--- /dev/null
+From decf82f4ba4215597a58629ae9d1fc08880069d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Feb 2024 00:42:12 +0100
+Subject: ALSA: hda/realtek: cs35l41: Fix device ID / model name
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jean-Loïc Charroud <lagiraudiere+linux@free.fr>
+
+[ Upstream commit b91050448897663b60b6d15525c8c3ecae28a368 ]
+
+The patch 51d976079976c800ef19ed1b542602fcf63f0edb ("ALSA: hda/realtek:
+Add quirks for ASUS Zenbook 2022 Models") modified the entry 1043:1e2e
+from "ASUS UM3402" to "ASUS UM6702RA/RC" and added another entry for
+"ASUS UM3402" with 104e:1ee2.
+The first entry was correct, while the new one corresponds to model
+"ASUS UM6702RA/RC"
+Fix the model names for both devices.
+
+Fixes: 51d976079976 ("ALSA: hda/realtek: Add quirks for ASUS Zenbook 2022 Models")
+Signed-off-by: Jean-Loïc Charroud <lagiraudiere+linux@free.fr>
+Link: https://lore.kernel.org/r/1656546983.650349575.1707867732866.JavaMail.zimbra@free.fr
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 5cfeda80cbf10..07e1547fff2e5 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10092,11 +10092,11 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x1da2, "ASUS UP6502ZA/ZD", ALC245_FIXUP_CS35L41_SPI_2),
+ SND_PCI_QUIRK(0x1043, 0x1e02, "ASUS UX3402ZA", ALC245_FIXUP_CS35L41_SPI_2),
+ SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502),
+- SND_PCI_QUIRK(0x1043, 0x1e12, "ASUS UM6702RA/RC", ALC287_FIXUP_CS35L41_I2C_2),
++ SND_PCI_QUIRK(0x1043, 0x1e12, "ASUS UM3402", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS),
+ SND_PCI_QUIRK(0x1043, 0x1e5e, "ASUS ROG Strix G513", ALC294_FIXUP_ASUS_G513_PINS),
+ SND_PCI_QUIRK(0x1043, 0x1e8e, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA401),
+- SND_PCI_QUIRK(0x1043, 0x1ee2, "ASUS UM3402", ALC287_FIXUP_CS35L41_I2C_2),
++ SND_PCI_QUIRK(0x1043, 0x1ee2, "ASUS UM6702RA/RC", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x1043, 0x1c52, "ASUS Zephyrus G15 2022", ALC289_FIXUP_ASUS_GA401),
+ SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401),
+ SND_PCI_QUIRK(0x1043, 0x1f12, "ASUS UM5302", ALC287_FIXUP_CS35L41_I2C_2),
+--
+2.43.0
+
--- /dev/null
+From 898b03f5c0f79b4aeb47faffe1d7d3d2273f30fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Feb 2024 00:44:24 +0100
+Subject: ALSA: hda/realtek: cs35l41: Fix order and duplicates in quirks table
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jean-Loïc Charroud <lagiraudiere+linux@free.fr>
+
+[ Upstream commit 852d432a14dbcd34e15a3a3910c5c6869a6d1929 ]
+
+Move entry {0x1043, 0x16a3, "ASUS UX3402VA"} following device ID order.
+Remove duplicate entry for device {0x1043, 0x1f62, "ASUS UX7602ZM"}.
+
+Fixes: 51d976079976 ("ALSA: hda/realtek: Add quirks for ASUS Zenbook 2022 Models")
+Signed-off-by: Jean-Loïc Charroud <lagiraudiere+linux@free.fr>
+Link: https://lore.kernel.org/r/1969151851.650354669.1707867864074.JavaMail.zimbra@free.fr
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index ebdd7c4323363..5cfeda80cbf10 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10053,6 +10053,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x1662, "ASUS GV301QH", ALC294_FIXUP_ASUS_DUAL_SPK),
+ SND_PCI_QUIRK(0x1043, 0x1663, "ASUS GU603ZV", ALC285_FIXUP_ASUS_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1683, "ASUS UM3402YAR", ALC287_FIXUP_CS35L41_I2C_2),
++ SND_PCI_QUIRK(0x1043, 0x16a3, "ASUS UX3402VA", ALC245_FIXUP_CS35L41_SPI_2),
+ SND_PCI_QUIRK(0x1043, 0x16b2, "ASUS GU603", ALC289_FIXUP_ASUS_GA401),
+ SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x1043, 0x1740, "ASUS UX430UA", ALC295_FIXUP_ASUS_DACS),
+@@ -10090,8 +10091,6 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE),
+ SND_PCI_QUIRK(0x1043, 0x1da2, "ASUS UP6502ZA/ZD", ALC245_FIXUP_CS35L41_SPI_2),
+ SND_PCI_QUIRK(0x1043, 0x1e02, "ASUS UX3402ZA", ALC245_FIXUP_CS35L41_SPI_2),
+- SND_PCI_QUIRK(0x1043, 0x16a3, "ASUS UX3402VA", ALC245_FIXUP_CS35L41_SPI_2),
+- SND_PCI_QUIRK(0x1043, 0x1f62, "ASUS UX7602ZM", ALC245_FIXUP_CS35L41_SPI_2),
+ SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502),
+ SND_PCI_QUIRK(0x1043, 0x1e12, "ASUS UM6702RA/RC", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS),
+--
+2.43.0
+
--- /dev/null
+From 485c9a5ae76295fd03a4758d17f7ee316abc65ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jan 2024 16:27:32 +0000
+Subject: ASoC: cs35l56: Load tunings for the correct speaker models
+
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+
+[ Upstream commit 245eeff18d7a37693815250ae15979ce98c3d190 ]
+
+If the "spk-id-gpios" property is present it points to GPIOs whose
+value must be used to select the correct bin file to match the
+speakers.
+
+Some manufacturers use multiple sources of speakers, which need
+different tunings for best performance. On these models the type of
+speaker fitted is indicated by the values of one or more GPIOs. The
+number formed by the GPIOs identifies the tuning required.
+
+The speaker ID must be used in combination with the subsystem ID
+(either from PCI SSID or cirrus,firmware-uid property), because the
+GPIOs can only indicate variants of a specific model.
+
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Fixes: 1a1c3d794ef6 ("ASoC: cs35l56: Use PCI SSID as the firmware UID")
+Link: https://msgid.link/r/20240129162737.497-14-rf@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/sound/cs35l56.h | 1 +
+ sound/soc/codecs/cs35l56-shared.c | 36 +++++++++++++++++++++++++++++++
+ sound/soc/codecs/cs35l56.c | 32 ++++++++++++++++++++++-----
+ sound/soc/codecs/cs35l56.h | 1 +
+ 4 files changed, 65 insertions(+), 5 deletions(-)
+
+diff --git a/include/sound/cs35l56.h b/include/sound/cs35l56.h
+index 4e5f35dc042a1..c0f2135968fec 100644
+--- a/include/sound/cs35l56.h
++++ b/include/sound/cs35l56.h
+@@ -287,6 +287,7 @@ int cs35l56_runtime_suspend_common(struct cs35l56_base *cs35l56_base);
+ int cs35l56_runtime_resume_common(struct cs35l56_base *cs35l56_base, bool is_soundwire);
+ void cs35l56_init_cs_dsp(struct cs35l56_base *cs35l56_base, struct cs_dsp *cs_dsp);
+ int cs35l56_hw_init(struct cs35l56_base *cs35l56_base);
++int cs35l56_get_speaker_id(struct cs35l56_base *cs35l56_base);
+ int cs35l56_get_bclk_freq_id(unsigned int freq);
+ void cs35l56_fill_supply_names(struct regulator_bulk_data *data);
+
+diff --git a/sound/soc/codecs/cs35l56-shared.c b/sound/soc/codecs/cs35l56-shared.c
+index 69c951e305842..d3db89c93b331 100644
+--- a/sound/soc/codecs/cs35l56-shared.c
++++ b/sound/soc/codecs/cs35l56-shared.c
+@@ -5,6 +5,7 @@
+ // Copyright (C) 2023 Cirrus Logic, Inc. and
+ // Cirrus Logic International Semiconductor Ltd.
+
++#include <linux/gpio/consumer.h>
+ #include <linux/regmap.h>
+ #include <linux/regulator/consumer.h>
+ #include <linux/types.h>
+@@ -695,6 +696,41 @@ int cs35l56_hw_init(struct cs35l56_base *cs35l56_base)
+ }
+ EXPORT_SYMBOL_NS_GPL(cs35l56_hw_init, SND_SOC_CS35L56_SHARED);
+
++int cs35l56_get_speaker_id(struct cs35l56_base *cs35l56_base)
++{
++ struct gpio_descs *descs;
++ int speaker_id;
++ int i, ret;
++
++ /* Read the speaker type qualifier from the motherboard GPIOs */
++ descs = gpiod_get_array_optional(cs35l56_base->dev, "spk-id", GPIOD_IN);
++ if (!descs) {
++ return -ENOENT;
++ } else if (IS_ERR(descs)) {
++ ret = PTR_ERR(descs);
++ return dev_err_probe(cs35l56_base->dev, ret, "Failed to get spk-id-gpios\n");
++ }
++
++ speaker_id = 0;
++ for (i = 0; i < descs->ndescs; i++) {
++ ret = gpiod_get_value_cansleep(descs->desc[i]);
++ if (ret < 0) {
++ dev_err_probe(cs35l56_base->dev, ret, "Failed to read spk-id[%d]\n", i);
++ goto err;
++ }
++
++ speaker_id |= (ret << i);
++ }
++
++ dev_dbg(cs35l56_base->dev, "Speaker ID = %d\n", speaker_id);
++ ret = speaker_id;
++err:
++ gpiod_put_array(descs);
++
++ return ret;
++}
++EXPORT_SYMBOL_NS_GPL(cs35l56_get_speaker_id, SND_SOC_CS35L56_SHARED);
++
+ static const u32 cs35l56_bclk_valid_for_pll_freq_table[] = {
+ [0x0C] = 128000,
+ [0x0F] = 256000,
+diff --git a/sound/soc/codecs/cs35l56.c b/sound/soc/codecs/cs35l56.c
+index c855ef3ec665e..015269f0db54c 100644
+--- a/sound/soc/codecs/cs35l56.c
++++ b/sound/soc/codecs/cs35l56.c
+@@ -941,10 +941,19 @@ static int cs35l56_component_probe(struct snd_soc_component *component)
+
+ if (!cs35l56->dsp.system_name &&
+ (snd_soc_card_get_pci_ssid(component->card, &vendor, &device) == 0)) {
+- cs35l56->dsp.system_name = devm_kasprintf(cs35l56->base.dev,
+- GFP_KERNEL,
+- "%04x%04x",
+- vendor, device);
++ /* Append a speaker qualifier if there is a speaker ID */
++ if (cs35l56->speaker_id >= 0) {
++ cs35l56->dsp.system_name = devm_kasprintf(cs35l56->base.dev,
++ GFP_KERNEL,
++ "%04x%04x-spkid%d",
++ vendor, device,
++ cs35l56->speaker_id);
++ } else {
++ cs35l56->dsp.system_name = devm_kasprintf(cs35l56->base.dev,
++ GFP_KERNEL,
++ "%04x%04x",
++ vendor, device);
++ }
+ if (!cs35l56->dsp.system_name)
+ return -ENOMEM;
+ }
+@@ -1230,7 +1239,13 @@ static int cs35l56_get_firmware_uid(struct cs35l56_private *cs35l56)
+ if (ret < 0)
+ return 0;
+
+- cs35l56->dsp.system_name = devm_kstrdup(dev, prop, GFP_KERNEL);
++ /* Append a speaker qualifier if there is a speaker ID */
++ if (cs35l56->speaker_id >= 0)
++ cs35l56->dsp.system_name = devm_kasprintf(dev, GFP_KERNEL, "%s-spkid%d",
++ prop, cs35l56->speaker_id);
++ else
++ cs35l56->dsp.system_name = devm_kstrdup(dev, prop, GFP_KERNEL);
++
+ if (cs35l56->dsp.system_name == NULL)
+ return -ENOMEM;
+
+@@ -1245,6 +1260,7 @@ int cs35l56_common_probe(struct cs35l56_private *cs35l56)
+
+ init_completion(&cs35l56->init_completion);
+ mutex_init(&cs35l56->base.irq_lock);
++ cs35l56->speaker_id = -ENOENT;
+
+ dev_set_drvdata(cs35l56->base.dev, cs35l56);
+
+@@ -1281,6 +1297,12 @@ int cs35l56_common_probe(struct cs35l56_private *cs35l56)
+ gpiod_set_value_cansleep(cs35l56->base.reset_gpio, 1);
+ }
+
++ ret = cs35l56_get_speaker_id(&cs35l56->base);
++ if ((ret < 0) && (ret != -ENOENT))
++ goto err;
++
++ cs35l56->speaker_id = ret;
++
+ ret = cs35l56_get_firmware_uid(cs35l56);
+ if (ret != 0)
+ goto err;
+diff --git a/sound/soc/codecs/cs35l56.h b/sound/soc/codecs/cs35l56.h
+index d9fbf568a1958..b000e7365e406 100644
+--- a/sound/soc/codecs/cs35l56.h
++++ b/sound/soc/codecs/cs35l56.h
+@@ -44,6 +44,7 @@ struct cs35l56_private {
+ bool sdw_attached;
+ struct completion init_completion;
+
++ int speaker_id;
+ u32 rx_mask;
+ u32 tx_mask;
+ u8 asp_slot_width;
+--
+2.43.0
+
--- /dev/null
+From 526dcd32dc5398c5f481db36a7afacbe521d1fae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Mar 2024 23:47:37 +0100
+Subject: ASoC: tas2781: mark dvc_tlv with __maybe_unused
+
+From: Gergo Koteles <soyer@irl.hu>
+
+[ Upstream commit 831ec5e3538e989c7995137b5c5c661991a09504 ]
+
+Since we put dvc_tlv static variable to a header file it's copied to
+each module that includes the header. But not all of them are actually
+used it.
+
+Fix this W=1 build warning:
+
+include/sound/tas2781-tlv.h:18:35: warning: 'dvc_tlv' defined but not
+used [-Wunused-const-variable=]
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202403290354.v0StnRpc-lkp@intel.com/
+Fixes: ae065d0ce9e3 ("ALSA: hda/tas2781: remove digital gain kcontrol")
+Signed-off-by: Gergo Koteles <soyer@irl.hu>
+Message-ID: <0e461545a2a6e9b6152985143e50526322e5f76b.1711665731.git.soyer@irl.hu>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/sound/tas2781-tlv.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/sound/tas2781-tlv.h b/include/sound/tas2781-tlv.h
+index 4038dd421150a..1dc59005d241f 100644
+--- a/include/sound/tas2781-tlv.h
++++ b/include/sound/tas2781-tlv.h
+@@ -15,7 +15,7 @@
+ #ifndef __TAS2781_TLV_H__
+ #define __TAS2781_TLV_H__
+
+-static const DECLARE_TLV_DB_SCALE(dvc_tlv, -10000, 100, 0);
++static const __maybe_unused DECLARE_TLV_DB_SCALE(dvc_tlv, -10000, 100, 0);
+ static const DECLARE_TLV_DB_SCALE(amp_vol_tlv, 1100, 50, 0);
+
+ #endif
+--
+2.43.0
+
--- /dev/null
+From 5159c0a240030860465205f08c10e6f4a08215b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Apr 2024 18:30:14 +0900
+Subject: ata: ahci: Add mask_port_map module parameter
+
+From: Damien Le Moal <dlemoal@kernel.org>
+
+[ Upstream commit 24cfd86433c920188ac3f02df8aba6bc4c792f4b ]
+
+Commits 0077a504e1a4 ("ahci: asm1166: correct count of reported ports")
+and 9815e3961754 ("ahci: asm1064: correct count of reported ports")
+attempted to limit the ports of the ASM1166 and ASM1064 AHCI controllers
+to avoid long boot times caused by the fact that these adapters report
+a port map larger than the number of physical ports. The excess ports
+are "virtual" to hide port multiplier devices and probing these ports
+takes time. However, these commits caused a regression for users that do
+use PMP devices, as the ATA devices connected to the PMP cannot be
+scanned. These commits have thus been reverted by commit 6cd8adc3e18
+("ahci: asm1064: asm1166: don't limit reported ports") to allow the
+discovery of devices connected through a port multiplier. But this
+revert re-introduced the long boot times for users that do not use a
+port multiplier setup.
+
+This patch adds the mask_port_map ahci module parameter to allow users
+to manually specify port map masks for controllers. In the case of the
+ASMedia 1166 and 1064 controllers, users that do not have port
+multiplier devices can mask the excess virtual ports exposed by the
+controller to speedup port scanning, thus reducing boot time.
+
+The mask_port_map parameter accepts 2 different formats:
+ - mask_port_map=<mask>
+ This applies the same mask to all AHCI controllers
+ present in the system. This format is convenient for small systems
+ that have only a single AHCI controller.
+ - mask_port_map=<pci_dev>=<mask>,<pci_dev>=mask,...
+ This applies the specified masks only to the PCI device listed. The
+ <pci_dev> field is a regular PCI device ID (domain:bus:dev.func).
+ This ID can be seen following "ahci" in the kernel messages. E.g.
+ for "ahci 0000:01:00.0: 2/2 ports implemented (port mask 0x3)", the
+ <pci_dev> field is "0000:01:00.0".
+
+When used, the function ahci_save_initial_config() indicates that a
+port map mask was applied with the message "masking port_map ...".
+E.g.: without a mask:
+modprobe ahci
+dmesg | grep ahci
+...
+ahci 0000:00:17.0: AHCI vers 0001.0301, 32 command slots, 6 Gbps, SATA mode
+ahci 0000:00:17.0: (0000:00:17.0) 8/8 ports implemented (port mask 0xff)
+
+With a mask:
+modprobe ahci mask_port_map=0000:00:17.0=0x1
+dmesg | grep ahci
+...
+ahci 0000:00:17.0: masking port_map 0xff -> 0x1
+ahci 0000:00:17.0: AHCI vers 0001.0301, 32 command slots, 6 Gbps, SATA mode
+ahci 0000:00:17.0: (0000:00:17.0) 1/8 ports implemented (port mask 0x1)
+
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Reviewed-by: Niklas Cassel <cassel@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/ahci.c | 85 ++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 85 insertions(+)
+
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 0a6aea36cd975..6e76780fb4308 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -667,6 +667,87 @@ static int mobile_lpm_policy = -1;
+ module_param(mobile_lpm_policy, int, 0644);
+ MODULE_PARM_DESC(mobile_lpm_policy, "Default LPM policy for mobile chipsets");
+
++static char *ahci_mask_port_map;
++module_param_named(mask_port_map, ahci_mask_port_map, charp, 0444);
++MODULE_PARM_DESC(mask_port_map,
++ "32-bits port map masks to ignore controllers ports. "
++ "Valid values are: "
++ "\"<mask>\" to apply the same mask to all AHCI controller "
++ "devices, and \"<pci_dev>=<mask>,<pci_dev>=<mask>,...\" to "
++ "specify different masks for the controllers specified, "
++ "where <pci_dev> is the PCI ID of an AHCI controller in the "
++ "form \"domain:bus:dev.func\"");
++
++static void ahci_apply_port_map_mask(struct device *dev,
++ struct ahci_host_priv *hpriv, char *mask_s)
++{
++ unsigned int mask;
++
++ if (kstrtouint(mask_s, 0, &mask)) {
++ dev_err(dev, "Invalid port map mask\n");
++ return;
++ }
++
++ hpriv->mask_port_map = mask;
++}
++
++static void ahci_get_port_map_mask(struct device *dev,
++ struct ahci_host_priv *hpriv)
++{
++ char *param, *end, *str, *mask_s;
++ char *name;
++
++ if (!strlen(ahci_mask_port_map))
++ return;
++
++ str = kstrdup(ahci_mask_port_map, GFP_KERNEL);
++ if (!str)
++ return;
++
++ /* Handle single mask case */
++ if (!strchr(str, '=')) {
++ ahci_apply_port_map_mask(dev, hpriv, str);
++ goto free;
++ }
++
++ /*
++ * Mask list case: parse the parameter to apply the mask only if
++ * the device name matches.
++ */
++ param = str;
++ end = param + strlen(param);
++ while (param && param < end && *param) {
++ name = param;
++ param = strchr(name, '=');
++ if (!param)
++ break;
++
++ *param = '\0';
++ param++;
++ if (param >= end)
++ break;
++
++ if (strcmp(dev_name(dev), name) != 0) {
++ param = strchr(param, ',');
++ if (param)
++ param++;
++ continue;
++ }
++
++ mask_s = param;
++ param = strchr(mask_s, ',');
++ if (param) {
++ *param = '\0';
++ param++;
++ }
++
++ ahci_apply_port_map_mask(dev, hpriv, mask_s);
++ }
++
++free:
++ kfree(str);
++}
++
+ static void ahci_pci_save_initial_config(struct pci_dev *pdev,
+ struct ahci_host_priv *hpriv)
+ {
+@@ -689,6 +770,10 @@ static void ahci_pci_save_initial_config(struct pci_dev *pdev,
+ "Disabling your PATA port. Use the boot option 'ahci.marvell_enable=0' to avoid this.\n");
+ }
+
++ /* Handle port map masks passed as module parameter. */
++ if (ahci_mask_port_map)
++ ahci_get_port_map_mask(&pdev->dev, hpriv);
++
+ ahci_save_initial_config(&pdev->dev, hpriv);
+ }
+
+--
+2.43.0
+
--- /dev/null
+From 4cdc6fec9fcd14805135aea3fbec851b591b52c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Jul 2024 12:07:46 -0400
+Subject: Bluetooth: Fix usage of __hci_cmd_sync_status
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 87be7b189b2c50d4b51512f59e4e97db4eedee8a ]
+
+__hci_cmd_sync_status shall only be used if hci_req_sync_lock is _not_
+required which is not the case of hci_dev_cmd so it needs to use
+hci_cmd_sync_status which uses hci_req_sync_lock internally.
+
+Fixes: f1a8f402f13f ("Bluetooth: L2CAP: Fix deadlock")
+Reported-by: Pauli Virtanen <pav@iki.fi>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_core.c | 27 ++++++++++++---------------
+ 1 file changed, 12 insertions(+), 15 deletions(-)
+
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index f787b0eb7d669..d4e607bf35baf 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -711,8 +711,8 @@ int hci_dev_cmd(unsigned int cmd, void __user *arg)
+
+ switch (cmd) {
+ case HCISETAUTH:
+- err = __hci_cmd_sync_status(hdev, HCI_OP_WRITE_AUTH_ENABLE,
+- 1, &dr.dev_opt, HCI_CMD_TIMEOUT);
++ err = hci_cmd_sync_status(hdev, HCI_OP_WRITE_AUTH_ENABLE,
++ 1, &dr.dev_opt, HCI_CMD_TIMEOUT);
+ break;
+
+ case HCISETENCRYPT:
+@@ -723,23 +723,21 @@ int hci_dev_cmd(unsigned int cmd, void __user *arg)
+
+ if (!test_bit(HCI_AUTH, &hdev->flags)) {
+ /* Auth must be enabled first */
+- err = __hci_cmd_sync_status(hdev,
+- HCI_OP_WRITE_AUTH_ENABLE,
+- 1, &dr.dev_opt,
+- HCI_CMD_TIMEOUT);
++ err = hci_cmd_sync_status(hdev,
++ HCI_OP_WRITE_AUTH_ENABLE,
++ 1, &dr.dev_opt,
++ HCI_CMD_TIMEOUT);
+ if (err)
+ break;
+ }
+
+- err = __hci_cmd_sync_status(hdev, HCI_OP_WRITE_ENCRYPT_MODE,
+- 1, &dr.dev_opt,
+- HCI_CMD_TIMEOUT);
++ err = hci_cmd_sync_status(hdev, HCI_OP_WRITE_ENCRYPT_MODE,
++ 1, &dr.dev_opt, HCI_CMD_TIMEOUT);
+ break;
+
+ case HCISETSCAN:
+- err = __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SCAN_ENABLE,
+- 1, &dr.dev_opt,
+- HCI_CMD_TIMEOUT);
++ err = hci_cmd_sync_status(hdev, HCI_OP_WRITE_SCAN_ENABLE,
++ 1, &dr.dev_opt, HCI_CMD_TIMEOUT);
+
+ /* Ensure that the connectable and discoverable states
+ * get correctly modified as this was a non-mgmt change.
+@@ -751,9 +749,8 @@ int hci_dev_cmd(unsigned int cmd, void __user *arg)
+ case HCISETLINKPOL:
+ policy = cpu_to_le16(dr.dev_opt);
+
+- err = __hci_cmd_sync_status(hdev, HCI_OP_WRITE_DEF_LINK_POLICY,
+- 2, &policy,
+- HCI_CMD_TIMEOUT);
++ err = hci_cmd_sync_status(hdev, HCI_OP_WRITE_DEF_LINK_POLICY,
++ 2, &policy, HCI_CMD_TIMEOUT);
+ break;
+
+ case HCISETLINKMODE:
+--
+2.43.0
+
--- /dev/null
+From fe3304ff865ea737c8b85ff966f927247a25a2b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Apr 2024 06:44:04 +0900
+Subject: bootconfig: Fix the kerneldoc of _xbc_exit()
+
+From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+
+[ Upstream commit 298b871cd55a607037ac8af0011b9fdeb54c1e65 ]
+
+Fix the kerneldoc of _xbc_exit() which is updated to have an @early
+argument and the function name is changed.
+
+Link: https://lore.kernel.org/all/171321744474.599864.13532445969528690358.stgit@devnote2/
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202404150036.kPJ3HEFA-lkp@intel.com/
+Fixes: 89f9a1e876b5 ("bootconfig: use memblock_free_late to free xbc memory to buddy")
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/bootconfig.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/lib/bootconfig.c b/lib/bootconfig.c
+index 8841554432d5b..97f8911ea339e 100644
+--- a/lib/bootconfig.c
++++ b/lib/bootconfig.c
+@@ -901,7 +901,8 @@ static int __init xbc_parse_tree(void)
+ }
+
+ /**
+- * xbc_exit() - Clean up all parsed bootconfig
++ * _xbc_exit() - Clean up all parsed bootconfig
++ * @early: Set true if this is called before budy system is initialized.
+ *
+ * This clears all data structures of parsed bootconfig on memory.
+ * If you need to reuse xbc_init() with new boot config, you can
+--
+2.43.0
+
--- /dev/null
+From 4eafc0f911a42d12f4ae6e3fd912ed58ef25b4be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Aug 2023 16:53:24 +0530
+Subject: bus: mhi: ep: Add support for async DMA read operation
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 2547beb00ddb40e55b773970622421d978f71473 ]
+
+As like the async DMA write operation, let's add support for async DMA read
+operation. In the async path, the data will be read from the transfer ring
+continuously and when the controller driver notifies the stack using the
+completion callback (mhi_ep_read_completion), then the client driver will
+be notified with the read data and the completion event will be sent to the
+host for the respective ring element (if requested by the host).
