--- /dev/null
+From ffd3956d5cc3576c0d9cd0a907a842a3c50aa12f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Feb 2024 13:18:46 +0300
+Subject: cifs: fix underflow in parse_server_interfaces()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit cffe487026be13eaf37ea28b783d9638ab147204 ]
+
+In this loop, we step through the buffer and after each item we check
+if the size_left is greater than the minimum size we need. However,
+the problem is that "bytes_left" is type ssize_t while sizeof() is type
+size_t. That means that because of type promotion, the comparison is
+done as an unsigned and if we have negative bytes left the loop
+continues instead of ending.
+
+Fixes: fe856be475f7 ("CIFS: parse and store info on iface queries")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Shyam Prasad N <sprasad@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2ops.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
+index e33ed0fbc318..5850f861e7e1 100644
+--- a/fs/smb/client/smb2ops.c
++++ b/fs/smb/client/smb2ops.c
+@@ -619,7 +619,7 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf,
+ goto out;
+ }
+
+- while (bytes_left >= sizeof(*p)) {
++ while (bytes_left >= (ssize_t)sizeof(*p)) {
+ memset(&tmp_iface, 0, sizeof(tmp_iface));
+ tmp_iface.speed = le64_to_cpu(p->LinkSpeed);
+ tmp_iface.rdma_capable = le32_to_cpu(p->Capability & RDMA_CAPABLE) ? 1 : 0;
+--
+2.43.0
+
--- /dev/null
+From 38ba97a322ec2854e6be64bc6ed645ad7f1262a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Feb 2024 01:56:34 -0800
+Subject: driver core: fw_devlink: Improve detection of overlapping cycles
+
+From: Saravana Kannan <saravanak@google.com>
+
+[ Upstream commit 6442d79d880cf7a2fff18779265d657fef0cce4c ]
+
+fw_devlink can detect most overlapping/intersecting cycles. However it was
+missing a few corner cases because of an incorrect optimization logic that
+tries to avoid repeating cycle detection for devices that are already
+marked as part of a cycle.
+
+Here's an example provided by Xu Yang (edited for clarity):
+
+ usb
+ +-----+
+ tcpc | |
+ +-----+ | +--|
+ | |----------->|EP|
+ |--+ | | +--|
+ |EP|<-----------| |
+ |--+ | | B |
+ | | +-----+
+ | A | |
+ +-----+ |
+ ^ +-----+ |
+ | | | |
+ +-----| C |<--+
+ | |
+ +-----+
+ usb-phy
+
+Node A (tcpc) will be populated as device 1-0050.
+Node B (usb) will be populated as device 38100000.usb.
+Node C (usb-phy) will be populated as device 381f0040.usb-phy.
+
+The description below uses the notation:
+consumer --> supplier
+child ==> parent
+
+1. Node C is populated as device C. No cycles detected because cycle
+ detection is only run when a fwnode link is converted to a device link.
+
+2. Node B is populated as device B. As we convert B --> C into a device
+ link we run cycle detection and find and mark the device link/fwnode
+ link cycle:
+ C--> A --> B.EP ==> B --> C
+
+3. Node A is populated as device A. As we convert C --> A into a device
+ link, we see it's already part of a cycle (from step 2) and don't run
+ cycle detection. Thus we miss detecting the cycle:
+ A --> B.EP ==> B --> A.EP ==> A
+
+Looking at it another way, A depends on B in one way:
+A --> B.EP ==> B
+
+But B depends on A in two ways and we only detect the first:
+B --> C --> A
+B --> A.EP ==> A
+
+To detect both of these, we remove the incorrect optimization attempt in
+step 3 and run cycle detection even if the fwnode link from which the
+device link is being created has already been marked as part of a cycle.
+
+Reported-by: Xu Yang <xu.yang_2@nxp.com>
+Closes: https://lore.kernel.org/lkml/DU2PR04MB8822693748725F85DC0CB86C8C792@DU2PR04MB8822.eurprd04.prod.outlook.com/
+Fixes: 3fb16866b51d ("driver core: fw_devlink: Make cycle detection more robust")
+Signed-off-by: Saravana Kannan <saravanak@google.com>
+Tested-by: Xu Yang <xu.yang_2@nxp.com>
+Link: https://lore.kernel.org/r/20240202095636.868578-3-saravanak@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/core.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index a81bc8844a8f..2cc0ab854168 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -2059,9 +2059,14 @@ static int fw_devlink_create_devlink(struct device *con,
+
+ /*
+ * SYNC_STATE_ONLY device links don't block probing and supports cycles.
+- * So cycle detection isn't necessary and shouldn't be done.
++ * So, one might expect that cycle detection isn't necessary for them.
++ * However, if the device link was marked as SYNC_STATE_ONLY because
++ * it's part of a cycle, then we still need to do cycle detection. This
++ * is because the consumer and supplier might be part of multiple cycles
++ * and we need to detect all those cycles.
+ */
+- if (!(flags & DL_FLAG_SYNC_STATE_ONLY)) {
++ if (!device_link_flag_is_sync_state_only(flags) ||
++ flags & DL_FLAG_CYCLE) {
+ device_links_write_lock();
+ if (__fw_devlink_relax_cycles(con, sup_handle)) {
+ __fwnode_link_cycle(link);
+--
+2.43.0
+
--- /dev/null
+From 4466df2a51269dfb44e34e3a5940b8cd080a017f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Feb 2024 15:59:39 +0100
+Subject: i2c: i801: Fix block process call transactions
+
+From: Jean Delvare <jdelvare@suse.de>
+
+[ Upstream commit c1c9d0f6f7f1dbf29db996bd8e166242843a5f21 ]
+
+According to the Intel datasheets, software must reset the block
+buffer index twice for block process call transactions: once before
+writing the outgoing data to the buffer, and once again before
+reading the incoming data from the buffer.
+
+The driver is currently missing the second reset, causing the wrong
+portion of the block buffer to be read.
+
+Signed-off-by: Jean Delvare <jdelvare@suse.de>
+Reported-by: Piotr Zakowski <piotr.zakowski@intel.com>
+Closes: https://lore.kernel.org/linux-i2c/20240213120553.7b0ab120@endymion.delvare/
+Fixes: 315cd67c9453 ("i2c: i801: Add Block Write-Block Read Process Call support")
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-i801.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
+index a87e3c15e5fc..f1c82b2016f3 100644
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -500,11 +500,10 @@ static int i801_block_transaction_by_block(struct i801_priv *priv,
+ /* Set block buffer mode */
+ outb_p(inb_p(SMBAUXCTL(priv)) | SMBAUXCTL_E32B, SMBAUXCTL(priv));
+
+- inb_p(SMBHSTCNT(priv)); /* reset the data buffer index */
+-
+ if (read_write == I2C_SMBUS_WRITE) {
+ len = data->block[0];
+ outb_p(len, SMBHSTDAT0(priv));
++ inb_p(SMBHSTCNT(priv)); /* reset the data buffer index */
+ for (i = 0; i < len; i++)
+ outb_p(data->block[i+1], SMBBLKDAT(priv));
+ }
+@@ -522,6 +521,7 @@ static int i801_block_transaction_by_block(struct i801_priv *priv,
+ }
+
+ data->block[0] = len;
++ inb_p(SMBHSTCNT(priv)); /* reset the data buffer index */
+ for (i = 0; i < len; i++)
+ data->block[i + 1] = inb_p(SMBBLKDAT(priv));
+ }
+--
+2.43.0
+
--- /dev/null
+From 7c3e37d4c2e4206bf26c1916cb91129baaaa3283 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Feb 2024 12:19:04 +0100
+Subject: i2c: pasemi: split driver into two separate modules
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit f44bff19268517ee98e80e944cad0f04f1db72e3 ]
+
+On powerpc, it is possible to compile test both the new apple (arm) and
+old pasemi (powerpc) drivers for the i2c hardware at the same time,
+which leads to a warning about linking the same object file twice:
+
+scripts/Makefile.build:244: drivers/i2c/busses/Makefile: i2c-pasemi-core.o is added to multiple modules: i2c-apple i2c-pasemi
+
+Rework the driver to have an explicit helper module, letting Kbuild
+take care of whether this should be built-in or a loadable driver.
