--- /dev/null
+From 5906f2ce2c67eee55d8ab59e13de5dd77b4c6688 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 May 2024 22:48:35 +0900
+Subject: af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock.
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit 9841991a446c87f90f66f4b9fee6fe934c1336a2 ]
+
+Billy Jheng Bing-Jhong reported a race between __unix_gc() and
+queue_oob().
+
+__unix_gc() tries to garbage-collect close()d inflight sockets,
+and then if the socket has MSG_OOB in unix_sk(sk)->oob_skb, GC
+will drop the reference and set NULL to it locklessly.
+
+However, the peer socket still can send MSG_OOB message and
+queue_oob() can update unix_sk(sk)->oob_skb concurrently, leading
+NULL pointer dereference. [0]
+
+To fix the issue, let's update unix_sk(sk)->oob_skb under the
+sk_receive_queue's lock and take it everywhere we touch oob_skb.
+
+Note that we defer kfree_skb() in manage_oob() to silence lockdep
+false-positive (See [1]).
+
+[0]:
+BUG: kernel NULL pointer dereference, address: 0000000000000008
+ PF: supervisor write access in kernel mode
+ PF: error_code(0x0002) - not-present page
+PGD 8000000009f5e067 P4D 8000000009f5e067 PUD 9f5d067 PMD 0
+Oops: 0002 [#1] PREEMPT SMP PTI
+CPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc5-00191-gd091e579b864 #110
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
+Workqueue: events delayed_fput
+RIP: 0010:skb_dequeue (./include/linux/skbuff.h:2386 ./include/linux/skbuff.h:2402 net/core/skbuff.c:3847)
+Code: 39 e3 74 3e 8b 43 10 48 89 ef 83 e8 01 89 43 10 49 8b 44 24 08 49 c7 44 24 08 00 00 00 00 49 8b 14 24 49 c7 04 24 00 00 00 00 <48> 89 42 08 48 89 10 e8 e7 c5 42 00 4c 89 e0 5b 5d 41 5c c3 cc cc
+RSP: 0018:ffffc900001bfd48 EFLAGS: 00000002
+RAX: 0000000000000000 RBX: ffff8880088f5ae8 RCX: 00000000361289f9
+RDX: 0000000000000000 RSI: 0000000000000206 RDI: ffff8880088f5b00
+RBP: ffff8880088f5b00 R08: 0000000000080000 R09: 0000000000000001
+R10: 0000000000000003 R11: 0000000000000001 R12: ffff8880056b6a00
+R13: ffff8880088f5280 R14: 0000000000000001 R15: ffff8880088f5a80
+FS: 0000000000000000(0000) GS:ffff88807dd80000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000000000008 CR3: 0000000006314000 CR4: 00000000007506f0
+PKRU: 55555554
+Call Trace:
+ <TASK>
+ unix_release_sock (net/unix/af_unix.c:654)
+ unix_release (net/unix/af_unix.c:1050)
+ __sock_release (net/socket.c:660)
+ sock_close (net/socket.c:1423)
+ __fput (fs/file_table.c:423)
+ delayed_fput (fs/file_table.c:444 (discriminator 3))
+ process_one_work (kernel/workqueue.c:3259)
+ worker_thread (kernel/workqueue.c:3329 kernel/workqueue.c:3416)
+ kthread (kernel/kthread.c:388)
+ ret_from_fork (arch/x86/kernel/process.c:153)
+ ret_from_fork_asm (arch/x86/entry/entry_64.S:257)
+ </TASK>
+Modules linked in:
+CR2: 0000000000000008
+
+Link: https://lore.kernel.org/netdev/a00d3993-c461-43f2-be6d-07259c98509a@rbox.co/ [1]
+Fixes: 1279f9d9dec2 ("af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.")
+Reported-by: Billy Jheng Bing-Jhong <billy@starlabs.sg>
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Link: https://lore.kernel.org/r/20240516134835.8332-1-kuniyu@amazon.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/unix/af_unix.c | 28 ++++++++++++++++++++++------
+ 1 file changed, 22 insertions(+), 6 deletions(-)
+
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index e94839d89b09d..9bc879f3e34e6 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -2217,13 +2217,15 @@ static int queue_oob(struct socket *sock, struct msghdr *msg, struct sock *other
+ maybe_add_creds(skb, sock, other);
+ skb_get(skb);
+
++ scm_stat_add(other, skb);
++
++ spin_lock(&other->sk_receive_queue.lock);
+ if (ousk->oob_skb)
+ consume_skb(ousk->oob_skb);
+-
+ WRITE_ONCE(ousk->oob_skb, skb);
++ __skb_queue_tail(&other->sk_receive_queue, skb);
++ spin_unlock(&other->sk_receive_queue.lock);
+
+- scm_stat_add(other, skb);
+- skb_queue_tail(&other->sk_receive_queue, skb);
+ sk_send_sigurg(other);
+ unix_state_unlock(other);
+ other->sk_data_ready(other);
+@@ -2614,8 +2616,10 @@ static int unix_stream_recv_urg(struct unix_stream_read_state *state)
+
+ mutex_lock(&u->iolock);
+ unix_state_lock(sk);
++ spin_lock(&sk->sk_receive_queue.lock);
+
+ if (sock_flag(sk, SOCK_URGINLINE) || !u->oob_skb) {
++ spin_unlock(&sk->sk_receive_queue.lock);
+ unix_state_unlock(sk);
+ mutex_unlock(&u->iolock);
+ return -EINVAL;
+@@ -2627,6 +2631,8 @@ static int unix_stream_recv_urg(struct unix_stream_read_state *state)
+ WRITE_ONCE(u->oob_skb, NULL);
+ else
+ skb_get(oob_skb);
++
++ spin_unlock(&sk->sk_receive_queue.lock);
+ unix_state_unlock(sk);
+
+ chunk = state->recv_actor(oob_skb, 0, chunk, state);
+@@ -2655,6 +2661,10 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk,
+ consume_skb(skb);
+ skb = NULL;
+ } else {
++ struct sk_buff *unlinked_skb = NULL;
++
++ spin_lock(&sk->sk_receive_queue.lock);
++
+ if (skb == u->oob_skb) {
+ if (copied) {
+ skb = NULL;
+@@ -2666,13 +2676,19 @@ static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk,
+ } else if (flags & MSG_PEEK) {
+ skb = NULL;
+ } else {
+- skb_unlink(skb, &sk->sk_receive_queue);
++ __skb_unlink(skb, &sk->sk_receive_queue);
+ WRITE_ONCE(u->oob_skb, NULL);
+- if (!WARN_ON_ONCE(skb_unref(skb)))
+- kfree_skb(skb);
++ unlinked_skb = skb;
+ skb = skb_peek(&sk->sk_receive_queue);
+ }
+ }
++
++ spin_unlock(&sk->sk_receive_queue.lock);
++
++ if (unlinked_skb) {
++ WARN_ON_ONCE(skb_unref(unlinked_skb));
++ kfree_skb(unlinked_skb);
++ }
+ }
+ return skb;
+ }
+--
+2.43.0
+
--- /dev/null
+From 4b5e46251d3de8bee17e5a49592430331adcf891 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 May 2024 11:08:11 +0100
+Subject: ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance
+
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+
+[ Upstream commit d344873c4cbde249b7152d36a273bcc45864001e ]
+
+The cs_dsp instance is initialized in the driver probe() so it
+should be freed in the driver remove(). Also fix a missing call
+to cs_dsp_remove() in the error path of cs35l56_hda_common_probe().
+
+The call to cs_dsp_remove() was being done in the component unbind
+callback cs35l56_hda_unbind(). This meant that if the driver was
+unbound and then re-bound it would be using an uninitialized cs_dsp
+instance.
+
+It is best to initialize the cs_dsp instance in probe() so that it
+can return an error if it fails. The component binding API doesn't
+have any error handling so there's no way to handle a failure if
+cs_dsp was initialized in the bind.
+
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Fixes: 73cfbfa9caea ("ALSA: hda/cs35l56: Add driver for Cirrus Logic CS35L56 amplifier")
+Link: https://lore.kernel.org/r/20240508100811.49514-1-rf@opensource.cirrus.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/cs35l56_hda.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/sound/pci/hda/cs35l56_hda.c b/sound/pci/hda/cs35l56_hda.c
+index 558c1f38fe971..11b0570ff56d4 100644
+--- a/sound/pci/hda/cs35l56_hda.c
++++ b/sound/pci/hda/cs35l56_hda.c
+@@ -732,8 +732,6 @@ static void cs35l56_hda_unbind(struct device *dev, struct device *master, void *
+ if (cs35l56->base.fw_patched)
+ cs_dsp_power_down(&cs35l56->cs_dsp);
+
+- cs_dsp_remove(&cs35l56->cs_dsp);
+-
+ if (comps[cs35l56->index].dev == dev)
+ memset(&comps[cs35l56->index], 0, sizeof(*comps));
+
+@@ -1035,7 +1033,7 @@ int cs35l56_hda_common_probe(struct cs35l56_hda *cs35l56, int hid, int id)
+ ARRAY_SIZE(cs35l56_hda_dai_config));
+ ret = cs35l56_force_sync_asp1_registers_from_cache(&cs35l56->base);
+ if (ret)
+- goto err;
++ goto dsp_err;
+
+ /*
+ * By default only enable one ASP1TXn, where n=amplifier index,
+@@ -1061,6 +1059,8 @@ int cs35l56_hda_common_probe(struct cs35l56_hda *cs35l56, int hid, int id)
+
+ pm_err:
+ pm_runtime_disable(cs35l56->base.dev);
++dsp_err:
++ cs_dsp_remove(&cs35l56->cs_dsp);
+ err:
+ gpiod_set_value_cansleep(cs35l56->base.reset_gpio, 0);
+
+@@ -1078,6 +1078,8 @@ void cs35l56_hda_remove(struct device *dev)
+
+ component_del(cs35l56->base.dev, &cs35l56_hda_comp_ops);
+
++ cs_dsp_remove(&cs35l56->cs_dsp);
++
+ kfree(cs35l56->system_name);
+ pm_runtime_put_noidle(cs35l56->base.dev);
+
+--
+2.43.0
+
--- /dev/null
+From 64f955991f331f6bc178f3c6a9a22c84c494178e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 May 2024 10:56:27 +0100
+Subject: ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup
+
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+
+[ Upstream commit 172811e3a557d8681a5e2d0f871dc04a2d17eb13 ]
+
+Use the control private_free callback to free the associated data
+block. This ensures that the memory won't leak, whatever way the
+control gets destroyed.
+
+The original implementation didn't actually remove the ALSA
+controls in hda_cs_dsp_control_remove(). It only freed the internal
+tracking structure. This meant it was possible to remove/unload the
+amp driver while leaving its ALSA controls still present in the
+soundcard. Obviously attempting to access them could cause segfaults
+or at least dereferencing stale pointers.
+
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Fixes: 3233b978af23 ("ALSA: hda: hda_cs_dsp_ctl: Add Library to support CS_DSP ALSA controls")
+Link: https://lore.kernel.org/r/20240508095627.44476-1-rf@opensource.cirrus.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_cs_dsp_ctl.c | 47 ++++++++++++++++++++++------------
+ 1 file changed, 31 insertions(+), 16 deletions(-)
+
+diff --git a/sound/pci/hda/hda_cs_dsp_ctl.c b/sound/pci/hda/hda_cs_dsp_ctl.c
+index 463ca06036bfe..9db45d7c17e5f 100644
+--- a/sound/pci/hda/hda_cs_dsp_ctl.c
++++ b/sound/pci/hda/hda_cs_dsp_ctl.c
+@@ -8,6 +8,7 @@
+
+ #include <linux/module.h>
+ #include <sound/soc.h>
++#include <linux/cleanup.h>
+ #include <linux/firmware/cirrus/cs_dsp.h>
+ #include <linux/firmware/cirrus/wmfw.h>
+ #include "hda_cs_dsp_ctl.h"
+@@ -97,11 +98,23 @@ static unsigned int wmfw_convert_flags(unsigned int in)
+ return out;
+ }
+
+-static void hda_cs_dsp_add_kcontrol(struct hda_cs_dsp_coeff_ctl *ctl, const char *name)
++static void hda_cs_dsp_free_kcontrol(struct snd_kcontrol *kctl)
+ {
++ struct hda_cs_dsp_coeff_ctl *ctl = (struct hda_cs_dsp_coeff_ctl *)snd_kcontrol_chip(kctl);
+ struct cs_dsp_coeff_ctl *cs_ctl = ctl->cs_ctl;
++
++ /* NULL priv to prevent a double-free in hda_cs_dsp_control_remove() */
++ cs_ctl->priv = NULL;
++ kfree(ctl);
++}
++
++static void hda_cs_dsp_add_kcontrol(struct cs_dsp_coeff_ctl *cs_ctl,
++ const struct hda_cs_dsp_ctl_info *info,
++ const char *name)
++{
+ struct snd_kcontrol_new kcontrol = {0};
+ struct snd_kcontrol *kctl;
++ struct hda_cs_dsp_coeff_ctl *ctl __free(kfree) = NULL;
+ int ret = 0;
+
+ if (cs_ctl->len > ADSP_MAX_STD_CTRL_SIZE) {
+@@ -110,6 +123,13 @@ static void hda_cs_dsp_add_kcontrol(struct hda_cs_dsp_coeff_ctl *ctl, const char
+ return;
+ }
+
++ ctl = kzalloc(sizeof(*ctl), GFP_KERNEL);
++ if (!ctl)
++ return;
++
++ ctl->cs_ctl = cs_ctl;
++ ctl->card = info->card;
++
+ kcontrol.name = name;
+ kcontrol.info = hda_cs_dsp_coeff_info;
+ kcontrol.iface = SNDRV_CTL_ELEM_IFACE_MIXER;
+@@ -117,20 +137,22 @@ static void hda_cs_dsp_add_kcontrol(struct hda_cs_dsp_coeff_ctl *ctl, const char
+ kcontrol.get = hda_cs_dsp_coeff_get;
+ kcontrol.put = hda_cs_dsp_coeff_put;
+
+- /* Save ctl inside private_data, ctl is owned by cs_dsp,
+- * and will be freed when cs_dsp removes the control */
+ kctl = snd_ctl_new1(&kcontrol, (void *)ctl);
+ if (!kctl)
+ return;
+
+- ret = snd_ctl_add(ctl->card, kctl);
++ kctl->private_free = hda_cs_dsp_free_kcontrol;
++ ctl->kctl = kctl;
++
++ /* snd_ctl_add() calls our private_free on error, which will kfree(ctl) */
++ cs_ctl->priv = no_free_ptr(ctl);
++ ret = snd_ctl_add(info->card, kctl);
+ if (ret) {
+ dev_err(cs_ctl->dsp->dev, "Failed to add KControl %s = %d\n", kcontrol.name, ret);
+ return;
+ }
+
+ dev_dbg(cs_ctl->dsp->dev, "Added KControl: %s\n", kcontrol.name);
+- ctl->kctl = kctl;
+ }
+
+ static void hda_cs_dsp_control_add(struct cs_dsp_coeff_ctl *cs_ctl,
+@@ -138,7 +160,6 @@ static void hda_cs_dsp_control_add(struct cs_dsp_coeff_ctl *cs_ctl,
+ {
+ struct cs_dsp *cs_dsp = cs_ctl->dsp;
+ char name[SNDRV_CTL_ELEM_ID_NAME_MAXLEN];
+- struct hda_cs_dsp_coeff_ctl *ctl;
+ const char *region_name;
+ int ret;
+
+@@ -163,15 +184,7 @@ static void hda_cs_dsp_control_add(struct cs_dsp_coeff_ctl *cs_ctl,
+ " %.*s", cs_ctl->subname_len - skip, cs_ctl->subname + skip);
+ }
+
+- ctl = kzalloc(sizeof(*ctl), GFP_KERNEL);
+- if (!ctl)
+- return;
+-
+- ctl->cs_ctl = cs_ctl;
+- ctl->card = info->card;
+- cs_ctl->priv = ctl;
+-
+- hda_cs_dsp_add_kcontrol(ctl, name);
++ hda_cs_dsp_add_kcontrol(cs_ctl, info, name);
+ }
+
+ void hda_cs_dsp_add_controls(struct cs_dsp *dsp, const struct hda_cs_dsp_ctl_info *info)
+@@ -203,7 +216,9 @@ void hda_cs_dsp_control_remove(struct cs_dsp_coeff_ctl *cs_ctl)
+ {
+ struct hda_cs_dsp_coeff_ctl *ctl = cs_ctl->priv;
+
+- kfree(ctl);
++ /* ctl and kctl may already have been removed by ALSA private_free */
++ if (ctl && ctl->kctl)
++ snd_ctl_remove(ctl->card, ctl->kctl);
+ }
+ EXPORT_SYMBOL_NS_GPL(hda_cs_dsp_control_remove, SND_HDA_CS_DSP_CONTROLS);
+
+--
+2.43.0
+
--- /dev/null
+From 463c3476e925751693342b29f37df3c5b209e132 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 May 2024 11:03:47 +0100
+Subject: ALSA: hda: hda_component: Initialize shared data during bind callback
+
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+
+[ Upstream commit ec6f32bc924d1c00cbcd5672510758f7088f2513 ]
+
+Move the initialization of the shared struct hda_component array into
+hda_component_manager_bind().
+
+The purpose of the manager bind() callback is to allow it to perform
+initialization before binding in the component drivers. This is the
+correct place to initialize the shared data.
+
+The original implementation initialized the shared data in
+hda_component_manager_init(). This is only done once during probe()
+of the manager driver. So if the component binding was unbound and
+then rebound, the shared data would not be re-initialized.
+
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Fixes: fd895a74dc1d ("ALSA: hda: realtek: Move hda_component implementation to module")
+Link: https://lore.kernel.org/r/20240508100347.47283-1-rf@opensource.cirrus.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_component.c | 16 +++++++++++++++-
+ sound/pci/hda/hda_component.h | 7 ++-----
+ sound/pci/hda/patch_realtek.c | 2 +-
+ 3 files changed, 18 insertions(+), 7 deletions(-)
+
+diff --git a/sound/pci/hda/hda_component.c b/sound/pci/hda/hda_component.c
+index cd299d7d84baf..d02589014a3fa 100644
+--- a/sound/pci/hda/hda_component.c
++++ b/sound/pci/hda/hda_component.c
+@@ -123,6 +123,21 @@ static int hda_comp_match_dev_name(struct device *dev, void *data)
+ return !strcmp(d + n, tmp);
+ }
+
++int hda_component_manager_bind(struct hda_codec *cdc,
++ struct hda_component *comps, int count)
++{
++ int i;
++
++ /* Init shared data */
++ for (i = 0; i < count; ++i) {
++ memset(&comps[i], 0, sizeof(comps[i]));
++ comps[i].codec = cdc;
++ }
++
++ return component_bind_all(hda_codec_dev(cdc), comps);
++}
++EXPORT_SYMBOL_NS_GPL(hda_component_manager_bind, SND_HDA_SCODEC_COMPONENT);
++
+ int hda_component_manager_init(struct hda_codec *cdc,
+ struct hda_component *comps, int count,
+ const char *bus, const char *hid,
+@@ -143,7 +158,6 @@ int hda_component_manager_init(struct hda_codec *cdc,
+ sm->hid = hid;
+ sm->match_str = match_str;
+ sm->index = i;
+- comps[i].codec = cdc;
+ component_match_add(dev, &match, hda_comp_match_dev_name, sm);
+ }
+
+diff --git a/sound/pci/hda/hda_component.h b/sound/pci/hda/hda_component.h
+index c80a66691b5d8..c70b3de68ab20 100644
+--- a/sound/pci/hda/hda_component.h
++++ b/sound/pci/hda/hda_component.h
+@@ -75,11 +75,8 @@ int hda_component_manager_init(struct hda_codec *cdc,
+ void hda_component_manager_free(struct hda_codec *cdc,
+ const struct component_master_ops *ops);
+
+-static inline int hda_component_manager_bind(struct hda_codec *cdc,
+- struct hda_component *comps)
+-{
+- return component_bind_all(hda_codec_dev(cdc), comps);
+-}
++int hda_component_manager_bind(struct hda_codec *cdc,
++ struct hda_component *comps, int count);
+
+ static inline void hda_component_manager_unbind(struct hda_codec *cdc,
+ struct hda_component *comps)
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 3b8b4ab488a61..08598a4f1fa3f 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6793,7 +6793,7 @@ static int comp_bind(struct device *dev)
+ struct alc_spec *spec = cdc->spec;
+ int ret;
+
+- ret = hda_component_manager_bind(cdc, spec->comps);
++ ret = hda_component_manager_bind(cdc, spec->comps, ARRAY_SIZE(spec->comps));
+ if (ret)
+ return ret;
+
+--
+2.43.0
+
--- /dev/null
+From 53f89f093d799a716fe2a45c01e618ffb402818f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 May 2024 08:40:08 +0200
+Subject: ALSA: hda/realtek: Drop doubly quirk entry for 103c:8a2e
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit d731b1ed15052580b7b2f40559021012d280f1d9 ]
+
+There are two quirk entries for SSID 103c:8a2e. Drop the latter one
+that isn't applied in anyway.
+
+As both point to the same quirk action, there is no actual behavior
+change.
+
+Fixes: aa8e3ef4fe53 ("ALSA: hda/realtek: Add quirks for various HP ENVY models")
+Link: https://lore.kernel.org/r/20240513064010.17546-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 08598a4f1fa3f..d8caa2be63c8b 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10103,7 +10103,6 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x8a2c, "HP Envy 16", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x103c, 0x8a2d, "HP Envy 16", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x103c, 0x8a2e, "HP Envy 16", ALC287_FIXUP_CS35L41_I2C_2),
+- SND_PCI_QUIRK(0x103c, 0x8a2e, "HP Envy 17", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x103c, 0x8a30, "HP Envy 17", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x103c, 0x8a31, "HP Envy 15", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x103c, 0x8a6e, "HP EDNA 360", ALC287_FIXUP_CS35L41_I2C_4),
+--
+2.43.0
+
--- /dev/null
+From 18ad98c54e5a83f8bb79faeb70465d146950e01c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 May 2024 21:34:37 +0800
+Subject: arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
+
+From: Jiangfeng Xiao <xiaojiangfeng@huawei.com>
+
+[ Upstream commit ffbf4fb9b5c12ff878a10ea17997147ea4ebea6f ]
+
+When CONFIG_DEBUG_BUGVERBOSE=n, we fail to add necessary padding bytes
+to bug_table entries, and as a result the last entry in a bug table will
+be ignored, potentially leading to an unexpected panic(). All prior
+entries in the table will be handled correctly.
+
+The arm64 ABI requires that struct fields of up to 8 bytes are
+naturally-aligned, with padding added within a struct such that struct
+are suitably aligned within arrays.
+
+When CONFIG_DEBUG_BUGVERPOSE=y, the layout of a bug_entry is:
+
+ struct bug_entry {
+ signed int bug_addr_disp; // 4 bytes
+ signed int file_disp; // 4 bytes
+ unsigned short line; // 2 bytes
+ unsigned short flags; // 2 bytes
+ }
+
+... with 12 bytes total, requiring 4-byte alignment.
+
+When CONFIG_DEBUG_BUGVERBOSE=n, the layout of a bug_entry is:
+
+ struct bug_entry {
+ signed int bug_addr_disp; // 4 bytes
+ unsigned short flags; // 2 bytes
+ < implicit padding > // 2 bytes
+ }
+
+... with 8 bytes total, with 6 bytes of data and 2 bytes of trailing
+padding, requiring 4-byte alginment.
+
+When we create a bug_entry in assembly, we align the start of the entry
+to 4 bytes, which implicitly handles padding for any prior entries.
+However, we do not align the end of the entry, and so when
+CONFIG_DEBUG_BUGVERBOSE=n, the final entry lacks the trailing padding
+bytes.
+
+For the main kernel image this is not a problem as find_bug() doesn't
+depend on the trailing padding bytes when searching for entries:
+
+ for (bug = __start___bug_table; bug < __stop___bug_table; ++bug)
+ if (bugaddr == bug_addr(bug))
+ return bug;
+
+However for modules, module_bug_finalize() depends on the trailing
+bytes when calculating the number of entries:
+
+ mod->num_bugs = sechdrs[i].sh_size / sizeof(struct bug_entry);
+
+... and as the last bug_entry lacks the necessary padding bytes, this entry
+will not be counted, e.g. in the case of a single entry:
+
+ sechdrs[i].sh_size == 6
+ sizeof(struct bug_entry) == 8;
+
+ sechdrs[i].sh_size / sizeof(struct bug_entry) == 0;
+
+Consequently module_find_bug() will miss the last bug_entry when it does:
+
+ for (i = 0; i < mod->num_bugs; ++i, ++bug)
+ if (bugaddr == bug_addr(bug))
+ goto out;
+
+... which can lead to a kenrel panic due to an unhandled bug.
+
+This can be demonstrated with the following module:
+
+ static int __init buginit(void)
+ {
+ WARN(1, "hello\n");
+ return 0;
+ }
+
+ static void __exit bugexit(void)
+ {
+ }
+
+ module_init(buginit);
+ module_exit(bugexit);
+ MODULE_LICENSE("GPL");
+
+... which will trigger a kernel panic when loaded:
+
+ ------------[ cut here ]------------
+ hello
+ Unexpected kernel BRK exception at EL1
+ Internal error: BRK handler: 00000000f2000800 [#1] PREEMPT SMP
+ Modules linked in: hello(O+)
+ CPU: 0 PID: 50 Comm: insmod Tainted: G O 6.9.1 #8
+ Hardware name: linux,dummy-virt (DT)
+ pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+ pc : buginit+0x18/0x1000 [hello]
+ lr : buginit+0x18/0x1000 [hello]
+ sp : ffff800080533ae0
+ x29: ffff800080533ae0 x28: 0000000000000000 x27: 0000000000000000
+ x26: ffffaba8c4e70510 x25: ffff800080533c30 x24: ffffaba8c4a28a58
+ x23: 0000000000000000 x22: 0000000000000000 x21: ffff3947c0eab3c0
+ x20: ffffaba8c4e3f000 x19: ffffaba846464000 x18: 0000000000000006
+ x17: 0000000000000000 x16: ffffaba8c2492834 x15: 0720072007200720
+ x14: 0720072007200720 x13: ffffaba8c49b27c8 x12: 0000000000000312
+ x11: 0000000000000106 x10: ffffaba8c4a0a7c8 x9 : ffffaba8c49b27c8
+ x8 : 00000000ffffefff x7 : ffffaba8c4a0a7c8 x6 : 80000000fffff000
+ x5 : 0000000000000107 x4 : 0000000000000000 x3 : 0000000000000000
+ x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff3947c0eab3c0
+ Call trace:
+ buginit+0x18/0x1000 [hello]
+ do_one_initcall+0x80/0x1c8
+ do_init_module+0x60/0x218
+ load_module+0x1ba4/0x1d70
+ __do_sys_init_module+0x198/0x1d0
+ __arm64_sys_init_module+0x1c/0x28
+ invoke_syscall+0x48/0x114
+ el0_svc_common.constprop.0+0x40/0xe0
+ do_el0_svc+0x1c/0x28
+ el0_svc+0x34/0xd8
+ el0t_64_sync_handler+0x120/0x12c
+ el0t_64_sync+0x190/0x194
+ Code: d0ffffe0 910003fd 91000000 9400000b (d4210000)
+ ---[ end trace 0000000000000000 ]---
+ Kernel panic - not syncing: BRK handler: Fatal exception
+
+Fix this by always aligning the end of a bug_entry to 4 bytes, which is
+correct regardless of CONFIG_DEBUG_BUGVERBOSE.
+
+Fixes: 9fb7410f955f ("arm64/BUG: Use BRK instruction for generic BUG traps")
+
+Signed-off-by: Yuanbin Xie <xieyuanbin1@huawei.com>
+Signed-off-by: Jiangfeng Xiao <xiaojiangfeng@huawei.com>
+Reviewed-by: Mark Rutland <mark.rutland@arm.com>
+Link: https://lore.kernel.org/r/1716212077-43826-1-git-send-email-xiaojiangfeng@huawei.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/asm-bug.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/include/asm/asm-bug.h b/arch/arm64/include/asm/asm-bug.h
+index c762038ba4009..6e73809f6492a 100644
+--- a/arch/arm64/include/asm/asm-bug.h
++++ b/arch/arm64/include/asm/asm-bug.h
+@@ -28,6 +28,7 @@
+ 14470: .long 14471f - .; \
+ _BUGVERBOSE_LOCATION(__FILE__, __LINE__) \
+ .short flags; \
++ .align 2; \
+ .popsection; \
+ 14471:
+ #else
+--
+2.43.0
+
--- /dev/null
+From 171129d48dae659cd4a38fe633e1eaa7b94fc95d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 May 2024 19:33:25 +0530
+Subject: ASoC: amd: acp: fix for acp platform device creation failure
+
+From: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
+
+[ Upstream commit 09068d624c490c0e89f33f963c402f1859964467 ]
+
+ACP pin configuration varies based on acp version.
+ACP PCI driver should read the ACP PIN config value and based on config
+value, it has to create a platform device in below two conditions.
+1) If ACP PDM configuration is selected from BIOS and ACP PDM controller
+exists.
+2) If ACP I2S configuration is selected from BIOS.
+
+Other than above scenarios, ACP PCI driver should skip the platform
+device creation logic, i.e. ACP PCI driver probe sequence should never
+fail if other acp pin configuration is selected. It should skip platform
+device creation logic.
+
+check_acp_pdm() function was implemented for ACP6.x platforms to check
+ACP PDM configuration. Previously, this code was safe guarded by
+FLAG_AMD_LEGACY_ONLY_DMIC flag check.
+
+This implementation breaks audio use cases for Huawei Matebooks which are
+based on ACP3.x varaint uses I2S configuration.
+In current scenario, check_acp_pdm() function returns -ENODEV value
+which results in ACP PCI driver probe failure without creating a platform
+device even in case of valid ACP pin configuration.
+
+Implement check_acp_config() as a common function which invokes platform
+specific acp pin configuration check functions for ACP3.x, ACP6.0 & ACP6.3
+& ACP7.0 variants and checks for ACP PDM controller.
+
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218780
+Fixes: 4af565de9f8c ("ASoC: amd: acp: fix for acp pdm configuration check")
+Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
+Link: https://lore.kernel.org/r/20240502140340.4049021-1-Vijendar.Mukunda@amd.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/acp/acp-legacy-common.c | 96 ++++++++++++++++++++++-----
+ sound/soc/amd/acp/acp-pci.c | 9 ++-
+ sound/soc/amd/acp/amd.h | 10 ++-
+ sound/soc/amd/acp/chip_offset_byte.h | 1 +
+ 4 files changed, 95 insertions(+), 21 deletions(-)
+
+diff --git a/sound/soc/amd/acp/acp-legacy-common.c b/sound/soc/amd/acp/acp-legacy-common.c
+index b5aff3f230be5..3be7c6d55a6f8 100644
+--- a/sound/soc/amd/acp/acp-legacy-common.c
++++ b/sound/soc/amd/acp/acp-legacy-common.c
+@@ -358,11 +358,25 @@ int smn_read(struct pci_dev *dev, u32 smn_addr)
+ }
+ EXPORT_SYMBOL_NS_GPL(smn_read, SND_SOC_ACP_COMMON);
+
+-int check_acp_pdm(struct pci_dev *pci, struct acp_chip_info *chip)
++static void check_acp3x_config(struct acp_chip_info *chip)
+ {
+- struct acpi_device *pdm_dev;
+- const union acpi_object *obj;
+- u32 pdm_addr, val;
++ u32 val;
++
++ val = readl(chip->base + ACP3X_PIN_CONFIG);
++ switch (val) {
++ case ACP_CONFIG_4:
++ chip->is_i2s_config = true;
++ chip->is_pdm_config = true;
++ break;
++ default:
++ chip->is_pdm_config = true;
++ break;
++ }
++}
++
++static void check_acp6x_config(struct acp_chip_info *chip)
++{
++ u32 val;
+
+ val = readl(chip->base + ACP_PIN_CONFIG);
+ switch (val) {
+@@ -371,42 +385,94 @@ int check_acp_pdm(struct pci_dev *pci, struct acp_chip_info *chip)
+ case ACP_CONFIG_6:
+ case ACP_CONFIG_7:
+ case ACP_CONFIG_8:
+- case ACP_CONFIG_10:
+ case ACP_CONFIG_11:
++ case ACP_CONFIG_14:
++ chip->is_pdm_config = true;
++ break;
++ case ACP_CONFIG_9:
++ chip->is_i2s_config = true;
++ break;
++ case ACP_CONFIG_10:
+ case ACP_CONFIG_12:
+ case ACP_CONFIG_13:
++ chip->is_i2s_config = true;
++ chip->is_pdm_config = true;
++ break;
++ default:
++ break;
++ }
++}
++
++static void check_acp70_config(struct acp_chip_info *chip)
++{
++ u32 val;
++
++ val = readl(chip->base + ACP_PIN_CONFIG);
++ switch (val) {
++ case ACP_CONFIG_4:
++ case ACP_CONFIG_5:
++ case ACP_CONFIG_6:
++ case ACP_CONFIG_7:
++ case ACP_CONFIG_8:
++ case ACP_CONFIG_11:
+ case ACP_CONFIG_14:
++ case ACP_CONFIG_17:
++ case ACP_CONFIG_18:
++ chip->is_pdm_config = true;
++ break;
++ case ACP_CONFIG_9:
++ chip->is_i2s_config = true;
++ break;
++ case ACP_CONFIG_10:
++ case ACP_CONFIG_12:
++ case ACP_CONFIG_13:
++ case ACP_CONFIG_19:
++ case ACP_CONFIG_20:
++ chip->is_i2s_config = true;
++ chip->is_pdm_config = true;
+ break;
+ default:
+- return -EINVAL;
++ break;
+ }
++}
++
++void check_acp_config(struct pci_dev *pci, struct acp_chip_info *chip)
++{
++ struct acpi_device *pdm_dev;
++ const union acpi_object *obj;
++ u32 pdm_addr;
+
+ switch (chip->acp_rev) {
+ case ACP3X_DEV:
+ pdm_addr = ACP_RENOIR_PDM_ADDR;
++ check_acp3x_config(chip);
+ break;
+ case ACP6X_DEV:
+ pdm_addr = ACP_REMBRANDT_PDM_ADDR;
++ check_acp6x_config(chip);
+ break;
+ case ACP63_DEV:
+ pdm_addr = ACP63_PDM_ADDR;
++ check_acp6x_config(chip);
+ break;
+ case ACP70_DEV:
+ pdm_addr = ACP70_PDM_ADDR;
++ check_acp70_config(chip);
+ break;
+ default:
+- return -EINVAL;
++ break;
+ }
+
+- pdm_dev = acpi_find_child_device(ACPI_COMPANION(&pci->dev), pdm_addr, 0);
+- if (pdm_dev) {
+- if (!acpi_dev_get_property(pdm_dev, "acp-audio-device-type",
+- ACPI_TYPE_INTEGER, &obj) &&
+- obj->integer.value == pdm_addr)
+- return 0;
++ if (chip->is_pdm_config) {
++ pdm_dev = acpi_find_child_device(ACPI_COMPANION(&pci->dev), pdm_addr, 0);
++ if (pdm_dev) {
++ if (!acpi_dev_get_property(pdm_dev, "acp-audio-device-type",
++ ACPI_TYPE_INTEGER, &obj) &&
++ obj->integer.value == pdm_addr)
++ chip->is_pdm_dev = true;
++ }
+ }
+- return -ENODEV;
+ }
+-EXPORT_SYMBOL_NS_GPL(check_acp_pdm, SND_SOC_ACP_COMMON);
++EXPORT_SYMBOL_NS_GPL(check_acp_config, SND_SOC_ACP_COMMON);
+
+ MODULE_LICENSE("Dual BSD/GPL");
+diff --git a/sound/soc/amd/acp/acp-pci.c b/sound/soc/amd/acp/acp-pci.c
+index 5f35b90eab8d3..ad320b29e87dc 100644
+--- a/sound/soc/amd/acp/acp-pci.c
++++ b/sound/soc/amd/acp/acp-pci.c
+@@ -100,7 +100,6 @@ static int acp_pci_probe(struct pci_dev *pci, const struct pci_device_id *pci_id
+ ret = -EINVAL;
+ goto release_regions;
+ }
+-
+ dmic_dev = platform_device_register_data(dev, "dmic-codec", PLATFORM_DEVID_NONE, NULL, 0);
+ if (IS_ERR(dmic_dev)) {
+ dev_err(dev, "failed to create DMIC device\n");
+@@ -119,6 +118,10 @@ static int acp_pci_probe(struct pci_dev *pci, const struct pci_device_id *pci_id
+ if (ret)
+ goto unregister_dmic_dev;
+
++ check_acp_config(pci, chip);
++ if (!chip->is_pdm_dev && !chip->is_i2s_config)
++ goto skip_pdev_creation;
++
+ res = devm_kcalloc(&pci->dev, num_res, sizeof(struct resource), GFP_KERNEL);
+ if (!res) {
+ ret = -ENOMEM;
+@@ -136,10 +139,6 @@ static int acp_pci_probe(struct pci_dev *pci, const struct pci_device_id *pci_id
+ }
+ }
+
+- ret = check_acp_pdm(pci, chip);
+- if (ret < 0)
+- goto skip_pdev_creation;
+-
+ chip->flag = flag;
+ memset(&pdevinfo, 0, sizeof(pdevinfo));
+
+diff --git a/sound/soc/amd/acp/amd.h b/sound/soc/amd/acp/amd.h
+index 5017e868f39b9..d75b4eb34de8d 100644
+--- a/sound/soc/amd/acp/amd.h
++++ b/sound/soc/amd/acp/amd.h
+@@ -138,6 +138,9 @@ struct acp_chip_info {
+ void __iomem *base; /* ACP memory PCI base */
+ struct platform_device *chip_pdev;
+ unsigned int flag; /* Distinguish b/w Legacy or Only PDM */
++ bool is_pdm_dev; /* flag set to true when ACP PDM controller exists */
++ bool is_pdm_config; /* flag set to true when PDM configuration is selected from BIOS */
++ bool is_i2s_config; /* flag set to true when I2S configuration is selected from BIOS */
+ };
+
+ struct acp_stream {
+@@ -212,6 +215,11 @@ enum acp_config {
+ ACP_CONFIG_13,
+ ACP_CONFIG_14,
+ ACP_CONFIG_15,
++ ACP_CONFIG_16,
++ ACP_CONFIG_17,
++ ACP_CONFIG_18,
++ ACP_CONFIG_19,
++ ACP_CONFIG_20,
+ };
+
+ extern const struct snd_soc_dai_ops asoc_acp_cpu_dai_ops;
+@@ -240,7 +248,7 @@ void restore_acp_pdm_params(struct snd_pcm_substream *substream,
+ int restore_acp_i2s_params(struct snd_pcm_substream *substream,
+ struct acp_dev_data *adata, struct acp_stream *stream);
+
+-int check_acp_pdm(struct pci_dev *pci, struct acp_chip_info *chip);
++void check_acp_config(struct pci_dev *pci, struct acp_chip_info *chip);
+
+ static inline u64 acp_get_byte_count(struct acp_dev_data *adata, int dai_id, int direction)
+ {
+diff --git a/sound/soc/amd/acp/chip_offset_byte.h b/sound/soc/amd/acp/chip_offset_byte.h
+index cfd6c4d075944..18da734c0e9e7 100644
+--- a/sound/soc/amd/acp/chip_offset_byte.h
++++ b/sound/soc/amd/acp/chip_offset_byte.h
+@@ -20,6 +20,7 @@
+ #define ACP_SOFT_RESET 0x1000
+ #define ACP_CONTROL 0x1004
+ #define ACP_PIN_CONFIG 0x1440
++#define ACP3X_PIN_CONFIG 0x1400
+
+ #define ACP_EXTERNAL_INTR_REG_ADDR(adata, offset, ctrl) \
+ (adata->acp_base + adata->rsrc->irq_reg_offset + offset + (ctrl * 0x04))
+--
+2.43.0
+
--- /dev/null
+From 34bf40ff92e4e14f806ef23ef038268bbd57206f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 May 2024 07:31:29 +0000
+Subject: ASoC: mediatek: mt8192: fix register configuration for tdm
+
+From: Hsin-Te Yuan <yuanhsinte@chromium.org>
+
+[ Upstream commit a85ed162f0efcfdd664954414a05d1d560cc95dc ]
+
+For DSP_A, data is a BCK cycle behind LRCK trigger edge. For DSP_B, this
+delay doesn't exist. Fix the delay configuration to match the standard.
+
+Fixes: 52fcd65414abfc ("ASoC: mediatek: mt8192: support tdm in platform driver")
+Signed-off-by: Hsin-Te Yuan <yuanhsinte@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20240509-8192-tdm-v1-1-530b54645763@chromium.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/mediatek/mt8192/mt8192-dai-tdm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/mediatek/mt8192/mt8192-dai-tdm.c b/sound/soc/mediatek/mt8192/mt8192-dai-tdm.c
+index 9ce06821c7d0f..49440db370af0 100644
+--- a/sound/soc/mediatek/mt8192/mt8192-dai-tdm.c
++++ b/sound/soc/mediatek/mt8192/mt8192-dai-tdm.c
+@@ -566,10 +566,10 @@ static int mtk_dai_tdm_hw_params(struct snd_pcm_substream *substream,
+ tdm_con |= 1 << DELAY_DATA_SFT;
+ tdm_con |= get_tdm_lrck_width(format) << LRCK_TDM_WIDTH_SFT;
+ } else if (tdm_priv->tdm_out_mode == TDM_OUT_DSP_A) {
+- tdm_con |= 0 << DELAY_DATA_SFT;
++ tdm_con |= 1 << DELAY_DATA_SFT;
+ tdm_con |= 0 << LRCK_TDM_WIDTH_SFT;
+ } else if (tdm_priv->tdm_out_mode == TDM_OUT_DSP_B) {
+- tdm_con |= 1 << DELAY_DATA_SFT;
++ tdm_con |= 0 << DELAY_DATA_SFT;
+ tdm_con |= 0 << LRCK_TDM_WIDTH_SFT;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From 690b28db44a4539ebcd3803cbd43563e97fbb0a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 May 2024 11:36:58 -0500
+Subject: ASoC: rt715-sdca-sdw: Fix wrong complete waiting in
+ rt715_dev_resume()
+
+From: Bard Liao <yung-chuan.liao@linux.intel.com>
+
+[ Upstream commit c8bdf9e727acb6e1b37febf422ef1751e5a2c7d1 ]
+
+enumeration_complete will be completed when a peripheral is attached.
+And initialization_complete will be completed when a peripheral is
+initialized. rt715_dev_resume() should wait for initialization_complete
+instead of enumeration_complete.
+
+the issue exists since commit 20d17057f0a8 ("ASoC: rt715-sdca: Add RT715
+sdca vendor-specific driver"), but the commit can only apply to
+commit f892e66fcabc ("ASoC: rt-sdw*: add __func__ to all error logs").
+
+Fixes: f892e66fcabc ("ASoC: rt-sdw*: add __func__ to all error logs")
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20240509163658.68062-1-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt715-sdca-sdw.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/rt715-sdca-sdw.c b/sound/soc/codecs/rt715-sdca-sdw.c
+index ee450126106f9..9a55e77af02fe 100644
+--- a/sound/soc/codecs/rt715-sdca-sdw.c
++++ b/sound/soc/codecs/rt715-sdca-sdw.c
+@@ -234,10 +234,10 @@ static int __maybe_unused rt715_dev_resume(struct device *dev)
+ if (!slave->unattach_request)
+ goto regmap_sync;
+
+- time = wait_for_completion_timeout(&slave->enumeration_complete,
++ time = wait_for_completion_timeout(&slave->initialization_complete,
+ msecs_to_jiffies(RT715_PROBE_TIMEOUT));
+ if (!time) {
+- dev_err(&slave->dev, "%s: Enumeration not complete, timed out\n", __func__);
++ dev_err(&slave->dev, "%s: Initialization not complete, timed out\n", __func__);
+ sdw_show_ping_status(slave->bus, true);
+
+ return -ETIMEDOUT;
+--
+2.43.0
+
--- /dev/null
+From 7ce60ced5dfc369980ed0c1cd86c2c53d95cb2e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Apr 2024 10:38:58 -0500
+Subject: ASoC: SOF: debug: Handle cases when fw_lib_prefix is not set, NULL
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit b32487ca7b51ce430f15ec785269f11c25a6a560 ]
+
+The firmware libraries are not supported by IPC3, the fw_lib_path is not
+a valid parameter and it is always NULL.
+Do not create the debugfs file for IPC3 at all as it is not applicable.
+
+With IPC4 some vendors/platforms might not support loadable libraries and
+the fw_lib_prefix is left to NULL to indicate this.
+Handle such case with allocating "Not supported" string.
+
+Reviewed-by: Marc Herbert <marc.herbert@intel.com>
+Fixes: 17f4041244e6 ("ASoC: SOF: debug: show firmware/topology prefix/names")
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20240426153902.39560-2-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/debug.c | 23 +++++++++++++++++++++--
+ 1 file changed, 21 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sof/debug.c b/sound/soc/sof/debug.c
+index 7275437ea8d8a..6481da31826dc 100644
+--- a/sound/soc/sof/debug.c
++++ b/sound/soc/sof/debug.c
+@@ -345,8 +345,27 @@ int snd_sof_dbg_init(struct snd_sof_dev *sdev)
+
+ debugfs_create_str("fw_path", 0444, fw_profile,
+ (char **)&plat_data->fw_filename_prefix);
+- debugfs_create_str("fw_lib_path", 0444, fw_profile,
+- (char **)&plat_data->fw_lib_prefix);
++ /* library path is not valid for IPC3 */
++ if (plat_data->ipc_type != SOF_IPC_TYPE_3) {
++ /*
++ * fw_lib_prefix can be NULL if the vendor/platform does not
++ * support loadable libraries
++ */
++ if (plat_data->fw_lib_prefix) {
++ debugfs_create_str("fw_lib_path", 0444, fw_profile,
++ (char **)&plat_data->fw_lib_prefix);
++ } else {
++ static char *fw_lib_path;
++
++ fw_lib_path = devm_kasprintf(sdev->dev, GFP_KERNEL,
++ "Not supported");
++ if (!fw_lib_path)
++ return -ENOMEM;
++
++ debugfs_create_str("fw_lib_path", 0444, fw_profile,
++ (char **)&fw_lib_path);
++ }
++ }
+ debugfs_create_str("tplg_path", 0444, fw_profile,
+ (char **)&plat_data->tplg_filename_prefix);
+ debugfs_create_str("fw_name", 0444, fw_profile,
+--
+2.43.0
+
--- /dev/null
+From f8f50e8cb953033c01f485ce8a7e7e2beb1105ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 May 2024 11:35:15 +0800
+Subject: ASoC: tas2552: Add TX path for capturing AUDIO-OUT data
+
+From: Shenghao Ding <shenghao-ding@ti.com>
+
+[ Upstream commit 7078ac4fd179a68d0bab448004fcd357e7a45f8d ]
+
+TAS2552 is a Smartamp with I/V sense data, add TX path
+to support capturing I/V data.
+
+Fixes: 38803ce7b53b ("ASoC: codecs: tas*: merge .digital_mute() into .mute_stream()")
+Signed-off-by: Shenghao Ding <shenghao-ding@ti.com>
+Link: https://msgid.link/r/20240518033515.866-1-shenghao-ding@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tas2552.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/tas2552.c b/sound/soc/codecs/tas2552.c
+index 8c9dc318b0e82..c65a4219ecd6c 100644
+--- a/sound/soc/codecs/tas2552.c
++++ b/sound/soc/codecs/tas2552.c
+@@ -2,7 +2,8 @@
+ /*
+ * tas2552.c - ALSA SoC Texas Instruments TAS2552 Mono Audio Amplifier
+ *
+- * Copyright (C) 2014 Texas Instruments Incorporated - https://www.ti.com
++ * Copyright (C) 2014 - 2024 Texas Instruments Incorporated -
++ * https://www.ti.com
+ *
+ * Author: Dan Murphy <dmurphy@ti.com>
+ */
+@@ -119,12 +120,14 @@ static const struct snd_soc_dapm_widget tas2552_dapm_widgets[] =
+ &tas2552_input_mux_control),
+
+ SND_SOC_DAPM_AIF_IN("DAC IN", "DAC Playback", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_OUT("ASI OUT", "DAC Capture", 0, SND_SOC_NOPM, 0, 0),
+ SND_SOC_DAPM_DAC("DAC", NULL, SND_SOC_NOPM, 0, 0),
+ SND_SOC_DAPM_OUT_DRV("ClassD", TAS2552_CFG_2, 7, 0, NULL, 0),
+ SND_SOC_DAPM_SUPPLY("PLL", TAS2552_CFG_2, 3, 0, NULL, 0),
+ SND_SOC_DAPM_POST("Post Event", tas2552_post_event),
+
+- SND_SOC_DAPM_OUTPUT("OUT")
++ SND_SOC_DAPM_OUTPUT("OUT"),
++ SND_SOC_DAPM_INPUT("DMIC")
+ };
+
+ static const struct snd_soc_dapm_route tas2552_audio_map[] = {
+@@ -134,6 +137,7 @@ static const struct snd_soc_dapm_route tas2552_audio_map[] = {
+ {"ClassD", NULL, "Input selection"},
+ {"OUT", NULL, "ClassD"},
+ {"ClassD", NULL, "PLL"},
++ {"ASI OUT", NULL, "DMIC"}
+ };
+
+ #ifdef CONFIG_PM
+@@ -538,6 +542,13 @@ static struct snd_soc_dai_driver tas2552_dai[] = {
+ .rates = SNDRV_PCM_RATE_8000_192000,
+ .formats = TAS2552_FORMATS,
+ },
++ .capture = {
++ .stream_name = "Capture",
++ .channels_min = 2,
++ .channels_max = 2,
++ .rates = SNDRV_PCM_RATE_8000_192000,
++ .formats = TAS2552_FORMATS,
++ },
+ .ops = &tas2552_speaker_dai_ops,
+ },
+ };
+--
+2.43.0
+
--- /dev/null
+From 4feffa26a7fa734df23d49a3242b48194ba5870b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 May 2024 20:23:45 +0800
+Subject: ASoC: tas2781: Fix a warning reported by robot kernel test
+
+From: Shenghao Ding <shenghao-ding@ti.com>
+
+[ Upstream commit 1ae14f3520b1a0ad144610a3f592c81a3e81cd1b ]
+
+Fix a warning reported by robot kernel test that 'fw_entry' in function
+'tas2781_load_calibration' is used uninitialized with compiler
+sh4-linux-gcc (GCC) 13.2.0, an update of copyright and a correction of the
+comments.
+
+Fixes: ef3bcde75d06 ("ASoc: tas2781: Add tas2781 driver")
+Signed-off-by: Shenghao Ding <shenghao-ding@ti.com>
+Link: https://lore.kernel.org/r/20240505122346.1326-1-shenghao-ding@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tas2781-fmwlib.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/codecs/tas2781-fmwlib.c b/sound/soc/codecs/tas2781-fmwlib.c
+index 45760fe195237..a6be81adcb839 100644
+--- a/sound/soc/codecs/tas2781-fmwlib.c
++++ b/sound/soc/codecs/tas2781-fmwlib.c
+@@ -1,8 +1,8 @@
+ // SPDX-License-Identifier: GPL-2.0
+ //
+-// tasdevice-fmw.c -- TASDEVICE firmware support
++// tas2781-fmwlib.c -- TASDEVICE firmware support
+ //
+-// Copyright 2023 Texas Instruments, Inc.
++// Copyright 2023 - 2024 Texas Instruments, Inc.
