffd_feature_required = UFFD_FEATURE_SIGBUS |
+- UFFD_FEATURE_EVENT_FORK | UFFD_FEATURE_PAGEFAULT_FLAG_WP,
++ UFFD_FEATURE_EVENT_FORK | UFFD_FEATURE_PAGEFAULT_FLAG_WP |
++ UFFD_FEATURE_WP_HUGETLBFS_SHMEM,
+ },
+ {
+ .name = "events",
tmpfs-fix-race-on-handling-dquot-rbtree.patch
btrfs-validate-device-maj-min-during-open.patch
btrfs-fix-race-in-read_extent_buffer_pages.patch
+btrfs-zoned-don-t-skip-block-groups-with-100-zone-unusable.patch
+btrfs-zoned-use-zone-aware-sb-location-for-scrub.patch
+btrfs-zoned-fix-use-after-free-in-do_zone_finish.patch
+wifi-mac80211-check-clear-fast-rx-for-non-4addr-sta-vlan-changes.patch
+wifi-cfg80211-add-a-flag-to-disable-wireless-extensions.patch
+wifi-iwlwifi-mvm-disable-mlo-for-the-time-being.patch
+wifi-iwlwifi-fw-don-t-always-use-fw-dump-trig.patch
+wifi-iwlwifi-mvm-handle-debugfs-names-more-carefully.patch
+revert-drm-amd-display-fix-sending-vsc-colorimetry-packets-for-dp-edp-displays-without-psr.patch
+gpio-cdev-sanitize-the-label-before-requesting-the-interrupt.patch
+fbdev-select-i-o-memory-framebuffer-ops-for-sbus.patch
+exec-fix-nommu-linux_binprm-exec-in-transfer_args_to_stack.patch
+hexagon-vmlinux.lds.s-handle-attributes-section.patch
+mm-cachestat-fix-two-shmem-bugs.patch
+selftests-mm-sigbus-wp-test-requires-uffd_feature_wp_hugetlbfs_shmem.patch
+selftests-mm-fix-arm-related-issue-with-fork-after-pthread_create.patch
+mmc-sdhci-omap-re-tuning-is-needed-after-a-pm-transition-to-support-emmc-hs200-mode.patch
+mmc-core-initialize-mmc_blk_ioc_data.patch
+mmc-core-avoid-negative-index-with-array-access.patch
+sdhci-of-dwcmshc-disable-pm-runtime-in-dwcmshc_remove.patch
+block-do-not-force-full-zone-append-completion-in-req_bio_endio.patch
+thermal-devfreq_cooling-fix-perf-state-when-calculate-dfc-res_util.patch
+revert-thermal-core-don-t-update-trip-points-inside-the-hysteresis-range.patch
+nouveau-dmem-handle-kcalloc-allocation-failure.patch
+net-ll_temac-platform_get_resource-replaced-by-wrong-function.patch
+net-wan-framer-add-missing-static-inline-qualifiers.patch
+net-phy-qcom-at803x-fix-kernel-panic-with-at8031_probe.patch
+drm-xe-query-fix-gt_id-bounds-check.patch
+drm-dp-fix-divide-by-zero-regression-on-dp-mst-unplug-with-nouveau.patch
+drm-vmwgfx-create-debugfs-ttm_resource_manager-entry-only-if-needed.patch
+drm-amdkfd-fix-tlb-flush-after-unmap-for-gfx9.4.2.patch
+drm-amdgpu-fix-deadlock-while-reading-mqd-from-debugfs.patch
+drm-amd-display-remove-mpc-rate-control-logic-from-dcn30-and-above.patch
+drm-amd-display-set-dcn351-bb-and-ip-the-same-as-dcn35.patch
--- /dev/null
+From a26de34b3c77ae3a969654d94be49e433c947e3b Mon Sep 17 00:00:00 2001
+From: Ye Zhang <ye.zhang@rock-chips.com>
+Date: Thu, 21 Mar 2024 18:21:00 +0800
+Subject: thermal: devfreq_cooling: Fix perf state when calculate dfc res_util
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ye Zhang <ye.zhang@rock-chips.com>
+
+commit a26de34b3c77ae3a969654d94be49e433c947e3b upstream.
+
+The issue occurs when the devfreq cooling device uses the EM power model
+and the get_real_power() callback is provided by the driver.