+
+Fixes: 9bc5f4f660ff ("i2c: pasemi: Split pci driver to its own file")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Sven Peter <sven@svenpeter.dev>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/Makefile | 6 ++----
+ drivers/i2c/busses/i2c-pasemi-core.c | 6 ++++++
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/i2c/busses/Makefile b/drivers/i2c/busses/Makefile
+index af56fe2c75c0..9be9fdb07f3d 100644
+--- a/drivers/i2c/busses/Makefile
++++ b/drivers/i2c/busses/Makefile
+@@ -90,10 +90,8 @@ obj-$(CONFIG_I2C_NPCM) += i2c-npcm7xx.o
+ obj-$(CONFIG_I2C_OCORES) += i2c-ocores.o
+ obj-$(CONFIG_I2C_OMAP) += i2c-omap.o
+ obj-$(CONFIG_I2C_OWL) += i2c-owl.o
+-i2c-pasemi-objs := i2c-pasemi-core.o i2c-pasemi-pci.o
+-obj-$(CONFIG_I2C_PASEMI) += i2c-pasemi.o
+-i2c-apple-objs := i2c-pasemi-core.o i2c-pasemi-platform.o
+-obj-$(CONFIG_I2C_APPLE) += i2c-apple.o
++obj-$(CONFIG_I2C_PASEMI) += i2c-pasemi-core.o i2c-pasemi-pci.o
++obj-$(CONFIG_I2C_APPLE) += i2c-pasemi-core.o i2c-pasemi-platform.o
+ obj-$(CONFIG_I2C_PCA_PLATFORM) += i2c-pca-platform.o
+ obj-$(CONFIG_I2C_PNX) += i2c-pnx.o
+ obj-$(CONFIG_I2C_PXA) += i2c-pxa.o
+diff --git a/drivers/i2c/busses/i2c-pasemi-core.c b/drivers/i2c/busses/i2c-pasemi-core.c
+index 7d54a9f34c74..bd8becbdeeb2 100644
+--- a/drivers/i2c/busses/i2c-pasemi-core.c
++++ b/drivers/i2c/busses/i2c-pasemi-core.c
+@@ -369,6 +369,7 @@ int pasemi_i2c_common_probe(struct pasemi_smbus *smbus)
+
+ return 0;
+ }
++EXPORT_SYMBOL_GPL(pasemi_i2c_common_probe);
+
+ irqreturn_t pasemi_irq_handler(int irq, void *dev_id)
+ {
+@@ -378,3 +379,8 @@ irqreturn_t pasemi_irq_handler(int irq, void *dev_id)
+ complete(&smbus->irq_completion);
+ return IRQ_HANDLED;
+ }
++EXPORT_SYMBOL_GPL(pasemi_irq_handler);
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Olof Johansson <olof@lixom.net>");
++MODULE_DESCRIPTION("PA Semi PWRficient SMBus driver");
+--
+2.43.0
+
--- /dev/null
+From ac678bba0ce75d9e0a6d0fc263aa784949461bde Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Feb 2024 18:22:39 +0530
+Subject: i2c: qcom-geni: Correct I2C TRE sequence
+
+From: Viken Dadhaniya <quic_vdadhani@quicinc.com>
+
+[ Upstream commit 83ef106fa732aea8558253641cd98e8a895604d7 ]
+
+For i2c read operation in GSI mode, we are getting timeout
+due to malformed TRE basically incorrect TRE sequence
+in gpi(drivers/dma/qcom/gpi.c) driver.
+
+I2C driver has geni_i2c_gpi(I2C_WRITE) function which generates GO TRE and
+geni_i2c_gpi(I2C_READ)generates DMA TRE. Hence to generate GO TRE before
+DMA TRE, we should move geni_i2c_gpi(I2C_WRITE) before
+geni_i2c_gpi(I2C_READ) inside the I2C GSI mode transfer function
+i.e. geni_i2c_gpi_xfer().
+
+TRE stands for Transfer Ring Element - which is basically an element with
+size of 4 words. It contains all information like slave address,
+clk divider, dma address value data size etc).
+
+Mainly we have 3 TREs(Config, GO and DMA tre).
+- CONFIG TRE : consists of internal register configuration which is
+ required before start of the transfer.
+- DMA TRE : contains DDR/Memory address, called as DMA descriptor.
+- GO TRE : contains Transfer directions, slave ID, Delay flags, Length
+ of the transfer.
+
+I2c driver calls GPI driver API to config each TRE depending on the
+protocol.
+
+For read operation tre sequence will be as below which is not aligned
+to hardware programming guide.
+
+- CONFIG tre
+- DMA tre
+- GO tre
+
+As per Qualcomm's internal Hardware Programming Guide, we should configure
+TREs in below sequence for any RX only transfer.
+
+- CONFIG tre
+- GO tre
+- DMA tre
+
+Fixes: d8703554f4de ("i2c: qcom-geni: Add support for GPI DMA")
+Reviewed-by: Andi Shyti <andi.shyti@kernel.org>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> # qrb5165-rb5
+Co-developed-by: Mukesh Kumar Savaliya <quic_msavaliy@quicinc.com>
+Signed-off-by: Mukesh Kumar Savaliya <quic_msavaliy@quicinc.com>
+Signed-off-by: Viken Dadhaniya <quic_vdadhani@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-qcom-geni.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c
+index 0a9d389df301..5cc32a465f12 100644
+--- a/drivers/i2c/busses/i2c-qcom-geni.c
++++ b/drivers/i2c/busses/i2c-qcom-geni.c
+@@ -613,20 +613,20 @@ static int geni_i2c_gpi_xfer(struct geni_i2c_dev *gi2c, struct i2c_msg msgs[], i
+
+ peripheral.addr = msgs[i].addr;
+
++ ret = geni_i2c_gpi(gi2c, &msgs[i], &config,
++ &tx_addr, &tx_buf, I2C_WRITE, gi2c->tx_c);
++ if (ret)
++ goto err;
++
+ if (msgs[i].flags & I2C_M_RD) {
+ ret = geni_i2c_gpi(gi2c, &msgs[i], &config,
+ &rx_addr, &rx_buf, I2C_READ, gi2c->rx_c);
+ if (ret)
+ goto err;
+- }
+-
+- ret = geni_i2c_gpi(gi2c, &msgs[i], &config,
+- &tx_addr, &tx_buf, I2C_WRITE, gi2c->tx_c);
+- if (ret)
+- goto err;
+
+- if (msgs[i].flags & I2C_M_RD)
+ dma_async_issue_pending(gi2c->rx_c);
++ }
++
+ dma_async_issue_pending(gi2c->tx_c);
+
+ timeout = wait_for_completion_timeout(&gi2c->done, XFER_TIMEOUT);
+--
+2.43.0
+
--- /dev/null
+From 63d767b69aa7279f9de202f8b7c3fd75eb9ce341 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Feb 2024 15:20:06 +0200
+Subject: iio: adc: ad4130: only set GPIO_CTRL if pin is unused
+
+From: Cosmin Tanislav <demonsingur@gmail.com>
+
+[ Upstream commit 78367c32bebfe833cd30c855755d863a4ff3fdee ]
+
+Currently, GPIO_CTRL bits are set even if the pins are used for
+measurements.