+ //
+ // Author: Shenghao Ding <shenghao-ding@ti.com>
+
+@@ -1878,7 +1878,7 @@ int tas2781_load_calibration(void *context, char *file_name,
+ {
+ struct tasdevice_priv *tas_priv = (struct tasdevice_priv *)context;
+ struct tasdevice *tasdev = &(tas_priv->tasdevice[i]);
+- const struct firmware *fw_entry;
++ const struct firmware *fw_entry = NULL;
+ struct tasdevice_fw *tas_fmw;
+ struct firmware fmw;
+ int offset = 0;
+--
+2.43.0
+
--- /dev/null
+From 7ad7244bb60b9781dfc3175e7b26b74009fd9d7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 May 2024 22:15:46 +0800
+Subject: ASoC: tas2781: Fix wrong loading calibrated data sequence
+
+From: Shenghao Ding <shenghao-ding@ti.com>
+
+[ Upstream commit b195acf5266d2dee4067f89345c3e6b88d925311 ]
+
+Calibrated data will be set to default after loading DSP config params,
+which will cause speaker protection work abnormally. Reload calibrated
+data after loading DSP config params. Remove declaration of unused API
+which load calibrated data in wrong sequence, changed the copyright year
+and correct file name in license
+header.
+
+Fixes: ef3bcde75d06 ("ASoC: tas2781: Add tas2781 driver")
+Signed-off-by: Shenghao Ding <shenghao-ding@ti.com>
+Link: https://msgid.link/r/20240518141546.1742-1-shenghao-ding@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/sound/tas2781-dsp.h | 7 +-
+ sound/soc/codecs/tas2781-fmwlib.c | 103 ++++++++----------------------
+ sound/soc/codecs/tas2781-i2c.c | 4 +-
+ 3 files changed, 32 insertions(+), 82 deletions(-)
+
+diff --git a/include/sound/tas2781-dsp.h b/include/sound/tas2781-dsp.h
+index ea9af2726a53f..7fba7ea26a4b0 100644
+--- a/include/sound/tas2781-dsp.h
++++ b/include/sound/tas2781-dsp.h
+@@ -2,7 +2,7 @@
+ //
+ // ALSA SoC Texas Instruments TAS2781 Audio Smart Amplifier
+ //
+-// Copyright (C) 2022 - 2023 Texas Instruments Incorporated
++// Copyright (C) 2022 - 2024 Texas Instruments Incorporated
+ // https://www.ti.com
+ //
+ // The TAS2781 driver implements a flexible and configurable
+@@ -13,8 +13,8 @@
+ // Author: Kevin Lu <kevin-lu@ti.com>
+ //
+
+-#ifndef __TASDEVICE_DSP_H__
+-#define __TASDEVICE_DSP_H__
++#ifndef __TAS2781_DSP_H__
++#define __TAS2781_DSP_H__
+
+ #define MAIN_ALL_DEVICES 0x0d
+ #define MAIN_DEVICE_A 0x01
+@@ -180,7 +180,6 @@ void tasdevice_calbin_remove(void *context);
+ int tasdevice_select_tuningprm_cfg(void *context, int prm,
+ int cfg_no, int rca_conf_no);
+ int tasdevice_prmg_load(void *context, int prm_no);
+-int tasdevice_prmg_calibdata_load(void *context, int prm_no);
+ void tasdevice_tuning_switch(void *context, int state);
+ int tas2781_load_calibration(void *context, char *file_name,
+ unsigned short i);
+diff --git a/sound/soc/codecs/tas2781-fmwlib.c b/sound/soc/codecs/tas2781-fmwlib.c
+index a6be81adcb839..265a8ca25cbbe 100644
+--- a/sound/soc/codecs/tas2781-fmwlib.c
++++ b/sound/soc/codecs/tas2781-fmwlib.c
+@@ -2151,6 +2151,24 @@ static int tasdevice_load_data(struct tasdevice_priv *tas_priv,
+ return ret;
+ }
+
++static void tasdev_load_calibrated_data(struct tasdevice_priv *priv, int i)
++{
++ struct tasdevice_calibration *cal;
++ struct tasdevice_fw *cal_fmw;
++
++ cal_fmw = priv->tasdevice[i].cali_data_fmw;
++
++ /* No calibrated data for current devices, playback will go ahead. */
++ if (!cal_fmw)
++ return;
++
++ cal = cal_fmw->calibrations;
++ if (cal)
++ return;
++
++ load_calib_data(priv, &cal->dev_data);
++}
++
+ int tasdevice_select_tuningprm_cfg(void *context, int prm_no,
+ int cfg_no, int rca_conf_no)
+ {
+@@ -2210,21 +2228,9 @@ int tasdevice_select_tuningprm_cfg(void *context, int prm_no,
+ for (i = 0; i < tas_priv->ndev; i++) {
+ if (tas_priv->tasdevice[i].is_loaderr == true)
+ continue;
+- else if (tas_priv->tasdevice[i].is_loaderr == false
+- && tas_priv->tasdevice[i].is_loading == true) {
+- struct tasdevice_fw *cal_fmw =
+- tas_priv->tasdevice[i].cali_data_fmw;
+-
+- if (cal_fmw) {
+- struct tasdevice_calibration
+- *cal = cal_fmw->calibrations;
+-
+- if (cal)
+- load_calib_data(tas_priv,
+- &(cal->dev_data));
+- }
++ if (tas_priv->tasdevice[i].is_loaderr == false &&
++ tas_priv->tasdevice[i].is_loading == true)
+ tas_priv->tasdevice[i].cur_prog = prm_no;
+- }
+ }
+ }
+
+@@ -2245,11 +2251,15 @@ int tasdevice_select_tuningprm_cfg(void *context, int prm_no,
+ tasdevice_load_data(tas_priv, &(conf->dev_data));
+ for (i = 0; i < tas_priv->ndev; i++) {
+ if (tas_priv->tasdevice[i].is_loaderr == true) {
+- status |= 1 << (i + 4);
++ status |= BIT(i + 4);
+ continue;
+- } else if (tas_priv->tasdevice[i].is_loaderr == false
+- && tas_priv->tasdevice[i].is_loading == true)
++ }
++
++ if (tas_priv->tasdevice[i].is_loaderr == false &&
++ tas_priv->tasdevice[i].is_loading == true) {
++ tasdev_load_calibrated_data(tas_priv, i);
+ tas_priv->tasdevice[i].cur_conf = cfg_no;
++ }
+ }
+ } else
+ dev_dbg(tas_priv->dev, "%s: Unneeded loading dsp conf %d\n",
+@@ -2308,65 +2318,6 @@ int tasdevice_prmg_load(void *context, int prm_no)
+ }
+ EXPORT_SYMBOL_NS_GPL(tasdevice_prmg_load, SND_SOC_TAS2781_FMWLIB);
+
+-int tasdevice_prmg_calibdata_load(void *context, int prm_no)
+-{
+- struct tasdevice_priv *tas_priv = (struct tasdevice_priv *) context;
+- struct tasdevice_fw *tas_fmw = tas_priv->fmw;
+- struct tasdevice_prog *program;
+- int prog_status = 0;
+- int i;
+-
+- if (!tas_fmw) {
+- dev_err(tas_priv->dev, "%s: Firmware is NULL\n", __func__);
+- goto out;
+- }
+-
+- if (prm_no >= tas_fmw->nr_programs) {
+- dev_err(tas_priv->dev,
+- "%s: prm(%d) is not in range of Programs %u\n",
+- __func__, prm_no, tas_fmw->nr_programs);
+- goto out;
+- }
+-
+- for (i = 0, prog_status = 0; i < tas_priv->ndev; i++) {
+- if (prm_no >= 0 && tas_priv->tasdevice[i].cur_prog != prm_no) {
+- tas_priv->tasdevice[i].cur_conf = -1;
+- tas_priv->tasdevice[i].is_loading = true;
+- prog_status++;
+- }
+- tas_priv->tasdevice[i].is_loaderr = false;
+- }
+-
+- if (prog_status) {
+- program = &(tas_fmw->programs[prm_no]);
+- tasdevice_load_data(tas_priv, &(program->dev_data));
+- for (i = 0; i < tas_priv->ndev; i++) {
+- if (tas_priv->tasdevice[i].is_loaderr == true)
+- continue;
+- else if (tas_priv->tasdevice[i].is_loaderr == false
+- && tas_priv->tasdevice[i].is_loading == true) {
+- struct tasdevice_fw *cal_fmw =
+- tas_priv->tasdevice[i].cali_data_fmw;
+-
+- if (cal_fmw) {
+- struct tasdevice_calibration *cal =
+- cal_fmw->calibrations;
+-
+- if (cal)
+- load_calib_data(tas_priv,
+- &(cal->dev_data));
+- }
+- tas_priv->tasdevice[i].cur_prog = prm_no;
+- }
+- }
+- }
+-
+-out:
+- return prog_status;
+-}
+-EXPORT_SYMBOL_NS_GPL(tasdevice_prmg_calibdata_load,
+- SND_SOC_TAS2781_FMWLIB);
+-
+ void tasdevice_tuning_switch(void *context, int state)
+ {
+ struct tasdevice_priv *tas_priv = (struct tasdevice_priv *) context;
+diff --git a/sound/soc/codecs/tas2781-i2c.c b/sound/soc/codecs/tas2781-i2c.c
+index b5abff230e437..9350972dfefe7 100644
+--- a/sound/soc/codecs/tas2781-i2c.c
++++ b/sound/soc/codecs/tas2781-i2c.c
+@@ -2,7 +2,7 @@
+ //
+ // ALSA SoC Texas Instruments TAS2563/TAS2781 Audio Smart Amplifier
+ //
+-// Copyright (C) 2022 - 2023 Texas Instruments Incorporated
++// Copyright (C) 2022 - 2024 Texas Instruments Incorporated
+ // https://www.ti.com
+ //
+ // The TAS2563/TAS2781 driver implements a flexible and configurable
+@@ -414,7 +414,7 @@ static void tasdevice_fw_ready(const struct firmware *fmw,
+ __func__, tas_priv->cal_binaryname[i]);
+ }
+
+- tasdevice_prmg_calibdata_load(tas_priv, 0);
++ tasdevice_prmg_load(tas_priv, 0);
+ tas_priv->cur_prog = 0;
+ out:
+ if (tas_priv->fw_state == TASDEVICE_DSP_FW_FAIL) {
+--
+2.43.0
+
--- /dev/null
+From cee3eacfaee9d33c8217d304af5db8e257ac71d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 May 2024 09:31:57 +0800
+Subject: blk-cgroup: fix list corruption from reorder of WRITE ->lqueued
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit d0aac2363549e12cc79b8e285f13d5a9f42fd08e ]
+
+__blkcg_rstat_flush() can be run anytime, especially when blk_cgroup_bio_start
+is being executed.
+
+If WRITE of `->lqueued` is re-ordered with READ of 'bisc->lnode.next' in
+the loop of __blkcg_rstat_flush(), `next_bisc` can be assigned with one
+stat instance being added in blk_cgroup_bio_start(), then the local
+list in __blkcg_rstat_flush() could be corrupted.
+
+Fix the issue by adding one barrier.
+
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Waiman Long <longman@redhat.com>
+Fixes: 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20240515013157.443672-3-ming.lei@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 86752b1652b5b..b36ba1d40ba1d 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -1036,6 +1036,16 @@ static void __blkcg_rstat_flush(struct blkcg *blkcg, int cpu)
+ struct blkg_iostat cur;
+ unsigned int seq;
+
++ /*
++ * Order assignment of `next_bisc` from `bisc->lnode.next` in
++ * llist_for_each_entry_safe and clearing `bisc->lqueued` for
++ * avoiding to assign `next_bisc` with new next pointer added
++ * in blk_cgroup_bio_start() in case of re-ordering.
++ *
++ * The pair barrier is implied in llist_add() in blk_cgroup_bio_start().
++ */
++ smp_mb();
++
+ WRITE_ONCE(bisc->lqueued, false);
+
+ /* fetch the current per-cpu values */
+--
+2.43.0
+
--- /dev/null
+From 1a53ae824a982f67bd452ba85f1348f4dc194596 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 May 2024 09:31:56 +0800
+Subject: blk-cgroup: fix list corruption from resetting io stat
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 6da6680632792709cecf2b006f2fe3ca7857e791 ]
+
+Since commit 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()"),
+each iostat instance is added to blkcg percpu list, so blkcg_reset_stats()
+can't reset the stat instance by memset(), otherwise the llist may be
+corrupted.
+
+Fix the issue by only resetting the counter part.
+
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Waiman Long <longman@redhat.com>
+Cc: Jay Shin <jaeshin@redhat.com>
+Fixes: 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Reviewed-by: Waiman Long <longman@redhat.com>
+Link: https://lore.kernel.org/r/20240515013157.443672-2-ming.lei@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 58 ++++++++++++++++++++++++++++------------------
+ 1 file changed, 35 insertions(+), 23 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 059467086b131..86752b1652b5b 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -619,12 +619,45 @@ static void blkg_destroy_all(struct gendisk *disk)
+ spin_unlock_irq(&q->queue_lock);
+ }
+
++static void blkg_iostat_set(struct blkg_iostat *dst, struct blkg_iostat *src)
++{
++ int i;
++
++ for (i = 0; i < BLKG_IOSTAT_NR; i++) {
++ dst->bytes[i] = src->bytes[i];
++ dst->ios[i] = src->ios[i];
++ }
++}
++
++static void __blkg_clear_stat(struct blkg_iostat_set *bis)
++{
++ struct blkg_iostat cur = {0};
++ unsigned long flags;
++
++ flags = u64_stats_update_begin_irqsave(&bis->sync);
++ blkg_iostat_set(&bis->cur, &cur);
++ blkg_iostat_set(&bis->last, &cur);
++ u64_stats_update_end_irqrestore(&bis->sync, flags);
++}
++
++static void blkg_clear_stat(struct blkcg_gq *blkg)
++{
++ int cpu;
++
++ for_each_possible_cpu(cpu) {
++ struct blkg_iostat_set *s = per_cpu_ptr(blkg->iostat_cpu, cpu);
++
++ __blkg_clear_stat(s);
++ }
++ __blkg_clear_stat(&blkg->iostat);
++}
++
+ static int blkcg_reset_stats(struct cgroup_subsys_state *css,
+ struct cftype *cftype, u64 val)
+ {
+ struct blkcg *blkcg = css_to_blkcg(css);
+ struct blkcg_gq *blkg;
+- int i, cpu;
++ int i;
+
+ mutex_lock(&blkcg_pol_mutex);
+ spin_lock_irq(&blkcg->lock);
+@@ -635,18 +668,7 @@ static int blkcg_reset_stats(struct cgroup_subsys_state *css,
+ * anyway. If you get hit by a race, retry.
+ */
+ hlist_for_each_entry(blkg, &blkcg->blkg_list, blkcg_node) {
+- for_each_possible_cpu(cpu) {
+- struct blkg_iostat_set *bis =
+- per_cpu_ptr(blkg->iostat_cpu, cpu);
+- memset(bis, 0, sizeof(*bis));
+-
+- /* Re-initialize the cleared blkg_iostat_set */
+- u64_stats_init(&bis->sync);
+- bis->blkg = blkg;
+- }
+- memset(&blkg->iostat, 0, sizeof(blkg->iostat));
+- u64_stats_init(&blkg->iostat.sync);
+-
++ blkg_clear_stat(blkg);
+ for (i = 0; i < BLKCG_MAX_POLS; i++) {
+ struct blkcg_policy *pol = blkcg_policy[i];
+
+@@ -949,16 +971,6 @@ void blkg_conf_exit(struct blkg_conf_ctx *ctx)
+ }
+ EXPORT_SYMBOL_GPL(blkg_conf_exit);
+
+-static void blkg_iostat_set(struct blkg_iostat *dst, struct blkg_iostat *src)
+-{
+- int i;
+-
+- for (i = 0; i < BLKG_IOSTAT_NR; i++) {
+- dst->bytes[i] = src->bytes[i];
+- dst->ios[i] = src->ios[i];
+- }
+-}
+-
+ static void blkg_iostat_add(struct blkg_iostat *dst, struct blkg_iostat *src)
+ {
+ int i;
+--
+2.43.0
+
--- /dev/null
+From 6415e4f1c13eb923cadcf26684d5659427e63df6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 May 2024 10:30:59 -0400
+Subject: blk-cgroup: Properly propagate the iostat update up the hierarchy
+
+From: Waiman Long <longman@redhat.com>
+
+[ Upstream commit 9d230c09964e6e18c8f6e4f0d41ee90eef45ec1c ]
+
+During a cgroup_rstat_flush() call, the lowest level of nodes are flushed
+first before their parents. Since commit 3b8cc6298724 ("blk-cgroup:
+Optimize blkcg_rstat_flush()"), iostat propagation was still done to
+the parent. Grandparent, however, may not get the iostat update if the
+parent has no blkg_iostat_set queued in its lhead lockless list.
+
+Fix this iostat propagation problem by queuing the parent's global
+blkg->iostat into one of its percpu lockless lists to make sure that
+the delta will always be propagated up to the grandparent and so on
+toward the root blkcg.
+
+Note that successive calls to __blkcg_rstat_flush() are serialized by
+the cgroup_rstat_lock. So no special barrier is used in the reading
+and writing of blkg->iostat.lqueued.
+
+Fixes: 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()")
+Reported-by: Dan Schatzberg <schatzberg.dan@gmail.com>
+Closes: https://lore.kernel.org/lkml/ZkO6l%2FODzadSgdhC@dschatzberg-fedora-PF3DHTBV/
+Signed-off-by: Waiman Long <longman@redhat.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20240515143059.276677-1-longman@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index b36ba1d40ba1d..96af8224992e6 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -323,6 +323,7 @@ static struct blkcg_gq *blkg_alloc(struct blkcg *blkcg, struct gendisk *disk,
+ blkg->q = disk->queue;
+ INIT_LIST_HEAD(&blkg->q_node);
+ blkg->blkcg = blkcg;
++ blkg->iostat.blkg = blkg;
+ #ifdef CONFIG_BLK_CGROUP_PUNT_BIO
+ spin_lock_init(&blkg->async_bio_lock);
+ bio_list_init(&blkg->async_bios);
+@@ -1047,6 +1048,8 @@ static void __blkcg_rstat_flush(struct blkcg *blkcg, int cpu)
+ smp_mb();
+
+ WRITE_ONCE(bisc->lqueued, false);
++ if (bisc == &blkg->iostat)
++ goto propagate_up; /* propagate up to parent only */
+
+ /* fetch the current per-cpu values */
+ do {
+@@ -1056,10 +1059,24 @@ static void __blkcg_rstat_flush(struct blkcg *blkcg, int cpu)
+
+ blkcg_iostat_update(blkg, &cur, &bisc->last);
+
++propagate_up:
+ /* propagate global delta to parent (unless that's root) */
+- if (parent && parent->parent)
++ if (parent && parent->parent) {
+ blkcg_iostat_update(parent, &blkg->iostat.cur,
+ &blkg->iostat.last);
++ /*
++ * Queue parent->iostat to its blkcg's lockless
++ * list to propagate up to the grandparent if the
++ * iostat hasn't been queued yet.
++ */
++ if (!parent->iostat.lqueued) {
++ struct llist_head *plhead;
++
++ plhead = per_cpu_ptr(parent->blkcg->lhead, cpu);
++ llist_add(&parent->iostat.lnode, plhead);
++ parent->iostat.lqueued = true;
++ }
++ }
+ }
+ raw_spin_unlock_irqrestore(&blkg_stat_lock, flags);
+ out:
+--
+2.43.0
+
--- /dev/null
+From a1e714682448fb8e4ec3e90912a6accd36ce2a98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Apr 2024 14:39:31 +0300
+Subject: Bluetooth: ISO: Handle PA sync when no BIGInfo reports are generated
+
+From: Iulia Tanasescu <iulia.tanasescu@nxp.com>
+
+[ Upstream commit d356c924e7a3adbea1e3e4ff4e098bcd9b99a82d ]
+
+In case of a Broadcast Source that has PA enabled but no active BIG,
+a Broadcast Sink needs to establish PA sync and parse BASE from PA
+reports.
+
+This commit moves the allocation of a PA sync hcon from the BIGInfo
+advertising report event to the PA sync established event. After the
+first complete PA report, the hcon is notified to the ISO layer. A
+child socket is allocated and enqueued in the parent's accept queue.
+
+BIGInfo reports also need to be processed, to extract the encryption
+field and inform userspace. After the first BIGInfo report is received,
+the PA sync hcon is notified again to the ISO layer. Since a socket will
+be found this time, the socket state will transition to BT_CONNECTED and
+the userspace will be woken up using sk_state_change.
+
+Signed-off-by: Iulia Tanasescu <iulia.tanasescu@nxp.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Stable-dep-of: a5b862c6a221 ("Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/bluetooth/hci_core.h | 3 +-
+ net/bluetooth/hci_event.c | 58 +++++++++++---------
+ net/bluetooth/iso.c | 94 ++++++++++++++------------------
+ 3 files changed, 74 insertions(+), 81 deletions(-)
+
+diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
+index 5277c6d5134ca..970101184cf10 100644
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -1335,8 +1335,7 @@ hci_conn_hash_lookup_pa_sync_handle(struct hci_dev *hdev, __u16 sync_handle)
+ rcu_read_lock();
+
+ list_for_each_entry_rcu(c, &h->list, list) {
+- if (c->type != ISO_LINK ||
+- !test_bit(HCI_CONN_PA_SYNC, &c->flags))
++ if (c->type != ISO_LINK)
+ continue;
+
+ if (c->sync_handle == sync_handle) {
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index cce73749f2dce..5449c6c086aa4 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -1,7 +1,7 @@
+ /*
+ BlueZ - Bluetooth protocol stack for Linux
+ Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
+- Copyright 2023 NXP
++ Copyright 2023-2024 NXP
+
+ Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
+
+@@ -6359,14 +6359,16 @@ static void hci_le_pa_sync_estabilished_evt(struct hci_dev *hdev, void *data,
+ if (!(flags & HCI_PROTO_DEFER))
+ goto unlock;
+
+- if (ev->status) {
+- /* Add connection to indicate the failed PA sync event */
+- pa_sync = hci_conn_add_unset(hdev, ISO_LINK, BDADDR_ANY,
+- HCI_ROLE_SLAVE);
++ /* Add connection to indicate PA sync event */
++ pa_sync = hci_conn_add_unset(hdev, ISO_LINK, BDADDR_ANY,
++ HCI_ROLE_SLAVE);
+
+- if (!pa_sync)
+- goto unlock;
++ if (!pa_sync)
++ goto unlock;
+
++ pa_sync->sync_handle = le16_to_cpu(ev->handle);
++
++ if (ev->status) {
+ set_bit(HCI_CONN_PA_SYNC_FAILED, &pa_sync->flags);
+
+ /* Notify iso layer */
+@@ -6383,6 +6385,7 @@ static void hci_le_per_adv_report_evt(struct hci_dev *hdev, void *data,
+ struct hci_ev_le_per_adv_report *ev = data;
+ int mask = hdev->link_mode;
+ __u8 flags = 0;
++ struct hci_conn *pa_sync;
+
+ bt_dev_dbg(hdev, "sync_handle 0x%4.4x", le16_to_cpu(ev->sync_handle));
+
+@@ -6390,8 +6393,28 @@ static void hci_le_per_adv_report_evt(struct hci_dev *hdev, void *data,
+
+ mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, ISO_LINK, &flags);
+ if (!(mask & HCI_LM_ACCEPT))
+- hci_le_pa_term_sync(hdev, ev->sync_handle);
++ goto unlock;
+
++ if (!(flags & HCI_PROTO_DEFER))
++ goto unlock;
++
++ pa_sync = hci_conn_hash_lookup_pa_sync_handle
++ (hdev,
++ le16_to_cpu(ev->sync_handle));
++
++ if (!pa_sync)
++ goto unlock;
++
++ if (ev->data_status == LE_PA_DATA_COMPLETE &&
++ !test_and_set_bit(HCI_CONN_PA_SYNC, &pa_sync->flags)) {
++ /* Notify iso layer */
++ hci_connect_cfm(pa_sync, 0);
++
++ /* Notify MGMT layer */
++ mgmt_device_connected(hdev, pa_sync, NULL, 0);
++ }
++
++unlock:
+ hci_dev_unlock(hdev);
+ }
+
+@@ -6926,10 +6949,8 @@ static void hci_le_big_info_adv_report_evt(struct hci_dev *hdev, void *data,
+ hci_dev_lock(hdev);
+
+ mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, ISO_LINK, &flags);
+- if (!(mask & HCI_LM_ACCEPT)) {
+- hci_le_pa_term_sync(hdev, ev->sync_handle);
++ if (!(mask & HCI_LM_ACCEPT))
+ goto unlock;
+- }
+
+ if (!(flags & HCI_PROTO_DEFER))
+ goto unlock;
+@@ -6938,24 +6959,11 @@ static void hci_le_big_info_adv_report_evt(struct hci_dev *hdev, void *data,
+ (hdev,
+ le16_to_cpu(ev->sync_handle));
+
+- if (pa_sync)
+- goto unlock;
+-
+- /* Add connection to indicate the PA sync event */
+- pa_sync = hci_conn_add_unset(hdev, ISO_LINK, BDADDR_ANY,
+- HCI_ROLE_SLAVE);
+-
+ if (IS_ERR(pa_sync))
+ goto unlock;
+
+- pa_sync->sync_handle = le16_to_cpu(ev->sync_handle);
+- set_bit(HCI_CONN_PA_SYNC, &pa_sync->flags);
+-
+ /* Notify iso layer */
+- hci_connect_cfm(pa_sync, 0x00);
+-
+- /* Notify MGMT layer */
+- mgmt_device_connected(hdev, pa_sync, NULL, 0);
++ hci_connect_cfm(pa_sync, 0);
+
+ unlock:
+ hci_dev_unlock(hdev);
+diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
+index 6cb41f9d174e2..00c0d8413c638 100644
+--- a/net/bluetooth/iso.c
++++ b/net/bluetooth/iso.c
+@@ -54,7 +54,6 @@ static void iso_sock_kill(struct sock *sk);
+ enum {
+ BT_SK_BIG_SYNC,
+ BT_SK_PA_SYNC,
+- BT_SK_PA_SYNC_TERM,
+ };
+
+ struct iso_pinfo {
+@@ -81,6 +80,7 @@ static bool check_ucast_qos(struct bt_iso_qos *qos);
+ static bool check_bcast_qos(struct bt_iso_qos *qos);
+ static bool iso_match_sid(struct sock *sk, void *data);
+ static bool iso_match_sync_handle(struct sock *sk, void *data);
++static bool iso_match_sync_handle_pa_report(struct sock *sk, void *data);
+ static void iso_sock_disconn(struct sock *sk);
+
+ typedef bool (*iso_sock_match_t)(struct sock *sk, void *data);
+@@ -197,21 +197,10 @@ static void iso_chan_del(struct sock *sk, int err)
+ sock_set_flag(sk, SOCK_ZAPPED);
+ }
+
+-static bool iso_match_conn_sync_handle(struct sock *sk, void *data)
+-{
+- struct hci_conn *hcon = data;
+-
+- if (test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags))
+- return false;
+-
+- return hcon->sync_handle == iso_pi(sk)->sync_handle;
+-}
+-
+ static void iso_conn_del(struct hci_conn *hcon, int err)
+ {
+ struct iso_conn *conn = hcon->iso_data;
+ struct sock *sk;
+- struct sock *parent;
+
+ if (!conn)
+ return;
+@@ -227,26 +216,6 @@ static void iso_conn_del(struct hci_conn *hcon, int err)
+
+ if (sk) {
+ lock_sock(sk);
+-
+- /* While a PA sync hcon is in the process of closing,
+- * mark parent socket with a flag, so that any residual
+- * BIGInfo adv reports that arrive before PA sync is
+- * terminated are not processed anymore.
+- */
+- if (test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags)) {
+- parent = iso_get_sock(&hcon->src,
+- &hcon->dst,
+- BT_LISTEN,
+- iso_match_conn_sync_handle,
+- hcon);
+-
+- if (parent) {
+- set_bit(BT_SK_PA_SYNC_TERM,
+- &iso_pi(parent)->flags);
+- sock_put(parent);
+- }
+- }
+-
+ iso_sock_clear_timer(sk);
+ iso_chan_del(sk, err);
+ release_sock(sk);
+@@ -860,6 +829,7 @@ static struct sock *iso_sock_alloc(struct net *net, struct socket *sock,
+ iso_pi(sk)->src_type = BDADDR_LE_PUBLIC;
+
+ iso_pi(sk)->qos = default_qos;
++ iso_pi(sk)->sync_handle = -1;
+
+ bt_sock_link(&iso_sk_list, sk);
+ return sk;
+@@ -907,7 +877,6 @@ static int iso_sock_bind_bc(struct socket *sock, struct sockaddr *addr,
+ return -EINVAL;
+
+ iso_pi(sk)->dst_type = sa->iso_bc->bc_bdaddr_type;
+- iso_pi(sk)->sync_handle = -1;
+
+ if (sa->iso_bc->bc_sid > 0x0f)
+ return -EINVAL;
+@@ -984,7 +953,8 @@ static int iso_sock_bind(struct socket *sock, struct sockaddr *addr,
+ /* Allow the user to bind a PA sync socket to a number
+ * of BISes to sync to.
+ */
+- if (sk->sk_state == BT_CONNECT2 &&
++ if ((sk->sk_state == BT_CONNECT2 ||
++ sk->sk_state == BT_CONNECTED) &&
+ test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags)) {
+ err = iso_sock_bind_pa_sk(sk, sa, addr_len);
+ goto done;
+@@ -1396,6 +1366,16 @@ static int iso_sock_recvmsg(struct socket *sock, struct msghdr *msg,
+ }
+ release_sock(sk);
+ return 0;
++ case BT_CONNECTED:
++ if (test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags)) {
++ iso_conn_big_sync(sk);
++ sk->sk_state = BT_LISTEN;
++ release_sock(sk);
++ return 0;
++ }
++
++ release_sock(sk);
++ break;
+ case BT_CONNECT:
+ release_sock(sk);
+ return iso_connect_cis(sk);
+@@ -1541,7 +1521,9 @@ static int iso_sock_setsockopt(struct socket *sock, int level, int optname,
+
+ case BT_ISO_QOS:
+ if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND &&
+- sk->sk_state != BT_CONNECT2) {
++ sk->sk_state != BT_CONNECT2 &&
++ (!test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags) ||
++ sk->sk_state != BT_CONNECTED)) {
+ err = -EINVAL;
+ break;
+ }
+@@ -1762,7 +1744,7 @@ static void iso_conn_ready(struct iso_conn *conn)
+ struct sock *sk = conn->sk;
+ struct hci_ev_le_big_sync_estabilished *ev = NULL;
+ struct hci_ev_le_pa_sync_established *ev2 = NULL;
+- struct hci_evt_le_big_info_adv_report *ev3 = NULL;
++ struct hci_ev_le_per_adv_report *ev3 = NULL;
+ struct hci_conn *hcon;
+
+ BT_DBG("conn %p", conn);
+@@ -1799,12 +1781,12 @@ static void iso_conn_ready(struct iso_conn *conn)
+ iso_match_sid, ev2);
+ } else if (test_bit(HCI_CONN_PA_SYNC, &hcon->flags)) {
+ ev3 = hci_recv_event_data(hcon->hdev,
+- HCI_EVT_LE_BIG_INFO_ADV_REPORT);
++ HCI_EV_LE_PER_ADV_REPORT);
+ if (ev3)
+ parent = iso_get_sock(&hcon->src,
+ &hcon->dst,
+ BT_LISTEN,
+- iso_match_sync_handle,
++ iso_match_sync_handle_pa_report,
+ ev3);
+ }
+
+@@ -1847,7 +1829,6 @@ static void iso_conn_ready(struct iso_conn *conn)
+
+ if (ev3) {
+ iso_pi(sk)->qos = iso_pi(parent)->qos;
+- iso_pi(sk)->qos.bcast.encryption = ev3->encryption;
+ hcon->iso_qos = iso_pi(sk)->qos;
+ iso_pi(sk)->bc_num_bis = iso_pi(parent)->bc_num_bis;
+ memcpy(iso_pi(sk)->bc_bis, iso_pi(parent)->bc_bis, ISO_MAX_NUM_BIS);
+@@ -1941,26 +1922,29 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
+
+ ev2 = hci_recv_event_data(hdev, HCI_EVT_LE_BIG_INFO_ADV_REPORT);
+ if (ev2) {
+- /* Try to get PA sync listening socket, if it exists */
+- sk = iso_get_sock(&hdev->bdaddr, bdaddr, BT_LISTEN,
+- iso_match_pa_sync_flag, NULL);
+-
+- if (!sk) {
+- sk = iso_get_sock(&hdev->bdaddr, bdaddr, BT_LISTEN,
+- iso_match_sync_handle, ev2);
+-
+- /* If PA Sync is in process of terminating,
+- * do not handle any more BIGInfo adv reports.
+- */
+-
+- if (sk && test_bit(BT_SK_PA_SYNC_TERM,
+- &iso_pi(sk)->flags))
+- return 0;
++ /* Check if BIGInfo report has already been handled */
++ sk = iso_get_sock(&hdev->bdaddr, bdaddr, BT_CONNECTED,
++ iso_match_sync_handle, ev2);
++ if (sk) {
++ sock_put(sk);
++ sk = NULL;
++ goto done;
+ }
+
++ /* Try to get PA sync socket, if it exists */
++ sk = iso_get_sock(&hdev->bdaddr, bdaddr, BT_CONNECT2,
++ iso_match_sync_handle, ev2);
++ if (!sk)
++ sk = iso_get_sock(&hdev->bdaddr, bdaddr,
++ BT_LISTEN,
++ iso_match_sync_handle,
++ ev2);
++
+ if (sk) {
+ int err;
+
++ iso_pi(sk)->qos.bcast.encryption = ev2->encryption;
++
+ if (ev2->num_bis < iso_pi(sk)->bc_num_bis)
+ iso_pi(sk)->bc_num_bis = ev2->num_bis;
+
+@@ -1979,6 +1963,8 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
+ }
+ }
+ }
++
++ goto done;
+ }
+
+ ev3 = hci_recv_event_data(hdev, HCI_EV_LE_PER_ADV_REPORT);
+--
+2.43.0
+
--- /dev/null
+From e56296a2e86601288f1c8d10c48c432ccef6379c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 May 2024 15:23:29 -0400
+Subject: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
+
+From: Sungwoo Kim <iam@sung-woo.kim>
+
+[ Upstream commit a5b862c6a221459d54e494e88965b48dcfa6cc44 ]
+
+l2cap_le_flowctl_init() can cause both div-by-zero and an integer
+overflow since hdev->le_mtu may not fall in the valid range.
+
+Move MTU from hci_dev to hci_conn to validate MTU and stop the connection
+process earlier if MTU is invalid.
+Also, add a missing validation in read_buffer_size() and make it return
+an error value if the validation fails.
+Now hci_conn_add() returns ERR_PTR() as it can fail due to the both a
+kzalloc failure and invalid MTU value.
+
+divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI
+CPU: 0 PID: 67 Comm: kworker/u5:0 Tainted: G W 6.9.0-rc5+ #20
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
+Workqueue: hci0 hci_rx_work
+RIP: 0010:l2cap_le_flowctl_init+0x19e/0x3f0 net/bluetooth/l2cap_core.c:547
+Code: e8 17 17 0c 00 66 41 89 9f 84 00 00 00 bf 01 00 00 00 41 b8 02 00 00 00 4c
+89 fe 4c 89 e2 89 d9 e8 27 17 0c 00 44 89 f0 31 d2 <66> f7 f3 89 c3 ff c3 4d 8d
+b7 88 00 00 00 4c 89 f0 48 c1 e8 03 42
+RSP: 0018:ffff88810bc0f858 EFLAGS: 00010246
+RAX: 00000000000002a0 RBX: 0000000000000000 RCX: dffffc0000000000
+RDX: 0000000000000000 RSI: ffff88810bc0f7c0 RDI: ffffc90002dcb66f
+RBP: ffff88810bc0f880 R08: aa69db2dda70ff01 R09: 0000ffaaaaaaaaaa
+R10: 0084000000ffaaaa R11: 0000000000000000 R12: ffff88810d65a084
+R13: dffffc0000000000 R14: 00000000000002a0 R15: ffff88810d65a000
+FS: 0000000000000000(0000) GS:ffff88811ac00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000020000100 CR3: 0000000103268003 CR4: 0000000000770ef0
+PKRU: 55555554
+Call Trace:
+ <TASK>
+ l2cap_le_connect_req net/bluetooth/l2cap_core.c:4902 [inline]
+ l2cap_le_sig_cmd net/bluetooth/l2cap_core.c:5420 [inline]
+ l2cap_le_sig_channel net/bluetooth/l2cap_core.c:5486 [inline]
+ l2cap_recv_frame+0xe59d/0x11710 net/bluetooth/l2cap_core.c:6809
+ l2cap_recv_acldata+0x544/0x10a0 net/bluetooth/l2cap_core.c:7506
+ hci_acldata_packet net/bluetooth/hci_core.c:3939 [inline]
+ hci_rx_work+0x5e5/0xb20 net/bluetooth/hci_core.c:4176
+ process_one_work kernel/workqueue.c:3254 [inline]
+ process_scheduled_works+0x90f/0x1530 kernel/workqueue.c:3335
+ worker_thread+0x926/0xe70 kernel/workqueue.c:3416
+ kthread+0x2e3/0x380 kernel/kthread.c:388
+ ret_from_fork+0x5c/0x90 arch/x86/kernel/process.c:147
+ ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
+ </TASK>
+Modules linked in:
+---[ end trace 0000000000000000 ]---
+
+Fixes: 6ed58ec520ad ("Bluetooth: Use LE buffers for LE traffic")
+Suggested-by: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
+Signed-off-by: Sungwoo Kim <iam@sung-woo.kim>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_event.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 5449c6c086aa4..1ed734a7fb313 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -6363,7 +6363,7 @@ static void hci_le_pa_sync_estabilished_evt(struct hci_dev *hdev, void *data,
+ pa_sync = hci_conn_add_unset(hdev, ISO_LINK, BDADDR_ANY,
+ HCI_ROLE_SLAVE);
+
+- if (!pa_sync)
++ if (IS_ERR(pa_sync))
+ goto unlock;
+
+ pa_sync->sync_handle = le16_to_cpu(ev->handle);
+--
+2.43.0
+
--- /dev/null
+From 4d3524084eb210492fd44245a9e2662c0dac42f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 May 2024 15:23:36 +0100
+Subject: cifs: Fix missing set of remote_i_size
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 93a43155127fec0f8cc942d63b76668c2f8f69fa ]
+
+Occasionally, the generic/001 xfstest will fail indicating corruption in
+one of the copy chains when run on cifs against a server that supports
+FSCTL_DUPLICATE_EXTENTS_TO_FILE (eg. Samba with a share on btrfs). The
+problem is that the remote_i_size value isn't updated by cifs_setsize()
+when called by smb2_duplicate_extents(), but i_size *is*.
+
+This may cause cifs_remap_file_range() to then skip the bit after calling
+->duplicate_extents() that sets sizes.
+
+Fix this by calling netfs_resize_file() in smb2_duplicate_extents() before
+calling cifs_setsize() to set i_size.
+
+This means we don't then need to call netfs_resize_file() upon return from
+->duplicate_extents(), but we also fix the test to compare against the pre-dup
+inode size.
+
+[Note that this goes back before the addition of remote_i_size with the
+netfs_inode struct. It should probably have been setting cifsi->server_eof
+previously.]
+
+Fixes: cfc63fc8126a ("smb3: fix cached file size problems in duplicate extents (reflink)")
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Steve French <sfrench@samba.org>
+cc: Paulo Alcantara <pc@manguebit.com>
+cc: Shyam Prasad N <nspmangalore@gmail.com>
+cc: Rohith Surabattula <rohiths.msft@gmail.com>
+cc: Jeff Layton <jlayton@kernel.org>
+cc: linux-cifs@vger.kernel.org
+cc: netfs@lists.linux.dev
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/cifsfs.c | 6 +++---
+ fs/smb/client/smb2ops.c | 1 +
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c
+index c8449f43856c5..4fb21affe4e11 100644
+--- a/fs/smb/client/cifsfs.c
++++ b/fs/smb/client/cifsfs.c
+@@ -1277,7 +1277,7 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off,
+ struct cifsFileInfo *smb_file_src = src_file->private_data;
+ struct cifsFileInfo *smb_file_target = dst_file->private_data;
+ struct cifs_tcon *target_tcon, *src_tcon;
+- unsigned long long destend, fstart, fend, new_size;
++ unsigned long long destend, fstart, fend, old_size, new_size;
+ unsigned int xid;
+ int rc;
+
+@@ -1344,6 +1344,7 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off,
+ goto unlock;
+ if (fend > target_cifsi->netfs.zero_point)
+ target_cifsi->netfs.zero_point = fend + 1;
++ old_size = target_cifsi->netfs.remote_i_size;
+
+ /* Discard all the folios that overlap the destination region. */
+ cifs_dbg(FYI, "about to discard pages %llx-%llx\n", fstart, fend);
+@@ -1356,9 +1357,8 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off,
+ if (target_tcon->ses->server->ops->duplicate_extents) {
+ rc = target_tcon->ses->server->ops->duplicate_extents(xid,
+ smb_file_src, smb_file_target, off, len, destoff);
+- if (rc == 0 && new_size > i_size_read(target_inode)) {
++ if (rc == 0 && new_size > old_size) {
+ truncate_setsize(target_inode, new_size);
+- netfs_resize_file(&target_cifsi->netfs, new_size, true);
+ fscache_resize_cookie(cifs_inode_cookie(target_inode),
+ new_size);
+ }
+diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
+index 28f0b7d19d534..6fea0aed43461 100644
+--- a/fs/smb/client/smb2ops.c
++++ b/fs/smb/client/smb2ops.c
+@@ -2028,6 +2028,7 @@ smb2_duplicate_extents(const unsigned int xid,
+ * size will be queried on next revalidate, but it is important
+ * to make sure that file's cached size is updated immediately
+ */
++ netfs_resize_file(netfs_inode(inode), dest_off + len, true);
+ cifs_setsize(inode, dest_off + len);
+ }
+ rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid,
+--
+2.43.0
+
--- /dev/null
+From 859ffc3a28cefa3e3cbe81edea67e7ffc25d7684 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Nov 2023 16:26:44 +0000
+Subject: cifs: Set zero_point in the copy_file_range() and remap_file_range()
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 3758c485f6c9124d8ad76b88382004cbc28a0892 ]
+
+Set zero_point in the copy_file_range() and remap_file_range()
+implementations so that we don't skip reading data modified on a
+server-side copy.
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Steve French <sfrench@samba.org>
+cc: Shyam Prasad N <nspmangalore@gmail.com>
+cc: Rohith Surabattula <rohiths.msft@gmail.com>
+cc: Jeff Layton <jlayton@kernel.org>
+cc: linux-cifs@vger.kernel.org
+cc: netfs@lists.linux.dev
+cc: linux-fsdevel@vger.kernel.org
+cc: linux-mm@kvack.org
+Stable-dep-of: 93a43155127f ("cifs: Fix missing set of remote_i_size")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/cifsfs.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c
+index 39277c37185ca..c8449f43856c5 100644
+--- a/fs/smb/client/cifsfs.c
++++ b/fs/smb/client/cifsfs.c
+@@ -1342,6 +1342,8 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off,
+ rc = cifs_flush_folio(target_inode, destend, &fstart, &fend, false);
+ if (rc)
+ goto unlock;
++ if (fend > target_cifsi->netfs.zero_point)
++ target_cifsi->netfs.zero_point = fend + 1;
+
+ /* Discard all the folios that overlap the destination region. */
+ cifs_dbg(FYI, "about to discard pages %llx-%llx\n", fstart, fend);
+@@ -1360,6 +1362,8 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off,
+ fscache_resize_cookie(cifs_inode_cookie(target_inode),
+ new_size);
+ }
++ if (rc == 0 && new_size > target_cifsi->netfs.zero_point)
++ target_cifsi->netfs.zero_point = new_size;
+ }
+
+ /* force revalidate of size and timestamps of target file now
+@@ -1451,6 +1455,8 @@ ssize_t cifs_file_copychunk_range(unsigned int xid,
+ rc = cifs_flush_folio(target_inode, destend, &fstart, &fend, false);
+ if (rc)
+ goto unlock;
++ if (fend > target_cifsi->netfs.zero_point)
++ target_cifsi->netfs.zero_point = fend + 1;
+
+ /* Discard all the folios that overlap the destination region. */
+ truncate_inode_pages_range(&target_inode->i_data, fstart, fend);
+--
+2.43.0
+
--- /dev/null
+From 092f2ac56ead21fc42c9efb5103e65ce5eb02d2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Apr 2024 11:07:48 +0800
+Subject: cxl/region: Fix cxlr_pmem leaks
+
+From: Li Zhijian <lizhijian@fujitsu.com>
+
+[ Upstream commit 1c987cf22d6b65ade46145c03eef13f0e3e81d83 ]
+
+Before this error path, cxlr_pmem pointed to a kzalloc() memory, free
+it to avoid this memory leaking.
+
+Fixes: f17b558d6663 ("cxl/pmem: Refactor nvdimm device registration, delete the workqueue")
+Signed-off-by: Li Zhijian <lizhijian@fujitsu.com>
+Reviewed-by: Dan Williams <dan.j.williams@intel.com>
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Link: https://lore.kernel.org/r/20240428030748.318985-1-lizhijian@fujitsu.com
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cxl/core/region.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
+index 5c186e0a39b96..812b2948b6c65 100644
+--- a/drivers/cxl/core/region.c
++++ b/drivers/cxl/core/region.c
+@@ -2719,6 +2719,7 @@ static struct cxl_pmem_region *cxl_pmem_region_alloc(struct cxl_region *cxlr)
+ if (i == 0) {
+ cxl_nvb = cxl_find_nvdimm_bridge(cxlmd);
+ if (!cxl_nvb) {
++ kfree(cxlr_pmem);
+ cxlr_pmem = ERR_PTR(-ENODEV);
+ goto out;
+ }
+--
+2.43.0
+
--- /dev/null
+From b0106a661b0694f2f7c44f5a4c441807038c8841 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Apr 2024 10:28:03 -0700
+Subject: cxl/trace: Correct DPA field masks for general_media & dram events
+
+From: Alison Schofield <alison.schofield@intel.com>
+
+[ Upstream commit 2042d11cb57b7e0cbda7910e5ff80e9e8bf0ae17 ]
+
+The length of Physical Address in General Media and DRAM event
+records is 64-bit, so the field mask for extracting the DPA should
+be 64-bit also, otherwise the trace event reports DPA's with the
+upper 32 bits of a DPA address masked off. If users do DPA-to-HPA
+translations this could lead to incorrect page retirement decisions.
+
+Use GENMASK_ULL() for CXL_DPA_MASK to get all the DPA address bits.
+
+Tidy up CXL_DPA_FLAGS_MASK by using GENMASK() to only mask the exact
+flag bits.
+
+These bits are defined as part of the event record physical address
+descriptions of General Media and DRAM events in CXL Spec 3.1
+Section 8.2.9.2 Events.
+
+Fixes: d54a531a430b ("cxl/mem: Trace General Media Event Record")
+Co-developed-by: Shiyang Ruan <ruansy.fnst@fujitsu.com>
+Signed-off-by: Shiyang Ruan <ruansy.fnst@fujitsu.com>
+Signed-off-by: Alison Schofield <alison.schofield@intel.com>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Link: https://lore.kernel.org/r/2867fc43c57720a4a15a3179431829b8dbd2dc16.1714496730.git.alison.schofield@intel.com
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cxl/core/trace.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/cxl/core/trace.h b/drivers/cxl/core/trace.h
+index e5f13260fc524..7c5cd069f10cc 100644
+--- a/drivers/cxl/core/trace.h
++++ b/drivers/cxl/core/trace.h
+@@ -253,8 +253,8 @@ TRACE_EVENT(cxl_generic_event,
+ * DRAM Event Record
+ * CXL rev 3.0 section 8.2.9.2.1.2; Table 8-44
+ */
+-#define CXL_DPA_FLAGS_MASK 0x3F
+-#define CXL_DPA_MASK (~CXL_DPA_FLAGS_MASK)
++#define CXL_DPA_FLAGS_MASK GENMASK(1, 0)
++#define CXL_DPA_MASK GENMASK_ULL(63, 6)
+
+ #define CXL_DPA_VOLATILE BIT(0)
+ #define CXL_DPA_NOT_REPAIRABLE BIT(1)
+--
+2.43.0
+
--- /dev/null
+From 2113ee507518885eee1646561f5bd22c2c8a45fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 May 2024 09:15:16 +0800
+Subject: drivers/xen: Improve the late XenStore init protocol
+
+From: Henry Wang <xin.wang2@amd.com>
+
+[ Upstream commit a3607581cd49c17128a486a526a36a97bafcb2bb ]
+
+Currently, the late XenStore init protocol is only triggered properly
+for the case that HVM_PARAM_STORE_PFN is ~0ULL (invalid). For the
+case that XenStore interface is allocated but not ready (the connection
+status is not XENSTORE_CONNECTED), Linux should also wait until the
+XenStore is set up properly.
+
+Introduce a macro to describe the XenStore interface is ready, use
+it in xenbus_probe_initcall() to select the code path of doing the
+late XenStore init protocol or not. Since now we have more than one
+condition for XenStore late init, rework the check in xenbus_probe()
+for the free_irq().
+
+Take the opportunity to enhance the check of the allocated XenStore
+interface can be properly mapped, and return error early if the
+memremap() fails.
+
+Fixes: 5b3353949e89 ("xen: add support for initializing xenstore later as HVM domain")
+Signed-off-by: Henry Wang <xin.wang2@amd.com>
+Signed-off-by: Michal Orzel <michal.orzel@amd.com>
+Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
+Link: https://lore.kernel.org/r/20240517011516.1451087-1-xin.wang2@amd.com
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/xenbus/xenbus_probe.c | 36 ++++++++++++++++++++-----------
+ 1 file changed, 23 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
+index 3205e5d724c8c..1a9ded0cddcb0 100644
+--- a/drivers/xen/xenbus/xenbus_probe.c
++++ b/drivers/xen/xenbus/xenbus_probe.c
+@@ -65,13 +65,17 @@
+ #include "xenbus.h"
+
+
+-static int xs_init_irq;
++static int xs_init_irq = -1;
+ int xen_store_evtchn;
+ EXPORT_SYMBOL_GPL(xen_store_evtchn);
+
+ struct xenstore_domain_interface *xen_store_interface;
+ EXPORT_SYMBOL_GPL(xen_store_interface);
+
++#define XS_INTERFACE_READY \
++ ((xen_store_interface != NULL) && \
++ (xen_store_interface->connection == XENSTORE_CONNECTED))
++
+ enum xenstore_init xen_store_domain_type;
+ EXPORT_SYMBOL_GPL(xen_store_domain_type);
+
+@@ -751,19 +755,19 @@ static void xenbus_probe(void)
+ {
+ xenstored_ready = 1;
+
+- if (!xen_store_interface) {
++ if (!xen_store_interface)
+ xen_store_interface = memremap(xen_store_gfn << XEN_PAGE_SHIFT,
+ XEN_PAGE_SIZE, MEMREMAP_WB);
+- /*
+- * Now it is safe to free the IRQ used for xenstore late
+- * initialization. No need to unbind: it is about to be
+- * bound again from xb_init_comms. Note that calling
+- * unbind_from_irqhandler now would result in xen_evtchn_close()
+- * being called and the event channel not being enabled again
+- * afterwards, resulting in missed event notifications.