+
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Stable-dep-of: c7d0b2db5bc5 ("bus: mhi: ep: Do not allocate memory for MHI objects from DMA zone")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/mhi/ep/main.c | 162 +++++++++++++++++++++-----------------
+ 1 file changed, 89 insertions(+), 73 deletions(-)
+
+diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c
+index 8765a7fb3d2c0..2cb7e21ad3b74 100644
+--- a/drivers/bus/mhi/ep/main.c
++++ b/drivers/bus/mhi/ep/main.c
+@@ -318,17 +318,81 @@ bool mhi_ep_queue_is_empty(struct mhi_ep_device *mhi_dev, enum dma_data_directio
+ }
+ EXPORT_SYMBOL_GPL(mhi_ep_queue_is_empty);
+
++static void mhi_ep_read_completion(struct mhi_ep_buf_info *buf_info)
++{
++ struct mhi_ep_device *mhi_dev = buf_info->mhi_dev;
++ struct mhi_ep_cntrl *mhi_cntrl = mhi_dev->mhi_cntrl;
++ struct mhi_ep_chan *mhi_chan = mhi_dev->ul_chan;
++ struct mhi_ep_ring *ring = &mhi_cntrl->mhi_chan[mhi_chan->chan].ring;
++ struct mhi_ring_element *el = &ring->ring_cache[ring->rd_offset];
++ struct mhi_result result = {};
++ int ret;
++
++ if (mhi_chan->xfer_cb) {
++ result.buf_addr = buf_info->cb_buf;
++ result.dir = mhi_chan->dir;
++ result.bytes_xferd = buf_info->size;
++
++ mhi_chan->xfer_cb(mhi_dev, &result);
++ }
++
++ /*
++ * The host will split the data packet into multiple TREs if it can't fit
++ * the packet in a single TRE. In that case, CHAIN flag will be set by the
++ * host for all TREs except the last one.
++ */
++ if (buf_info->code != MHI_EV_CC_OVERFLOW) {
++ if (MHI_TRE_DATA_GET_CHAIN(el)) {
++ /*
++ * IEOB (Interrupt on End of Block) flag will be set by the host if
++ * it expects the completion event for all TREs of a TD.
++ */
++ if (MHI_TRE_DATA_GET_IEOB(el)) {
++ ret = mhi_ep_send_completion_event(mhi_cntrl, ring, el,
++ MHI_TRE_DATA_GET_LEN(el),
++ MHI_EV_CC_EOB);
++ if (ret < 0) {
++ dev_err(&mhi_chan->mhi_dev->dev,
++ "Error sending transfer compl. event\n");
++ goto err_free_tre_buf;
++ }
++ }
++ } else {
++ /*
++ * IEOT (Interrupt on End of Transfer) flag will be set by the host
++ * for the last TRE of the TD and expects the completion event for
++ * the same.
++ */
++ if (MHI_TRE_DATA_GET_IEOT(el)) {
++ ret = mhi_ep_send_completion_event(mhi_cntrl, ring, el,
++ MHI_TRE_DATA_GET_LEN(el),
++ MHI_EV_CC_EOT);
++ if (ret < 0) {
++ dev_err(&mhi_chan->mhi_dev->dev,
++ "Error sending transfer compl. event\n");
++ goto err_free_tre_buf;
++ }
++ }
++ }
++ }
++
++ mhi_ep_ring_inc_index(ring);
++
++err_free_tre_buf:
++ kmem_cache_free(mhi_cntrl->tre_buf_cache, buf_info->cb_buf);
++}
++
+ static int mhi_ep_read_channel(struct mhi_ep_cntrl *mhi_cntrl,
+- struct mhi_ep_ring *ring,
+- struct mhi_result *result,
+- u32 len)
++ struct mhi_ep_ring *ring)
+ {
+ struct mhi_ep_chan *mhi_chan = &mhi_cntrl->mhi_chan[ring->ch_id];
+ struct device *dev = &mhi_cntrl->mhi_dev->dev;
+ size_t tr_len, read_offset, write_offset;
+ struct mhi_ep_buf_info buf_info = {};
++ u32 len = MHI_EP_DEFAULT_MTU;
+ struct mhi_ring_element *el;
+ bool tr_done = false;
++ void *buf_addr;
+ u32 buf_left;
+ int ret;
+
+@@ -358,83 +422,50 @@ static int mhi_ep_read_channel(struct mhi_ep_cntrl *mhi_cntrl,
+ read_offset = mhi_chan->tre_size - mhi_chan->tre_bytes_left;
+ write_offset = len - buf_left;
+
++ buf_addr = kmem_cache_zalloc(mhi_cntrl->tre_buf_cache, GFP_KERNEL | GFP_DMA);
++ if (!buf_addr)
++ return -ENOMEM;
++
+ buf_info.host_addr = mhi_chan->tre_loc + read_offset;
+- buf_info.dev_addr = result->buf_addr + write_offset;
++ buf_info.dev_addr = buf_addr + write_offset;
+ buf_info.size = tr_len;
++ buf_info.cb = mhi_ep_read_completion;
++ buf_info.cb_buf = buf_addr;
++ buf_info.mhi_dev = mhi_chan->mhi_dev;
++
++ if (mhi_chan->tre_bytes_left - tr_len)
++ buf_info.code = MHI_EV_CC_OVERFLOW;
+
+ dev_dbg(dev, "Reading %zd bytes from channel (%u)\n", tr_len, ring->ch_id);
+- ret = mhi_cntrl->read_sync(mhi_cntrl, &buf_info);
++ ret = mhi_cntrl->read_async(mhi_cntrl, &buf_info);
+ if (ret < 0) {
+ dev_err(&mhi_chan->mhi_dev->dev, "Error reading from channel\n");
+- return ret;
++ goto err_free_buf_addr;
+ }
+
+ buf_left -= tr_len;
+ mhi_chan->tre_bytes_left -= tr_len;
+
+- /*
+- * Once the TRE (Transfer Ring Element) of a TD (Transfer Descriptor) has been
+- * read completely:
+- *
+- * 1. Send completion event to the host based on the flags set in TRE.
+- * 2. Increment the local read offset of the transfer ring.
+- */
+ if (!mhi_chan->tre_bytes_left) {
+- /*
+- * The host will split the data packet into multiple TREs if it can't fit
+- * the packet in a single TRE. In that case, CHAIN flag will be set by the
+- * host for all TREs except the last one.
+- */
+- if (MHI_TRE_DATA_GET_CHAIN(el)) {
+- /*
+- * IEOB (Interrupt on End of Block) flag will be set by the host if
+- * it expects the completion event for all TREs of a TD.
+- */
+- if (MHI_TRE_DATA_GET_IEOB(el)) {
+- ret = mhi_ep_send_completion_event(mhi_cntrl, ring, el,
+- MHI_TRE_DATA_GET_LEN(el),
+- MHI_EV_CC_EOB);
+- if (ret < 0) {
+- dev_err(&mhi_chan->mhi_dev->dev,
+- "Error sending transfer compl. event\n");
+- return ret;
+- }
+- }
+- } else {
+- /*
+- * IEOT (Interrupt on End of Transfer) flag will be set by the host
+- * for the last TRE of the TD and expects the completion event for
+- * the same.
+- */
+- if (MHI_TRE_DATA_GET_IEOT(el)) {
+- ret = mhi_ep_send_completion_event(mhi_cntrl, ring, el,
+- MHI_TRE_DATA_GET_LEN(el),
+- MHI_EV_CC_EOT);
+- if (ret < 0) {
+- dev_err(&mhi_chan->mhi_dev->dev,
+- "Error sending transfer compl. event\n");
+- return ret;
+- }
+- }
+-
++ if (MHI_TRE_DATA_GET_IEOT(el))
+ tr_done = true;
+- }
+
+ mhi_chan->rd_offset = (mhi_chan->rd_offset + 1) % ring->ring_size;
+- mhi_ep_ring_inc_index(ring);
+ }
+-
+- result->bytes_xferd += tr_len;
+ } while (buf_left && !tr_done);
+
+ return 0;
++
++err_free_buf_addr:
++ kmem_cache_free(mhi_cntrl->tre_buf_cache, buf_addr);
++
++ return ret;
+ }
+
+-static int mhi_ep_process_ch_ring(struct mhi_ep_ring *ring, struct mhi_ring_element *el)
++static int mhi_ep_process_ch_ring(struct mhi_ep_ring *ring)
+ {
+ struct mhi_ep_cntrl *mhi_cntrl = ring->mhi_cntrl;
+ struct mhi_result result = {};
+- u32 len = MHI_EP_DEFAULT_MTU;
+ struct mhi_ep_chan *mhi_chan;
+ int ret;
+
+@@ -455,27 +486,15 @@ static int mhi_ep_process_ch_ring(struct mhi_ep_ring *ring, struct mhi_ring_elem
+ mhi_chan->xfer_cb(mhi_chan->mhi_dev, &result);
+ } else {
+ /* UL channel */
+- result.buf_addr = kmem_cache_zalloc(mhi_cntrl->tre_buf_cache, GFP_KERNEL | GFP_DMA);
+- if (!result.buf_addr)
+- return -ENOMEM;
+-
+ do {
+- ret = mhi_ep_read_channel(mhi_cntrl, ring, &result, len);
++ ret = mhi_ep_read_channel(mhi_cntrl, ring);
+ if (ret < 0) {
+ dev_err(&mhi_chan->mhi_dev->dev, "Failed to read channel\n");
+- kmem_cache_free(mhi_cntrl->tre_buf_cache, result.buf_addr);
+ return ret;
+ }
+
+- result.dir = mhi_chan->dir;
+- mhi_chan->xfer_cb(mhi_chan->mhi_dev, &result);
+- result.bytes_xferd = 0;
+- memset(result.buf_addr, 0, len);
+-
+ /* Read until the ring becomes empty */
+ } while (!mhi_ep_queue_is_empty(mhi_chan->mhi_dev, DMA_TO_DEVICE));
+-
+- kmem_cache_free(mhi_cntrl->tre_buf_cache, result.buf_addr);
+ }
+
+ return 0;
+@@ -781,7 +800,6 @@ static void mhi_ep_ch_ring_worker(struct work_struct *work)
+ struct mhi_ep_cntrl *mhi_cntrl = container_of(work, struct mhi_ep_cntrl, ch_ring_work);
+ struct device *dev = &mhi_cntrl->mhi_dev->dev;
+ struct mhi_ep_ring_item *itr, *tmp;
+- struct mhi_ring_element *el;
+ struct mhi_ep_ring *ring;
+ struct mhi_ep_chan *chan;
+ unsigned long flags;
+@@ -826,10 +844,8 @@ static void mhi_ep_ch_ring_worker(struct work_struct *work)
+ continue;
+ }
+
+- el = &ring->ring_cache[ring->rd_offset];
+-
+ dev_dbg(dev, "Processing the ring for channel (%u)\n", ring->ch_id);
+- ret = mhi_ep_process_ch_ring(ring, el);
++ ret = mhi_ep_process_ch_ring(ring);
+ if (ret) {
+ dev_err(dev, "Error processing ring for channel (%u): %d\n",
+ ring->ch_id, ret);
+--
+2.43.0
+
--- /dev/null
+From 8bc16b2c5b33396ede26f34abdfd0fc5d12c04fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Nov 2023 20:33:18 +0530
+Subject: bus: mhi: ep: Add support for async DMA write operation
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit ee08acb58fe47fc3bc2c137965985cdb1df40b35 ]
+
+In order to optimize the data transfer, let's use the async DMA operation
+for writing (queuing) data to the host.
+
+In the async path, the completion event for the transfer ring will only be
+sent to the host when the controller driver notifies the MHI stack of the
+actual transfer completion using the callback (mhi_ep_skb_completion)
+supplied in "struct mhi_ep_buf_info".
+
+Also to accommodate the async operation, the transfer ring read offset
+(ring->rd_offset) is cached in the "struct mhi_ep_chan" and updated locally
+to let the stack queue further ring items to the controller driver. But the
+actual read offset of the transfer ring will only be updated in the
+completion callback.
+
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Stable-dep-of: c7d0b2db5bc5 ("bus: mhi: ep: Do not allocate memory for MHI objects from DMA zone")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/mhi/ep/internal.h | 1 +
+ drivers/bus/mhi/ep/main.c | 74 +++++++++++++++++++++++++----------
+ include/linux/mhi_ep.h | 4 ++
+ 3 files changed, 59 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/bus/mhi/ep/internal.h b/drivers/bus/mhi/ep/internal.h
+index a2125fa5fe2f9..accbf3a51d0cf 100644
+--- a/drivers/bus/mhi/ep/internal.h
++++ b/drivers/bus/mhi/ep/internal.h
+@@ -159,6 +159,7 @@ struct mhi_ep_chan {
+ void (*xfer_cb)(struct mhi_ep_device *mhi_dev, struct mhi_result *result);
+ enum mhi_ch_state state;
+ enum dma_data_direction dir;
++ size_t rd_offset;
+ u64 tre_loc;
+ u32 tre_size;
+ u32 tre_bytes_left;
+diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c
+index 1ec9552d2b519..8765a7fb3d2c0 100644
+--- a/drivers/bus/mhi/ep/main.c
++++ b/drivers/bus/mhi/ep/main.c
+@@ -183,6 +183,8 @@ static int mhi_ep_process_cmd_ring(struct mhi_ep_ring *ring, struct mhi_ring_ele
+
+ goto err_unlock;
+ }
++
++ mhi_chan->rd_offset = ch_ring->rd_offset;
+ }
+
+ /* Set channel state to RUNNING */
+@@ -312,7 +314,7 @@ bool mhi_ep_queue_is_empty(struct mhi_ep_device *mhi_dev, enum dma_data_directio
+ struct mhi_ep_cntrl *mhi_cntrl = mhi_dev->mhi_cntrl;
+ struct mhi_ep_ring *ring = &mhi_cntrl->mhi_chan[mhi_chan->chan].ring;
+
+- return !!(ring->rd_offset == ring->wr_offset);
++ return !!(mhi_chan->rd_offset == ring->wr_offset);
+ }
+ EXPORT_SYMBOL_GPL(mhi_ep_queue_is_empty);
+
+@@ -339,7 +341,7 @@ static int mhi_ep_read_channel(struct mhi_ep_cntrl *mhi_cntrl,
+ return -ENODEV;
+ }
+
+- el = &ring->ring_cache[ring->rd_offset];
++ el = &ring->ring_cache[mhi_chan->rd_offset];
+
+ /* Check if there is data pending to be read from previous read operation */
+ if (mhi_chan->tre_bytes_left) {
+@@ -418,6 +420,7 @@ static int mhi_ep_read_channel(struct mhi_ep_cntrl *mhi_cntrl,
+ tr_done = true;
+ }
+
++ mhi_chan->rd_offset = (mhi_chan->rd_offset + 1) % ring->ring_size;
+ mhi_ep_ring_inc_index(ring);
+ }
+
+@@ -478,6 +481,35 @@ static int mhi_ep_process_ch_ring(struct mhi_ep_ring *ring, struct mhi_ring_elem
+ return 0;
+ }
+
++static void mhi_ep_skb_completion(struct mhi_ep_buf_info *buf_info)
++{
++ struct mhi_ep_device *mhi_dev = buf_info->mhi_dev;
++ struct mhi_ep_cntrl *mhi_cntrl = mhi_dev->mhi_cntrl;
++ struct mhi_ep_chan *mhi_chan = mhi_dev->dl_chan;
++ struct mhi_ep_ring *ring = &mhi_cntrl->mhi_chan[mhi_chan->chan].ring;
++ struct mhi_ring_element *el = &ring->ring_cache[ring->rd_offset];
++ struct device *dev = &mhi_dev->dev;
++ struct mhi_result result = {};
++ int ret;
++
++ if (mhi_chan->xfer_cb) {
++ result.buf_addr = buf_info->cb_buf;
++ result.dir = mhi_chan->dir;
++ result.bytes_xferd = buf_info->size;
++
++ mhi_chan->xfer_cb(mhi_dev, &result);
++ }
++
++ ret = mhi_ep_send_completion_event(mhi_cntrl, ring, el, buf_info->size,
++ buf_info->code);
++ if (ret) {
++ dev_err(dev, "Error sending transfer completion event\n");
++ return;
++ }
++
++ mhi_ep_ring_inc_index(ring);
++}
++
+ /* TODO: Handle partially formed TDs */
+ int mhi_ep_queue_skb(struct mhi_ep_device *mhi_dev, struct sk_buff *skb)
+ {
+@@ -488,7 +520,6 @@ int mhi_ep_queue_skb(struct mhi_ep_device *mhi_dev, struct sk_buff *skb)
+ struct mhi_ring_element *el;
+ u32 buf_left, read_offset;
+ struct mhi_ep_ring *ring;
+- enum mhi_ev_ccs code;
+ size_t tr_len;
+ u32 tre_len;
+ int ret;
+@@ -512,7 +543,7 @@ int mhi_ep_queue_skb(struct mhi_ep_device *mhi_dev, struct sk_buff *skb)
+ goto err_exit;
+ }
+
+- el = &ring->ring_cache[ring->rd_offset];
++ el = &ring->ring_cache[mhi_chan->rd_offset];
+ tre_len = MHI_TRE_DATA_GET_LEN(el);
+
+ tr_len = min(buf_left, tre_len);
+@@ -521,33 +552,35 @@ int mhi_ep_queue_skb(struct mhi_ep_device *mhi_dev, struct sk_buff *skb)
+ buf_info.dev_addr = skb->data + read_offset;
+ buf_info.host_addr = MHI_TRE_DATA_GET_PTR(el);
+ buf_info.size = tr_len;
++ buf_info.cb = mhi_ep_skb_completion;
++ buf_info.cb_buf = skb;
++ buf_info.mhi_dev = mhi_dev;
+
+- dev_dbg(dev, "Writing %zd bytes to channel (%u)\n", tr_len, ring->ch_id);
+- ret = mhi_cntrl->write_sync(mhi_cntrl, &buf_info);
+- if (ret < 0) {
+- dev_err(dev, "Error writing to the channel\n");
+- goto err_exit;
+- }
+-
+- buf_left -= tr_len;
+ /*
+ * For all TREs queued by the host for DL channel, only the EOT flag will be set.
+ * If the packet doesn't fit into a single TRE, send the OVERFLOW event to
+ * the host so that the host can adjust the packet boundary to next TREs. Else send
+ * the EOT event to the host indicating the packet boundary.
+ */
+- if (buf_left)
+- code = MHI_EV_CC_OVERFLOW;
++ if (buf_left - tr_len)
++ buf_info.code = MHI_EV_CC_OVERFLOW;
+ else
+- code = MHI_EV_CC_EOT;
++ buf_info.code = MHI_EV_CC_EOT;
+
+- ret = mhi_ep_send_completion_event(mhi_cntrl, ring, el, tr_len, code);
+- if (ret) {
+- dev_err(dev, "Error sending transfer completion event\n");
++ dev_dbg(dev, "Writing %zd bytes to channel (%u)\n", tr_len, ring->ch_id);
++ ret = mhi_cntrl->write_async(mhi_cntrl, &buf_info);
++ if (ret < 0) {
++ dev_err(dev, "Error writing to the channel\n");
+ goto err_exit;
+ }
+
+- mhi_ep_ring_inc_index(ring);
++ buf_left -= tr_len;
++
++ /*
++ * Update the read offset cached in mhi_chan. Actual read offset
++ * will be updated by the completion handler.
++ */
++ mhi_chan->rd_offset = (mhi_chan->rd_offset + 1) % ring->ring_size;
+ } while (buf_left);
+
+ mutex_unlock(&mhi_chan->lock);
+@@ -787,7 +820,7 @@ static void mhi_ep_ch_ring_worker(struct work_struct *work)
+ }
+
+ /* Sanity check to make sure there are elements in the ring */
+- if (ring->rd_offset == ring->wr_offset) {
++ if (chan->rd_offset == ring->wr_offset) {
+ mutex_unlock(&chan->lock);
+ kmem_cache_free(mhi_cntrl->ring_item_cache, itr);
+ continue;
+@@ -1431,6 +1464,7 @@ int mhi_ep_register_controller(struct mhi_ep_cntrl *mhi_cntrl,
+ ret = -ENOMEM;
+ goto err_destroy_tre_buf_cache;
+ }
++
+ INIT_WORK(&mhi_cntrl->state_work, mhi_ep_state_worker);
+ INIT_WORK(&mhi_cntrl->reset_work, mhi_ep_reset_worker);
+ INIT_WORK(&mhi_cntrl->cmd_ring_work, mhi_ep_cmd_ring_worker);
+diff --git a/include/linux/mhi_ep.h b/include/linux/mhi_ep.h
+index 14c6e8d3f5736..11bf3212f7822 100644
+--- a/include/linux/mhi_ep.h
++++ b/include/linux/mhi_ep.h
+@@ -51,16 +51,20 @@ struct mhi_ep_db_info {
+
+ /**
+ * struct mhi_ep_buf_info - MHI Endpoint transfer buffer info
++ * @mhi_dev: MHI device associated with this buffer
+ * @dev_addr: Address of the buffer in endpoint
+ * @host_addr: Address of the bufffer in host
+ * @size: Size of the buffer
++ * @code: Transfer completion code
+ * @cb: Callback to be executed by controller drivers after transfer completion (async)
+ * @cb_buf: Opaque buffer to be passed to the callback
+ */
+ struct mhi_ep_buf_info {
++ struct mhi_ep_device *mhi_dev;
+ void *dev_addr;
+ u64 host_addr;
+ size_t size;
++ int code;
+
+ void (*cb)(struct mhi_ep_buf_info *buf_info);
+ void *cb_buf;
+--
+2.43.0
+
--- /dev/null
+From fb14cc58b8075af983a44b7e277e4b61c14f1f49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Jun 2024 22:13:54 +0530
+Subject: bus: mhi: ep: Do not allocate memory for MHI objects from DMA zone
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit c7d0b2db5bc5e8c0fdc67b3c8f463c3dfec92f77 ]
+
+MHI endpoint stack accidentally started allocating memory for objects from
+DMA zone since commit 62210a26cd4f ("bus: mhi: ep: Use slab allocator
+where applicable"). But there is no real need to allocate memory from this
+naturally limited DMA zone. This also causes the MHI endpoint stack to run
+out of memory while doing high bandwidth transfers.
+
+So let's switch over to normal memory.
+
+Cc: <stable@vger.kernel.org> # 6.8
+Fixes: 62210a26cd4f ("bus: mhi: ep: Use slab allocator where applicable")
+Reviewed-by: Mayank Rana <quic_mrana@quicinc.com>
+Link: https://lore.kernel.org/r/20240603164354.79035-1-manivannan.sadhasivam@linaro.org
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/mhi/ep/main.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c
+index 2cb7e21ad3b74..c48f4d9f2c690 100644
+--- a/drivers/bus/mhi/ep/main.c
++++ b/drivers/bus/mhi/ep/main.c
+@@ -74,7 +74,7 @@ static int mhi_ep_send_completion_event(struct mhi_ep_cntrl *mhi_cntrl, struct m
+ struct mhi_ring_element *event;
+ int ret;
+
+- event = kmem_cache_zalloc(mhi_cntrl->ev_ring_el_cache, GFP_KERNEL | GFP_DMA);
++ event = kmem_cache_zalloc(mhi_cntrl->ev_ring_el_cache, GFP_KERNEL);
+ if (!event)
+ return -ENOMEM;
+
+@@ -93,7 +93,7 @@ int mhi_ep_send_state_change_event(struct mhi_ep_cntrl *mhi_cntrl, enum mhi_stat
+ struct mhi_ring_element *event;
+ int ret;
+
+- event = kmem_cache_zalloc(mhi_cntrl->ev_ring_el_cache, GFP_KERNEL | GFP_DMA);
++ event = kmem_cache_zalloc(mhi_cntrl->ev_ring_el_cache, GFP_KERNEL);
+ if (!event)
+ return -ENOMEM;
+
+@@ -111,7 +111,7 @@ int mhi_ep_send_ee_event(struct mhi_ep_cntrl *mhi_cntrl, enum mhi_ee_type exec_e
+ struct mhi_ring_element *event;
+ int ret;
+
+- event = kmem_cache_zalloc(mhi_cntrl->ev_ring_el_cache, GFP_KERNEL | GFP_DMA);
++ event = kmem_cache_zalloc(mhi_cntrl->ev_ring_el_cache, GFP_KERNEL);
+ if (!event)
+ return -ENOMEM;
+
+@@ -130,7 +130,7 @@ static int mhi_ep_send_cmd_comp_event(struct mhi_ep_cntrl *mhi_cntrl, enum mhi_e
+ struct mhi_ring_element *event;
+ int ret;
+
+- event = kmem_cache_zalloc(mhi_cntrl->ev_ring_el_cache, GFP_KERNEL | GFP_DMA);
++ event = kmem_cache_zalloc(mhi_cntrl->ev_ring_el_cache, GFP_KERNEL);
+ if (!event)
+ return -ENOMEM;
+
+@@ -422,7 +422,7 @@ static int mhi_ep_read_channel(struct mhi_ep_cntrl *mhi_cntrl,
+ read_offset = mhi_chan->tre_size - mhi_chan->tre_bytes_left;
+ write_offset = len - buf_left;
+
+- buf_addr = kmem_cache_zalloc(mhi_cntrl->tre_buf_cache, GFP_KERNEL | GFP_DMA);
++ buf_addr = kmem_cache_zalloc(mhi_cntrl->tre_buf_cache, GFP_KERNEL);
+ if (!buf_addr)
+ return -ENOMEM;
+
+@@ -1460,14 +1460,14 @@ int mhi_ep_register_controller(struct mhi_ep_cntrl *mhi_cntrl,
+
+ mhi_cntrl->ev_ring_el_cache = kmem_cache_create("mhi_ep_event_ring_el",
+ sizeof(struct mhi_ring_element), 0,
+- SLAB_CACHE_DMA, NULL);
++ 0, NULL);
+ if (!mhi_cntrl->ev_ring_el_cache) {
+ ret = -ENOMEM;
+ goto err_free_cmd;
+ }
+
+ mhi_cntrl->tre_buf_cache = kmem_cache_create("mhi_ep_tre_buf", MHI_EP_DEFAULT_MTU, 0,
+- SLAB_CACHE_DMA, NULL);
++ 0, NULL);
+ if (!mhi_cntrl->tre_buf_cache) {
+ ret = -ENOMEM;
+ goto err_destroy_ev_ring_el_cache;
+--
+2.43.0
+
--- /dev/null
+From 268b4553d80d3c39926c3b5c8b93b0b8f6d50e89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Nov 2023 15:35:50 +0530
+Subject: bus: mhi: ep: Introduce async read/write callbacks
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 8b786ed8fb089e347af21d13ba5677325fcd4cd8 ]
+
+These callbacks can be implemented by the controller drivers to perform
+async read/write operation that increases the throughput.
+
+For aiding the async operation, a completion callback is also introduced.
+
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Stable-dep-of: c7d0b2db5bc5 ("bus: mhi: ep: Do not allocate memory for MHI objects from DMA zone")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mhi_ep.h | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/include/linux/mhi_ep.h b/include/linux/mhi_ep.h
+index b96b543bf2f65..14c6e8d3f5736 100644
+--- a/include/linux/mhi_ep.h
++++ b/include/linux/mhi_ep.h
+@@ -54,11 +54,16 @@ struct mhi_ep_db_info {
+ * @dev_addr: Address of the buffer in endpoint
+ * @host_addr: Address of the bufffer in host
+ * @size: Size of the buffer
++ * @cb: Callback to be executed by controller drivers after transfer completion (async)
++ * @cb_buf: Opaque buffer to be passed to the callback
+ */
+ struct mhi_ep_buf_info {
+ void *dev_addr;
+ u64 host_addr;
+ size_t size;
++
++ void (*cb)(struct mhi_ep_buf_info *buf_info);
++ void *cb_buf;
+ };
+
+ /**
+@@ -96,6 +101,8 @@ struct mhi_ep_buf_info {
+ * @unmap_free: CB function to unmap and free the allocated memory in endpoint for storing host context
+ * @read_sync: CB function for reading from host memory synchronously
+ * @write_sync: CB function for writing to host memory synchronously
++ * @read_async: CB function for reading from host memory asynchronously
++ * @write_async: CB function for writing to host memory asynchronously
+ * @mhi_state: MHI Endpoint state
+ * @max_chan: Maximum channels supported by the endpoint controller
+ * @mru: MRU (Maximum Receive Unit) value of the endpoint controller
+@@ -151,6 +158,8 @@ struct mhi_ep_cntrl {
+ void __iomem *virt, size_t size);
+ int (*read_sync)(struct mhi_ep_cntrl *mhi_cntrl, struct mhi_ep_buf_info *buf_info);
+ int (*write_sync)(struct mhi_ep_cntrl *mhi_cntrl, struct mhi_ep_buf_info *buf_info);
++ int (*read_async)(struct mhi_ep_cntrl *mhi_cntrl, struct mhi_ep_buf_info *buf_info);
++ int (*write_async)(struct mhi_ep_cntrl *mhi_cntrl, struct mhi_ep_buf_info *buf_info);
+
+ enum mhi_state mhi_state;
+
+--
+2.43.0
+
--- /dev/null
+From 9162bde8146d4aaf4c8c045c9ba5509b0c8a42e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Nov 2023 13:57:37 +0530
+Subject: bus: mhi: ep: Rename read_from_host() and write_to_host() APIs
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 927105244f8bc48e6841826a5644c6a961e03b5d ]
+
+In the preparation for adding async API support, let's rename the existing
+APIs to read_sync() and write_sync() to make it explicit that these APIs
+are used for synchronous read/write.