+
+GPIO_CTRL bits should only be set if the pin is not used for
+other functionality.
+
+Fix this by only setting the GPIO_CTRL bits if the pin has no
+other function.
+
+Fixes: 62094060cf3a ("iio: adc: ad4130: add AD4130 driver")
+Signed-off-by: Cosmin Tanislav <demonsingur@gmail.com>
+Reviewed-by: Nuno Sa <nuno.sa@analog.com>
+Link: https://lore.kernel.org/r/20240207132007.253768-2-demonsingur@gmail.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/ad4130.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iio/adc/ad4130.c b/drivers/iio/adc/ad4130.c
+index bbdae66d1f1d..e650ebd167b0 100644
+--- a/drivers/iio/adc/ad4130.c
++++ b/drivers/iio/adc/ad4130.c
+@@ -1900,10 +1900,14 @@ static int ad4130_setup(struct iio_dev *indio_dev)
+ return ret;
+
+ /*
+- * Configure all GPIOs for output. If configured, the interrupt function
+- * of P2 takes priority over the GPIO out function.
++ * Configure unused GPIOs for output. If configured, the interrupt
++ * function of P2 takes priority over the GPIO out function.
+ */
+- val = AD4130_IO_CONTROL_GPIO_CTRL_MASK;
++ val = 0;
++ for (i = 0; i < AD4130_MAX_GPIOS; i++)
++ if (st->pins_fn[i + AD4130_AIN2_P1] == AD4130_PIN_FN_NONE)
++ val |= FIELD_PREP(AD4130_IO_CONTROL_GPIO_CTRL_MASK, BIT(i));
++
+ val |= FIELD_PREP(AD4130_IO_CONTROL_INT_PIN_SEL_MASK, st->int_pin_sel);
+
+ ret = regmap_write(st->regmap, AD4130_IO_CONTROL_REG, val);
+--
+2.43.0
+
--- /dev/null
+From e653d8b6e4ba4319fb1bd8ad673941552d4cbbff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Feb 2024 15:20:05 +0200
+Subject: iio: adc: ad4130: zero-initialize clock init data
+
+From: Cosmin Tanislav <demonsingur@gmail.com>
+
+[ Upstream commit a22b0a2be69a36511cb5b37d948b651ddf7debf3 ]
+
+The clk_init_data struct does not have all its members
+initialized, causing issues when trying to expose the internal
+clock on the CLK pin.
+
+Fix this by zero-initializing the clk_init_data struct.
+
+Fixes: 62094060cf3a ("iio: adc: ad4130: add AD4130 driver")
+Signed-off-by: Cosmin Tanislav <demonsingur@gmail.com>
+Reviewed-by: Nuno Sa <nuno.sa@analog.com>
+Link: https://lore.kernel.org/r/20240207132007.253768-1-demonsingur@gmail.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/ad4130.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/adc/ad4130.c b/drivers/iio/adc/ad4130.c
+index 5a5dd5e87ffc..bbdae66d1f1d 100644
+--- a/drivers/iio/adc/ad4130.c
++++ b/drivers/iio/adc/ad4130.c
+@@ -1826,7 +1826,7 @@ static int ad4130_setup_int_clk(struct ad4130_state *st)
+ {
+ struct device *dev = &st->spi->dev;
+ struct device_node *of_node = dev_of_node(dev);
+- struct clk_init_data init;
++ struct clk_init_data init = {};
+ const char *clk_name;
+ struct clk *clk;
+ int ret;
+--
+2.43.0
+
--- /dev/null
+From 7652063ccb0be1a497cca9335cabf66c0601a06a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jan 2024 15:16:26 +0200
+Subject: interconnect: qcom: sc8180x: Mark CO0 BCM keepalive
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 85e985a4f46e462a37f1875cb74ed380e7c0c2e0 ]
+
+The CO0 BCM needs to be up at all times, otherwise some hardware (like
+the UFS controller) loses its connection to the rest of the SoC,
+resulting in a hang of the platform, accompanied by a spectacular
+logspam.
+
+Mark it as keepalive to prevent such cases.
+
+Fixes: 9c8c6bac1ae8 ("interconnect: qcom: Add SC8180x providers")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231214-topic-sc8180_fixes-v1-1-421904863006@linaro.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/sc8180x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/interconnect/qcom/sc8180x.c b/drivers/interconnect/qcom/sc8180x.c
+index bdd3471d4ac8..a741badaa966 100644
+--- a/drivers/interconnect/qcom/sc8180x.c
++++ b/drivers/interconnect/qcom/sc8180x.c
+@@ -1372,6 +1372,7 @@ static struct qcom_icc_bcm bcm_mm0 = {
+
+ static struct qcom_icc_bcm bcm_co0 = {
+ .name = "CO0",
++ .keepalive = true,
+ .num_nodes = 1,
+ .nodes = { &slv_qns_cdsp_mem_noc }
+ };
+--
+2.43.0
+
--- /dev/null
+From fd4cca86ff147095c91ec173bb4322d57be5a8b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jan 2024 15:16:46 +0200
+Subject: interconnect: qcom: sm8550: Enable sync_state
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 24406f6794aa631516241deb9e19de333d6a0600 ]
+
+To ensure the interconnect votes are actually meaningful and in order to
+prevent holding all buses at FMAX, introduce the sync state callback.
+
+Fixes: e6f0d6a30f73 ("interconnect: qcom: Add SM8550 interconnect provider driver")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20231218-topic-8550_fixes-v1-2-ce1272d77540@linaro.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/sm8550.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/interconnect/qcom/sm8550.c b/drivers/interconnect/qcom/sm8550.c
+index a10c8b6549ee..16b2dfd794b4 100644
+--- a/drivers/interconnect/qcom/sm8550.c
++++ b/drivers/interconnect/qcom/sm8550.c
+@@ -2223,6 +2223,7 @@ static struct platform_driver qnoc_driver = {
+ .driver = {
+ .name = "qnoc-sm8550",
+ .of_match_table = qnoc_of_match,
++ .sync_state = icc_sync_state,
+ },
+ };
+
+--
+2.43.0
+
--- /dev/null
+From a97b58ff81fb34d375a25cb61428dd37e02ccf83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 10:12:04 +0000
+Subject: irqchip/gic-v3-its: Handle non-coherent GICv4 redistributors
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit 846297e11e8ae428f8b00156a0cfe2db58100702 ]
+
+Although the GICv3 code base has gained some handling of systems failing to
+handle the shareability attributes, the GICv4 side of things has been
+firmly ignored.
+
+This is unfortunate, as the new recent addition of the "dma-noncoherent" is
+supposed to apply to all of the GICR tables, and not just the ones that are
+common to v3 and v4.
+
+Add some checks to handle the VPROPBASE/VPENDBASE shareability and
+cacheability attributes in the same way we deal with the other GICR_BASE
+registers, wrapping the flag check in a helper for improved readability.
+
+Note that this has been found by inspection only, as I don't have access to
+HW that suffers from this particular issue.