+- */
++ /*
++ * Now it is safe to free the IRQ used for xenstore late
++ * initialization. No need to unbind: it is about to be
++ * bound again from xb_init_comms. Note that calling
++ * unbind_from_irqhandler now would result in xen_evtchn_close()
++ * being called and the event channel not being enabled again
++ * afterwards, resulting in missed event notifications.
++ */
++ if (xs_init_irq >= 0)
+ free_irq(xs_init_irq, &xb_waitq);
+- }
+
+ /*
+ * In the HVM case, xenbus_init() deferred its call to
+@@ -822,7 +826,7 @@ static int __init xenbus_probe_initcall(void)
+ if (xen_store_domain_type == XS_PV ||
+ (xen_store_domain_type == XS_HVM &&
+ !xs_hvm_defer_init_for_callback() &&
+- xen_store_interface != NULL))
++ XS_INTERFACE_READY))
+ xenbus_probe();
+
+ /*
+@@ -831,7 +835,7 @@ static int __init xenbus_probe_initcall(void)
+ * started, then probe. It will be triggered when communication
+ * starts happening, by waiting on xb_waitq.
+ */
+- if (xen_store_domain_type == XS_LOCAL || xen_store_interface == NULL) {
++ if (xen_store_domain_type == XS_LOCAL || !XS_INTERFACE_READY) {
+ struct task_struct *probe_task;
+
+ probe_task = kthread_run(xenbus_probe_thread, NULL,
+@@ -1014,6 +1018,12 @@ static int __init xenbus_init(void)
+ xen_store_interface =
+ memremap(xen_store_gfn << XEN_PAGE_SHIFT,
+ XEN_PAGE_SIZE, MEMREMAP_WB);
++ if (!xen_store_interface) {
++ pr_err("%s: cannot map HVM_PARAM_STORE_PFN=%llx\n",
++ __func__, v);
++ err = -EINVAL;
++ goto out_error;
++ }
+ if (xen_store_interface->connection != XENSTORE_CONNECTED)
+ wait = true;
+ }
+--
+2.43.0
+
--- /dev/null
+From 369bb24905e71127f827facbae8af8707fe936bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Apr 2024 11:22:32 +0530
+Subject: drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_
+ cp_compute_microcode() and rlc_microcode()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit acce6479e30f73ab0872e93a75aed1fb791d04ec ]
+
+The function gfx_v9_4_3_init_microcode in gfx_v9_4_3.c was generating
+about potential truncation of output when using the snprintf function.
+The issue was due to the size of the buffer 'ucode_prefix' being too
+small to accommodate the maximum possible length of the string being
+written into it.
+
+The string being written is "amdgpu/%s_mec.bin" or "amdgpu/%s_rlc.bin",
+where %s is replaced by the value of 'chip_name'. The length of this
+string without the %s is 16 characters. The warning message indicated
+that 'chip_name' could be up to 29 characters long, resulting in a total
+of 45 characters, which exceeds the buffer size of 30 characters.
+
+To resolve this issue, the size of the 'ucode_prefix' buffer has been
+reduced from 30 to 15. This ensures that the maximum possible length of
+the string being written into the buffer will not exceed its size, thus
+preventing potential buffer overflow and truncation issues.
+
+Fixes the below with gcc W=1:
+drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c: In function ‘gfx_v9_4_3_early_init’:
+drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=]
+ 379 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", chip_name);
+ | ^~
+......
+ 439 | r = gfx_v9_4_3_init_rlc_microcode(adev, ucode_prefix);
+ | ~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:9: note: ‘snprintf’ output between 16 and 45 bytes into a destination of size 30
+ 379 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", chip_name);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=]
+ 413 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", chip_name);
+ | ^~
+......
+ 443 | r = gfx_v9_4_3_init_cp_compute_microcode(adev, ucode_prefix);
+ | ~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:9: note: ‘snprintf’ output between 16 and 45 bytes into a destination of size 30
+ 413 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", chip_name);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Fixes: 86301129698b ("drm/amdgpu: split gc v9_4_3 functionality from gc v9_0")
+Cc: Hawking Zhang <Hawking.Zhang@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Suggested-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
+index f4d48d6d7e777..d89d6829f1df4 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
+@@ -431,7 +431,7 @@ static int gfx_v9_4_3_init_cp_compute_microcode(struct amdgpu_device *adev,
+
+ static int gfx_v9_4_3_init_microcode(struct amdgpu_device *adev)
+ {
+- char ucode_prefix[30];
++ char ucode_prefix[15];
+ int r;
+
+ amdgpu_ucode_ip_version_decode(adev, GC_HWIP, ucode_prefix, sizeof(ucode_prefix));
+--
+2.43.0
+
--- /dev/null
+From 999ef4a3ce01680f8fd93badcfc04c25f5e06599 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Apr 2024 17:57:52 +0800
+Subject: drm/amdgpu: init microcode chip name from ip versions
+
+From: Le Ma <le.ma@amd.com>
+
+[ Upstream commit 92ed1e9cd5f6cc4f8c9a9ba6c4d2d2bbc6221296 ]
+
+To adapt to different gc versions in gfx_v9_4_3.c file.
+
+Signed-off-by: Le Ma <le.ma@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: acce6479e30f ("drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
+index b53c8fd4e8cf3..f4d48d6d7e777 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
+@@ -431,16 +431,16 @@ static int gfx_v9_4_3_init_cp_compute_microcode(struct amdgpu_device *adev,
+
+ static int gfx_v9_4_3_init_microcode(struct amdgpu_device *adev)
+ {
+- const char *chip_name;
++ char ucode_prefix[30];
+ int r;
+
+- chip_name = "gc_9_4_3";
++ amdgpu_ucode_ip_version_decode(adev, GC_HWIP, ucode_prefix, sizeof(ucode_prefix));
+
+- r = gfx_v9_4_3_init_rlc_microcode(adev, chip_name);
++ r = gfx_v9_4_3_init_rlc_microcode(adev, ucode_prefix);
+ if (r)
+ return r;
+
+- r = gfx_v9_4_3_init_cp_compute_microcode(adev, chip_name);
++ r = gfx_v9_4_3_init_cp_compute_microcode(adev, ucode_prefix);
+ if (r)
+ return r;
+
+--
+2.43.0
+
--- /dev/null
+From 0fbbbb2d0a114c8f416133355cbd88bcc03907a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Apr 2024 05:33:52 -0500
+Subject: drm/bridge: imx: Fix unmet depenency for PHY_FSL_SAMSUNG_HDMI_PHY
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit cbdbd9ca718e6efbc77b97ddf0b19b0cd46ac36c ]
+
+When enabling i.MX8MP DWC HDMI driver, it automatically selects
+PHY_FSL_SAMSUNG_HDMI_PHY, since it wont' work without the phy.
+This may cause some Kconfig warnings during various build tests.
+Fix this by implying the phy instead of selecting the phy.
+
+To prevent this from happening with the DRM_IMX8MP_HDMI_PVI, also
+imply it instead of selecting it.
+
+Fixes: 1f36d634670d ("drm/bridge: imx: add bridge wrapper driver for i.MX8MP DWC HDMI")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202404190103.lLm8LtuP-lkp@intel.com/
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240422103352.8886-1-aford173@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/imx/Kconfig | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/imx/Kconfig b/drivers/gpu/drm/bridge/imx/Kconfig
+index 7687ed652df5b..13142a6b85905 100644
+--- a/drivers/gpu/drm/bridge/imx/Kconfig
++++ b/drivers/gpu/drm/bridge/imx/Kconfig
+@@ -8,8 +8,8 @@ config DRM_IMX8MP_DW_HDMI_BRIDGE
+ depends on COMMON_CLK
+ depends on DRM_DW_HDMI
+ depends on OF
+- select DRM_IMX8MP_HDMI_PVI
+- select PHY_FSL_SAMSUNG_HDMI_PHY
++ imply DRM_IMX8MP_HDMI_PVI
++ imply PHY_FSL_SAMSUNG_HDMI_PHY
+ help
+ Choose this to enable support for the internal HDMI encoder found
+ on the i.MX8MP SoC.
+--
+2.43.0
+
--- /dev/null
+From e9f89dd99f4862b05ac79f2f95d36bfd942927b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Feb 2024 08:19:33 +0200
+Subject: drm/bridge: tc358775: fix support for jeida-18 and jeida-24
+
+From: Michael Walle <mwalle@kernel.org>
+
+[ Upstream commit 30ea09a182cb37c4921b9d477ed18107befe6d78 ]
+
+The bridge always uses 24bpp internally. Therefore, for jeida-18
+mapping we need to discard the lowest two bits for each channel and thus
+starting with LV_[RGB]2. jeida-24 has the same mapping but uses four
+lanes instead of three, with the forth pair transmitting the lowest two
+bits of each channel. Thus, the mapping between jeida-18 and jeida-24
+is actually the same, except that one channel is turned off (by
+selecting the RGB666 format in VPCTRL).
+
+While at it, remove the bogus comment about the hardware default because
+the default is overwritten in any case.
+
+Tested with a jeida-18 display (Evervision VGG644804).
+
+Fixes: b26975593b17 ("display/drm/bridge: TC358775 DSI/LVDS driver")
+Signed-off-by: Michael Walle <mwalle@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240225062008.33191-5-tony@atomide.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358775.c | 21 +++++++++------------
+ 1 file changed, 9 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358775.c b/drivers/gpu/drm/bridge/tc358775.c
+index fea4f00a20f83..c737670631929 100644
+--- a/drivers/gpu/drm/bridge/tc358775.c
++++ b/drivers/gpu/drm/bridge/tc358775.c
+@@ -454,10 +454,6 @@ static void tc_bridge_enable(struct drm_bridge *bridge)
+ dev_dbg(tc->dev, "bus_formats %04x bpc %d\n",
+ connector->display_info.bus_formats[0],
+ tc->bpc);
+- /*
+- * Default hardware register settings of tc358775 configured
+- * with MEDIA_BUS_FMT_RGB888_1X7X4_JEIDA jeida-24 format
+- */
+ if (connector->display_info.bus_formats[0] ==
+ MEDIA_BUS_FMT_RGB888_1X7X4_SPWG) {
+ /* VESA-24 */
+@@ -468,14 +464,15 @@ static void tc_bridge_enable(struct drm_bridge *bridge)
+ d2l_write(tc->i2c, LV_MX1619, LV_MX(LVI_B6, LVI_B7, LVI_B1, LVI_B2));
+ d2l_write(tc->i2c, LV_MX2023, LV_MX(LVI_B3, LVI_B4, LVI_B5, LVI_L0));
+ d2l_write(tc->i2c, LV_MX2427, LV_MX(LVI_HS, LVI_VS, LVI_DE, LVI_R6));
+- } else { /* MEDIA_BUS_FMT_RGB666_1X7X3_SPWG - JEIDA-18 */
+- d2l_write(tc->i2c, LV_MX0003, LV_MX(LVI_R0, LVI_R1, LVI_R2, LVI_R3));
+- d2l_write(tc->i2c, LV_MX0407, LV_MX(LVI_R4, LVI_L0, LVI_R5, LVI_G0));
+- d2l_write(tc->i2c, LV_MX0811, LV_MX(LVI_G1, LVI_G2, LVI_L0, LVI_L0));
+- d2l_write(tc->i2c, LV_MX1215, LV_MX(LVI_G3, LVI_G4, LVI_G5, LVI_B0));
+- d2l_write(tc->i2c, LV_MX1619, LV_MX(LVI_L0, LVI_L0, LVI_B1, LVI_B2));
+- d2l_write(tc->i2c, LV_MX2023, LV_MX(LVI_B3, LVI_B4, LVI_B5, LVI_L0));
+- d2l_write(tc->i2c, LV_MX2427, LV_MX(LVI_HS, LVI_VS, LVI_DE, LVI_L0));
++ } else {
++ /* JEIDA-18 and JEIDA-24 */
++ d2l_write(tc->i2c, LV_MX0003, LV_MX(LVI_R2, LVI_R3, LVI_R4, LVI_R5));
++ d2l_write(tc->i2c, LV_MX0407, LV_MX(LVI_R6, LVI_R1, LVI_R7, LVI_G2));
++ d2l_write(tc->i2c, LV_MX0811, LV_MX(LVI_G3, LVI_G4, LVI_G0, LVI_G1));
++ d2l_write(tc->i2c, LV_MX1215, LV_MX(LVI_G5, LVI_G6, LVI_G7, LVI_B2));
++ d2l_write(tc->i2c, LV_MX1619, LV_MX(LVI_B0, LVI_B1, LVI_B3, LVI_B4));
++ d2l_write(tc->i2c, LV_MX2023, LV_MX(LVI_B5, LVI_B6, LVI_B7, LVI_L0));
++ d2l_write(tc->i2c, LV_MX2427, LV_MX(LVI_HS, LVI_VS, LVI_DE, LVI_R0));
+ }
+
+ d2l_write(tc->i2c, VFUEN, VFUEN_EN);
+--
+2.43.0
+
--- /dev/null
+From 10f7eec459ab8deab2f552948d11b32e40420f93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Mar 2024 11:57:02 +0100
+Subject: drm: Make drivers depends on DRM_DW_HDMI
+
+From: Maxime Ripard <mripard@kernel.org>
+
+[ Upstream commit c0e0f139354c01e0213204e4a96e7076e5a3e396 ]
+
+DRM_DW_HDMI has a number of dependencies that might not be enabled.
+However, drivers were used to selecting it while not enforcing the
+DRM_DW_HDMI dependencies.
+
+This could result in Kconfig warnings (and further build breakages) such
+as:
+
+ Kconfig warnings: (for reference only)
+ WARNING: unmet direct dependencies detected for DRM_DW_HDMI
+ Depends on [n]: HAS_IOMEM [=y] && DRM [=m] && DRM_BRIDGE [=y] && DRM_DISPLAY_HELPER [=n]
+ Selected by [m]:
+ - DRM_SUN8I_DW_HDMI [=m] && HAS_IOMEM [=y] && DRM_SUN4I [=m]
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202403262127.kZkttfNz-lkp@intel.com/
+Acked-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://lore.kernel.org/r/20240327-kms-kconfig-helpers-v3-7-eafee11b84b3@kernel.org
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Stable-dep-of: cbdbd9ca718e ("drm/bridge: imx: Fix unmet depenency for PHY_FSL_SAMSUNG_HDMI_PHY")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/imx/Kconfig | 4 ++--
+ drivers/gpu/drm/imx/ipuv3/Kconfig | 5 +++--
+ drivers/gpu/drm/ingenic/Kconfig | 2 +-
+ drivers/gpu/drm/meson/Kconfig | 2 +-
+ drivers/gpu/drm/renesas/rcar-du/Kconfig | 2 +-
+ drivers/gpu/drm/rockchip/Kconfig | 2 +-
+ drivers/gpu/drm/sun4i/Kconfig | 2 +-
+ 7 files changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/imx/Kconfig b/drivers/gpu/drm/bridge/imx/Kconfig
+index 5965e8027529a..7687ed652df5b 100644
+--- a/drivers/gpu/drm/bridge/imx/Kconfig
++++ b/drivers/gpu/drm/bridge/imx/Kconfig
+@@ -5,9 +5,9 @@ config DRM_IMX_LDB_HELPER
+
+ config DRM_IMX8MP_DW_HDMI_BRIDGE
+ tristate "Freescale i.MX8MP HDMI-TX bridge support"
+- depends on OF
+ depends on COMMON_CLK
+- select DRM_DW_HDMI
++ depends on DRM_DW_HDMI
++ depends on OF
+ select DRM_IMX8MP_HDMI_PVI
+ select PHY_FSL_SAMSUNG_HDMI_PHY
+ help
+diff --git a/drivers/gpu/drm/imx/ipuv3/Kconfig b/drivers/gpu/drm/imx/ipuv3/Kconfig
+index bacf0655ebaf3..5d810ac02171d 100644
+--- a/drivers/gpu/drm/imx/ipuv3/Kconfig
++++ b/drivers/gpu/drm/imx/ipuv3/Kconfig
+@@ -35,7 +35,8 @@ config DRM_IMX_LDB
+
+ config DRM_IMX_HDMI
+ tristate "Freescale i.MX DRM HDMI"
+- select DRM_DW_HDMI
+- depends on DRM_IMX && OF
++ depends on DRM_DW_HDMI
++ depends on DRM_IMX
++ depends on OF
+ help
+ Choose this if you want to use HDMI on i.MX6.
+diff --git a/drivers/gpu/drm/ingenic/Kconfig b/drivers/gpu/drm/ingenic/Kconfig
+index 3db117c5edd91..23effeb2ac721 100644
+--- a/drivers/gpu/drm/ingenic/Kconfig
++++ b/drivers/gpu/drm/ingenic/Kconfig
+@@ -27,8 +27,8 @@ config DRM_INGENIC_IPU
+
+ config DRM_INGENIC_DW_HDMI
+ tristate "Ingenic specific support for Synopsys DW HDMI"
++ depends on DRM_DW_HDMI
+ depends on MACH_JZ4780
+- select DRM_DW_HDMI
+ help
+ Choose this option to enable Synopsys DesignWare HDMI based driver.
+ If you want to enable HDMI on Ingenic JZ4780 based SoC, you should
+diff --git a/drivers/gpu/drm/meson/Kconfig b/drivers/gpu/drm/meson/Kconfig
+index 615fdd0ce41b4..5520b9e3f0107 100644
+--- a/drivers/gpu/drm/meson/Kconfig
++++ b/drivers/gpu/drm/meson/Kconfig
+@@ -13,9 +13,9 @@ config DRM_MESON
+
+ config DRM_MESON_DW_HDMI
+ tristate "HDMI Synopsys Controller support for Amlogic Meson Display"
++ depends on DRM_DW_HDMI
+ depends on DRM_MESON
+ default y if DRM_MESON
+- select DRM_DW_HDMI
+ imply DRM_DW_HDMI_I2S_AUDIO
+
+ config DRM_MESON_DW_MIPI_DSI
+diff --git a/drivers/gpu/drm/renesas/rcar-du/Kconfig b/drivers/gpu/drm/renesas/rcar-du/Kconfig
+index 53c356aed5d52..2dc739db2ba33 100644
+--- a/drivers/gpu/drm/renesas/rcar-du/Kconfig
++++ b/drivers/gpu/drm/renesas/rcar-du/Kconfig
+@@ -25,8 +25,8 @@ config DRM_RCAR_CMM
+ config DRM_RCAR_DW_HDMI
+ tristate "R-Car Gen3 and RZ/G2 DU HDMI Encoder Support"
+ depends on DRM && OF
++ depends on DRM_DW_HDMI
+ depends on DRM_RCAR_DU || COMPILE_TEST
+- select DRM_DW_HDMI
+ help
+ Enable support for R-Car Gen3 or RZ/G2 internal HDMI encoder.
+
+diff --git a/drivers/gpu/drm/rockchip/Kconfig b/drivers/gpu/drm/rockchip/Kconfig
+index 1bf3e2829cd07..0d5260e10f272 100644
+--- a/drivers/gpu/drm/rockchip/Kconfig
++++ b/drivers/gpu/drm/rockchip/Kconfig
+@@ -7,7 +7,6 @@ config DRM_ROCKCHIP
+ select DRM_PANEL
+ select VIDEOMODE_HELPERS
+ select DRM_ANALOGIX_DP if ROCKCHIP_ANALOGIX_DP
+- select DRM_DW_HDMI if ROCKCHIP_DW_HDMI
+ select DRM_DW_MIPI_DSI if ROCKCHIP_DW_MIPI_DSI
+ select GENERIC_PHY if ROCKCHIP_DW_MIPI_DSI
+ select GENERIC_PHY_MIPI_DPHY if ROCKCHIP_DW_MIPI_DSI
+@@ -57,6 +56,7 @@ config ROCKCHIP_CDN_DP
+
+ config ROCKCHIP_DW_HDMI
+ bool "Rockchip specific extensions for Synopsys DW HDMI"
++ depends on DRM_DW_HDMI
+ help
+ This selects support for Rockchip SoC specific extensions
+ for the Synopsys DesignWare HDMI driver. If you want to
+diff --git a/drivers/gpu/drm/sun4i/Kconfig b/drivers/gpu/drm/sun4i/Kconfig
+index 4741d9f6544c2..5b19c7cb7b7eb 100644
+--- a/drivers/gpu/drm/sun4i/Kconfig
++++ b/drivers/gpu/drm/sun4i/Kconfig
+@@ -57,8 +57,8 @@ config DRM_SUN6I_DSI
+ config DRM_SUN8I_DW_HDMI
+ tristate "Support for Allwinner version of DesignWare HDMI"
+ depends on DRM_SUN4I
++ depends on DRM_DW_HDMI
+ default DRM_SUN4I
+- select DRM_DW_HDMI
+ help
+ Choose this option if you have an Allwinner SoC with the
+ DesignWare HDMI controller. SoCs that support HDMI and
+--
+2.43.0
+
--- /dev/null
+From a6aaf4078c2e9cb21372e92ae2435ef7e68a0068 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Apr 2024 10:38:19 +0000
+Subject: drm/mediatek: dp: Fix mtk_dp_aux_transfer return value
+
+From: Wojciech Macek <wmacek@chromium.org>
+
+[ Upstream commit 8431fff9e0f3fc1c5844cf99a73b49b63ceed481 ]
+
+In case there is no DP device attached to the port the
+transfer function should return IO error, similar to what
+other drivers do.
+In case EAGAIN is returned then any read from /dev/drm_dp_aux
+device ends up in an infinite loop as the upper layers
+constantly repeats the transfer request.
+
+Fixes: f70ac097a2cf ("drm/mediatek: Add MT8195 Embedded DisplayPort driver")
+Signed-off-by: Wojciech Macek <wmacek@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/20240417103819.990512-1-wmacek@chromium.org/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_dp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_dp.c b/drivers/gpu/drm/mediatek/mtk_dp.c
+index 0ba72102636aa..536366956447a 100644
+--- a/drivers/gpu/drm/mediatek/mtk_dp.c
++++ b/drivers/gpu/drm/mediatek/mtk_dp.c
+@@ -2104,7 +2104,7 @@ static ssize_t mtk_dp_aux_transfer(struct drm_dp_aux *mtk_aux,
+
+ if (mtk_dp->bridge.type != DRM_MODE_CONNECTOR_eDP &&
+ !mtk_dp->train_info.cable_plugged_in) {
+- ret = -EAGAIN;
++ ret = -EIO;
+ goto err;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From e170816e09a8fbab83058787efa939ebb3d89560 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Apr 2024 09:46:35 +0200
+Subject: drm/meson: gate px_clk when setting rate
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit 5c9837374ecf55a1fa3b7622d365a0456960270f ]
+
+Disable the px_clk when setting the rate to recover a fully
+configured and correctly reset VCLK clock tree after the rate
+is set.
+
+Fixes: 77d9e1e6b846 ("drm/meson: add support for MIPI-DSI transceiver")
+Reviewed-by: Nicolas Belin <nbelin@baylibre.com>
+Link: https://lore.kernel.org/r/20240403-amlogic-v6-4-upstream-dsi-ccf-vim3-v12-4-99ecdfdc87fc@linaro.org
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240403-amlogic-v6-4-upstream-dsi-ccf-vim3-v12-4-99ecdfdc87fc@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/meson/meson_dw_mipi_dsi.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/gpu/drm/meson/meson_dw_mipi_dsi.c b/drivers/gpu/drm/meson/meson_dw_mipi_dsi.c
+index a6bc1bdb3d0d8..a10cff3ca1fef 100644
+--- a/drivers/gpu/drm/meson/meson_dw_mipi_dsi.c
++++ b/drivers/gpu/drm/meson/meson_dw_mipi_dsi.c
+@@ -95,6 +95,7 @@ static int dw_mipi_dsi_phy_init(void *priv_data)
+ return ret;
+ }
+
++ clk_disable_unprepare(mipi_dsi->px_clk);
+ ret = clk_set_rate(mipi_dsi->px_clk, mipi_dsi->mode->clock * 1000);
+
+ if (ret) {
+@@ -103,6 +104,12 @@ static int dw_mipi_dsi_phy_init(void *priv_data)
+ return ret;
+ }
+
++ ret = clk_prepare_enable(mipi_dsi->px_clk);
++ if (ret) {
++ dev_err(mipi_dsi->dev, "Failed to enable DSI Pixel clock (ret %d)\n", ret);
++ return ret;
++ }
++
+ switch (mipi_dsi->dsi_device->format) {
+ case MIPI_DSI_FMT_RGB888:
+ dpi_data_format = DPI_COLOR_24BIT;
+--
+2.43.0
+
--- /dev/null
+From e9c4c5241a6df810096f933eb223c731628f2d33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Apr 2024 10:53:25 +0200
+Subject: drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 46d4efcccc688cbacdd70a238bedca510acaa8e4 ]
+
+Calling a6xx_destroy() before adreno_gpu_init() leads to a null pointer
+dereference on:
+
+msm_gpu_cleanup() : platform_set_drvdata(gpu->pdev, NULL);
+
+as gpu->pdev is only assigned in:
+
+a6xx_gpu_init()
+|_ adreno_gpu_init
+ |_ msm_gpu_init()
+
+Instead of relying on handwavy null checks down the cleanup chain,
+explicitly de-allocate the LLC data and free a6xx_gpu instead.
+
+Fixes: 76efc2453d0e ("drm/msm/gpu: Fix crash during system suspend after unbind")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/588919/
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+index 441dfebb36386..7b72327df7f3f 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -3062,7 +3062,8 @@ struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)
+
+ ret = a6xx_set_supported_hw(&pdev->dev, config->info);
+ if (ret) {
+- a6xx_destroy(&(a6xx_gpu->base.base));
++ a6xx_llc_slices_destroy(a6xx_gpu);
++ kfree(a6xx_gpu);
+ return ERR_PTR(ret);
+ }
+
+--
+2.43.0
+
--- /dev/null
+From f515b0742cbe9f36946ab53719dc7cc06bd0a7ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Apr 2024 14:57:00 +0200
+Subject: drm/msm/adreno: fix CP cycles stat retrieval on a7xx
+
+From: Zan Dobersek <zdobersek@igalia.com>
+
+[ Upstream commit 328660262df89ab64031059909d763f7a8af9570 ]
+
+a7xx_submit() should use the a7xx variant of the RBBM_PERFCTR_CP register
+for retrieving the CP cycles value before and after the submitted command
+stream execution.
+
+Signed-off-by: Zan Dobersek <zdobersek@igalia.com>
+Fixes: af66706accdf ("drm/msm/a6xx: Add skeleton A7xx support")
+Patchwork: https://patchwork.freedesktop.org/patch/588445/
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+index cf0b1de1c0712..441dfebb36386 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -284,7 +284,7 @@ static void a7xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
+
+ a6xx_set_pagetable(a6xx_gpu, ring, submit->queue->ctx);
+
+- get_stats_counter(ring, REG_A6XX_RBBM_PERFCTR_CP(0),
++ get_stats_counter(ring, REG_A7XX_RBBM_PERFCTR_CP(0),
+ rbmemptr_stats(ring, index, cpcycles_start));
+ get_stats_counter(ring, REG_A6XX_CP_ALWAYS_ON_COUNTER,
+ rbmemptr_stats(ring, index, alwayson_start));
+@@ -330,7 +330,7 @@ static void a7xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
+ OUT_PKT7(ring, CP_SET_MARKER, 1);
+ OUT_RING(ring, 0x00e); /* IB1LIST end */
+
+- get_stats_counter(ring, REG_A6XX_RBBM_PERFCTR_CP(0),
++ get_stats_counter(ring, REG_A7XX_RBBM_PERFCTR_CP(0),
+ rbmemptr_stats(ring, index, cpcycles_end));
+ get_stats_counter(ring, REG_A6XX_CP_ALWAYS_ON_COUNTER,
+ rbmemptr_stats(ring, index, alwayson_end));
+--
+2.43.0
+
--- /dev/null
+From a2cc71e1d0194b83712d75b96d8650f6f7065c54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Apr 2024 11:55:23 +0300
+Subject: drm/msm/dpu: Add callback function pointer check before its call
+
+From: Aleksandr Mishin <amishin@t-argos.ru>
+
+[ Upstream commit 530f272053a5e72243a9cb07bb1296af6c346002 ]
+
+In dpu_core_irq_callback_handler() callback function pointer is compared to NULL,
+but then callback function is unconditionally called by this pointer.
+Fix this bug by adding conditional return.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: c929ac60b3ed ("drm/msm/dpu: allow just single IRQ callback")
+Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/588237/
+Link: https://lore.kernel.org/r/20240408085523.12231-1-amishin@t-argos.ru
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c
+index 6a0a74832fb64..b85881aab0478 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c
+@@ -223,9 +223,11 @@ static void dpu_core_irq_callback_handler(struct dpu_kms *dpu_kms, unsigned int
+
+ VERB("IRQ=[%d, %d]\n", DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx));
+
+- if (!irq_entry->cb)
++ if (!irq_entry->cb) {
+ DRM_ERROR("no registered cb, IRQ=[%d, %d]\n",
+ DPU_IRQ_REG(irq_idx), DPU_IRQ_BIT(irq_idx));
++ return;
++ }
+
+ atomic_inc(&irq_entry->count);
+
+--
+2.43.0
+
--- /dev/null
+From 34af238370dbf2754832003c9b868e24552c9c3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Apr 2024 01:57:44 +0200
+Subject: drm/msm/dpu: Allow configuring multiple active DSC blocks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marijn Suijten <marijn.suijten@somainline.org>
+
+[ Upstream commit ca97fa419dfe62a384fdea8b33553c4d6afe034e ]
+
+Just like the active interface and writeback block in ctl_intf_cfg_v1(),
+and later the rest of the blocks in followup active-CTL fixes or
+reworks, multiple calls to this function should enable additional DSC
+blocks instead of overwriting the blocks that are enabled.
+
+This pattern is observed in an active-CTL scenario since DPU 5.0.0 where
+for example bonded-DSI uses a single CTL to drive multiple INTFs, and
+each encoder calls this function individually with the INTF (hence the
+pre-existing update instead of overwrite of this bitmask) and DSC blocks
+it wishes to be enabled, and expects them to be OR'd into the bitmask.
+
+The reverse already exists in reset_intf_cfg_v1() where only specified
+DSC blocks are removed out of the CTL_DSC_ACTIVE bitmask (same for all
+other blocks and ACTIVE bitmasks), leaving the rest enabled.
+
+Fixes: 77f6da90487c ("drm/msm/disp/dpu1: Add DSC support in hw_ctl")
+Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/589902/
+Link: https://lore.kernel.org/r/20240417-drm-msm-initial-dualpipe-dsc-fixes-v1-4-78ae3ee9a697@somainline.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
+index a06f69d0b257d..2e50049f2f850 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
+@@ -545,6 +545,7 @@ static void dpu_hw_ctl_intf_cfg_v1(struct dpu_hw_ctl *ctx,
+ {
+ struct dpu_hw_blk_reg_map *c = &ctx->hw;
+ u32 intf_active = 0;
++ u32 dsc_active = 0;
+ u32 wb_active = 0;
+ u32 mode_sel = 0;
+
+@@ -560,6 +561,7 @@ static void dpu_hw_ctl_intf_cfg_v1(struct dpu_hw_ctl *ctx,
+
+ intf_active = DPU_REG_READ(c, CTL_INTF_ACTIVE);
+ wb_active = DPU_REG_READ(c, CTL_WB_ACTIVE);
++ dsc_active = DPU_REG_READ(c, CTL_DSC_ACTIVE);
+
+ if (cfg->intf)
+ intf_active |= BIT(cfg->intf - INTF_0);
+@@ -567,17 +569,18 @@ static void dpu_hw_ctl_intf_cfg_v1(struct dpu_hw_ctl *ctx,
+ if (cfg->wb)
+ wb_active |= BIT(cfg->wb - WB_0);
+
++ if (cfg->dsc)
++ dsc_active |= cfg->dsc;
++
+ DPU_REG_WRITE(c, CTL_TOP, mode_sel);
+ DPU_REG_WRITE(c, CTL_INTF_ACTIVE, intf_active);
+ DPU_REG_WRITE(c, CTL_WB_ACTIVE, wb_active);
++ DPU_REG_WRITE(c, CTL_DSC_ACTIVE, dsc_active);
+
+ if (cfg->merge_3d)
+ DPU_REG_WRITE(c, CTL_MERGE_3D_ACTIVE,
+ BIT(cfg->merge_3d - MERGE_3D_0));
+
+- if (cfg->dsc)
+- DPU_REG_WRITE(c, CTL_DSC_ACTIVE, cfg->dsc);
+-
+ if (cfg->cdm)
+ DPU_REG_WRITE(c, CTL_CDM_ACTIVE, cfg->cdm);
+ }
+--
+2.43.0
+
--- /dev/null
+From 9994c310e0639c31b828a1901c14dbd044ef42c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Apr 2024 01:57:43 +0200
+Subject: drm/msm/dpu: Always flush the slave INTF on the CTL
+
+From: Marijn Suijten <marijn.suijten@somainline.org>
+
+[ Upstream commit 2b938c3ab0a69ec6ea587bbf6fc2aec3db4a8736 ]
+
+As we can clearly see in a downstream kernel [1], flushing the slave INTF
+is skipped /only if/ the PPSPLIT topology is active.
+
+However, when DPU was originally submitted to mainline PPSPLIT was no
+longer part of it (seems to have been ripped out before submission), but
+this clause was incorrectly ported from the original SDE driver. Given
+that there is no support for PPSPLIT (currently), flushing the slave
+INTF should /never/ be skipped (as the `if (ppsplit && !master) goto
+skip;` clause downstream never becomes true).
+
+[1]: https://git.codelinaro.org/clo/la/platform/vendor/opensource/display-drivers/-/blob/display-kernel.lnx.5.4.r1-rel/msm/sde/sde_encoder_phys_cmd.c?ref_type=heads#L1131-1139
+
+Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
+Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/589901/
+Link: https://lore.kernel.org/r/20240417-drm-msm-initial-dualpipe-dsc-fixes-v1-3-78ae3ee9a697@somainline.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c
+index fc1d5736d7fcc..489be1c0c7046 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c
+@@ -448,9 +448,6 @@ static void dpu_encoder_phys_cmd_enable_helper(
+
+ _dpu_encoder_phys_cmd_pingpong_config(phys_enc);
+
+- if (!dpu_encoder_phys_cmd_is_master(phys_enc))
+- return;
+-
+ ctl = phys_enc->hw_ctl;
+ ctl->ops.update_pending_flush_intf(ctl, phys_enc->hw_intf->idx);
+ }
+--
+2.43.0
+
--- /dev/null
+From 10f233478d75ec71bc6e6f52e5686211f77472ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Apr 2024 01:57:41 +0200
+Subject: drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original mode
+ pclk
+
+From: Marijn Suijten <marijn.suijten@somainline.org>
+
+[ Upstream commit f12e0e12524a34bf145f7b80122e653ffe3d130a ]
+
+When dual-DSI (bonded DSI) was added in commit ed9976a09b48
+("drm/msm/dsi: adjust dsi timing for dual dsi mode") some DBG() prints
+were not updated, leading to print the original mode->clock rather
+than the adjusted (typically the mode clock divided by two, though more
+recently also adjusted for DSC compression) msm_host->pixel_clk_rate
+which is passed to clk_set_rate() just below. Fix that by printing the
+actual pixel_clk_rate that is being set.
+
+Fixes: ed9976a09b48 ("drm/msm/dsi: adjust dsi timing for dual dsi mode")
+Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/589896/
+Link: https://lore.kernel.org/r/20240417-drm-msm-initial-dualpipe-dsc-fixes-v1-1-78ae3ee9a697@somainline.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/dsi_host.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
+index 9d86a6aca6f2a..c80be74cf10b5 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
+@@ -356,8 +356,8 @@ int dsi_link_clk_set_rate_6g(struct msm_dsi_host *msm_host)
+ {
+ int ret;
+
+- DBG("Set clk rates: pclk=%d, byteclk=%lu",
+- msm_host->mode->clock, msm_host->byte_clk_rate);
++ DBG("Set clk rates: pclk=%lu, byteclk=%lu",
++ msm_host->pixel_clk_rate, msm_host->byte_clk_rate);
+
+ ret = dev_pm_opp_set_rate(&msm_host->pdev->dev,
+ msm_host->byte_clk_rate);
+@@ -430,9 +430,9 @@ int dsi_link_clk_set_rate_v2(struct msm_dsi_host *msm_host)
+ {
+ int ret;
+
+- DBG("Set clk rates: pclk=%d, byteclk=%lu, esc_clk=%lu, dsi_src_clk=%lu",
+- msm_host->mode->clock, msm_host->byte_clk_rate,
+- msm_host->esc_clk_rate, msm_host->src_clk_rate);
++ DBG("Set clk rates: pclk=%lu, byteclk=%lu, esc_clk=%lu, dsi_src_clk=%lu",
++ msm_host->pixel_clk_rate, msm_host->byte_clk_rate,
++ msm_host->esc_clk_rate, msm_host->src_clk_rate);
+
+ ret = clk_set_rate(msm_host->byte_clk, msm_host->byte_clk_rate);
+ if (ret) {
+--
+2.43.0
+
--- /dev/null
+From 60ec8f132c5e23c789751d558fea423451bb01f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 May 2024 23:43:52 +0300
+Subject: drm/nouveau: use tile_mode and pte_kind for VM_BIND bo allocations
+
+From: Mohamed Ahmed <mohamedahmedegypt2001@gmail.com>
+
+[ Upstream commit 959314c438caf1b62d787f02d54a193efda38880 ]
+
+Allow PTE kind and tile mode on BO create with VM_BIND, and add a
+GETPARAM to indicate this change. This is needed to support modifiers in
+NVK and ensure correctness when dealing with the nouveau GL driver.
+
+The userspace modifiers implementation this is for can be found here:
+https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/24795
+
+Fixes: b88baab82871 ("drm/nouveau: implement new VM_BIND uAPI")
+Signed-off-by: Mohamed Ahmed <mohamedahmedegypt2001@gmail.com>
+Reviewed-by: Faith Ekstrand <faith.ekstrand@collabora.com>
+Signed-off-by: Danilo Krummrich <dakr@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240509204352.7597-1-mohamedahmedegypt2001@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_abi16.c | 3 ++
+ drivers/gpu/drm/nouveau/nouveau_bo.c | 44 +++++++++++--------------
+ include/uapi/drm/nouveau_drm.h | 7 ++++
+ 3 files changed, 29 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
+index 80f74ee0fc786..47e53e17b4e58 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
++++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
+@@ -272,6 +272,9 @@ nouveau_abi16_ioctl_getparam(ABI16_IOCTL_ARGS)
+ getparam->value = (u64)ttm_resource_manager_usage(vram_mgr);
+ break;
+ }
++ case NOUVEAU_GETPARAM_HAS_VMA_TILEMODE:
++ getparam->value = 1;
++ break;
+ default:
+ NV_PRINTK(dbg, cli, "unknown parameter %lld\n", getparam->param);
+ return -EINVAL;
+diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
+index db8cbf6151129..186add400ea5f 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
++++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
+@@ -241,28 +241,28 @@ nouveau_bo_alloc(struct nouveau_cli *cli, u64 *size, int *align, u32 domain,
+ }
+
+ nvbo->contig = !(tile_flags & NOUVEAU_GEM_TILE_NONCONTIG);
+- if (!nouveau_cli_uvmm(cli) || internal) {
+- /* for BO noVM allocs, don't assign kinds */
+- if (cli->device.info.family >= NV_DEVICE_INFO_V0_FERMI) {
+- nvbo->kind = (tile_flags & 0x0000ff00) >> 8;
+- if (!nvif_mmu_kind_valid(mmu, nvbo->kind)) {
+- kfree(nvbo);
+- return ERR_PTR(-EINVAL);
+- }
+
+- nvbo->comp = mmu->kind[nvbo->kind] != nvbo->kind;
+- } else if (cli->device.info.family >= NV_DEVICE_INFO_V0_TESLA) {
+- nvbo->kind = (tile_flags & 0x00007f00) >> 8;
+- nvbo->comp = (tile_flags & 0x00030000) >> 16;
+- if (!nvif_mmu_kind_valid(mmu, nvbo->kind)) {
+- kfree(nvbo);
+- return ERR_PTR(-EINVAL);
+- }
+- } else {
+- nvbo->zeta = (tile_flags & 0x00000007);
++ if (cli->device.info.family >= NV_DEVICE_INFO_V0_FERMI) {
++ nvbo->kind = (tile_flags & 0x0000ff00) >> 8;
++ if (!nvif_mmu_kind_valid(mmu, nvbo->kind)) {
++ kfree(nvbo);
++ return ERR_PTR(-EINVAL);
++ }
++
++ nvbo->comp = mmu->kind[nvbo->kind] != nvbo->kind;
++ } else if (cli->device.info.family >= NV_DEVICE_INFO_V0_TESLA) {
++ nvbo->kind = (tile_flags & 0x00007f00) >> 8;
++ nvbo->comp = (tile_flags & 0x00030000) >> 16;
++ if (!nvif_mmu_kind_valid(mmu, nvbo->kind)) {
++ kfree(nvbo);
++ return ERR_PTR(-EINVAL);
+ }
+- nvbo->mode = tile_mode;
++ } else {
++ nvbo->zeta = (tile_flags & 0x00000007);
++ }
++ nvbo->mode = tile_mode;
+
++ if (!nouveau_cli_uvmm(cli) || internal) {
+ /* Determine the desirable target GPU page size for the buffer. */
+ for (i = 0; i < vmm->page_nr; i++) {
+ /* Because we cannot currently allow VMM maps to fail
+@@ -304,12 +304,6 @@ nouveau_bo_alloc(struct nouveau_cli *cli, u64 *size, int *align, u32 domain,
+ }
+ nvbo->page = vmm->page[pi].shift;
+ } else {
+- /* reject other tile flags when in VM mode. */
+- if (tile_mode)
+- return ERR_PTR(-EINVAL);
+- if (tile_flags & ~NOUVEAU_GEM_TILE_NONCONTIG)
+- return ERR_PTR(-EINVAL);
+-
+ /* Determine the desirable target GPU page size for the buffer. */
+ for (i = 0; i < vmm->page_nr; i++) {
+ /* Because we cannot currently allow VMM maps to fail
+diff --git a/include/uapi/drm/nouveau_drm.h b/include/uapi/drm/nouveau_drm.h
+index cd84227f1b42f..5402f77ee8594 100644
+--- a/include/uapi/drm/nouveau_drm.h
++++ b/include/uapi/drm/nouveau_drm.h
+@@ -68,6 +68,13 @@ extern "C" {
+ */
+ #define NOUVEAU_GETPARAM_VRAM_USED 19
+
++/*
++ * NOUVEAU_GETPARAM_HAS_VMA_TILEMODE
++ *
++ * Query whether tile mode and PTE kind are accepted with VM allocs or not.
++ */
++#define NOUVEAU_GETPARAM_HAS_VMA_TILEMODE 20
++
+ struct drm_nouveau_getparam {
+ __u64 param;
+ __u64 value;
+--
+2.43.0
+
--- /dev/null
+From d6817dc61b3b6a1e4f098b25109e7f2ecaaf0ee8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Mar 2024 15:47:41 -0500
+Subject: drm: zynqmp_dpsub: Always register bridge
+
+From: Sean Anderson <sean.anderson@linux.dev>
+
+[ Upstream commit be3f3042391d061cfca2bd22630e0d101acea5fc ]
+
+We must always register the DRM bridge, since zynqmp_dp_hpd_work_func
+calls drm_bridge_hpd_notify, which in turn expects hpd_mutex to be
+initialized. We do this before zynqmp_dpsub_drm_init since that calls
+drm_bridge_attach. This fixes the following lockdep warning:
+
+[ 19.217084] ------------[ cut here ]------------
+[ 19.227530] DEBUG_LOCKS_WARN_ON(lock->magic != lock)
+[ 19.227768] WARNING: CPU: 0 PID: 140 at kernel/locking/mutex.c:582 __mutex_lock+0x4bc/0x550
+[ 19.241696] Modules linked in:
+[ 19.244937] CPU: 0 PID: 140 Comm: kworker/0:4 Not tainted 6.6.20+ #96
+[ 19.252046] Hardware name: xlnx,zynqmp (DT)
+[ 19.256421] Workqueue: events zynqmp_dp_hpd_work_func
+[ 19.261795] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[ 19.269104] pc : __mutex_lock+0x4bc/0x550
+[ 19.273364] lr : __mutex_lock+0x4bc/0x550
+[ 19.277592] sp : ffffffc085c5bbe0
+[ 19.281066] x29: ffffffc085c5bbe0 x28: 0000000000000000 x27: ffffff88009417f8
+[ 19.288624] x26: ffffff8800941788 x25: ffffff8800020008 x24: ffffffc082aa3000
+[ 19.296227] x23: ffffffc080d90e3c x22: 0000000000000002 x21: 0000000000000000
+[ 19.303744] x20: 0000000000000000 x19: ffffff88002f5210 x18: 0000000000000000
+[ 19.311295] x17: 6c707369642e3030 x16: 3030613464662072 x15: 0720072007200720
+[ 19.318922] x14: 0000000000000000 x13: 284e4f5f4e524157 x12: 0000000000000001
+[ 19.326442] x11: 0001ffc085c5b940 x10: 0001ff88003f388b x9 : 0001ff88003f3888
+[ 19.334003] x8 : 0001ff88003f3888 x7 : 0000000000000000 x6 : 0000000000000000
+[ 19.341537] x5 : 0000000000000000 x4 : 0000000000001668 x3 : 0000000000000000
+[ 19.349054] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffff88003f3880
+[ 19.356581] Call trace:
+[ 19.359160] __mutex_lock+0x4bc/0x550
+[ 19.363032] mutex_lock_nested+0x24/0x30
+[ 19.367187] drm_bridge_hpd_notify+0x2c/0x6c
+[ 19.371698] zynqmp_dp_hpd_work_func+0x44/0x54
+[ 19.376364] process_one_work+0x3ac/0x988
+[ 19.380660] worker_thread+0x398/0x694
+[ 19.384736] kthread+0x1bc/0x1c0
+[ 19.388241] ret_from_fork+0x10/0x20
+[ 19.392031] irq event stamp: 183
+[ 19.395450] hardirqs last enabled at (183): [<ffffffc0800b9278>] finish_task_switch.isra.0+0xa8/0x2d4
+[ 19.405140] hardirqs last disabled at (182): [<ffffffc081ad3754>] __schedule+0x714/0xd04
+[ 19.413612] softirqs last enabled at (114): [<ffffffc080133de8>] srcu_invoke_callbacks+0x158/0x23c
+[ 19.423128] softirqs last disabled at (110): [<ffffffc080133de8>] srcu_invoke_callbacks+0x158/0x23c
+[ 19.432614] ---[ end trace 0000000000000000 ]---
+
+Fixes: eb2d64bfcc17 ("drm: xlnx: zynqmp_dpsub: Report HPD through the bridge")
+Signed-off-by: Sean Anderson <sean.anderson@linux.dev>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240308204741.3631919-1-sean.anderson@linux.dev
+(cherry picked from commit 61ba791c4a7a09a370c45b70a81b8c7d4cf6b2ae)
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/xlnx/zynqmp_dpsub.c b/drivers/gpu/drm/xlnx/zynqmp_dpsub.c
+index 88eb33acd5f0d..face8d6b2a6fb 100644
+--- a/drivers/gpu/drm/xlnx/zynqmp_dpsub.c
++++ b/drivers/gpu/drm/xlnx/zynqmp_dpsub.c
+@@ -256,12 +256,12 @@ static int zynqmp_dpsub_probe(struct platform_device *pdev)
+ if (ret)
+ goto err_dp;
+
++ drm_bridge_add(dpsub->bridge);
++
+ if (dpsub->dma_enabled) {
+ ret = zynqmp_dpsub_drm_init(dpsub);
+ if (ret)
+ goto err_disp;
+- } else {
+- drm_bridge_add(dpsub->bridge);
+ }
+
+ dev_info(&pdev->dev, "ZynqMP DisplayPort Subsystem driver probed");
+@@ -288,9 +288,8 @@ static void zynqmp_dpsub_remove(struct platform_device *pdev)
+
+ if (dpsub->drm)
+ zynqmp_dpsub_drm_cleanup(dpsub);
+- else
+- drm_bridge_remove(dpsub->bridge);
+
++ drm_bridge_remove(dpsub->bridge);
+ zynqmp_disp_remove(dpsub);
+ zynqmp_dp_remove(dpsub);
+
+--
+2.43.0
+
--- /dev/null
+From 1f76d6d2d2ece612c75ce8e90d7a15b1c56b6fde Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Apr 2024 09:54:34 +0300
+Subject: fs/ntfs3: Check 'folio' pointer for NULL
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit 1cd6c96219c429ebcfa8e79a865277376c563803 ]
+
+It can be NULL if bmap is called.
+
+Fixes: 82cae269cfa95 ("fs/ntfs3: Add initialization of super block")
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/inode.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
+index ba5a39a2f957d..90d4e9a9859e4 100644
+--- a/fs/ntfs3/inode.c
++++ b/fs/ntfs3/inode.c
+@@ -577,13 +577,18 @@ static noinline int ntfs_get_block_vbo(struct inode *inode, u64 vbo,
+ clear_buffer_uptodate(bh);
+
+ if (is_resident(ni)) {
+- ni_lock(ni);
+- err = attr_data_read_resident(ni, &folio->page);
+- ni_unlock(ni);
+-
+- if (!err)
+- set_buffer_uptodate(bh);
++ bh->b_blocknr = RESIDENT_LCN;
+ bh->b_size = block_size;
++ if (!folio) {
++ err = 0;
++ } else {
++ ni_lock(ni);
++ err = attr_data_read_resident(ni, &folio->page);
++ ni_unlock(ni);
++
++ if (!err)
++ set_buffer_uptodate(bh);
++ }
+ return err;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From 8803e3950264583e5b724736038648a8aedfe1ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Apr 2024 09:45:09 +0300
+Subject: fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit e931f6b630ffb22d66caab202a52aa8cbb10c649 ]
+
+For example, in the expression:
+ vbo = 2 * vbo + skip
+
+Fixes: b46acd6a6a627 ("fs/ntfs3: Add NTFS journal")
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/fslog.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
+index 855519713bf79..4085fe30bf481 100644
+--- a/fs/ntfs3/fslog.c
++++ b/fs/ntfs3/fslog.c
+@@ -1184,7 +1184,8 @@ static int read_log_page(struct ntfs_log *log, u32 vbo,
+ static int log_read_rst(struct ntfs_log *log, bool first,
+ struct restart_info *info)
+ {
+- u32 skip, vbo;
++ u32 skip;
++ u64 vbo;
+ struct RESTART_HDR *r_page = NULL;
+
+ /* Determine which restart area we are looking for. */
+--
+2.43.0
+
--- /dev/null
+From 2d75630d4d5c4099b5242fd80c6404a957b62824 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Apr 2024 09:43:58 +0300
+Subject: fs/ntfs3: Use variable length array instead of fixed size
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit 1997cdc3e727526aa5d84b32f7cbb3f56459b7ef ]
+
+Should fix smatch warning:
+ ntfs_set_label() error: __builtin_memcpy() 'uni->name' too small (20 vs 256)
+
+Fixes: 4534a70b7056f ("fs/ntfs3: Add headers and misc files")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/202401091421.3RJ24Mn3-lkp@intel.com/
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/ntfs.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h
+index 9c7478150a035..3d6143c7abc03 100644
+--- a/fs/ntfs3/ntfs.h
++++ b/fs/ntfs3/ntfs.h
+@@ -59,7 +59,7 @@ struct GUID {
+ struct cpu_str {
+ u8 len;
+ u8 unused;
+- u16 name[10];
++ u16 name[];
+ };
+
+ struct le_str {
+--
+2.43.0
+
--- /dev/null
+From e8179c548167c3b1dc8d32a3a2254407d41759ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 May 2024 12:40:08 -0400
+Subject: i3c: master: svc: change ENXIO to EAGAIN when IBI occurs during start
+ frame
+
+From: Frank Li <Frank.Li@nxp.com>
+
+[ Upstream commit 7f3d633b460be5553a65a247def5426d16805e72 ]
+
+svc_i3c_master_xfer() returns error ENXIO if an In-Band Interrupt (IBI)
+occurs when the host starts the frame.