+
+The EM power table is sorted ascending，can't index the table by cooling
+device state，so convert cooling state to performance state by
+dfc->max_state - dfc->capped_state.
+
+Fixes: 615510fe13bd ("thermal: devfreq_cooling: remove old power model and use EM")
+Cc: 5.11+ <stable@vger.kernel.org> # 5.11+
+Signed-off-by: Ye Zhang <ye.zhang@rock-chips.com>
+Reviewed-by: Dhruva Gole <d-gole@ti.com>
+Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/thermal/devfreq_cooling.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/thermal/devfreq_cooling.c
++++ b/drivers/thermal/devfreq_cooling.c
+@@ -201,7 +201,7 @@ static int devfreq_cooling_get_requested
+
+ res = dfc->power_ops->get_real_power(df, power, freq, voltage);
+ if (!res) {
+- state = dfc->capped_state;
++ state = dfc->max_state - dfc->capped_state;
+
+ /* Convert EM power into milli-Watts first */
+ dfc->res_util = dfc->em_pd->table[state].power;
--- /dev/null
+From be23b2d7c3b7c8bf57b1cf0bf890bd65df9d0186 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 14 Mar 2024 11:09:51 +0100
+Subject: wifi: cfg80211: add a flag to disable wireless extensions
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit be23b2d7c3b7c8bf57b1cf0bf890bd65df9d0186 upstream.
+
+Wireless extensions are already disabled if MLO is enabled,
+given that we cannot support MLO there with all the hard-
+coded assumptions about BSSID etc.
+
+However, the WiFi7 ecosystem is still stabilizing, and some
+devices may need MLO disabled while that happens. In that
+case, we might end up with a device that supports wext (but
+not MLO) in one kernel, and then breaks wext in the future
+(by enabling MLO), which is not desirable.
+
+Add a flag to let such drivers/devices disable wext even if
+MLO isn't yet enabled.
+
+Cc: stable@vger.kernel.org
+Link: https://msgid.link/20240314110951.b50f1dc4ec21.I656ddd8178eedb49dc5c6c0e70f8ce5807afb54f@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/cfg80211.h | 2 ++
+ net/wireless/wext-core.c | 7 +++++--
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -4972,6 +4972,7 @@ struct cfg80211_ops {
+ * set this flag to update channels on beacon hints.
+ * @WIPHY_FLAG_SUPPORTS_NSTR_NONPRIMARY: support connection to non-primary link
+ * of an NSTR mobile AP MLD.
++ * @WIPHY_FLAG_DISABLE_WEXT: disable wireless extensions for this device
+ */
+ enum wiphy_flags {
+ WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK = BIT(0),
+@@ -4983,6 +4984,7 @@ enum wiphy_flags {
+ WIPHY_FLAG_4ADDR_STATION = BIT(6),
+ WIPHY_FLAG_CONTROL_PORT_PROTOCOL = BIT(7),
+ WIPHY_FLAG_IBSS_RSN = BIT(8),
++ WIPHY_FLAG_DISABLE_WEXT = BIT(9),
+ WIPHY_FLAG_MESH_AUTH = BIT(10),
+ WIPHY_FLAG_SUPPORTS_EXT_KCK_32 = BIT(11),
+ WIPHY_FLAG_SUPPORTS_NSTR_NONPRIMARY = BIT(12),
+--- a/net/wireless/wext-core.c
++++ b/net/wireless/wext-core.c
+@@ -4,6 +4,7 @@
+ * Authors : Jean Tourrilhes - HPL - <jt@hpl.hp.com>
+ * Copyright (c) 1997-2007 Jean Tourrilhes, All Rights Reserved.