+
+Fixes: 3a0fff0fb6a3 ("irqchip/gic-v3: Enable non-coherent redistributors/ITSes DT probing")
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Link: https://lore.kernel.org/r/20240213101206.2137483-2-maz@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v3-its.c | 37 +++++++++++++++++++++-----------
+ 1 file changed, 25 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index 9a7a74239eab..bdc2c8330479 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -207,6 +207,11 @@ static bool require_its_list_vmovp(struct its_vm *vm, struct its_node *its)
+ return (gic_rdists->has_rvpeid || vm->vlpi_count[its->list_nr]);
+ }
+
++static bool rdists_support_shareable(void)
++{
++ return !(gic_rdists->flags & RDIST_FLAGS_FORCE_NON_SHAREABLE);
++}
++
+ static u16 get_its_list(struct its_vm *vm)
+ {
+ struct its_node *its;
+@@ -2710,10 +2715,12 @@ static u64 inherit_vpe_l1_table_from_its(void)
+ break;
+ }
+ val |= FIELD_PREP(GICR_VPROPBASER_4_1_ADDR, addr >> 12);
+- val |= FIELD_PREP(GICR_VPROPBASER_SHAREABILITY_MASK,
+- FIELD_GET(GITS_BASER_SHAREABILITY_MASK, baser));
+- val |= FIELD_PREP(GICR_VPROPBASER_INNER_CACHEABILITY_MASK,
+- FIELD_GET(GITS_BASER_INNER_CACHEABILITY_MASK, baser));
++ if (rdists_support_shareable()) {
++ val |= FIELD_PREP(GICR_VPROPBASER_SHAREABILITY_MASK,
++ FIELD_GET(GITS_BASER_SHAREABILITY_MASK, baser));
++ val |= FIELD_PREP(GICR_VPROPBASER_INNER_CACHEABILITY_MASK,
++ FIELD_GET(GITS_BASER_INNER_CACHEABILITY_MASK, baser));
++ }
+ val |= FIELD_PREP(GICR_VPROPBASER_4_1_SIZE, GITS_BASER_NR_PAGES(baser) - 1);
+
+ return val;
+@@ -2936,8 +2943,10 @@ static int allocate_vpe_l1_table(void)
+ WARN_ON(!IS_ALIGNED(pa, psz));
+
+ val |= FIELD_PREP(GICR_VPROPBASER_4_1_ADDR, pa >> 12);
+- val |= GICR_VPROPBASER_RaWb;
+- val |= GICR_VPROPBASER_InnerShareable;
++ if (rdists_support_shareable()) {
++ val |= GICR_VPROPBASER_RaWb;
++ val |= GICR_VPROPBASER_InnerShareable;
++ }
+ val |= GICR_VPROPBASER_4_1_Z;
+ val |= GICR_VPROPBASER_4_1_VALID;
+
+@@ -3126,7 +3135,7 @@ static void its_cpu_init_lpis(void)
+ gicr_write_propbaser(val, rbase + GICR_PROPBASER);
+ tmp = gicr_read_propbaser(rbase + GICR_PROPBASER);
+
+- if (gic_rdists->flags & RDIST_FLAGS_FORCE_NON_SHAREABLE)
++ if (!rdists_support_shareable())
+ tmp &= ~GICR_PROPBASER_SHAREABILITY_MASK;
+
+ if ((tmp ^ val) & GICR_PROPBASER_SHAREABILITY_MASK) {
+@@ -3153,7 +3162,7 @@ static void its_cpu_init_lpis(void)
+ gicr_write_pendbaser(val, rbase + GICR_PENDBASER);
+ tmp = gicr_read_pendbaser(rbase + GICR_PENDBASER);
+
+- if (gic_rdists->flags & RDIST_FLAGS_FORCE_NON_SHAREABLE)
++ if (!rdists_support_shareable())
+ tmp &= ~GICR_PENDBASER_SHAREABILITY_MASK;
+
+ if (!(tmp & GICR_PENDBASER_SHAREABILITY_MASK)) {
+@@ -3880,14 +3889,18 @@ static void its_vpe_schedule(struct its_vpe *vpe)
+ val = virt_to_phys(page_address(vpe->its_vm->vprop_page)) &
+ GENMASK_ULL(51, 12);
+ val |= (LPI_NRBITS - 1) & GICR_VPROPBASER_IDBITS_MASK;
+- val |= GICR_VPROPBASER_RaWb;
+- val |= GICR_VPROPBASER_InnerShareable;
++ if (rdists_support_shareable()) {
++ val |= GICR_VPROPBASER_RaWb;
++ val |= GICR_VPROPBASER_InnerShareable;
++ }
+ gicr_write_vpropbaser(val, vlpi_base + GICR_VPROPBASER);
+
+ val = virt_to_phys(page_address(vpe->vpt_page)) &
+ GENMASK_ULL(51, 16);
+- val |= GICR_VPENDBASER_RaWaWb;
+- val |= GICR_VPENDBASER_InnerShareable;
++ if (rdists_support_shareable()) {
++ val |= GICR_VPENDBASER_RaWaWb;
++ val |= GICR_VPENDBASER_InnerShareable;
++ }
+ /*
+ * There is no good way of finding out if the pending table is
+ * empty as we can race against the doorbell interrupt very
+--
+2.43.0
+
--- /dev/null
+From d592798d60bb09be715e9c3cebceb480551b583a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jan 2024 16:27:20 +0800
+Subject: irqchip/loongson-eiointc: Use correct struct type in
+ eiointc_domain_alloc()
+
+From: Bibo Mao <maobibo@loongson.cn>
+
+[ Upstream commit f1c2765c6afcd1f71f76ed8c9bf94acedab4cecb ]
+
+eiointc_domain_alloc() uses struct eiointc, which is not defined, for a
+pointer. Older compilers treat that as a forward declaration and due to
+assignment of a void pointer there is no warning emitted. As the variable
+is then handed in as a void pointer argument to irq_domain_set_info() the
+code is functional.
+
+Use struct eiointc_priv instead.
+
+[ tglx: Rewrote changelog ]
+
+Fixes: dd281e1a1a93 ("irqchip: Add Loongson Extended I/O interrupt controller support")
+Signed-off-by: Bibo Mao <maobibo@loongson.cn>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Huacai Chen <chenhuacai@loongson.cn>
+Link: https://lore.kernel.org/r/20240130082722.2912576-2-maobibo@loongson.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-loongson-eiointc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-loongson-eiointc.c b/drivers/irqchip/irq-loongson-eiointc.c
+index 1623cd779175..b3736bdd4b9f 100644
+--- a/drivers/irqchip/irq-loongson-eiointc.c
++++ b/drivers/irqchip/irq-loongson-eiointc.c
+@@ -241,7 +241,7 @@ static int eiointc_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ int ret;
+ unsigned int i, type;
+ unsigned long hwirq = 0;
+- struct eiointc *priv = domain->host_data;
++ struct eiointc_priv *priv = domain->host_data;
+
+ ret = irq_domain_translate_onecell(domain, arg, &hwirq, &type);
+ if (ret)
+--
+2.43.0
+
--- /dev/null
+From 29ee2b2c4a990a2d62ae1b412c34daac4ce77530 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Feb 2024 09:32:08 +0100
+Subject: kallsyms: ignore ARMv4 thunks along with others
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit a951884d82886d8453d489f84f20ac168d062b38 ]
+
+lld is now able to build ARMv4 and ARMv4T kernels, which means it can
+generate thunks for those (__ARMv4PILongThunk_*, __ARMv4PILongBXThunk_*)
+that can interfere with kallsyms table generation since they do not get
+ignore like the corresponding ARMv5+ ones are:
+
+Inconsistent kallsyms data
+Try "make KALLSYMS_EXTRA_PASS=1" as a workaround
+
+Replace the hardcoded list of thunk symbols with a more general regex that
+covers this one along with future symbols that follow the same pattern.