+
+Change error code to EAGAIN to inform the client driver that this
+situation has occurred and to try again sometime later.
+
+Fixes: 5e5e3c92e748 ("i3c: master: svc: fix wrong data return when IBI happen during start frame")
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/r/20240506164009.21375-2-Frank.Li@nxp.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/svc-i3c-master.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c
+index 5ee4db68988e2..a2298ab460a37 100644
+--- a/drivers/i3c/master/svc-i3c-master.c
++++ b/drivers/i3c/master/svc-i3c-master.c
+@@ -1080,7 +1080,7 @@ static int svc_i3c_master_xfer(struct svc_i3c_master *master,
+ * and yield the above events handler.
+ */
+ if (SVC_I3C_MSTATUS_IBIWON(reg)) {
+- ret = -ENXIO;
++ ret = -EAGAIN;
+ *actual_len = 0;
+ goto emit_stop;
+ }
+--
+2.43.0
+
--- /dev/null
+From 3649c0398131430be99b7ed070c84a376d5790fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2024 12:39:53 -0700
+Subject: ice: Interpret .set_channels() input differently
+
+From: Larysa Zaremba <larysa.zaremba@intel.com>
+
+[ Upstream commit 05d6f442f31f901d27dbc64fd504a8ec7d5013de ]
+
+A bug occurs because a safety check guarding AF_XDP-related queues in
+ethnl_set_channels(), does not trigger. This happens, because kernel and
+ice driver interpret the ethtool command differently.
+
+How the bug occurs:
+1. ethtool -l <IFNAME> -> combined: 40
+2. Attach AF_XDP to queue 30
+3. ethtool -L <IFNAME> rx 15 tx 15
+ combined number is not specified, so command becomes {rx_count = 15,
+ tx_count = 15, combined_count = 40}.
+4. ethnl_set_channels checks, if there are any AF_XDP of queues from the
+ new (combined_count + rx_count) to the old one, so from 55 to 40, check
+ does not trigger.
+5. ice interprets `rx 15 tx 15` as 15 combined channels and deletes the
+ queue that AF_XDP is attached to.
+
+Interpret the command in a way that is more consistent with ethtool
+manual [0] (--show-channels and --set-channels).
+
+Considering that in the ice driver only the difference between RX and TX
+queues forms dedicated channels, change the correct way to set number of
+channels to:
+
+ethtool -L <IFNAME> combined 10 /* For symmetric queues */
+ethtool -L <IFNAME> combined 8 tx 2 rx 0 /* For asymmetric queues */
+
+[0] https://man7.org/linux/man-pages/man8/ethtool.8.html
+
+Fixes: 87324e747fde ("ice: Implement ethtool ops for channels")
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com>
+Tested-by: Chandan Kumar Rout <chandanx.rout@intel.com>
+Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com>
+Acked-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_ethtool.c | 19 ++-----------------
+ 1 file changed, 2 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+index 78b833b3e1d7e..62c8205fcebae 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+@@ -3593,7 +3593,6 @@ static int ice_set_channels(struct net_device *dev, struct ethtool_channels *ch)
+ struct ice_pf *pf = vsi->back;
+ int new_rx = 0, new_tx = 0;
+ bool locked = false;
+- u32 curr_combined;
+ int ret = 0;
+
+ /* do not support changing channels in Safe Mode */
+@@ -3615,22 +3614,8 @@ static int ice_set_channels(struct net_device *dev, struct ethtool_channels *ch)
+ return -EOPNOTSUPP;
+ }
+
+- curr_combined = ice_get_combined_cnt(vsi);
+-
+- /* these checks are for cases where user didn't specify a particular
+- * value on cmd line but we get non-zero value anyway via
+- * get_channels(); look at ethtool.c in ethtool repository (the user
+- * space part), particularly, do_schannels() routine
+- */
+- if (ch->rx_count == vsi->num_rxq - curr_combined)
+- ch->rx_count = 0;
+- if (ch->tx_count == vsi->num_txq - curr_combined)
+- ch->tx_count = 0;
+- if (ch->combined_count == curr_combined)
+- ch->combined_count = 0;
+-
+- if (!(ch->combined_count || (ch->rx_count && ch->tx_count))) {
+- netdev_err(dev, "Please specify at least 1 Rx and 1 Tx channel\n");
++ if (ch->rx_count && ch->tx_count) {
++ netdev_err(dev, "Dedicated RX or TX channels cannot be used simultaneously\n");
+ return -EINVAL;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From b604219c8401ed394f79ec500c17d4b1119cdab4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2024 12:39:54 -0700
+Subject: idpf: Interpret .set_channels() input differently
+
+From: Larysa Zaremba <larysa.zaremba@intel.com>
+
+[ Upstream commit 5e7695e0219bf6acb96081af3ba0ca08b1829656 ]
+
+Unlike ice, idpf does not check, if user has requested at least 1 combined
+channel. Instead, it relies on a check in the core code. Unfortunately, the
+check does not trigger for us because of the hacky .set_channels()
+interpretation logic that is not consistent with the core code.
+
+This naturally leads to user being able to trigger a crash with an invalid
+input. This is how:
+
+1. ethtool -l <IFNAME> -> combined: 40
+2. ethtool -L <IFNAME> rx 0 tx 0
+ combined number is not specified, so command becomes {rx_count = 0,
+ tx_count = 0, combined_count = 40}.
+3. ethnl_set_channels checks, if there is at least 1 RX and 1 TX channel,
+ comparing (combined_count + rx_count) and (combined_count + tx_count)
+ to zero. Obviously, (40 + 0) is greater than zero, so the core code
+ deems the input OK.
+4. idpf interprets `rx 0 tx 0` as 0 channels and tries to proceed with such
+ configuration.
+
+The issue has to be solved fundamentally, as current logic is also known to
+cause AF_XDP problems in ice [0].
+
+Interpret the command in a way that is more consistent with ethtool
+manual [1] (--show-channels and --set-channels) and new ice logic.
+
+Considering that in the idpf driver only the difference between RX and TX
+queues forms dedicated channels, change the correct way to set number of
+channels to:
+
+ethtool -L <IFNAME> combined 10 /* For symmetric queues */
+ethtool -L <IFNAME> combined 8 tx 2 rx 0 /* For asymmetric queues */
+
+[0] https://lore.kernel.org/netdev/20240418095857.2827-1-larysa.zaremba@intel.com/
+[1] https://man7.org/linux/man-pages/man8/ethtool.8.html
+
+Fixes: 02cbfba1add5 ("idpf: add ethtool callbacks")
+Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Reviewed-by: Igor Bagnucki <igor.bagnucki@intel.com>
+Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com>
+Tested-by: Krishneil Singh <krishneil.k.singh@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/intel/idpf/idpf_ethtool.c | 21 ++++++-------------
+ 1 file changed, 6 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_ethtool.c b/drivers/net/ethernet/intel/idpf/idpf_ethtool.c
+index 6972d728431cb..1885ba618981d 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_ethtool.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_ethtool.c
+@@ -222,14 +222,19 @@ static int idpf_set_channels(struct net_device *netdev,
+ struct ethtool_channels *ch)
+ {
+ struct idpf_vport_config *vport_config;
+- u16 combined, num_txq, num_rxq;
+ unsigned int num_req_tx_q;
+ unsigned int num_req_rx_q;
+ struct idpf_vport *vport;
++ u16 num_txq, num_rxq;
+ struct device *dev;
+ int err = 0;
+ u16 idx;
+
++ if (ch->rx_count && ch->tx_count) {
++ netdev_err(netdev, "Dedicated RX or TX channels cannot be used simultaneously\n");
++ return -EINVAL;
++ }
++
+ idpf_vport_ctrl_lock(netdev);
+ vport = idpf_netdev_to_vport(netdev);
+
+@@ -239,20 +244,6 @@ static int idpf_set_channels(struct net_device *netdev,
+ num_txq = vport_config->user_config.num_req_tx_qs;
+ num_rxq = vport_config->user_config.num_req_rx_qs;
+
+- combined = min(num_txq, num_rxq);
+-
+- /* these checks are for cases where user didn't specify a particular
+- * value on cmd line but we get non-zero value anyway via
+- * get_channels(); look at ethtool.c in ethtool repository (the user
+- * space part), particularly, do_schannels() routine
+- */
+- if (ch->combined_count == combined)
+- ch->combined_count = 0;
+- if (ch->combined_count && ch->rx_count == num_rxq - combined)
+- ch->rx_count = 0;
+- if (ch->combined_count && ch->tx_count == num_txq - combined)
+- ch->tx_count = 0;
+-
+ num_req_tx_q = ch->combined_count + ch->tx_count;
+ num_req_rx_q = ch->combined_count + ch->rx_count;
+
+--
+2.43.0
+
--- /dev/null
+From ea9ea060dfa9b8d4bf5e79a6a1933a0d69760eb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Oct 2023 14:10:18 +0200
+Subject: Input: cyapa - add missing input core locking to suspend/resume
+ functions
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 7b4e0b39182cf5e677c1fc092a3ec40e621c25b6 ]
+
+Grab input->mutex during suspend/resume functions like it is done in
+other input drivers. This fixes the following warning during system
+suspend/resume cycle on Samsung Exynos5250-based Snow Chromebook:
+
+------------[ cut here ]------------
+WARNING: CPU: 1 PID: 1680 at drivers/input/input.c:2291 input_device_enabled+0x68/0x6c
+Modules linked in: ...
+CPU: 1 PID: 1680 Comm: kworker/u4:12 Tainted: G W 6.6.0-rc5-next-20231009 #14109
+Hardware name: Samsung Exynos (Flattened Device Tree)
+Workqueue: events_unbound async_run_entry_fn
+ unwind_backtrace from show_stack+0x10/0x14
+ show_stack from dump_stack_lvl+0x58/0x70
+ dump_stack_lvl from __warn+0x1a8/0x1cc
+ __warn from warn_slowpath_fmt+0x18c/0x1b4
+ warn_slowpath_fmt from input_device_enabled+0x68/0x6c
+ input_device_enabled from cyapa_gen3_set_power_mode+0x13c/0x1dc
+ cyapa_gen3_set_power_mode from cyapa_reinitialize+0x10c/0x15c
+ cyapa_reinitialize from cyapa_resume+0x48/0x98
+ cyapa_resume from dpm_run_callback+0x90/0x298
+ dpm_run_callback from device_resume+0xb4/0x258
+ device_resume from async_resume+0x20/0x64
+ async_resume from async_run_entry_fn+0x40/0x15c
+ async_run_entry_fn from process_scheduled_works+0xbc/0x6a8
+ process_scheduled_works from worker_thread+0x188/0x454
+ worker_thread from kthread+0x108/0x140
+ kthread from ret_from_fork+0x14/0x28
+Exception stack(0xf1625fb0 to 0xf1625ff8)
+...
+---[ end trace 0000000000000000 ]---
+...
+------------[ cut here ]------------
+WARNING: CPU: 1 PID: 1680 at drivers/input/input.c:2291 input_device_enabled+0x68/0x6c
+Modules linked in: ...
+CPU: 1 PID: 1680 Comm: kworker/u4:12 Tainted: G W 6.6.0-rc5-next-20231009 #14109
+Hardware name: Samsung Exynos (Flattened Device Tree)
+Workqueue: events_unbound async_run_entry_fn
+ unwind_backtrace from show_stack+0x10/0x14
+ show_stack from dump_stack_lvl+0x58/0x70
+ dump_stack_lvl from __warn+0x1a8/0x1cc
+ __warn from warn_slowpath_fmt+0x18c/0x1b4
+ warn_slowpath_fmt from input_device_enabled+0x68/0x6c
+ input_device_enabled from cyapa_gen3_set_power_mode+0x13c/0x1dc
+ cyapa_gen3_set_power_mode from cyapa_reinitialize+0x10c/0x15c
+ cyapa_reinitialize from cyapa_resume+0x48/0x98
+ cyapa_resume from dpm_run_callback+0x90/0x298
+ dpm_run_callback from device_resume+0xb4/0x258
+ device_resume from async_resume+0x20/0x64
+ async_resume from async_run_entry_fn+0x40/0x15c
+ async_run_entry_fn from process_scheduled_works+0xbc/0x6a8
+ process_scheduled_works from worker_thread+0x188/0x454
+ worker_thread from kthread+0x108/0x140
+ kthread from ret_from_fork+0x14/0x28
+Exception stack(0xf1625fb0 to 0xf1625ff8)
+...
+---[ end trace 0000000000000000 ]---
+
+Fixes: d69f0a43c677 ("Input: use input_device_enabled()")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Reviewed-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
+Link: https://lore.kernel.org/r/20231009121018.1075318-1-m.szyprowski@samsung.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/mouse/cyapa.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/input/mouse/cyapa.c b/drivers/input/mouse/cyapa.c
+index 5979deabe23d1..256f757a13267 100644
+--- a/drivers/input/mouse/cyapa.c
++++ b/drivers/input/mouse/cyapa.c
+@@ -1347,10 +1347,16 @@ static int cyapa_suspend(struct device *dev)
+ u8 power_mode;
+ int error;
+
+- error = mutex_lock_interruptible(&cyapa->state_sync_lock);
++ error = mutex_lock_interruptible(&cyapa->input->mutex);
+ if (error)
+ return error;
+
++ error = mutex_lock_interruptible(&cyapa->state_sync_lock);
++ if (error) {
++ mutex_unlock(&cyapa->input->mutex);
++ return error;
++ }
++
+ /*
+ * Runtime PM is enable only when device is in operational mode and
+ * users in use, so need check it before disable it to
+@@ -1385,6 +1391,8 @@ static int cyapa_suspend(struct device *dev)
+ cyapa->irq_wake = (enable_irq_wake(client->irq) == 0);
+
+ mutex_unlock(&cyapa->state_sync_lock);
++ mutex_unlock(&cyapa->input->mutex);
++
+ return 0;
+ }
+
+@@ -1394,6 +1402,7 @@ static int cyapa_resume(struct device *dev)
+ struct cyapa *cyapa = i2c_get_clientdata(client);
+ int error;
+
++ mutex_lock(&cyapa->input->mutex);
+ mutex_lock(&cyapa->state_sync_lock);
+
+ if (device_may_wakeup(dev) && cyapa->irq_wake) {
+@@ -1412,6 +1421,7 @@ static int cyapa_resume(struct device *dev)
+ enable_irq(client->irq);
+
+ mutex_unlock(&cyapa->state_sync_lock);
++ mutex_unlock(&cyapa->input->mutex);
+ return 0;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From 22b19cf206f4fa7b5cd61e855aec544f589139f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Mar 2024 13:28:56 -0700
+Subject: Input: ims-pcu - fix printf string overflow
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit bf32bceedd0453c70d9d022e2e29f98e446d7161 ]
+
+clang warns about a string overflow in this driver
+
+drivers/input/misc/ims-pcu.c:1802:2: error: 'snprintf' will always be truncated; specified size is 10, but format string expands to at least 12 [-Werror,-Wformat-truncation]
+drivers/input/misc/ims-pcu.c:1814:2: error: 'snprintf' will always be truncated; specified size is 10, but format string expands to at least 12 [-Werror,-Wformat-truncation]
+
+Make the buffer a little longer to ensure it always fits.
+
+Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20240326223825.4084412-7-arnd@kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/misc/ims-pcu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
+index 6e8cc28debd97..80d16c92a08b3 100644
+--- a/drivers/input/misc/ims-pcu.c
++++ b/drivers/input/misc/ims-pcu.c
+@@ -42,8 +42,8 @@ struct ims_pcu_backlight {
+ #define IMS_PCU_PART_NUMBER_LEN 15
+ #define IMS_PCU_SERIAL_NUMBER_LEN 8
+ #define IMS_PCU_DOM_LEN 8
+-#define IMS_PCU_FW_VERSION_LEN (9 + 1)
+-#define IMS_PCU_BL_VERSION_LEN (9 + 1)
++#define IMS_PCU_FW_VERSION_LEN 16
++#define IMS_PCU_BL_VERSION_LEN 16
+ #define IMS_PCU_BL_RESET_REASON_LEN (2 + 1)
+
+ #define IMS_PCU_PCU_B_DEVICE_ID 5
+--
+2.43.0
+
--- /dev/null
+From 82350f77d502ec4bf727d52133c1db36cde011e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Mar 2024 12:46:14 -0700
+Subject: Input: ioc3kbd - add device table
+
+From: Karel Balej <balejk@matfyz.cz>
+
+[ Upstream commit d40e9edcf3eb925c259df9f9dd7319a4fcbc675b ]
+
+Without the device table the driver will not auto-load when compiled as
+a module.
+
+Fixes: 273db8f03509 ("Input: add IOC3 serio driver")
+Signed-off-by: Karel Balej <balejk@matfyz.cz>
+Link: https://lore.kernel.org/r/20240313115832.8052-1-balejk@matfyz.cz
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/serio/ioc3kbd.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/input/serio/ioc3kbd.c b/drivers/input/serio/ioc3kbd.c
+index 50552dc7b4f5e..676b0bda3d720 100644
+--- a/drivers/input/serio/ioc3kbd.c
++++ b/drivers/input/serio/ioc3kbd.c
+@@ -200,9 +200,16 @@ static void ioc3kbd_remove(struct platform_device *pdev)
+ serio_unregister_port(d->aux);
+ }
+
++static const struct platform_device_id ioc3kbd_id_table[] = {
++ { "ioc3-kbd", },
++ { }
++};
++MODULE_DEVICE_TABLE(platform, ioc3kbd_id_table);
++
+ static struct platform_driver ioc3kbd_driver = {
+ .probe = ioc3kbd_probe,
+ .remove_new = ioc3kbd_remove,
++ .id_table = ioc3kbd_id_table,
+ .driver = {
+ .name = "ioc3-kbd",
+ },
+--
+2.43.0
+
--- /dev/null
+From 650fe296b8ad0f12855e5ab4fd4e7c9afd3ef27a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Apr 2024 16:03:40 -0700
+Subject: Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation
+
+From: Fenglin Wu <quic_fenglinw@quicinc.com>
+
+[ Upstream commit 48c0687a322d54ac7e7a685c0b6db78d78f593af ]
+
+The output voltage is inclusive hence the max level calculation is
+off-by-one-step. Correct it.
+
+iWhile we are at it also add a define for the step size instead of
+using the magic value.
+
+Fixes: 11205bb63e5c ("Input: add support for pm8xxx based vibrator driver")
+Signed-off-by: Fenglin Wu <quic_fenglinw@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20240412-pm8xxx-vibrator-new-design-v10-1-0ec0ad133866@quicinc.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/misc/pm8xxx-vibrator.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/input/misc/pm8xxx-vibrator.c b/drivers/input/misc/pm8xxx-vibrator.c
+index 5c288fe7accf1..79f478d3a9b37 100644
+--- a/drivers/input/misc/pm8xxx-vibrator.c
++++ b/drivers/input/misc/pm8xxx-vibrator.c
+@@ -13,7 +13,8 @@
+
+ #define VIB_MAX_LEVEL_mV (3100)
+ #define VIB_MIN_LEVEL_mV (1200)
+-#define VIB_MAX_LEVELS (VIB_MAX_LEVEL_mV - VIB_MIN_LEVEL_mV)
++#define VIB_PER_STEP_mV (100)
++#define VIB_MAX_LEVELS (VIB_MAX_LEVEL_mV - VIB_MIN_LEVEL_mV + VIB_PER_STEP_mV)
+
+ #define MAX_FF_SPEED 0xff
+
+@@ -117,10 +118,10 @@ static void pm8xxx_work_handler(struct work_struct *work)
+ vib->active = true;
+ vib->level = ((VIB_MAX_LEVELS * vib->speed) / MAX_FF_SPEED) +
+ VIB_MIN_LEVEL_mV;
+- vib->level /= 100;
++ vib->level /= VIB_PER_STEP_mV;
+ } else {
+ vib->active = false;
+- vib->level = VIB_MIN_LEVEL_mV / 100;
++ vib->level = VIB_MIN_LEVEL_mV / VIB_PER_STEP_mV;
+ }
+
+ pm8xxx_vib_set(vib, vib->active);
+--
+2.43.0
+
--- /dev/null
+From 20bc565bc9964e7be35d8eb077790a2bd4668f05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 May 2024 08:54:35 +0800
+Subject: ipv6: sr: fix memleak in seg6_hmac_init_algo
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit efb9f4f19f8e37fde43dfecebc80292d179f56c6 ]
+
+seg6_hmac_init_algo returns without cleaning up the previous allocations
+if one fails, so it's going to leak all that memory and the crypto tfms.
+
+Update seg6_hmac_exit to only free the memory when allocated, so we can
+reuse the code directly.
+
+Fixes: bf355b8d2c30 ("ipv6: sr: add core files for SR HMAC support")
+Reported-by: Sabrina Dubroca <sd@queasysnail.net>
+Closes: https://lore.kernel.org/netdev/Zj3bh-gE7eT6V6aH@hog/
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
+Link: https://lore.kernel.org/r/20240517005435.2600277-1-liuhangbin@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/seg6_hmac.c | 42 ++++++++++++++++++++++++++++--------------
+ 1 file changed, 28 insertions(+), 14 deletions(-)
+
+diff --git a/net/ipv6/seg6_hmac.c b/net/ipv6/seg6_hmac.c
+index 861e0366f549d..bbf5b84a70fca 100644
+--- a/net/ipv6/seg6_hmac.c
++++ b/net/ipv6/seg6_hmac.c
+@@ -356,6 +356,7 @@ static int seg6_hmac_init_algo(void)
+ struct crypto_shash *tfm;
+ struct shash_desc *shash;
+ int i, alg_count, cpu;
++ int ret = -ENOMEM;
+
+ alg_count = ARRAY_SIZE(hmac_algos);
+
+@@ -366,12 +367,14 @@ static int seg6_hmac_init_algo(void)
+ algo = &hmac_algos[i];
+ algo->tfms = alloc_percpu(struct crypto_shash *);
+ if (!algo->tfms)
+- return -ENOMEM;
++ goto error_out;
+
+ for_each_possible_cpu(cpu) {
+ tfm = crypto_alloc_shash(algo->name, 0, 0);
+- if (IS_ERR(tfm))
+- return PTR_ERR(tfm);
++ if (IS_ERR(tfm)) {
++ ret = PTR_ERR(tfm);
++ goto error_out;
++ }
+ p_tfm = per_cpu_ptr(algo->tfms, cpu);
+ *p_tfm = tfm;
+ }
+@@ -383,18 +386,22 @@ static int seg6_hmac_init_algo(void)
+
+ algo->shashs = alloc_percpu(struct shash_desc *);
+ if (!algo->shashs)
+- return -ENOMEM;
++ goto error_out;
+
+ for_each_possible_cpu(cpu) {
+ shash = kzalloc_node(shsize, GFP_KERNEL,
+ cpu_to_node(cpu));
+ if (!shash)
+- return -ENOMEM;
++ goto error_out;
+ *per_cpu_ptr(algo->shashs, cpu) = shash;
+ }
+ }
+
+ return 0;
++
++error_out:
++ seg6_hmac_exit();
++ return ret;
+ }
+
+ int __init seg6_hmac_init(void)
+@@ -412,22 +419,29 @@ int __net_init seg6_hmac_net_init(struct net *net)
+ void seg6_hmac_exit(void)
+ {
+ struct seg6_hmac_algo *algo = NULL;
++ struct crypto_shash *tfm;
++ struct shash_desc *shash;
+ int i, alg_count, cpu;
+
+ alg_count = ARRAY_SIZE(hmac_algos);
+ for (i = 0; i < alg_count; i++) {
+ algo = &hmac_algos[i];
+- for_each_possible_cpu(cpu) {
+- struct crypto_shash *tfm;
+- struct shash_desc *shash;
+
+- shash = *per_cpu_ptr(algo->shashs, cpu);
+- kfree(shash);
+- tfm = *per_cpu_ptr(algo->tfms, cpu);
+- crypto_free_shash(tfm);
++ if (algo->shashs) {
++ for_each_possible_cpu(cpu) {
++ shash = *per_cpu_ptr(algo->shashs, cpu);
++ kfree(shash);
++ }
++ free_percpu(algo->shashs);
++ }
++
++ if (algo->tfms) {
++ for_each_possible_cpu(cpu) {
++ tfm = *per_cpu_ptr(algo->tfms, cpu);
++ crypto_free_shash(tfm);
++ }
++ free_percpu(algo->tfms);
+ }
+- free_percpu(algo->tfms);
+- free_percpu(algo->shashs);
+ }
+ }
+ EXPORT_SYMBOL(seg6_hmac_exit);
+--
+2.43.0
+
--- /dev/null
+From 88658814d941b03db4cefde20f1e91b8173b0438 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 May 2024 18:45:41 +0200
+Subject: ipv6: sr: fix missing sk_buff release in seg6_input_core
+
+From: Andrea Mayer <andrea.mayer@uniroma2.it>
+
+[ Upstream commit 5447f9708d9e4c17a647b16a9cb29e9e02820bd9 ]
+
+The seg6_input() function is responsible for adding the SRH into a
+packet, delegating the operation to the seg6_input_core(). This function
+uses the skb_cow_head() to ensure that there is sufficient headroom in
+the sk_buff for accommodating the link-layer header.
+In the event that the skb_cow_header() function fails, the
+seg6_input_core() catches the error but it does not release the sk_buff,
+which will result in a memory leak.
+
+This issue was introduced in commit af3b5158b89d ("ipv6: sr: fix BUG due
+to headroom too small after SRH push") and persists even after commit
+7a3f5b0de364 ("netfilter: add netfilter hooks to SRv6 data plane"),
+where the entire seg6_input() code was refactored to deal with netfilter
+hooks.
+
+The proposed patch addresses the identified memory leak by requiring the
+seg6_input_core() function to release the sk_buff in the event that
+skb_cow_head() fails.
+
+Fixes: af3b5158b89d ("ipv6: sr: fix BUG due to headroom too small after SRH push")
+Signed-off-by: Andrea Mayer <andrea.mayer@uniroma2.it>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/seg6_iptunnel.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
+index 03b877ff45588..a75df2ec8db0d 100644
+--- a/net/ipv6/seg6_iptunnel.c
++++ b/net/ipv6/seg6_iptunnel.c
+@@ -459,10 +459,8 @@ static int seg6_input_core(struct net *net, struct sock *sk,
+ int err;
+
+ err = seg6_do_srh(skb);
+- if (unlikely(err)) {
+- kfree_skb(skb);
+- return err;
+- }
++ if (unlikely(err))
++ goto drop;
+
+ slwt = seg6_lwt_lwtunnel(orig_dst->lwtstate);
+
+@@ -486,7 +484,7 @@ static int seg6_input_core(struct net *net, struct sock *sk,
+
+ err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev));
+ if (unlikely(err))
+- return err;
++ goto drop;
+
+ if (static_branch_unlikely(&nf_hooks_lwtunnel_enabled))
+ return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
+@@ -494,6 +492,9 @@ static int seg6_input_core(struct net *net, struct sock *sk,
+ skb_dst(skb)->dev, seg6_input_finish);
+
+ return seg6_input_finish(dev_net(skb->dev), NULL, skb);
++drop:
++ kfree_skb(skb);
++ return err;
+ }
+
+ static int seg6_input_nf(struct sk_buff *skb)
+--
+2.43.0
+
--- /dev/null
+From 56be57a16bda3b79cacddfa9b867ca2c87d2189f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 May 2024 15:01:18 +0200
+Subject: kasan, fortify: properly rename memintrinsics
+
+From: Andrey Konovalov <andreyknvl@gmail.com>
+
+[ Upstream commit 2e577732e8d28b9183df701fb90cb7943aa4ed16 ]
+
+After commit 69d4c0d32186 ("entry, kasan, x86: Disallow overriding mem*()
+functions") and the follow-up fixes, with CONFIG_FORTIFY_SOURCE enabled,
+even though the compiler instruments meminstrinsics by generating calls to
+__asan/__hwasan_ prefixed functions, FORTIFY_SOURCE still uses
+uninstrumented memset/memmove/memcpy as the underlying functions.
+
+As a result, KASAN cannot detect bad accesses in memset/memmove/memcpy.
+This also makes KASAN tests corrupt kernel memory and cause crashes.
+
+To fix this, use __asan_/__hwasan_memset/memmove/memcpy as the underlying
+functions whenever appropriate. Do this only for the instrumented code
+(as indicated by __SANITIZE_ADDRESS__).
+
+Link: https://lkml.kernel.org/r/20240517130118.759301-1-andrey.konovalov@linux.dev
+Fixes: 69d4c0d32186 ("entry, kasan, x86: Disallow overriding mem*() functions")
+Fixes: 51287dcb00cc ("kasan: emit different calls for instrumentable memintrinsics")
+Fixes: 36be5cba99f6 ("kasan: treat meminstrinsic as builtins in uninstrumented files")
+Signed-off-by: Andrey Konovalov <andreyknvl@gmail.com>
+Reported-by: Erhard Furtner <erhard_f@mailbox.org>
+Reported-by: Nico Pache <npache@redhat.com>
+Closes: https://lore.kernel.org/all/20240501144156.17e65021@outsider.home/
+Reviewed-by: Marco Elver <elver@google.com>
+Tested-by: Nico Pache <npache@redhat.com>
+Acked-by: Nico Pache <npache@redhat.com>
+Cc: Alexander Potapenko <glider@google.com>
+Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
+Cc: Daniel Axtens <dja@axtens.net>
+Cc: Dmitry Vyukov <dvyukov@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/fortify-string.h | 22 ++++++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/include/linux/fortify-string.h b/include/linux/fortify-string.h
+index 6eaa190d0083c..9754f97e71e52 100644
+--- a/include/linux/fortify-string.h
++++ b/include/linux/fortify-string.h
+@@ -71,17 +71,30 @@ void __write_overflow_field(size_t avail, size_t wanted) __compiletime_warning("
+ __ret; \
+ })
+
+-#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
++#if defined(__SANITIZE_ADDRESS__)
++
++#if !defined(CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX) && !defined(CONFIG_GENERIC_ENTRY)
++extern void *__underlying_memset(void *p, int c, __kernel_size_t size) __RENAME(memset);
++extern void *__underlying_memmove(void *p, const void *q, __kernel_size_t size) __RENAME(memmove);
++extern void *__underlying_memcpy(void *p, const void *q, __kernel_size_t size) __RENAME(memcpy);
++#elif defined(CONFIG_KASAN_GENERIC)
++extern void *__underlying_memset(void *p, int c, __kernel_size_t size) __RENAME(__asan_memset);
++extern void *__underlying_memmove(void *p, const void *q, __kernel_size_t size) __RENAME(__asan_memmove);
++extern void *__underlying_memcpy(void *p, const void *q, __kernel_size_t size) __RENAME(__asan_memcpy);
++#else /* CONFIG_KASAN_SW_TAGS */
++extern void *__underlying_memset(void *p, int c, __kernel_size_t size) __RENAME(__hwasan_memset);
++extern void *__underlying_memmove(void *p, const void *q, __kernel_size_t size) __RENAME(__hwasan_memmove);
++extern void *__underlying_memcpy(void *p, const void *q, __kernel_size_t size) __RENAME(__hwasan_memcpy);
++#endif
++
+ extern void *__underlying_memchr(const void *p, int c, __kernel_size_t size) __RENAME(memchr);
+ extern int __underlying_memcmp(const void *p, const void *q, __kernel_size_t size) __RENAME(memcmp);
+-extern void *__underlying_memcpy(void *p, const void *q, __kernel_size_t size) __RENAME(memcpy);
+-extern void *__underlying_memmove(void *p, const void *q, __kernel_size_t size) __RENAME(memmove);
+-extern void *__underlying_memset(void *p, int c, __kernel_size_t size) __RENAME(memset);
+ extern char *__underlying_strcat(char *p, const char *q) __RENAME(strcat);
+ extern char *__underlying_strcpy(char *p, const char *q) __RENAME(strcpy);
+ extern __kernel_size_t __underlying_strlen(const char *p) __RENAME(strlen);
+ extern char *__underlying_strncat(char *p, const char *q, __kernel_size_t count) __RENAME(strncat);
+ extern char *__underlying_strncpy(char *p, const char *q, __kernel_size_t size) __RENAME(strncpy);
++
+ #else
+
+ #if defined(__SANITIZE_MEMORY__)
+@@ -106,6 +119,7 @@ extern char *__underlying_strncpy(char *p, const char *q, __kernel_size_t size)
+ #define __underlying_strlen __builtin_strlen
+ #define __underlying_strncat __builtin_strncat
+ #define __underlying_strncpy __builtin_strncpy
++
+ #endif
+
+ /**
+--
+2.43.0
+
--- /dev/null
+From cf65939b3977db8089903ebd8479c1a9dcd0d110 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 May 2024 07:19:52 +0000
+Subject: KVM: arm64: Destroy mpidr_data for 'late' vCPU creation
+
+From: Oliver Upton <oliver.upton@linux.dev>
+
+[ Upstream commit ce5d2448eb8fe83aed331db53a08612286a137dd ]
+
+A particularly annoying userspace could create a vCPU after KVM has
+computed mpidr_data for the VM, either by racing against VGIC
+initialization or having a userspace irqchip.
+
+In any case, this means mpidr_data no longer fully describes the VM, and
+attempts to find the new vCPU with kvm_mpidr_to_vcpu() will fail. The
+fix is to discard mpidr_data altogether, as it is only a performance
+optimization and not required for correctness. In all likelihood KVM
+will recompute the mappings when KVM_RUN is called on the new vCPU.
+
+Note that reads of mpidr_data are not guarded by a lock; promote to RCU
+to cope with the possibility of mpidr_data being invalidated at runtime.
+
+Fixes: 54a8006d0b49 ("KVM: arm64: Fast-track kvm_mpidr_to_vcpu() when mpidr_data is available")
+Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
+Link: https://lore.kernel.org/r/20240508071952.2035422-1-oliver.upton@linux.dev
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kvm/arm.c | 50 ++++++++++++++++++++++++++++++++++++--------
+ 1 file changed, 41 insertions(+), 9 deletions(-)
+
+diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
+index c4a0a35e02c72..6cda738a41577 100644
+--- a/arch/arm64/kvm/arm.c
++++ b/arch/arm64/kvm/arm.c
+@@ -195,6 +195,23 @@ void kvm_arch_create_vm_debugfs(struct kvm *kvm)
+ kvm_sys_regs_create_debugfs(kvm);
+ }
+
++static void kvm_destroy_mpidr_data(struct kvm *kvm)
++{
++ struct kvm_mpidr_data *data;
++
++ mutex_lock(&kvm->arch.config_lock);
++
++ data = rcu_dereference_protected(kvm->arch.mpidr_data,
++ lockdep_is_held(&kvm->arch.config_lock));
++ if (data) {
++ rcu_assign_pointer(kvm->arch.mpidr_data, NULL);
++ synchronize_rcu();
++ kfree(data);
++ }
++
++ mutex_unlock(&kvm->arch.config_lock);
++}
++
+ /**
+ * kvm_arch_destroy_vm - destroy the VM data structure
+ * @kvm: pointer to the KVM struct
+@@ -209,7 +226,8 @@ void kvm_arch_destroy_vm(struct kvm *kvm)
+ if (is_protected_kvm_enabled())
+ pkvm_destroy_hyp_vm(kvm);
+
+- kfree(kvm->arch.mpidr_data);
++ kvm_destroy_mpidr_data(kvm);
++
+ kfree(kvm->arch.sysreg_masks);
+ kvm_destroy_vcpus(kvm);
+
+@@ -395,6 +413,13 @@ int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu)
+
+ vcpu->arch.hw_mmu = &vcpu->kvm->arch.mmu;
+
++ /*
++ * This vCPU may have been created after mpidr_data was initialized.
++ * Throw out the pre-computed mappings if that is the case which forces
++ * KVM to fall back to iteratively searching the vCPUs.
++ */
++ kvm_destroy_mpidr_data(vcpu->kvm);
++
+ err = kvm_vgic_vcpu_init(vcpu);
+ if (err)
+ return err;
+@@ -594,7 +619,8 @@ static void kvm_init_mpidr_data(struct kvm *kvm)
+
+ mutex_lock(&kvm->arch.config_lock);
+
+- if (kvm->arch.mpidr_data || atomic_read(&kvm->online_vcpus) == 1)
++ if (rcu_access_pointer(kvm->arch.mpidr_data) ||
++ atomic_read(&kvm->online_vcpus) == 1)
+ goto out;
+
+ kvm_for_each_vcpu(c, vcpu, kvm) {
+@@ -631,7 +657,7 @@ static void kvm_init_mpidr_data(struct kvm *kvm)
+ data->cmpidr_to_idx[index] = c;
+ }
+
+- kvm->arch.mpidr_data = data;
++ rcu_assign_pointer(kvm->arch.mpidr_data, data);
+ out:
+ mutex_unlock(&kvm->arch.config_lock);
+ }
+@@ -2470,21 +2496,27 @@ static int __init init_hyp_mode(void)
+
+ struct kvm_vcpu *kvm_mpidr_to_vcpu(struct kvm *kvm, unsigned long mpidr)
+ {
+- struct kvm_vcpu *vcpu;
++ struct kvm_vcpu *vcpu = NULL;
++ struct kvm_mpidr_data *data;
+ unsigned long i;
+
+ mpidr &= MPIDR_HWID_BITMASK;
+
+- if (kvm->arch.mpidr_data) {
+- u16 idx = kvm_mpidr_index(kvm->arch.mpidr_data, mpidr);
++ rcu_read_lock();
++ data = rcu_dereference(kvm->arch.mpidr_data);
+
+- vcpu = kvm_get_vcpu(kvm,
+- kvm->arch.mpidr_data->cmpidr_to_idx[idx]);
++ if (data) {
++ u16 idx = kvm_mpidr_index(data, mpidr);
++
++ vcpu = kvm_get_vcpu(kvm, data->cmpidr_to_idx[idx]);
+ if (mpidr != kvm_vcpu_get_mpidr_aff(vcpu))
+ vcpu = NULL;
++ }
+
++ rcu_read_unlock();
++
++ if (vcpu)
+ return vcpu;
+- }
+
+ kvm_for_each_vcpu(i, vcpu, kvm) {
+ if (mpidr == kvm_vcpu_get_mpidr_aff(vcpu))
+--
+2.43.0
+
--- /dev/null
+From de21af66569dbd3311a9943b5794124e4a2e1dbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Apr 2024 09:27:29 +0530
+Subject: KVM: PPC: Book3S HV nestedv2: Cancel pending DEC exception
+
+From: Vaibhav Jain <vaibhav@linux.ibm.com>
+
+[ Upstream commit 7be6ce7043b4cf293c8826a48fd9f56931cef2cf ]
+
+This reverts commit 180c6b072bf3 ("KVM: PPC: Book3S HV nestedv2: Do not
+cancel pending decrementer exception") [1] which prevented canceling a
+pending HDEC exception for nestedv2 KVM guests. It was done to avoid
+overhead of a H_GUEST_GET_STATE hcall to read the 'DEC expiry TB' register
+which was higher compared to handling extra decrementer exceptions.
+
+However recent benchmarks indicate that overhead of not handling 'DECR'
+expiry for Nested KVM Guest(L2) is higher and results in much larger exits
+to Pseries Host(L1) as indicated by the Unixbench-arithoh bench[2]
+
+Metric | Current upstream | Revert [1] | Difference %
+========================================================================
+arithoh-count (10) | 3244831634 | 3403089673 | +04.88%
+kvm_hv:kvm_guest_exit | 513558 | 152441 | -70.32%
+probe:kvmppc_gsb_recv | 28060 | 28110 | +00.18%
+
+N=1
+
+As indicated by the data above that reverting [1] results in substantial
+reduction in number of L2->L1 exits with only slight increase in number of
+H_GUEST_GET_STATE hcalls to read the value of 'DEC expiry TB'. This results
+in an overall ~4% improvement of arithoh[2] throughput.
+
+[1] commit 180c6b072bf3 ("KVM: PPC: Book3S HV nestedv2: Do not cancel pending decrementer exception")
+[2] https://github.com/kdlucas/byte-unixbench/
+
+Fixes: 180c6b072bf3 ("KVM: PPC: Book3S HV nestedv2: Do not cancel pending decrementer exception")
+Signed-off-by: Vaibhav Jain <vaibhav@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20240415035731.103097-1-vaibhav@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/book3s_hv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index 8e86eb577eb8e..692a7c6f5fd91 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -4857,7 +4857,7 @@ int kvmhv_run_single_vcpu(struct kvm_vcpu *vcpu, u64 time_limit,
+ * entering a nested guest in which case the decrementer is now owned
+ * by L2 and the L1 decrementer is provided in hdec_expires
+ */
+- if (!kvmhv_is_nestedv2() && kvmppc_core_pending_dec(vcpu) &&
++ if (kvmppc_core_pending_dec(vcpu) &&
+ ((tb < kvmppc_dec_expires_host_tb(vcpu)) ||
+ (trap == BOOK3S_INTERRUPT_SYSCALL &&
+ kvmppc_get_gpr(vcpu, 3) == H_ENTER_NESTED)))
+--
+2.43.0
+
--- /dev/null
+From 1349bb92701a73280c8dddb28bd05cfdb94aaebd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jan 2024 12:34:25 +0100
+Subject: KVM: PPC: Book3S HV nestedv2: Fix an error handling path in
+ gs_msg_ops_kvmhv_nestedv2_config_fill_info()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit b52e8cd3f835869370f8540f1bc804a47a47f02b ]
+
+The return value of kvmppc_gse_put_buff_info() is not assigned to 'rc' and
+'rc' is uninitialized at this point.
+So the error handling can not work.
+
+Assign the expected value to 'rc' to fix the issue.
+
+Fixes: 19d31c5f1157 ("KVM: PPC: Add support for nestedv2 guests")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Vaibhav Jain <vaibhav@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/a7ed4cc12e0a0bbd97fac44fe6c222d1c393ec95.1706441651.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/book3s_hv_nestedv2.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/kvm/book3s_hv_nestedv2.c b/arch/powerpc/kvm/book3s_hv_nestedv2.c
+index 8e6f5355f08b5..1091f7a83b255 100644
+--- a/arch/powerpc/kvm/book3s_hv_nestedv2.c
++++ b/arch/powerpc/kvm/book3s_hv_nestedv2.c
+@@ -71,8 +71,8 @@ gs_msg_ops_kvmhv_nestedv2_config_fill_info(struct kvmppc_gs_buff *gsb,
+ }
+
+ if (kvmppc_gsm_includes(gsm, KVMPPC_GSID_RUN_OUTPUT)) {
+- kvmppc_gse_put_buff_info(gsb, KVMPPC_GSID_RUN_OUTPUT,
+- cfg->vcpu_run_output_cfg);
++ rc = kvmppc_gse_put_buff_info(gsb, KVMPPC_GSID_RUN_OUTPUT,
++ cfg->vcpu_run_output_cfg);
+ if (rc < 0)
+ return rc;
+ }
+--
+2.43.0
+
--- /dev/null
+From dc3c623621ccbe0d4a8d4a39dfbc9476cd86dbde Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Feb 2024 12:24:38 +0000
+Subject: media: cec: cec-adap: always cancel work in cec_transmit_msg_fh
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 9fe2816816a3c765dff3b88af5b5c3d9bbb911ce ]
+
+Do not check for !data->completed, just always call
+cancel_delayed_work_sync(). This fixes a small race condition.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Reported-by: Yang, Chenyuan <cy54@illinois.edu>
+Closes: https://lore.kernel.org/linux-media/PH7PR11MB57688E64ADE4FE82E658D86DA09EA@PH7PR11MB5768.namprd11.prod.outlook.com/
+Fixes: 490d84f6d73c ("media: cec: forgot to cancel delayed work")
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/cec/core/cec-adap.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c
+index 559a172ebc6cb..6fc7de744ee9a 100644
+--- a/drivers/media/cec/core/cec-adap.c
++++ b/drivers/media/cec/core/cec-adap.c
+@@ -936,8 +936,7 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
+ */
+ mutex_unlock(&adap->lock);
+ wait_for_completion_killable(&data->c);
+- if (!data->completed)
+- cancel_delayed_work_sync(&data->work);
++ cancel_delayed_work_sync(&data->work);
+ mutex_lock(&adap->lock);
+
+ /* Cancel the transmit if it was interrupted */
+--
+2.43.0
+
--- /dev/null
+From 8ad3d95c7480045545d5b2345d29cc9cdf7769a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Feb 2024 12:25:55 +0000
+Subject: media: cec: cec-api: add locking in cec_release()
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 42bcaacae924bf18ae387c3f78c202df0b739292 ]
+
+When cec_release() uses fh->msgs it has to take fh->lock,
+otherwise the list can get corrupted.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Reported-by: Yang, Chenyuan <cy54@illinois.edu>
+Closes: https://lore.kernel.org/linux-media/PH7PR11MB57688E64ADE4FE82E658D86DA09EA@PH7PR11MB5768.namprd11.prod.outlook.com/
+Fixes: ca684386e6e2 ("[media] cec: add HDMI CEC framework (api)")
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/cec/core/cec-api.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/media/cec/core/cec-api.c b/drivers/media/cec/core/cec-api.c
+index 67dc79ef17050..d64bb716f9c68 100644
+--- a/drivers/media/cec/core/cec-api.c
++++ b/drivers/media/cec/core/cec-api.c
+@@ -664,6 +664,8 @@ static int cec_release(struct inode *inode, struct file *filp)
+ list_del_init(&data->xfer_list);
+ }
+ mutex_unlock(&adap->lock);
++
++ mutex_lock(&fh->lock);
+ while (!list_empty(&fh->msgs)) {
+ struct cec_msg_entry *entry =
+ list_first_entry(&fh->msgs, struct cec_msg_entry, list);
+@@ -681,6 +683,7 @@ static int cec_release(struct inode *inode, struct file *filp)
+ kfree(entry);
+ }
+ }
++ mutex_unlock(&fh->lock);
+ kfree(fh);
+
+ cec_put_device(devnode);
+--
+2.43.0
+
--- /dev/null
+From d1dd53353a2f2358b9ea1868875984006ad88990 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Apr 2024 11:13:47 +0100
+Subject: media: cec: core: avoid confusing "transmit timed out" message
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit cbe499977bc36fedae89f0a0d7deb4ccde9798fe ]
+
+If, when waiting for a transmit to finish, the wait is interrupted,
+then you might get a "transmit timed out" message, even though the
+transmit was interrupted and did not actually time out.
+
+Set transmit_in_progress_aborted to true if the
+wait_for_completion_killable() call was interrupted and ensure
+that the transmit is properly marked as ABORTED.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Reported-by: Yang, Chenyuan <cy54@illinois.edu>
+Closes: https://lore.kernel.org/linux-media/PH7PR11MB57688E64ADE4FE82E658D86DA09EA@PH7PR11MB5768.namprd11.prod.outlook.com/
+Fixes: 590a8e564c6e ("media: cec: abort if the current transmit was canceled")
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/cec/core/cec-adap.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c
+index a493cbce24567..da09834990b87 100644
+--- a/drivers/media/cec/core/cec-adap.c
++++ b/drivers/media/cec/core/cec-adap.c
+@@ -490,6 +490,15 @@ int cec_thread_func(void *_adap)
+ goto unlock;
+ }
+
++ if (adap->transmit_in_progress &&
++ adap->transmit_in_progress_aborted) {
++ if (adap->transmitting)
++ cec_data_cancel(adap->transmitting,
++ CEC_TX_STATUS_ABORTED, 0);
++ adap->transmit_in_progress = false;
++ adap->transmit_in_progress_aborted = false;
++ goto unlock;
++ }
+ if (adap->transmit_in_progress && timeout) {
+ /*
+ * If we timeout, then log that. Normally this does
+@@ -771,6 +780,7 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
+ {
+ struct cec_data *data;
+ bool is_raw = msg_is_raw(msg);
++ int err;
+
+ if (adap->devnode.unregistered)
+ return -ENODEV;
+@@ -935,10 +945,13 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
+ * Release the lock and wait, retake the lock afterwards.
+ */
+ mutex_unlock(&adap->lock);
+- wait_for_completion_killable(&data->c);
++ err = wait_for_completion_killable(&data->c);
+ cancel_delayed_work_sync(&data->work);
+ mutex_lock(&adap->lock);
+
++ if (err)
++ adap->transmit_in_progress_aborted = true;
++
+ /* Cancel the transmit if it was interrupted */
+ if (!data->completed) {
+ if (data->msg.tx_status & CEC_TX_STATUS_OK)
+--
+2.43.0
+
--- /dev/null
+From 3049317cf9df070585b2853da4438025ec41b6c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Feb 2024 16:17:33 +0000
+Subject: media: cec: core: avoid recursive cec_claim_log_addrs
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 47c82aac10a6954d68f29f10d9758d016e8e5af1 ]
+
+Keep track if cec_claim_log_addrs() is running, and return -EBUSY
+if it is when calling CEC_ADAP_S_LOG_ADDRS.
+
+This prevents a case where cec_claim_log_addrs() could be called
+while it was still in progress.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Reported-by: Yang, Chenyuan <cy54@illinois.edu>
+Closes: https://lore.kernel.org/linux-media/PH7PR11MB57688E64ADE4FE82E658D86DA09EA@PH7PR11MB5768.namprd11.prod.outlook.com/
+Fixes: ca684386e6e2 ("[media] cec: add HDMI CEC framework (api)")
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/cec/core/cec-adap.c | 6 +++++-
+ drivers/media/cec/core/cec-api.c | 2 +-
+ include/media/cec.h | 1 +
+ 3 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c
+index 6fc7de744ee9a..a493cbce24567 100644
+--- a/drivers/media/cec/core/cec-adap.c
++++ b/drivers/media/cec/core/cec-adap.c
+@@ -1574,9 +1574,12 @@ static int cec_config_thread_func(void *arg)
+ */
+ static void cec_claim_log_addrs(struct cec_adapter *adap, bool block)
+ {
+- if (WARN_ON(adap->is_configuring || adap->is_configured))
++ if (WARN_ON(adap->is_claiming_log_addrs ||
++ adap->is_configuring || adap->is_configured))
+ return;
+
++ adap->is_claiming_log_addrs = true;
++
+ init_completion(&adap->config_completion);
+
+ /* Ready to kick off the thread */
+@@ -1591,6 +1594,7 @@ static void cec_claim_log_addrs(struct cec_adapter *adap, bool block)
+ wait_for_completion(&adap->config_completion);
+ mutex_lock(&adap->lock);
+ }
++ adap->is_claiming_log_addrs = false;
+ }
+
+ /*
+diff --git a/drivers/media/cec/core/cec-api.c b/drivers/media/cec/core/cec-api.c
+index d64bb716f9c68..3ef9153443044 100644
+--- a/drivers/media/cec/core/cec-api.c
++++ b/drivers/media/cec/core/cec-api.c
+@@ -178,7 +178,7 @@ static long cec_adap_s_log_addrs(struct cec_adapter *adap, struct cec_fh *fh,
+ CEC_LOG_ADDRS_FL_ALLOW_RC_PASSTHRU |
+ CEC_LOG_ADDRS_FL_CDC_ONLY;
+ mutex_lock(&adap->lock);
+- if (!adap->is_configuring &&
++ if (!adap->is_claiming_log_addrs && !adap->is_configuring &&
+ (!log_addrs.num_log_addrs || !adap->is_configured) &&
+ !cec_is_busy(adap, fh)) {
+ err = __cec_s_log_addrs(adap, &log_addrs, block);
+diff --git a/include/media/cec.h b/include/media/cec.h
+index 10c9cf6058b7e..cc3fcd0496c36 100644
+--- a/include/media/cec.h
++++ b/include/media/cec.h
+@@ -258,6 +258,7 @@ struct cec_adapter {
+ u16 phys_addr;
+ bool needs_hpd;
+ bool is_enabled;
++ bool is_claiming_log_addrs;
+ bool is_configuring;
+ bool must_reconfigure;
+ bool is_configured;
+--
+2.43.0
+
--- /dev/null
+From 8e7042565e79aae96d196498038a07a86d0fd93e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jun 2022 06:50:24 +0100
+Subject: media: flexcop-usb: fix sanity check of bNumEndpoints
+
+From: Dongliang Mu <mudongliangabcd@gmail.com>
+
+[ Upstream commit f62dc8f6bf82d1b307fc37d8d22cc79f67856c2f ]
+
+Commit d725d20e81c2 ("media: flexcop-usb: sanity checking of endpoint type
+") adds a sanity check for endpoint[1], but fails to modify the sanity
+check of bNumEndpoints.