+ * Copyright 2009 Johannes Berg <johannes@sipsolutions.net>
++ * Copyright (C) 2024 Intel Corporation
+ *
+ * (As all part of the Linux kernel, this file is GPL)
+ */
+@@ -662,7 +663,8 @@ struct iw_statistics *get_wireless_stats
+ dev->ieee80211_ptr->wiphy->wext &&
+ dev->ieee80211_ptr->wiphy->wext->get_wireless_stats) {
+ wireless_warn_cfg80211_wext();
+- if (dev->ieee80211_ptr->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO)
++ if (dev->ieee80211_ptr->wiphy->flags & (WIPHY_FLAG_SUPPORTS_MLO |
++ WIPHY_FLAG_DISABLE_WEXT))
+ return NULL;
+ return dev->ieee80211_ptr->wiphy->wext->get_wireless_stats(dev);
+ }
+@@ -704,7 +706,8 @@ static iw_handler get_handler(struct net
+ #ifdef CONFIG_CFG80211_WEXT
+ if (dev->ieee80211_ptr && dev->ieee80211_ptr->wiphy) {
+ wireless_warn_cfg80211_wext();
+- if (dev->ieee80211_ptr->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO)
++ if (dev->ieee80211_ptr->wiphy->flags & (WIPHY_FLAG_SUPPORTS_MLO |
++ WIPHY_FLAG_DISABLE_WEXT))
+ return NULL;
+ handlers = dev->ieee80211_ptr->wiphy->wext;
+ }
--- /dev/null
+From 045a5b645dd59929b0e05375f493cde3a0318271 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Tue, 19 Mar 2024 10:10:20 +0200
+Subject: wifi: iwlwifi: fw: don't always use FW dump trig
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 045a5b645dd59929b0e05375f493cde3a0318271 upstream.
+
+Since the dump_data (struct iwl_fwrt_dump_data) is a union,
+it's not safe to unconditionally access and use the 'trig'
+member, it might be 'desc' instead. Access it only if it's
+known to be 'trig' rather than 'desc', i.e. if ini-debug
+is present.
+
+Cc: stable@vger.kernel.org
+Fixes: 0eb50c674a1e ("iwlwifi: yoyo: send hcmd to fw after dump collection completes.")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240319100755.e2976bc58b29.I72fbd6135b3623227de53d8a2bb82776066cb72b@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+@@ -3074,8 +3074,6 @@ static void iwl_fw_dbg_collect_sync(stru
+ struct iwl_fw_dbg_params params = {0};
+ struct iwl_fwrt_dump_data *dump_data =
+ &fwrt->dump.wks[wk_idx].dump_data;
+- u32 policy;
+- u32 time_point;
+ if (!test_bit(wk_idx, &fwrt->dump.active_wks))
+ return;
+
+@@ -3106,13 +3104,16 @@ static void iwl_fw_dbg_collect_sync(stru
+
+ iwl_fw_dbg_stop_restart_recording(fwrt, ¶ms, false);
+
+- policy = le32_to_cpu(dump_data->trig->apply_policy);
+- time_point = le32_to_cpu(dump_data->trig->time_point);
+-
+- if (policy & IWL_FW_INI_APPLY_POLICY_DUMP_COMPLETE_CMD) {
+- IWL_DEBUG_FW_INFO(fwrt, "WRT: sending dump complete\n");
+- iwl_send_dbg_dump_complete_cmd(fwrt, time_point, 0);
++ if (iwl_trans_dbg_ini_valid(fwrt->trans)) {
++ u32 policy = le32_to_cpu(dump_data->trig->apply_policy);
++ u32 time_point = le32_to_cpu(dump_data->trig->time_point);
++
++ if (policy & IWL_FW_INI_APPLY_POLICY_DUMP_COMPLETE_CMD) {
++ IWL_DEBUG_FW_INFO(fwrt, "WRT: sending dump complete\n");
++ iwl_send_dbg_dump_complete_cmd(fwrt, time_point, 0);
++ }
+ }
++
+ if (fwrt->trans->dbg.last_tp_resetfw == IWL_FW_INI_RESET_FW_MODE_STOP_FW_ONLY)
+ iwl_force_nmi(fwrt->trans);
+
--- /dev/null
+From 5f404005055304830bbbee0d66af2964fc48f29e Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 14 Mar 2024 11:09:52 +0100
+Subject: wifi: iwlwifi: mvm: disable MLO for the time being
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 5f404005055304830bbbee0d66af2964fc48f29e upstream.
+
+MLO ended up not really fully stable yet, we want to make
+sure it works well with the ecosystem before enabling it.