+
+Fixes: 5eb6e280432d ("ARM: 9289/1: Allow pre-ARMv5 builds with ld.lld 16.0.0 and newer")
+Fixes: efe6e3068067 ("kallsyms: fix nonconverging kallsyms table with lld")
+Suggested-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/mksysmap | 13 ++-----------
+ 1 file changed, 2 insertions(+), 11 deletions(-)
+
+diff --git a/scripts/mksysmap b/scripts/mksysmap
+index 9ba1c9da0a40..57ff5656d566 100755
+--- a/scripts/mksysmap
++++ b/scripts/mksysmap
+@@ -48,17 +48,8 @@ ${NM} -n ${1} | sed >${2} -e "
+ / __kvm_nvhe_\\$/d
+ / __kvm_nvhe_\.L/d
+
+-# arm64 lld
+-/ __AArch64ADRPThunk_/d
+-
+-# arm lld
+-/ __ARMV5PILongThunk_/d
+-/ __ARMV7PILongThunk_/d
+-/ __ThumbV7PILongThunk_/d
+-
+-# mips lld
+-/ __LA25Thunk_/d
+-/ __microLA25Thunk_/d
++# lld arm/aarch64/mips thunks
++/ __[[:alnum:]]*Thunk_/d
+
+ # CFI type identifiers
+ / __kcfi_typeid_/d
+--
+2.43.0
+
--- /dev/null
+From a7d823f50dfa7209e945e632fddd5e4f027bc2bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jan 2024 09:14:19 +0100
+Subject: media: ir_toy: fix a memleak in irtoy_tx
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit dc9ceb90c4b42c6e5c6757df1d6257110433788e ]
+
+When irtoy_command fails, buf should be freed since it is allocated by
+irtoy_tx, or there is a memleak.
+
+Fixes: 4114978dcd24 ("media: ir_toy: prevent device from hanging during transmit")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/ir_toy.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/rc/ir_toy.c b/drivers/media/rc/ir_toy.c
+index 196806709259..69e630d85262 100644
+--- a/drivers/media/rc/ir_toy.c
++++ b/drivers/media/rc/ir_toy.c
+@@ -332,6 +332,7 @@ static int irtoy_tx(struct rc_dev *rc, uint *txbuf, uint count)
+ sizeof(COMMAND_SMODE_EXIT), STATE_COMMAND_NO_RESP);
+ if (err) {
+ dev_err(irtoy->dev, "exit sample mode: %d\n", err);
++ kfree(buf);
+ return err;
+ }
+
+@@ -339,6 +340,7 @@ static int irtoy_tx(struct rc_dev *rc, uint *txbuf, uint count)
+ sizeof(COMMAND_SMODE_ENTER), STATE_COMMAND);
+ if (err) {
+ dev_err(irtoy->dev, "enter sample mode: %d\n", err);
++ kfree(buf);
+ return err;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From f5f0ff7e77a9e97786e17a498a2cbce3602aea2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Feb 2024 10:14:07 +0100
+Subject: modpost: trim leading spaces when processing source files list
+
+From: Radek Krejci <radek.krejci@oracle.com>
+
+[ Upstream commit 5d9a16b2a4d9e8fa028892ded43f6501bc2969e5 ]
+
+get_line() does not trim the leading spaces, but the
+parse_source_files() expects to get lines with source files paths where
+the first space occurs after the file path.
+
+Fixes: 70f30cfe5b89 ("modpost: use read_text_file() and get_line() for reading text files")
+Signed-off-by: Radek Krejci <radek.krejci@oracle.com>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/mod/sumversion.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/mod/sumversion.c b/scripts/mod/sumversion.c
+index 31066bfdba04..dc4878502276 100644
+--- a/scripts/mod/sumversion.c
++++ b/scripts/mod/sumversion.c
+@@ -326,7 +326,12 @@ static int parse_source_files(const char *objfile, struct md4_ctx *md)
+
+ /* Sum all files in the same dir or subdirs. */
+ while ((line = get_line(&pos))) {
+- char* p = line;
++ char* p;
++
++ /* trim the leading spaces away */
++ while (isspace(*line))
++ line++;
++ p = line;
+
+ if (strncmp(line, "source_", sizeof("source_")-1) == 0) {
+ p = strrchr(line, ' ');
+--
+2.43.0
+
--- /dev/null
+From b1a86f1dcf68fc3fa015b77a1b3ebc1f0ae1ae60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jan 2024 11:55:31 -0700
+Subject: PCI: Fix active state requirement in PME polling
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+[ Upstream commit 41044d5360685e78a869d40a168491a70cdb7e73 ]
+
+The commit noted in fixes added a bogus requirement that runtime PM managed
+devices need to be in the RPM_ACTIVE state for PME polling. In fact, only
+devices in low power states should be polled.
+
+However there's still a requirement that the device config space must be
+accessible, which has implications for both the current state of the polled
+device and the parent bridge, when present. It's not sufficient to assume
+the bridge remains in D0 and cases have been observed where the bridge
+passes the D0 test, but the PM state indicates RPM_SUSPENDING and config
+space of the polled device becomes inaccessible during pci_pme_wakeup().
+
+Therefore, since the bridge is already effectively required to be in the
+RPM_ACTIVE state, formalize this in the code and elevate the PM usage count
+to maintain the state while polling the subordinate device.
+
+This resolves a regression reported in the bugzilla below where a
+Thunderbolt/USB4 hierarchy fails to scan for an attached NVMe endpoint
+downstream of a bridge in a D3hot power state.
+
+Link: https://lore.kernel.org/r/20240123185548.1040096-1-alex.williamson@redhat.com
+Fixes: d3fcd7360338 ("PCI: Fix runtime PM race with PME polling")
+Reported-by: Sanath S <sanath.s@amd.com>
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218360
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Tested-by: Sanath S <sanath.s@amd.com>
+Reviewed-by: Rafael J. Wysocki <rafael@kernel.org>
+Cc: Lukas Wunner <lukas@wunner.de>
+Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 37 ++++++++++++++++++++++---------------
+ 1 file changed, 22 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 59d6cb1a3a9d..06fc6f532d6c 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -2434,29 +2434,36 @@ static void pci_pme_list_scan(struct work_struct *work)
+ if (pdev->pme_poll) {
+ struct pci_dev *bridge = pdev->bus->self;
+ struct device *dev = &pdev->dev;
+- int pm_status;
++ struct device *bdev = bridge ? &bridge->dev : NULL;
++ int bref = 0;
+
+ /*
+- * If bridge is in low power state, the
+- * configuration space of subordinate devices
+- * may be not accessible
++ * If we have a bridge, it should be in an active/D0
++ * state or the configuration space of subordinate
++ * devices may not be accessible or stable over the
++ * course of the call.
+ */
+- if (bridge && bridge->current_state != PCI_D0)
+- continue;
++ if (bdev) {
++ bref = pm_runtime_get_if_active(bdev, true);
++ if (!bref)
++ continue;
++
++ if (bridge->current_state != PCI_D0)
++ goto put_bridge;
++ }
+
+ /*
+- * If the device is in a low power state it
+- * should not be polled either.
++ * The device itself should be suspended but config
++ * space must be accessible, therefore it cannot be in
++ * D3cold.