+
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Stable-dep-of: c7d0b2db5bc5 ("bus: mhi: ep: Do not allocate memory for MHI objects from DMA zone")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/mhi/ep/main.c | 4 ++--
+ drivers/bus/mhi/ep/ring.c | 8 ++++----
+ drivers/pci/endpoint/functions/pci-epf-mhi.c | 8 ++++----
+ include/linux/mhi_ep.h | 8 ++++----
+ 4 files changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c
+index 934cdbca08e44..1ec9552d2b519 100644
+--- a/drivers/bus/mhi/ep/main.c
++++ b/drivers/bus/mhi/ep/main.c
+@@ -361,7 +361,7 @@ static int mhi_ep_read_channel(struct mhi_ep_cntrl *mhi_cntrl,
+ buf_info.size = tr_len;
+
+ dev_dbg(dev, "Reading %zd bytes from channel (%u)\n", tr_len, ring->ch_id);
+- ret = mhi_cntrl->read_from_host(mhi_cntrl, &buf_info);
++ ret = mhi_cntrl->read_sync(mhi_cntrl, &buf_info);
+ if (ret < 0) {
+ dev_err(&mhi_chan->mhi_dev->dev, "Error reading from channel\n");
+ return ret;
+@@ -523,7 +523,7 @@ int mhi_ep_queue_skb(struct mhi_ep_device *mhi_dev, struct sk_buff *skb)
+ buf_info.size = tr_len;
+
+ dev_dbg(dev, "Writing %zd bytes to channel (%u)\n", tr_len, ring->ch_id);
+- ret = mhi_cntrl->write_to_host(mhi_cntrl, &buf_info);
++ ret = mhi_cntrl->write_sync(mhi_cntrl, &buf_info);
+ if (ret < 0) {
+ dev_err(dev, "Error writing to the channel\n");
+ goto err_exit;
+diff --git a/drivers/bus/mhi/ep/ring.c b/drivers/bus/mhi/ep/ring.c
+index c673d7200b3e1..ba9f696d1aa80 100644
+--- a/drivers/bus/mhi/ep/ring.c
++++ b/drivers/bus/mhi/ep/ring.c
+@@ -48,7 +48,7 @@ static int __mhi_ep_cache_ring(struct mhi_ep_ring *ring, size_t end)
+ buf_info.host_addr = ring->rbase + (start * sizeof(struct mhi_ring_element));
+ buf_info.dev_addr = &ring->ring_cache[start];
+
+- ret = mhi_cntrl->read_from_host(mhi_cntrl, &buf_info);
++ ret = mhi_cntrl->read_sync(mhi_cntrl, &buf_info);
+ if (ret < 0)
+ return ret;
+ } else {
+@@ -56,7 +56,7 @@ static int __mhi_ep_cache_ring(struct mhi_ep_ring *ring, size_t end)
+ buf_info.host_addr = ring->rbase + (start * sizeof(struct mhi_ring_element));
+ buf_info.dev_addr = &ring->ring_cache[start];
+
+- ret = mhi_cntrl->read_from_host(mhi_cntrl, &buf_info);
++ ret = mhi_cntrl->read_sync(mhi_cntrl, &buf_info);
+ if (ret < 0)
+ return ret;
+
+@@ -65,7 +65,7 @@ static int __mhi_ep_cache_ring(struct mhi_ep_ring *ring, size_t end)
+ buf_info.dev_addr = &ring->ring_cache[0];
+ buf_info.size = end * sizeof(struct mhi_ring_element);
+
+- ret = mhi_cntrl->read_from_host(mhi_cntrl, &buf_info);
++ ret = mhi_cntrl->read_sync(mhi_cntrl, &buf_info);
+ if (ret < 0)
+ return ret;
+ }
+@@ -143,7 +143,7 @@ int mhi_ep_ring_add_element(struct mhi_ep_ring *ring, struct mhi_ring_element *e
+ buf_info.dev_addr = el;
+ buf_info.size = sizeof(*el);
+
+- return mhi_cntrl->write_to_host(mhi_cntrl, &buf_info);
++ return mhi_cntrl->write_sync(mhi_cntrl, &buf_info);
+ }
+
+ void mhi_ep_ring_init(struct mhi_ep_ring *ring, enum mhi_ep_ring_type type, u32 id)
+diff --git a/drivers/pci/endpoint/functions/pci-epf-mhi.c b/drivers/pci/endpoint/functions/pci-epf-mhi.c
+index 6dc918a8a0235..34e7191f95086 100644
+--- a/drivers/pci/endpoint/functions/pci-epf-mhi.c
++++ b/drivers/pci/endpoint/functions/pci-epf-mhi.c
+@@ -536,11 +536,11 @@ static int pci_epf_mhi_link_up(struct pci_epf *epf)
+ mhi_cntrl->alloc_map = pci_epf_mhi_alloc_map;
+ mhi_cntrl->unmap_free = pci_epf_mhi_unmap_free;
+ if (info->flags & MHI_EPF_USE_DMA) {
+- mhi_cntrl->read_from_host = pci_epf_mhi_edma_read;
+- mhi_cntrl->write_to_host = pci_epf_mhi_edma_write;
++ mhi_cntrl->read_sync = pci_epf_mhi_edma_read;
++ mhi_cntrl->write_sync = pci_epf_mhi_edma_write;
+ } else {
+- mhi_cntrl->read_from_host = pci_epf_mhi_iatu_read;
+- mhi_cntrl->write_to_host = pci_epf_mhi_iatu_write;
++ mhi_cntrl->read_sync = pci_epf_mhi_iatu_read;
++ mhi_cntrl->write_sync = pci_epf_mhi_iatu_write;
+ }
+
+ /* Register the MHI EP controller */
+diff --git a/include/linux/mhi_ep.h b/include/linux/mhi_ep.h
+index 96f3a133540db..b96b543bf2f65 100644
+--- a/include/linux/mhi_ep.h
++++ b/include/linux/mhi_ep.h
+@@ -94,8 +94,8 @@ struct mhi_ep_buf_info {
+ * @raise_irq: CB function for raising IRQ to the host
+ * @alloc_map: CB function for allocating memory in endpoint for storing host context and mapping it
+ * @unmap_free: CB function to unmap and free the allocated memory in endpoint for storing host context
+- * @read_from_host: CB function for reading from host memory from endpoint
+- * @write_to_host: CB function for writing to host memory from endpoint
++ * @read_sync: CB function for reading from host memory synchronously
++ * @write_sync: CB function for writing to host memory synchronously
+ * @mhi_state: MHI Endpoint state
+ * @max_chan: Maximum channels supported by the endpoint controller
+ * @mru: MRU (Maximum Receive Unit) value of the endpoint controller
+@@ -149,8 +149,8 @@ struct mhi_ep_cntrl {
+ void __iomem **virt, size_t size);
+ void (*unmap_free)(struct mhi_ep_cntrl *mhi_cntrl, u64 pci_addr, phys_addr_t phys,
+ void __iomem *virt, size_t size);
+- int (*read_from_host)(struct mhi_ep_cntrl *mhi_cntrl, struct mhi_ep_buf_info *buf_info);
+- int (*write_to_host)(struct mhi_ep_cntrl *mhi_cntrl, struct mhi_ep_buf_info *buf_info);
++ int (*read_sync)(struct mhi_ep_cntrl *mhi_cntrl, struct mhi_ep_buf_info *buf_info);
++ int (*write_sync)(struct mhi_ep_cntrl *mhi_cntrl, struct mhi_ep_buf_info *buf_info);
+
+ enum mhi_state mhi_state;
+
+--
+2.43.0
+
--- /dev/null
+From 2f74dc2d274bf984d16bbe3ab6dfbeedcd1e08f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jul 2024 08:14:13 +0000
+Subject: cpufreq/amd-pstate-ut: Convert nominal_freq to khz during comparisons
+
+From: Dhananjay Ugwekar <Dhananjay.Ugwekar@amd.com>
+
+[ Upstream commit f21ab5ed4e8758b06230900f44b9dcbcfdc0c3ae ]
+
+cpudata->nominal_freq being in MHz whereas other frequencies being in
+KHz breaks the amd-pstate-ut frequency sanity check. This fixes it.
+
+Fixes: e4731baaf294 ("cpufreq: amd-pstate: Fix the inconsistency in max frequency units")
+Reported-by: David Arcari <darcari@redhat.com>
+Signed-off-by: Dhananjay Ugwekar <Dhananjay.Ugwekar@amd.com>
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Reviewed-by: Gautham R. Shenoy <gautham.shenoy@amd.com>
+Link: https://lore.kernel.org/r/20240702081413.5688-2-Dhananjay.Ugwekar@amd.com
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/amd-pstate-ut.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/cpufreq/amd-pstate-ut.c b/drivers/cpufreq/amd-pstate-ut.c
+index f04ae67dda372..f5e0151f50083 100644
+--- a/drivers/cpufreq/amd-pstate-ut.c
++++ b/drivers/cpufreq/amd-pstate-ut.c
+@@ -201,6 +201,7 @@ static void amd_pstate_ut_check_freq(u32 index)
+ int cpu = 0;
+ struct cpufreq_policy *policy = NULL;
+ struct amd_cpudata *cpudata = NULL;
++ u32 nominal_freq_khz;
+
+ for_each_possible_cpu(cpu) {
+ policy = cpufreq_cpu_get(cpu);
+@@ -208,13 +209,14 @@ static void amd_pstate_ut_check_freq(u32 index)
+ break;
+ cpudata = policy->driver_data;
+
+- if (!((cpudata->max_freq >= cpudata->nominal_freq) &&
+- (cpudata->nominal_freq > cpudata->lowest_nonlinear_freq) &&
++ nominal_freq_khz = cpudata->nominal_freq*1000;
++ if (!((cpudata->max_freq >= nominal_freq_khz) &&
++ (nominal_freq_khz > cpudata->lowest_nonlinear_freq) &&
+ (cpudata->lowest_nonlinear_freq > cpudata->min_freq) &&
+ (cpudata->min_freq > 0))) {
+ amd_pstate_ut_cases[index].result = AMD_PSTATE_UT_RESULT_FAIL;
+ pr_err("%s cpu%d max=%d >= nominal=%d > lowest_nonlinear=%d > min=%d > 0, the formula is incorrect!\n",
+- __func__, cpu, cpudata->max_freq, cpudata->nominal_freq,
++ __func__, cpu, cpudata->max_freq, nominal_freq_khz,
+ cpudata->lowest_nonlinear_freq, cpudata->min_freq);
+ goto skip_test;
+ }
+@@ -228,13 +230,13 @@ static void amd_pstate_ut_check_freq(u32 index)
+
+ if (cpudata->boost_supported) {
+ if ((policy->max == cpudata->max_freq) ||
+- (policy->max == cpudata->nominal_freq))
++ (policy->max == nominal_freq_khz))
+ amd_pstate_ut_cases[index].result = AMD_PSTATE_UT_RESULT_PASS;
+ else {
+ amd_pstate_ut_cases[index].result = AMD_PSTATE_UT_RESULT_FAIL;
+ pr_err("%s cpu%d policy_max=%d should be equal cpu_max=%d or cpu_nominal=%d !\n",
+ __func__, cpu, policy->max, cpudata->max_freq,
+- cpudata->nominal_freq);
++ nominal_freq_khz);
+ goto skip_test;
+ }
+ } else {
+--
+2.43.0
+
--- /dev/null
+From a7e3712e5b462aa282b72c1204633f5c32379a85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Jun 2024 11:01:59 -0400
+Subject: drm/amd/display: Remove a redundant check in authenticated_dp
+
+From: Wenjing Liu <wenjing.liu@amd.com>
+
+[ Upstream commit 4b22869f76563ce1e10858d2ae3305affa8d4a6a ]
+
+[WHY]
+mod_hdcp_execute_and_set returns (*status == MOD_HDCP_STATUS_SUCCESS).
+When it return 0, it is guaranteed that status == MOD_HDCP_STATUS_SUCCESS
+will be evaluated as false. Since now we are using goto out already, all 3
+if (status == MOD_HDCP_STATUS_SUCCESS) clauses are guaranteed to enter.
+Therefore we are removing the if statements due to redundancy.
+
+Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Wenjing Liu <wenjing.liu@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: bc2fe69f16c7 ("drm/amd/display: Revert "Check HDCP returned status"")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../display/modules/hdcp/hdcp1_execution.c | 27 +++++++++----------
+ 1 file changed, 12 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c
+index 93c0455766ddb..b7da7037fe058 100644
+--- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c
++++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c
+@@ -432,21 +432,18 @@ static enum mod_hdcp_status authenticated_dp(struct mod_hdcp *hdcp,
+ goto out;
+ }
+
+- if (status == MOD_HDCP_STATUS_SUCCESS)
+- if (!mod_hdcp_execute_and_set(mod_hdcp_read_bstatus,
+- &input->bstatus_read, &status,
+- hdcp, "bstatus_read"))
+- goto out;
+- if (status == MOD_HDCP_STATUS_SUCCESS)
+- if (!mod_hdcp_execute_and_set(check_link_integrity_dp,
+- &input->link_integrity_check, &status,
+- hdcp, "link_integrity_check"))
+- goto out;
+- if (status == MOD_HDCP_STATUS_SUCCESS)
+- if (!mod_hdcp_execute_and_set(check_no_reauthentication_request_dp,
+- &input->reauth_request_check, &status,
+- hdcp, "reauth_request_check"))
+- goto out;
++ if (!mod_hdcp_execute_and_set(mod_hdcp_read_bstatus,
++ &input->bstatus_read, &status,
++ hdcp, "bstatus_read"))
++ goto out;
++ if (!mod_hdcp_execute_and_set(check_link_integrity_dp,
++ &input->link_integrity_check, &status,
++ hdcp, "link_integrity_check"))
++ goto out;
++ if (!mod_hdcp_execute_and_set(check_no_reauthentication_request_dp,
++ &input->reauth_request_check, &status,
++ hdcp, "reauth_request_check"))
++ goto out;
+ out:
+ return status;
+ }
+--
+2.43.0
+
--- /dev/null
+From ea17ac909f626caae47cbf39441a86d431f7edad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jun 2024 13:06:43 -0600
+Subject: drm/amd/display: Revert "Check HDCP returned status"
+
+From: Alex Hung <alex.hung@amd.com>
+
+[ Upstream commit bc2fe69f16c7122b5dabc294aa2d6065d8da2169 ]
+
+This reverts commit 5d93060d430b359e16e7c555c8f151ead1ac614b due to a
+power consumption regression.
+
+Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com>
+Signed-off-by: Jerry Zuo <jerry.zuo@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/modules/hdcp/hdcp1_execution.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c
+index b7da7037fe058..cee5e9e64ae71 100644
+--- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c
++++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp1_execution.c
+@@ -432,18 +432,18 @@ static enum mod_hdcp_status authenticated_dp(struct mod_hdcp *hdcp,
+ goto out;
+ }
+
+- if (!mod_hdcp_execute_and_set(mod_hdcp_read_bstatus,
++ mod_hdcp_execute_and_set(mod_hdcp_read_bstatus,
+ &input->bstatus_read, &status,
+- hdcp, "bstatus_read"))
+- goto out;
+- if (!mod_hdcp_execute_and_set(check_link_integrity_dp,
++ hdcp, "bstatus_read");
++
++ mod_hdcp_execute_and_set(check_link_integrity_dp,
+ &input->link_integrity_check, &status,
+- hdcp, "link_integrity_check"))
+- goto out;
+- if (!mod_hdcp_execute_and_set(check_no_reauthentication_request_dp,
++ hdcp, "link_integrity_check");
++
++ mod_hdcp_execute_and_set(check_no_reauthentication_request_dp,
+ &input->reauth_request_check, &status,
+- hdcp, "reauth_request_check"))
+- goto out;
++ hdcp, "reauth_request_check");
++
+ out:
+ return status;
+ }
+--
+2.43.0
+
--- /dev/null
+From 3f4f20058cf0b2300c664d3ec377c646c026b264 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Feb 2024 13:55:34 -0800
+Subject: drm/crtc: fix uninitialized variable use even harder
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit b6802b61a9d0e99dcfa6fff7c50db7c48a9623d3 ]
+
+DRM_MODESET_LOCK_ALL_BEGIN() has a hidden trap-door (aka retry loop),
+which means we can't rely too much on variable initializers.
+
+Fixes: 6e455f5dcdd1 ("drm/crtc: fix uninitialized variable use")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> # sc7180, sdm845
+Link: https://patchwork.freedesktop.org/patch/msgid/20240212215534.190682-1-robdclark@gmail.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_crtc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
+index cb90e70d85e86..65f9f66933bba 100644
+--- a/drivers/gpu/drm/drm_crtc.c
++++ b/drivers/gpu/drm/drm_crtc.c
+@@ -904,6 +904,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
+ connector_set = NULL;
+ fb = NULL;
+ mode = NULL;
++ num_connectors = 0;
+
+ DRM_MODESET_LOCK_ALL_END(dev, ctx, ret);
+
+--
+2.43.0
+
--- /dev/null
+From a9e1e0ef25916cab7f87f03526c784efb4ba2a12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Mar 2024 14:11:28 +0800
+Subject: drm/panel: boe-tv101wum-nl6: Fine tune Himax83102-j02 panel HFP and
+ HBP (again)
+
+From: Cong Yang <yangcong5@huaqin.corp-partner.google.com>
+
+[ Upstream commit 9dfc46c87cdc8f5a42a71de247a744a6b8188980 ]
+
+The current measured frame rate is 59.95Hz, which does not meet the
+requirements of touch-stylus and stylus cannot work normally. After
+adjustment, the actual measurement is 60.001Hz. Now this panel looks
+like it's only used by me on the MTK platform, so let's change this
+set of parameters.
+
+[ dianders: Added "(again") to subject and fixed the "Fixes" line ]
+
+Fixes: cea7008190ad ("drm/panel: boe-tv101wum-nl6: Fine tune Himax83102-j02 panel HFP and HBP")
+Signed-off-by: Cong Yang <yangcong5@huaqin.corp-partner.google.com>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240301061128.3145982-1-yangcong5@huaqin.corp-partner.google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
+index cfa5b54ed6fe7..e6328991c87e9 100644
+--- a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
++++ b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
+@@ -2112,11 +2112,11 @@ static const struct panel_desc starry_qfh032011_53g_desc = {
+ };
+
+ static const struct drm_display_mode starry_himax83102_j02_default_mode = {
+- .clock = 162850,
++ .clock = 162680,
+ .hdisplay = 1200,
+- .hsync_start = 1200 + 50,
+- .hsync_end = 1200 + 50 + 20,
+- .htotal = 1200 + 50 + 20 + 50,
++ .hsync_start = 1200 + 60,
++ .hsync_end = 1200 + 60 + 20,
++ .htotal = 1200 + 60 + 20 + 40,
+ .vdisplay = 1920,
+ .vsync_start = 1920 + 116,
+ .vsync_end = 1920 + 116 + 8,
+--
+2.43.0
+
--- /dev/null
+From daa86277d8b192b26cf8634611aaaad9d720fe60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 May 2024 15:06:04 -0700
+Subject: e1000e: move force SMBUS near the end of enable_ulp function
+
+From: Hui Wang <hui.wang@canonical.com>
+
+[ Upstream commit bfd546a552e140b0a4c8a21527c39d6d21addb28 ]
+
+The commit 861e8086029e ("e1000e: move force SMBUS from enable ulp
+function to avoid PHY loss issue") introduces a regression on
+PCH_MTP_I219_LM18 (PCIID: 0x8086550A). Without the referred commit, the
+ethernet works well after suspend and resume, but after applying the
+commit, the ethernet couldn't work anymore after the resume and the
+dmesg shows that the NIC link changes to 10Mbps (1000Mbps originally):
+
+ [ 43.305084] e1000e 0000:00:1f.6 enp0s31f6: NIC Link is Up 10 Mbps Full Duplex, Flow Control: Rx/Tx
+
+Without the commit, the force SMBUS code will not be executed if
+"return 0" or "goto out" is executed in the enable_ulp(), and in my
+case, the "goto out" is executed since FWSM_FW_VALID is set. But after
+applying the commit, the force SMBUS code will be ran unconditionally.
+
+Here move the force SMBUS code back to enable_ulp() and put it
+immediately ahead of hw->phy.ops.release(hw), this could allow the
+longest settling time as possible for interface in this function and
+doesn't change the original code logic.
+
+The issue was found on a Lenovo laptop with the ethernet hw as below:
+00:1f.6 Ethernet controller [0200]: Intel Corporation Device [8086:550a]
+(rev 20).
+
+And this patch is verified (cable plug and unplug, system suspend
+and resume) on Lenovo laptops with ethernet hw: [8086:550a],
+[8086:550b], [8086:15bb], [8086:15be], [8086:1a1f], [8086:1a1c] and
+[8086:0dc7].
+
+Fixes: 861e8086029e ("e1000e: move force SMBUS from enable ulp function to avoid PHY loss issue")
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Acked-by: Vitaly Lifshits <vitaly.lifshits@intel.com>
+Tested-by: Naama Meir <naamax.meir@linux.intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Tested-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://lore.kernel.org/r/20240528-net-2024-05-28-intel-net-fixes-v1-1-dc8593d2bbc6@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/e1000e/ich8lan.c | 22 +++++++++++++++++++++
+ drivers/net/ethernet/intel/e1000e/netdev.c | 18 -----------------
+ 2 files changed, 22 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+index f9e94be36e97f..2e98a2a0bead9 100644
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+@@ -1225,6 +1225,28 @@ s32 e1000_enable_ulp_lpt_lp(struct e1000_hw *hw, bool to_sx)
+ }
+
+ release:
++ /* Switching PHY interface always returns MDI error
++ * so disable retry mechanism to avoid wasting time
++ */
++ e1000e_disable_phy_retry(hw);
++
++ /* Force SMBus mode in PHY */
++ ret_val = e1000_read_phy_reg_hv_locked(hw, CV_SMB_CTRL, &phy_reg);
++ if (ret_val) {
++ e1000e_enable_phy_retry(hw);
++ hw->phy.ops.release(hw);
++ goto out;
++ }
++ phy_reg |= CV_SMB_CTRL_FORCE_SMBUS;
++ e1000_write_phy_reg_hv_locked(hw, CV_SMB_CTRL, phy_reg);
++
++ e1000e_enable_phy_retry(hw);
++
++ /* Force SMBus mode in MAC */
++ mac_reg = er32(CTRL_EXT);
++ mac_reg |= E1000_CTRL_EXT_FORCE_SMBUS;
++ ew32(CTRL_EXT, mac_reg);
++
+ hw->phy.ops.release(hw);
+ out:
+ if (ret_val)
+diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
+index d377a286c0e1b..06d109063c8d8 100644
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -6623,7 +6623,6 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool runtime)
+ struct e1000_hw *hw = &adapter->hw;
+ u32 ctrl, ctrl_ext, rctl, status, wufc;
+ int retval = 0;
+- u16 smb_ctrl;
+
+ /* Runtime suspend should only enable wakeup for link changes */
+ if (runtime)
+@@ -6701,23 +6700,6 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool runtime)
+ goto skip_phy_configurations;
+ }
+ }
+-
+- /* Force SMBUS to allow WOL */
+- /* Switching PHY interface always returns MDI error
+- * so disable retry mechanism to avoid wasting time
+- */
+- e1000e_disable_phy_retry(hw);
+-
+- e1e_rphy(hw, CV_SMB_CTRL, &smb_ctrl);
+- smb_ctrl |= CV_SMB_CTRL_FORCE_SMBUS;
+- e1e_wphy(hw, CV_SMB_CTRL, smb_ctrl);
+-
+- e1000e_enable_phy_retry(hw);
+-
+- /* Force SMBus mode in MAC */
+- ctrl_ext = er32(CTRL_EXT);
+- ctrl_ext |= E1000_CTRL_EXT_FORCE_SMBUS;
+- ew32(CTRL_EXT, ctrl_ext);
+ }
+
+ /* Ensure that the appropriate bits are set in LPI_CTRL
+--
+2.43.0
+
--- /dev/null
+From 7533e737c9548ec4d3b1d5cdcaced8673a3e6e91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jun 2024 18:29:46 +0300
+Subject: fs/ntfs3: Do not call file_modified if collapse range failed
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit 2db86f7995fe6b62a4d6fee9f3cdeba3c6d27606 ]
+
+Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/file.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c
+index cd69cbd0aaae7..f14d21b6c6d39 100644
+--- a/fs/ntfs3/file.c
++++ b/fs/ntfs3/file.c
+@@ -418,7 +418,7 @@ static int ntfs_truncate(struct inode *inode, loff_t new_size)
+ }
+
+ /*
+- * ntfs_fallocate
++ * ntfs_fallocate - file_operations::ntfs_fallocate
+ *
+ * Preallocate space for a file. This implements ntfs's fallocate file
+ * operation, which gets called from sys_fallocate system call. User
+@@ -553,6 +553,8 @@ static long ntfs_fallocate(struct file *file, int mode, loff_t vbo, loff_t len)
+ ni_lock(ni);
+ err = attr_collapse_range(ni, vbo, len);
+ ni_unlock(ni);
++ if (err)
++ goto out;
+ } else if (mode & FALLOC_FL_INSERT_RANGE) {
+ /* Check new size. */
+ err = inode_newsize_ok(inode, new_size);
+--
+2.43.0
+
--- /dev/null
+From 98b8c2089c6ca47b9cb8e8f21263525f9618dadb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Aug 2024 16:23:02 +0300
+Subject: fs/ntfs3: Fix sparse warning in ni_fiemap
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit 62fea783f96ce825f0ac9e40ce9530ddc1ea2a29 ]
+
+The interface of fiemap_fill_next_extent_k() was modified
+to eliminate the sparse warning.