+Thus, remove the flag, but set WIPHY_FLAG_DISABLE_WEXT so
+we don't get wireless extensions back until we enable MLO
+for this hardware.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240314110951.d6ad146df98d.I47127e4fdbdef89e4ccf7483641570ee7871d4e6@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -354,7 +354,7 @@ int iwl_mvm_mac_setup_register(struct iw
+ if (mvm->mld_api_is_used && mvm->nvm_data->sku_cap_11be_enable &&
+ !iwlwifi_mod_params.disable_11ax &&
+ !iwlwifi_mod_params.disable_11be)
+- hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_MLO;
++ hw->wiphy->flags |= WIPHY_FLAG_DISABLE_WEXT;
+
+ /* With MLD FW API, it tracks timing by itself,
+ * no need for any timing from the host
--- /dev/null
+From 19d82bdedaf2db0bfb3762dda714ea803065eed5 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 20 Mar 2024 23:26:32 +0200
+Subject: wifi: iwlwifi: mvm: handle debugfs names more carefully
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 19d82bdedaf2db0bfb3762dda714ea803065eed5 upstream.
+
+With debugfs=off, we can get here with the dbgfs_dir being
+an ERR_PTR(). Instead of checking for all this, which is
+often flagged as a mistake, simply handle the names here
+more carefully by printing them, then we don't need extra
+checks.
+
+Also, while checking, I noticed theoretically 'buf' is too
+small, so fix that size as well.
+
+Cc: stable@vger.kernel.org
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218422
+Fixes: c36235acb34f ("wifi: iwlwifi: mvm: rework debugfs handling")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240320232419.4dc1eb3dd015.I32f308b0356ef5bcf8d188dd98ce9b210e3ab9fd@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c
+@@ -735,7 +735,9 @@ void iwl_mvm_vif_dbgfs_add_link(struct i
+ {
+ struct dentry *dbgfs_dir = vif->debugfs_dir;
+ struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+- char buf[100];
++ char buf[3 * 3 + 11 + (NL80211_WIPHY_NAME_MAXLEN + 1) +
++ (7 + IFNAMSIZ + 1) + 6 + 1];
++ char name[7 + IFNAMSIZ + 1];
+
+ /* this will happen in monitor mode */
+ if (!dbgfs_dir)
+@@ -748,10 +750,11 @@ void iwl_mvm_vif_dbgfs_add_link(struct i
+ * find
+ * netdev:wlan0 -> ../../../ieee80211/phy0/netdev:wlan0/iwlmvm/
+ */
+- snprintf(buf, 100, "../../../%pd3/iwlmvm", dbgfs_dir);
++ snprintf(name, sizeof(name), "%pd", dbgfs_dir);
++ snprintf(buf, sizeof(buf), "../../../%pd3/iwlmvm", dbgfs_dir);
+
+- mvmvif->dbgfs_slink = debugfs_create_symlink(dbgfs_dir->d_name.name,
+- mvm->debugfs_dir, buf);
++ mvmvif->dbgfs_slink =
++ debugfs_create_symlink(name, mvm->debugfs_dir, buf);
+ }
+
+ void iwl_mvm_vif_dbgfs_rm_link(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
--- /dev/null
+From 4f2bdb3c5e3189297e156b3ff84b140423d64685 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 16 Mar 2024 08:43:36 +0100
+Subject: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
+
+From: Felix Fietkau <nbd@nbd.name>
+
+commit 4f2bdb3c5e3189297e156b3ff84b140423d64685 upstream.
+
+When moving a station out of a VLAN and deleting the VLAN afterwards, the
+fast_rx entry still holds a pointer to the VLAN's netdev, which can cause
+use-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx
+after the VLAN change.
+
+Cc: stable@vger.kernel.org
+Reported-by: ranygh@riseup.net
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Link: https://msgid.link/20240316074336.40442-1-nbd@nbd.name
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/cfg.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2164,15 +2164,14 @@ static int ieee80211_change_station(stru
+ }
+
+ if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+- sta->sdata->u.vlan.sta) {
+- ieee80211_clear_fast_rx(sta);
++ sta->sdata->u.vlan.sta)
+ RCU_INIT_POINTER(sta->sdata->u.vlan.sta, NULL);
+- }
+
+ if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
+ ieee80211_vif_dec_num_mcast(sta->sdata);
+
+ sta->sdata = vlansdata;
++ ieee80211_check_fast_rx(sta);
+ ieee80211_check_fast_xmit(sta);
+
+ if (test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
projects / thirdparty / kernel / stable-queue.git / commitdiff