+ */
+- pm_status = pm_runtime_get_if_active(dev, true);
+- if (!pm_status)
+- continue;
+-
+- if (pdev->current_state != PCI_D3cold)
++ if (pm_runtime_suspended(dev) &&
++ pdev->current_state != PCI_D3cold)
+ pci_pme_wakeup(pdev, NULL);
+
+- if (pm_status > 0)
+- pm_runtime_put(dev);
++put_bridge:
++ if (bref > 0)
++ pm_runtime_put(bdev);
+ } else {
+ list_del(&pme_dev->list);
+ kfree(pme_dev);
+--
+2.43.0
+
--- /dev/null
+From ed78b4a4d36b2f5b9ccca16012141e1b85230046 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jan 2024 11:38:38 +0100
+Subject: powerpc/6xx: set High BAT Enable flag on G2_LE cores
+
+From: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+
+[ Upstream commit a038a3ff8c6582404834852c043dadc73a5b68b4 ]
+
+MMU_FTR_USE_HIGH_BATS is set for G2_LE cores and derivatives like e300cX,
+but the high BATs need to be enabled in HID2 to work. Add register
+definitions and add the needed setup to __setup_cpu_603.
+
+This fixes boot on CPUs like the MPC5200B with STRICT_KERNEL_RWX enabled
+on systems where the flag has not been set by the bootloader already.
+
+Fixes: e4d6654ebe6e ("powerpc/mm/32s: rework mmu_mapin_ram()")
+Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20240124103838.43675-1-matthias.schiffer@ew.tq-group.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/reg.h | 2 ++
+ arch/powerpc/kernel/cpu_setup_6xx.S | 20 +++++++++++++++++++-
+ 2 files changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
+index 4ae4ab9090a2..ade5f094dbd2 100644
+--- a/arch/powerpc/include/asm/reg.h
++++ b/arch/powerpc/include/asm/reg.h
+@@ -617,6 +617,8 @@
+ #endif
+ #define SPRN_HID2 0x3F8 /* Hardware Implementation Register 2 */
+ #define SPRN_HID2_GEKKO 0x398 /* Gekko HID2 Register */
++#define SPRN_HID2_G2_LE 0x3F3 /* G2_LE HID2 Register */
++#define HID2_G2_LE_HBE (1<<18) /* High BAT Enable (G2_LE) */
+ #define SPRN_IABR 0x3F2 /* Instruction Address Breakpoint Register */
+ #define SPRN_IABR2 0x3FA /* 83xx */
+ #define SPRN_IBCR 0x135 /* 83xx Insn Breakpoint Control Reg */
+diff --git a/arch/powerpc/kernel/cpu_setup_6xx.S b/arch/powerpc/kernel/cpu_setup_6xx.S
+index f29ce3dd6140..bfd3f442e5eb 100644
+--- a/arch/powerpc/kernel/cpu_setup_6xx.S
++++ b/arch/powerpc/kernel/cpu_setup_6xx.S
+@@ -26,6 +26,15 @@ BEGIN_FTR_SECTION
+ bl __init_fpu_registers
+ END_FTR_SECTION_IFCLR(CPU_FTR_FPU_UNAVAILABLE)
+ bl setup_common_caches
++
++ /*
++ * This assumes that all cores using __setup_cpu_603 with
++ * MMU_FTR_USE_HIGH_BATS are G2_LE compatible
++ */
++BEGIN_MMU_FTR_SECTION
++ bl setup_g2_le_hid2
++END_MMU_FTR_SECTION_IFSET(MMU_FTR_USE_HIGH_BATS)
++
+ mtlr r5
+ blr
+ _GLOBAL(__setup_cpu_604)
+@@ -115,6 +124,16 @@ SYM_FUNC_START_LOCAL(setup_604_hid0)
+ blr
+ SYM_FUNC_END(setup_604_hid0)
+
++/* Enable high BATs for G2_LE and derivatives like e300cX */
++SYM_FUNC_START_LOCAL(setup_g2_le_hid2)
++ mfspr r11,SPRN_HID2_G2_LE
++ oris r11,r11,HID2_G2_LE_HBE@h
++ mtspr SPRN_HID2_G2_LE,r11
++ sync
++ isync
++ blr
++SYM_FUNC_END(setup_g2_le_hid2)
++
+ /* 7400 <= rev 2.7 and 7410 rev = 1.0 suffer from some
+ * erratas we work around here.
+ * Moto MPC710CE.pdf describes them, those are errata
+@@ -495,4 +514,3 @@ _GLOBAL(__restore_cpu_setup)
+ mtcr r7
+ blr
+ _ASM_NOKPROBE_SYMBOL(__restore_cpu_setup)
+-
+--
+2.43.0
+
--- /dev/null
+From 01b22d1edacbebd413ff3293faf96102f542bfbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jan 2024 09:45:59 +0800
+Subject: powerpc/kasan: Fix addr error caused by page alignment
+
+From: Jiangfeng Xiao <xiaojiangfeng@huawei.com>
+
+[ Upstream commit 4a7aee96200ad281a5cc4cf5c7a2e2a49d2b97b0 ]
+
+In kasan_init_region, when k_start is not page aligned, at the begin of
+for loop, k_cur = k_start & PAGE_MASK is less than k_start, and then
+`va = block + k_cur - k_start` is less than block, the addr va is invalid,
+because the memory address space from va to block is not alloced by
+memblock_alloc, which will not be reserved by memblock_reserve later, it
+will be used by other places.
+
+As a result, memory overwriting occurs.
+
+for example:
+int __init __weak kasan_init_region(void *start, size_t size)
+{
+[...]
+ /* if say block(dcd97000) k_start(feef7400) k_end(feeff3fe) */
+ block = memblock_alloc(k_end - k_start, PAGE_SIZE);
+ [...]
+ for (k_cur = k_start & PAGE_MASK; k_cur < k_end; k_cur += PAGE_SIZE) {
+ /* at the begin of for loop
+ * block(dcd97000) va(dcd96c00) k_cur(feef7000) k_start(feef7400)
+ * va(dcd96c00) is less than block(dcd97000), va is invalid
+ */
+ void *va = block + k_cur - k_start;
+ [...]
+ }
+[...]
+}
+
+Therefore, page alignment is performed on k_start before
+memblock_alloc() to ensure the validity of the VA address.
+
+Fixes: 663c0c9496a6 ("powerpc/kasan: Fix shadow area set up for modules.")
+Signed-off-by: Jiangfeng Xiao <xiaojiangfeng@huawei.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/1705974359-43790-1-git-send-email-xiaojiangfeng@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/kasan/init_32.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/mm/kasan/init_32.c b/arch/powerpc/mm/kasan/init_32.c
+index a70828a6d935..aa9aa11927b2 100644
+--- a/arch/powerpc/mm/kasan/init_32.c
++++ b/arch/powerpc/mm/kasan/init_32.c
+@@ -64,6 +64,7 @@ int __init __weak kasan_init_region(void *start, size_t size)
+ if (ret)
+ return ret;
+
++ k_start = k_start & PAGE_MASK;
+ block = memblock_alloc(k_end - k_start, PAGE_SIZE);
+ if (!block)
+ return -ENOMEM;
+--
+2.43.0
+
--- /dev/null
+From b34bc3cbd03c000a1654eedfb0bc2655eccc9c5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Feb 2024 17:42:44 +1100
+Subject: powerpc/kasan: Limit KASAN thread size increase to 32KB
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit f1acb109505d983779bbb7e20a1ee6244d2b5736 ]
+
+KASAN is seen to increase stack usage, to the point that it was reported
+to lead to stack overflow on some 32-bit machines (see link).
+
+To avoid overflows the stack size was doubled for KASAN builds in
+commit 3e8635fb2e07 ("powerpc/kasan: Force thread size increase with
+KASAN").