+
+Fixes: d57431c6f511 ("fs/ntfs3: Do copy_to_user out of run_lock")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202406271920.hndE8N6D-lkp@intel.com/
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/frecord.c | 21 ++++++++-------------
+ 1 file changed, 8 insertions(+), 13 deletions(-)
+
+diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
+index f7c381730b396..61055bcfe8277 100644
+--- a/fs/ntfs3/frecord.c
++++ b/fs/ntfs3/frecord.c
+@@ -1900,13 +1900,13 @@ enum REPARSE_SIGN ni_parse_reparse(struct ntfs_inode *ni, struct ATTRIB *attr,
+
+ /*
+ * fiemap_fill_next_extent_k - a copy of fiemap_fill_next_extent
+- * but it accepts kernel address for fi_extents_start
++ * but it uses 'fe_k' instead of fieinfo->fi_extents_start
+ */
+ static int fiemap_fill_next_extent_k(struct fiemap_extent_info *fieinfo,
+- u64 logical, u64 phys, u64 len, u32 flags)
++ struct fiemap_extent *fe_k, u64 logical,
++ u64 phys, u64 len, u32 flags)
+ {
+ struct fiemap_extent extent;
+- struct fiemap_extent __user *dest = fieinfo->fi_extents_start;
+
+ /* only count the extents */
+ if (fieinfo->fi_extents_max == 0) {
+@@ -1930,8 +1930,7 @@ static int fiemap_fill_next_extent_k(struct fiemap_extent_info *fieinfo,
+ extent.fe_length = len;
+ extent.fe_flags = flags;
+
+- dest += fieinfo->fi_extents_mapped;
+- memcpy(dest, &extent, sizeof(extent));
++ memcpy(fe_k + fieinfo->fi_extents_mapped, &extent, sizeof(extent));
+
+ fieinfo->fi_extents_mapped++;
+ if (fieinfo->fi_extents_mapped == fieinfo->fi_extents_max)
+@@ -1949,7 +1948,6 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo,
+ __u64 vbo, __u64 len)
+ {
+ int err = 0;
+- struct fiemap_extent __user *fe_u = fieinfo->fi_extents_start;
+ struct fiemap_extent *fe_k = NULL;
+ struct ntfs_sb_info *sbi = ni->mi.sbi;
+ u8 cluster_bits = sbi->cluster_bits;
+@@ -2008,7 +2006,6 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo,
+ err = -ENOMEM;
+ goto out;
+ }
+- fieinfo->fi_extents_start = fe_k;
+
+ end = vbo + len;
+ alloc_size = le64_to_cpu(attr->nres.alloc_size);
+@@ -2098,8 +2095,8 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo,
+ if (vbo + dlen >= end)
+ flags |= FIEMAP_EXTENT_LAST;
+
+- err = fiemap_fill_next_extent_k(fieinfo, vbo, lbo, dlen,
+- flags);
++ err = fiemap_fill_next_extent_k(fieinfo, fe_k, vbo, lbo,
++ dlen, flags);
+
+ if (err < 0)
+ break;
+@@ -2120,7 +2117,7 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo,
+ if (vbo + bytes >= end)
+ flags |= FIEMAP_EXTENT_LAST;
+
+- err = fiemap_fill_next_extent_k(fieinfo, vbo, lbo, bytes,
++ err = fiemap_fill_next_extent_k(fieinfo, fe_k, vbo, lbo, bytes,
+ flags);
+ if (err < 0)
+ break;
+@@ -2137,15 +2134,13 @@ int ni_fiemap(struct ntfs_inode *ni, struct fiemap_extent_info *fieinfo,
+ /*
+ * Copy to user memory out of lock
+ */
+- if (copy_to_user(fe_u, fe_k,
++ if (copy_to_user(fieinfo->fi_extents_start, fe_k,
+ fieinfo->fi_extents_max *
+ sizeof(struct fiemap_extent))) {
+ err = -EFAULT;
+ }
+
+ out:
+- /* Restore original pointer. */
+- fieinfo->fi_extents_start = fe_u;
+ kfree(fe_k);
+ return err;
+ }
+--
+2.43.0
+
--- /dev/null
+From 8d5feedf785286163e48b288fe1310b05aeca3fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jul 2024 16:51:18 +0300
+Subject: fs/ntfs3: Refactor enum_rstbl to suppress static checker
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit 56c16d5459d5c050a97a138a00a82b105a8e0a66 ]
+
+Comments and brief description of function enum_rstbl added.
+
+Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/fslog.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
+index 231b012fb19d3..2a1aeab53ea4b 100644
+--- a/fs/ntfs3/fslog.c
++++ b/fs/ntfs3/fslog.c
+@@ -609,14 +609,29 @@ static inline void add_client(struct CLIENT_REC *ca, u16 index, __le16 *head)
+ *head = cpu_to_le16(index);
+ }
+
++/*
++ * Enumerate restart table.
++ *
++ * @t - table to enumerate.
++ * @c - current enumerated element.
++ *
++ * enumeration starts with @c == NULL
++ * returns next element or NULL
++ */
+ static inline void *enum_rstbl(struct RESTART_TABLE *t, void *c)
+ {
+ __le32 *e;
+ u32 bprt;
+- u16 rsize = t ? le16_to_cpu(t->size) : 0;
++ u16 rsize;
++
++ if (!t)
++ return NULL;
++
++ rsize = le16_to_cpu(t->size);
+
+ if (!c) {
+- if (!t || !t->total)
++ /* start enumeration. */
++ if (!t->total)
+ return NULL;
+ e = Add2Ptr(t, sizeof(struct RESTART_TABLE));
+ } else {
+--
+2.43.0
+
--- /dev/null
+From fb5862f5679881d7b53550c1f1b65a5b4222ebbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jun 2024 02:23:54 +0200
+Subject: gfs2: qd_check_sync cleanups
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit 59ebc33201237bf38e5adca3794716100660c5b4 ]
+
+Rename qd_check_sync() to qd_grab_sync() and make it return a bool.
+Turn the sync_gen pointer into a regular u64 and pass in U64_MAX instead
+of a NULL pointer when sync generation checking isn't needed.
+
+Introduce a new qd_ungrab_sync() helper for undoing the effects of
+qd_grab_sync() if the subsequent bh_get() on the qd object fails.
+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Stable-dep-of: 4b4b6374dc61 ("gfs2: Revert "ignore negated quota changes"")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/quota.c | 40 ++++++++++++++++++++++------------------
+ 1 file changed, 22 insertions(+), 18 deletions(-)
+
+diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
+index 62522d4011106..ed602352fe1d3 100644
+--- a/fs/gfs2/quota.c
++++ b/fs/gfs2/quota.c
+@@ -446,13 +446,13 @@ static void bh_put(struct gfs2_quota_data *qd)
+ mutex_unlock(&sdp->sd_quota_mutex);
+ }
+
+-static int qd_check_sync(struct gfs2_sbd *sdp, struct gfs2_quota_data *qd,
+- u64 *sync_gen)
++static bool qd_grab_sync(struct gfs2_sbd *sdp, struct gfs2_quota_data *qd,
++ u64 sync_gen)
+ {
+ if (test_bit(QDF_LOCKED, &qd->qd_flags) ||
+ !test_bit(QDF_CHANGE, &qd->qd_flags) ||
+- (sync_gen && (qd->qd_sync_gen >= *sync_gen)))
+- return 0;
++ qd->qd_sync_gen >= sync_gen)
++ return false;
+
+ /*
+ * If qd_change is 0 it means a pending quota change was negated.
+@@ -462,17 +462,24 @@ static int qd_check_sync(struct gfs2_sbd *sdp, struct gfs2_quota_data *qd,
+ if (!qd->qd_change && test_and_clear_bit(QDF_CHANGE, &qd->qd_flags)) {
+ slot_put(qd);
+ qd_put(qd);
+- return 0;
++ return false;
+ }
+
+ if (!lockref_get_not_dead(&qd->qd_lockref))
+- return 0;
++ return false;
+
+ list_move_tail(&qd->qd_list, &sdp->sd_quota_list);
+ set_bit(QDF_LOCKED, &qd->qd_flags);
+ qd->qd_change_sync = qd->qd_change;
+ slot_hold(qd);
+- return 1;
++ return true;
++}
++
++static void qd_ungrab_sync(struct gfs2_quota_data *qd)
++{
++ clear_bit(QDF_LOCKED, &qd->qd_flags);
++ slot_put(qd);
++ qd_put(qd);
+ }
+
+ static int qd_fish(struct gfs2_sbd *sdp, struct gfs2_quota_data **qdp)
+@@ -488,7 +495,7 @@ static int qd_fish(struct gfs2_sbd *sdp, struct gfs2_quota_data **qdp)
+ spin_lock(&qd_lock);
+
+ list_for_each_entry(iter, &sdp->sd_quota_list, qd_list) {
+- if (qd_check_sync(sdp, iter, &sdp->sd_quota_sync_gen)) {
++ if (qd_grab_sync(sdp, iter, sdp->sd_quota_sync_gen)) {
+ qd = iter;
+ break;
+ }
+@@ -499,9 +506,7 @@ static int qd_fish(struct gfs2_sbd *sdp, struct gfs2_quota_data **qdp)
+ if (qd) {
+ error = bh_get(qd);
+ if (error) {
+- clear_bit(QDF_LOCKED, &qd->qd_flags);
+- slot_put(qd);
+- qd_put(qd);
++ qd_ungrab_sync(qd);
+ return error;
+ }
+ }
+@@ -1139,7 +1144,6 @@ void gfs2_quota_unlock(struct gfs2_inode *ip)
+ struct gfs2_quota_data *qda[2 * GFS2_MAXQUOTAS];
+ unsigned int count = 0;
+ u32 x;
+- int found;
+
+ if (!test_and_clear_bit(GIF_QD_LOCKED, &ip->i_flags))
+ return;
+@@ -1147,6 +1151,7 @@ void gfs2_quota_unlock(struct gfs2_inode *ip)
+ for (x = 0; x < ip->i_qadata->qa_qd_num; x++) {
+ struct gfs2_quota_data *qd;
+ bool sync;
++ int error;
+
+ qd = ip->i_qadata->qa_qd[x];
+ sync = need_sync(qd);
+@@ -1156,17 +1161,16 @@ void gfs2_quota_unlock(struct gfs2_inode *ip)
+ continue;
+
+ spin_lock(&qd_lock);
+- found = qd_check_sync(sdp, qd, NULL);
++ sync = qd_grab_sync(sdp, qd, U64_MAX);
+ spin_unlock(&qd_lock);
+
+- if (!found)
++ if (!sync)
+ continue;
+
+ gfs2_assert_warn(sdp, qd->qd_change_sync);
+- if (bh_get(qd)) {
+- clear_bit(QDF_LOCKED, &qd->qd_flags);
+- slot_put(qd);
+- qd_put(qd);
++ error = bh_get(qd);
++ if (error) {
++ qd_ungrab_sync(qd);
+ continue;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From de7c058ed1215db7f2f32ad0cf4be0dd816c7144 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Jun 2024 19:04:09 +0200
+Subject: gfs2: Revert "ignore negated quota changes"
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit 4b4b6374dc6134849f2bdca81fa2945b6ed6d9fc ]
+
+Commit 4c6a08125f22 ("gfs2: ignore negated quota changes") skips quota
+changes with qd_change == 0 instead of writing them back, which leaves
+behind non-zero qd_change values in the affected slots. The kernel then
+assumes that those slots are unused, while the qd_change values on disk
+indicate that they are indeed still in use. The next time the
+filesystem is mounted, those invalid slots are read in from disk, which
+will cause inconsistencies.
+
+Revert that commit to avoid filesystem corruption.
+
+This reverts commit 4c6a08125f2249531ec01783a5f4317d7342add5.
+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/quota.c | 11 -----------
+ 1 file changed, 11 deletions(-)
+
+diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
+index ed602352fe1d3..c537e1d02cf3a 100644
+--- a/fs/gfs2/quota.c
++++ b/fs/gfs2/quota.c
+@@ -454,17 +454,6 @@ static bool qd_grab_sync(struct gfs2_sbd *sdp, struct gfs2_quota_data *qd,
+ qd->qd_sync_gen >= sync_gen)
+ return false;
+
+- /*
+- * If qd_change is 0 it means a pending quota change was negated.
+- * We should not sync it, but we still have a qd reference and slot
+- * reference taken by gfs2_quota_change -> do_qc that need to be put.
+- */
+- if (!qd->qd_change && test_and_clear_bit(QDF_CHANGE, &qd->qd_flags)) {
+- slot_put(qd);
+- qd_put(qd);
+- return false;
+- }
+-
+ if (!lockref_get_not_dead(&qd->qd_lockref))
+ return false;
+
+--
+2.43.0
+
--- /dev/null
+From 52c3772cb1747d02ee05e2a3e23ef97a4f83195d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jun 2024 02:11:12 +0200
+Subject: gfs2: Revert "introduce qd_bh_get_or_undo"
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit 2aedfe847b4d91eabee11a44c27244055cef4eb3 ]
+
+The qd_bh_get_or_undo() helper introduced by that commit doesn't improve
+the code much, so revert it and clean things up in a more useful way in
+the next commit.
+
+This reverts commit 7dbc6ae60dd7089d8ed42892b6a66c138f0aa7a0.
+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Stable-dep-of: 4b4b6374dc61 ("gfs2: Revert "ignore negated quota changes"")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/quota.c | 36 +++++++++++++++++-------------------
+ 1 file changed, 17 insertions(+), 19 deletions(-)
+
+diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
+index 299b6d6aaa795..62522d4011106 100644
+--- a/fs/gfs2/quota.c
++++ b/fs/gfs2/quota.c
+@@ -475,20 +475,6 @@ static int qd_check_sync(struct gfs2_sbd *sdp, struct gfs2_quota_data *qd,
+ return 1;
+ }
+
+-static int qd_bh_get_or_undo(struct gfs2_sbd *sdp, struct gfs2_quota_data *qd)
+-{
+- int error;
+-
+- error = bh_get(qd);
+- if (!error)
+- return 0;
+-
+- clear_bit(QDF_LOCKED, &qd->qd_flags);
+- slot_put(qd);
+- qd_put(qd);
+- return error;
+-}
+-
+ static int qd_fish(struct gfs2_sbd *sdp, struct gfs2_quota_data **qdp)
+ {
+ struct gfs2_quota_data *qd = NULL, *iter;
+@@ -511,12 +497,17 @@ static int qd_fish(struct gfs2_sbd *sdp, struct gfs2_quota_data **qdp)
+ spin_unlock(&qd_lock);
+
+ if (qd) {
+- error = qd_bh_get_or_undo(sdp, qd);
+- if (error)
++ error = bh_get(qd);
++ if (error) {
++ clear_bit(QDF_LOCKED, &qd->qd_flags);
++ slot_put(qd);
++ qd_put(qd);
+ return error;
+- *qdp = qd;
++ }
+ }
+
++ *qdp = qd;
++
+ return 0;
+ }
+
+@@ -1171,8 +1162,15 @@ void gfs2_quota_unlock(struct gfs2_inode *ip)
+ if (!found)
+ continue;
+
+- if (!qd_bh_get_or_undo(sdp, qd))
+- qda[count++] = qd;
++ gfs2_assert_warn(sdp, qd->qd_change_sync);
++ if (bh_get(qd)) {
++ clear_bit(QDF_LOCKED, &qd->qd_flags);
++ slot_put(qd);
++ qd_put(qd);
++ continue;
++ }
++
++ qda[count++] = qd;
+ }
+
+ if (count) {
+--
+2.43.0
+
--- /dev/null
+From ad4f09ffe5da42d493753c8297ee51601267beee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 17:17:10 +0100
+Subject: i40e: Fix ST code value for Clause 45
+
+From: Ivan Vecera <ivecera@redhat.com>
+
+[ Upstream commit 9b3daf2b0443eeba23c3888059342aec920dfd53 ]
+
+ST code value for clause 45 that has been changed by
+commit 8196b5fd6c73 ("i40e: Refactor I40E_MDIO_CLAUSE* macros")
+is currently wrong.
+
+The mentioned commit refactored ..MDIO_CLAUSE??_STCODE_MASK so
+their value is the same for both clauses. The value is correct
+for clause 22 but not for clause 45.
+
+Fix the issue by adding a parameter to I40E_GLGEN_MSCA_STCODE_MASK
+macro that specifies required value.
+
+Fixes: 8196b5fd6c73 ("i40e: Refactor I40E_MDIO_CLAUSE* macros")
+Signed-off-by: Ivan Vecera <ivecera@redhat.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_register.h | 2 +-
+ drivers/net/ethernet/intel/i40e/i40e_type.h | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_register.h b/drivers/net/ethernet/intel/i40e/i40e_register.h
+index 989c186824733..d3c82ba3835a7 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_register.h
++++ b/drivers/net/ethernet/intel/i40e/i40e_register.h
+@@ -204,7 +204,7 @@
+ #define I40E_GLGEN_MSCA_OPCODE_SHIFT 26
+ #define I40E_GLGEN_MSCA_OPCODE_MASK(_i) I40E_MASK(_i, I40E_GLGEN_MSCA_OPCODE_SHIFT)
+ #define I40E_GLGEN_MSCA_STCODE_SHIFT 28
+-#define I40E_GLGEN_MSCA_STCODE_MASK I40E_MASK(0x1, I40E_GLGEN_MSCA_STCODE_SHIFT)
++#define I40E_GLGEN_MSCA_STCODE_MASK(_i) I40E_MASK(_i, I40E_GLGEN_MSCA_STCODE_SHIFT)
+ #define I40E_GLGEN_MSCA_MDICMD_SHIFT 30
+ #define I40E_GLGEN_MSCA_MDICMD_MASK I40E_MASK(0x1, I40E_GLGEN_MSCA_MDICMD_SHIFT)
+ #define I40E_GLGEN_MSCA_MDIINPROGEN_SHIFT 31
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_type.h b/drivers/net/ethernet/intel/i40e/i40e_type.h
+index 4092f82bcfb12..6e7cb2081ab37 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_type.h
++++ b/drivers/net/ethernet/intel/i40e/i40e_type.h
+@@ -40,11 +40,11 @@ typedef void (*I40E_ADMINQ_CALLBACK)(struct i40e_hw *, struct i40e_aq_desc *);
+ #define I40E_QTX_CTL_VM_QUEUE 0x1
+ #define I40E_QTX_CTL_PF_QUEUE 0x2
+
+-#define I40E_MDIO_CLAUSE22_STCODE_MASK I40E_GLGEN_MSCA_STCODE_MASK
++#define I40E_MDIO_CLAUSE22_STCODE_MASK I40E_GLGEN_MSCA_STCODE_MASK(1)
+ #define I40E_MDIO_CLAUSE22_OPCODE_WRITE_MASK I40E_GLGEN_MSCA_OPCODE_MASK(1)
+ #define I40E_MDIO_CLAUSE22_OPCODE_READ_MASK I40E_GLGEN_MSCA_OPCODE_MASK(2)
+
+-#define I40E_MDIO_CLAUSE45_STCODE_MASK I40E_GLGEN_MSCA_STCODE_MASK
++#define I40E_MDIO_CLAUSE45_STCODE_MASK I40E_GLGEN_MSCA_STCODE_MASK(0)
+ #define I40E_MDIO_CLAUSE45_OPCODE_ADDRESS_MASK I40E_GLGEN_MSCA_OPCODE_MASK(0)
+ #define I40E_MDIO_CLAUSE45_OPCODE_WRITE_MASK I40E_GLGEN_MSCA_OPCODE_MASK(1)
+ #define I40E_MDIO_CLAUSE45_OPCODE_READ_MASK I40E_GLGEN_MSCA_OPCODE_MASK(3)
+--
+2.43.0
+
--- /dev/null
+From 766cc3175505dd9258c7c5f08664217687cbcd84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jan 2024 09:25:32 -0800
+Subject: i40e: Include types.h to some headers
+
+From: Tony Nguyen <anthony.l.nguyen@intel.com>
+
+[ Upstream commit 9cfd3b502153810b66ac0ce47f1fba682228f2d2 ]
+
+Commit 56df345917c0 ("i40e: Remove circular header dependencies and fix
+headers") redistributed a number of includes from one large header file
+to the locations they were needed. In some environments, types.h is not
+included and causing compile issues. The driver should not rely on
+implicit inclusion from other locations; explicitly include it to these
+files.
+
+Snippet of issue. Entire log can be seen through the Closes: link.
+
+In file included from drivers/net/ethernet/intel/i40e/i40e_diag.h:7,
+ from drivers/net/ethernet/intel/i40e/i40e_diag.c:4:
+drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h:33:9: error: unknown type name '__le16'
+ 33 | __le16 flags;
+ | ^~~~~~
+drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h:34:9: error: unknown type name '__le16'
+ 34 | __le16 opcode;
+ | ^~~~~~
+...
+drivers/net/ethernet/intel/i40e/i40e_diag.h:22:9: error: unknown type name 'u32'
+ 22 | u32 elements; /* number of elements if array */
+ | ^~~
+drivers/net/ethernet/intel/i40e/i40e_diag.h:23:9: error: unknown type name 'u32'
+ 23 | u32 stride; /* bytes between each element */
+
+Reported-by: Martin Zaharinov <micron10@gmail.com>
+Closes: https://lore.kernel.org/netdev/21BBD62A-F874-4E42-B347-93087EEA8126@gmail.com/
+Fixes: 56df345917c0 ("i40e: Remove circular header dependencies and fix headers")
+Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Tested-by: Arpana Arland <arpanax.arland@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Link: https://lore.kernel.org/r/20240117172534.3555162-1-anthony.l.nguyen@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h | 1 +
+ drivers/net/ethernet/intel/i40e/i40e_diag.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h b/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h
+index 18a1c3b6d72c5..c8f35d4de271a 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h
++++ b/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h
+@@ -5,6 +5,7 @@
+ #define _I40E_ADMINQ_CMD_H_
+
+ #include <linux/bits.h>
++#include <linux/types.h>
+
+ /* This header file defines the i40e Admin Queue commands and is shared between
+ * i40e Firmware and Software.
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_diag.h b/drivers/net/ethernet/intel/i40e/i40e_diag.h
+index ece3a6b9a5c61..ab20202a3da3c 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_diag.h
++++ b/drivers/net/ethernet/intel/i40e/i40e_diag.h
+@@ -4,6 +4,7 @@
+ #ifndef _I40E_DIAG_H_
+ #define _I40E_DIAG_H_
+
++#include <linux/types.h>
+ #include "i40e_adminq_cmd.h"
+
+ /* forward-declare the HW struct for the compiler */
+--
+2.43.0
+
--- /dev/null
+From 5f1405777669e0ae1dbbfb5449d267c09fdef965 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2024 05:40:12 +0000
+Subject: Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal
+
+From: Mathias Krause <minipli@grsecurity.net>
+
+commit fbf8d71742557abaf558d8efb96742d442720cc2 upstream.
+
+Calling irq_domain_remove() will lead to freeing the IRQ domain
+prematurely. The domain is still referenced and will be attempted to get
+used via rmi_free_function_list() -> rmi_unregister_function() ->
+irq_dispose_mapping() -> irq_get_irq_data()'s ->domain pointer.
+
+With PaX's MEMORY_SANITIZE this will lead to an access fault when
+attempting to dereference embedded pointers, as in Torsten's report that
+was faulting on the 'domain->ops->unmap' test.
+
+Fix this by releasing the IRQ domain only after all related IRQs have
+been deactivated.
+
+Fixes: 24d28e4f1271 ("Input: synaptics-rmi4 - convert irq distribution to irq_domain")
+Reported-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
+Signed-off-by: Mathias Krause <minipli@grsecurity.net>
+Link: https://lore.kernel.org/r/20240222142654.856566-1-minipli@grsecurity.net
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/rmi4/rmi_driver.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
+index aa32371f04af6..ef9ea295f9e03 100644
+--- a/drivers/input/rmi4/rmi_driver.c
++++ b/drivers/input/rmi4/rmi_driver.c
+@@ -978,12 +978,12 @@ static int rmi_driver_remove(struct device *dev)
+
+ rmi_disable_irq(rmi_dev, false);
+
+- irq_domain_remove(data->irqdomain);
+- data->irqdomain = NULL;
+-
+ rmi_f34_remove_sysfs(rmi_dev);
+ rmi_free_function_list(rmi_dev);
+
++ irq_domain_remove(data->irqdomain);
++ data->irqdomain = NULL;
++
+ return 0;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From 78c166c10701fced9a7f5c4a74a124eb5acc07c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2024 22:16:47 -0700
+Subject: jbd2: fix kernel-doc for j_transaction_overhead_buffers
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 7e8fb2eda9885ea2d13179a4c0bbf810f900ef25 ]
+
+Use the correct struct member name in the kernel-doc notation
+to prevent a kernel-doc build warning.
+
+include/linux/jbd2.h:1303: warning: Function parameter or struct member 'j_transaction_overhead_buffers' not described in 'journal_s'
+include/linux/jbd2.h:1303: warning: Excess struct member 'j_transaction_overhead' description in 'journal_s'
+
+Fixes: e3a00a23781c ("jbd2: precompute number of transaction descriptor blocks")
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Closes: https://lore.kernel.org/linux-next/20240710182252.4c281445@canb.auug.org.au/
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://patch.msgid.link/20240723051647.3053491-1-rdunlap@infradead.org
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/jbd2.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
+index 8553dc1d0e898..f0bc9aa5aed3f 100644
+--- a/include/linux/jbd2.h
++++ b/include/linux/jbd2.h
+@@ -1084,7 +1084,7 @@ struct journal_s
+ int j_revoke_records_per_block;
+
+ /**
+- * @j_transaction_overhead:
++ * @j_transaction_overhead_buffers:
+ *
+ * Number of blocks each transaction needs for its own bookkeeping
+ */
+--
+2.43.0
+
--- /dev/null
+From 7ccc954fcf80f5689e58a9e8b8345a2caf46eaa6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Jul 2024 17:58:01 +0200
+Subject: lib/build_OID_registry: avoid non-destructive substitution for Perl <
+ 5.13.2 compat
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Paul Menzel <pmenzel@molgen.mpg.de>
+
+[ Upstream commit 2fe29fe945637b9834c5569fbb1c9d4f881d8263 ]
+
+On a system with Perl 5.12.1, commit 5ef6dc08cfde
+("lib/build_OID_registry: don't mention the full path of the script in
+output") causes the build to fail with the error below.
+
+ Bareword found where operator expected at ./lib/build_OID_registry line 41, near "s#^\Q$abs_srctree/\E##r"
+ syntax error at ./lib/build_OID_registry line 41, near "s#^\Q$abs_srctree/\E##r"
+ Execution of ./lib/build_OID_registry aborted due to compilation errors.
+ make[3]: *** [lib/Makefile:352: lib/oid_registry_data.c] Error 255
+
+Ahmad Fatoum analyzed that non-destructive substitution is only supported since
+Perl 5.13.2. Instead of dropping `r` and having the side effect of modifying
+`$0`, introduce a dedicated variable to support older Perl versions.
+
+Link: https://lkml.kernel.org/r/20240702223512.8329-2-pmenzel@molgen.mpg.de
+Link: https://lkml.kernel.org/r/20240701155802.75152-1-pmenzel@molgen.mpg.de
+Fixes: 5ef6dc08cfde ("lib/build_OID_registry: don't mention the full path of the script in output")
+Link: https://lore.kernel.org/all/259f7a87-2692-480e-9073-1c1c35b52f67@molgen.mpg.de/
+Signed-off-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Suggested-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Cc: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Cc: Nicolas Schier <nicolas@fjasle.eu>
+Cc: Masahiro Yamada <masahiroy@kernel.org>
+Cc: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/build_OID_registry | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/lib/build_OID_registry b/lib/build_OID_registry
+index 56d8bafeb848b..8267e8d71338b 100755
+--- a/lib/build_OID_registry
++++ b/lib/build_OID_registry
+@@ -38,7 +38,9 @@ close IN_FILE || die;
+ #
+ open C_FILE, ">$ARGV[1]" or die;
+ print C_FILE "/*\n";
+-print C_FILE " * Automatically generated by ", $0 =~ s#^\Q$abs_srctree/\E##r, ". Do not edit\n";
++my $scriptname = $0;
++$scriptname =~ s#^\Q$abs_srctree/\E##;
++print C_FILE " * Automatically generated by ", $scriptname, ". Do not edit\n";
+ print C_FILE " */\n";
+
+ #
+--
+2.43.0
+
--- /dev/null
+From c900e091d6328aa98c9b29ed9ed4bd9ae733cd40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Mar 2024 09:05:44 +0800
+Subject: libceph: init the cursor when preparing sparse read in msgr2
+
+From: Xiubo Li <xiubli@redhat.com>
+
+[ Upstream commit 321e3c3de53c7530cd518219d01f04e7e32a9d23 ]
+
+The cursor is no longer initialized in the OSD client, causing the
+sparse read state machine to fall into an infinite loop. The cursor
+should be initialized in IN_S_PREPARE_SPARSE_DATA state.