+
+Fix this by modifying the sanity check of bNumEndpoints to 2.
+
+Link: https://lore.kernel.org/linux-media/20220602055027.849014-1-dzm91@hust.edu.cn
+Fixes: d725d20e81c2 ("media: flexcop-usb: sanity checking of endpoint type")
+Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/b2c2/flexcop-usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c
+index 790787f0eba84..bcb24d8964981 100644
+--- a/drivers/media/usb/b2c2/flexcop-usb.c
++++ b/drivers/media/usb/b2c2/flexcop-usb.c
+@@ -515,7 +515,7 @@ static int flexcop_usb_init(struct flexcop_usb *fc_usb)
+
+ alt = fc_usb->uintf->cur_altsetting;
+
+- if (alt->desc.bNumEndpoints < 1)
++ if (alt->desc.bNumEndpoints < 2)
+ return -ENODEV;
+ if (!usb_endpoint_is_isoc_in(&alt->endpoint[0].desc))
+ return -ENODEV;
+--
+2.43.0
+
--- /dev/null
+From 0b139e49670f140610c3efdf888e0ced3c782b01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Dec 2023 13:32:40 +0200
+Subject: media: mediatek: vcodec: fix possible unbalanced PM counter
+
+From: Eugen Hristev <eugen.hristev@collabora.com>
+
+[ Upstream commit c28d4921a1e3ce0a0374b7e9d68593be8802c42a ]
+
+It is possible that mtk_vcodec_enc_pw_on fails, and in that scenario
+the PM counter is not incremented, and subsequent call to
+mtk_vcodec_enc_pw_off decrements the counter, leading to a PM imbalance.
+Fix by bailing out of venc_if_encode in the case when mtk_vcodec_enc_pw_on
+fails.
+
+Fixes: 4e855a6efa54 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Encoder Driver")
+Signed-off-by: Eugen Hristev <eugen.hristev@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
+Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.c | 4 +++-
+ .../platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.h | 2 +-
+ drivers/media/platform/mediatek/vcodec/encoder/venc_drv_if.c | 5 ++++-
+ 3 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.c b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.c
+index a22b7dfc656e1..1a2b14a3e219c 100644
+--- a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.c
++++ b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.c
+@@ -58,13 +58,15 @@ int mtk_vcodec_init_enc_clk(struct mtk_vcodec_enc_dev *mtkdev)
+ return 0;
+ }
+
+-void mtk_vcodec_enc_pw_on(struct mtk_vcodec_pm *pm)
++int mtk_vcodec_enc_pw_on(struct mtk_vcodec_pm *pm)
+ {
+ int ret;
+
+ ret = pm_runtime_resume_and_get(pm->dev);
+ if (ret)
+ dev_err(pm->dev, "pm_runtime_resume_and_get fail: %d", ret);
++
++ return ret;
+ }
+
+ void mtk_vcodec_enc_pw_off(struct mtk_vcodec_pm *pm)
+diff --git a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.h b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.h
+index 157ea08ba9e36..2e28f25e36cc4 100644
+--- a/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.h
++++ b/drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_pm.h
+@@ -10,7 +10,7 @@
+ #include "mtk_vcodec_enc_drv.h"
+
+ int mtk_vcodec_init_enc_clk(struct mtk_vcodec_enc_dev *dev);
+-void mtk_vcodec_enc_pw_on(struct mtk_vcodec_pm *pm);
++int mtk_vcodec_enc_pw_on(struct mtk_vcodec_pm *pm);
+ void mtk_vcodec_enc_pw_off(struct mtk_vcodec_pm *pm);
+ void mtk_vcodec_enc_clock_on(struct mtk_vcodec_pm *pm);
+ void mtk_vcodec_enc_clock_off(struct mtk_vcodec_pm *pm);
+diff --git a/drivers/media/platform/mediatek/vcodec/encoder/venc_drv_if.c b/drivers/media/platform/mediatek/vcodec/encoder/venc_drv_if.c
+index c402a686f3cb2..e83747b8d69ab 100644
+--- a/drivers/media/platform/mediatek/vcodec/encoder/venc_drv_if.c
++++ b/drivers/media/platform/mediatek/vcodec/encoder/venc_drv_if.c
+@@ -64,7 +64,9 @@ int venc_if_encode(struct mtk_vcodec_enc_ctx *ctx,
+ ctx->dev->curr_ctx = ctx;
+ spin_unlock_irqrestore(&ctx->dev->irqlock, flags);
+
+- mtk_vcodec_enc_pw_on(&ctx->dev->pm);
++ ret = mtk_vcodec_enc_pw_on(&ctx->dev->pm);
++ if (ret)
++ goto venc_if_encode_pw_on_err;
+ mtk_vcodec_enc_clock_on(&ctx->dev->pm);
+ ret = ctx->enc_if->encode(ctx->drv_handle, opt, frm_buf,
+ bs_buf, result);
+@@ -75,6 +77,7 @@ int venc_if_encode(struct mtk_vcodec_enc_ctx *ctx,
+ ctx->dev->curr_ctx = NULL;
+ spin_unlock_irqrestore(&ctx->dev->irqlock, flags);
+
++venc_if_encode_pw_on_err:
+ mtk_venc_unlock(ctx);
+ return ret;
+ }
+--
+2.43.0
+
--- /dev/null
+From f14ea54f764b8bd0e36d44bfdff5e7371894e754 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Mar 2024 19:44:13 -0300
+Subject: media: ov2680: Allow probing if link-frequencies is absent
+
+From: Fabio Estevam <festevam@denx.de>
+
+[ Upstream commit fd2e66abd729dae5809dbb41c6c52a6931cfa6bb ]
+
+Since commit 63b0cd30b78e ("media: ov2680: Add bus-cfg / endpoint
+property verification") the ov2680 no longer probes on a imx7s-warp7:
+
+ov2680 1-0036: error -EINVAL: supported link freq 330000000 not found
+ov2680 1-0036: probe with driver ov2680 failed with error -22
+
+As the 'link-frequencies' property is not mandatory, allow the probe
+to succeed by skipping the link-frequency verification when the
+property is absent.
+
+Cc: stable@vger.kernel.org
+Fixes: 63b0cd30b78e ("media: ov2680: Add bus-cfg / endpoint property verification")
+Signed-off-by: Fabio Estevam <festevam@denx.de>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Stable-dep-of: 24034af644fc ("media: ov2680: Do not fail if data-lanes property is absent")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov2680.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c
+index 3e3b7c2b492cf..a857763c7984c 100644
+--- a/drivers/media/i2c/ov2680.c
++++ b/drivers/media/i2c/ov2680.c
+@@ -1123,18 +1123,23 @@ static int ov2680_parse_dt(struct ov2680_dev *sensor)
+ goto out_free_bus_cfg;
+ }
+
++ if (!bus_cfg.nr_of_link_frequencies) {
++ dev_warn(dev, "Consider passing 'link-frequencies' in DT\n");
++ goto skip_link_freq_validation;
++ }
++
+ for (i = 0; i < bus_cfg.nr_of_link_frequencies; i++)
+ if (bus_cfg.link_frequencies[i] == sensor->link_freq[0])
+ break;
+
+- if (bus_cfg.nr_of_link_frequencies == 0 ||
+- bus_cfg.nr_of_link_frequencies == i) {
++ if (bus_cfg.nr_of_link_frequencies == i) {
+ ret = dev_err_probe(dev, -EINVAL,
+ "supported link freq %lld not found\n",
+ sensor->link_freq[0]);
+ goto out_free_bus_cfg;
+ }
+
++skip_link_freq_validation:
+ ret = 0;
+ out_free_bus_cfg:
+ v4l2_fwnode_endpoint_free(&bus_cfg);
+--
+2.43.0
+
--- /dev/null
+From 7276613f092218c18b5b865d0b6bf9cae8c99395 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Mar 2024 19:44:12 -0300
+Subject: media: ov2680: Clear the 'ret' variable on success
+
+From: Fabio Estevam <festevam@denx.de>
+
+[ Upstream commit 49a9bad83b4ab5dac1d7aba2615c77978bcf3984 ]
+
+Since commit 63b0cd30b78e ("media: ov2680: Add bus-cfg / endpoint
+property verification") even when the correct 'link-frequencies'
+property is passed in the devicetree, the driver fails to probe:
+
+ov2680 1-0036: probe with driver ov2680 failed with error -22
+
+The reason is that the variable 'ret' may contain the -EINVAL value
+from a previous assignment:
+
+ret = fwnode_property_read_u32(dev_fwnode(dev), "clock-frequency",
+ &rate);
+
+Fix the problem by clearing 'ret' on the successful path.
+
+Tested on imx7s-warp board with the following devicetree:
+
+port {
+ ov2680_to_mipi: endpoint {
+ remote-endpoint = <&mipi_from_sensor>;
+ clock-lanes = <0>;
+ data-lanes = <1>;
+ link-frequencies = /bits/ 64 <330000000>;
+ };
+};
+
+Cc: stable@vger.kernel.org
+Fixes: 63b0cd30b78e ("media: ov2680: Add bus-cfg / endpoint property verification")
+Suggested-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Fabio Estevam <festevam@denx.de>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Stable-dep-of: 24034af644fc ("media: ov2680: Do not fail if data-lanes property is absent")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov2680.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c
+index 39d321e2b7f98..3e3b7c2b492cf 100644
+--- a/drivers/media/i2c/ov2680.c
++++ b/drivers/media/i2c/ov2680.c
+@@ -1135,6 +1135,7 @@ static int ov2680_parse_dt(struct ov2680_dev *sensor)
+ goto out_free_bus_cfg;
+ }
+
++ ret = 0;
+ out_free_bus_cfg:
+ v4l2_fwnode_endpoint_free(&bus_cfg);
+ return ret;
+--
+2.43.0
+
--- /dev/null
+From 5c3c00c1af308abad4dfc0703870656bcf864ed4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Apr 2024 18:09:06 -0300
+Subject: media: ov2680: Do not fail if data-lanes property is absent
+
+From: Fabio Estevam <festevam@denx.de>
+
+[ Upstream commit 24034af644fc01126bec9850346a06ef1450181f ]
+
+Since commit 63b0cd30b78e ("media: ov2680: Add bus-cfg / endpoint
+property verification") the ov2680 driver no longer probes when the
+'data-lanes' property is absent.
+
+The OV2680 sensor has only one data lane, so there is no need for
+describing it the devicetree.
+
+Remove the unnecessary data-lanes property check.
+
+Suggested-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Fixes: 63b0cd30b78e ("media: ov2680: Add bus-cfg / endpoint property verification")
+Signed-off-by: Fabio Estevam <festevam@denx.de>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov2680.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c
+index a857763c7984c..4577a8977c85a 100644
+--- a/drivers/media/i2c/ov2680.c
++++ b/drivers/media/i2c/ov2680.c
+@@ -1116,13 +1116,6 @@ static int ov2680_parse_dt(struct ov2680_dev *sensor)
+ sensor->pixel_rate = sensor->link_freq[0] * 2;
+ do_div(sensor->pixel_rate, 10);
+
+- /* Verify bus cfg */
+- if (bus_cfg.bus.mipi_csi2.num_data_lanes != 1) {
+- ret = dev_err_probe(dev, -EINVAL,
+- "only a 1-lane CSI2 config is supported");
+- goto out_free_bus_cfg;
+- }
+-
+ if (!bus_cfg.nr_of_link_frequencies) {
+ dev_warn(dev, "Consider passing 'link-frequencies' in DT\n");
+ goto skip_link_freq_validation;
+--
+2.43.0
+
--- /dev/null
+From 6b4a6577e602cdcfebdd3b62c196e134f48643ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Apr 2024 12:32:44 +0300
+Subject: media: stk1160: fix bounds checking in stk1160_copy_video()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit faa4364bef2ec0060de381ff028d1d836600a381 ]
+
+The subtract in this condition is reversed. The ->length is the length
+of the buffer. The ->bytesused is how many bytes we have copied thus
+far. When the condition is reversed that means the result of the
+subtraction is always negative but since it's unsigned then the result
+is a very high positive value. That means the overflow check is never
+true.
+
+Additionally, the ->bytesused doesn't actually work for this purpose
+because we're not writing to "buf->mem + buf->bytesused". Instead, the
+math to calculate the destination where we are writing is a bit
+involved. You calculate the number of full lines already written,
+multiply by two, skip a line if necessary so that we start on an odd
+numbered line, and add the offset into the line.
+
+To fix this buffer overflow, just take the actual destination where we
+are writing, if the offset is already out of bounds print an error and
+return. Otherwise, write up to buf->length bytes.
+
+Fixes: 9cb2173e6ea8 ("[media] media: Add stk1160 new driver (easycap replacement)")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/stk1160/stk1160-video.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/media/usb/stk1160/stk1160-video.c b/drivers/media/usb/stk1160/stk1160-video.c
+index 366f0e4a5dc0d..e79c45db60ab5 100644
+--- a/drivers/media/usb/stk1160/stk1160-video.c
++++ b/drivers/media/usb/stk1160/stk1160-video.c
+@@ -99,7 +99,7 @@ void stk1160_buffer_done(struct stk1160 *dev)
+ static inline
+ void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len)
+ {
+- int linesdone, lineoff, lencopy;
++ int linesdone, lineoff, lencopy, offset;
+ int bytesperline = dev->width * 2;
+ struct stk1160_buffer *buf = dev->isoc_ctl.buf;
+ u8 *dst = buf->mem;
+@@ -139,8 +139,13 @@ void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len)
+ * Check if we have enough space left in the buffer.
+ * In that case, we force loop exit after copy.
+ */
+- if (lencopy > buf->bytesused - buf->length) {
+- lencopy = buf->bytesused - buf->length;
++ offset = dst - (u8 *)buf->mem;
++ if (offset > buf->length) {
++ dev_warn_ratelimited(dev->dev, "out of bounds offset\n");
++ return;
++ }
++ if (lencopy > buf->length - offset) {
++ lencopy = buf->length - offset;
+ remain = lencopy;
+ }
+
+@@ -182,8 +187,13 @@ void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len)
+ * Check if we have enough space left in the buffer.
+ * In that case, we force loop exit after copy.
+ */
+- if (lencopy > buf->bytesused - buf->length) {
+- lencopy = buf->bytesused - buf->length;
++ offset = dst - (u8 *)buf->mem;
++ if (offset > buf->length) {
++ dev_warn_ratelimited(dev->dev, "offset out of bounds\n");
++ return;
++ }
++ if (lencopy > buf->length - offset) {
++ lencopy = buf->length - offset;
+ remain = lencopy;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From 67ec6f21f19953434630addf7f73c4f9c4c2a723 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Sep 2023 05:04:38 +0100
+Subject: media: sunxi: a83-mips-csi2: also select GENERIC_PHY
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 8237026159cb6760ad22e28d57b9a1c53b612d3a ]
+
+When selecting GENERIC_PHY_MIPI_DPHY, also select GENERIC_PHY to
+prevent kconfig warnings:
+
+WARNING: unmet direct dependencies detected for GENERIC_PHY_MIPI_DPHY
+ Depends on [n]: GENERIC_PHY [=n]
+ Selected by [y]:
+ - VIDEO_SUN8I_A83T_MIPI_CSI2 [=y] && MEDIA_SUPPORT [=y] && MEDIA_PLATFORM_SUPPORT [=y] && MEDIA_PLATFORM_DRIVERS [=y] && V4L_PLATFORM_DRIVERS [=y] && VIDEO_DEV [=y] && (ARCH_SUNXI || COMPILE_TEST [=y]) && PM [=y] && COMMON_CLK [=y] && RESET_CONTROLLER [=y]
+
+Fixes: 94d7fd9692b5 ("media: sunxi: Depend on GENERIC_PHY_MIPI_DPHY")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/r/ZQ/WS8HC1A3F0Qn8@rli9-mobl
+Link: https://lore.kernel.org/linux-media/20230927040438.5589-1-rdunlap@infradead.org
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/Kconfig b/drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/Kconfig
+index 47a8c0fb7eb9f..99c401e653bc4 100644
+--- a/drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/Kconfig
++++ b/drivers/media/platform/sunxi/sun8i-a83t-mipi-csi2/Kconfig
+@@ -8,6 +8,7 @@ config VIDEO_SUN8I_A83T_MIPI_CSI2
+ select VIDEO_V4L2_SUBDEV_API
+ select V4L2_FWNODE
+ select REGMAP_MMIO
++ select GENERIC_PHY
+ select GENERIC_PHY_MIPI_DPHY
+ help
+ Support for the Allwinner A83T MIPI CSI-2 controller and D-PHY.
+--
+2.43.0
+
--- /dev/null
+From c97b49292d3ab726118155f207bd446f45eb3e98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Feb 2024 13:53:02 +0530
+Subject: media: ti: j721e-csi2rx: Fix races while restarting DMA
+
+From: Jai Luthra <j-luthra@ti.com>
+
+[ Upstream commit ad79c9ecea5baa7b4f19677e4b1c881ed89b0c3b ]
+
+After the frame is submitted to DMA, it may happen that the submitted
+list is not updated soon enough, and the DMA callback is triggered
+before that.
+
+This can lead to kernel crashes, so move everything in a single
+lock/unlock section to prevent such races.
+
+Fixes: b4a3d877dc92 ("media: ti: Add CSI2RX support for J721E")
+Signed-off-by: Jai Luthra <j-luthra@ti.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c b/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c
+index 6da83d0cffaae..22442fce76078 100644
+--- a/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c
++++ b/drivers/media/platform/ti/j721e-csi2rx/j721e-csi2rx.c
+@@ -786,15 +786,14 @@ static void ti_csi2rx_buffer_queue(struct vb2_buffer *vb)
+ dev_warn(csi->dev,
+ "Failed to drain DMA. Next frame might be bogus\n");
+
++ spin_lock_irqsave(&dma->lock, flags);
+ ret = ti_csi2rx_start_dma(csi, buf);
+ if (ret) {
+- dev_err(csi->dev, "Failed to start DMA: %d\n", ret);
+- spin_lock_irqsave(&dma->lock, flags);
+ vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR);
+ dma->state = TI_CSI2RX_DMA_IDLE;
+ spin_unlock_irqrestore(&dma->lock, flags);
++ dev_err(csi->dev, "Failed to start DMA: %d\n", ret);
+ } else {
+- spin_lock_irqsave(&dma->lock, flags);
+ list_add_tail(&buf->list, &dma->submitted);
+ spin_unlock_irqrestore(&dma->lock, flags);
+ }
+--
+2.43.0
+
--- /dev/null
+From dba00bd8bc2ed164c36972b843934a45e554f2c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Apr 2024 12:58:44 +0300
+Subject: media: v4l: Don't turn on privacy LED if streamon fails
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit f2bf6cd8f44781349620e30a0af8987fe9af008f ]
+
+Turn on the privacy LED only if streamon succeeds. This can be done after
+enabling streaming on the sensor.
+
+Fixes: b6e10ff6c23d ("media: v4l2-core: Make the v4l2-core code enable/disable the privacy LED if present")
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Reviewed-by: Umang Jain <umang.jain@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-subdev.c | 22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-subdev.c b/drivers/media/v4l2-core/v4l2-subdev.c
+index 45836f0a2b0a7..19d20871afefa 100644
+--- a/drivers/media/v4l2-core/v4l2-subdev.c
++++ b/drivers/media/v4l2-core/v4l2-subdev.c
+@@ -412,15 +412,6 @@ static int call_s_stream(struct v4l2_subdev *sd, int enable)
+ if (WARN_ON(!!sd->enabled_streams == !!enable))
+ return 0;
+
+-#if IS_REACHABLE(CONFIG_LEDS_CLASS)
+- if (!IS_ERR_OR_NULL(sd->privacy_led)) {
+- if (enable)
+- led_set_brightness(sd->privacy_led,
+- sd->privacy_led->max_brightness);
+- else
+- led_set_brightness(sd->privacy_led, 0);
+- }
+-#endif
+ ret = sd->ops->video->s_stream(sd, enable);
+
+ if (!enable && ret < 0) {
+@@ -428,9 +419,20 @@ static int call_s_stream(struct v4l2_subdev *sd, int enable)
+ ret = 0;
+ }
+
+- if (!ret)
++ if (!ret) {
+ sd->enabled_streams = enable ? BIT(0) : 0;
+
++#if IS_REACHABLE(CONFIG_LEDS_CLASS)
++ if (!IS_ERR_OR_NULL(sd->privacy_led)) {
++ if (enable)
++ led_set_brightness(sd->privacy_led,
++ sd->privacy_led->max_brightness);
++ else
++ led_set_brightness(sd->privacy_led, 0);
++ }
++#endif
++ }
++
+ return ret;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From 8cf3135b7c1cd0747aa3516c83bdcfe4ca7e4555 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Mar 2024 17:38:36 -0500
+Subject: mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock
+
+From: Judith Mendez <jm@ti.com>
+
+[ Upstream commit 9dff65bb5e09903c27d9cff947dff4d22b6ea6a1 ]
+
+Add ITAPDLYSEL to sdhci_j721e_4bit_set_clock function.
+This allows to set the correct ITAPDLY for timings that
+do not carry out tuning.
+
+Fixes: 1accbced1c32 ("mmc: sdhci_am654: Add Support for 4 bit IP on J721E")
+Signed-off-by: Judith Mendez <jm@ti.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20240320223837.959900-7-jm@ti.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci_am654.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci_am654.c b/drivers/mmc/host/sdhci_am654.c
+index 888bfda0ebc0e..884d1b53180d7 100644
+--- a/drivers/mmc/host/sdhci_am654.c
++++ b/drivers/mmc/host/sdhci_am654.c
+@@ -320,6 +320,7 @@ static void sdhci_j721e_4bit_set_clock(struct sdhci_host *host,
+ unsigned char timing = host->mmc->ios.timing;
+ u32 otap_del_sel;
+ u32 itap_del_ena;
++ u32 itap_del_sel;
+ u32 mask, val;
+
+ /* Setup DLL Output TAP delay */
+@@ -329,13 +330,18 @@ static void sdhci_j721e_4bit_set_clock(struct sdhci_host *host,
+ val = (0x1 << OTAPDLYENA_SHIFT) |
+ (otap_del_sel << OTAPDLYSEL_SHIFT);
+
++ /* Setup Input TAP delay */
+ itap_del_ena = sdhci_am654->itap_del_ena[timing];
++ itap_del_sel = sdhci_am654->itap_del_sel[timing];
+
+- mask |= ITAPDLYENA_MASK;
+- val |= (itap_del_ena << ITAPDLYENA_SHIFT);
++ mask |= ITAPDLYENA_MASK | ITAPDLYSEL_MASK;
++ val |= (itap_del_ena << ITAPDLYENA_SHIFT) |
++ (itap_del_sel << ITAPDLYSEL_SHIFT);
+
++ regmap_update_bits(sdhci_am654->base, PHY_CTRL4, ITAPCHGWIN_MASK,
++ 1 << ITAPCHGWIN_SHIFT);
+ regmap_update_bits(sdhci_am654->base, PHY_CTRL4, mask, val);
+-
++ regmap_update_bits(sdhci_am654->base, PHY_CTRL4, ITAPCHGWIN_MASK, 0);
+ regmap_update_bits(sdhci_am654->base, PHY_CTRL5, CLKBUFSEL_MASK,
+ sdhci_am654->clkbuf_sel);
+
+--
+2.43.0
+
--- /dev/null
+From 2d4f25026309b89327fc78ff3bc1695f0eff5bbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Mar 2024 17:38:33 -0500
+Subject: mmc: sdhci_am654: Add OTAP/ITAP delay enable
+
+From: Judith Mendez <jm@ti.com>
+
+[ Upstream commit 387c1bf7dce0dfea02080c8bdb066b5209e92155 ]
+
+Currently the OTAP/ITAP delay enable functionality is incorrect in
+the am654_set_clock function. The OTAP delay is not enabled when
+timing < SDR25 bus speed mode. The ITAP delay is not enabled for
+timings that do not carry out tuning.
+
+Add this OTAP/ITAP delay functionality according to the datasheet
+[1] OTAPDLYENA and ITAPDLYENA for MMC0.
+
+[1] https://www.ti.com/lit/ds/symlink/am62p.pdf
+
+Fixes: 8ee5fc0e0b3b ("mmc: sdhci_am654: Update OTAPDLY writes")
+Signed-off-by: Judith Mendez <jm@ti.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20240320223837.959900-4-jm@ti.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci_am654.c | 40 ++++++++++++++++++++++------------
+ 1 file changed, 26 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci_am654.c b/drivers/mmc/host/sdhci_am654.c
+index cfb614d0b42b4..888bfda0ebc0e 100644
+--- a/drivers/mmc/host/sdhci_am654.c
++++ b/drivers/mmc/host/sdhci_am654.c
+@@ -143,6 +143,7 @@ struct sdhci_am654_data {
+ struct regmap *base;
+ int otap_del_sel[ARRAY_SIZE(td)];
+ int itap_del_sel[ARRAY_SIZE(td)];
++ u32 itap_del_ena[ARRAY_SIZE(td)];
+ int clkbuf_sel;
+ int trm_icp;
+ int drv_strength;
+@@ -239,11 +240,13 @@ static void sdhci_am654_setup_dll(struct sdhci_host *host, unsigned int clock)
+ }
+
+ static void sdhci_am654_write_itapdly(struct sdhci_am654_data *sdhci_am654,
+- u32 itapdly)
++ u32 itapdly, u32 enable)
+ {
+ /* Set ITAPCHGWIN before writing to ITAPDLY */
+ regmap_update_bits(sdhci_am654->base, PHY_CTRL4, ITAPCHGWIN_MASK,
+ 1 << ITAPCHGWIN_SHIFT);
++ regmap_update_bits(sdhci_am654->base, PHY_CTRL4, ITAPDLYENA_MASK,
++ enable << ITAPDLYENA_SHIFT);
+ regmap_update_bits(sdhci_am654->base, PHY_CTRL4, ITAPDLYSEL_MASK,
+ itapdly << ITAPDLYSEL_SHIFT);
+ regmap_update_bits(sdhci_am654->base, PHY_CTRL4, ITAPCHGWIN_MASK, 0);
+@@ -260,8 +263,8 @@ static void sdhci_am654_setup_delay_chain(struct sdhci_am654_data *sdhci_am654,
+ mask = SELDLYTXCLK_MASK | SELDLYRXCLK_MASK;
+ regmap_update_bits(sdhci_am654->base, PHY_CTRL5, mask, val);
+
+- sdhci_am654_write_itapdly(sdhci_am654,
+- sdhci_am654->itap_del_sel[timing]);
++ sdhci_am654_write_itapdly(sdhci_am654, sdhci_am654->itap_del_sel[timing],
++ sdhci_am654->itap_del_ena[timing]);
+ }
+
+ static void sdhci_am654_set_clock(struct sdhci_host *host, unsigned int clock)
+@@ -270,7 +273,6 @@ static void sdhci_am654_set_clock(struct sdhci_host *host, unsigned int clock)
+ struct sdhci_am654_data *sdhci_am654 = sdhci_pltfm_priv(pltfm_host);
+ unsigned char timing = host->mmc->ios.timing;
+ u32 otap_del_sel;
+- u32 otap_del_ena;
+ u32 mask, val;
+
+ regmap_update_bits(sdhci_am654->base, PHY_CTRL1, ENDLL_MASK, 0);
+@@ -279,10 +281,9 @@ static void sdhci_am654_set_clock(struct sdhci_host *host, unsigned int clock)
+
+ /* Setup DLL Output TAP delay */
+ otap_del_sel = sdhci_am654->otap_del_sel[timing];
+- otap_del_ena = (timing > MMC_TIMING_UHS_SDR25) ? 1 : 0;
+
+ mask = OTAPDLYENA_MASK | OTAPDLYSEL_MASK;
+- val = (otap_del_ena << OTAPDLYENA_SHIFT) |
++ val = (0x1 << OTAPDLYENA_SHIFT) |
+ (otap_del_sel << OTAPDLYSEL_SHIFT);
+
+ /* Write to STRBSEL for HS400 speed mode */
+@@ -300,7 +301,8 @@ static void sdhci_am654_set_clock(struct sdhci_host *host, unsigned int clock)
+ if (timing > MMC_TIMING_UHS_SDR25 && clock >= CLOCK_TOO_SLOW_HZ) {
+ sdhci_am654_setup_dll(host, clock);
+ sdhci_am654->dll_enable = true;
+- sdhci_am654_write_itapdly(sdhci_am654, sdhci_am654->itap_del_sel[timing]);
++ sdhci_am654_write_itapdly(sdhci_am654, sdhci_am654->itap_del_sel[timing],
++ sdhci_am654->itap_del_ena[timing]);
+ } else {
+ sdhci_am654_setup_delay_chain(sdhci_am654, timing);
+ sdhci_am654->dll_enable = false;
+@@ -317,6 +319,7 @@ static void sdhci_j721e_4bit_set_clock(struct sdhci_host *host,
+ struct sdhci_am654_data *sdhci_am654 = sdhci_pltfm_priv(pltfm_host);
+ unsigned char timing = host->mmc->ios.timing;
+ u32 otap_del_sel;
++ u32 itap_del_ena;
+ u32 mask, val;
+
+ /* Setup DLL Output TAP delay */
+@@ -325,6 +328,12 @@ static void sdhci_j721e_4bit_set_clock(struct sdhci_host *host,
+ mask = OTAPDLYENA_MASK | OTAPDLYSEL_MASK;
+ val = (0x1 << OTAPDLYENA_SHIFT) |
+ (otap_del_sel << OTAPDLYSEL_SHIFT);
++
++ itap_del_ena = sdhci_am654->itap_del_ena[timing];
++
++ mask |= ITAPDLYENA_MASK;
++ val |= (itap_del_ena << ITAPDLYENA_SHIFT);
++
+ regmap_update_bits(sdhci_am654->base, PHY_CTRL4, mask, val);
+
+ regmap_update_bits(sdhci_am654->base, PHY_CTRL5, CLKBUFSEL_MASK,
+@@ -478,6 +487,7 @@ static int sdhci_am654_platform_execute_tuning(struct sdhci_host *host,
+ {
+ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ struct sdhci_am654_data *sdhci_am654 = sdhci_pltfm_priv(pltfm_host);
++ unsigned char timing = host->mmc->ios.timing;
+ struct window fail_window[ITAPDLY_LENGTH];
+ u8 curr_pass, itap;
+ u8 fail_index = 0;
+@@ -486,11 +496,10 @@ static int sdhci_am654_platform_execute_tuning(struct sdhci_host *host,
+ memset(fail_window, 0, sizeof(fail_window));
+
+ /* Enable ITAPDLY */
+- regmap_update_bits(sdhci_am654->base, PHY_CTRL4, ITAPDLYENA_MASK,
+- 1 << ITAPDLYENA_SHIFT);
++ sdhci_am654->itap_del_ena[timing] = 0x1;
+
+ for (itap = 0; itap < ITAPDLY_LENGTH; itap++) {
+- sdhci_am654_write_itapdly(sdhci_am654, itap);
++ sdhci_am654_write_itapdly(sdhci_am654, itap, sdhci_am654->itap_del_ena[timing]);
+
+ curr_pass = !mmc_send_tuning(host->mmc, opcode, NULL);
+
+@@ -514,7 +523,7 @@ static int sdhci_am654_platform_execute_tuning(struct sdhci_host *host,
+ itap = sdhci_am654_calculate_itap(host, fail_window, fail_index,
+ sdhci_am654->dll_enable);
+
+- sdhci_am654_write_itapdly(sdhci_am654, itap);
++ sdhci_am654_write_itapdly(sdhci_am654, itap, sdhci_am654->itap_del_ena[timing]);
+
+ return 0;
+ }
+@@ -663,9 +672,12 @@ static int sdhci_am654_get_otap_delay(struct sdhci_host *host,
+ host->mmc->caps2 &= ~td[i].capability;
+ }
+
+- if (td[i].itap_binding)
+- device_property_read_u32(dev, td[i].itap_binding,
+- &sdhci_am654->itap_del_sel[i]);
++ if (td[i].itap_binding) {
++ ret = device_property_read_u32(dev, td[i].itap_binding,
++ &sdhci_am654->itap_del_sel[i]);
++ if (!ret)
++ sdhci_am654->itap_del_ena[i] = 0x1;
++ }
+ }
+
+ return 0;
+--
+2.43.0
+
--- /dev/null
+From 07b377ae62aa29812e3ff30a01f52907afe60310 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Mar 2024 17:38:31 -0500
+Subject: mmc: sdhci_am654: Add tuning algorithm for delay chain
+
+From: Judith Mendez <jm@ti.com>
+
+[ Upstream commit 6231d99dd4119312ad41abf9383e18fec66cbe4b ]
+
+Currently the sdhci_am654 driver only supports one tuning
+algorithm which should be used only when DLL is enabled. The
+ITAPDLY is selected from the largest passing window and the
+buffer is viewed as a circular buffer.
+
+The new algorithm should be used when the delay chain
+is enabled. The ITAPDLY is selected from the largest passing
+window and the buffer is not viewed as a circular buffer.
+
+This implementation is based off of the following paper: [1].
+
+Also add support for multiple failing windows.
+
+[1] https://www.ti.com/lit/an/spract9/spract9.pdf
+
+Fixes: 13ebeae68ac9 ("mmc: sdhci_am654: Add support for software tuning")
+Signed-off-by: Judith Mendez <jm@ti.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20240320223837.959900-2-jm@ti.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci_am654.c | 112 +++++++++++++++++++++++++++------
+ 1 file changed, 92 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci_am654.c b/drivers/mmc/host/sdhci_am654.c
+index d659c59422e1e..d8c9821b0b663 100644
+--- a/drivers/mmc/host/sdhci_am654.c
++++ b/drivers/mmc/host/sdhci_am654.c
+@@ -149,10 +149,17 @@ struct sdhci_am654_data {
+ int strb_sel;
+ u32 flags;
+ u32 quirks;
++ bool dll_enable;
+
+ #define SDHCI_AM654_QUIRK_FORCE_CDTEST BIT(0)
+ };
+
++struct window {
++ u8 start;
++ u8 end;
++ u8 length;
++};
++
+ struct sdhci_am654_driver_data {
+ const struct sdhci_pltfm_data *pdata;
+ u32 flags;
+@@ -290,10 +297,13 @@ static void sdhci_am654_set_clock(struct sdhci_host *host, unsigned int clock)
+
+ regmap_update_bits(sdhci_am654->base, PHY_CTRL4, mask, val);
+
+- if (timing > MMC_TIMING_UHS_SDR25 && clock >= CLOCK_TOO_SLOW_HZ)
++ if (timing > MMC_TIMING_UHS_SDR25 && clock >= CLOCK_TOO_SLOW_HZ) {
+ sdhci_am654_setup_dll(host, clock);
+- else
++ sdhci_am654->dll_enable = true;
++ } else {
+ sdhci_am654_setup_delay_chain(sdhci_am654, timing);
++ sdhci_am654->dll_enable = false;
++ }
+
+ regmap_update_bits(sdhci_am654->base, PHY_CTRL5, CLKBUFSEL_MASK,
+ sdhci_am654->clkbuf_sel);
+@@ -408,39 +418,101 @@ static u32 sdhci_am654_cqhci_irq(struct sdhci_host *host, u32 intmask)
+ return 0;
+ }
+
+-#define ITAP_MAX 32
++#define ITAPDLY_LENGTH 32
++#define ITAPDLY_LAST_INDEX (ITAPDLY_LENGTH - 1)
++
++static u32 sdhci_am654_calculate_itap(struct sdhci_host *host, struct window
++ *fail_window, u8 num_fails, bool circular_buffer)
++{
++ u8 itap = 0, start_fail = 0, end_fail = 0, pass_length = 0;
++ u8 first_fail_start = 0, last_fail_end = 0;
++ struct device *dev = mmc_dev(host->mmc);
++ struct window pass_window = {0, 0, 0};
++ int prev_fail_end = -1;
++ u8 i;
++
++ if (!num_fails)
++ return ITAPDLY_LAST_INDEX >> 1;
++
++ if (fail_window->length == ITAPDLY_LENGTH) {
++ dev_err(dev, "No passing ITAPDLY, return 0\n");
++ return 0;
++ }
++
++ first_fail_start = fail_window->start;
++ last_fail_end = fail_window[num_fails - 1].end;
++
++ for (i = 0; i < num_fails; i++) {
++ start_fail = fail_window[i].start;
++ end_fail = fail_window[i].end;
++ pass_length = start_fail - (prev_fail_end + 1);
++
++ if (pass_length > pass_window.length) {
++ pass_window.start = prev_fail_end + 1;
++ pass_window.length = pass_length;
++ }
++ prev_fail_end = end_fail;
++ }
++
++ if (!circular_buffer)
++ pass_length = ITAPDLY_LAST_INDEX - last_fail_end;
++ else
++ pass_length = ITAPDLY_LAST_INDEX - last_fail_end + first_fail_start;
++
++ if (pass_length > pass_window.length) {
++ pass_window.start = last_fail_end + 1;
++ pass_window.length = pass_length;
++ }
++
++ if (!circular_buffer)
++ itap = pass_window.start + (pass_window.length >> 1);
++ else
++ itap = (pass_window.start + (pass_window.length >> 1)) % ITAPDLY_LENGTH;
++
++ return (itap > ITAPDLY_LAST_INDEX) ? ITAPDLY_LAST_INDEX >> 1 : itap;
++}
++
+ static int sdhci_am654_platform_execute_tuning(struct sdhci_host *host,
+ u32 opcode)
+ {
+ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ struct sdhci_am654_data *sdhci_am654 = sdhci_pltfm_priv(pltfm_host);
+- int cur_val, prev_val = 1, fail_len = 0, pass_window = 0, pass_len;
+- u32 itap;
++ struct window fail_window[ITAPDLY_LENGTH];
++ u8 curr_pass, itap;
++ u8 fail_index = 0;
++ u8 prev_pass = 1;
++
++ memset(fail_window, 0, sizeof(fail_window));
+
+ /* Enable ITAPDLY */
+ regmap_update_bits(sdhci_am654->base, PHY_CTRL4, ITAPDLYENA_MASK,
+ 1 << ITAPDLYENA_SHIFT);
+
+- for (itap = 0; itap < ITAP_MAX; itap++) {
++ for (itap = 0; itap < ITAPDLY_LENGTH; itap++) {
+ sdhci_am654_write_itapdly(sdhci_am654, itap);
+
+- cur_val = !mmc_send_tuning(host->mmc, opcode, NULL);
+- if (cur_val && !prev_val)
+- pass_window = itap;
++ curr_pass = !mmc_send_tuning(host->mmc, opcode, NULL);
+
+- if (!cur_val)
+- fail_len++;
++ if (!curr_pass && prev_pass)
++ fail_window[fail_index].start = itap;
+
+- prev_val = cur_val;
++ if (!curr_pass) {
++ fail_window[fail_index].end = itap;
++ fail_window[fail_index].length++;
++ }
++
++ if (curr_pass && !prev_pass)
++ fail_index++;
++
++ prev_pass = curr_pass;
+ }
+- /*
+- * Having determined the length of the failing window and start of
+- * the passing window calculate the length of the passing window and
+- * set the final value halfway through it considering the range as a
+- * circular buffer
+- */
+- pass_len = ITAP_MAX - fail_len;
+- itap = (pass_window + (pass_len >> 1)) % ITAP_MAX;
++
++ if (fail_window[fail_index].length != 0)
++ fail_index++;
++
++ itap = sdhci_am654_calculate_itap(host, fail_window, fail_index,
++ sdhci_am654->dll_enable);
++
+ sdhci_am654_write_itapdly(sdhci_am654, itap);
+
+ return 0;
+--
+2.43.0
+
--- /dev/null
+From 96f446ac66d47f3be8640d89fd6cbac328ac9ff6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Mar 2024 17:38:37 -0500
+Subject: mmc: sdhci_am654: Fix ITAPDLY for HS400 timing
+
+From: Judith Mendez <jm@ti.com>
+
+[ Upstream commit d3182932bb070e7518411fd165e023f82afd7d25 ]
+
+While STRB is currently used for DATA and CRC responses, the CMD
+responses from the device to the host still require ITAPDLY for
+HS400 timing.
+
+Currently what is stored for HS400 is the ITAPDLY from High Speed
+mode which is incorrect. The ITAPDLY for HS400 speed mode should
+be the same as ITAPDLY as HS200 timing after tuning is executed.
+Add the functionality to save ITAPDLY from HS200 tuning and save
+as HS400 ITAPDLY.
+
+Fixes: a161c45f2979 ("mmc: sdhci_am654: Enable DLL only for some speed modes")
+Signed-off-by: Judith Mendez <jm@ti.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20240320223837.959900-8-jm@ti.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci_am654.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci_am654.c b/drivers/mmc/host/sdhci_am654.c
+index 884d1b53180d7..562034af653eb 100644
+--- a/drivers/mmc/host/sdhci_am654.c
++++ b/drivers/mmc/host/sdhci_am654.c
+@@ -301,6 +301,12 @@ static void sdhci_am654_set_clock(struct sdhci_host *host, unsigned int clock)
+ if (timing > MMC_TIMING_UHS_SDR25 && clock >= CLOCK_TOO_SLOW_HZ) {
+ sdhci_am654_setup_dll(host, clock);
+ sdhci_am654->dll_enable = true;
++
++ if (timing == MMC_TIMING_MMC_HS400) {
++ sdhci_am654->itap_del_ena[timing] = 0x1;
++ sdhci_am654->itap_del_sel[timing] = sdhci_am654->itap_del_sel[timing - 1];
++ }
++
+ sdhci_am654_write_itapdly(sdhci_am654, sdhci_am654->itap_del_sel[timing],
+ sdhci_am654->itap_del_ena[timing]);
+ } else {
+@@ -531,6 +537,9 @@ static int sdhci_am654_platform_execute_tuning(struct sdhci_host *host,
+
+ sdhci_am654_write_itapdly(sdhci_am654, itap, sdhci_am654->itap_del_ena[timing]);
+
++ /* Save ITAPDLY */
++ sdhci_am654->itap_del_sel[timing] = itap;
++
+ return 0;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From 024383fc1e105eb6eb830831f9de9eb7333b09f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Mar 2024 17:38:32 -0500
+Subject: mmc: sdhci_am654: Write ITAPDLY for DDR52 timing
+
+From: Judith Mendez <jm@ti.com>
+
+[ Upstream commit d465234493bb6ad1b9c10a0c9ef9881b8d85081a ]
+
+For DDR52 timing, DLL is enabled but tuning is not carried
+out, therefore the ITAPDLY value in PHY CTRL 4 register is
+not correct. Fix this by writing ITAPDLY after enabling DLL.
+
+Fixes: a161c45f2979 ("mmc: sdhci_am654: Enable DLL only for some speed modes")
+Signed-off-by: Judith Mendez <jm@ti.com>
+Reviewed-by: Andrew Davis <afd@ti.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20240320223837.959900-3-jm@ti.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci_am654.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mmc/host/sdhci_am654.c b/drivers/mmc/host/sdhci_am654.c
+index d8c9821b0b663..cfb614d0b42b4 100644
+--- a/drivers/mmc/host/sdhci_am654.c
++++ b/drivers/mmc/host/sdhci_am654.c
+@@ -300,6 +300,7 @@ static void sdhci_am654_set_clock(struct sdhci_host *host, unsigned int clock)
+ if (timing > MMC_TIMING_UHS_SDR25 && clock >= CLOCK_TOO_SLOW_HZ) {
+ sdhci_am654_setup_dll(host, clock);
+ sdhci_am654->dll_enable = true;
++ sdhci_am654_write_itapdly(sdhci_am654, sdhci_am654->itap_del_sel[timing]);
+ } else {
+ sdhci_am654_setup_delay_chain(sdhci_am654, timing);
+ sdhci_am654->dll_enable = false;
+--
+2.43.0
+
--- /dev/null
+From cfb6df106d0327749bf28313dca59061bd36d927 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 May 2024 09:56:30 -0700
+Subject: net: Always descend into dsa/ folder with CONFIG_NET_DSA enabled
+
+From: Florian Fainelli <florian.fainelli@broadcom.com>
+
+[ Upstream commit b1fa60ec252fba39130107074becd12d0b3f83ec ]
+
+Stephen reported that he was unable to get the dsa_loop driver to get
+probed, and the reason ended up being because he had CONFIG_FIXED_PHY=y
+in his kernel configuration. As Masahiro explained it:
+
+ "obj-m += dsa/" means everything under dsa/ must be modular.
+
+ If there is a built-in object under dsa/ with CONFIG_NET_DSA=m,
+ you cannot do "obj-$(CONFIG_NET_DSA) += dsa/".
+
+ You need to change it back to "obj-y += dsa/".
+
+This was the case here whereby CONFIG_NET_DSA=m, and so the
+obj-$(CONFIG_FIXED_PHY) += dsa_loop_bdinfo.o rule is not executed and
+the DSA loop mdio_board info structure is not registered with the
+kernel, and eventually the device is simply not found.
+
+To preserve the intention of the original commit of limiting the amount
+of folder descending, conditionally descend into drivers/net/dsa when
+CONFIG_NET_DSA is enabled.
+
+Fixes: 227d72063fcc ("dsa: simplify Kconfig symbols and dependencies")
+Reported-by: Stephen Langstaff <stephenlangstaff1@gmail.com>
+Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/Makefile | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/Makefile b/drivers/net/Makefile
+index 7cab36f94782e..db55ffdb5792d 100644
+--- a/drivers/net/Makefile
++++ b/drivers/net/Makefile
+@@ -48,7 +48,9 @@ obj-$(CONFIG_MHI_NET) += mhi_net.o
+ obj-$(CONFIG_ARCNET) += arcnet/
+ obj-$(CONFIG_CAIF) += caif/
+ obj-$(CONFIG_CAN) += can/
+-obj-$(CONFIG_NET_DSA) += dsa/
++ifdef CONFIG_NET_DSA
++obj-y += dsa/
++endif
+ obj-$(CONFIG_ETHERNET) += ethernet/
+ obj-$(CONFIG_FDDI) += fddi/
+ obj-$(CONFIG_HIPPI) += hippi/
+--
+2.43.0
+
--- /dev/null
+From cbfbc85091213edb1da4710aad07b23408219fbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2024 10:38:00 +0800
+Subject: net: fec: avoid lock evasion when reading pps_enable
+
+From: Wei Fang <wei.fang@nxp.com>
+
+[ Upstream commit 3b1c92f8e5371700fada307cc8fd2c51fa7bc8c1 ]
+
+The assignment of pps_enable is protected by tmreg_lock, but the read
+operation of pps_enable is not. So the Coverity tool reports a lock
+evasion warning which may cause data race to occur when running in a
+multithread environment. Although this issue is almost impossible to
+occur, we'd better fix it, at least it seems more logically reasonable,
+and it also prevents Coverity from continuing to issue warnings.
+
+Fixes: 278d24047891 ("net: fec: ptp: Enable PPS output based on ptp clock")
+Signed-off-by: Wei Fang <wei.fang@nxp.com>
+Link: https://lore.kernel.org/r/20240521023800.17102-1-wei.fang@nxp.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fec_ptp.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c
+index 181d9bfbee220..e32f6724f5681 100644
+--- a/drivers/net/ethernet/freescale/fec_ptp.c
++++ b/drivers/net/ethernet/freescale/fec_ptp.c
+@@ -104,14 +104,13 @@ static int fec_ptp_enable_pps(struct fec_enet_private *fep, uint enable)
+ struct timespec64 ts;
+ u64 ns;
+
+- if (fep->pps_enable == enable)
+- return 0;
+-
+- fep->pps_channel = DEFAULT_PPS_CHANNEL;
+- fep->reload_period = PPS_OUPUT_RELOAD_PERIOD;
+-
+ spin_lock_irqsave(&fep->tmreg_lock, flags);
+
++ if (fep->pps_enable == enable) {
++ spin_unlock_irqrestore(&fep->tmreg_lock, flags);
++ return 0;
++ }
++
+ if (enable) {
+ /* clear capture or output compare interrupt status if have.
+ */
+@@ -532,6 +531,9 @@ static int fec_ptp_enable(struct ptp_clock_info *ptp,
+ int ret = 0;
+
+ if (rq->type == PTP_CLK_REQ_PPS) {
++ fep->pps_channel = DEFAULT_PPS_CHANNEL;
++ fep->reload_period = PPS_OUPUT_RELOAD_PERIOD;
++
+ ret = fec_ptp_enable_pps(fep, on);
+
+ return ret;
+--
+2.43.0
+
--- /dev/null
+From cec5099bef575fbff139511e24c071c79c05fb60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 May 2024 15:58:08 +0200
+Subject: net: lan966x: Remove ptp traps in case the ptp is not enabled.
+
+From: Horatiu Vultur <horatiu.vultur@microchip.com>
+
+[ Upstream commit eda40be3a5ff3fdce513d2bcfeaca8cc16cf962a ]
+
+Lan966x is adding ptp traps to redirect the ptp frames to the CPU such
+that the HW will not forward these frames anywhere. The issue is that in
+case ptp is not enabled and the timestamping source is et to
+HWTSTAMP_SOURCE_NETDEV then these traps would not be removed on the
+error path.
+Fix this by removing the traps in this case as they are not needed.
+
+Fixes: 54e1ed69c40a ("net: lan966x: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set()")
+Suggested-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com>
+Link: https://lore.kernel.org/r/20240517135808.3025435-1-horatiu.vultur@microchip.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microchip/lan966x/lan966x_main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_main.c b/drivers/net/ethernet/microchip/lan966x/lan966x_main.c
+index 61d88207eed42..6695ed661ef83 100644
+--- a/drivers/net/ethernet/microchip/lan966x/lan966x_main.c
++++ b/drivers/net/ethernet/microchip/lan966x/lan966x_main.c
+@@ -474,14 +474,14 @@ static int lan966x_port_hwtstamp_set(struct net_device *dev,
+ cfg->source != HWTSTAMP_SOURCE_PHYLIB)
+ return -EOPNOTSUPP;
+
++ if (cfg->source == HWTSTAMP_SOURCE_NETDEV && !port->lan966x->ptp)
++ return -EOPNOTSUPP;
++
+ err = lan966x_ptp_setup_traps(port, cfg);
+ if (err)
+ return err;
+
+ if (cfg->source == HWTSTAMP_SOURCE_NETDEV) {
+- if (!port->lan966x->ptp)
+- return -EOPNOTSUPP;
+-
+ err = lan966x_ptp_hwtstamp_set(port, cfg, extack);
+ if (err) {
+ lan966x_ptp_del_traps(port);
+--
+2.43.0
+
--- /dev/null
+From d619197e09a2267d7066e20ad7a24d3582366607 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2024 16:01:00 +0200
+Subject: net: relax socket state check at accept time.