+
+However with a 32KB stack size to begin with, the doubling leads to a
+64KB stack, which causes build errors:
+ arch/powerpc/kernel/switch.S:249: Error: operand out of range (0x000000000000fe50 is not between 0xffffffffffff8000 and 0x0000000000007fff)
+
+Although the asm could be reworked, in practice a 32KB stack seems
+sufficient even for KASAN builds - the additional usage seems to be in
+the 2-3KB range for a 64-bit KASAN build.
+
+So only increase the stack for KASAN if the stack size is < 32KB.
+
+Fixes: 18f14afe2816 ("powerpc/64s: Increase default stack size to 32KB")
+Reported-by: Spoorthy <spoorthy@linux.ibm.com>
+Reported-by: Benjamin Gray <bgray@linux.ibm.com>
+Reviewed-by: Benjamin Gray <bgray@linux.ibm.com>
+Link: https://lore.kernel.org/linuxppc-dev/bug-207129-206035@https.bugzilla.kernel.org%2F/
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20240212064244.3924505-1-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/thread_info.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/include/asm/thread_info.h b/arch/powerpc/include/asm/thread_info.h
+index bf5dde1a4114..15c5691dd218 100644
+--- a/arch/powerpc/include/asm/thread_info.h
++++ b/arch/powerpc/include/asm/thread_info.h
+@@ -14,7 +14,7 @@
+
+ #ifdef __KERNEL__
+
+-#ifdef CONFIG_KASAN
++#if defined(CONFIG_KASAN) && CONFIG_THREAD_SHIFT < 15
+ #define MIN_THREAD_SHIFT (CONFIG_THREAD_SHIFT + 1)
+ #else
+ #define MIN_THREAD_SHIFT CONFIG_THREAD_SHIFT
+--
+2.43.0
+
--- /dev/null
+From 4dd8aa8da0f38ce395feb16cf3f1223c27f1b9f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jan 2024 16:24:07 -0600
+Subject: powerpc/pseries/iommu: Fix iommu initialisation during DLPAR add
+
+From: Gaurav Batra <gbatra@linux.ibm.com>
+
+[ Upstream commit ed8b94f6e0acd652ce69bd69d678a0c769172df8 ]
+
+When a PCI device is dynamically added, the kernel oopses with a NULL
+pointer dereference:
+
+ BUG: Kernel NULL pointer dereference on read at 0x00000030
+ Faulting instruction address: 0xc0000000006bbe5c
+ Oops: Kernel access of bad area, sig: 11 [#1]
+ LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries
+ Modules linked in: rpadlpar_io rpaphp rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs xsk_diag bonding nft_compat nf_tables nfnetlink rfkill binfmt_misc dm_multipath rpcrdma sunrpc rdma_ucm ib_srpt ib_isert iscsi_target_mod target_core_mod ib_umad ib_iser libiscsi scsi_transport_iscsi ib_ipoib rdma_cm iw_cm ib_cm mlx5_ib ib_uverbs ib_core pseries_rng drm drm_panel_orientation_quirks xfs libcrc32c mlx5_core mlxfw sd_mod t10_pi sg tls ibmvscsi ibmveth scsi_transport_srp vmx_crypto pseries_wdt psample dm_mirror dm_region_hash dm_log dm_mod fuse
+ CPU: 17 PID: 2685 Comm: drmgr Not tainted 6.7.0-203405+ #66
+ Hardware name: IBM,9080-HEX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_008) hv:phyp pSeries
+ NIP: c0000000006bbe5c LR: c000000000a13e68 CTR: c0000000000579f8
+ REGS: c00000009924f240 TRAP: 0300 Not tainted (6.7.0-203405+)
+ MSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 24002220 XER: 20040006
+ CFAR: c000000000a13e64 DAR: 0000000000000030 DSISR: 40000000 IRQMASK: 0
+ ...
+ NIP sysfs_add_link_to_group+0x34/0x94
+ LR iommu_device_link+0x5c/0x118
+ Call Trace:
+ iommu_init_device+0x26c/0x318 (unreliable)
+ iommu_device_link+0x5c/0x118
+ iommu_init_device+0xa8/0x318
+ iommu_probe_device+0xc0/0x134
+ iommu_bus_notifier+0x44/0x104
+ notifier_call_chain+0xb8/0x19c
+ blocking_notifier_call_chain+0x64/0x98
+ bus_notify+0x50/0x7c
+ device_add+0x640/0x918
+ pci_device_add+0x23c/0x298
+ of_create_pci_dev+0x400/0x884
+ of_scan_pci_dev+0x124/0x1b0
+ __of_scan_bus+0x78/0x18c
+ pcibios_scan_phb+0x2a4/0x3b0
+ init_phb_dynamic+0xb8/0x110
+ dlpar_add_slot+0x170/0x3b8 [rpadlpar_io]
+ add_slot_store.part.0+0xb4/0x130 [rpadlpar_io]
+ kobj_attr_store+0x2c/0x48
+ sysfs_kf_write+0x64/0x78
+ kernfs_fop_write_iter+0x1b0/0x290
+ vfs_write+0x350/0x4a0
+ ksys_write+0x84/0x140
+ system_call_exception+0x124/0x330
+ system_call_vectored_common+0x15c/0x2ec
+
+Commit a940904443e4 ("powerpc/iommu: Add iommu_ops to report capabilities
+and allow blocking domains") broke DLPAR add of PCI devices.
+
+The above added iommu_device structure to pci_controller. During
+system boot, PCI devices are discovered and this newly added iommu_device
+structure is initialized by a call to iommu_device_register().
+
+During DLPAR add of a PCI device, a new pci_controller structure is
+allocated but there are no calls made to iommu_device_register()
+interface.
+
+Fix is to register the iommu device during DLPAR add as well.