+
+[ idryomov: use msg instead of con->in_msg, changelog ]
+
+Link: https://tracker.ceph.com/issues/64607
+Fixes: 8e46a2d068c9 ("libceph: just wait for more data to be available on the socket")
+Signed-off-by: Xiubo Li <xiubli@redhat.com>
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
+Tested-by: Luis Henriques <lhenriques@suse.de>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ceph/messenger_v2.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c
+index a901cae2f1060..f9ed6bf6c4776 100644
+--- a/net/ceph/messenger_v2.c
++++ b/net/ceph/messenger_v2.c
+@@ -2038,6 +2038,9 @@ static int prepare_sparse_read_data(struct ceph_connection *con)
+ if (!con_secure(con))
+ con->in_data_crc = -1;
+
++ ceph_msg_data_cursor_init(&con->v2.in_cursor, msg,
++ msg->sparse_read_total);
++
+ reset_in_kvecs(con);
+ con->v2.in_state = IN_S_PREPARE_SPARSE_DATA_CONT;
+ con->v2.data_len_remain = data_len(msg);
+--
+2.43.0
+
--- /dev/null
+From e0c46f31af15e300f3375719e8e551ef2adb1455 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2024 11:48:30 +0530
+Subject: libsubcmd: Don't free the usage string
+
+From: Aditya Gupta <adityag@linux.ibm.com>
+
+[ Upstream commit 1a5efc9e13f357abc396dbf445b25d08914c8060 ]
+
+Currently, commands which depend on 'parse_options_subcommand()' don't
+show the usage string, and instead show '(null)'
+
+ $ ./perf sched
+ Usage: (null)
+
+ -D, --dump-raw-trace dump raw trace in ASCII
+ -f, --force don't complain, do it
+ -i, --input <file> input file name
+ -v, --verbose be more verbose (show symbol address, etc)
+
+'parse_options_subcommand()' is generally expected to initialise the usage
+string, with information in the passed 'subcommands[]' array
+
+This behaviour was changed in:
+
+ 230a7a71f92212e7 ("libsubcmd: Fix parse-options memory leak")
+
+Where the generated usage string is deallocated, and usage[0] string is
+reassigned as NULL.
+
+As discussed in [1], free the allocated usage string in the main
+function itself, and don't reset usage string to NULL in
+parse_options_subcommand
+
+With this change, the behaviour is restored.
+
+ $ ./perf sched
+ Usage: perf sched [<options>] {record|latency|map|replay|script|timehist}
+
+ -D, --dump-raw-trace dump raw trace in ASCII
+ -f, --force don't complain, do it
+ -i, --input <file> input file name
+ -v, --verbose be more verbose (show symbol address, etc)
+
+[1]: https://lore.kernel.org/linux-perf-users/htq5vhx6piet4nuq2mmhk7fs2bhfykv52dbppwxmo3s7du2odf@styd27tioc6e/
+
+Fixes: 230a7a71f92212e7 ("libsubcmd: Fix parse-options memory leak")
+Suggested-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+Cc: Disha Goel <disgoel@linux.vnet.ibm.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kajol Jain <kjain@linux.ibm.com>
+Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20240904061836.55873-2-adityag@linux.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/subcmd/parse-options.c | 8 +++-----
+ tools/perf/builtin-kmem.c | 2 ++
+ tools/perf/builtin-kvm.c | 3 +++
+ tools/perf/builtin-kwork.c | 3 +++
+ tools/perf/builtin-lock.c | 3 +++
+ tools/perf/builtin-mem.c | 3 +++
+ tools/perf/builtin-sched.c | 3 +++
+ 7 files changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/tools/lib/subcmd/parse-options.c b/tools/lib/subcmd/parse-options.c
+index d943d78b787ed..9fa75943f2ed1 100644
+--- a/tools/lib/subcmd/parse-options.c
++++ b/tools/lib/subcmd/parse-options.c
+@@ -633,10 +633,11 @@ int parse_options_subcommand(int argc, const char **argv, const struct option *o
+ const char *const subcommands[], const char *usagestr[], int flags)
+ {
+ struct parse_opt_ctx_t ctx;
+- char *buf = NULL;
+
+ /* build usage string if it's not provided */
+ if (subcommands && !usagestr[0]) {
++ char *buf = NULL;
++
+ astrcatf(&buf, "%s %s [<options>] {", subcmd_config.exec_name, argv[0]);
+
+ for (int i = 0; subcommands[i]; i++) {
+@@ -678,10 +679,7 @@ int parse_options_subcommand(int argc, const char **argv, const struct option *o
+ astrcatf(&error_buf, "unknown switch `%c'", *ctx.opt);
+ usage_with_options(usagestr, options);
+ }
+- if (buf) {
+- usagestr[0] = NULL;
+- free(buf);
+- }
++
+ return parse_options_end(&ctx);
+ }
+
+diff --git a/tools/perf/builtin-kmem.c b/tools/perf/builtin-kmem.c
+index 9714327fd0ead..cf623c1490d95 100644
+--- a/tools/perf/builtin-kmem.c
++++ b/tools/perf/builtin-kmem.c
+@@ -2058,6 +2058,8 @@ int cmd_kmem(int argc, const char **argv)
+
+ out_delete:
+ perf_session__delete(session);
++ /* free usage string allocated by parse_options_subcommand */
++ free((void *)kmem_usage[0]);
+
+ return ret;
+ }
+diff --git a/tools/perf/builtin-kvm.c b/tools/perf/builtin-kvm.c
+index 71165036e4cac..988bef73bd095 100644
+--- a/tools/perf/builtin-kvm.c
++++ b/tools/perf/builtin-kvm.c
+@@ -2187,5 +2187,8 @@ int cmd_kvm(int argc, const char **argv)
+ else
+ usage_with_options(kvm_usage, kvm_options);
+
++ /* free usage string allocated by parse_options_subcommand */
++ free((void *)kvm_usage[0]);
++
+ return 0;
+ }
+diff --git a/tools/perf/builtin-kwork.c b/tools/perf/builtin-kwork.c
+index de2fbb7c56c32..be210be42c77b 100644
+--- a/tools/perf/builtin-kwork.c
++++ b/tools/perf/builtin-kwork.c
+@@ -1853,5 +1853,8 @@ int cmd_kwork(int argc, const char **argv)
+ } else
+ usage_with_options(kwork_usage, kwork_options);
+
++ /* free usage string allocated by parse_options_subcommand */
++ free((void *)kwork_usage[0]);
++
+ return 0;
+ }
+diff --git a/tools/perf/builtin-lock.c b/tools/perf/builtin-lock.c
+index 0b4b4445c5207..fcb32c58bee7e 100644
+--- a/tools/perf/builtin-lock.c
++++ b/tools/perf/builtin-lock.c
+@@ -2622,6 +2622,9 @@ int cmd_lock(int argc, const char **argv)
+ usage_with_options(lock_usage, lock_options);
+ }
+
++ /* free usage string allocated by parse_options_subcommand */
++ free((void *)lock_usage[0]);
++
+ zfree(&lockhash_table);
+ return rc;
+ }
+diff --git a/tools/perf/builtin-mem.c b/tools/perf/builtin-mem.c
+index 865f321d729b6..286105be91cec 100644
+--- a/tools/perf/builtin-mem.c
++++ b/tools/perf/builtin-mem.c
+@@ -518,5 +518,8 @@ int cmd_mem(int argc, const char **argv)
+ else
+ usage_with_options(mem_usage, mem_options);
+
++ /* free usage string allocated by parse_options_subcommand */
++ free((void *)mem_usage[0]);
++
+ return 0;
+ }
+diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
+index 994b9dcb2385a..ac9d94dbbeefa 100644
+--- a/tools/perf/builtin-sched.c
++++ b/tools/perf/builtin-sched.c
+@@ -3737,5 +3737,8 @@ int cmd_sched(int argc, const char **argv)
+ usage_with_options(sched_usage, sched_options);
+ }
+
++ /* free usage string allocated by parse_options_subcommand */
++ free((void *)sched_usage[0]);
++
+ return 0;
+ }
+--
+2.43.0
+
--- /dev/null
+From c8e96ab2497186986675c4da6767c95cc9f1538c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Jan 2024 01:12:22 +0100
+Subject: net: ethernet: cortina: Drop TSO support
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit ac631873c9e7a50d2a8de457cfc4b9f86666403e ]
+
+The recent change to allow large frames without hardware checksumming
+slotted in software checksumming in the driver if hardware could not
+do it.
+
+This will however upset TSO (TCP Segment Offloading). Typical
+error dumps includes this:
+
+skb len=2961 headroom=222 headlen=66 tailroom=0
+(...)
+WARNING: CPU: 0 PID: 956 at net/core/dev.c:3259 skb_warn_bad_offload+0x7c/0x108
+gemini-ethernet-port: caps=(0x0000010000154813, 0x00002007ffdd7889)
+
+And the packets do not go through.
+
+The TSO implementation is bogus: a TSO enabled driver must propagate
+the skb_shinfo(skb)->gso_size value to the TSO engine on the NIC.
+
+Drop the size check and TSO offloading features for now: this
+needs to be fixed up properly.
+
+After this ethernet works fine on Gemini devices with a direct connected
+PHY such as D-Link DNS-313.
+
+Also tested to still be working with a DSA switch using the Gemini
+ethernet as conduit interface.
+
+Link: https://lore.kernel.org/netdev/CANn89iJLfxng1sYL5Zk0mknXpyYQPCp83m3KgD2KJ2_hKCpEUg@mail.gmail.com/
+Suggested-by: Eric Dumazet <edumazet@google.com>
+Fixes: d4d0c5b4d279 ("net: ethernet: cortina: Handle large frames")
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cortina/gemini.c | 15 ++-------------
+ 1 file changed, 2 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
+index f69d974a23a1f..956cfb293ee19 100644
+--- a/drivers/net/ethernet/cortina/gemini.c
++++ b/drivers/net/ethernet/cortina/gemini.c
+@@ -79,8 +79,7 @@ MODULE_PARM_DESC(debug, "Debug level (0=none,...,16=all)");
+ #define GMAC0_IRQ4_8 (GMAC0_MIB_INT_BIT | GMAC0_RX_OVERRUN_INT_BIT)
+
+ #define GMAC_OFFLOAD_FEATURES (NETIF_F_SG | NETIF_F_IP_CSUM | \
+- NETIF_F_IPV6_CSUM | NETIF_F_RXCSUM | \
+- NETIF_F_TSO | NETIF_F_TSO_ECN | NETIF_F_TSO6)
++ NETIF_F_IPV6_CSUM | NETIF_F_RXCSUM)
+
+ /**
+ * struct gmac_queue_page - page buffer per-page info
+@@ -1148,23 +1147,13 @@ static int gmac_map_tx_bufs(struct net_device *netdev, struct sk_buff *skb,
+ struct gmac_txdesc *txd;
+ skb_frag_t *skb_frag;
+ dma_addr_t mapping;
+- unsigned short mtu;
+ void *buffer;
+ int ret;
+
+- mtu = ETH_HLEN;
+- mtu += netdev->mtu;
+- if (skb->protocol == htons(ETH_P_8021Q))
+- mtu += VLAN_HLEN;
+-
++ /* TODO: implement proper TSO using MTU in word3 */
+ word1 = skb->len;
+ word3 = SOF_BIT;
+
+- if (word1 > mtu) {
+- word1 |= TSS_MTU_ENABLE_BIT;
+- word3 |= mtu;
+- }
+-
+ if (skb->len >= ETH_FRAME_LEN) {
+ /* Hardware offloaded checksumming isn't working on frames
+ * bigger than 1514 bytes. A hypothesis about this is that the
+--
+2.43.0
+
--- /dev/null
+From 7ca016d622912fac1f27c065ca00851135d950c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Sep 2024 14:19:32 -0300
+Subject: ntfs3: Change to non-blocking allocation in ntfs_d_hash
+
+From: Diogo Jahchan Koike <djahchankoike@gmail.com>
+
+[ Upstream commit 589996bf8c459deb5bbc9747d8f1c51658608103 ]
+
+d_hash is done while under "rcu-walk" and should not sleep.
+__get_name() allocates using GFP_KERNEL, having the possibility
+to sleep when under memory pressure. Change the allocation to
+GFP_NOWAIT.
+
+Reported-by: syzbot+7f71f79bbfb4427b00e1@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=7f71f79bbfb4427b00e1
+Fixes: d392e85fd1e8 ("fs/ntfs3: Fix the format of the "nocase" mount option")
+Signed-off-by: Diogo Jahchan Koike <djahchankoike@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/namei.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ntfs3/namei.c b/fs/ntfs3/namei.c
+index b5687d74b4495..bcdc1ec90a96a 100644
+--- a/fs/ntfs3/namei.c
++++ b/fs/ntfs3/namei.c
+@@ -501,7 +501,7 @@ static int ntfs_d_hash(const struct dentry *dentry, struct qstr *name)
+ /*
+ * Try slow way with current upcase table
+ */
+- uni = __getname();
++ uni = kmem_cache_alloc(names_cachep, GFP_NOWAIT);
+ if (!uni)
+ return -ENOMEM;
+
+@@ -523,7 +523,7 @@ static int ntfs_d_hash(const struct dentry *dentry, struct qstr *name)
+ err = 0;
+
+ out:
+- __putname(uni);
++ kmem_cache_free(names_cachep, uni);
+ return err;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From 43d96afeaa188b27b03ef968bc69450c2d0519ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Feb 2024 16:20:02 -0800
+Subject: pds_core: no health-thread in VF path
+
+From: Shannon Nelson <shannon.nelson@amd.com>
+
+[ Upstream commit 3e36031cc0540ca97b615cbb940331892cbd3d21 ]
+
+The VFs don't run the health thread, so don't try to
+stop or restart the non-existent timer or work item.
+
+Fixes: d9407ff11809 ("pds_core: Prevent health thread from running during reset/remove")
+Reviewed-by: Brett Creeley <brett.creeley@amd.com>
+Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
+Link: https://lore.kernel.org/r/20240210002002.49483-1-shannon.nelson@amd.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/pds_core/main.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/ethernet/amd/pds_core/main.c b/drivers/net/ethernet/amd/pds_core/main.c
+index 6d589ac532a3d..eddbf0acdde77 100644
+--- a/drivers/net/ethernet/amd/pds_core/main.c
++++ b/drivers/net/ethernet/amd/pds_core/main.c
+@@ -451,6 +451,9 @@ static void pdsc_remove(struct pci_dev *pdev)
+
+ static void pdsc_stop_health_thread(struct pdsc *pdsc)
+ {
++ if (pdsc->pdev->is_virtfn)
++ return;
++
+ timer_shutdown_sync(&pdsc->wdtimer);
+ if (pdsc->health_work.func)
+ cancel_work_sync(&pdsc->health_work);
+@@ -458,6 +461,9 @@ static void pdsc_stop_health_thread(struct pdsc *pdsc)
+
+ static void pdsc_restart_health_thread(struct pdsc *pdsc)
+ {
++ if (pdsc->pdev->is_virtfn)
++ return;
++
+ timer_setup(&pdsc->wdtimer, pdsc_wdtimer_cb, 0);
+ mod_timer(&pdsc->wdtimer, jiffies + 1);
+ }
+--
+2.43.0
+
--- /dev/null
+From 9666f00816b45f9efd1239f52eb3d40b2bc42075 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Feb 2024 08:32:25 +0000
+Subject: perf sched: Fix memory leak in perf_sched__map()
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit ef76a5af819743d405674f6de5d0e63320ac653e ]
+
+perf_sched__map() needs to free memory of map_cpus, color_pids and
+color_cpus in normal path and rollback allocated memory in error path.
+
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20240206083228.172607-3-yangjihong1@huawei.com
+Stable-dep-of: 1a5efc9e13f3 ("libsubcmd: Don't free the usage string")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-sched.c | 41 ++++++++++++++++++++++++--------------
+ 1 file changed, 26 insertions(+), 15 deletions(-)
+
+diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
+index 2d36b06d4d877..8143828fdc585 100644
+--- a/tools/perf/builtin-sched.c
++++ b/tools/perf/builtin-sched.c
+@@ -3252,8 +3252,6 @@ static int perf_sched__lat(struct perf_sched *sched)
+
+ static int setup_map_cpus(struct perf_sched *sched)
+ {
+- struct perf_cpu_map *map;
+-
+ sched->max_cpu.cpu = sysconf(_SC_NPROCESSORS_CONF);
+
+ if (sched->map.comp) {
+@@ -3262,16 +3260,15 @@ static int setup_map_cpus(struct perf_sched *sched)
+ return -1;
+ }
+
+- if (!sched->map.cpus_str)
+- return 0;
+-
+- map = perf_cpu_map__new(sched->map.cpus_str);
+- if (!map) {
+- pr_err("failed to get cpus map from %s\n", sched->map.cpus_str);
+- return -1;
++ if (sched->map.cpus_str) {
++ sched->map.cpus = perf_cpu_map__new(sched->map.cpus_str);
++ if (!sched->map.cpus) {
++ pr_err("failed to get cpus map from %s\n", sched->map.cpus_str);
++ zfree(&sched->map.comp_cpus);
++ return -1;
++ }
+ }
+
+- sched->map.cpus = map;
+ return 0;
+ }
+
+@@ -3311,20 +3308,34 @@ static int setup_color_cpus(struct perf_sched *sched)
+
+ static int perf_sched__map(struct perf_sched *sched)
+ {
++ int rc = -1;
++
+ if (setup_map_cpus(sched))
+- return -1;
++ return rc;
+
+ if (setup_color_pids(sched))
+- return -1;
++ goto out_put_map_cpus;
+
+ if (setup_color_cpus(sched))
+- return -1;
++ goto out_put_color_pids;
+
+ setup_pager();
+ if (perf_sched__read_events(sched))
+- return -1;
++ goto out_put_color_cpus;
++
++ rc = 0;
+ print_bad_events(sched);
+- return 0;
++
++out_put_color_cpus:
++ perf_cpu_map__put(sched->map.color_cpus);
++
++out_put_color_pids:
++ perf_thread_map__put(sched->map.color_pids);
++
++out_put_map_cpus:
++ zfree(&sched->map.comp_cpus);
++ perf_cpu_map__put(sched->map.cpus);
++ return rc;
+ }
+
+ static int perf_sched__replay(struct perf_sched *sched)
+--
+2.43.0
+
--- /dev/null
+From 5f84dd866810cd14b1cf7887f6d81288819b058f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Feb 2024 08:32:27 +0000
+Subject: perf sched: Move curr_pid and cpu_last_switched initialization to
+ perf_sched__{lat|map|replay}()
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit bd2cdf26b9ea000339d54adc82e87fdbf22c21c3 ]
+
+The curr_pid and cpu_last_switched are used only for the
+'perf sched replay/latency/map'. Put their initialization in
+perf_sched__{lat|map|replay () to reduce unnecessary actions in other
+commands.
+
+Simple functional testing:
+
+ # perf sched record perf bench sched messaging
+ # Running 'sched/messaging' benchmark:
+ # 20 sender and receiver processes per group
+ # 10 groups == 400 processes run
+
+ Total time: 0.209 [sec]
+ [ perf record: Woken up 1 times to write data ]
+ [ perf record: Captured and wrote 16.456 MB perf.data (147907 samples) ]
+
+ # perf sched lat
+
+ -------------------------------------------------------------------------------------------------------------------------------------------
+ Task | Runtime ms | Switches | Avg delay ms | Max delay ms | Max delay start | Max delay end |
+ -------------------------------------------------------------------------------------------------------------------------------------------
+ sched-messaging:(401) | 2990.699 ms | 38705 | avg: 0.661 ms | max: 67.046 ms | max start: 456532.624830 s | max end: 456532.691876 s
+ qemu-system-x86:(7) | 179.764 ms | 2191 | avg: 0.152 ms | max: 21.857 ms | max start: 456532.576434 s | max end: 456532.598291 s
+ sshd:48125 | 0.522 ms | 2 | avg: 0.037 ms | max: 0.046 ms | max start: 456532.514610 s | max end: 456532.514656 s
+ <SNIP>
+ ksoftirqd/11:82 | 0.063 ms | 1 | avg: 0.005 ms | max: 0.005 ms | max start: 456532.769366 s | max end: 456532.769371 s
+ kworker/9:0-mm_:34624 | 0.233 ms | 20 | avg: 0.004 ms | max: 0.007 ms | max start: 456532.690804 s | max end: 456532.690812 s
+ migration/13:93 | 0.000 ms | 1 | avg: 0.004 ms | max: 0.004 ms | max start: 456532.512669 s | max end: 456532.512674 s
+ -----------------------------------------------------------------------------------------------------------------
+ TOTAL: | 3180.750 ms | 41368 |
+ ---------------------------------------------------
+
+ # echo $?
+ 0
+
+ # perf sched map
+ *A0 456532.510141 secs A0 => migration/0:15
+ *. 456532.510171 secs . => swapper:0
+ . *B0 456532.510261 secs B0 => migration/1:21
+ . *. 456532.510279 secs
+ <SNIP>
+ L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 *L7 . . . . 456532.785979 secs
+ L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 *L7 . . . 456532.786054 secs
+ L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 *L7 . . 456532.786127 secs
+ L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 *L7 . 456532.786197 secs
+ L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 L7 *L7 456532.786270 secs
+ # echo $?
+ 0
+
+ # perf sched replay
+ run measurement overhead: 108 nsecs
+ sleep measurement overhead: 66473 nsecs
+ the run test took 1000002 nsecs
+ the sleep test took 1082686 nsecs
+ nr_run_events: 49334
+ nr_sleep_events: 50054
+ nr_wakeup_events: 34701
+ target-less wakeups: 165
+ multi-target wakeups: 766
+ task 0 ( swapper: 0), nr_events: 15419
+ task 1 ( swapper: 1), nr_events: 1
+ task 2 ( swapper: 2), nr_events: 1
+ <SNIP>
+ task 715 ( sched-messaging: 110248), nr_events: 1438
+ task 716 ( sched-messaging: 110249), nr_events: 512
+ task 717 ( sched-messaging: 110250), nr_events: 500
+ task 718 ( sched-messaging: 110251), nr_events: 537
+ task 719 ( sched-messaging: 110252), nr_events: 823
+ ------------------------------------------------------------
+ #1 : 1325.288, ravg: 1325.29, cpu: 7823.35 / 7823.35
+ #2 : 1363.606, ravg: 1329.12, cpu: 7655.53 / 7806.56
+ #3 : 1349.494, ravg: 1331.16, cpu: 7544.80 / 7780.39
+ #4 : 1311.488, ravg: 1329.19, cpu: 7495.13 / 7751.86
+ #5 : 1309.902, ravg: 1327.26, cpu: 7266.65 / 7703.34
+ #6 : 1309.535, ravg: 1325.49, cpu: 7843.86 / 7717.39
+ #7 : 1316.482, ravg: 1324.59, cpu: 7854.41 / 7731.09
+ #8 : 1366.604, ravg: 1328.79, cpu: 7955.81 / 7753.57
+ #9 : 1326.286, ravg: 1328.54, cpu: 7466.86 / 7724.90
+ #10 : 1356.653, ravg: 1331.35, cpu: 7566.60 / 7709.07
+ # echo $?