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+[ Upstream commit 26afda78cda3da974fd4c287962c169e9462c495 ]
+
+Christoph reported the following splat:
+
+WARNING: CPU: 1 PID: 772 at net/ipv4/af_inet.c:761 __inet_accept+0x1f4/0x4a0
+Modules linked in:
+CPU: 1 PID: 772 Comm: syz-executor510 Not tainted 6.9.0-rc7-g7da7119fe22b #56
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014
+RIP: 0010:__inet_accept+0x1f4/0x4a0 net/ipv4/af_inet.c:759
+Code: 04 38 84 c0 0f 85 87 00 00 00 41 c7 04 24 03 00 00 00 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc e8 ec b7 da fd <0f> 0b e9 7f fe ff ff e8 e0 b7 da fd 0f 0b e9 fe fe ff ff 89 d9 80
+RSP: 0018:ffffc90000c2fc58 EFLAGS: 00010293
+RAX: ffffffff836bdd14 RBX: 0000000000000000 RCX: ffff888104668000
+RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
+RBP: dffffc0000000000 R08: ffffffff836bdb89 R09: fffff52000185f64
+R10: dffffc0000000000 R11: fffff52000185f64 R12: dffffc0000000000
+R13: 1ffff92000185f98 R14: ffff88810754d880 R15: ffff8881007b7800
+FS: 000000001c772880(0000) GS:ffff88811b280000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007fb9fcf2e178 CR3: 00000001045d2002 CR4: 0000000000770ef0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+PKRU: 55555554
+Call Trace:
+ <TASK>
+ inet_accept+0x138/0x1d0 net/ipv4/af_inet.c:786
+ do_accept+0x435/0x620 net/socket.c:1929
+ __sys_accept4_file net/socket.c:1969 [inline]
+ __sys_accept4+0x9b/0x110 net/socket.c:1999
+ __do_sys_accept net/socket.c:2016 [inline]
+ __se_sys_accept net/socket.c:2013 [inline]
+ __x64_sys_accept+0x7d/0x90 net/socket.c:2013
+ do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+ do_syscall_64+0x58/0x100 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+RIP: 0033:0x4315f9
+Code: fd ff 48 81 c4 80 00 00 00 e9 f1 fe ff ff 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 ab b4 fd ff c3 66 2e 0f 1f 84 00 00 00 00
+RSP: 002b:00007ffdb26d9c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002b
+RAX: ffffffffffffffda RBX: 0000000000400300 RCX: 00000000004315f9
+RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
+RBP: 00000000006e1018 R08: 0000000000400300 R09: 0000000000400300
+R10: 0000000000400300 R11: 0000000000000246 R12: 0000000000000000
+R13: 000000000040cdf0 R14: 000000000040ce80 R15: 0000000000000055
+ </TASK>
+
+The reproducer invokes shutdown() before entering the listener status.
+After commit 94062790aedb ("tcp: defer shutdown(SEND_SHUTDOWN) for
+TCP_SYN_RECV sockets"), the above causes the child to reach the accept
+syscall in FIN_WAIT1 status.
+
+Eric noted we can relax the existing assertion in __inet_accept()
+
+Reported-by: Christoph Paasch <cpaasch@apple.com>
+Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/490
+Suggested-by: Eric Dumazet <edumazet@google.com>
+Fixes: 94062790aedb ("tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets")
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://lore.kernel.org/r/23ab880a44d8cfd967e84de8b93dbf48848e3d8c.1716299669.git.pabeni@redhat.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/af_inet.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
+index fafb123f798be..c6bebca49591f 100644
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -758,7 +758,9 @@ void __inet_accept(struct socket *sock, struct socket *newsock, struct sock *new
+ sock_rps_record_flow(newsk);
+ WARN_ON(!((1 << newsk->sk_state) &
+ (TCPF_ESTABLISHED | TCPF_SYN_RECV |
+- TCPF_CLOSE_WAIT | TCPF_CLOSE)));
++ TCPF_FIN_WAIT1 | TCPF_FIN_WAIT2 |
++ TCPF_CLOSING | TCPF_CLOSE_WAIT |
++ TCPF_CLOSE)));
+
+ if (test_bit(SOCK_SUPPORT_ZC, &sock->flags))
+ set_bit(SOCK_SUPPORT_ZC, &newsock->flags);
+--
+2.43.0
+
--- /dev/null
+From 3efb206ecfbcd4a666c8f36bc616073abf469406 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2024 16:49:46 +0100
+Subject: netfs: Fix setting of BDP_ASYNC from iocb flags
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit c596bea1452ddf172ec9b588e4597228e9a1f4d5 ]
+
+Fix netfs_perform_write() to set BDP_ASYNC if IOCB_NOWAIT is set rather
+than if IOCB_SYNC is not set. It reflects asynchronicity in the sense of
+not waiting rather than synchronicity in the sense of not returning until
+the op is complete.
+
+Without this, generic/590 fails on cifs in strict caching mode with a
+complaint that one of the writes fails with EAGAIN. The test can be
+distilled down to:
+
+ mount -t cifs /my/share /mnt -ostuff
+ xfs_io -i -c 'falloc 0 8191M -c fsync -f /mnt/file
+ xfs_io -i -c 'pwrite -b 1M -W 0 8191M' /mnt/file
+
+Fixes: c38f4e96e605 ("netfs: Provide func to copy data to pagecache for buffered write")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://lore.kernel.org/r/316306.1716306586@warthog.procyon.org.uk
+Reviewed-by: Jens Axboe <axboe@kernel.dk>
+cc: Jeff Layton <jlayton@kernel.org>
+cc: Enzo Matsumiya <ematsumiya@suse.de>
+cc: Jens Axboe <axboe@kernel.dk>
+cc: Matthew Wilcox <willy@infradead.org>
+cc: netfs@lists.linux.dev
+cc: v9fs@lists.linux.dev
+cc: linux-afs@lists.infradead.org
+cc: linux-cifs@vger.kernel.org
+cc: linux-fsdevel@vger.kernel.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/netfs/buffered_write.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/netfs/buffered_write.c b/fs/netfs/buffered_write.c
+index 267b622d923b1..912ad0a1df021 100644
+--- a/fs/netfs/buffered_write.c
++++ b/fs/netfs/buffered_write.c
+@@ -163,7 +163,7 @@ ssize_t netfs_perform_write(struct kiocb *iocb, struct iov_iter *iter,
+ struct folio *folio;
+ enum netfs_how_to_modify howto;
+ enum netfs_folio_trace trace;
+- unsigned int bdp_flags = (iocb->ki_flags & IOCB_SYNC) ? 0: BDP_ASYNC;
++ unsigned int bdp_flags = (iocb->ki_flags & IOCB_NOWAIT) ? BDP_ASYNC : 0;
+ ssize_t written = 0, ret, ret2;
+ loff_t i_size, pos = iocb->ki_pos, from, to;
+ size_t max_chunk = PAGE_SIZE << MAX_PAGECACHE_ORDER;
+--
+2.43.0
+
--- /dev/null
+From 65e195fd994538a4ab726d872b22dc020b560679 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 May 2024 00:34:42 +0900
+Subject: nfc: nci: Fix handling of zero-length payload packets in
+ nci_rx_work()
+
+From: Ryosuke Yasuoka <ryasuoka@redhat.com>
+
+[ Upstream commit 6671e352497ca4bb07a96c48e03907065ff77d8a ]
+
+When nci_rx_work() receives a zero-length payload packet, it should not
+discard the packet and exit the loop. Instead, it should continue
+processing subsequent packets.
+
+Fixes: d24b03535e5e ("nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet")
+Signed-off-by: Ryosuke Yasuoka <ryasuoka@redhat.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20240521153444.535399-1-ryasuoka@redhat.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/nfc/nci/core.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
+index 7a9897fbf4f41..f456a5911e7d1 100644
+--- a/net/nfc/nci/core.c
++++ b/net/nfc/nci/core.c
+@@ -1531,8 +1531,7 @@ static void nci_rx_work(struct work_struct *work)
+
+ if (!nci_valid_size(skb)) {
+ kfree_skb(skb);
+- kcov_remote_stop();
+- break;
++ continue;
+ }
+
+ /* Process frame */
+--
+2.43.0
+
--- /dev/null
+From 4715cddb7d482aad44f4d78c78ffb5902f999841 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 May 2024 18:43:03 +0900
+Subject: nfc: nci: Fix uninit-value in nci_rx_work
+
+From: Ryosuke Yasuoka <ryasuoka@redhat.com>
+
+[ Upstream commit e4a87abf588536d1cdfb128595e6e680af5cf3ed ]
+
+syzbot reported the following uninit-value access issue [1]
+
+nci_rx_work() parses received packet from ndev->rx_q. It should be
+validated header size, payload size and total packet size before
+processing the packet. If an invalid packet is detected, it should be
+silently discarded.
+
+Fixes: d24b03535e5e ("nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet")
+Reported-and-tested-by: syzbot+d7b4dc6cd50410152534@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=d7b4dc6cd50410152534 [1]
+Signed-off-by: Ryosuke Yasuoka <ryasuoka@redhat.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/nfc/nci/core.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
+index b133dc55304ce..7a9897fbf4f41 100644
+--- a/net/nfc/nci/core.c
++++ b/net/nfc/nci/core.c
+@@ -1463,6 +1463,19 @@ int nci_core_ntf_packet(struct nci_dev *ndev, __u16 opcode,
+ ndev->ops->n_core_ops);
+ }
+
++static bool nci_valid_size(struct sk_buff *skb)
++{
++ BUILD_BUG_ON(NCI_CTRL_HDR_SIZE != NCI_DATA_HDR_SIZE);
++ unsigned int hdr_size = NCI_CTRL_HDR_SIZE;
++
++ if (skb->len < hdr_size ||
++ !nci_plen(skb->data) ||
++ skb->len < hdr_size + nci_plen(skb->data)) {
++ return false;
++ }
++ return true;
++}
++
+ /* ---- NCI TX Data worker thread ---- */
+
+ static void nci_tx_work(struct work_struct *work)
+@@ -1516,7 +1529,7 @@ static void nci_rx_work(struct work_struct *work)
+ nfc_send_to_raw_sock(ndev->nfc_dev, skb,
+ RAW_PAYLOAD_NCI, NFC_DIRECTION_RX);
+
+- if (!nci_plen(skb->data)) {
++ if (!nci_valid_size(skb)) {
+ kfree_skb(skb);
+ kcov_remote_stop();
+ break;
+--
+2.43.0
+
--- /dev/null
+From 4b2a4ed7490a9fe4a30fdda0b8a6849bd571ebde Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Apr 2024 19:01:09 +0200
+Subject: nfs: keep server info for remounts
+
+From: Martin Kaiser <martin@kaiser.cx>
+
+[ Upstream commit b322bf9e983addedff0894c55e92d58f4d16d92a ]
+
+With newer kernels that use fs_context for nfs mounts, remounts fail with
+-EINVAL.
+
+$ mount -t nfs -o nolock 10.0.0.1:/tmp/test /mnt/test/
+$ mount -t nfs -o remount /mnt/test/
+mount: mounting 10.0.0.1:/tmp/test on /mnt/test failed: Invalid argument
+
+For remounts, the nfs server address and port are populated by
+nfs_init_fs_context and later overwritten with 0x00 bytes by
+nfs23_parse_monolithic. The remount then fails as the server address is
+invalid.
+
+Fix this by not overwriting nfs server info in nfs23_parse_monolithic if
+we're doing a remount.
+
+Fixes: f2aedb713c28 ("NFS: Add fs_context support.")
+Signed-off-by: Martin Kaiser <martin@kaiser.cx>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/fs_context.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/fs/nfs/fs_context.c b/fs/nfs/fs_context.c
+index d0a0956f8a134..cac1157be2c29 100644
+--- a/fs/nfs/fs_context.c
++++ b/fs/nfs/fs_context.c
+@@ -1112,9 +1112,12 @@ static int nfs23_parse_monolithic(struct fs_context *fc,
+ ctx->acdirmax = data->acdirmax;
+ ctx->need_mount = false;
+
+- memcpy(sap, &data->addr, sizeof(data->addr));
+- ctx->nfs_server.addrlen = sizeof(data->addr);
+- ctx->nfs_server.port = ntohs(data->addr.sin_port);
++ if (!is_remount_fc(fc)) {
++ memcpy(sap, &data->addr, sizeof(data->addr));
++ ctx->nfs_server.addrlen = sizeof(data->addr);
++ ctx->nfs_server.port = ntohs(data->addr.sin_port);
++ }
++
+ if (sap->ss_family != AF_INET ||
+ !nfs_verify_server_address(sap))
+ goto out_no_address;
+--
+2.43.0
+
--- /dev/null
+From f644244f86a77cf78484fdc6dc6d7290a6653483 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Apr 2024 14:49:29 -0400
+Subject: NFSv4: Fixup smatch warning for ambiguous return
+
+From: Benjamin Coddington <bcodding@redhat.com>
+
+[ Upstream commit 37ffe06537af3e3ec212e7cbe941046fce0a822f ]
+
+Dan Carpenter reports smatch warning for nfs4_try_migration() when a memory
+allocation failure results in a zero return value. In this case, a
+transient allocation failure error will likely be retried the next time the
+server responds with NFS4ERR_MOVED.
+
+We can fixup the smatch warning with a small refactor: attempt all three
+allocations before testing and returning on a failure.
+
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Fixes: c3ed222745d9 ("NFSv4: Fix free of uninitialized nfs4_label on referral lookup.")
+Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4state.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 662e86ea3a2dd..5b452411e8fdf 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -2116,6 +2116,7 @@ static int nfs4_try_migration(struct nfs_server *server, const struct cred *cred
+ {
+ struct nfs_client *clp = server->nfs_client;
+ struct nfs4_fs_locations *locations = NULL;
++ struct nfs_fattr *fattr;
+ struct inode *inode;
+ struct page *page;
+ int status, result;
+@@ -2125,19 +2126,16 @@ static int nfs4_try_migration(struct nfs_server *server, const struct cred *cred
+ (unsigned long long)server->fsid.minor,
+ clp->cl_hostname);
+
+- result = 0;
+ page = alloc_page(GFP_KERNEL);
+ locations = kmalloc(sizeof(struct nfs4_fs_locations), GFP_KERNEL);
+- if (page == NULL || locations == NULL) {
+- dprintk("<-- %s: no memory\n", __func__);
+- goto out;
+- }
+- locations->fattr = nfs_alloc_fattr();
+- if (locations->fattr == NULL) {
++ fattr = nfs_alloc_fattr();
++ if (page == NULL || locations == NULL || fattr == NULL) {
+ dprintk("<-- %s: no memory\n", __func__);
++ result = 0;
+ goto out;
+ }
+
++ locations->fattr = fattr;
+ inode = d_inode(server->super->s_root);
+ result = nfs4_proc_get_locations(server, NFS_FH(inode), locations,
+ page, cred);
+--
+2.43.0
+
--- /dev/null
+From 5ca468e18e9074ae6ba779845a555fd869fffac1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Apr 2024 17:00:19 +0900
+Subject: nilfs2: make superblock data array index computation sparse friendly
+
+From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+
+[ Upstream commit 91d743a9c8299de1fc1b47428d8bb4c85face00f ]
+
+Upon running sparse, "warning: dubious: x & !y" is output at an array
+index calculation within nilfs_load_super_block().
+
+The calculation is not wrong, but to eliminate the sparse warning, replace
+it with an equivalent calculation.
+
+Also, add a comment to make it easier to understand what the unintuitive
+array index calculation is doing and whether it's correct.
+
+Link: https://lkml.kernel.org/r/20240430080019.4242-3-konishi.ryusuke@gmail.com
+Fixes: e339ad31f599 ("nilfs2: introduce secondary super block")
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Cc: Bart Van Assche <bvanassche@acm.org>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: kernel test robot <lkp@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nilfs2/the_nilfs.c | 20 ++++++++++++++++++--
+ 1 file changed, 18 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
+index 2ae2c1bbf6d17..adbc6e87471ab 100644
+--- a/fs/nilfs2/the_nilfs.c
++++ b/fs/nilfs2/the_nilfs.c
+@@ -592,7 +592,7 @@ static int nilfs_load_super_block(struct the_nilfs *nilfs,
+ struct nilfs_super_block **sbp = nilfs->ns_sbp;
+ struct buffer_head **sbh = nilfs->ns_sbh;
+ u64 sb2off, devsize = bdev_nr_bytes(nilfs->ns_bdev);
+- int valid[2], swp = 0;
++ int valid[2], swp = 0, older;
+
+ if (devsize < NILFS_SEG_MIN_BLOCKS * NILFS_MIN_BLOCK_SIZE + 4096) {
+ nilfs_err(sb, "device size too small");
+@@ -648,9 +648,25 @@ static int nilfs_load_super_block(struct the_nilfs *nilfs,
+ if (swp)
+ nilfs_swap_super_block(nilfs);
+
++ /*
++ * Calculate the array index of the older superblock data.
++ * If one has been dropped, set index 0 pointing to the remaining one,
++ * otherwise set index 1 pointing to the old one (including if both
++ * are the same).
++ *
++ * Divided case valid[0] valid[1] swp -> older
++ * -------------------------------------------------------------
++ * Both SBs are invalid 0 0 N/A (Error)
++ * SB1 is invalid 0 1 1 0
++ * SB2 is invalid 1 0 0 0
++ * SB2 is newer 1 1 1 0
++ * SB2 is older or the same 1 1 0 1
++ */
++ older = valid[1] ^ swp;
++
+ nilfs->ns_sbwcount = 0;
+ nilfs->ns_sbwtime = le64_to_cpu(sbp[0]->s_wtime);
+- nilfs->ns_prot_seq = le64_to_cpu(sbp[valid[1] & !swp]->s_last_seq);
++ nilfs->ns_prot_seq = le64_to_cpu(sbp[older]->s_last_seq);
+ *sbpp = sbp[0];
+ return 0;
+ }
+--
+2.43.0
+
--- /dev/null
+From b46da34ecca05ed47090549b0a6dbd92116ea34b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 May 2024 23:39:34 +0800
+Subject: null_blk: fix null-ptr-dereference while configuring 'power' and
+ 'submit_queues'
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit a2db328b0839312c169eb42746ec46fc1ab53ed2 ]
+
+Writing 'power' and 'submit_queues' concurrently will trigger kernel
+panic:
+
+Test script:
+
+modprobe null_blk nr_devices=0
+mkdir -p /sys/kernel/config/nullb/nullb0
+while true; do echo 1 > submit_queues; echo 4 > submit_queues; done &
+while true; do echo 1 > power; echo 0 > power; done
+
+Test result:
+
+BUG: kernel NULL pointer dereference, address: 0000000000000148
+Oops: 0000 [#1] PREEMPT SMP
+RIP: 0010:__lock_acquire+0x41d/0x28f0
+Call Trace:
+ <TASK>
+ lock_acquire+0x121/0x450
+ down_write+0x5f/0x1d0
+ simple_recursive_removal+0x12f/0x5c0
+ blk_mq_debugfs_unregister_hctxs+0x7c/0x100
+ blk_mq_update_nr_hw_queues+0x4a3/0x720
+ nullb_update_nr_hw_queues+0x71/0xf0 [null_blk]
+ nullb_device_submit_queues_store+0x79/0xf0 [null_blk]
+ configfs_write_iter+0x119/0x1e0
+ vfs_write+0x326/0x730
+ ksys_write+0x74/0x150
+
+This is because del_gendisk() can concurrent with
+blk_mq_update_nr_hw_queues():
+
+nullb_device_power_store nullb_apply_submit_queues
+ null_del_dev
+ del_gendisk
+ nullb_update_nr_hw_queues
+ if (!dev->nullb)
+ // still set while gendisk is deleted
+ return 0
+ blk_mq_update_nr_hw_queues
+ dev->nullb = NULL
+
+Fix this problem by resuing the global mutex to protect
+nullb_device_power_store() and nullb_update_nr_hw_queues() from configfs.
+
+Fixes: 45919fbfe1c4 ("null_blk: Enable modifying 'submit_queues' after an instance has been configured")
+Reported-and-tested-by: Yi Zhang <yi.zhang@redhat.com>
+Closes: https://lore.kernel.org/all/CAHj4cs9LgsHLnjg8z06LQ3Pr5cax-+Ps+xT7AP7TPnEjStuwZA@mail.gmail.com/
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Link: https://lore.kernel.org/r/20240523153934.1937851-1-yukuai1@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/null_blk/main.c | 40 +++++++++++++++++++++++------------
+ 1 file changed, 26 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
+index 14ffda1ffe6c3..3b3fd093b0044 100644
+--- a/drivers/block/null_blk/main.c
++++ b/drivers/block/null_blk/main.c
+@@ -404,13 +404,25 @@ static int nullb_update_nr_hw_queues(struct nullb_device *dev,
+ static int nullb_apply_submit_queues(struct nullb_device *dev,
+ unsigned int submit_queues)
+ {
+- return nullb_update_nr_hw_queues(dev, submit_queues, dev->poll_queues);
++ int ret;
++
++ mutex_lock(&lock);
++ ret = nullb_update_nr_hw_queues(dev, submit_queues, dev->poll_queues);
++ mutex_unlock(&lock);
++
++ return ret;
+ }
+
+ static int nullb_apply_poll_queues(struct nullb_device *dev,
+ unsigned int poll_queues)
+ {
+- return nullb_update_nr_hw_queues(dev, dev->submit_queues, poll_queues);
++ int ret;
++
++ mutex_lock(&lock);
++ ret = nullb_update_nr_hw_queues(dev, dev->submit_queues, poll_queues);
++ mutex_unlock(&lock);
++
++ return ret;
+ }
+
+ NULLB_DEVICE_ATTR(size, ulong, NULL);
+@@ -457,28 +469,31 @@ static ssize_t nullb_device_power_store(struct config_item *item,
+ if (ret < 0)
+ return ret;
+
++ ret = count;
++ mutex_lock(&lock);
+ if (!dev->power && newp) {
+ if (test_and_set_bit(NULLB_DEV_FL_UP, &dev->flags))
+- return count;
++ goto out;
++
+ ret = null_add_dev(dev);
+ if (ret) {
+ clear_bit(NULLB_DEV_FL_UP, &dev->flags);
+- return ret;
++ goto out;
+ }
+
+ set_bit(NULLB_DEV_FL_CONFIGURED, &dev->flags);
+ dev->power = newp;
+ } else if (dev->power && !newp) {
+ if (test_and_clear_bit(NULLB_DEV_FL_UP, &dev->flags)) {
+- mutex_lock(&lock);
+ dev->power = newp;
+ null_del_dev(dev->nullb);
+- mutex_unlock(&lock);
+ }
+ clear_bit(NULLB_DEV_FL_CONFIGURED, &dev->flags);
+ }
+
+- return count;
++out:
++ mutex_unlock(&lock);
++ return ret;
+ }
+
+ CONFIGFS_ATTR(nullb_device_, power);
+@@ -1918,15 +1933,12 @@ static int null_add_dev(struct nullb_device *dev)
+ nullb->q->queuedata = nullb;
+ blk_queue_flag_set(QUEUE_FLAG_NONROT, nullb->q);
+
+- mutex_lock(&lock);
+ rv = ida_alloc(&nullb_indexes, GFP_KERNEL);
+- if (rv < 0) {
+- mutex_unlock(&lock);
++ if (rv < 0)
+ goto out_cleanup_disk;
+- }
++
+ nullb->index = rv;
+ dev->index = rv;
+- mutex_unlock(&lock);
+
+ if (config_item_name(&dev->group.cg_item)) {
+ /* Use configfs dir name as the device name */
+@@ -1955,9 +1967,7 @@ static int null_add_dev(struct nullb_device *dev)
+ if (rv)
+ goto out_ida_free;
+
+- mutex_lock(&lock);
+ list_add_tail(&nullb->list, &nullb_list);
+- mutex_unlock(&lock);
+
+ pr_info("disk %s created\n", nullb->disk_name);
+
+@@ -2006,7 +2016,9 @@ static int null_create_dev(void)
+ if (!dev)
+ return -ENOMEM;
+
++ mutex_lock(&lock);
+ ret = null_add_dev(dev);
++ mutex_unlock(&lock);
+ if (ret) {
+ null_free_dev(dev);
+ return ret;
+--
+2.43.0
+
--- /dev/null
+From 9b760a024c38abeae81894b4c96985e2c88581ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 May 2024 09:55:38 +0200
+Subject: null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION()
+
+From: Zhu Yanjun <yanjun.zhu@linux.dev>
+
+[ Upstream commit 9e6727f824edcdb8fdd3e6e8a0862eb49546e1cd ]
+
+No functional changes intended.
+
+Fixes: f2298c0403b0 ("null_blk: multi queue aware block test driver")
+Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Link: https://lore.kernel.org/r/20240506075538.6064-1-yanjun.zhu@linux.dev
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/null_blk/main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
+index eed63f95e89d0..14ffda1ffe6c3 100644
+--- a/drivers/block/null_blk/main.c
++++ b/drivers/block/null_blk/main.c
+@@ -2121,4 +2121,5 @@ module_init(null_init);
+ module_exit(null_exit);
+
+ MODULE_AUTHOR("Jens Axboe <axboe@kernel.dk>");
++MODULE_DESCRIPTION("multi queue aware block test driver");
+ MODULE_LICENSE("GPL");
+--
+2.43.0
+
--- /dev/null
+From bbaaf07a481fb1662146a7e026c19554504eaab2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 May 2024 16:09:41 -0400
+Subject: openvswitch: Set the skbuff pkt_type for proper pmtud support.
+
+From: Aaron Conole <aconole@redhat.com>
+
+[ Upstream commit 30a92c9e3d6b073932762bef2ac66f4ee784c657 ]
+
+Open vSwitch is originally intended to switch at layer 2, only dealing with
+Ethernet frames. With the introduction of l3 tunnels support, it crossed
+into the realm of needing to care a bit about some routing details when
+making forwarding decisions. If an oversized packet would need to be
+fragmented during this forwarding decision, there is a chance for pmtu
+to get involved and generate a routing exception. This is gated by the
+skbuff->pkt_type field.
+
+When a flow is already loaded into the openvswitch module this field is
+set up and transitioned properly as a packet moves from one port to
+another. In the case that a packet execute is invoked after a flow is
+newly installed this field is not properly initialized. This causes the
+pmtud mechanism to omit sending the required exception messages across
+the tunnel boundary and a second attempt needs to be made to make sure
+that the routing exception is properly setup. To fix this, we set the
+outgoing packet's pkt_type to PACKET_OUTGOING, since it can only get
+to the openvswitch module via a port device or packet command.
+
+Even for bridge ports as users, the pkt_type needs to be reset when
+doing the transmit as the packet is truly outgoing and routing needs
+to get involved post packet transformations, in the case of
+VXLAN/GENEVE/udp-tunnel packets. In general, the pkt_type on output
+gets ignored, since we go straight to the driver, but in the case of
+tunnel ports they go through IP routing layer.
+
+This issue is periodically encountered in complex setups, such as large
+openshift deployments, where multiple sets of tunnel traversal occurs.
+A way to recreate this is with the ovn-heater project that can setup
+a networking environment which mimics such large deployments. We need
+larger environments for this because we need to ensure that flow
+misses occur. In these environment, without this patch, we can see:
+
+ ./ovn_cluster.sh start
+ podman exec ovn-chassis-1 ip r a 170.168.0.5/32 dev eth1 mtu 1200
+ podman exec ovn-chassis-1 ip netns exec sw01p1 ip r flush cache
+ podman exec ovn-chassis-1 ip netns exec sw01p1 \
+ ping 21.0.0.3 -M do -s 1300 -c2
+ PING 21.0.0.3 (21.0.0.3) 1300(1328) bytes of data.
+ From 21.0.0.3 icmp_seq=2 Frag needed and DF set (mtu = 1142)
+
+ --- 21.0.0.3 ping statistics ---
+ ...
+
+Using tcpdump, we can also see the expected ICMP FRAG_NEEDED message is not
+sent into the server.
+
+With this patch, setting the pkt_type, we see the following:
+
+ podman exec ovn-chassis-1 ip netns exec sw01p1 \
+ ping 21.0.0.3 -M do -s 1300 -c2
+ PING 21.0.0.3 (21.0.0.3) 1300(1328) bytes of data.
+ From 21.0.0.3 icmp_seq=1 Frag needed and DF set (mtu = 1222)
+ ping: local error: message too long, mtu=1222
+
+ --- 21.0.0.3 ping statistics ---
+ ...
+
+In this case, the first ping request receives the FRAG_NEEDED message and
+a local routing exception is created.
+
+Tested-by: Jaime Caamano <jcaamano@redhat.com>
+Reported-at: https://issues.redhat.com/browse/FDP-164
+Fixes: 58264848a5a7 ("openvswitch: Add vxlan tunneling support.")
+Signed-off-by: Aaron Conole <aconole@redhat.com>
+Acked-by: Eelco Chaudron <echaudro@redhat.com>
+Link: https://lore.kernel.org/r/20240516200941.16152-1-aconole@redhat.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/openvswitch/actions.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
+index 6fcd7e2ca81fe..9642255808247 100644
+--- a/net/openvswitch/actions.c
++++ b/net/openvswitch/actions.c
+@@ -936,6 +936,12 @@ static void do_output(struct datapath *dp, struct sk_buff *skb, int out_port,
+ pskb_trim(skb, ovs_mac_header_len(key));
+ }
+
++ /* Need to set the pkt_type to involve the routing layer. The
++ * packet movement through the OVS datapath doesn't generally
++ * use routing, but this is needed for tunnel cases.
++ */
++ skb->pkt_type = PACKET_OUTGOING;
++
+ if (likely(!mru ||
+ (skb->len <= mru + vport->dev->hard_header_len))) {
+ ovs_vport_send(vport, skb, ovs_key_mac_proto(key));
+--
+2.43.0
+
--- /dev/null
+From c1f4d91f42f2068809b118f9bc9f97ed30db6ec3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 May 2024 11:00:50 -0700
+Subject: perf/arm-dmc620: Fix lockdep assert in ->event_init()
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+[ Upstream commit a4c5a457c6107dfe9dc65a104af1634811396bac ]
+
+for_each_sibling_event() checks leader's ctx but it doesn't have the ctx
+yet if it's the leader. Like in perf_event_validate_size(), we should
+skip checking siblings in that case.
+
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Fixes: f3c0eba28704 ("perf: Add a few assertions")
+Reported-by: Greg Thelen <gthelen@google.com>
+Cc: Robin Murphy <robin.murphy@arm.com>
+Cc: Tuan Phan <tuanphan@os.amperecomputing.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Reviewed-by: Robin Murphy <robin.murphy@arm.com>
+Link: https://lore.kernel.org/r/20240514180050.182454-1-namhyung@kernel.org
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm_dmc620_pmu.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/perf/arm_dmc620_pmu.c b/drivers/perf/arm_dmc620_pmu.c
+index 8a81be2dd5ecf..88c17c1d6d499 100644
+--- a/drivers/perf/arm_dmc620_pmu.c
++++ b/drivers/perf/arm_dmc620_pmu.c
+@@ -542,12 +542,16 @@ static int dmc620_pmu_event_init(struct perf_event *event)
+ if (event->cpu < 0)
+ return -EINVAL;
+
++ hwc->idx = -1;
++
++ if (event->group_leader == event)
++ return 0;
++
+ /*
+ * We can't atomically disable all HW counters so only one event allowed,
+ * although software events are acceptable.
+ */
+- if (event->group_leader != event &&
+- !is_software_event(event->group_leader))
++ if (!is_software_event(event->group_leader))
+ return -EINVAL;
+
+ for_each_sibling_event(sibling, event->group_leader) {
+@@ -556,7 +560,6 @@ static int dmc620_pmu_event_init(struct perf_event *event)
+ return -EINVAL;
+ }
+
+- hwc->idx = -1;
+ return 0;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From 6ed19f589553c0fdd205e36126dbcaaa7c16bf2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Feb 2024 16:22:36 +0100
+Subject: phy: qcom: qmp-combo: fix sm8650 voltage swing table
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit f320268fcebcbab02631d2070fa19ad4856a5a5e ]
+
+The QMP USB3/DP PHY found in the SM8650 SoC requires a slightly
+different Voltage Swing table for HBR/RBR link speeds.
+
+Add a new hbr/rbr voltage switch table named "v6" used in a new
+sm8650 qmp_phy_cfg struct replacing the sm8550 fallback used for
+the sm8650 compatible.
+
+Fixes: 80c1afe8c5fe ("phy: qcom: qmp-combo: add QMP USB3/DP PHY tables for SM8650")
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20240226-topic-sm8650-upstream-combo-phy-swing-update-v1-1-08707ebca92a@linaro.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/qualcomm/phy-qcom-qmp-combo.c | 54 ++++++++++++++++++++++-
+ 1 file changed, 53 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
+index c21cdb8dbfe74..acc2b5b9ea255 100644
+--- a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
++++ b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
+@@ -1382,6 +1382,13 @@ static const u8 qmp_dp_v5_voltage_swing_hbr_rbr[4][4] = {
+ { 0x3f, 0xff, 0xff, 0xff }
+ };
+
++static const u8 qmp_dp_v6_voltage_swing_hbr_rbr[4][4] = {
++ { 0x27, 0x2f, 0x36, 0x3f },
++ { 0x31, 0x3e, 0x3f, 0xff },
++ { 0x36, 0x3f, 0xff, 0xff },
++ { 0x3f, 0xff, 0xff, 0xff }
++};
++
+ static const u8 qmp_dp_v6_pre_emphasis_hbr_rbr[4][4] = {
+ { 0x20, 0x2d, 0x34, 0x3a },
+ { 0x20, 0x2e, 0x35, 0xff },
+@@ -2001,6 +2008,51 @@ static const struct qmp_phy_cfg sm8550_usb3dpphy_cfg = {
+ .num_vregs = ARRAY_SIZE(qmp_phy_vreg_l),
+ };
+
++static const struct qmp_phy_cfg sm8650_usb3dpphy_cfg = {
++ .offsets = &qmp_combo_offsets_v3,
++
++ .serdes_tbl = sm8550_usb3_serdes_tbl,
++ .serdes_tbl_num = ARRAY_SIZE(sm8550_usb3_serdes_tbl),
++ .tx_tbl = sm8550_usb3_tx_tbl,
++ .tx_tbl_num = ARRAY_SIZE(sm8550_usb3_tx_tbl),
++ .rx_tbl = sm8550_usb3_rx_tbl,
++ .rx_tbl_num = ARRAY_SIZE(sm8550_usb3_rx_tbl),
++ .pcs_tbl = sm8550_usb3_pcs_tbl,
++ .pcs_tbl_num = ARRAY_SIZE(sm8550_usb3_pcs_tbl),
++ .pcs_usb_tbl = sm8550_usb3_pcs_usb_tbl,
++ .pcs_usb_tbl_num = ARRAY_SIZE(sm8550_usb3_pcs_usb_tbl),
++
++ .dp_serdes_tbl = qmp_v6_dp_serdes_tbl,
++ .dp_serdes_tbl_num = ARRAY_SIZE(qmp_v6_dp_serdes_tbl),
++ .dp_tx_tbl = qmp_v6_dp_tx_tbl,
++ .dp_tx_tbl_num = ARRAY_SIZE(qmp_v6_dp_tx_tbl),
++
++ .serdes_tbl_rbr = qmp_v6_dp_serdes_tbl_rbr,
++ .serdes_tbl_rbr_num = ARRAY_SIZE(qmp_v6_dp_serdes_tbl_rbr),
++ .serdes_tbl_hbr = qmp_v6_dp_serdes_tbl_hbr,
++ .serdes_tbl_hbr_num = ARRAY_SIZE(qmp_v6_dp_serdes_tbl_hbr),
++ .serdes_tbl_hbr2 = qmp_v6_dp_serdes_tbl_hbr2,
++ .serdes_tbl_hbr2_num = ARRAY_SIZE(qmp_v6_dp_serdes_tbl_hbr2),
++ .serdes_tbl_hbr3 = qmp_v6_dp_serdes_tbl_hbr3,
++ .serdes_tbl_hbr3_num = ARRAY_SIZE(qmp_v6_dp_serdes_tbl_hbr3),
++
++ .swing_hbr_rbr = &qmp_dp_v6_voltage_swing_hbr_rbr,
++ .pre_emphasis_hbr_rbr = &qmp_dp_v6_pre_emphasis_hbr_rbr,
++ .swing_hbr3_hbr2 = &qmp_dp_v5_voltage_swing_hbr3_hbr2,
++ .pre_emphasis_hbr3_hbr2 = &qmp_dp_v5_pre_emphasis_hbr3_hbr2,
++
++ .dp_aux_init = qmp_v4_dp_aux_init,
++ .configure_dp_tx = qmp_v4_configure_dp_tx,
++ .configure_dp_phy = qmp_v4_configure_dp_phy,
++ .calibrate_dp_phy = qmp_v4_calibrate_dp_phy,
++
++ .regs = qmp_v6_usb3phy_regs_layout,
++ .reset_list = msm8996_usb3phy_reset_l,
++ .num_resets = ARRAY_SIZE(msm8996_usb3phy_reset_l),
++ .vreg_list = qmp_phy_vreg_l,
++ .num_vregs = ARRAY_SIZE(qmp_phy_vreg_l),
++};
++
+ static int qmp_combo_dp_serdes_init(struct qmp_combo *qmp)
+ {
+ const struct qmp_phy_cfg *cfg = qmp->cfg;
+@@ -3631,7 +3683,7 @@ static const struct of_device_id qmp_combo_of_match_table[] = {
+ },
+ {
+ .compatible = "qcom,sm8650-qmp-usb3-dp-phy",
+- .data = &sm8550_usb3dpphy_cfg,
++ .data = &sm8650_usb3dpphy_cfg,
+ },
+ {
+ .compatible = "qcom,x1e80100-qmp-usb3-dp-phy",
+--
+2.43.0
+
--- /dev/null
+From ce3f61af123a77847360a41f2a18bd36140e6458 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Apr 2024 14:28:11 +0200
+Subject: platform/x86: thinkpad_acpi: Take hotkey_mutex during hotkey_exit()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit e397c564298c2e91aea3887990da8e8eddb65277 ]
+
+hotkey_exit() already takes the mutex around the hotkey_poll_stop_sync()
+call, but not around the other calls.
+
+commit 38831eaf7d4c ("platform/x86: thinkpad_acpi: use lockdep
+annotations") has added lockdep_assert_held() checks to various hotkey
+functions.
+
+These lockdep_assert_held() checks fail causing WARN() backtraces in
+dmesg due to missing locking in hotkey_exit(), fix this.
+
+Fixes: 38831eaf7d4c ("platform/x86: thinkpad_acpi: use lockdep annotations")
+Tested-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Link: https://lore.kernel.org/r/20240424122834.19801-2-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/thinkpad_acpi.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index 82429e59999da..87a4a381bd988 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -3044,10 +3044,9 @@ static void tpacpi_send_radiosw_update(void)
+
+ static void hotkey_exit(void)
+ {
+-#ifdef CONFIG_THINKPAD_ACPI_HOTKEY_POLL
+ mutex_lock(&hotkey_mutex);
++#ifdef CONFIG_THINKPAD_ACPI_HOTKEY_POLL
+ hotkey_poll_stop_sync();
+- mutex_unlock(&hotkey_mutex);
+ #endif
+ dbg_printk(TPACPI_DBG_EXIT | TPACPI_DBG_HKEY,
+ "restoring original HKEY status and mask\n");
+@@ -3057,6 +3056,8 @@ static void hotkey_exit(void)
+ hotkey_mask_set(hotkey_orig_mask)) |
+ hotkey_status_set(false)) != 0)
+ pr_err("failed to restore hot key mask to BIOS defaults\n");
++
++ mutex_unlock(&hotkey_mutex);
+ }
+
+ static void __init hotkey_unmap(const unsigned int scancode)
+--
+2.43.0
+
--- /dev/null
+From 2721d713319eee0f86b0151c8aaf7c29be3d2dd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 May 2024 11:15:45 -0400
+Subject: pNFS/filelayout: fixup pNfs allocation modes
+
+From: Olga Kornievskaia <kolga@netapp.com>
+
+[ Upstream commit 3ebcb24646f8c5bfad2866892d3f3cff05514452 ]
+
+Change left over allocation flags.
+
+Fixes: a245832aaa99 ("pNFS/files: Ensure pNFS allocation modes are consistent with nfsiod")
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/filelayout/filelayout.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
+index ce8f8934bca51..569ae4ec60845 100644
+--- a/fs/nfs/filelayout/filelayout.c
++++ b/fs/nfs/filelayout/filelayout.c
+@@ -883,7 +883,7 @@ filelayout_pg_init_read(struct nfs_pageio_descriptor *pgio,
+ NFS4_MAX_UINT64,
+ IOMODE_READ,
+ false,
+- GFP_KERNEL);
++ nfs_io_gfp_mask());
+ if (IS_ERR(pgio->pg_lseg)) {
+ pgio->pg_error = PTR_ERR(pgio->pg_lseg);
+ pgio->pg_lseg = NULL;
+@@ -907,7 +907,7 @@ filelayout_pg_init_write(struct nfs_pageio_descriptor *pgio,
+ NFS4_MAX_UINT64,
+ IOMODE_RW,
+ false,
+- GFP_NOFS);
++ nfs_io_gfp_mask());
+ if (IS_ERR(pgio->pg_lseg)) {
+ pgio->pg_error = PTR_ERR(pgio->pg_lseg);
+ pgio->pg_lseg = NULL;
+--
+2.43.0
+
--- /dev/null
+From 28548456db4fbaa7a100d51dc4f7646e9e78d770 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Mar 2024 16:36:23 +0100
+Subject: powerpc/bpf/32: Fix failing test_bpf tests
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 8ecf3c1dab1c675721d3d0255556abe2306fa340 ]
+
+Recent additions in BPF like cpu v4 instructions, test_bpf module
+exhibits the following failures:
+
+ test_bpf: #82 ALU_MOVSX | BPF_B jited:1 ret 2 != 1 (0x2 != 0x1)FAIL (1 times)
+ test_bpf: #83 ALU_MOVSX | BPF_H jited:1 ret 2 != 1 (0x2 != 0x1)FAIL (1 times)
+ test_bpf: #84 ALU64_MOVSX | BPF_B jited:1 ret 2 != 1 (0x2 != 0x1)FAIL (1 times)
+ test_bpf: #85 ALU64_MOVSX | BPF_H jited:1 ret 2 != 1 (0x2 != 0x1)FAIL (1 times)
+ test_bpf: #86 ALU64_MOVSX | BPF_W jited:1 ret 2 != 1 (0x2 != 0x1)FAIL (1 times)
+
+ test_bpf: #165 ALU_SDIV_X: -6 / 2 = -3 jited:1 ret 2147483645 != -3 (0x7ffffffd != 0xfffffffd)FAIL (1 times)
+ test_bpf: #166 ALU_SDIV_K: -6 / 2 = -3 jited:1 ret 2147483645 != -3 (0x7ffffffd != 0xfffffffd)FAIL (1 times)
+
+ test_bpf: #169 ALU_SMOD_X: -7 % 2 = -1 jited:1 ret 1 != -1 (0x1 != 0xffffffff)FAIL (1 times)
+ test_bpf: #170 ALU_SMOD_K: -7 % 2 = -1 jited:1 ret 1 != -1 (0x1 != 0xffffffff)FAIL (1 times)
+
+ test_bpf: #172 ALU64_SMOD_K: -7 % 2 = -1 jited:1 ret 1 != -1 (0x1 != 0xffffffff)FAIL (1 times)
+
+ test_bpf: #313 BSWAP 16: 0x0123456789abcdef -> 0xefcd
+ eBPF filter opcode 00d7 (@2) unsupported
+ jited:0 301 PASS
+ test_bpf: #314 BSWAP 32: 0x0123456789abcdef -> 0xefcdab89
+ eBPF filter opcode 00d7 (@2) unsupported
+ jited:0 555 PASS
+ test_bpf: #315 BSWAP 64: 0x0123456789abcdef -> 0x67452301
+ eBPF filter opcode 00d7 (@2) unsupported
+ jited:0 268 PASS
+ test_bpf: #316 BSWAP 64: 0x0123456789abcdef >> 32 -> 0xefcdab89
+ eBPF filter opcode 00d7 (@2) unsupported
+ jited:0 269 PASS
+ test_bpf: #317 BSWAP 16: 0xfedcba9876543210 -> 0x1032
+ eBPF filter opcode 00d7 (@2) unsupported
+ jited:0 460 PASS
+ test_bpf: #318 BSWAP 32: 0xfedcba9876543210 -> 0x10325476
+ eBPF filter opcode 00d7 (@2) unsupported
+ jited:0 320 PASS
+ test_bpf: #319 BSWAP 64: 0xfedcba9876543210 -> 0x98badcfe
+ eBPF filter opcode 00d7 (@2) unsupported
+ jited:0 222 PASS
+ test_bpf: #320 BSWAP 64: 0xfedcba9876543210 >> 32 -> 0x10325476
+ eBPF filter opcode 00d7 (@2) unsupported
+ jited:0 273 PASS
+
+ test_bpf: #344 BPF_LDX_MEMSX | BPF_B
+ eBPF filter opcode 0091 (@5) unsupported
+ jited:0 432 PASS
+ test_bpf: #345 BPF_LDX_MEMSX | BPF_H
+ eBPF filter opcode 0089 (@5) unsupported
+ jited:0 381 PASS
+ test_bpf: #346 BPF_LDX_MEMSX | BPF_W
+ eBPF filter opcode 0081 (@5) unsupported
+ jited:0 505 PASS
+
+ test_bpf: #490 JMP32_JA: Unconditional jump: if (true) return 1
+ eBPF filter opcode 0006 (@1) unsupported
+ jited:0 261 PASS
+
+ test_bpf: Summary: 1040 PASSED, 10 FAILED, [924/1038 JIT'ed]
+
+Fix them by adding missing processing.