+
+Fixes: a940904443e4 ("powerpc/iommu: Add iommu_ops to report capabilities and allow blocking domains")
+Signed-off-by: Gaurav Batra <gbatra@linux.ibm.com>
+[mpe: Trim oops and tweak some change log wording]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20240122222407.39603-1-gbatra@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/ppc-pci.h | 3 +++
+ arch/powerpc/kernel/iommu.c | 21 ++++++++++++++++-----
+ arch/powerpc/platforms/pseries/pci_dlpar.c | 4 ++++
+ 3 files changed, 23 insertions(+), 5 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/ppc-pci.h b/arch/powerpc/include/asm/ppc-pci.h
+index d9fcff575027..e500a7b9d1b5 100644
+--- a/arch/powerpc/include/asm/ppc-pci.h
++++ b/arch/powerpc/include/asm/ppc-pci.h
+@@ -29,6 +29,9 @@ void *pci_traverse_device_nodes(struct device_node *start,
+ void *(*fn)(struct device_node *, void *),
+ void *data);
+ extern void pci_devs_phb_init_dynamic(struct pci_controller *phb);
++extern void ppc_iommu_register_device(struct pci_controller *phb);
++extern void ppc_iommu_unregister_device(struct pci_controller *phb);
++
+
+ /* From rtas_pci.h */
+ extern void init_pci_config_tokens (void);
+diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
+index 14251bc5219e..7e23cc03c06c 100644
+--- a/arch/powerpc/kernel/iommu.c
++++ b/arch/powerpc/kernel/iommu.c
+@@ -1393,6 +1393,21 @@ static const struct attribute_group *spapr_tce_iommu_groups[] = {
+ NULL,
+ };
+
++void ppc_iommu_register_device(struct pci_controller *phb)
++{
++ iommu_device_sysfs_add(&phb->iommu, phb->parent,
++ spapr_tce_iommu_groups, "iommu-phb%04x",
++ phb->global_number);
++ iommu_device_register(&phb->iommu, &spapr_tce_iommu_ops,
++ phb->parent);
++}
++
++void ppc_iommu_unregister_device(struct pci_controller *phb)
++{
++ iommu_device_unregister(&phb->iommu);
++ iommu_device_sysfs_remove(&phb->iommu);
++}
++
+ /*
+ * This registers IOMMU devices of PHBs. This needs to happen
+ * after core_initcall(iommu_init) + postcore_initcall(pci_driver_init) and
+@@ -1403,11 +1418,7 @@ static int __init spapr_tce_setup_phb_iommus_initcall(void)
+ struct pci_controller *hose;
+
+ list_for_each_entry(hose, &hose_list, list_node) {
+- iommu_device_sysfs_add(&hose->iommu, hose->parent,
+- spapr_tce_iommu_groups, "iommu-phb%04x",
+- hose->global_number);
+- iommu_device_register(&hose->iommu, &spapr_tce_iommu_ops,
+- hose->parent);
++ ppc_iommu_register_device(hose);
+ }
+ return 0;
+ }
+diff --git a/arch/powerpc/platforms/pseries/pci_dlpar.c b/arch/powerpc/platforms/pseries/pci_dlpar.c
+index 4ba824568119..4448386268d9 100644
+--- a/arch/powerpc/platforms/pseries/pci_dlpar.c
++++ b/arch/powerpc/platforms/pseries/pci_dlpar.c
+@@ -35,6 +35,8 @@ struct pci_controller *init_phb_dynamic(struct device_node *dn)
+
+ pseries_msi_allocate_domains(phb);
+
++ ppc_iommu_register_device(phb);
++
+ /* Create EEH devices for the PHB */
+ eeh_phb_pe_create(phb);
+
+@@ -76,6 +78,8 @@ int remove_phb_dynamic(struct pci_controller *phb)
+ }
+ }
+
++ ppc_iommu_unregister_device(phb);
++
+ pseries_msi_free_domains(phb);
+
+ /* Keep a reference so phb isn't freed yet */
+--
+2.43.0
+
--- /dev/null
+From c1845b876f233db30930e93dc0d9e43d3d3a95b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Feb 2024 16:02:50 +0000
+Subject: Revert "kobject: Remove redundant checks for whether ktype is NULL"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit 3ca8fbabcceb8bfe44f7f50640092fd8f1de375c ]
+
+This reverts commit 1b28cb81dab7c1eedc6034206f4e8d644046ad31.
+
+It is reported to cause problems, so revert it for now until the root
+cause can be found.
+
+Reported-by: kernel test robot <oliver.sang@intel.com>
+Fixes: 1b28cb81dab7 ("kobject: Remove redundant checks for whether ktype is NULL")
+Cc: Zhen Lei <thunder.leizhen@huawei.com>
+Closes: https://lore.kernel.org/oe-lkp/202402071403.e302e33a-oliver.sang@intel.com
+Link: https://lore.kernel.org/r/2024020849-consensus-length-6264@gregkh
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/kobject.c | 24 ++++++++++++++----------
+ 1 file changed, 14 insertions(+), 10 deletions(-)
+
+diff --git a/lib/kobject.c b/lib/kobject.c
+index 59dbcbdb1c91..72fa20f405f1 100644
+--- a/lib/kobject.c
++++ b/lib/kobject.c
+@@ -74,10 +74,12 @@ static int create_dir(struct kobject *kobj)
+ if (error)
+ return error;
+
+- error = sysfs_create_groups(kobj, ktype->default_groups);
+- if (error) {
+- sysfs_remove_dir(kobj);
+- return error;
++ if (ktype) {
++ error = sysfs_create_groups(kobj, ktype->default_groups);
++ if (error) {
++ sysfs_remove_dir(kobj);
++ return error;
++ }
+ }
+
+ /*
+@@ -589,7 +591,8 @@ static void __kobject_del(struct kobject *kobj)
+ sd = kobj->sd;
+ ktype = get_ktype(kobj);
+
+- sysfs_remove_groups(kobj, ktype->default_groups);
++ if (ktype)
++ sysfs_remove_groups(kobj, ktype->default_groups);
+
+ /* send "remove" if the caller did not do it but sent "add" */
+ if (kobj->state_add_uevent_sent && !kobj->state_remove_uevent_sent) {
+@@ -666,6 +669,10 @@ static void kobject_cleanup(struct kobject *kobj)
+ pr_debug("'%s' (%p): %s, parent %p\n",
+ kobject_name(kobj), kobj, __func__, kobj->parent);
+
++ if (t && !t->release)
++ pr_debug("'%s' (%p): does not have a release() function, it is broken and must be fixed. See Documentation/core-api/kobject.rst.\n",
++ kobject_name(kobj), kobj);
++
+ /* remove from sysfs if the caller did not do it */
+ if (kobj->state_in_sysfs) {
+ pr_debug("'%s' (%p): auto cleanup kobject_del\n",
+@@ -676,13 +683,10 @@ static void kobject_cleanup(struct kobject *kobj)
+ parent = NULL;
+ }
+
+- if (t->release) {
++ if (t && t->release) {
+ pr_debug("'%s' (%p): calling ktype release\n",
+ kobject_name(kobj), kobj);
+ t->release(kobj);
+- } else {
+- pr_debug("'%s' (%p): does not have a release() function, it is broken and must be fixed. See Documentation/core-api/kobject.rst.\n",
+- kobject_name(kobj), kobj);
+ }
+
+ /* free name if we allocated it */
+@@ -1056,7 +1060,7 @@ const struct kobj_ns_type_operations *kobj_child_ns_ops(const struct kobject *pa
+ {
+ const struct kobj_ns_type_operations *ops = NULL;
+
+- if (parent && parent->ktype->child_ns_type)
++ if (parent && parent->ktype && parent->ktype->child_ns_type)
+ ops = parent->ktype->child_ns_type(parent);
+
+ return ops;
+--
+2.43.0
+
usb-chipidea-core-handle-power-lost-in-workqueue.patch
usb-core-prevent-null-pointer-dereference-in-update_port_device_state.patch
usb-dwc3-gadget-fix-null-pointer-dereference-in-dwc3_gadget_suspend.patch
+interconnect-qcom-sc8180x-mark-co0-bcm-keepalive.patch
+interconnect-qcom-sm8550-enable-sync_state.patch
+media-ir_toy-fix-a-memleak-in-irtoy_tx.patch
+driver-core-fw_devlink-improve-detection-of-overlapp.patch
+powerpc-pseries-iommu-fix-iommu-initialisation-durin.patch
+powerpc-6xx-set-high-bat-enable-flag-on-g2_le-cores.patch
+powerpc-kasan-fix-addr-error-caused-by-page-alignmen.patch
+revert-kobject-remove-redundant-checks-for-whether-k.patch
+pci-fix-active-state-requirement-in-pme-polling.patch
+iio-adc-ad4130-zero-initialize-clock-init-data.patch
+iio-adc-ad4130-only-set-gpio_ctrl-if-pin-is-unused.patch
+cifs-fix-underflow-in-parse_server_interfaces.patch
+i2c-qcom-geni-correct-i2c-tre-sequence.patch
+irqchip-loongson-eiointc-use-correct-struct-type-in-.patch
+irqchip-gic-v3-its-handle-non-coherent-gicv4-redistr.patch
+powerpc-kasan-limit-kasan-thread-size-increase-to-32.patch
+i2c-pasemi-split-driver-into-two-separate-modules.patch
+i2c-i801-fix-block-process-call-transactions.patch
+modpost-trim-leading-spaces-when-processing-source-f.patch
+kallsyms-ignore-armv4-thunks-along-with-others.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