+ 0
+
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20240206083228.172607-5-yangjihong1@huawei.com
+Stable-dep-of: 1a5efc9e13f3 ("libsubcmd: Don't free the usage string")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-sched.c | 94 +++++++++++++++++++++++++-------------
+ 1 file changed, 61 insertions(+), 33 deletions(-)
+
+diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
+index e498b559ea68a..994b9dcb2385a 100644
+--- a/tools/perf/builtin-sched.c
++++ b/tools/perf/builtin-sched.c
+@@ -3211,14 +3211,44 @@ static void perf_sched__merge_lat(struct perf_sched *sched)
+ }
+ }
+
++static int setup_cpus_switch_event(struct perf_sched *sched)
++{
++ unsigned int i;
++
++ sched->cpu_last_switched = calloc(MAX_CPUS, sizeof(*(sched->cpu_last_switched)));
++ if (!sched->cpu_last_switched)
++ return -1;
++
++ sched->curr_pid = malloc(MAX_CPUS * sizeof(*(sched->curr_pid)));
++ if (!sched->curr_pid) {
++ zfree(&sched->cpu_last_switched);
++ return -1;
++ }
++
++ for (i = 0; i < MAX_CPUS; i++)
++ sched->curr_pid[i] = -1;
++
++ return 0;
++}
++
++static void free_cpus_switch_event(struct perf_sched *sched)
++{
++ zfree(&sched->curr_pid);
++ zfree(&sched->cpu_last_switched);
++}
++
+ static int perf_sched__lat(struct perf_sched *sched)
+ {
++ int rc = -1;
+ struct rb_node *next;
+
+ setup_pager();
+
++ if (setup_cpus_switch_event(sched))
++ return rc;
++
+ if (perf_sched__read_events(sched))
+- return -1;
++ goto out_free_cpus_switch_event;
+
+ perf_sched__merge_lat(sched);
+ perf_sched__sort_lat(sched);
+@@ -3247,7 +3277,11 @@ static int perf_sched__lat(struct perf_sched *sched)
+ print_bad_events(sched);
+ printf("\n");
+
+- return 0;
++ rc = 0;
++
++out_free_cpus_switch_event:
++ free_cpus_switch_event(sched);
++ return rc;
+ }
+
+ static int setup_map_cpus(struct perf_sched *sched)
+@@ -3314,9 +3348,12 @@ static int perf_sched__map(struct perf_sched *sched)
+ if (!sched->curr_thread)
+ return rc;
+
+- if (setup_map_cpus(sched))
++ if (setup_cpus_switch_event(sched))
+ goto out_free_curr_thread;
+
++ if (setup_map_cpus(sched))
++ goto out_free_cpus_switch_event;
++
+ if (setup_color_pids(sched))
+ goto out_put_map_cpus;
+
+@@ -3340,6 +3377,9 @@ static int perf_sched__map(struct perf_sched *sched)
+ zfree(&sched->map.comp_cpus);
+ perf_cpu_map__put(sched->map.cpus);
+
++out_free_cpus_switch_event:
++ free_cpus_switch_event(sched);
++
+ out_free_curr_thread:
+ zfree(&sched->curr_thread);
+ return rc;
+@@ -3353,6 +3393,10 @@ static int perf_sched__replay(struct perf_sched *sched)
+ mutex_init(&sched->start_work_mutex);
+ mutex_init(&sched->work_done_wait_mutex);
+
++ ret = setup_cpus_switch_event(sched);
++ if (ret)
++ goto out_mutex_destroy;
++
+ calibrate_run_measurement_overhead(sched);
+ calibrate_sleep_measurement_overhead(sched);
+
+@@ -3360,7 +3404,7 @@ static int perf_sched__replay(struct perf_sched *sched)
+
+ ret = perf_sched__read_events(sched);
+ if (ret)
+- goto out_mutex_destroy;
++ goto out_free_cpus_switch_event;
+
+ printf("nr_run_events: %ld\n", sched->nr_run_events);
+ printf("nr_sleep_events: %ld\n", sched->nr_sleep_events);
+@@ -3386,6 +3430,9 @@ static int perf_sched__replay(struct perf_sched *sched)
+ sched->thread_funcs_exit = true;
+ destroy_tasks(sched);
+
++out_free_cpus_switch_event:
++ free_cpus_switch_event(sched);
++
+ out_mutex_destroy:
+ mutex_destroy(&sched->start_work_mutex);
+ mutex_destroy(&sched->work_done_wait_mutex);
+@@ -3624,21 +3671,7 @@ int cmd_sched(int argc, const char **argv)
+ .switch_event = replay_switch_event,
+ .fork_event = replay_fork_event,
+ };
+- unsigned int i;
+- int ret = 0;
+-
+- sched.cpu_last_switched = calloc(MAX_CPUS, sizeof(*sched.cpu_last_switched));
+- if (!sched.cpu_last_switched) {
+- ret = -ENOMEM;
+- goto out;
+- }
+- sched.curr_pid = malloc(MAX_CPUS * sizeof(*sched.curr_pid));
+- if (!sched.curr_pid) {
+- ret = -ENOMEM;
+- goto out;
+- }
+- for (i = 0; i < MAX_CPUS; i++)
+- sched.curr_pid[i] = -1;
++ int ret;
+
+ argc = parse_options_subcommand(argc, argv, sched_options, sched_subcommands,
+ sched_usage, PARSE_OPT_STOP_AT_NON_OPTION);
+@@ -3649,9 +3682,9 @@ int cmd_sched(int argc, const char **argv)
+ * Aliased to 'perf script' for now:
+ */
+ if (!strcmp(argv[0], "script")) {
+- ret = cmd_script(argc, argv);
++ return cmd_script(argc, argv);
+ } else if (strlen(argv[0]) > 2 && strstarts("record", argv[0])) {
+- ret = __cmd_record(argc, argv);
++ return __cmd_record(argc, argv);
+ } else if (strlen(argv[0]) > 2 && strstarts("latency", argv[0])) {
+ sched.tp_handler = &lat_ops;
+ if (argc > 1) {
+@@ -3660,7 +3693,7 @@ int cmd_sched(int argc, const char **argv)
+ usage_with_options(latency_usage, latency_options);
+ }
+ setup_sorting(&sched, latency_options, latency_usage);
+- ret = perf_sched__lat(&sched);
++ return perf_sched__lat(&sched);
+ } else if (!strcmp(argv[0], "map")) {
+ if (argc) {
+ argc = parse_options(argc, argv, map_options, map_usage, 0);
+@@ -3669,7 +3702,7 @@ int cmd_sched(int argc, const char **argv)
+ }
+ sched.tp_handler = &map_ops;
+ setup_sorting(&sched, latency_options, latency_usage);
+- ret = perf_sched__map(&sched);
++ return perf_sched__map(&sched);
+ } else if (strlen(argv[0]) > 2 && strstarts("replay", argv[0])) {
+ sched.tp_handler = &replay_ops;
+ if (argc) {
+@@ -3677,7 +3710,7 @@ int cmd_sched(int argc, const char **argv)
+ if (argc)
+ usage_with_options(replay_usage, replay_options);
+ }
+- ret = perf_sched__replay(&sched);
++ return perf_sched__replay(&sched);
+ } else if (!strcmp(argv[0], "timehist")) {
+ if (argc) {
+ argc = parse_options(argc, argv, timehist_options,
+@@ -3693,21 +3726,16 @@ int cmd_sched(int argc, const char **argv)
+ parse_options_usage(NULL, timehist_options, "w", true);
+ if (sched.show_next)
+ parse_options_usage(NULL, timehist_options, "n", true);
+- ret = -EINVAL;
+- goto out;
++ return -EINVAL;
+ }
+ ret = symbol__validate_sym_arguments();
+ if (ret)
+- goto out;
++ return ret;
+
+- ret = perf_sched__timehist(&sched);
++ return perf_sched__timehist(&sched);
+ } else {
+ usage_with_options(sched_usage, sched_options);
+ }
+
+-out:
+- free(sched.curr_pid);
+- free(sched.cpu_last_switched);
+-
+- return ret;
++ return 0;
+ }
+--
+2.43.0
+
--- /dev/null
+From 576d87c06cb135e5542845887bd3e12b0a99a1b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Feb 2024 08:32:26 +0000
+Subject: perf sched: Move curr_thread initialization to perf_sched__map()
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit 5e895278697c014e95ae7ae5e79a72ef68c5184e ]
+
+The curr_thread is used only for the 'perf sched map'. Put initialization
+in perf_sched__map() to reduce unnecessary actions in other commands.
+
+Simple functional testing:
+
+ # perf sched record perf bench sched messaging
+ # Running 'sched/messaging' benchmark:
+ # 20 sender and receiver processes per group
+ # 10 groups == 400 processes run
+
+ Total time: 0.197 [sec]
+ [ perf record: Woken up 1 times to write data ]
+ [ perf record: Captured and wrote 15.526 MB perf.data (140095 samples) ]
+
+ # perf sched map
+ *A0 451264.532445 secs A0 => migration/0:15
+ *. 451264.532468 secs . => swapper:0
+ . *B0 451264.532537 secs B0 => migration/1:21
+ . *. 451264.532560 secs
+ . . *C0 451264.532644 secs C0 => migration/2:27
+ . . *. 451264.532668 secs
+ . . . *D0 451264.532753 secs D0 => migration/3:33
+ . . . *. 451264.532778 secs
+ . . . . *E0 451264.532861 secs E0 => migration/4:39
+ . . . . *. 451264.532886 secs
+ . . . . . *F0 451264.532973 secs F0 => migration/5:45
+ <SNIP>
+ A7 A7 A7 A7 A7 *A7 . . . . . . . . . . 451264.790785 secs
+ A7 A7 A7 A7 A7 A7 *A7 . . . . . . . . . 451264.790858 secs
+ A7 A7 A7 A7 A7 A7 A7 *A7 . . . . . . . . 451264.790934 secs
+ A7 A7 A7 A7 A7 A7 A7 A7 *A7 . . . . . . . 451264.791004 secs
+ A7 A7 A7 A7 A7 A7 A7 A7 A7 *A7 . . . . . . 451264.791075 secs
+ A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 *A7 . . . . . 451264.791143 secs
+ A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 *A7 . . . . 451264.791232 secs
+ A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 *A7 . . . 451264.791336 secs
+ A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 *A7 . . 451264.791407 secs
+ A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 *A7 . 451264.791484 secs
+ A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 *A7 451264.791553 secs
+ # echo $?
+ 0
+
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20240206083228.172607-4-yangjihong1@huawei.com
+Stable-dep-of: 1a5efc9e13f3 ("libsubcmd: Don't free the usage string")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-sched.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
+index 8143828fdc585..e498b559ea68a 100644
+--- a/tools/perf/builtin-sched.c
++++ b/tools/perf/builtin-sched.c
+@@ -3310,9 +3310,13 @@ static int perf_sched__map(struct perf_sched *sched)
+ {
+ int rc = -1;
+
+- if (setup_map_cpus(sched))
++ sched->curr_thread = calloc(MAX_CPUS, sizeof(*(sched->curr_thread)));
++ if (!sched->curr_thread)
+ return rc;
+
++ if (setup_map_cpus(sched))
++ goto out_free_curr_thread;
++
+ if (setup_color_pids(sched))
+ goto out_put_map_cpus;
+
+@@ -3335,6 +3339,9 @@ static int perf_sched__map(struct perf_sched *sched)
+ out_put_map_cpus:
+ zfree(&sched->map.comp_cpus);
+ perf_cpu_map__put(sched->map.cpus);
++
++out_free_curr_thread:
++ zfree(&sched->curr_thread);
+ return rc;
+ }
+
+@@ -3620,11 +3627,6 @@ int cmd_sched(int argc, const char **argv)
+ unsigned int i;
+ int ret = 0;
+
+- sched.curr_thread = calloc(MAX_CPUS, sizeof(*sched.curr_thread));
+- if (!sched.curr_thread) {
+- ret = -ENOMEM;
+- goto out;
+- }
+ sched.cpu_last_switched = calloc(MAX_CPUS, sizeof(*sched.cpu_last_switched));
+ if (!sched.cpu_last_switched) {
+ ret = -ENOMEM;
+@@ -3706,7 +3708,6 @@ int cmd_sched(int argc, const char **argv)
+ out:
+ free(sched.curr_pid);
+ free(sched.cpu_last_switched);
+- free(sched.curr_thread);
+
+ return ret;
+ }
+--
+2.43.0
+
--- /dev/null
+From 3442c328f1cdff54b8b9503e184eddea3c338a02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Feb 2024 08:32:24 +0000
+Subject: perf sched: Move start_work_mutex and work_done_wait_mutex
+ initialization to perf_sched__replay()
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit c6907863519cf97ee09653cc8ec338a2328c2b6f ]
+
+The start_work_mutex and work_done_wait_mutex are used only for the
+'perf sched replay'. Put their initialization in perf_sched__replay () to
+reduce unnecessary actions in other commands.
+
+Simple functional testing:
+
+ # perf sched record perf bench sched messaging
+ # Running 'sched/messaging' benchmark:
+ # 20 sender and receiver processes per group
+ # 10 groups == 400 processes run
+
+ Total time: 0.197 [sec]
+ [ perf record: Woken up 1 times to write data ]
+ [ perf record: Captured and wrote 14.952 MB perf.data (134165 samples) ]
+
+ # perf sched replay
+ run measurement overhead: 108 nsecs
+ sleep measurement overhead: 65658 nsecs
+ the run test took 999991 nsecs
+ the sleep test took 1079324 nsecs
+ nr_run_events: 42378
+ nr_sleep_events: 43102
+ nr_wakeup_events: 31852
+ target-less wakeups: 17
+ multi-target wakeups: 712
+ task 0 ( swapper: 0), nr_events: 10451
+ task 1 ( swapper: 1), nr_events: 3
+ task 2 ( swapper: 2), nr_events: 1
+ <SNIP>
+ task 717 ( sched-messaging: 74483), nr_events: 152
+ task 718 ( sched-messaging: 74484), nr_events: 1944
+ task 719 ( sched-messaging: 74485), nr_events: 73
+ task 720 ( sched-messaging: 74486), nr_events: 163
+ task 721 ( sched-messaging: 74487), nr_events: 942
+ task 722 ( sched-messaging: 74488), nr_events: 78
+ task 723 ( sched-messaging: 74489), nr_events: 1090
+ ------------------------------------------------------------
+ #1 : 1366.507, ravg: 1366.51, cpu: 7682.70 / 7682.70
+ #2 : 1410.072, ravg: 1370.86, cpu: 7723.88 / 7686.82
+ #3 : 1396.296, ravg: 1373.41, cpu: 7568.20 / 7674.96
+ #4 : 1381.019, ravg: 1374.17, cpu: 7531.81 / 7660.64
+ #5 : 1393.826, ravg: 1376.13, cpu: 7725.25 / 7667.11
+ #6 : 1401.581, ravg: 1378.68, cpu: 7594.82 / 7659.88
+ #7 : 1381.337, ravg: 1378.94, cpu: 7371.22 / 7631.01
+ #8 : 1373.842, ravg: 1378.43, cpu: 7894.92 / 7657.40
+ #9 : 1364.697, ravg: 1377.06, cpu: 7324.91 / 7624.15
+ #10 : 1363.613, ravg: 1375.72, cpu: 7209.55 / 7582.69
+ # echo $?
+ 0
+
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20240206083228.172607-2-yangjihong1@huawei.com
+Stable-dep-of: 1a5efc9e13f3 ("libsubcmd: Don't free the usage string")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-sched.c | 19 ++++++++++++-------
+ 1 file changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
+index 42185da0f000a..2d36b06d4d877 100644
+--- a/tools/perf/builtin-sched.c
++++ b/tools/perf/builtin-sched.c
+@@ -3329,15 +3329,20 @@ static int perf_sched__map(struct perf_sched *sched)
+
+ static int perf_sched__replay(struct perf_sched *sched)
+ {
++ int ret;
+ unsigned long i;
+
++ mutex_init(&sched->start_work_mutex);
++ mutex_init(&sched->work_done_wait_mutex);
++
+ calibrate_run_measurement_overhead(sched);
+ calibrate_sleep_measurement_overhead(sched);
+
+ test_calibrations(sched);
+
+- if (perf_sched__read_events(sched))
+- return -1;
++ ret = perf_sched__read_events(sched);
++ if (ret)
++ goto out_mutex_destroy;
+
+ printf("nr_run_events: %ld\n", sched->nr_run_events);
+ printf("nr_sleep_events: %ld\n", sched->nr_sleep_events);
+@@ -3362,7 +3367,11 @@ static int perf_sched__replay(struct perf_sched *sched)
+
+ sched->thread_funcs_exit = true;
+ destroy_tasks(sched);
+- return 0;
++
++out_mutex_destroy:
++ mutex_destroy(&sched->start_work_mutex);
++ mutex_destroy(&sched->work_done_wait_mutex);
++ return ret;
+ }
+
+ static void setup_sorting(struct perf_sched *sched, const struct option *options,
+@@ -3600,8 +3609,6 @@ int cmd_sched(int argc, const char **argv)
+ unsigned int i;
+ int ret = 0;
+
+- mutex_init(&sched.start_work_mutex);
+- mutex_init(&sched.work_done_wait_mutex);
+ sched.curr_thread = calloc(MAX_CPUS, sizeof(*sched.curr_thread));
+ if (!sched.curr_thread) {
+ ret = -ENOMEM;
+@@ -3689,8 +3696,6 @@ int cmd_sched(int argc, const char **argv)
+ free(sched.curr_pid);
+ free(sched.cpu_last_switched);
+ free(sched.curr_thread);
+- mutex_destroy(&sched.start_work_mutex);
+- mutex_destroy(&sched.work_done_wait_mutex);
+
+ return ret;
+ }
+--
+2.43.0
+
--- /dev/null
+From 4f12023bcd1e3b591c11526ac552af12c78c4211 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Feb 2024 10:39:33 +0200
+Subject: phy: qualcomm: eusb2-repeater: Rework init to drop redundant zero-out
+ loop
+
+From: Abel Vesa <abel.vesa@linaro.org>
+
+[ Upstream commit 734550d60cdf634299f0eac7f7fe15763ed990bb ]
+
+Instead of incrementing the base of the global reg fields, which renders
+the second instance of the repeater broken due to wrong offsets, use
+regmap with base and offset. As for zeroing out the rest of the tuning
+regs, avoid looping though the table and just use the table as is,
+as it is already zero initialized.
+
+Fixes: 99a517a582fc ("phy: qualcomm: phy-qcom-eusb2-repeater: Zero out untouched tuning regs")
+Tested-by: Elliot Berman <quic_eberman@quicinc.com> # sm8650-qrd
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20240201-phy-qcom-eusb2-repeater-fixes-v4-1-cf18c8cef6d7@linaro.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../phy/qualcomm/phy-qcom-eusb2-repeater.c | 166 +++++++-----------
+ 1 file changed, 62 insertions(+), 104 deletions(-)
+
+diff --git a/drivers/phy/qualcomm/phy-qcom-eusb2-repeater.c b/drivers/phy/qualcomm/phy-qcom-eusb2-repeater.c
+index a623f092b11f6..a43e20abb10d5 100644
+--- a/drivers/phy/qualcomm/phy-qcom-eusb2-repeater.c
++++ b/drivers/phy/qualcomm/phy-qcom-eusb2-repeater.c
+@@ -37,56 +37,28 @@
+ #define EUSB2_TUNE_EUSB_EQU 0x5A
+ #define EUSB2_TUNE_EUSB_HS_COMP_CUR 0x5B
+
+-#define QCOM_EUSB2_REPEATER_INIT_CFG(r, v) \
+- { \
+- .reg = r, \
+- .val = v, \
+- }
+-
+-enum reg_fields {
+- F_TUNE_EUSB_HS_COMP_CUR,
+- F_TUNE_EUSB_EQU,
+- F_TUNE_EUSB_SLEW,
+- F_TUNE_USB2_HS_COMP_CUR,
+- F_TUNE_USB2_PREEM,
+- F_TUNE_USB2_EQU,
+- F_TUNE_USB2_SLEW,
+- F_TUNE_SQUELCH_U,
+- F_TUNE_HSDISC,
+- F_TUNE_RES_FSDIF,
+- F_TUNE_IUSB2,
+- F_TUNE_USB2_CROSSOVER,
+- F_NUM_TUNE_FIELDS,
+-
+- F_FORCE_VAL_5 = F_NUM_TUNE_FIELDS,
+- F_FORCE_EN_5,
+-
+- F_EN_CTL1,
+-
+- F_RPTR_STATUS,
+- F_NUM_FIELDS,
+-};
+-
+-static struct reg_field eusb2_repeater_tune_reg_fields[F_NUM_FIELDS] = {
+- [F_TUNE_EUSB_HS_COMP_CUR] = REG_FIELD(EUSB2_TUNE_EUSB_HS_COMP_CUR, 0, 1),
+- [F_TUNE_EUSB_EQU] = REG_FIELD(EUSB2_TUNE_EUSB_EQU, 0, 1),
+- [F_TUNE_EUSB_SLEW] = REG_FIELD(EUSB2_TUNE_EUSB_SLEW, 0, 1),
+- [F_TUNE_USB2_HS_COMP_CUR] = REG_FIELD(EUSB2_TUNE_USB2_HS_COMP_CUR, 0, 1),
+- [F_TUNE_USB2_PREEM] = REG_FIELD(EUSB2_TUNE_USB2_PREEM, 0, 2),
+- [F_TUNE_USB2_EQU] = REG_FIELD(EUSB2_TUNE_USB2_EQU, 0, 1),
+- [F_TUNE_USB2_SLEW] = REG_FIELD(EUSB2_TUNE_USB2_SLEW, 0, 1),
+- [F_TUNE_SQUELCH_U] = REG_FIELD(EUSB2_TUNE_SQUELCH_U, 0, 2),
+- [F_TUNE_HSDISC] = REG_FIELD(EUSB2_TUNE_HSDISC, 0, 2),
+- [F_TUNE_RES_FSDIF] = REG_FIELD(EUSB2_TUNE_RES_FSDIF, 0, 2),
+- [F_TUNE_IUSB2] = REG_FIELD(EUSB2_TUNE_IUSB2, 0, 3),
+- [F_TUNE_USB2_CROSSOVER] = REG_FIELD(EUSB2_TUNE_USB2_CROSSOVER, 0, 2),
+-
+- [F_FORCE_VAL_5] = REG_FIELD(EUSB2_FORCE_VAL_5, 0, 7),
+- [F_FORCE_EN_5] = REG_FIELD(EUSB2_FORCE_EN_5, 0, 7),
+-
+- [F_EN_CTL1] = REG_FIELD(EUSB2_EN_CTL1, 0, 7),
+-
+- [F_RPTR_STATUS] = REG_FIELD(EUSB2_RPTR_STATUS, 0, 7),
++enum eusb2_reg_layout {
++ TUNE_EUSB_HS_COMP_CUR,
++ TUNE_EUSB_EQU,
++ TUNE_EUSB_SLEW,
++ TUNE_USB2_HS_COMP_CUR,
++ TUNE_USB2_PREEM,
++ TUNE_USB2_EQU,
++ TUNE_USB2_SLEW,
++ TUNE_SQUELCH_U,
++ TUNE_HSDISC,
++ TUNE_RES_FSDIF,
++ TUNE_IUSB2,
++ TUNE_USB2_CROSSOVER,
++ NUM_TUNE_FIELDS,
++
++ FORCE_VAL_5 = NUM_TUNE_FIELDS,
++ FORCE_EN_5,
++
++ EN_CTL1,
++
++ RPTR_STATUS,
++ LAYOUT_SIZE,
+ };
+
+ struct eusb2_repeater_cfg {
+@@ -98,10 +70,11 @@ struct eusb2_repeater_cfg {
+
+ struct eusb2_repeater {
+ struct device *dev;
+- struct regmap_field *regs[F_NUM_FIELDS];
++ struct regmap *regmap;
+ struct phy *phy;
+ struct regulator_bulk_data *vregs;
+ const struct eusb2_repeater_cfg *cfg;
++ u32 base;
+ enum phy_mode mode;
+ };
+
+@@ -109,10 +82,10 @@ static const char * const pm8550b_vreg_l[] = {
+ "vdd18", "vdd3",
+ };
+
+-static const u32 pm8550b_init_tbl[F_NUM_TUNE_FIELDS] = {
+- [F_TUNE_IUSB2] = 0x8,
+- [F_TUNE_SQUELCH_U] = 0x3,
+- [F_TUNE_USB2_PREEM] = 0x5,
++static const u32 pm8550b_init_tbl[NUM_TUNE_FIELDS] = {
++ [TUNE_IUSB2] = 0x8,
++ [TUNE_SQUELCH_U] = 0x3,
++ [TUNE_USB2_PREEM] = 0x5,
+ };
+
+ static const struct eusb2_repeater_cfg pm8550b_eusb2_cfg = {
+@@ -140,47 +113,42 @@ static int eusb2_repeater_init_vregs(struct eusb2_repeater *rptr)
+
+ static int eusb2_repeater_init(struct phy *phy)
+ {
+- struct reg_field *regfields = eusb2_repeater_tune_reg_fields;
+ struct eusb2_repeater *rptr = phy_get_drvdata(phy);
+ struct device_node *np = rptr->dev->of_node;
+- u32 init_tbl[F_NUM_TUNE_FIELDS] = { 0 };
+- u8 override;
++ struct regmap *regmap = rptr->regmap;
++ const u32 *init_tbl = rptr->cfg->init_tbl;
++ u8 tune_usb2_preem = init_tbl[TUNE_USB2_PREEM];
++ u8 tune_hsdisc = init_tbl[TUNE_HSDISC];
++ u8 tune_iusb2 = init_tbl[TUNE_IUSB2];
++ u32 base = rptr->base;
+ u32 val;
+ int ret;
+- int i;
++
++ of_property_read_u8(np, "qcom,tune-usb2-amplitude", &tune_iusb2);
++ of_property_read_u8(np, "qcom,tune-usb2-disc-thres", &tune_hsdisc);
++ of_property_read_u8(np, "qcom,tune-usb2-preem", &tune_usb2_preem);
+
+ ret = regulator_bulk_enable(rptr->cfg->num_vregs, rptr->vregs);
+ if (ret)
+ return ret;
+
+- regmap_field_update_bits(rptr->regs[F_EN_CTL1], EUSB2_RPTR_EN, EUSB2_RPTR_EN);
++ regmap_write(regmap, base + EUSB2_EN_CTL1, EUSB2_RPTR_EN);
+
+- for (i = 0; i < F_NUM_TUNE_FIELDS; i++) {
+- if (init_tbl[i]) {
+- regmap_field_update_bits(rptr->regs[i], init_tbl[i], init_tbl[i]);
+- } else {
+- /* Write 0 if there's no value set */
+- u32 mask = GENMASK(regfields[i].msb, regfields[i].lsb);
+-
+- regmap_field_update_bits(rptr->regs[i], mask, 0);
+- }
+- }
+- memcpy(init_tbl, rptr->cfg->init_tbl, sizeof(init_tbl));
++ regmap_write(regmap, base + EUSB2_TUNE_EUSB_HS_COMP_CUR, init_tbl[TUNE_EUSB_HS_COMP_CUR]);
++ regmap_write(regmap, base + EUSB2_TUNE_EUSB_EQU, init_tbl[TUNE_EUSB_EQU]);
++ regmap_write(regmap, base + EUSB2_TUNE_EUSB_SLEW, init_tbl[TUNE_EUSB_SLEW]);
++ regmap_write(regmap, base + EUSB2_TUNE_USB2_HS_COMP_CUR, init_tbl[TUNE_USB2_HS_COMP_CUR]);
++ regmap_write(regmap, base + EUSB2_TUNE_USB2_EQU, init_tbl[TUNE_USB2_EQU]);
++ regmap_write(regmap, base + EUSB2_TUNE_USB2_SLEW, init_tbl[TUNE_USB2_SLEW]);
++ regmap_write(regmap, base + EUSB2_TUNE_SQUELCH_U, init_tbl[TUNE_SQUELCH_U]);
++ regmap_write(regmap, base + EUSB2_TUNE_RES_FSDIF, init_tbl[TUNE_RES_FSDIF]);
++ regmap_write(regmap, base + EUSB2_TUNE_USB2_CROSSOVER, init_tbl[TUNE_USB2_CROSSOVER]);
+
+- if (!of_property_read_u8(np, "qcom,tune-usb2-amplitude", &override))
+- init_tbl[F_TUNE_IUSB2] = override;
++ regmap_write(regmap, base + EUSB2_TUNE_USB2_PREEM, tune_usb2_preem);
++ regmap_write(regmap, base + EUSB2_TUNE_HSDISC, tune_hsdisc);
++ regmap_write(regmap, base + EUSB2_TUNE_IUSB2, tune_iusb2);
+
+- if (!of_property_read_u8(np, "qcom,tune-usb2-disc-thres", &override))
+- init_tbl[F_TUNE_HSDISC] = override;
+-
+- if (!of_property_read_u8(np, "qcom,tune-usb2-preem", &override))
+- init_tbl[F_TUNE_USB2_PREEM] = override;
+-
+- for (i = 0; i < F_NUM_TUNE_FIELDS; i++)
+- regmap_field_update_bits(rptr->regs[i], init_tbl[i], init_tbl[i]);
+-
+- ret = regmap_field_read_poll_timeout(rptr->regs[F_RPTR_STATUS],
+- val, val & RPTR_OK, 10, 5);
++ ret = regmap_read_poll_timeout(regmap, base + EUSB2_RPTR_STATUS, val, val & RPTR_OK, 10, 5);
+ if (ret)
+ dev_err(rptr->dev, "initialization timed-out\n");
+
+@@ -191,6 +159,8 @@ static int eusb2_repeater_set_mode(struct phy *phy,
+ enum phy_mode mode, int submode)
+ {
+ struct eusb2_repeater *rptr = phy_get_drvdata(phy);
++ struct regmap *regmap = rptr->regmap;
++ u32 base = rptr->base;
+
+ switch (mode) {
+ case PHY_MODE_USB_HOST:
+@@ -199,10 +169,8 @@ static int eusb2_repeater_set_mode(struct phy *phy,
+ * per eUSB 1.2 Spec. Below implement software workaround until
+ * PHY and controller is fixing seen observation.
+ */
+- regmap_field_update_bits(rptr->regs[F_FORCE_EN_5],
+- F_CLK_19P2M_EN, F_CLK_19P2M_EN);
+- regmap_field_update_bits(rptr->regs[F_FORCE_VAL_5],
+- V_CLK_19P2M_EN, V_CLK_19P2M_EN);
++ regmap_write(regmap, base + EUSB2_FORCE_EN_5, F_CLK_19P2M_EN);
++ regmap_write(regmap, base + EUSB2_FORCE_VAL_5, V_CLK_19P2M_EN);
+ break;
+ case PHY_MODE_USB_DEVICE:
+ /*
+@@ -211,10 +179,8 @@ static int eusb2_repeater_set_mode(struct phy *phy,
+ * repeater doesn't clear previous value due to shared
+ * regulators (say host <-> device mode switch).