+
+Fixes: daabb2b098e0 ("bpf/tests: add tests for cpuv4 instructions")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/91de862dda99d170697eb79ffb478678af7e0b27.1709652689.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/ppc-opcode.h | 4 +
+ arch/powerpc/net/bpf_jit_comp32.c | 137 ++++++++++++++++++++------
+ 2 files changed, 110 insertions(+), 31 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/ppc-opcode.h b/arch/powerpc/include/asm/ppc-opcode.h
+index 005601243dda4..076ae60b4a55d 100644
+--- a/arch/powerpc/include/asm/ppc-opcode.h
++++ b/arch/powerpc/include/asm/ppc-opcode.h
+@@ -510,6 +510,7 @@
+ #define PPC_RAW_STB(r, base, i) (0x98000000 | ___PPC_RS(r) | ___PPC_RA(base) | IMM_L(i))
+ #define PPC_RAW_LBZ(r, base, i) (0x88000000 | ___PPC_RT(r) | ___PPC_RA(base) | IMM_L(i))
+ #define PPC_RAW_LDX(r, base, b) (0x7c00002a | ___PPC_RT(r) | ___PPC_RA(base) | ___PPC_RB(b))
++#define PPC_RAW_LHA(r, base, i) (0xa8000000 | ___PPC_RT(r) | ___PPC_RA(base) | IMM_L(i))
+ #define PPC_RAW_LHZ(r, base, i) (0xa0000000 | ___PPC_RT(r) | ___PPC_RA(base) | IMM_L(i))
+ #define PPC_RAW_LHBRX(r, base, b) (0x7c00062c | ___PPC_RT(r) | ___PPC_RA(base) | ___PPC_RB(b))
+ #define PPC_RAW_LWBRX(r, base, b) (0x7c00042c | ___PPC_RT(r) | ___PPC_RA(base) | ___PPC_RB(b))
+@@ -532,6 +533,7 @@
+ #define PPC_RAW_MULW(d, a, b) (0x7c0001d6 | ___PPC_RT(d) | ___PPC_RA(a) | ___PPC_RB(b))
+ #define PPC_RAW_MULHWU(d, a, b) (0x7c000016 | ___PPC_RT(d) | ___PPC_RA(a) | ___PPC_RB(b))
+ #define PPC_RAW_MULI(d, a, i) (0x1c000000 | ___PPC_RT(d) | ___PPC_RA(a) | IMM_L(i))
++#define PPC_RAW_DIVW(d, a, b) (0x7c0003d6 | ___PPC_RT(d) | ___PPC_RA(a) | ___PPC_RB(b))
+ #define PPC_RAW_DIVWU(d, a, b) (0x7c000396 | ___PPC_RT(d) | ___PPC_RA(a) | ___PPC_RB(b))
+ #define PPC_RAW_DIVDU(d, a, b) (0x7c000392 | ___PPC_RT(d) | ___PPC_RA(a) | ___PPC_RB(b))
+ #define PPC_RAW_DIVDE(t, a, b) (0x7c000352 | ___PPC_RT(t) | ___PPC_RA(a) | ___PPC_RB(b))
+@@ -550,6 +552,8 @@
+ #define PPC_RAW_XOR(d, a, b) (0x7c000278 | ___PPC_RA(d) | ___PPC_RS(a) | ___PPC_RB(b))
+ #define PPC_RAW_XORI(d, a, i) (0x68000000 | ___PPC_RA(d) | ___PPC_RS(a) | IMM_L(i))
+ #define PPC_RAW_XORIS(d, a, i) (0x6c000000 | ___PPC_RA(d) | ___PPC_RS(a) | IMM_L(i))
++#define PPC_RAW_EXTSB(d, a) (0x7c000774 | ___PPC_RA(d) | ___PPC_RS(a))
++#define PPC_RAW_EXTSH(d, a) (0x7c000734 | ___PPC_RA(d) | ___PPC_RS(a))
+ #define PPC_RAW_EXTSW(d, a) (0x7c0007b4 | ___PPC_RA(d) | ___PPC_RS(a))
+ #define PPC_RAW_SLW(d, a, s) (0x7c000030 | ___PPC_RA(d) | ___PPC_RS(a) | ___PPC_RB(s))
+ #define PPC_RAW_SLD(d, a, s) (0x7c000036 | ___PPC_RA(d) | ___PPC_RS(a) | ___PPC_RB(s))
+diff --git a/arch/powerpc/net/bpf_jit_comp32.c b/arch/powerpc/net/bpf_jit_comp32.c
+index 2f39c50ca729e..43b97032a91c0 100644
+--- a/arch/powerpc/net/bpf_jit_comp32.c
++++ b/arch/powerpc/net/bpf_jit_comp32.c
+@@ -450,10 +450,16 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code
+ }
+ break;
+ case BPF_ALU | BPF_DIV | BPF_X: /* (u32) dst /= (u32) src */
+- EMIT(PPC_RAW_DIVWU(dst_reg, src2_reg, src_reg));
++ if (off)
++ EMIT(PPC_RAW_DIVW(dst_reg, src2_reg, src_reg));
++ else
++ EMIT(PPC_RAW_DIVWU(dst_reg, src2_reg, src_reg));
+ break;
+ case BPF_ALU | BPF_MOD | BPF_X: /* (u32) dst %= (u32) src */
+- EMIT(PPC_RAW_DIVWU(_R0, src2_reg, src_reg));
++ if (off)
++ EMIT(PPC_RAW_DIVW(_R0, src2_reg, src_reg));
++ else
++ EMIT(PPC_RAW_DIVWU(_R0, src2_reg, src_reg));
+ EMIT(PPC_RAW_MULW(_R0, src_reg, _R0));
+ EMIT(PPC_RAW_SUB(dst_reg, src2_reg, _R0));
+ break;
+@@ -467,10 +473,16 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code
+ if (imm == 1) {
+ EMIT(PPC_RAW_MR(dst_reg, src2_reg));
+ } else if (is_power_of_2((u32)imm)) {
+- EMIT(PPC_RAW_SRWI(dst_reg, src2_reg, ilog2(imm)));
++ if (off)
++ EMIT(PPC_RAW_SRAWI(dst_reg, src2_reg, ilog2(imm)));
++ else
++ EMIT(PPC_RAW_SRWI(dst_reg, src2_reg, ilog2(imm)));
+ } else {
+ PPC_LI32(_R0, imm);
+- EMIT(PPC_RAW_DIVWU(dst_reg, src2_reg, _R0));
++ if (off)
++ EMIT(PPC_RAW_DIVW(dst_reg, src2_reg, _R0));
++ else
++ EMIT(PPC_RAW_DIVWU(dst_reg, src2_reg, _R0));
+ }
+ break;
+ case BPF_ALU | BPF_MOD | BPF_K: /* (u32) dst %= (u32) imm */
+@@ -480,11 +492,19 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code
+ if (!is_power_of_2((u32)imm)) {
+ bpf_set_seen_register(ctx, tmp_reg);
+ PPC_LI32(tmp_reg, imm);
+- EMIT(PPC_RAW_DIVWU(_R0, src2_reg, tmp_reg));
++ if (off)
++ EMIT(PPC_RAW_DIVW(_R0, src2_reg, tmp_reg));
++ else
++ EMIT(PPC_RAW_DIVWU(_R0, src2_reg, tmp_reg));
+ EMIT(PPC_RAW_MULW(_R0, tmp_reg, _R0));
+ EMIT(PPC_RAW_SUB(dst_reg, src2_reg, _R0));
+ } else if (imm == 1) {
+ EMIT(PPC_RAW_LI(dst_reg, 0));
++ } else if (off) {
++ EMIT(PPC_RAW_SRAWI(_R0, src2_reg, ilog2(imm)));
++ EMIT(PPC_RAW_ADDZE(_R0, _R0));
++ EMIT(PPC_RAW_SLWI(_R0, _R0, ilog2(imm)));
++ EMIT(PPC_RAW_SUB(dst_reg, src2_reg, _R0));
+ } else {
+ imm = ilog2((u32)imm);
+ EMIT(PPC_RAW_RLWINM(dst_reg, src2_reg, 0, 32 - imm, 31));
+@@ -497,11 +517,21 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code
+ imm = -imm;
+ if (!is_power_of_2(imm))
+ return -EOPNOTSUPP;
+- if (imm == 1)
++ if (imm == 1) {
+ EMIT(PPC_RAW_LI(dst_reg, 0));
+- else
++ EMIT(PPC_RAW_LI(dst_reg_h, 0));
++ } else if (off) {
++ EMIT(PPC_RAW_SRAWI(dst_reg_h, src2_reg_h, 31));
++ EMIT(PPC_RAW_XOR(dst_reg, src2_reg, dst_reg_h));
++ EMIT(PPC_RAW_SUBFC(dst_reg, dst_reg_h, dst_reg));
++ EMIT(PPC_RAW_RLWINM(dst_reg, dst_reg, 0, 32 - ilog2(imm), 31));
++ EMIT(PPC_RAW_XOR(dst_reg, dst_reg, dst_reg_h));
++ EMIT(PPC_RAW_SUBFC(dst_reg, dst_reg_h, dst_reg));
++ EMIT(PPC_RAW_SUBFE(dst_reg_h, dst_reg_h, dst_reg_h));
++ } else {
+ EMIT(PPC_RAW_RLWINM(dst_reg, src2_reg, 0, 32 - ilog2(imm), 31));
+- EMIT(PPC_RAW_LI(dst_reg_h, 0));
++ EMIT(PPC_RAW_LI(dst_reg_h, 0));
++ }
+ break;
+ case BPF_ALU64 | BPF_DIV | BPF_K: /* dst /= imm */
+ if (!imm)
+@@ -727,15 +757,30 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code
+ * MOV
+ */
+ case BPF_ALU64 | BPF_MOV | BPF_X: /* dst = src */
+- if (dst_reg == src_reg)
+- break;
+- EMIT(PPC_RAW_MR(dst_reg, src_reg));
+- EMIT(PPC_RAW_MR(dst_reg_h, src_reg_h));
++ if (off == 8) {
++ EMIT(PPC_RAW_EXTSB(dst_reg, src_reg));
++ EMIT(PPC_RAW_SRAWI(dst_reg_h, dst_reg, 31));
++ } else if (off == 16) {
++ EMIT(PPC_RAW_EXTSH(dst_reg, src_reg));
++ EMIT(PPC_RAW_SRAWI(dst_reg_h, dst_reg, 31));
++ } else if (off == 32 && dst_reg == src_reg) {
++ EMIT(PPC_RAW_SRAWI(dst_reg_h, src_reg, 31));
++ } else if (off == 32) {
++ EMIT(PPC_RAW_MR(dst_reg, src_reg));
++ EMIT(PPC_RAW_SRAWI(dst_reg_h, src_reg, 31));
++ } else if (dst_reg != src_reg) {
++ EMIT(PPC_RAW_MR(dst_reg, src_reg));
++ EMIT(PPC_RAW_MR(dst_reg_h, src_reg_h));
++ }
+ break;
+ case BPF_ALU | BPF_MOV | BPF_X: /* (u32) dst = src */
+ /* special mov32 for zext */
+ if (imm == 1)
+ EMIT(PPC_RAW_LI(dst_reg_h, 0));
++ else if (off == 8)
++ EMIT(PPC_RAW_EXTSB(dst_reg, src_reg));
++ else if (off == 16)
++ EMIT(PPC_RAW_EXTSH(dst_reg, src_reg));
+ else if (dst_reg != src_reg)
+ EMIT(PPC_RAW_MR(dst_reg, src_reg));
+ break;
+@@ -751,6 +796,7 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code
+ * BPF_FROM_BE/LE
+ */
+ case BPF_ALU | BPF_END | BPF_FROM_LE:
++ case BPF_ALU64 | BPF_END | BPF_FROM_LE:
+ switch (imm) {
+ case 16:
+ /* Copy 16 bits to upper part */
+@@ -785,6 +831,8 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code
+ EMIT(PPC_RAW_MR(dst_reg_h, tmp_reg));
+ break;
+ }
++ if (BPF_CLASS(code) == BPF_ALU64 && imm != 64)
++ EMIT(PPC_RAW_LI(dst_reg_h, 0));
+ break;
+ case BPF_ALU | BPF_END | BPF_FROM_BE:
+ switch (imm) {
+@@ -918,11 +966,17 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code
+ * BPF_LDX
+ */
+ case BPF_LDX | BPF_MEM | BPF_B: /* dst = *(u8 *)(ul) (src + off) */
++ case BPF_LDX | BPF_MEMSX | BPF_B:
+ case BPF_LDX | BPF_PROBE_MEM | BPF_B:
++ case BPF_LDX | BPF_PROBE_MEMSX | BPF_B:
+ case BPF_LDX | BPF_MEM | BPF_H: /* dst = *(u16 *)(ul) (src + off) */
++ case BPF_LDX | BPF_MEMSX | BPF_H:
+ case BPF_LDX | BPF_PROBE_MEM | BPF_H:
++ case BPF_LDX | BPF_PROBE_MEMSX | BPF_H:
+ case BPF_LDX | BPF_MEM | BPF_W: /* dst = *(u32 *)(ul) (src + off) */
++ case BPF_LDX | BPF_MEMSX | BPF_W:
+ case BPF_LDX | BPF_PROBE_MEM | BPF_W:
++ case BPF_LDX | BPF_PROBE_MEMSX | BPF_W:
+ case BPF_LDX | BPF_MEM | BPF_DW: /* dst = *(u64 *)(ul) (src + off) */
+ case BPF_LDX | BPF_PROBE_MEM | BPF_DW:
+ /*
+@@ -931,7 +985,7 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code
+ * load only if addr is kernel address (see is_kernel_addr()), otherwise
+ * set dst_reg=0 and move on.
+ */
+- if (BPF_MODE(code) == BPF_PROBE_MEM) {
++ if (BPF_MODE(code) == BPF_PROBE_MEM || BPF_MODE(code) == BPF_PROBE_MEMSX) {
+ PPC_LI32(_R0, TASK_SIZE - off);
+ EMIT(PPC_RAW_CMPLW(src_reg, _R0));
+ PPC_BCC_SHORT(COND_GT, (ctx->idx + 4) * 4);
+@@ -953,30 +1007,48 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code
+ * as there are two load instructions for dst_reg_h & dst_reg
+ * respectively.
+ */
+- if (size == BPF_DW)
++ if (size == BPF_DW ||
++ (size == BPF_B && BPF_MODE(code) == BPF_PROBE_MEMSX))
+ PPC_JMP((ctx->idx + 3) * 4);
+ else
+ PPC_JMP((ctx->idx + 2) * 4);
+ }
+
+- switch (size) {
+- case BPF_B:
+- EMIT(PPC_RAW_LBZ(dst_reg, src_reg, off));
+- break;
+- case BPF_H:
+- EMIT(PPC_RAW_LHZ(dst_reg, src_reg, off));
+- break;
+- case BPF_W:
+- EMIT(PPC_RAW_LWZ(dst_reg, src_reg, off));
+- break;
+- case BPF_DW:
+- EMIT(PPC_RAW_LWZ(dst_reg_h, src_reg, off));
+- EMIT(PPC_RAW_LWZ(dst_reg, src_reg, off + 4));
+- break;
+- }
++ if (BPF_MODE(code) == BPF_MEMSX || BPF_MODE(code) == BPF_PROBE_MEMSX) {
++ switch (size) {
++ case BPF_B:
++ EMIT(PPC_RAW_LBZ(dst_reg, src_reg, off));
++ EMIT(PPC_RAW_EXTSB(dst_reg, dst_reg));
++ break;
++ case BPF_H:
++ EMIT(PPC_RAW_LHA(dst_reg, src_reg, off));
++ break;
++ case BPF_W:
++ EMIT(PPC_RAW_LWZ(dst_reg, src_reg, off));
++ break;
++ }
++ if (!fp->aux->verifier_zext)
++ EMIT(PPC_RAW_SRAWI(dst_reg_h, dst_reg, 31));
+
+- if (size != BPF_DW && !fp->aux->verifier_zext)
+- EMIT(PPC_RAW_LI(dst_reg_h, 0));
++ } else {
++ switch (size) {
++ case BPF_B:
++ EMIT(PPC_RAW_LBZ(dst_reg, src_reg, off));
++ break;
++ case BPF_H:
++ EMIT(PPC_RAW_LHZ(dst_reg, src_reg, off));
++ break;
++ case BPF_W:
++ EMIT(PPC_RAW_LWZ(dst_reg, src_reg, off));
++ break;
++ case BPF_DW:
++ EMIT(PPC_RAW_LWZ(dst_reg_h, src_reg, off));
++ EMIT(PPC_RAW_LWZ(dst_reg, src_reg, off + 4));
++ break;
++ }
++ if (size != BPF_DW && !fp->aux->verifier_zext)
++ EMIT(PPC_RAW_LI(dst_reg_h, 0));
++ }
+
+ if (BPF_MODE(code) == BPF_PROBE_MEM) {
+ int insn_idx = ctx->idx - 1;
+@@ -1068,6 +1140,9 @@ int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, u32 *fimage, struct code
+ case BPF_JMP | BPF_JA:
+ PPC_JMP(addrs[i + 1 + off]);
+ break;
++ case BPF_JMP32 | BPF_JA:
++ PPC_JMP(addrs[i + 1 + imm]);
++ break;
+
+ case BPF_JMP | BPF_JGT | BPF_K:
+ case BPF_JMP | BPF_JGT | BPF_X:
+--
+2.43.0
+
--- /dev/null
+From 46c1de2f6bdefceed8268f6db9920239341ec56e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Apr 2024 14:50:47 +0530
+Subject: powerpc/pseries: Add failure related checks for h_get_mpp and
+ h_get_ppp
+
+From: Shrikanth Hegde <sshegde@linux.ibm.com>
+
+[ Upstream commit 6d4341638516bf97b9a34947e0bd95035a8230a5 ]
+
+Couple of Minor fixes:
+
+- hcall return values are long. Fix that for h_get_mpp, h_get_ppp and
+parse_ppp_data
+
+- If hcall fails, values set should be at-least zero. It shouldn't be
+uninitialized values. Fix that for h_get_mpp and h_get_ppp
+
+Signed-off-by: Shrikanth Hegde <sshegde@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20240412092047.455483-3-sshegde@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/hvcall.h | 2 +-
+ arch/powerpc/platforms/pseries/lpar.c | 6 +++---
+ arch/powerpc/platforms/pseries/lparcfg.c | 6 +++---
+ 3 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h
+index a41e542ba94dd..51172625fa3a5 100644
+--- a/arch/powerpc/include/asm/hvcall.h
++++ b/arch/powerpc/include/asm/hvcall.h
+@@ -570,7 +570,7 @@ struct hvcall_mpp_data {
+ unsigned long backing_mem;
+ };
+
+-int h_get_mpp(struct hvcall_mpp_data *);
++long h_get_mpp(struct hvcall_mpp_data *mpp_data);
+
+ struct hvcall_mpp_x_data {
+ unsigned long coalesced_bytes;
+diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
+index 4e9916bb03d71..c1d8bee8f7018 100644
+--- a/arch/powerpc/platforms/pseries/lpar.c
++++ b/arch/powerpc/platforms/pseries/lpar.c
+@@ -1886,10 +1886,10 @@ notrace void __trace_hcall_exit(long opcode, long retval, unsigned long *retbuf)
+ * h_get_mpp
+ * H_GET_MPP hcall returns info in 7 parms
+ */
+-int h_get_mpp(struct hvcall_mpp_data *mpp_data)
++long h_get_mpp(struct hvcall_mpp_data *mpp_data)
+ {
+- int rc;
+- unsigned long retbuf[PLPAR_HCALL9_BUFSIZE];
++ unsigned long retbuf[PLPAR_HCALL9_BUFSIZE] = {0};
++ long rc;
+
+ rc = plpar_hcall9(H_GET_MPP, retbuf);
+
+diff --git a/arch/powerpc/platforms/pseries/lparcfg.c b/arch/powerpc/platforms/pseries/lparcfg.c
+index f73c4d1c26af9..fb0189af2dea1 100644
+--- a/arch/powerpc/platforms/pseries/lparcfg.c
++++ b/arch/powerpc/platforms/pseries/lparcfg.c
+@@ -113,8 +113,8 @@ struct hvcall_ppp_data {
+ */
+ static unsigned int h_get_ppp(struct hvcall_ppp_data *ppp_data)
+ {
+- unsigned long rc;
+- unsigned long retbuf[PLPAR_HCALL9_BUFSIZE];
++ unsigned long retbuf[PLPAR_HCALL9_BUFSIZE] = {0};
++ long rc;
+
+ rc = plpar_hcall9(H_GET_PPP, retbuf);
+
+@@ -193,7 +193,7 @@ static void parse_ppp_data(struct seq_file *m)
+ struct hvcall_ppp_data ppp_data;
+ struct device_node *root;
+ const __be32 *perf_level;
+- int rc;
++ long rc;
+
+ rc = h_get_ppp(&ppp_data);
+ if (rc)
+--
+2.43.0
+
--- /dev/null
+From 082294625325fa6eaccb4b56f8f7eb2b1013f21f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 May 2024 10:03:41 +0200
+Subject: printk: Fix LOG_CPU_MAX_BUF_SHIFT when BASE_SMALL is enabled
+
+From: Yoann Congal <yoann.congal@smile.fr>
+
+[ Upstream commit 320bf43190514be5c00e11f47ec2160dd3993844 ]
+
+LOG_CPU_MAX_BUF_SHIFT default value depends on BASE_SMALL:
+ config LOG_CPU_MAX_BUF_SHIFT
+ default 12 if !BASE_SMALL
+ default 0 if BASE_SMALL
+But, BASE_SMALL is a config of type int and "!BASE_SMALL" is always
+evaluated to true whatever is the value of BASE_SMALL.
+
+This patch fixes this by using the correct conditional operator for int
+type : BASE_SMALL != 0.
+
+Note: This changes CONFIG_LOG_CPU_MAX_BUF_SHIFT=12 to
+CONFIG_LOG_CPU_MAX_BUF_SHIFT=0 for BASE_SMALL defconfigs, but that will
+not be a big impact due to this code in kernel/printk/printk.c:
+ /* by default this will only continue through for large > 64 CPUs */
+ if (cpu_extra <= __LOG_BUF_LEN / 2)
+ return;
+Systems using CONFIG_BASE_SMALL and having 64+ CPUs should be quite
+rare.
+
+John Ogness <john.ogness@linutronix.de> (printk reviewer) wrote:
+> For printk this will mean that BASE_SMALL systems were probably
+> previously allocating/using the dynamic ringbuffer and now they will
+> just continue to use the static ringbuffer. Which is fine and saves
+> memory (as it should).
+
+Petr Mladek <pmladek@suse.com> (printk maintainer) wrote:
+> More precisely, it allocated the buffer dynamically when the sum
+> of per-CPU-extra space exceeded half of the default static ring
+> buffer. This happened for systems with more than 64 CPUs with
+> the default config values.
+
+Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Closes: https://lore.kernel.org/all/CAMuHMdWm6u1wX7efZQf=2XUAHascps76YQac6rdnQGhc8nop_Q@mail.gmail.com/
+Reported-by: Vegard Nossum <vegard.nossum@oracle.com>
+Closes: https://lore.kernel.org/all/f6856be8-54b7-0fa0-1d17-39632bf29ada@oracle.com/
+Fixes: 4e244c10eab3 ("kconfig: remove unneeded symbol_empty variable")
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Reviewed-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
+Link: https://lore.kernel.org/r/20240505080343.1471198-2-yoann.congal@smile.fr
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ init/Kconfig | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/init/Kconfig b/init/Kconfig
+index 664bedb9a71fb..459f44ef7cc94 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -743,8 +743,8 @@ config LOG_CPU_MAX_BUF_SHIFT
+ int "CPU kernel log buffer size contribution (13 => 8 KB, 17 => 128KB)"
+ depends on SMP
+ range 0 21
+- default 12 if !BASE_SMALL
+- default 0 if BASE_SMALL
++ default 0 if BASE_SMALL != 0
++ default 12
+ depends on PRINTK
+ help
+ This option allows to increase the default ring buffer size
+--
+2.43.0
+
--- /dev/null
+From 4361c28ee4cb8e6dfe5d2a4566e0688712d948d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 May 2024 11:54:41 +0300
+Subject: regulator: bd71828: Don't overwrite runtime voltages
+
+From: Matti Vaittinen <mazziesaccount@gmail.com>
+
+[ Upstream commit 0f9f7c63c415e287cd57b5c98be61eb320dedcfc ]
+
+Some of the regulators on the BD71828 have common voltage setting for
+RUN/SUSPEND/IDLE/LPSR states. The enable control can be set for each
+state though.
+
+The driver allows setting the voltage values for these states via
+device-tree. As a side effect, setting the voltages for
+SUSPEND/IDLE/LPSR will also change the RUN level voltage which is not
+desired and can break the system.
+
+The comment in code reflects this behaviour, but it is likely to not
+make people any happier. The right thing to do is to allow setting the
+enable/disable state at SUSPEND/IDLE/LPSR via device-tree, but to
+disallow setting state specific voltages for those regulators.
+
+BUCK1 is a bit different. It only shares the SUSPEND and LPSR state
+voltages. The former behaviour of allowing to silently overwrite the
+SUSPEND state voltage by LPSR state voltage is also changed here so that
+the SUSPEND voltage is prioritized over LPSR voltage.
+
+Prevent setting PMIC state specific voltages for regulators which do not
+support it.
+
+Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com>
+Fixes: 522498f8cb8c ("regulator: bd71828: Basic support for ROHM bd71828 PMIC regulators")
+Link: https://msgid.link/r/e1883ae1e3ae5668f1030455d4750923561f3d68.1715848512.git.mazziesaccount@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/bd71828-regulator.c | 58 +--------------------------
+ 1 file changed, 2 insertions(+), 56 deletions(-)
+
+diff --git a/drivers/regulator/bd71828-regulator.c b/drivers/regulator/bd71828-regulator.c
+index 08d4ee369287e..dd871ffe979c3 100644
+--- a/drivers/regulator/bd71828-regulator.c
++++ b/drivers/regulator/bd71828-regulator.c
+@@ -206,14 +206,11 @@ static const struct bd71828_regulator_data bd71828_rdata[] = {
+ .suspend_reg = BD71828_REG_BUCK1_SUSP_VOLT,
+ .suspend_mask = BD71828_MASK_BUCK1267_VOLT,
+ .suspend_on_mask = BD71828_MASK_SUSP_EN,
+- .lpsr_on_mask = BD71828_MASK_LPSR_EN,
+ /*
+ * LPSR voltage is same as SUSPEND voltage. Allow
+- * setting it so that regulator can be set enabled at
+- * LPSR state
++ * only enabling/disabling regulator for LPSR state
+ */
+- .lpsr_reg = BD71828_REG_BUCK1_SUSP_VOLT,
+- .lpsr_mask = BD71828_MASK_BUCK1267_VOLT,
++ .lpsr_on_mask = BD71828_MASK_LPSR_EN,
+ },
+ .reg_inits = buck1_inits,
+ .reg_init_amnt = ARRAY_SIZE(buck1_inits),
+@@ -288,13 +285,7 @@ static const struct bd71828_regulator_data bd71828_rdata[] = {
+ ROHM_DVS_LEVEL_SUSPEND |
+ ROHM_DVS_LEVEL_LPSR,
+ .run_reg = BD71828_REG_BUCK3_VOLT,
+- .idle_reg = BD71828_REG_BUCK3_VOLT,
+- .suspend_reg = BD71828_REG_BUCK3_VOLT,
+- .lpsr_reg = BD71828_REG_BUCK3_VOLT,
+ .run_mask = BD71828_MASK_BUCK3_VOLT,
+- .idle_mask = BD71828_MASK_BUCK3_VOLT,
+- .suspend_mask = BD71828_MASK_BUCK3_VOLT,
+- .lpsr_mask = BD71828_MASK_BUCK3_VOLT,
+ .idle_on_mask = BD71828_MASK_IDLE_EN,
+ .suspend_on_mask = BD71828_MASK_SUSP_EN,
+ .lpsr_on_mask = BD71828_MASK_LPSR_EN,
+@@ -329,13 +320,7 @@ static const struct bd71828_regulator_data bd71828_rdata[] = {
+ ROHM_DVS_LEVEL_SUSPEND |
+ ROHM_DVS_LEVEL_LPSR,
+ .run_reg = BD71828_REG_BUCK4_VOLT,
+- .idle_reg = BD71828_REG_BUCK4_VOLT,
+- .suspend_reg = BD71828_REG_BUCK4_VOLT,
+- .lpsr_reg = BD71828_REG_BUCK4_VOLT,
+ .run_mask = BD71828_MASK_BUCK4_VOLT,
+- .idle_mask = BD71828_MASK_BUCK4_VOLT,
+- .suspend_mask = BD71828_MASK_BUCK4_VOLT,
+- .lpsr_mask = BD71828_MASK_BUCK4_VOLT,
+ .idle_on_mask = BD71828_MASK_IDLE_EN,
+ .suspend_on_mask = BD71828_MASK_SUSP_EN,
+ .lpsr_on_mask = BD71828_MASK_LPSR_EN,
+@@ -370,13 +355,7 @@ static const struct bd71828_regulator_data bd71828_rdata[] = {
+ ROHM_DVS_LEVEL_SUSPEND |
+ ROHM_DVS_LEVEL_LPSR,
+ .run_reg = BD71828_REG_BUCK5_VOLT,
+- .idle_reg = BD71828_REG_BUCK5_VOLT,
+- .suspend_reg = BD71828_REG_BUCK5_VOLT,
+- .lpsr_reg = BD71828_REG_BUCK5_VOLT,
+ .run_mask = BD71828_MASK_BUCK5_VOLT,
+- .idle_mask = BD71828_MASK_BUCK5_VOLT,
+- .suspend_mask = BD71828_MASK_BUCK5_VOLT,
+- .lpsr_mask = BD71828_MASK_BUCK5_VOLT,
+ .idle_on_mask = BD71828_MASK_IDLE_EN,
+ .suspend_on_mask = BD71828_MASK_SUSP_EN,
+ .lpsr_on_mask = BD71828_MASK_LPSR_EN,
+@@ -493,13 +472,7 @@ static const struct bd71828_regulator_data bd71828_rdata[] = {
+ ROHM_DVS_LEVEL_SUSPEND |
+ ROHM_DVS_LEVEL_LPSR,
+ .run_reg = BD71828_REG_LDO1_VOLT,
+- .idle_reg = BD71828_REG_LDO1_VOLT,
+- .suspend_reg = BD71828_REG_LDO1_VOLT,
+- .lpsr_reg = BD71828_REG_LDO1_VOLT,
+ .run_mask = BD71828_MASK_LDO_VOLT,
+- .idle_mask = BD71828_MASK_LDO_VOLT,
+- .suspend_mask = BD71828_MASK_LDO_VOLT,
+- .lpsr_mask = BD71828_MASK_LDO_VOLT,
+ .idle_on_mask = BD71828_MASK_IDLE_EN,
+ .suspend_on_mask = BD71828_MASK_SUSP_EN,
+ .lpsr_on_mask = BD71828_MASK_LPSR_EN,
+@@ -533,13 +506,7 @@ static const struct bd71828_regulator_data bd71828_rdata[] = {
+ ROHM_DVS_LEVEL_SUSPEND |
+ ROHM_DVS_LEVEL_LPSR,
+ .run_reg = BD71828_REG_LDO2_VOLT,
+- .idle_reg = BD71828_REG_LDO2_VOLT,
+- .suspend_reg = BD71828_REG_LDO2_VOLT,
+- .lpsr_reg = BD71828_REG_LDO2_VOLT,
+ .run_mask = BD71828_MASK_LDO_VOLT,
+- .idle_mask = BD71828_MASK_LDO_VOLT,
+- .suspend_mask = BD71828_MASK_LDO_VOLT,
+- .lpsr_mask = BD71828_MASK_LDO_VOLT,
+ .idle_on_mask = BD71828_MASK_IDLE_EN,
+ .suspend_on_mask = BD71828_MASK_SUSP_EN,
+ .lpsr_on_mask = BD71828_MASK_LPSR_EN,
+@@ -573,13 +540,7 @@ static const struct bd71828_regulator_data bd71828_rdata[] = {
+ ROHM_DVS_LEVEL_SUSPEND |
+ ROHM_DVS_LEVEL_LPSR,
+ .run_reg = BD71828_REG_LDO3_VOLT,
+- .idle_reg = BD71828_REG_LDO3_VOLT,
+- .suspend_reg = BD71828_REG_LDO3_VOLT,
+- .lpsr_reg = BD71828_REG_LDO3_VOLT,
+ .run_mask = BD71828_MASK_LDO_VOLT,
+- .idle_mask = BD71828_MASK_LDO_VOLT,
+- .suspend_mask = BD71828_MASK_LDO_VOLT,
+- .lpsr_mask = BD71828_MASK_LDO_VOLT,
+ .idle_on_mask = BD71828_MASK_IDLE_EN,
+ .suspend_on_mask = BD71828_MASK_SUSP_EN,
+ .lpsr_on_mask = BD71828_MASK_LPSR_EN,
+@@ -614,13 +575,7 @@ static const struct bd71828_regulator_data bd71828_rdata[] = {
+ ROHM_DVS_LEVEL_SUSPEND |
+ ROHM_DVS_LEVEL_LPSR,
+ .run_reg = BD71828_REG_LDO4_VOLT,
+- .idle_reg = BD71828_REG_LDO4_VOLT,
+- .suspend_reg = BD71828_REG_LDO4_VOLT,
+- .lpsr_reg = BD71828_REG_LDO4_VOLT,
+ .run_mask = BD71828_MASK_LDO_VOLT,
+- .idle_mask = BD71828_MASK_LDO_VOLT,
+- .suspend_mask = BD71828_MASK_LDO_VOLT,
+- .lpsr_mask = BD71828_MASK_LDO_VOLT,
+ .idle_on_mask = BD71828_MASK_IDLE_EN,
+ .suspend_on_mask = BD71828_MASK_SUSP_EN,
+ .lpsr_on_mask = BD71828_MASK_LPSR_EN,
+@@ -655,13 +610,7 @@ static const struct bd71828_regulator_data bd71828_rdata[] = {
+ ROHM_DVS_LEVEL_SUSPEND |
+ ROHM_DVS_LEVEL_LPSR,
+ .run_reg = BD71828_REG_LDO5_VOLT,
+- .idle_reg = BD71828_REG_LDO5_VOLT,
+- .suspend_reg = BD71828_REG_LDO5_VOLT,
+- .lpsr_reg = BD71828_REG_LDO5_VOLT,
+ .run_mask = BD71828_MASK_LDO_VOLT,
+- .idle_mask = BD71828_MASK_LDO_VOLT,
+- .suspend_mask = BD71828_MASK_LDO_VOLT,
+- .lpsr_mask = BD71828_MASK_LDO_VOLT,
+ .idle_on_mask = BD71828_MASK_IDLE_EN,
+ .suspend_on_mask = BD71828_MASK_SUSP_EN,
+ .lpsr_on_mask = BD71828_MASK_LPSR_EN,
+@@ -720,9 +669,6 @@ static const struct bd71828_regulator_data bd71828_rdata[] = {
+ .suspend_reg = BD71828_REG_LDO7_VOLT,
+ .lpsr_reg = BD71828_REG_LDO7_VOLT,
+ .run_mask = BD71828_MASK_LDO_VOLT,
+- .idle_mask = BD71828_MASK_LDO_VOLT,
+- .suspend_mask = BD71828_MASK_LDO_VOLT,
+- .lpsr_mask = BD71828_MASK_LDO_VOLT,
+ .idle_on_mask = BD71828_MASK_IDLE_EN,
+ .suspend_on_mask = BD71828_MASK_SUSP_EN,
+ .lpsr_on_mask = BD71828_MASK_LPSR_EN,
+--
+2.43.0
+
--- /dev/null
+From ea9cea061dee215d0640f6491dd24e175b9e4f03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 May 2024 15:31:33 +0300
+Subject: regulator: pickable ranges: don't always cache vsel
+
+From: Matti Vaittinen <mazziesaccount@gmail.com>
+
+[ Upstream commit f4f4276f985a5aac7b310a4ed040b47e275e7591 ]
+
+Some PMICs treat the vsel_reg same as apply-bit. Eg, when voltage range
+is changed, the new voltage setting is not taking effect until the vsel
+register is written.
+
+Add a flag 'range_applied_by_vsel' to the regulator desc to indicate this
+behaviour and to force the vsel value to be written to hardware if range
+was changed, even if the old selector was same as the new one.
+
+Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com>
+Link: https://msgid.link/r/ZktCpcGZdgHWuN_L@fedora
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 1ace99d7c7c4 ("regulator: tps6287x: Force writing VSEL bit")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/helpers.c | 43 ++++++++++++++++++++++----------
+ include/linux/regulator/driver.h | 3 +++
+ 2 files changed, 33 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/regulator/helpers.c b/drivers/regulator/helpers.c
+index d492683365532..6e1ace660b8cf 100644
+--- a/drivers/regulator/helpers.c
++++ b/drivers/regulator/helpers.c
+@@ -161,6 +161,32 @@ int regulator_get_voltage_sel_pickable_regmap(struct regulator_dev *rdev)
+ }
+ EXPORT_SYMBOL_GPL(regulator_get_voltage_sel_pickable_regmap);
+
++static int write_separate_vsel_and_range(struct regulator_dev *rdev,
++ unsigned int sel, unsigned int range)
++{
++ bool range_updated;
++ int ret;
++
++ ret = regmap_update_bits_base(rdev->regmap, rdev->desc->vsel_range_reg,
++ rdev->desc->vsel_range_mask,
++ range, &range_updated, false, false);
++ if (ret)
++ return ret;
++
++ /*
++ * Some PMICs treat the vsel_reg same as apply-bit. Force it to be
++ * written if the range changed, even if the old selector was same as
++ * the new one
++ */
++ if (rdev->desc->range_applied_by_vsel && range_updated)
++ return regmap_write_bits(rdev->regmap,
++ rdev->desc->vsel_reg,
++ rdev->desc->vsel_mask, sel);
++
++ return regmap_update_bits(rdev->regmap, rdev->desc->vsel_reg,
++ rdev->desc->vsel_mask, sel);
++}
++
+ /**
+ * regulator_set_voltage_sel_pickable_regmap - pickable range set_voltage_sel
+ *
+@@ -199,21 +225,12 @@ int regulator_set_voltage_sel_pickable_regmap(struct regulator_dev *rdev,
+ range = rdev->desc->linear_range_selectors_bitfield[i];
+ range <<= ffs(rdev->desc->vsel_range_mask) - 1;
+
+- if (rdev->desc->vsel_reg == rdev->desc->vsel_range_reg) {
+- ret = regmap_update_bits(rdev->regmap,
+- rdev->desc->vsel_reg,
++ if (rdev->desc->vsel_reg == rdev->desc->vsel_range_reg)
++ ret = regmap_update_bits(rdev->regmap, rdev->desc->vsel_reg,
+ rdev->desc->vsel_range_mask |
+ rdev->desc->vsel_mask, sel | range);
+- } else {
+- ret = regmap_update_bits(rdev->regmap,
+- rdev->desc->vsel_range_reg,
+- rdev->desc->vsel_range_mask, range);
+- if (ret)
+- return ret;
+-
+- ret = regmap_update_bits(rdev->regmap, rdev->desc->vsel_reg,
+- rdev->desc->vsel_mask, sel);
+- }
++ else
++ ret = write_separate_vsel_and_range(rdev, sel, range);
+
+ if (ret)
+ return ret;
+diff --git a/include/linux/regulator/driver.h b/include/linux/regulator/driver.h
+index 22a07c0900a41..f230a472ccd35 100644
+--- a/include/linux/regulator/driver.h
++++ b/include/linux/regulator/driver.h
+@@ -299,6 +299,8 @@ enum regulator_type {
+ * @vsel_range_reg: Register for range selector when using pickable ranges
+ * and ``regulator_map_*_voltage_*_pickable`` functions.
+ * @vsel_range_mask: Mask for register bitfield used for range selector
++ * @range_applied_by_vsel: A flag to indicate that changes to vsel_range_reg
++ * are only effective after vsel_reg is written
+ * @vsel_reg: Register for selector when using ``regulator_map_*_voltage_*``
+ * @vsel_mask: Mask for register bitfield used for selector
+ * @vsel_step: Specify the resolution of selector stepping when setting
+@@ -389,6 +391,7 @@ struct regulator_desc {
+
+ unsigned int vsel_range_reg;
+ unsigned int vsel_range_mask;
++ bool range_applied_by_vsel;
+ unsigned int vsel_reg;
+ unsigned int vsel_mask;
+ unsigned int vsel_step;
+--
+2.43.0
+
--- /dev/null
+From 934231040bd602388f6023345621f75fb0b1bcfd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 May 2024 15:36:55 +0300
+Subject: regulator: tps6287x: Force writing VSEL bit
+
+From: Matti Vaittinen <mazziesaccount@gmail.com>
+
+[ Upstream commit 1ace99d7c7c4c801c0660246f741ff846a9b8e3c ]
+
+The data-sheet for TPS6287x-Q1
+https://www.ti.com/lit/ds/symlink/tps62873-q1.pdf
+states at chapter 9.3.6.1 Output Voltage Range:
+
+"Note that every change to the VRANGE[1:0] bits must be followed by a
+write to the VSET register, even if the value of the VSET[7:0] bits does
+not change."
+
+The current implementation of the driver uses the
+regulator_set_voltage_sel_pickable_regmap() helper which further uses
+regmap_update_bits() to write the VSET-register. The
+regmap_update_bits() will not access the hardware if the new register
+value is same as old. It is worth noting that this is true also when the
+register is marked volatile, which I can't say is wrong because
+'read-mnodify-write'-cycle with a volatile register is in any case
+something user should carefully consider.
+
+The 'range_applied_by_vsel'-flag in regulator desc was added to force
+the vsel register upodates by using regmap_write_bits(). This variant
+will always unconditionally write the bits to the hardware.
+
+It is worth noting that the vsel is now forced to be written to the
+hardware, whether the range was changed or not. This may cause a
+performance drop if users are wrtiting same voltage value repeteadly.
+
+It would be possible to read the range register to determine if it was
+changed, but this would be a performance issue for users who don't use
+reg cache for vsel.
+
+Always write the VSET register to the hardware regardless the cache.
+
+Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com>
+Fixes: 7b0518fbf2be ("regulator: Add support for TI TPS6287x regulators")
+Link: https://msgid.link/r/ZktD50C5twF1EuKu@fedora
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/tps6287x-regulator.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/regulator/tps6287x-regulator.c b/drivers/regulator/tps6287x-regulator.c
+index 9b7c3d77789e3..3c9d79e003e4b 100644
+--- a/drivers/regulator/tps6287x-regulator.c
++++ b/drivers/regulator/tps6287x-regulator.c
+@@ -115,6 +115,7 @@ static struct regulator_desc tps6287x_reg = {
+ .vsel_mask = 0xFF,
+ .vsel_range_reg = TPS6287X_CTRL2,
+ .vsel_range_mask = TPS6287X_CTRL2_VRANGE,
++ .range_applied_by_vsel = true,
+ .ramp_reg = TPS6287X_CTRL1,
+ .ramp_mask = TPS6287X_CTRL1_VRAMP,
+ .ramp_delay_table = tps6287x_ramp_table,
+--
+2.43.0
+
--- /dev/null
+From 89c3fbb7f93f30e6b2a33c8f006282bd739f36cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2024 15:17:58 +0530
+Subject: regulator: tps6594-regulator: Correct multi-phase configuration
+
+From: Neha Malcom Francis <n-francis@ti.com>
+
+[ Upstream commit 74b38cd77d3eb63c6d0ad9cf2ae59812ae54d3ee ]
+
+According to the TPS6594 PMIC Manual (linked) 8.3.2.1.4 Multi-Phase BUCK
+Regulator Configurations section, the PMIC ignores all the other bucks'
+except the primary buck's regulator registers. This is BUCK1 for
+configurations BUCK12, BUCK123 and BUCK1234 while it is BUCK3 for
+BUCK34. Correct the registers mapped for these configurations
+accordingly.
+
+Fixes: f17ccc5deb4d ("regulator: tps6594-regulator: Add driver for TI TPS6594 regulators")
+Link: https://www.ti.com/lit/gpn/tps6594-q1
+Signed-off-by: Neha Malcom Francis <n-francis@ti.com>
+Link: https://msgid.link/r/20240521094758.2190331-1-n-francis@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/tps6594-regulator.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/regulator/tps6594-regulator.c b/drivers/regulator/tps6594-regulator.c
+index b7f0c87797577..5fad61785e72f 100644
+--- a/drivers/regulator/tps6594-regulator.c
++++ b/drivers/regulator/tps6594-regulator.c
+@@ -287,30 +287,30 @@ static struct tps6594_regulator_irq_type *tps6594_ldos_irq_types[] = {
+ static const struct regulator_desc multi_regs[] = {
+ TPS6594_REGULATOR("BUCK12", "buck12", TPS6594_BUCK_1,
+ REGULATOR_VOLTAGE, tps6594_bucks_ops, TPS6594_MASK_BUCKS_VSET,
+- TPS6594_REG_BUCKX_VOUT_1(1),
++ TPS6594_REG_BUCKX_VOUT_1(0),
+ TPS6594_MASK_BUCKS_VSET,
+- TPS6594_REG_BUCKX_CTRL(1),
++ TPS6594_REG_BUCKX_CTRL(0),
+ TPS6594_BIT_BUCK_EN, 0, 0, bucks_ranges,
+ 4, 4000, 0, NULL, 0, 0),
+ TPS6594_REGULATOR("BUCK34", "buck34", TPS6594_BUCK_3,
+ REGULATOR_VOLTAGE, tps6594_bucks_ops, TPS6594_MASK_BUCKS_VSET,
+- TPS6594_REG_BUCKX_VOUT_1(3),
++ TPS6594_REG_BUCKX_VOUT_1(2),
+ TPS6594_MASK_BUCKS_VSET,
+- TPS6594_REG_BUCKX_CTRL(3),
++ TPS6594_REG_BUCKX_CTRL(2),
+ TPS6594_BIT_BUCK_EN, 0, 0, bucks_ranges,
+ 4, 0, 0, NULL, 0, 0),
+ TPS6594_REGULATOR("BUCK123", "buck123", TPS6594_BUCK_1,
+ REGULATOR_VOLTAGE, tps6594_bucks_ops, TPS6594_MASK_BUCKS_VSET,
+- TPS6594_REG_BUCKX_VOUT_1(1),
++ TPS6594_REG_BUCKX_VOUT_1(0),
+ TPS6594_MASK_BUCKS_VSET,
+- TPS6594_REG_BUCKX_CTRL(1),
++ TPS6594_REG_BUCKX_CTRL(0),
+ TPS6594_BIT_BUCK_EN, 0, 0, bucks_ranges,
+ 4, 4000, 0, NULL, 0, 0),
+ TPS6594_REGULATOR("BUCK1234", "buck1234", TPS6594_BUCK_1,
+ REGULATOR_VOLTAGE, tps6594_bucks_ops, TPS6594_MASK_BUCKS_VSET,
+- TPS6594_REG_BUCKX_VOUT_1(1),
++ TPS6594_REG_BUCKX_VOUT_1(0),
+ TPS6594_MASK_BUCKS_VSET,
+- TPS6594_REG_BUCKX_CTRL(1),
++ TPS6594_REG_BUCKX_CTRL(0),
+ TPS6594_BIT_BUCK_EN, 0, 0, bucks_ranges,
+ 4, 4000, 0, NULL, 0, 0),
+ };
+--
+2.43.0
+
--- /dev/null
+From 5caf943083eb135a6efc7eee8748ff91b9fbecc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Apr 2024 14:22:59 +0200
+Subject: Revert "drm/bridge: ti-sn65dsi83: Fix enable error path"
+
+From: Luca Ceresoli <luca.ceresoli@bootlin.com>
+
+[ Upstream commit ad81feb5b6f1f5461641706376dcf7a9914ed2e7 ]
+
+This reverts commit 8a91b29f1f50ce7742cdbe5cf11d17f128511f3f.
+
+The regulator_disable() added by the original commit solves one kind of
+regulator imbalance but adds another one as it allows the regulator to be
+disabled one more time than it is enabled in the following scenario:
+
+ 1. Start video pipeline -> sn65dsi83_atomic_pre_enable -> regulator_enable
+ 2. PLL lock fails -> regulator_disable
+ 3. Stop video pipeline -> sn65dsi83_atomic_disable -> regulator_disable
+
+The reason is clear from the code flow, which looks like this (after
+removing unrelated code):
+
+ static void sn65dsi83_atomic_pre_enable()
+ {
+ regulator_enable(ctx->vcc);
+
+ if (PLL failed locking) {
+ regulator_disable(ctx->vcc); <---- added by patch being reverted
+ return;
+ }
+ }
+
+ static void sn65dsi83_atomic_disable()
+ {
+ regulator_disable(ctx->vcc);
+ }
+
+The use case for introducing the additional regulator_disable() was
+removing the module for debugging (see link below for the discussion). If
+the module is removed after a .atomic_pre_enable, i.e. with an active
+pipeline from the DRM point of view, .atomic_disable is not called and thus
+the regulator would not be disabled.
+
+According to the discussion however there is no actual use case for
+removing the module with an active pipeline, except for
+debugging/development.
+
+On the other hand, the occurrence of a PLL lock failure is possible due to
+any physical reason (e.g. a temporary hardware failure for electrical
+reasons) so handling it gracefully should be supported. As there is no way
+for .atomic[_pre]_enable to report an error to the core, the only clean way
+to support it is calling regulator_disabled() only in .atomic_disable,
+unconditionally, as it was before.
+
+Link: https://lore.kernel.org/all/15244220.uLZWGnKmhe@steina-w/
+Fixes: 8a91b29f1f50 ("drm/bridge: ti-sn65dsi83: Fix enable error path")
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240426122259.46808-1-luca.ceresoli@bootlin.com
+(cherry picked from commit 2940ee03b23281071620dda1d790cd644dabd394)
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/ti-sn65dsi83.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi83.c b/drivers/gpu/drm/bridge/ti-sn65dsi83.c
+index 4814b7b6d1fd1..57a7ed13f9965 100644
+--- a/drivers/gpu/drm/bridge/ti-sn65dsi83.c
++++ b/drivers/gpu/drm/bridge/ti-sn65dsi83.c
+@@ -478,7 +478,6 @@ static void sn65dsi83_atomic_pre_enable(struct drm_bridge *bridge,
+ dev_err(ctx->dev, "failed to lock PLL, ret=%i\n", ret);
+ /* On failure, disable PLL again and exit. */
+ regmap_write(ctx->regmap, REG_RC_PLL_EN, 0x00);
+- regulator_disable(ctx->vcc);
+ return;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From 51de264d9dc1728aae4946b43519a50845d3727e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 May 2024 17:21:27 -0700
+Subject: Revert "ixgbe: Manual AN-37 for troublesome link partners for X550
+ SFI"
+
+From: Jacob Keller <jacob.e.keller@intel.com>
+
+[ Upstream commit b35b1c0b4e166a427395deaf61e3140495dfcb89 ]
+
+This reverts commit 565736048bd5f9888990569993c6b6bfdf6dcb6d.
+
+According to the commit, it implements a manual AN-37 for some
+"troublesome" Juniper MX5 switches. This appears to be a workaround for a
+particular switch.
+
+It has been reported that this causes a severe breakage for other switches,
+including a Cisco 3560CX-12PD-S.
+
+The code appears to be a workaround for a specific switch which fails to
+link in SFI mode. It expects to see AN-37 auto negotiation in order to
+link. The Cisco switch is not expecting AN-37 auto negotiation. When the
+device starts the manual AN-37, the Cisco switch decides that the port is
+confused and stops attempting to link with it. This persists until a power
+cycle. A simple driver unload and reload does not resolve the issue, even
+if loading with a version of the driver which lacks this workaround.
+
+The authors of the workaround commit have not responded with
+clarifications, and the result of the workaround is complete failure to
+connect with other switches.
+
+This appears to be a case where the driver can either "correctly" link with
+the Juniper MX5 switch, at the cost of bricking the link with the Cisco
+switch, or it can behave properly for the Cisco switch, but fail to link
+with the Junipir MX5 switch. I do not know enough about the standards
+involved to clearly determine whether either switch is at fault or behaving
+incorrectly. Nor do I know whether there exists some alternative fix which
+corrects behavior with both switches.
+
+Revert the workaround for the Juniper switch.
+
+Fixes: 565736048bd5 ("ixgbe: Manual AN-37 for troublesome link partners for X550 SFI")
+Link: https://lore.kernel.org/netdev/cbe874db-9ac9-42b8-afa0-88ea910e1e99@intel.com/T/
+Link: https://forum.proxmox.com/threads/intel-x553-sfp-ixgbe-no-go-on-pve8.135129/#post-612291
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Cc: Jeff Daly <jeffd@silicom-usa.com>
+Cc: kernel.org-fo5k2w@ycharbi.fr
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://lore.kernel.org/r/20240520-net-2024-05-20-revert-silicom-switch-workaround-v1-1-50f80f261c94@intel.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_type.h | 3 -
+ drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c | 56 +------------------
+ 2 files changed, 3 insertions(+), 56 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
+index ed440dd0c4f9f..84fb6b8de2a12 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
+@@ -3676,9 +3676,7 @@ struct ixgbe_info {
+ #define IXGBE_KRM_LINK_S1(P) ((P) ? 0x8200 : 0x4200)
+ #define IXGBE_KRM_LINK_CTRL_1(P) ((P) ? 0x820C : 0x420C)
+ #define IXGBE_KRM_AN_CNTL_1(P) ((P) ? 0x822C : 0x422C)
+-#define IXGBE_KRM_AN_CNTL_4(P) ((P) ? 0x8238 : 0x4238)
+ #define IXGBE_KRM_AN_CNTL_8(P) ((P) ? 0x8248 : 0x4248)
+-#define IXGBE_KRM_PCS_KX_AN(P) ((P) ? 0x9918 : 0x5918)
+ #define IXGBE_KRM_SGMII_CTRL(P) ((P) ? 0x82A0 : 0x42A0)
+ #define IXGBE_KRM_LP_BASE_PAGE_HIGH(P) ((P) ? 0x836C : 0x436C)
+ #define IXGBE_KRM_DSP_TXFFE_STATE_4(P) ((P) ? 0x8634 : 0x4634)
+@@ -3688,7 +3686,6 @@ struct ixgbe_info {
+ #define IXGBE_KRM_PMD_FLX_MASK_ST20(P) ((P) ? 0x9054 : 0x5054)
+ #define IXGBE_KRM_TX_COEFF_CTRL_1(P) ((P) ? 0x9520 : 0x5520)
+ #define IXGBE_KRM_RX_ANA_CTL(P) ((P) ? 0x9A00 : 0x5A00)
+-#define IXGBE_KRM_FLX_TMRS_CTRL_ST31(P) ((P) ? 0x9180 : 0x5180)
+
+ #define IXGBE_KRM_PMD_FLX_MASK_ST20_SFI_10G_DA ~(0x3 << 20)
+ #define IXGBE_KRM_PMD_FLX_MASK_ST20_SFI_10G_SR BIT(20)
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
+index 2decb0710b6e3..a5f6449344450 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
+@@ -1722,59 +1722,9 @@ static int ixgbe_setup_sfi_x550a(struct ixgbe_hw *hw, ixgbe_link_speed *speed)
+ return -EINVAL;
+ }
+
+- (void)mac->ops.write_iosf_sb_reg(hw,
+- IXGBE_KRM_PMD_FLX_MASK_ST20(hw->bus.lan_id),
+- IXGBE_SB_IOSF_TARGET_KR_PHY, reg_val);
+-
+- /* change mode enforcement rules to hybrid */
+- (void)mac->ops.read_iosf_sb_reg(hw,
+- IXGBE_KRM_FLX_TMRS_CTRL_ST31(hw->bus.lan_id),
+- IXGBE_SB_IOSF_TARGET_KR_PHY, ®_val);
+- reg_val |= 0x0400;
+-
+- (void)mac->ops.write_iosf_sb_reg(hw,
+- IXGBE_KRM_FLX_TMRS_CTRL_ST31(hw->bus.lan_id),
+- IXGBE_SB_IOSF_TARGET_KR_PHY, reg_val);
+-
+- /* manually control the config */
+- (void)mac->ops.read_iosf_sb_reg(hw,
+- IXGBE_KRM_LINK_CTRL_1(hw->bus.lan_id),
+- IXGBE_SB_IOSF_TARGET_KR_PHY, ®_val);
+- reg_val |= 0x20002240;
+-
+- (void)mac->ops.write_iosf_sb_reg(hw,
+- IXGBE_KRM_LINK_CTRL_1(hw->bus.lan_id),
+- IXGBE_SB_IOSF_TARGET_KR_PHY, reg_val);
+-
+- /* move the AN base page values */
+- (void)mac->ops.read_iosf_sb_reg(hw,
+- IXGBE_KRM_PCS_KX_AN(hw->bus.lan_id),
+- IXGBE_SB_IOSF_TARGET_KR_PHY, ®_val);
+- reg_val |= 0x1;
+-
+- (void)mac->ops.write_iosf_sb_reg(hw,
+- IXGBE_KRM_PCS_KX_AN(hw->bus.lan_id),
+- IXGBE_SB_IOSF_TARGET_KR_PHY, reg_val);
+-
+- /* set the AN37 over CB mode */
+- (void)mac->ops.read_iosf_sb_reg(hw,
+- IXGBE_KRM_AN_CNTL_4(hw->bus.lan_id),
+- IXGBE_SB_IOSF_TARGET_KR_PHY, ®_val);
+- reg_val |= 0x20000000;
+-
+- (void)mac->ops.write_iosf_sb_reg(hw,
+- IXGBE_KRM_AN_CNTL_4(hw->bus.lan_id),
+- IXGBE_SB_IOSF_TARGET_KR_PHY, reg_val);
+-
+- /* restart AN manually */
+- (void)mac->ops.read_iosf_sb_reg(hw,
+- IXGBE_KRM_LINK_CTRL_1(hw->bus.lan_id),
+- IXGBE_SB_IOSF_TARGET_KR_PHY, ®_val);
+- reg_val |= IXGBE_KRM_LINK_CTRL_1_TETH_AN_RESTART;
+-
+- (void)mac->ops.write_iosf_sb_reg(hw,
+- IXGBE_KRM_LINK_CTRL_1(hw->bus.lan_id),
+- IXGBE_SB_IOSF_TARGET_KR_PHY, reg_val);
++ status = mac->ops.write_iosf_sb_reg(hw,
++ IXGBE_KRM_PMD_FLX_MASK_ST20(hw->bus.lan_id),
++ IXGBE_SB_IOSF_TARGET_KR_PHY, reg_val);
+
+ /* Toggle port SW reset by AN reset. */
+ status = ixgbe_restart_an_internal_phy_x550em(hw);
+--
+2.43.0
+
--- /dev/null
+From f46dfe2491b5836426909f0f20c64d47453f4e85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 May 2024 21:50:51 -0700
+Subject: riscv: cpufeature: Fix extension subset checking
+
+From: Charlie Jenkins <charlie@rivosinc.com>
+
+[ Upstream commit e67e98ee8952c7d5ce986d1dc6f8221ab8674afa ]
+
+This loop is supposed to check if ext->subset_ext_ids[j] is valid, rather
+than if ext->subset_ext_ids[i] is valid, before setting the extension
+id ext->subset_ext_ids[j] in isainfo->isa.