+ */
+- regmap_field_update_bits(rptr->regs[F_FORCE_EN_5],
+- F_CLK_19P2M_EN, 0);
+- regmap_field_update_bits(rptr->regs[F_FORCE_VAL_5],
+- V_CLK_19P2M_EN, 0);
++ regmap_write(regmap, base + EUSB2_FORCE_EN_5, 0);
++ regmap_write(regmap, base + EUSB2_FORCE_VAL_5, 0);
+ break;
+ default:
+ return -EINVAL;
+@@ -243,9 +209,8 @@ static int eusb2_repeater_probe(struct platform_device *pdev)
+ struct device *dev = &pdev->dev;
+ struct phy_provider *phy_provider;
+ struct device_node *np = dev->of_node;
+- struct regmap *regmap;
+- int i, ret;
+ u32 res;
++ int ret;
+
+ rptr = devm_kzalloc(dev, sizeof(*rptr), GFP_KERNEL);
+ if (!rptr)
+@@ -258,22 +223,15 @@ static int eusb2_repeater_probe(struct platform_device *pdev)
+ if (!rptr->cfg)
+ return -EINVAL;
+
+- regmap = dev_get_regmap(dev->parent, NULL);
+- if (!regmap)
++ rptr->regmap = dev_get_regmap(dev->parent, NULL);
++ if (!rptr->regmap)
+ return -ENODEV;
+
+ ret = of_property_read_u32(np, "reg", &res);
+ if (ret < 0)
+ return ret;
+
+- for (i = 0; i < F_NUM_FIELDS; i++)
+- eusb2_repeater_tune_reg_fields[i].reg += res;
+-
+- ret = devm_regmap_field_bulk_alloc(dev, regmap, rptr->regs,
+- eusb2_repeater_tune_reg_fields,
+- F_NUM_FIELDS);
+- if (ret)
+- return ret;
++ rptr->base = res;
+
+ ret = eusb2_repeater_init_vregs(rptr);
+ if (ret < 0) {
+--
+2.43.0
+
--- /dev/null
+From 2dcb16e59080f23b74f7a64777949d878cf40c6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Sep 2023 11:53:26 +0200
+Subject: phy: qualcomm: phy-qcom-eusb2-repeater: Add tuning overrides
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 56156a76e765d32009fee058697c591194d0829f ]
+
+There are devices in the wild, like the Sony Xperia 1 V that *require*
+different tuning than the base design for USB to work.
+
+Add support for overriding the necessary tuning values.
+
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230830-topic-eusb2_override-v2-4-7d8c893d93f6@linaro.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Stable-dep-of: 734550d60cdf ("phy: qualcomm: eusb2-repeater: Rework init to drop redundant zero-out loop")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/qualcomm/phy-qcom-eusb2-repeater.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/phy/qualcomm/phy-qcom-eusb2-repeater.c b/drivers/phy/qualcomm/phy-qcom-eusb2-repeater.c
+index d4fb85c20eb0f..a623f092b11f6 100644
+--- a/drivers/phy/qualcomm/phy-qcom-eusb2-repeater.c
++++ b/drivers/phy/qualcomm/phy-qcom-eusb2-repeater.c
+@@ -142,7 +142,9 @@ static int eusb2_repeater_init(struct phy *phy)
+ {
+ struct reg_field *regfields = eusb2_repeater_tune_reg_fields;
+ struct eusb2_repeater *rptr = phy_get_drvdata(phy);
+- const u32 *init_tbl = rptr->cfg->init_tbl;
++ struct device_node *np = rptr->dev->of_node;
++ u32 init_tbl[F_NUM_TUNE_FIELDS] = { 0 };
++ u8 override;
+ u32 val;
+ int ret;
+ int i;
+@@ -163,6 +165,19 @@ static int eusb2_repeater_init(struct phy *phy)
+ regmap_field_update_bits(rptr->regs[i], mask, 0);
+ }
+ }
++ memcpy(init_tbl, rptr->cfg->init_tbl, sizeof(init_tbl));
++
++ if (!of_property_read_u8(np, "qcom,tune-usb2-amplitude", &override))
++ init_tbl[F_TUNE_IUSB2] = override;
++
++ if (!of_property_read_u8(np, "qcom,tune-usb2-disc-thres", &override))
++ init_tbl[F_TUNE_HSDISC] = override;
++
++ if (!of_property_read_u8(np, "qcom,tune-usb2-preem", &override))
++ init_tbl[F_TUNE_USB2_PREEM] = override;
++
++ for (i = 0; i < F_NUM_TUNE_FIELDS; i++)
++ regmap_field_update_bits(rptr->regs[i], init_tbl[i], init_tbl[i]);
+
+ ret = regmap_field_read_poll_timeout(rptr->regs[F_RPTR_STATUS],
+ val, val & RPTR_OK, 10, 5);
+--
+2.43.0
+
--- /dev/null
+From e81fe6d081b132172567a5e6dce3d4df609cd87d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jan 2024 22:28:56 +0800
+Subject: Revert "mm/filemap: avoid buffered read/write race to read
+ inconsistent data"
+
+From: Baokun Li <libaokun1@huawei.com>
+
+[ Upstream commit 4b944f8ef99641d5af287c7d9df91d20ef5d3e88 ]
+
+This reverts commit e2c27b803bb6 ("mm/filemap: avoid buffered read/write
+race to read inconsistent data"). After making the i_size_read/write
+helpers be smp_load_acquire/store_release(), it is already guaranteed that
+changes to page contents are visible before we see increased inode size,
+so the extra smp_rmb() in filemap_read() can be removed.
+
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Link: https://lore.kernel.org/r/20240124142857.4146716-3-libaokun1@huawei.com
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/filemap.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/mm/filemap.c b/mm/filemap.c
+index e6c112f3a211f..cd028f3be6026 100644
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -2694,15 +2694,6 @@ ssize_t filemap_read(struct kiocb *iocb, struct iov_iter *iter,
+ goto put_folios;
+ end_offset = min_t(loff_t, isize, iocb->ki_pos + iter->count);
+
+- /*
+- * Pairs with a barrier in
+- * block_write_end()->mark_buffer_dirty() or other page
+- * dirtying routines like iomap_write_end() to ensure
+- * changes to page contents are visible before we see
+- * increased inode size.
+- */
+- smp_rmb();
+-
+ /*
+ * Once we start copying data, we don't want to be touching any
+ * cachelines that might be contended:
+--
+2.43.0
+
--- /dev/null
+From 60fbd89cffadc73a4e53d8da38a5f73d9ebf0fc7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Apr 2024 17:13:01 -0500
+Subject: Revert "PCI/MSI: Provide stubs for IMS functions"
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+[ Upstream commit 372c669271bff736c5bc275c982d8d1b4f1f147c ]
+
+This reverts commit 41efa431244f6498833ff8ee8dde28c4924c5479.
+
+IMS (Interrupt Message Store) support appeared in v6.2, but there are no
+users yet.
+
+Remove it for now. We can add it back when a user comes along. If this is
+re-added later, this could be squashed with these commits:
+
+ 0194425af0c8 ("PCI/MSI: Provide IMS (Interrupt Message Store) support")
+ c9e5bea27383 ("PCI/MSI: Provide pci_ims_alloc/free_irq()")
+
+which added the non-stub implementations.
+
+Link: https://lore.kernel.org/r/20240410221307.2162676-2-helgaas@kernel.org
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/pci.h | 34 ++++++++--------------------------
+ 1 file changed, 8 insertions(+), 26 deletions(-)
+
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 7b18a4b3efb0e..2b7e45bae9408 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -1630,8 +1630,6 @@ struct msix_entry {
+ u16 entry; /* Driver uses to specify entry, OS writes */
+ };
+
+-struct msi_domain_template;
+-
+ #ifdef CONFIG_PCI_MSI
+ int pci_msi_vec_count(struct pci_dev *dev);
+ void pci_disable_msi(struct pci_dev *dev);
+@@ -1664,11 +1662,6 @@ void pci_msix_free_irq(struct pci_dev *pdev, struct msi_map map);
+ void pci_free_irq_vectors(struct pci_dev *dev);
+ int pci_irq_vector(struct pci_dev *dev, unsigned int nr);
+ const struct cpumask *pci_irq_get_affinity(struct pci_dev *pdev, int vec);
+-bool pci_create_ims_domain(struct pci_dev *pdev, const struct msi_domain_template *template,
+- unsigned int hwsize, void *data);
+-struct msi_map pci_ims_alloc_irq(struct pci_dev *pdev, union msi_instance_cookie *icookie,
+- const struct irq_affinity_desc *affdesc);
+-void pci_ims_free_irq(struct pci_dev *pdev, struct msi_map map);
+
+ #else
+ static inline int pci_msi_vec_count(struct pci_dev *dev) { return -ENOSYS; }
+@@ -1732,25 +1725,6 @@ static inline const struct cpumask *pci_irq_get_affinity(struct pci_dev *pdev,
+ {
+ return cpu_possible_mask;
+ }
+-
+-static inline bool pci_create_ims_domain(struct pci_dev *pdev,
+- const struct msi_domain_template *template,
+- unsigned int hwsize, void *data)
+-{ return false; }
+-
+-static inline struct msi_map pci_ims_alloc_irq(struct pci_dev *pdev,
+- union msi_instance_cookie *icookie,
+- const struct irq_affinity_desc *affdesc)
+-{
+- struct msi_map map = { .index = -ENOSYS, };
+-
+- return map;
+-}
+-
+-static inline void pci_ims_free_irq(struct pci_dev *pdev, struct msi_map map)
+-{
+-}
+-
+ #endif
+
+ /**
+@@ -2667,6 +2641,14 @@ static inline bool pci_is_thunderbolt_attached(struct pci_dev *pdev)
+ void pci_uevent_ers(struct pci_dev *pdev, enum pci_ers_result err_type);
+ #endif
+
++struct msi_domain_template;
++
++bool pci_create_ims_domain(struct pci_dev *pdev, const struct msi_domain_template *template,
++ unsigned int hwsize, void *data);
++struct msi_map pci_ims_alloc_irq(struct pci_dev *pdev, union msi_instance_cookie *icookie,
++ const struct irq_affinity_desc *affdesc);
++void pci_ims_free_irq(struct pci_dev *pdev, struct msi_map map);
++
+ #include <linux/dma-mapping.h>
+
+ #define pci_printk(level, pdev, fmt, arg...) \
+--
+2.43.0
+
--- /dev/null
+From ead46a61193d47993e39b71c2f210487199a8900 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jan 2024 10:27:53 +0000
+Subject: Revert "powerpc/ps3_defconfig: Disable PPC64_BIG_ENDIAN_ELF_ABI_V2"
+
+From: Geoff Levand <geoff@infradead.org>
+
+[ Upstream commit 914d081ead115f7ba685ab57f977716bdd09c894 ]
+
+This reverts commit 482b718a84f08b6fc84879c3e90cc57dba11c115.
+
+The preceding commits by Nicholas Piggin enable PS3 support for ELFv2,
+so there's no need to disable it for PS3 anymore.
+
+Signed-off-by: Geoff Levand <geoff@infradead.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/983836405df1b6001a2262972fb32d1aee97d6f5.1705654669.git.geoff@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/configs/ps3_defconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/powerpc/configs/ps3_defconfig b/arch/powerpc/configs/ps3_defconfig
+index aa8bb0208bcc8..2b175ddf82f0b 100644
+--- a/arch/powerpc/configs/ps3_defconfig
++++ b/arch/powerpc/configs/ps3_defconfig
+@@ -24,7 +24,6 @@ CONFIG_PS3_VRAM=m
+ CONFIG_PS3_LPM=m
+ # CONFIG_PPC_OF_BOOT_TRAMPOLINE is not set
+ CONFIG_KEXEC=y
+-# CONFIG_PPC64_BIG_ENDIAN_ELF_ABI_V2 is not set
+ CONFIG_PPC_4K_PAGES=y
+ CONFIG_SCHED_SMT=y
+ CONFIG_PM=y
+--
+2.43.0
+
--- /dev/null
+From d19b6266c75dd1b4dbedfde92f44edbdc29c4a73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 May 2024 21:50:50 -0700
+Subject: riscv: cpufeature: Fix thead vector hwcap removal
+
+From: Charlie Jenkins <charlie@rivosinc.com>
+
+[ Upstream commit e482eab4d1eb31031eff2b6afb71776483101979 ]
+
+The riscv_cpuinfo struct that contains mvendorid and marchid is not
+populated until all harts are booted which happens after the DT parsing.
+Use the mvendorid/marchid from the boot hart to determine if the DT
+contains an invalid V.
+
+Fixes: d82f32202e0d ("RISC-V: Ignore V from the riscv,isa DT property on older T-Head CPUs")
+Signed-off-by: Charlie Jenkins <charlie@rivosinc.com>
+Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
+Reviewed-by: Guo Ren <guoren@kernel.org>
+Link: https://lore.kernel.org/r/20240502-cpufeature_fixes-v4-1-b3d1a088722d@rivosinc.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/include/asm/sbi.h | 2 ++
+ arch/riscv/kernel/cpu.c | 40 ++++++++++++++++++++++++++++++----
+ arch/riscv/kernel/cpufeature.c | 8 +++++--
+ 3 files changed, 44 insertions(+), 6 deletions(-)
+
+diff --git a/arch/riscv/include/asm/sbi.h b/arch/riscv/include/asm/sbi.h
+index b79d0228144f4..3ed853b8a8c85 100644
+--- a/arch/riscv/include/asm/sbi.h
++++ b/arch/riscv/include/asm/sbi.h
+@@ -327,6 +327,8 @@ static inline int sbi_remote_fence_i(const struct cpumask *cpu_mask) { return -1
+ static inline void sbi_init(void) {}
+ #endif /* CONFIG_RISCV_SBI */
+
++unsigned long riscv_get_mvendorid(void);
++unsigned long riscv_get_marchid(void);
+ unsigned long riscv_cached_mvendorid(unsigned int cpu_id);
+ unsigned long riscv_cached_marchid(unsigned int cpu_id);
+ unsigned long riscv_cached_mimpid(unsigned int cpu_id);
+diff --git a/arch/riscv/kernel/cpu.c b/arch/riscv/kernel/cpu.c
+index 157ace8b262c2..88732abecd023 100644
+--- a/arch/riscv/kernel/cpu.c
++++ b/arch/riscv/kernel/cpu.c
+@@ -139,6 +139,34 @@ int riscv_of_parent_hartid(struct device_node *node, unsigned long *hartid)
+ return -1;
+ }
+
++unsigned long __init riscv_get_marchid(void)
++{
++ struct riscv_cpuinfo *ci = this_cpu_ptr(&riscv_cpuinfo);
++
++#if IS_ENABLED(CONFIG_RISCV_SBI)
++ ci->marchid = sbi_spec_is_0_1() ? 0 : sbi_get_marchid();
++#elif IS_ENABLED(CONFIG_RISCV_M_MODE)
++ ci->marchid = csr_read(CSR_MARCHID);
++#else
++ ci->marchid = 0;
++#endif
++ return ci->marchid;
++}
++
++unsigned long __init riscv_get_mvendorid(void)
++{
++ struct riscv_cpuinfo *ci = this_cpu_ptr(&riscv_cpuinfo);
++
++#if IS_ENABLED(CONFIG_RISCV_SBI)
++ ci->mvendorid = sbi_spec_is_0_1() ? 0 : sbi_get_mvendorid();
++#elif IS_ENABLED(CONFIG_RISCV_M_MODE)
++ ci->mvendorid = csr_read(CSR_MVENDORID);
++#else
++ ci->mvendorid = 0;
++#endif
++ return ci->mvendorid;
++}
++
+ DEFINE_PER_CPU(struct riscv_cpuinfo, riscv_cpuinfo);
+
+ unsigned long riscv_cached_mvendorid(unsigned int cpu_id)
+@@ -170,12 +198,16 @@ static int riscv_cpuinfo_starting(unsigned int cpu)
+ struct riscv_cpuinfo *ci = this_cpu_ptr(&riscv_cpuinfo);
+
+ #if IS_ENABLED(CONFIG_RISCV_SBI)
+- ci->mvendorid = sbi_spec_is_0_1() ? 0 : sbi_get_mvendorid();
+- ci->marchid = sbi_spec_is_0_1() ? 0 : sbi_get_marchid();
++ if (!ci->mvendorid)
++ ci->mvendorid = sbi_spec_is_0_1() ? 0 : sbi_get_mvendorid();
++ if (!ci->marchid)
++ ci->marchid = sbi_spec_is_0_1() ? 0 : sbi_get_marchid();
+ ci->mimpid = sbi_spec_is_0_1() ? 0 : sbi_get_mimpid();
+ #elif IS_ENABLED(CONFIG_RISCV_M_MODE)
+- ci->mvendorid = csr_read(CSR_MVENDORID);
+- ci->marchid = csr_read(CSR_MARCHID);
++ if (!ci->mvendorid)
++ ci->mvendorid = csr_read(CSR_MVENDORID);
++ if (!ci->marchid)
++ ci->marchid = csr_read(CSR_MARCHID);
+ ci->mimpid = csr_read(CSR_MIMPID);
+ #else
+ ci->mvendorid = 0;
+diff --git a/arch/riscv/kernel/cpufeature.c b/arch/riscv/kernel/cpufeature.c
+index e39a905aca248..bb5fb2b820a21 100644
+--- a/arch/riscv/kernel/cpufeature.c
++++ b/arch/riscv/kernel/cpufeature.c
+@@ -351,6 +351,8 @@ static void __init riscv_fill_hwcap_from_isa_string(unsigned long *isa2hwcap)
+ struct acpi_table_header *rhct;
+ acpi_status status;
+ unsigned int cpu;
++ u64 boot_vendorid;
++ u64 boot_archid;
+
+ if (!acpi_disabled) {
+ status = acpi_get_table(ACPI_SIG_RHCT, 0, &rhct);
+@@ -358,6 +360,9 @@ static void __init riscv_fill_hwcap_from_isa_string(unsigned long *isa2hwcap)
+ return;
+ }
+
++ boot_vendorid = riscv_get_mvendorid();
++ boot_archid = riscv_get_marchid();
++
+ for_each_possible_cpu(cpu) {
+ struct riscv_isainfo *isainfo = &hart_isa[cpu];
+ unsigned long this_hwcap = 0;
+@@ -405,8 +410,7 @@ static void __init riscv_fill_hwcap_from_isa_string(unsigned long *isa2hwcap)
+ * CPU cores with the ratified spec will contain non-zero
+ * marchid.
+ */
+- if (acpi_disabled && riscv_cached_mvendorid(cpu) == THEAD_VENDOR_ID &&
+- riscv_cached_marchid(cpu) == 0x0) {
++ if (acpi_disabled && boot_vendorid == THEAD_VENDOR_ID && boot_archid == 0x0) {
+ this_hwcap &= ~isa2hwcap[RISCV_ISA_EXT_v];
+ clear_bit(RISCV_ISA_EXT_v, isainfo->isa);
+ }
+--
+2.43.0
+
--- /dev/null
+From 18a8f0c8ad0ded6e8c6565b76397240602c08ce8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Dec 2023 19:03:31 +0800
+Subject: riscv: Remove SHADOW_OVERFLOW_STACK_SIZE macro
+
+From: Song Shuai <songshuaishuai@tinylab.org>
+
+[ Upstream commit a7565f4d068b2e60f95c3223c3167c40b8fe83ae ]
+
+The commit be97d0db5f44 ("riscv: VMAP_STACK overflow
+detection thread-safe") got rid of `shadow_stack`,
+so SHADOW_OVERFLOW_STACK_SIZE should be removed too.
+
+Fixes: be97d0db5f44 ("riscv: VMAP_STACK overflow detection thread-safe")
+Signed-off-by: Song Shuai <songshuaishuai@tinylab.org>
+Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
+Link: https://lore.kernel.org/r/20231211110331.359534-1-songshuaishuai@tinylab.org
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/include/asm/thread_info.h | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/riscv/include/asm/thread_info.h b/arch/riscv/include/asm/thread_info.h
+index 4fb84c2e94c65..8c72d1bcdf141 100644
+--- a/arch/riscv/include/asm/thread_info.h
++++ b/arch/riscv/include/asm/thread_info.h
+@@ -33,7 +33,6 @@
+
+ #define THREAD_SHIFT (PAGE_SHIFT + THREAD_SIZE_ORDER)
+ #define OVERFLOW_STACK_SIZE SZ_4K
+-#define SHADOW_OVERFLOW_STACK_SIZE (1024)
+
+ #define IRQ_STACK_SIZE THREAD_SIZE
+
+--
+2.43.0
+
--- /dev/null
+From 36816869c4285caf5b7af2b511dff5623193c09a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Aug 2023 12:48:33 +0900
+Subject: scsi: Remove scsi device no_start_on_resume flag
+
+From: Damien Le Moal <dlemoal@kernel.org>
+
+[ Upstream commit c4367ac83805a2322268c9736cd8ef9124063424 ]
+
+The scsi device flag no_start_on_resume is not set by any scsi low
+level driver. Remove it. This reverts the changes introduced by commit
+0a8589055936 ("ata,scsi: do not issue START STOP UNIT on resume").
+
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Tested-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Stable-dep-of: 7a6bbc2829d4 ("scsi: sd: Do not repeat the starting disk message")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/sd.c | 9 +++------
+ include/scsi/scsi_device.h | 1 -
+ 2 files changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index b0a574c534c4c..2c627deedc1fa 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -3968,7 +3968,7 @@ static int sd_resume(struct device *dev)
+ static int sd_resume_common(struct device *dev, bool runtime)
+ {
+ struct scsi_disk *sdkp = dev_get_drvdata(dev);
+- int ret = 0;
++ int ret;
+
+ if (!sdkp) /* E.g.: runtime resume at the start of sd_probe() */
+ return 0;
+@@ -3978,11 +3978,8 @@ static int sd_resume_common(struct device *dev, bool runtime)
+ return 0;
+ }
+
+- if (!sdkp->device->no_start_on_resume) {
+- sd_printk(KERN_NOTICE, sdkp, "Starting disk\n");
+- ret = sd_start_stop_device(sdkp, 1);
+- }
+-
++ sd_printk(KERN_NOTICE, sdkp, "Starting disk\n");
++ ret = sd_start_stop_device(sdkp, 1);
+ if (!ret) {
+ sd_resume(dev);
+ sdkp->suspended = false;
+diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
+index 9c8b6f611330c..c38f4fe5e64cf 100644
+--- a/include/scsi/scsi_device.h
++++ b/include/scsi/scsi_device.h
+@@ -216,7 +216,6 @@ struct scsi_device {
+ unsigned use_192_bytes_for_3f:1; /* ask for 192 bytes from page 0x3f */
+ unsigned no_start_on_add:1; /* do not issue start on add */
+ unsigned allow_restart:1; /* issue START_UNIT in error handler */
+- unsigned no_start_on_resume:1; /* Do not issue START_STOP_UNIT on resume */
+ unsigned start_stop_pwr_cond:1; /* Set power cond. in START_STOP_UNIT */
+ unsigned no_uld_attach:1; /* disable connecting to upper level drivers */
+ unsigned select_no_atn:1;
+--
+2.43.0
+
--- /dev/null
+From aab45a211208e0b316f0ffea8d97f0cd2810cf04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jul 2024 06:53:26 +0900
+Subject: scsi: sd: Do not repeat the starting disk message
+
+From: Damien Le Moal <dlemoal@kernel.org>
+
+[ Upstream commit 7a6bbc2829d4ab592c7e440a6f6f5deb3cd95db4 ]
+
+The SCSI disk message "Starting disk" to signal resuming of a suspended
+disk is printed in both sd_resume() and sd_resume_common() which results
+in this message being printed twice when resuming from e.g. autosuspend:
+
+$ echo 5000 > /sys/block/sda/device/power/autosuspend_delay_ms
+$ echo auto > /sys/block/sda/device/power/control
+
+[ 4962.438293] sd 0:0:0:0: [sda] Synchronizing SCSI cache
+[ 4962.501121] sd 0:0:0:0: [sda] Stopping disk
+
+$ echo on > /sys/block/sda/device/power/control
+
+[ 4972.805851] sd 0:0:0:0: [sda] Starting disk
+[ 4980.558806] sd 0:0:0:0: [sda] Starting disk
+
+Fix this double print by removing the call to sd_printk() from sd_resume()
+and moving the call to sd_printk() in sd_resume_common() earlier in the
+function, before the check using sd_do_start_stop(). Doing so, the message
+is printed once regardless if sd_resume_common() actually executes
+sd_start_stop_device() (i.e. SCSI device case) or not (libsas and libata
+managed ATA devices case).
+
+Fixes: 0c76106cb975 ("scsi: sd: Fix TCG OPAL unlock on system resume")
+Cc: stable@vger.kernel.org
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Link: https://lore.kernel.org/r/20240701215326.128067-1-dlemoal@kernel.org
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/sd.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 2c627deedc1fa..7c25adb00e95d 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -3955,8 +3955,6 @@ static int sd_resume(struct device *dev)
+ {
+ struct scsi_disk *sdkp = dev_get_drvdata(dev);
+
+- sd_printk(KERN_NOTICE, sdkp, "Starting disk\n");
+-
+ if (opal_unlock_from_suspend(sdkp->opal_dev)) {
+ sd_printk(KERN_NOTICE, sdkp, "OPAL unlock failed\n");
+ return -EIO;
+@@ -3973,12 +3971,13 @@ static int sd_resume_common(struct device *dev, bool runtime)
+ if (!sdkp) /* E.g.: runtime resume at the start of sd_probe() */
+ return 0;
+
++ sd_printk(KERN_NOTICE, sdkp, "Starting disk\n");
++
+ if (!sd_do_start_stop(sdkp->device, runtime)) {
+ sdkp->suspended = false;
+ return 0;
+ }
+
+- sd_printk(KERN_NOTICE, sdkp, "Starting disk\n");
+ ret = sd_start_stop_device(sdkp, 1);
+ if (!ret) {
+ sd_resume(dev);
+--
+2.43.0
+
--- /dev/null
+From bf72b877f8ff03c9ccfbf1000bd775152bd7c409 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jan 2024 18:21:18 -0500
+Subject: selftests: Introduce Makefile variable to list shared bash scripts
+
+From: Benjamin Poirier <bpoirier@nvidia.com>
+
+[ Upstream commit 2a0683be5b4c9829e8335e494a21d1148e832822 ]
+
+Some tests written in bash source other files in a parent directory. For
+example, drivers/net/bonding/dev_addr_lists.sh sources
+net/forwarding/lib.sh. If a subset of tests is exported and run outside the
+source tree (for example by using `make -C tools/testing/selftests gen_tar
+TARGETS="drivers/net/bonding"`), these other files must be made available
+as well.
+
+Commit ae108c48b5d2 ("selftests: net: Fix cross-tree inclusion of scripts")
+addressed this problem by symlinking and copying the sourced files but this
+only works for direct dependencies. Commit 25ae948b4478 ("selftests/net:
+add lib.sh") changed net/forwarding/lib.sh to source net/lib.sh. As a
+result, that latter file must be included as well when the former is
+exported. This was not handled and was reverted in commit 2114e83381d3
+("selftests: forwarding: Avoid failures to source net/lib.sh"). In order to
+allow reinstating the inclusion of net/lib.sh from net/forwarding/lib.sh,
+add a mechanism to list dependent files in a new Makefile variable and
+export them. This allows sourcing those files using the same expression
+whether tests are run in-tree or exported.
+
+Dependencies are not resolved recursively so transitive dependencies must
+be listed in TEST_INCLUDES. For example, if net/forwarding/lib.sh sources
+net/lib.sh; the Makefile related to a test that sources
+net/forwarding/lib.sh from a parent directory must list:
+TEST_INCLUDES := \
+ ../../../net/forwarding/lib.sh \
+ ../../../net/lib.sh
+
+v2:
+Fix rst syntax in Documentation/dev-tools/kselftest.rst (Jakub Kicinski)
+
+v1 (from RFC):
+* changed TEST_INCLUDES to take relative paths, like other TEST_* variables
+ (Vladimir Oltean)
+* preserved common "$(MAKE) OUTPUT=... -C ... target" ordering in Makefile
+ (Petr Machata)
+
+Signed-off-by: Benjamin Poirier <bpoirier@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/dev-tools/kselftest.rst | 12 ++++++++++++
+ tools/testing/selftests/Makefile | 7 ++++++-
+ tools/testing/selftests/lib.mk | 19 +++++++++++++++++++
+ 3 files changed, 37 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/dev-tools/kselftest.rst b/Documentation/dev-tools/kselftest.rst
+index deede972f2547..3ae1b3677d7f3 100644
+--- a/Documentation/dev-tools/kselftest.rst
++++ b/Documentation/dev-tools/kselftest.rst
+@@ -255,9 +255,21 @@ Contributing new tests (details)
+
+ TEST_PROGS_EXTENDED, TEST_GEN_PROGS_EXTENDED mean it is the
+ executable which is not tested by default.
++
+ TEST_FILES, TEST_GEN_FILES mean it is the file which is used by
+ test.
+
++ TEST_INCLUDES is similar to TEST_FILES, it lists files which should be
++ included when exporting or installing the tests, with the following
++ differences:
++
++ * symlinks to files in other directories are preserved
++ * the part of paths below tools/testing/selftests/ is preserved when
++ copying the files to the output directory
++
++ TEST_INCLUDES is meant to list dependencies located in other directories of
++ the selftests hierarchy.
++
+ * First use the headers inside the kernel source and/or git repo, and then the
+ system headers. Headers for the kernel release as opposed to headers
+ installed by the distro on the system should be the primary focus to be able
+diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
+index 697f13bbbc321..5b61b8bb29f84 100644
+--- a/tools/testing/selftests/Makefile
++++ b/tools/testing/selftests/Makefile
+@@ -184,6 +184,8 @@ run_tests: all
+ @for TARGET in $(TARGETS); do \
+ BUILD_TARGET=$$BUILD/$$TARGET; \
+ $(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET run_tests \
++ SRC_PATH=$(shell readlink -e $$(pwd)) \
++ OBJ_PATH=$(BUILD) \
+ O=$(abs_objtree); \
+ done;
+
+@@ -234,7 +236,10 @@ ifdef INSTALL_PATH
+ @ret=1; \
+ for TARGET in $(TARGETS); do \
+ BUILD_TARGET=$$BUILD/$$TARGET; \
+- $(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET INSTALL_PATH=$(INSTALL_PATH)/$$TARGET install \
++ $(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET install \
++ INSTALL_PATH=$(INSTALL_PATH)/$$TARGET \
++ SRC_PATH=$(shell readlink -e $$(pwd)) \
++ OBJ_PATH=$(INSTALL_PATH) \
+ O=$(abs_objtree) \
+ $(if $(FORCE_TARGETS),|| exit); \
+ ret=$$((ret * $$?)); \
+diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
+index a8f0442a36bca..01db65c0e84ca 100644
+--- a/tools/testing/selftests/lib.mk
++++ b/tools/testing/selftests/lib.mk
+@@ -77,11 +77,29 @@ define RUN_TESTS
+ run_many $(1)
+ endef
+
++define INSTALL_INCLUDES
++ $(if $(TEST_INCLUDES), \
++ relative_files=""; \
++ for entry in $(TEST_INCLUDES); do \
++ entry_dir=$$(readlink -e "$$(dirname "$$entry")"); \
++ entry_name=$$(basename "$$entry"); \
++ relative_dir=$${entry_dir#"$$SRC_PATH"/}; \
++ if [ "$$relative_dir" = "$$entry_dir" ]; then \
++ echo "Error: TEST_INCLUDES entry \"$$entry\" not located inside selftests directory ($$SRC_PATH)" >&2; \
++ exit 1; \
++ fi; \
++ relative_files="$$relative_files $$relative_dir/$$entry_name"; \
++ done; \
++ cd $(SRC_PATH) && rsync -aR $$relative_files $(OBJ_PATH)/ \
++ )
++endef
++
+ run_tests: all
+ ifdef building_out_of_srctree
+ @if [ "X$(TEST_PROGS)$(TEST_PROGS_EXTENDED)$(TEST_FILES)" != "X" ]; then \
+ rsync -aq --copy-unsafe-links $(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES) $(OUTPUT); \
+ fi
++ @$(INSTALL_INCLUDES)
+ @if [ "X$(TEST_PROGS)" != "X" ]; then \
+ $(call RUN_TESTS, $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS) \
+ $(addprefix $(OUTPUT)/,$(TEST_PROGS))) ; \
+@@ -111,6 +129,7 @@ endef
+ install: all
+ ifdef INSTALL_PATH
+ $(INSTALL_RULE)
++ $(INSTALL_INCLUDES)
+ else
+ $(error Error: set INSTALL_PATH to use install)
+ endif
+--
+2.43.0
+
--- /dev/null
+From 3600f8a9267c42ae0130ef2869be867fdfec66f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 09:08:46 -0500
+Subject: selftests: net: Remove executable bits from library scripts
+
+From: Benjamin Poirier <bpoirier@nvidia.com>
+
+[ Upstream commit 9d851dd4dab63e95c1911a2fa847796d1ec5d58d ]
+
+setup_loopback.sh and net_helper.sh are meant to be sourced from other
+scripts, not executed directly. Therefore, remove the executable bits from
+those files' permissions.
+
+This change is similar to commit 49078c1b80b6 ("selftests: forwarding:
+Remove executable bits from lib.sh")
+
+Fixes: 7d1575014a63 ("selftests/net: GRO coalesce test")
+Fixes: 3bdd9fd29cb0 ("selftests/net: synchronize udpgro tests' tx and rx connection")
+Suggested-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Benjamin Poirier <bpoirier@nvidia.com>
+Link: https://lore.kernel.org/r/20240131140848.360618-4-bpoirier@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/setup_loopback.sh | 0
+ 1 file changed, 0 insertions(+), 0 deletions(-)
+ mode change 100755 => 100644 tools/testing/selftests/net/setup_loopback.sh
+
+diff --git a/tools/testing/selftests/net/setup_loopback.sh b/tools/testing/selftests/net/setup_loopback.sh
+old mode 100755
+new mode 100644
+--
+2.43.0
+
unicode-don-t-special-case-ignorable-code-points.patch
net-fec-don-t-save-ptp-state-if-ptp-is-unsupported.patch
+revert-pci-msi-provide-stubs-for-ims-functions.patch
+asoc-cs35l56-load-tunings-for-the-correct-speaker-mo.patch
+phy-qualcomm-phy-qcom-eusb2-repeater-add-tuning-over.patch
+phy-qualcomm-eusb2-repeater-rework-init-to-drop-redu.patch
+gfs2-revert-introduce-qd_bh_get_or_undo.patch
+gfs2-qd_check_sync-cleanups.patch
+gfs2-revert-ignore-negated-quota-changes.patch
+riscv-remove-shadow_overflow_stack_size-macro.patch
+net-ethernet-cortina-drop-tso-support.patch
+drm-panel-boe-tv101wum-nl6-fine-tune-himax83102-j02-.patch
+revert-mm-filemap-avoid-buffered-read-write-race-to-.patch
+tracing-remove-precision-vsnprintf-check-from-print-.patch
+alsa-hda-realtek-cs35l41-fix-order-and-duplicates-in.patch
+alsa-hda-realtek-cs35l41-fix-device-id-model-name.patch
+drm-crtc-fix-uninitialized-variable-use-even-harder.patch
+bus-mhi-ep-rename-read_from_host-and-write_to_host-a.patch
+bus-mhi-ep-introduce-async-read-write-callbacks.patch
+bus-mhi-ep-add-support-for-async-dma-write-operation.patch
+bus-mhi-ep-add-support-for-async-dma-read-operation.patch
+bus-mhi-ep-do-not-allocate-memory-for-mhi-objects-fr.patch
+revert-powerpc-ps3_defconfig-disable-ppc64_big_endia.patch
+pds_core-no-health-thread-in-vf-path.patch
+libceph-init-the-cursor-when-preparing-sparse-read-i.patch
+tracing-have-saved_cmdlines-arrays-all-in-one-alloca.patch
+riscv-cpufeature-fix-thead-vector-hwcap-removal.patch
+spi-spi-fsl-lpspi-remove-redundant-spi_controller_pu.patch
+ata-ahci-add-mask_port_map-module-parameter.patch
+asoc-tas2781-mark-dvc_tlv-with-__maybe_unused.patch
+scsi-remove-scsi-device-no_start_on_resume-flag.patch
+scsi-sd-do-not-repeat-the-starting-disk-message.patch
+i40e-fix-st-code-value-for-clause-45.patch
+i40e-include-types.h-to-some-headers.patch
+e1000e-move-force-smbus-near-the-end-of-enable_ulp-f.patch
+bootconfig-fix-the-kerneldoc-of-_xbc_exit.patch
+perf-sched-move-start_work_mutex-and-work_done_wait_.patch
+perf-sched-fix-memory-leak-in-perf_sched__map.patch
+perf-sched-move-curr_thread-initialization-to-perf_s.patch
+perf-sched-move-curr_pid-and-cpu_last_switched-initi.patch
+libsubcmd-don-t-free-the-usage-string.patch
+selftests-net-remove-executable-bits-from-library-sc.patch
+cpufreq-amd-pstate-ut-convert-nominal_freq-to-khz-du.patch
+selftests-introduce-makefile-variable-to-list-shared.patch
+bluetooth-fix-usage-of-__hci_cmd_sync_status.patch
+jbd2-fix-kernel-doc-for-j_transaction_overhead_buffe.patch
+lib-build_oid_registry-avoid-non-destructive-substit.patch
+drm-amd-display-remove-a-redundant-check-in-authenti.patch
+drm-amd-display-revert-check-hdcp-returned-status.patch
+fs-ntfs3-do-not-call-file_modified-if-collapse-range.patch
+fs-ntfs3-fix-sparse-warning-in-ni_fiemap.patch
+fs-ntfs3-refactor-enum_rstbl-to-suppress-static-chec.patch
+virtio_console-fix-misc-probe-bugs.patch
+ntfs3-change-to-non-blocking-allocation-in-ntfs_d_ha.patch
+zram-free-secondary-algorithms-names.patch
+zram-don-t-free-statically-defined-names.patch
+input-synaptics-rmi4-fix-uaf-of-irq-domain-on-driver.patch
--- /dev/null
+From 67b4aa4052395e81aec25ea95f2357933d4fc74b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Apr 2024 16:40:29 +0800
+Subject: spi: spi-fsl-lpspi: remove redundant spi_controller_put call
+
+From: Carlos Song <carlos.song@nxp.com>
+
+[ Upstream commit bff892acf79cec531da6cb21c50980a584ce1476 ]
+
+devm_spi_alloc_controller will allocate an SPI controller and
+automatically release a reference on it when dev is unbound from
+its driver. It doesn't need to call spi_controller_put explicitly
+to put the reference when lpspi driver failed initialization.
+
+Fixes: 2ae0ab0143fc ("spi: lpspi: Avoid potential use-after-free in probe()")
+Signed-off-by: Carlos Song <carlos.song@nxp.com>
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
+Link: https://msgid.link/r/20240403084029.2000544-1-carlos.song@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index 180cea7d38172..13313f07839b6 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -881,39 +881,39 @@ static int fsl_lpspi_probe(struct platform_device *pdev)
+ fsl_lpspi->base = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
+ if (IS_ERR(fsl_lpspi->base)) {
+ ret = PTR_ERR(fsl_lpspi->base);
+- goto out_controller_put;
++ return ret;
+ }
+ fsl_lpspi->base_phys = res->start;
+
+ irq = platform_get_irq(pdev, 0);
+ if (irq < 0) {
+ ret = irq;
+- goto out_controller_put;
++ return ret;
+ }
+
+ ret = devm_request_irq(&pdev->dev, irq, fsl_lpspi_isr, 0,
+ dev_name(&pdev->dev), fsl_lpspi);
+ if (ret) {
+ dev_err(&pdev->dev, "can't get irq%d: %d\n", irq, ret);
+- goto out_controller_put;
++ return ret;
+ }
+
+ fsl_lpspi->clk_per = devm_clk_get(&pdev->dev, "per");
+ if (IS_ERR(fsl_lpspi->clk_per)) {
+ ret = PTR_ERR(fsl_lpspi->clk_per);
+- goto out_controller_put;
++ return ret;
+ }
+
+ fsl_lpspi->clk_ipg = devm_clk_get(&pdev->dev, "ipg");
+ if (IS_ERR(fsl_lpspi->clk_ipg)) {
+ ret = PTR_ERR(fsl_lpspi->clk_ipg);
+- goto out_controller_put;
++ return ret;
+ }
+
+ /* enable the clock */
+ ret = fsl_lpspi_init_rpm(fsl_lpspi);
+ if (ret)
+- goto out_controller_put;
++ return ret;
+
+ ret = pm_runtime_get_sync(fsl_lpspi->dev);
+ if (ret < 0) {
+@@ -974,8 +974,6 @@ static int fsl_lpspi_probe(struct platform_device *pdev)
+ pm_runtime_dont_use_autosuspend(fsl_lpspi->dev);
+ pm_runtime_put_sync(fsl_lpspi->dev);
+ pm_runtime_disable(fsl_lpspi->dev);
+-out_controller_put:
+- spi_controller_put(controller);
+
+ return ret;
+ }
+--
+2.43.0
+
--- /dev/null
+From f86e08e2abb19d4aa6a28b42b2e800a307efb16b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Feb 2024 09:06:14 -0500
+Subject: tracing: Have saved_cmdlines arrays all in one allocation
+
+From: Steven Rostedt (Google) <rostedt@goodmis.org>
+
+[ Upstream commit 0b18c852cc6fb8284ac0ab97e3e840974a6a8a64 ]
+
+The saved_cmdlines have three arrays for mapping PIDs to COMMs:
+
+ - map_pid_to_cmdline[]
+ - map_cmdline_to_pid[]
+ - saved_cmdlines
+
+The map_pid_to_cmdline[] is PID_MAX_DEFAULT in size and holds the index
+into the other arrays. The map_cmdline_to_pid[] is a mapping back to the
+full pid as it can be larger than PID_MAX_DEFAULT. And the
+saved_cmdlines[] just holds the COMMs associated to the pids.
+
+Currently the map_pid_to_cmdline[] and saved_cmdlines[] are allocated
+together (in reality the saved_cmdlines is just in the memory of the
+rounding of the allocation of the structure as it is always allocated in
+powers of two). The map_cmdline_to_pid[] array is allocated separately.
+
+Since the rounding to a power of two is rather large (it allows for 8000
+elements in saved_cmdlines), also include the map_cmdline_to_pid[] array.
+(This drops it to 6000 by default, which is still plenty for most use
+cases). This saves even more memory as the map_cmdline_to_pid[] array
+doesn't need to be allocated.
+
+Link: https://lore.kernel.org/linux-trace-kernel/20240212174011.068211d9@gandalf.local.home/
+Link: https://lore.kernel.org/linux-trace-kernel/20240220140703.182330529@goodmis.org
+
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: Vincent Donnefort <vdonnefort@google.com>
+Cc: Sven Schnelle <svens@linux.ibm.com>
+Cc: Mete Durlu <meted@linux.ibm.com>
+Fixes: 44dc5c41b5b1 ("tracing: Fix wasted memory in saved_cmdlines logic")
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace.c | 18 ++++++++----------
+ 1 file changed, 8 insertions(+), 10 deletions(-)
+
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index be878005e3449..4f93d57cc0299 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -2316,6 +2316,10 @@ struct saved_cmdlines_buffer {
+ };
+ static struct saved_cmdlines_buffer *savedcmd;
+
++/* Holds the size of a cmdline and pid element */
++#define SAVED_CMDLINE_MAP_ELEMENT_SIZE(s) \
++ (TASK_COMM_LEN + sizeof((s)->map_cmdline_to_pid[0]))
++
+ static inline char *get_saved_cmdlines(int idx)
+ {
+ return &savedcmd->saved_cmdlines[idx * TASK_COMM_LEN];
+@@ -2330,7 +2334,6 @@ static void free_saved_cmdlines_buffer(struct saved_cmdlines_buffer *s)
+ {
+ int order = get_order(sizeof(*s) + s->cmdline_num * TASK_COMM_LEN);
+
+- kfree(s->map_cmdline_to_pid);
+ kmemleak_free(s);
+ free_pages((unsigned long)s, order);
+ }
+@@ -2343,7 +2346,7 @@ static struct saved_cmdlines_buffer *allocate_cmdlines_buffer(unsigned int val)
+ int order;
+
+ /* Figure out how much is needed to hold the given number of cmdlines */
+- orig_size = sizeof(*s) + val * TASK_COMM_LEN;
++ orig_size = sizeof(*s) + val * SAVED_CMDLINE_MAP_ELEMENT_SIZE(s);
+ order = get_order(orig_size);
+ size = 1 << (order + PAGE_SHIFT);
+ page = alloc_pages(GFP_KERNEL, order);
+@@ -2355,16 +2358,11 @@ static struct saved_cmdlines_buffer *allocate_cmdlines_buffer(unsigned int val)
+ memset(s, 0, sizeof(*s));
+
+ /* Round up to actual allocation */
+- val = (size - sizeof(*s)) / TASK_COMM_LEN;
++ val = (size - sizeof(*s)) / SAVED_CMDLINE_MAP_ELEMENT_SIZE(s);
+ s->cmdline_num = val;
+
+- s->map_cmdline_to_pid = kmalloc_array(val,
+- sizeof(*s->map_cmdline_to_pid),
+- GFP_KERNEL);
+- if (!s->map_cmdline_to_pid) {
+- free_saved_cmdlines_buffer(s);
+- return NULL;
+- }
++ /* Place map_cmdline_to_pid array right after saved_cmdlines */
++ s->map_cmdline_to_pid = (unsigned *)&s->saved_cmdlines[val * TASK_COMM_LEN];
+
+ s->cmdline_idx = 0;
+ memset(&s->map_pid_to_cmdline, NO_CMDLINE_MAP,
+--
+2.43.0
+
--- /dev/null
+From e20651932a9034be80769f12ea5284fa52821823 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Mar 2024 17:43:41 -0500
+Subject: tracing: Remove precision vsnprintf() check from print event
+
+From: Steven Rostedt (Google) <rostedt@goodmis.org>
+
+[ Upstream commit 5efd3e2aef91d2d812290dcb25b2058e6f3f532c ]
+
+This reverts 60be76eeabb3d ("tracing: Add size check when printing
+trace_marker output"). The only reason the precision check was added
+was because of a bug that miscalculated the write size of the string into
+the ring buffer and it truncated it removing the terminating nul byte. On
+reading the trace it crashed the kernel. But this was due to the bug in
+the code that happened during development and should never happen in
+practice. If anything, the precision can hide bugs where the string in the
+ring buffer isn't nul terminated and it will not be checked.
+
+Link: https://lore.kernel.org/all/C7E7AF1A-D30F-4D18-B8E5-AF1EF58004F5@linux.ibm.com/
+Link: https://lore.kernel.org/linux-trace-kernel/20240227125706.04279ac2@gandalf.local.home
+Link: https://lore.kernel.org/all/20240302111244.3a1674be@gandalf.local.home/
+Link: https://lore.kernel.org/linux-trace-kernel/20240304174341.2a561d9f@gandalf.local.home
+
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Fixes: 60be76eeabb3d ("tracing: Add size check when printing trace_marker output")
+Reported-by: Sachin Sant <sachinp@linux.ibm.com>
+Tested-by: Sachin Sant <sachinp@linux.ibm.com>
+Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_output.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
+index 3b7d3e9eb6ea4..db575094c4982 100644
+--- a/kernel/trace/trace_output.c
++++ b/kernel/trace/trace_output.c
+@@ -1587,12 +1587,11 @@ static enum print_line_t trace_print_print(struct trace_iterator *iter,
+ {
+ struct print_entry *field;
+ struct trace_seq *s = &iter->seq;
+- int max = iter->ent_size - offsetof(struct print_entry, buf);
+
+ trace_assign_type(field, iter->ent);
+
+ seq_print_ip_sym(s, field->ip, flags);
+- trace_seq_printf(s, ": %.*s", max, field->buf);
++ trace_seq_printf(s, ": %s", field->buf);
+
+ return trace_handle_return(s);
+ }
+@@ -1601,11 +1600,10 @@ static enum print_line_t trace_print_raw(struct trace_iterator *iter, int flags,
+ struct trace_event *event)
+ {
+ struct print_entry *field;
+- int max = iter->ent_size - offsetof(struct print_entry, buf);
+
+ trace_assign_type(field, iter->ent);
+
+- trace_seq_printf(&iter->seq, "# %lx %.*s", field->ip, max, field->buf);
++ trace_seq_printf(&iter->seq, "# %lx %s", field->ip, field->buf);
+
+ return trace_handle_return(&iter->seq);
+ }
+--
+2.43.0
+
--- /dev/null
+From cfd9d750958a30710230dd23e792efeca75274ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Sep 2024 14:16:44 -0400
+Subject: virtio_console: fix misc probe bugs
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+[ Upstream commit b9efbe2b8f0177fa97bfab290d60858900aa196b ]
+
+This fixes the following issue discovered by code review:
+
+after vqs have been created, a buggy device can send an interrupt.
+
+A control vq callback will then try to schedule control_work which has
+not been initialized yet. Similarly for config interrupt. Further, in
+and out vq callbacks invoke find_port_by_vq which attempts to take
+ports_lock which also has not been initialized.
+
+To fix, init all locks and work before creating vqs.
+
+Message-ID: <ad982e975a6160ad110c623c016041311ca15b4f.1726511547.git.mst@redhat.com>
+Fixes: 17634ba25544 ("virtio: console: Add a new MULTIPORT feature, support for generic ports")
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/virtio_console.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
+index 680d1ef2a2179..796ab9a4e48fa 100644
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -2052,25 +2052,27 @@ static int virtcons_probe(struct virtio_device *vdev)
+ multiport = true;
+ }
+
+- err = init_vqs(portdev);
+- if (err < 0) {
+- dev_err(&vdev->dev, "Error %d initializing vqs\n", err);
+- goto free_chrdev;
+- }
+-
+ spin_lock_init(&portdev->ports_lock);
+ INIT_LIST_HEAD(&portdev->ports);
+ INIT_LIST_HEAD(&portdev->list);
+
+- virtio_device_ready(portdev->vdev);
+-
+ INIT_WORK(&portdev->config_work, &config_work_handler);
+ INIT_WORK(&portdev->control_work, &control_work_handler);
+
+ if (multiport) {
+ spin_lock_init(&portdev->c_ivq_lock);
+ spin_lock_init(&portdev->c_ovq_lock);
++ }
+
++ err = init_vqs(portdev);
++ if (err < 0) {
++ dev_err(&vdev->dev, "Error %d initializing vqs\n", err);
++ goto free_chrdev;
++ }
++
++ virtio_device_ready(portdev->vdev);
++
++ if (multiport) {
+ err = fill_queue(portdev->c_ivq, &portdev->c_ivq_lock);
+ if (err < 0) {
+ dev_err(&vdev->dev,
+--
+2.43.0
+
--- /dev/null
+From 91c9f9d052dc061dd50218db06204587f92f7bdf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2024 13:51:40 +0900
+Subject: zram: don't free statically defined names
+
+From: Andrey Skvortsov <andrej.skvortzov@gmail.com>
+
+[ Upstream commit 486fd58af7ac1098b68370b1d4d9f94a2a1c7124 ]
+
+When CONFIG_ZRAM_MULTI_COMP isn't set ZRAM_SECONDARY_COMP can hold
+default_compressor, because it's the same offset as ZRAM_PRIMARY_COMP, so
+we need to make sure that we don't attempt to kfree() the statically
+defined compressor name.
+
+This is detected by KASAN.
+
+==================================================================
+ Call trace:
+ kfree+0x60/0x3a0
+ zram_destroy_comps+0x98/0x198 [zram]
+ zram_reset_device+0x22c/0x4a8 [zram]
+ reset_store+0x1bc/0x2d8 [zram]
+ dev_attr_store+0x44/0x80
+ sysfs_kf_write+0xfc/0x188
+ kernfs_fop_write_iter+0x28c/0x428
+ vfs_write+0x4dc/0x9b8
+ ksys_write+0x100/0x1f8
+ __arm64_sys_write+0x74/0xb8
+ invoke_syscall+0xd8/0x260
+ el0_svc_common.constprop.0+0xb4/0x240
+ do_el0_svc+0x48/0x68
+ el0_svc+0x40/0xc8
+ el0t_64_sync_handler+0x120/0x130
+ el0t_64_sync+0x190/0x198
+==================================================================
+
+Link: https://lkml.kernel.org/r/20240923164843.1117010-1-andrej.skvortzov@gmail.com
+Fixes: 684826f8271a ("zram: free secondary algorithms names")
+Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
+Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Reported-by: Venkat Rao Bagalkote <venkat88@linux.vnet.ibm.com>
+Closes: https://lore.kernel.org/lkml/57130e48-dbb6-4047-a8c7-ebf5aaea93f4@linux.vnet.ibm.com/
+Tested-by: Venkat Rao Bagalkote <venkat88@linux.vnet.ibm.com>
+Cc: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Minchan Kim <minchan@kernel.org>
+Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
+Cc: Venkat Rao Bagalkote <venkat88@linux.vnet.ibm.com>
+Cc: Chris Li <chrisl@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/zram/zram_drv.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index db729035fd6bf..606f388c7a571 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -1984,8 +1984,10 @@ static void zram_destroy_comps(struct zram *zram)
+ zram->num_active_comps--;
+ }
+
+- for (prio = ZRAM_SECONDARY_COMP; prio < ZRAM_MAX_COMPS; prio++) {
+- kfree(zram->comp_algs[prio]);
++ for (prio = ZRAM_PRIMARY_COMP; prio < ZRAM_MAX_COMPS; prio++) {
++ /* Do not free statically defined compression algorithms */
++ if (zram->comp_algs[prio] != default_compressor)
++ kfree(zram->comp_algs[prio]);
+ zram->comp_algs[prio] = NULL;
+ }
+ }
+--
+2.43.0
+
--- /dev/null
+From 257fc140d039f13e851767d5902f7be4e78bda90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2024 13:51:39 +0900
+Subject: zram: free secondary algorithms names
+
+From: Sergey Senozhatsky <senozhatsky@chromium.org>
+
+[ Upstream commit 684826f8271ad97580b138b9ffd462005e470b99 ]
+
+We need to kfree() secondary algorithms names when reset zram device that
+had multi-streams, otherwise we leak memory.
+
+[senozhatsky@chromium.org: kfree(NULL) is legal]
+ Link: https://lkml.kernel.org/r/20240917013021.868769-1-senozhatsky@chromium.org
+Link: https://lkml.kernel.org/r/20240911025600.3681789-1-senozhatsky@chromium.org
+Fixes: 001d92735701 ("zram: add recompression algorithm sysfs knob")
+Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Cc: Minchan Kim <minchan@kernel.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/zram/zram_drv.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index 06673c6ca2555..db729035fd6bf 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -1983,6 +1983,11 @@ static void zram_destroy_comps(struct zram *zram)
+ zcomp_destroy(comp);
+ zram->num_active_comps--;
+ }
++
++ for (prio = ZRAM_SECONDARY_COMP; prio < ZRAM_MAX_COMPS; prio++) {
++ kfree(zram->comp_algs[prio]);
++ zram->comp_algs[prio] = NULL;
++ }
+ }
+
+ static void zram_reset_device(struct zram *zram)
+--
+2.43.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