+
+Signed-off-by: Charlie Jenkins <charlie@rivosinc.com>
+Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
+Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Fixes: 0d8295ed975b ("riscv: add ISA extension parsing for scalar crypto")
+Link: https://lore.kernel.org/r/20240502-cpufeature_fixes-v4-2-b3d1a088722d@rivosinc.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/cpufeature.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/riscv/kernel/cpufeature.c b/arch/riscv/kernel/cpufeature.c
+index 13d4fc0d1817e..5ef48cb20ee11 100644
+--- a/arch/riscv/kernel/cpufeature.c
++++ b/arch/riscv/kernel/cpufeature.c
+@@ -603,7 +603,7 @@ static int __init riscv_fill_hwcap_from_ext_list(unsigned long *isa2hwcap)
+
+ if (ext->subset_ext_size) {
+ for (int j = 0; j < ext->subset_ext_size; j++) {
+- if (riscv_isa_extension_check(ext->subset_ext_ids[i]))
++ if (riscv_isa_extension_check(ext->subset_ext_ids[j]))
+ set_bit(ext->subset_ext_ids[j], isainfo->isa);
+ }
+ }
+--
+2.43.0
+
--- /dev/null
+From 8f35c8ac2e98e4479305d74aa44cbd43df7d0a0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 May 2024 21:50:50 -0700
+Subject: riscv: cpufeature: Fix thead vector hwcap removal
+
+From: Charlie Jenkins <charlie@rivosinc.com>
+
+[ Upstream commit e482eab4d1eb31031eff2b6afb71776483101979 ]
+
+The riscv_cpuinfo struct that contains mvendorid and marchid is not
+populated until all harts are booted which happens after the DT parsing.
+Use the mvendorid/marchid from the boot hart to determine if the DT
+contains an invalid V.
+
+Fixes: d82f32202e0d ("RISC-V: Ignore V from the riscv,isa DT property on older T-Head CPUs")
+Signed-off-by: Charlie Jenkins <charlie@rivosinc.com>
+Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
+Reviewed-by: Guo Ren <guoren@kernel.org>
+Link: https://lore.kernel.org/r/20240502-cpufeature_fixes-v4-1-b3d1a088722d@rivosinc.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/include/asm/sbi.h | 2 ++
+ arch/riscv/kernel/cpu.c | 40 ++++++++++++++++++++++++++++++----
+ arch/riscv/kernel/cpufeature.c | 8 +++++--
+ 3 files changed, 44 insertions(+), 6 deletions(-)
+
+diff --git a/arch/riscv/include/asm/sbi.h b/arch/riscv/include/asm/sbi.h
+index 6e68f8dff76bc..0fab508a65b3c 100644
+--- a/arch/riscv/include/asm/sbi.h
++++ b/arch/riscv/include/asm/sbi.h
+@@ -370,6 +370,8 @@ static inline int sbi_remote_fence_i(const struct cpumask *cpu_mask) { return -1
+ static inline void sbi_init(void) {}
+ #endif /* CONFIG_RISCV_SBI */
+
++unsigned long riscv_get_mvendorid(void);
++unsigned long riscv_get_marchid(void);
+ unsigned long riscv_cached_mvendorid(unsigned int cpu_id);
+ unsigned long riscv_cached_marchid(unsigned int cpu_id);
+ unsigned long riscv_cached_mimpid(unsigned int cpu_id);
+diff --git a/arch/riscv/kernel/cpu.c b/arch/riscv/kernel/cpu.c
+index d11d6320fb0d2..c1f3655238fd2 100644
+--- a/arch/riscv/kernel/cpu.c
++++ b/arch/riscv/kernel/cpu.c
+@@ -139,6 +139,34 @@ int riscv_of_parent_hartid(struct device_node *node, unsigned long *hartid)
+ return -1;
+ }
+
++unsigned long __init riscv_get_marchid(void)
++{
++ struct riscv_cpuinfo *ci = this_cpu_ptr(&riscv_cpuinfo);
++
++#if IS_ENABLED(CONFIG_RISCV_SBI)
++ ci->marchid = sbi_spec_is_0_1() ? 0 : sbi_get_marchid();
++#elif IS_ENABLED(CONFIG_RISCV_M_MODE)
++ ci->marchid = csr_read(CSR_MARCHID);
++#else
++ ci->marchid = 0;
++#endif
++ return ci->marchid;
++}
++
++unsigned long __init riscv_get_mvendorid(void)
++{
++ struct riscv_cpuinfo *ci = this_cpu_ptr(&riscv_cpuinfo);
++
++#if IS_ENABLED(CONFIG_RISCV_SBI)
++ ci->mvendorid = sbi_spec_is_0_1() ? 0 : sbi_get_mvendorid();
++#elif IS_ENABLED(CONFIG_RISCV_M_MODE)
++ ci->mvendorid = csr_read(CSR_MVENDORID);
++#else
++ ci->mvendorid = 0;
++#endif
++ return ci->mvendorid;
++}
++
+ DEFINE_PER_CPU(struct riscv_cpuinfo, riscv_cpuinfo);
+
+ unsigned long riscv_cached_mvendorid(unsigned int cpu_id)
+@@ -170,12 +198,16 @@ static int riscv_cpuinfo_starting(unsigned int cpu)
+ struct riscv_cpuinfo *ci = this_cpu_ptr(&riscv_cpuinfo);
+
+ #if IS_ENABLED(CONFIG_RISCV_SBI)
+- ci->mvendorid = sbi_spec_is_0_1() ? 0 : sbi_get_mvendorid();
+- ci->marchid = sbi_spec_is_0_1() ? 0 : sbi_get_marchid();
++ if (!ci->mvendorid)
++ ci->mvendorid = sbi_spec_is_0_1() ? 0 : sbi_get_mvendorid();
++ if (!ci->marchid)
++ ci->marchid = sbi_spec_is_0_1() ? 0 : sbi_get_marchid();
+ ci->mimpid = sbi_spec_is_0_1() ? 0 : sbi_get_mimpid();
+ #elif IS_ENABLED(CONFIG_RISCV_M_MODE)
+- ci->mvendorid = csr_read(CSR_MVENDORID);
+- ci->marchid = csr_read(CSR_MARCHID);
++ if (!ci->mvendorid)
++ ci->mvendorid = csr_read(CSR_MVENDORID);
++ if (!ci->marchid)
++ ci->marchid = csr_read(CSR_MARCHID);
+ ci->mimpid = csr_read(CSR_MIMPID);
+ #else
+ ci->mvendorid = 0;
+diff --git a/arch/riscv/kernel/cpufeature.c b/arch/riscv/kernel/cpufeature.c
+index 3ed2359eae353..13d4fc0d1817e 100644
+--- a/arch/riscv/kernel/cpufeature.c
++++ b/arch/riscv/kernel/cpufeature.c
+@@ -490,6 +490,8 @@ static void __init riscv_fill_hwcap_from_isa_string(unsigned long *isa2hwcap)
+ struct acpi_table_header *rhct;
+ acpi_status status;
+ unsigned int cpu;
++ u64 boot_vendorid;
++ u64 boot_archid;
+
+ if (!acpi_disabled) {
+ status = acpi_get_table(ACPI_SIG_RHCT, 0, &rhct);
+@@ -497,6 +499,9 @@ static void __init riscv_fill_hwcap_from_isa_string(unsigned long *isa2hwcap)
+ return;
+ }
+
++ boot_vendorid = riscv_get_mvendorid();
++ boot_archid = riscv_get_marchid();
++
+ for_each_possible_cpu(cpu) {
+ struct riscv_isainfo *isainfo = &hart_isa[cpu];
+ unsigned long this_hwcap = 0;
+@@ -544,8 +549,7 @@ static void __init riscv_fill_hwcap_from_isa_string(unsigned long *isa2hwcap)
+ * CPU cores with the ratified spec will contain non-zero
+ * marchid.
+ */
+- if (acpi_disabled && riscv_cached_mvendorid(cpu) == THEAD_VENDOR_ID &&
+- riscv_cached_marchid(cpu) == 0x0) {
++ if (acpi_disabled && boot_vendorid == THEAD_VENDOR_ID && boot_archid == 0x0) {
+ this_hwcap &= ~isa2hwcap[RISCV_ISA_EXT_v];
+ clear_bit(RISCV_ISA_EXT_v, isainfo->isa);
+ }
+--
+2.43.0
+
--- /dev/null
+From 6df70f2b0360de3e410b14f157148400a1caffaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Apr 2024 12:58:03 -0700
+Subject: riscv: selftests: Add hwprobe binaries to .gitignore
+
+From: Charlie Jenkins <charlie@rivosinc.com>
+
+[ Upstream commit f8ea6ab92748e69216b44b07ea7213cb02070dba ]
+
+The cbo and which-cpu hwprobe selftests leave their artifacts in the
+kernel tree and end up being tracked by git. Add the binaries to the
+hwprobe selftest .gitignore so this no longer happens.
+
+Signed-off-by: Charlie Jenkins <charlie@rivosinc.com>
+Fixes: a29e2a48afe3 ("RISC-V: selftests: Add CBO tests")
+Fixes: ef7d6abb2cf5 ("RISC-V: selftests: Add which-cpus hwprobe test")
+Reviewed-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Link: https://lore.kernel.org/r/20240425-gitignore_hwprobe_artifacts-v1-1-dfc5a20da469@rivosinc.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/riscv/hwprobe/.gitignore | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/riscv/hwprobe/.gitignore b/tools/testing/selftests/riscv/hwprobe/.gitignore
+index 8113dc3bdd03a..6e384e80ea1a8 100644
+--- a/tools/testing/selftests/riscv/hwprobe/.gitignore
++++ b/tools/testing/selftests/riscv/hwprobe/.gitignore
+@@ -1 +1,3 @@
+ hwprobe
++cbo
++which-cpus
+--
+2.43.0
+
--- /dev/null
+From 40102264201527df644fe49cfaf0ea7cef66d881 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2024 22:13:13 +0300
+Subject: riscv: stacktrace: fixed walk_stackframe()
+
+From: Matthew Bystrin <dev.mbstr@gmail.com>
+
+[ Upstream commit a2a4d4a6a0bf5eba66f8b0b32502cc20d82715a0 ]
+
+If the load access fault occures in a leaf function (with
+CONFIG_FRAME_POINTER=y), when wrong stack trace will be displayed:
+
+[<ffffffff804853c2>] regmap_mmio_read32le+0xe/0x1c
+---[ end trace 0000000000000000 ]---
+
+Registers dump:
+ ra 0xffffffff80485758 <regmap_mmio_read+36>
+ sp 0xffffffc80200b9a0
+ fp 0xffffffc80200b9b0
+ pc 0xffffffff804853ba <regmap_mmio_read32le+6>
+
+Stack dump:
+ 0xffffffc80200b9a0: 0xffffffc80200b9e0 0xffffffc80200b9e0
+ 0xffffffc80200b9b0: 0xffffffff8116d7e8 0x0000000000000100
+ 0xffffffc80200b9c0: 0xffffffd8055b9400 0xffffffd8055b9400
+ 0xffffffc80200b9d0: 0xffffffc80200b9f0 0xffffffff8047c526
+ 0xffffffc80200b9e0: 0xffffffc80200ba30 0xffffffff8047fe9a
+
+The assembler dump of the function preambula:
+ add sp,sp,-16
+ sd s0,8(sp)
+ add s0,sp,16
+
+In the fist stack frame, where ra is not stored on the stack we can
+observe:
+
+ 0(sp) 8(sp)
+ .---------------------------------------------.
+ sp->| frame->fp | frame->ra (saved fp) |
+ |---------------------------------------------|
+ fp->| .... | .... |
+ |---------------------------------------------|
+ | | |
+
+and in the code check is performed:
+ if (regs && (regs->epc == pc) && (frame->fp & 0x7))
+
+I see no reason to check frame->fp value at all, because it is can be
+uninitialized value on the stack. A better way is to check frame->ra to
+be an address on the stack. After the stacktrace shows as expect:
+
+[<ffffffff804853c2>] regmap_mmio_read32le+0xe/0x1c
+[<ffffffff80485758>] regmap_mmio_read+0x24/0x52
+[<ffffffff8047c526>] _regmap_bus_reg_read+0x1a/0x22
+[<ffffffff8047fe9a>] _regmap_read+0x5c/0xea
+[<ffffffff80480376>] _regmap_update_bits+0x76/0xc0
+...
+---[ end trace 0000000000000000 ]---
+As pointed by Samuel Holland it is incorrect to remove check of the stackframe
+entirely.
+
+Changes since v2 [2]:
+ - Add accidentally forgotten curly brace
+
+Changes since v1 [1]:
+ - Instead of just dropping frame->fp check, replace it with validation of
+ frame->ra, which should be a stack address.
+ - Move frame pointer validation into the separate function.
+
+[1] https://lore.kernel.org/linux-riscv/20240426072701.6463-1-dev.mbstr@gmail.com/
+[2] https://lore.kernel.org/linux-riscv/20240521131314.48895-1-dev.mbstr@gmail.com/
+
+Fixes: f766f77a74f5 ("riscv/stacktrace: Fix stack output without ra on the stack top")
+Signed-off-by: Matthew Bystrin <dev.mbstr@gmail.com>
+Reviewed-by: Samuel Holland <samuel.holland@sifive.com>
+Link: https://lore.kernel.org/r/20240521191727.62012-1-dev.mbstr@gmail.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/stacktrace.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/arch/riscv/kernel/stacktrace.c b/arch/riscv/kernel/stacktrace.c
+index 64a9c093aef93..528ec7cc9a622 100644
+--- a/arch/riscv/kernel/stacktrace.c
++++ b/arch/riscv/kernel/stacktrace.c
+@@ -18,6 +18,16 @@
+
+ extern asmlinkage void ret_from_exception(void);
+
++static inline int fp_is_valid(unsigned long fp, unsigned long sp)
++{
++ unsigned long low, high;
++
++ low = sp + sizeof(struct stackframe);
++ high = ALIGN(sp, THREAD_SIZE);
++
++ return !(fp < low || fp > high || fp & 0x07);
++}
++
+ void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs,
+ bool (*fn)(void *, unsigned long), void *arg)
+ {
+@@ -41,21 +51,19 @@ void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs,
+ }
+
+ for (;;) {
+- unsigned long low, high;
+ struct stackframe *frame;
+
+ if (unlikely(!__kernel_text_address(pc) || (level++ >= 0 && !fn(arg, pc))))
+ break;
+
+- /* Validate frame pointer */
+- low = sp + sizeof(struct stackframe);
+- high = ALIGN(sp, THREAD_SIZE);
+- if (unlikely(fp < low || fp > high || fp & 0x7))
++ if (unlikely(!fp_is_valid(fp, sp)))
+ break;
++
+ /* Unwind stack frame */
+ frame = (struct stackframe *)fp - 1;
+ sp = fp;
+- if (regs && (regs->epc == pc) && (frame->fp & 0x7)) {
++ if (regs && (regs->epc == pc) && fp_is_valid(frame->ra, sp)) {
++ /* We hit function where ra is not saved on the stack */
+ fp = frame->ra;
+ pc = regs->ra;
+ } else {
+--
+2.43.0
+
--- /dev/null
+From f90a90cf16b68dd7a6f4b3bcce9d2f51e2a2a39c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 May 2024 12:37:59 +0300
+Subject: rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL
+
+From: Dan Aloni <dan.aloni@vastdata.com>
+
+[ Upstream commit 4836da219781ec510c4c0303df901aa643507a7a ]
+
+Under the scenario of IB device bonding, when bringing down one of the
+ports, or all ports, we saw xprtrdma entering a non-recoverable state
+where it is not even possible to complete the disconnect and shut it
+down the mount, requiring a reboot. Following debug, we saw that
+transport connect never ended after receiving the
+RDMA_CM_EVENT_DEVICE_REMOVAL callback.
+
+The DEVICE_REMOVAL callback is irrespective of whether the CM_ID is
+connected, and ESTABLISHED may not have happened. So need to work with
+each of these states accordingly.
+
+Fixes: 2acc5cae2923 ('xprtrdma: Prevent dereferencing r_xprt->rx_ep after it is freed')
+Cc: Sagi Grimberg <sagi.grimberg@vastdata.com>
+Signed-off-by: Dan Aloni <dan.aloni@vastdata.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xprtrdma/verbs.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
+index 4f8d7efa469f0..432557a553e7e 100644
+--- a/net/sunrpc/xprtrdma/verbs.c
++++ b/net/sunrpc/xprtrdma/verbs.c
+@@ -244,7 +244,11 @@ rpcrdma_cm_event_handler(struct rdma_cm_id *id, struct rdma_cm_event *event)
+ case RDMA_CM_EVENT_DEVICE_REMOVAL:
+ pr_info("rpcrdma: removing device %s for %pISpc\n",
+ ep->re_id->device->name, sap);
+- fallthrough;
++ switch (xchg(&ep->re_connect_status, -ENODEV)) {
++ case 0: goto wake_connect_worker;
++ case 1: goto disconnected;
++ }
++ return 0;
+ case RDMA_CM_EVENT_ADDR_CHANGE:
+ ep->re_connect_status = -ENODEV;
+ goto disconnected;
+--
+2.43.0
+
--- /dev/null
+From a168af5d8bf23e4dc13a8fb4aaab8a428735c272 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 May 2024 13:42:39 +0800
+Subject: rv: Update rv_en(dis)able_monitor doc to match kernel-doc
+
+From: Yang Li <yang.lee@linux.alibaba.com>
+
+[ Upstream commit 1e8b7b3dbb3103d577a586ca72bc329f7b67120b ]
+
+The patch updates the function documentation comment for
+rv_en(dis)able_monitor to adhere to the kernel-doc specification.
+
+Link: https://lore.kernel.org/linux-trace-kernel/20240520054239.61784-1-yang.lee@linux.alibaba.com
+
+Fixes: 102227b970a15 ("rv: Add Runtime Verification (RV) interface")
+Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/rv/rv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/kernel/trace/rv/rv.c b/kernel/trace/rv/rv.c
+index 2f68e93fff0bc..df0745a42a3f3 100644
+--- a/kernel/trace/rv/rv.c
++++ b/kernel/trace/rv/rv.c
+@@ -245,6 +245,7 @@ static int __rv_disable_monitor(struct rv_monitor_def *mdef, bool sync)
+
+ /**
+ * rv_disable_monitor - disable a given runtime monitor
++ * @mdef: Pointer to the monitor definition structure.
+ *
+ * Returns 0 on success.
+ */
+@@ -256,6 +257,7 @@ int rv_disable_monitor(struct rv_monitor_def *mdef)
+
+ /**
+ * rv_enable_monitor - enable a given runtime monitor
++ * @mdef: Pointer to the monitor definition structure.
+ *
+ * Returns 0 on success, error otherwise.
+ */
+--
+2.43.0
+
--- /dev/null
+From 370d8a2b0c9f80b3be5a61dd8def22f45a166af1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2024 17:54:34 +0100
+Subject: selftests: forwarding: Change inappropriate log_test_skip() calls
+
+From: Petr Machata <petrm@nvidia.com>
+
+[ Upstream commit 677f394956e808c709c18b92bd01d19f14a96dd5 ]
+
+The SKIP return should be used for cases where tooling of the machine under
+test is lacking. For cases where HW is lacking, the appropriate outcome is
+XFAIL.
+
+This is the case with ethtool_rmon and mlxsw_lib. For these, introduce a
+new helper, log_test_xfail().
+
+Do the same for router_mpath_nh_lib. Note that it will be fixed using a
+more reusable way in a following patch.
+
+For the two resource_scale selftests, the log should simply not be written,
+because there is no problem.
+
+Cc: Tobias Waldekranz <tobias@waldekranz.com>
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Link: https://lore.kernel.org/r/3d668d8fb6fa0d9eeb47ce6d9e54114348c7c179.1711464583.git.petrm@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: ea63ac142925 ("selftests/net: use tc rule to filter the na packet")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/drivers/net/mlxsw/mlxsw_lib.sh | 2 +-
+ .../drivers/net/mlxsw/spectrum-2/resource_scale.sh | 1 -
+ .../drivers/net/mlxsw/spectrum/resource_scale.sh | 1 -
+ tools/testing/selftests/net/forwarding/ethtool_rmon.sh | 4 ++--
+ tools/testing/selftests/net/forwarding/lib.sh | 9 +++++++++
+ .../selftests/net/forwarding/router_mpath_nh_lib.sh | 2 +-
+ 6 files changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/tools/testing/selftests/drivers/net/mlxsw/mlxsw_lib.sh b/tools/testing/selftests/drivers/net/mlxsw/mlxsw_lib.sh
+index 6369927e9c378..48395cfd4f958 100644
+--- a/tools/testing/selftests/drivers/net/mlxsw/mlxsw_lib.sh
++++ b/tools/testing/selftests/drivers/net/mlxsw/mlxsw_lib.sh
+@@ -42,7 +42,7 @@ __mlxsw_only_on_spectrum()
+ local src=$1; shift
+
+ if ! mlxsw_on_spectrum "$rev"; then
+- log_test_skip $src:$caller "(Spectrum-$rev only)"
++ log_test_xfail $src:$caller "(Spectrum-$rev only)"
+ return 1
+ fi
+ }
+diff --git a/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/resource_scale.sh b/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/resource_scale.sh
+index a88d8a8c85f2e..899b6892603fd 100755
+--- a/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/resource_scale.sh
++++ b/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/resource_scale.sh
+@@ -47,7 +47,6 @@ for current_test in ${TESTS:-$ALL_TESTS}; do
+ RET=0
+ target=$(${current_test}_get_target "$should_fail")
+ if ((target == 0)); then
+- log_test_skip "'$current_test' should_fail=$should_fail test"
+ continue
+ fi
+
+diff --git a/tools/testing/selftests/drivers/net/mlxsw/spectrum/resource_scale.sh b/tools/testing/selftests/drivers/net/mlxsw/spectrum/resource_scale.sh
+index f981c957f0975..482ebb744ebad 100755
+--- a/tools/testing/selftests/drivers/net/mlxsw/spectrum/resource_scale.sh
++++ b/tools/testing/selftests/drivers/net/mlxsw/spectrum/resource_scale.sh
+@@ -52,7 +52,6 @@ for current_test in ${TESTS:-$ALL_TESTS}; do
+ RET=0
+ target=$(${current_test}_get_target "$should_fail")
+ if ((target == 0)); then
+- log_test_skip "'$current_test' [$profile] should_fail=$should_fail test"
+ continue
+ fi
+ ${current_test}_setup_prepare
+diff --git a/tools/testing/selftests/net/forwarding/ethtool_rmon.sh b/tools/testing/selftests/net/forwarding/ethtool_rmon.sh
+index 41a34a61f7632..e78776db850f1 100755
+--- a/tools/testing/selftests/net/forwarding/ethtool_rmon.sh
++++ b/tools/testing/selftests/net/forwarding/ethtool_rmon.sh
+@@ -78,7 +78,7 @@ rmon_histogram()
+
+ for if in $iface $neigh; do
+ if ! ensure_mtu $if ${bucket[0]}; then
+- log_test_skip "$if does not support the required MTU for $step"
++ log_test_xfail "$if does not support the required MTU for $step"
+ return
+ fi
+ done
+@@ -93,7 +93,7 @@ rmon_histogram()
+ jq -r ".[0].rmon[\"${set}-pktsNtoM\"][]|[.low, .high]|@tsv" 2>/dev/null)
+
+ if [ $nbuckets -eq 0 ]; then
+- log_test_skip "$iface does not support $set histogram counters"
++ log_test_xfail "$iface does not support $set histogram counters"
+ return
+ fi
+ }
+diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh
+index e579c2e0c462a..9042fe92ca465 100644
+--- a/tools/testing/selftests/net/forwarding/lib.sh
++++ b/tools/testing/selftests/net/forwarding/lib.sh
+@@ -429,6 +429,15 @@ log_test_skip()
+ return 0
+ }
+
++log_test_xfail()
++{
++ local test_name=$1
++ local opt_str=$2
++
++ printf "TEST: %-60s [XFAIL]\n" "$test_name $opt_str"
++ return 0
++}
++
+ log_info()
+ {
+ local msg=$1
+diff --git a/tools/testing/selftests/net/forwarding/router_mpath_nh_lib.sh b/tools/testing/selftests/net/forwarding/router_mpath_nh_lib.sh
+index 7e7d62161c345..b2d2c6cecc01e 100644
+--- a/tools/testing/selftests/net/forwarding/router_mpath_nh_lib.sh
++++ b/tools/testing/selftests/net/forwarding/router_mpath_nh_lib.sh
+@@ -69,7 +69,7 @@ nh_stats_test_dispatch_swhw()
+ nh_stats_do_test "HW $what" "$nh1_id" "$nh2_id" "$group_id" \
+ nh_stats_get_hw "${mz[@]}"
+ elif [[ $kind == veth ]]; then
+- log_test_skip "HW stats not offloaded on veth topology"
++ log_test_xfail "HW stats not offloaded on veth topology"
+ fi
+ }
+
+--
+2.43.0
+
--- /dev/null
+From ba56fcd84e7ef1bae4a840f32c365e72fc5ef9c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2024 17:54:37 +0100
+Subject: selftests: forwarding: Convert log_test() to recognize RET values
+
+From: Petr Machata <petrm@nvidia.com>
+
+[ Upstream commit a923af1ceee744c187d1c08a0d7dc9e8ab7ca482 ]
+
+In a previous patch, the interpretation of RET value was changed to mean
+the kselftest framework constant with the test outcome: $ksft_pass,
+$ksft_xfail, etc.
+
+Update log_test() to recognize the various possible RET values.
+
+Then have EXIT_STATUS track the RET value of the current test. This differs
+subtly from the way RET tracks the value: while for RET we want to
+recognize XFAIL as a separate status, for purposes of exit code, we want to
+to conflate XFAIL and PASS, because they both communicate non-failure. Thus
+add a new helper, ksft_exit_status_merge().
+
+With this log_test_skip() and log_test_xfail() can be reexpressed as thin
+wrappers around log_test.
+
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Link: https://lore.kernel.org/r/e5f807cb5476ab795fd14ac74da53a731a9fc432.1711464583.git.petrm@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: ea63ac142925 ("selftests/net: use tc rule to filter the na packet")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/forwarding/lib.sh | 92 ++++++++++++++-----
+ tools/testing/selftests/net/lib.sh | 9 ++
+ 2 files changed, 77 insertions(+), 24 deletions(-)
+
+diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh
+index 258d2082aa991..99ab42319e3e3 100644
+--- a/tools/testing/selftests/net/forwarding/lib.sh
++++ b/tools/testing/selftests/net/forwarding/lib.sh
+@@ -400,6 +400,62 @@ check_err_fail()
+ fi
+ }
+
++log_test_result()
++{
++ local test_name=$1; shift
++ local opt_str=$1; shift
++ local result=$1; shift
++ local retmsg=$1; shift
++
++ printf "TEST: %-60s [%s]\n" "$test_name $opt_str" "$result"
++ if [[ $retmsg ]]; then
++ printf "\t%s\n" "$retmsg"
++ fi
++}
++
++pause_on_fail()
++{
++ if [[ $PAUSE_ON_FAIL == yes ]]; then
++ echo "Hit enter to continue, 'q' to quit"
++ read a
++ [[ $a == q ]] && exit 1
++ fi
++}
++
++handle_test_result_pass()
++{
++ local test_name=$1; shift
++ local opt_str=$1; shift
++
++ log_test_result "$test_name" "$opt_str" " OK "
++}
++
++handle_test_result_fail()
++{
++ local test_name=$1; shift
++ local opt_str=$1; shift
++
++ log_test_result "$test_name" "$opt_str" FAIL "$retmsg"
++ pause_on_fail
++}
++
++handle_test_result_xfail()
++{
++ local test_name=$1; shift
++ local opt_str=$1; shift
++
++ log_test_result "$test_name" "$opt_str" XFAIL "$retmsg"
++ pause_on_fail
++}
++
++handle_test_result_skip()
++{
++ local test_name=$1; shift
++ local opt_str=$1; shift
++
++ log_test_result "$test_name" "$opt_str" SKIP "$retmsg"
++}
++
+ log_test()
+ {
+ local test_name=$1
+@@ -409,40 +465,28 @@ log_test()
+ opt_str="($opt_str)"
+ fi
+
+- if [[ $RET -ne 0 ]]; then
+- EXIT_STATUS=1
+- printf "TEST: %-60s [FAIL]\n" "$test_name $opt_str"
+- if [[ ! -z "$retmsg" ]]; then
+- printf "\t%s\n" "$retmsg"
+- fi
+- if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
+- echo "Hit enter to continue, 'q' to quit"
+- read a
+- [ "$a" = "q" ] && exit 1
+- fi
+- return 1
++ if ((RET == ksft_pass)); then
++ handle_test_result_pass "$test_name" "$opt_str"
++ elif ((RET == ksft_xfail)); then
++ handle_test_result_xfail "$test_name" "$opt_str"
++ elif ((RET == ksft_skip)); then
++ handle_test_result_skip "$test_name" "$opt_str"
++ else
++ handle_test_result_fail "$test_name" "$opt_str"
+ fi
+
+- printf "TEST: %-60s [ OK ]\n" "$test_name $opt_str"
+- return 0
++ EXIT_STATUS=$(ksft_exit_status_merge $EXIT_STATUS $RET)
++ return $RET
+ }
+
+ log_test_skip()
+ {
+- local test_name=$1
+- local opt_str=$2
+-
+- printf "TEST: %-60s [SKIP]\n" "$test_name $opt_str"
+- return 0
++ RET=$ksft_skip retmsg= log_test "$@"
+ }
+
+ log_test_xfail()
+ {
+- local test_name=$1
+- local opt_str=$2
+-
+- printf "TEST: %-60s [XFAIL]\n" "$test_name $opt_str"
+- return 0
++ RET=$ksft_xfail retmsg= log_test "$@"
+ }
+
+ log_info()
+diff --git a/tools/testing/selftests/net/lib.sh b/tools/testing/selftests/net/lib.sh
+index b0bbde83b8461..e826ec1cc9d88 100644
+--- a/tools/testing/selftests/net/lib.sh
++++ b/tools/testing/selftests/net/lib.sh
+@@ -44,6 +44,15 @@ ksft_status_merge()
+ $ksft_pass $ksft_xfail $ksft_skip $ksft_fail
+ }
+
++ksft_exit_status_merge()
++{
++ local a=$1; shift
++ local b=$1; shift
++
++ __ksft_status_merge "$a" "$b" \
++ $ksft_xfail $ksft_pass $ksft_skip $ksft_fail
++}
++
+ busywait()
+ {
+ local timeout=$1; shift
+--
+2.43.0
+
--- /dev/null
+From 217adc45fd16d1cc6ef3997d033e2423cd0f073a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2024 17:54:36 +0100
+Subject: selftests: forwarding: Have RET track kselftest framework constants
+
+From: Petr Machata <petrm@nvidia.com>
+
+[ Upstream commit 596c8819cb78c047acc0cab03a863a9983a3cc62 ]
+
+The variable RET keeps track of whether the test under execution has so far
+failed or not. Currently it works in binary fashion: zero means everything
+is fine, non-zero means something failed. log_test() then uses the value to
+given a human-readable message.
+
+In order to allow log_test() to report skips and xfails, the semantics of
+RET need to be more fine-grained. Therefore have RET value be one of
+kselftest framework constants: $ksft_fail, $ksft_xfail, etc.
+
+The current logic in check_err() is such that first non-zero value of RET
+trumps all those that follow. But that is not right when RET has more
+fine-grained value semantics. Different outcomes have different weights.
+
+The results of PASS and XFAIL are mostly the same: they both communicate a
+test that did not go wrong. SKIP communicates lack of tooling, which the
+user should go and try to fix, and as such should not be overridden by the
+passes. So far, the higher-numbered statuses can be considered weightier.
+But FAIL should be the weightiest.
+
+Add a helper, ksft_status_merge(), which merges two statuses in a way that
+respects the above conditions. Express it in a generic manner, because exit
+status merge is subtly different, and we want to reuse the same logic.
+
+Use the new helper when setting RET in check_err().
+
+Re-express check_fail() in terms of check_err() to avoid duplication.
+
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Link: https://lore.kernel.org/r/7dfff51cc925c7a3ac879b9050a0d6a327c8d21f.1711464583.git.petrm@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: ea63ac142925 ("selftests/net: use tc rule to filter the na packet")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/forwarding/lib.sh | 21 ++++++++-----
+ tools/testing/selftests/net/lib.sh | 30 +++++++++++++++++++
+ 2 files changed, 44 insertions(+), 7 deletions(-)
+
+diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh
+index 9042fe92ca465..258d2082aa991 100644
+--- a/tools/testing/selftests/net/forwarding/lib.sh
++++ b/tools/testing/selftests/net/forwarding/lib.sh
+@@ -358,14 +358,24 @@ EXIT_STATUS=0
+ # Per-test return value. Clear at the beginning of each test.
+ RET=0
+
++ret_set_ksft_status()
++{
++ local ksft_status=$1; shift
++ local msg=$1; shift
++
++ RET=$(ksft_status_merge $RET $ksft_status)
++ if (( $? )); then
++ retmsg=$msg
++ fi
++}
++
+ check_err()
+ {
+ local err=$1
+ local msg=$2
+
+- if [[ $RET -eq 0 && $err -ne 0 ]]; then
+- RET=$err
+- retmsg=$msg
++ if ((err)); then
++ ret_set_ksft_status $ksft_fail "$msg"
+ fi
+ }
+
+@@ -374,10 +384,7 @@ check_fail()
+ local err=$1
+ local msg=$2
+
+- if [[ $RET -eq 0 && $err -eq 0 ]]; then
+- RET=1
+- retmsg=$msg
+- fi
++ check_err $((!err)) "$msg"
+ }
+
+ check_err_fail()
+diff --git a/tools/testing/selftests/net/lib.sh b/tools/testing/selftests/net/lib.sh
+index 56a9454b7ba35..b0bbde83b8461 100644
+--- a/tools/testing/selftests/net/lib.sh
++++ b/tools/testing/selftests/net/lib.sh
+@@ -14,6 +14,36 @@ NS_LIST=""
+
+ ##############################################################################
+ # Helpers
++
++__ksft_status_merge()
++{
++ local a=$1; shift
++ local b=$1; shift
++ local -A weights
++ local weight=0
++
++ for i in "$@"; do
++ weights[$i]=$((weight++))
++ done
++
++ if [[ ${weights[$a]} > ${weights[$b]} ]]; then
++ echo "$a"
++ return 0
++ else
++ echo "$b"
++ return 1
++ fi
++}
++
++ksft_status_merge()
++{
++ local a=$1; shift
++ local b=$1; shift
++
++ __ksft_status_merge "$a" "$b" \
++ $ksft_pass $ksft_xfail $ksft_skip $ksft_fail
++}
++
+ busywait()
+ {
+ local timeout=$1; shift
+--
+2.43.0
+
--- /dev/null
+From 1aca908efe3c3f0102d5a8b38f695d64b27723a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 May 2024 13:20:52 +0000
+Subject: selftests: net: kill smcrouted in the cleanup logic in amt.sh
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+[ Upstream commit cc563e749810f5636451d4b833fbd689899ecdb9 ]
+
+The amt.sh requires smcrouted for multicasting routing.
+So, it starts smcrouted before forwarding tests.
+It must be stopped after all tests, but it isn't.
+
+To fix this issue, it kills smcrouted in the cleanup logic.
+
+Fixes: c08e8baea78e ("selftests: add amt interface selftest script")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/amt.sh | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/amt.sh b/tools/testing/selftests/net/amt.sh
+index 5175a42cbe8a2..7e7ed6c558da9 100755
+--- a/tools/testing/selftests/net/amt.sh
++++ b/tools/testing/selftests/net/amt.sh
+@@ -77,6 +77,7 @@ readonly LISTENER=$(mktemp -u listener-XXXXXXXX)
+ readonly GATEWAY=$(mktemp -u gateway-XXXXXXXX)
+ readonly RELAY=$(mktemp -u relay-XXXXXXXX)
+ readonly SOURCE=$(mktemp -u source-XXXXXXXX)
++readonly SMCROUTEDIR="$(mktemp -d)"
+ ERR=4
+ err=0
+
+@@ -85,6 +86,11 @@ exit_cleanup()
+ for ns in "$@"; do
+ ip netns delete "${ns}" 2>/dev/null || true
+ done
++ if [ -f "$SMCROUTEDIR/amt.pid" ]; then
++ smcpid=$(< $SMCROUTEDIR/amt.pid)
++ kill $smcpid
++ fi
++ rm -rf $SMCROUTEDIR
+
+ exit $ERR
+ }
+@@ -167,7 +173,7 @@ setup_iptables()
+
+ setup_mcast_routing()
+ {
+- ip netns exec "${RELAY}" smcrouted
++ ip netns exec "${RELAY}" smcrouted -P $SMCROUTEDIR/amt.pid
+ ip netns exec "${RELAY}" smcroutectl a relay_src \
+ 172.17.0.2 239.0.0.1 amtr
+ ip netns exec "${RELAY}" smcroutectl a relay_src \
+--
+2.43.0
+
--- /dev/null
+From 75bd45a8c0aae4135f16fe583b739eaffd14e74d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Apr 2024 19:03:04 +0200
+Subject: selftests: net: Unify code of busywait() and slowwait()
+
+From: Petr Machata <petrm@nvidia.com>
+
+[ Upstream commit a4022a332f437ae5b10921d66058ce98a2db2c20 ]
+
+Bodies of busywait() and slowwait() functions are almost identical. Extract
+the common code into a helper, loopy_wait, and convert busywait() and
+slowwait() into trivial wrappers.
+
+Moreover, the fact that slowwait() uses seconds for units is really not
+intuitive, and the comment does not help much. Instead make the unit part
+of the name of the argument to further clarify what units are expected.
+
+Cc: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Reviewed-by: Benjamin Poirier <bpoirier@nvidia.com>
+Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Stable-dep-of: ea63ac142925 ("selftests/net: use tc rule to filter the na packet")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/forwarding/lib.sh | 22 ++-----------------
+ tools/testing/selftests/net/lib.sh | 16 +++++++++++---
+ 2 files changed, 15 insertions(+), 23 deletions(-)
+
+diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh
+index 99ab42319e3e3..01322758255f7 100644
+--- a/tools/testing/selftests/net/forwarding/lib.sh
++++ b/tools/testing/selftests/net/forwarding/lib.sh
+@@ -41,27 +41,9 @@ source "$net_forwarding_dir/../lib.sh"
+ # timeout in seconds
+ slowwait()
+ {
+- local timeout=$1; shift
+-
+- local start_time="$(date -u +%s)"
+- while true
+- do
+- local out
+- out=$("$@")
+- local ret=$?
+- if ((!ret)); then
+- echo -n "$out"
+- return 0
+- fi
++ local timeout_sec=$1; shift
+
+- local current_time="$(date -u +%s)"
+- if ((current_time - start_time > timeout)); then
+- echo -n "$out"
+- return 1
+- fi
+-
+- sleep 0.1
+- done
++ loopy_wait "sleep 0.1" "$((timeout_sec * 1000))" "$@"
+ }
+
+ ##############################################################################
+diff --git a/tools/testing/selftests/net/lib.sh b/tools/testing/selftests/net/lib.sh
+index e826ec1cc9d88..308c3b0bcf210 100644
+--- a/tools/testing/selftests/net/lib.sh
++++ b/tools/testing/selftests/net/lib.sh
+@@ -53,9 +53,10 @@ ksft_exit_status_merge()
+ $ksft_xfail $ksft_pass $ksft_skip $ksft_fail
+ }
+
+-busywait()
++loopy_wait()
+ {
+- local timeout=$1; shift
++ local sleep_cmd=$1; shift
++ local timeout_ms=$1; shift
+
+ local start_time="$(date -u +%s%3N)"
+ while true
+@@ -69,13 +70,22 @@ busywait()
+ fi
+
+ local current_time="$(date -u +%s%3N)"
+- if ((current_time - start_time > timeout)); then
++ if ((current_time - start_time > timeout_ms)); then
+ echo -n "$out"
+ return 1
+ fi
++
++ $sleep_cmd
+ done
+ }
+
++busywait()
++{
++ local timeout_ms=$1; shift
++
++ loopy_wait : "$timeout_ms" "$@"
++}
++
+ cleanup_ns()
+ {
+ local ns=""
+--
+2.43.0
+
--- /dev/null
+From fc53c0927087f0452e0d9073f80fd50c4af6005e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 May 2024 09:03:27 +0800
+Subject: selftests/net: use tc rule to filter the na packet
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit ea63ac14292564eefc7dffe868ed354ff9ed6f4b ]
+
+Test arp_ndisc_untracked_subnets use tcpdump to filter the unsolicited
+and untracked na messages. It set -e before calling tcpdump. But if
+tcpdump filters 0 packet, it will return none zero, and cause the script
+to exit.
+
+Instead of using slow tcpdump to capture packets, let's using tc rule
+to filter out the na message.
+
+At the same time, fix function setup_v6 which only needs one parameter.
+Move all the related helpers from forwarding lib.sh to net lib.sh.
+
+Fixes: 0ea7b0a454ca ("selftests: net: arp_ndisc_untracked_subnets: test for arp_accept and accept_untracked_na")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://lore.kernel.org/r/20240517010327.2631319-1-liuhangbin@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/arp_ndisc_untracked_subnets.sh | 53 ++++++-----------
+ tools/testing/selftests/net/forwarding/lib.sh | 58 -------------------
+ tools/testing/selftests/net/lib.sh | 58 +++++++++++++++++++
+ 3 files changed, 75 insertions(+), 94 deletions(-)
+
+diff --git a/tools/testing/selftests/net/arp_ndisc_untracked_subnets.sh b/tools/testing/selftests/net/arp_ndisc_untracked_subnets.sh
+index a40c0e9bd023c..eef5cbf6eecca 100755
+--- a/tools/testing/selftests/net/arp_ndisc_untracked_subnets.sh
++++ b/tools/testing/selftests/net/arp_ndisc_untracked_subnets.sh
+@@ -73,25 +73,19 @@ setup_v6() {
+ # namespaces. veth0 is veth-router, veth1 is veth-host.
+ # first, set up the inteface's link to the namespace
+ # then, set the interface "up"
+- ip -6 -netns ${ROUTER_NS_V6} link add name ${ROUTER_INTF} \
+- type veth peer name ${HOST_INTF}
+-
+- ip -6 -netns ${ROUTER_NS_V6} link set dev ${ROUTER_INTF} up
+- ip -6 -netns ${ROUTER_NS_V6} link set dev ${HOST_INTF} netns \
+- ${HOST_NS_V6}
++ ip -n ${ROUTER_NS_V6} link add name ${ROUTER_INTF} \
++ type veth peer name ${HOST_INTF} netns ${HOST_NS_V6}
+
+- ip -6 -netns ${HOST_NS_V6} link set dev ${HOST_INTF} up
+- ip -6 -netns ${ROUTER_NS_V6} addr add \
+- ${ROUTER_ADDR_V6}/${PREFIX_WIDTH_V6} dev ${ROUTER_INTF} nodad
++ # Add tc rule to filter out host na message
++ tc -n ${ROUTER_NS_V6} qdisc add dev ${ROUTER_INTF} clsact
++ tc -n ${ROUTER_NS_V6} filter add dev ${ROUTER_INTF} \
++ ingress protocol ipv6 pref 1 handle 101 \
++ flower src_ip ${HOST_ADDR_V6} ip_proto icmpv6 type 136 skip_hw action pass
+
+ HOST_CONF=net.ipv6.conf.${HOST_INTF}
+ ip netns exec ${HOST_NS_V6} sysctl -qw ${HOST_CONF}.ndisc_notify=1
+ ip netns exec ${HOST_NS_V6} sysctl -qw ${HOST_CONF}.disable_ipv6=0
+- ip -6 -netns ${HOST_NS_V6} addr add ${HOST_ADDR_V6}/${PREFIX_WIDTH_V6} \
+- dev ${HOST_INTF}
+-
+ ROUTER_CONF=net.ipv6.conf.${ROUTER_INTF}
+-
+ ip netns exec ${ROUTER_NS_V6} sysctl -w \
+ ${ROUTER_CONF}.forwarding=1 >/dev/null 2>&1
+ ip netns exec ${ROUTER_NS_V6} sysctl -w \
+@@ -99,6 +93,13 @@ setup_v6() {
+ ip netns exec ${ROUTER_NS_V6} sysctl -w \
+ ${ROUTER_CONF}.accept_untracked_na=${accept_untracked_na} \
+ >/dev/null 2>&1
++
++ ip -n ${ROUTER_NS_V6} link set dev ${ROUTER_INTF} up
++ ip -n ${HOST_NS_V6} link set dev ${HOST_INTF} up
++ ip -n ${ROUTER_NS_V6} addr add ${ROUTER_ADDR_V6}/${PREFIX_WIDTH_V6} \
++ dev ${ROUTER_INTF} nodad
++ ip -n ${HOST_NS_V6} addr add ${HOST_ADDR_V6}/${PREFIX_WIDTH_V6} \
++ dev ${HOST_INTF}
+ set +e
+ }
+
+@@ -162,26 +163,6 @@ arp_test_gratuitous_combinations() {
+ arp_test_gratuitous 2 1
+ }
+
+-cleanup_tcpdump() {
+- set -e
+- [[ ! -z ${tcpdump_stdout} ]] && rm -f ${tcpdump_stdout}
+- [[ ! -z ${tcpdump_stderr} ]] && rm -f ${tcpdump_stderr}
+- tcpdump_stdout=
+- tcpdump_stderr=
+- set +e
+-}
+-
+-start_tcpdump() {
+- set -e
+- tcpdump_stdout=`mktemp`
+- tcpdump_stderr=`mktemp`
+- ip netns exec ${ROUTER_NS_V6} timeout 15s \
+- tcpdump --immediate-mode -tpni ${ROUTER_INTF} -c 1 \
+- "icmp6 && icmp6[0] == 136 && src ${HOST_ADDR_V6}" \
+- > ${tcpdump_stdout} 2> /dev/null
+- set +e
+-}
+-
+ verify_ndisc() {
+ local accept_untracked_na=$1
+ local same_subnet=$2
+@@ -222,8 +203,9 @@ ndisc_test_untracked_advertisements() {
+ HOST_ADDR_V6=2001:db8:abcd:0012::3
+ fi
+ fi
+- setup_v6 $1 $2
+- start_tcpdump
++ setup_v6 $1
++ slowwait_for_counter 15 1 \
++ tc_rule_handle_stats_get "dev ${ROUTER_INTF} ingress" 101 ".packets" "-n ${ROUTER_NS_V6}"
+
+ if verify_ndisc $1 $2; then
+ printf " TEST: %-60s [ OK ]\n" "${test_msg[*]}"
+@@ -231,7 +213,6 @@ ndisc_test_untracked_advertisements() {
+ printf " TEST: %-60s [FAIL]\n" "${test_msg[*]}"
+ fi
+
+- cleanup_tcpdump
+ cleanup_v6
+ set +e
+ }
+diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh
+index 01322758255f7..e78f11140edd8 100644
+--- a/tools/testing/selftests/net/forwarding/lib.sh
++++ b/tools/testing/selftests/net/forwarding/lib.sh
+@@ -38,14 +38,6 @@ fi
+
+ source "$net_forwarding_dir/../lib.sh"
+
+-# timeout in seconds
+-slowwait()
+-{
+- local timeout_sec=$1; shift
+-
+- loopy_wait "sleep 0.1" "$((timeout_sec * 1000))" "$@"
+-}
+-
+ ##############################################################################
+ # Sanity checks
+
+@@ -529,33 +521,6 @@ wait_for_trap()
+ "$@" | grep -q trap
+ }
+
+-until_counter_is()
+-{
+- local expr=$1; shift
+- local current=$("$@")
+-
+- echo $((current))
+- ((current $expr))
+-}
+-
+-busywait_for_counter()
+-{
+- local timeout=$1; shift
+- local delta=$1; shift
+-
+- local base=$("$@")
+- busywait "$timeout" until_counter_is ">= $((base + delta))" "$@"
+-}
+-
+-slowwait_for_counter()
+-{
+- local timeout=$1; shift
+- local delta=$1; shift
+-
+- local base=$("$@")
+- slowwait "$timeout" until_counter_is ">= $((base + delta))" "$@"
+-}
+-
+ setup_wait_dev()
+ {
+ local dev=$1; shift
+@@ -861,29 +826,6 @@ link_stats_rx_errors_get()
+ link_stats_get $1 rx errors
+ }
+
+-tc_rule_stats_get()
+-{
+- local dev=$1; shift
+- local pref=$1; shift
+- local dir=$1; shift
+- local selector=${1:-.packets}; shift
+-
+- tc -j -s filter show dev $dev ${dir:-ingress} pref $pref \
+- | jq ".[1].options.actions[].stats$selector"
+-}
+-
+-tc_rule_handle_stats_get()
+-{
+- local id=$1; shift
+- local handle=$1; shift
+- local selector=${1:-.packets}; shift
+- local netns=${1:-""}; shift
+-
+- tc $netns -j -s filter show $id \
+- | jq ".[] | select(.options.handle == $handle) | \
+- .options.actions[0].stats$selector"
+-}
+-
+ ethtool_stats_get()
+ {
+ local dev=$1; shift
+diff --git a/tools/testing/selftests/net/lib.sh b/tools/testing/selftests/net/lib.sh
+index 308c3b0bcf210..fb640fb9e8d32 100644
+--- a/tools/testing/selftests/net/lib.sh
++++ b/tools/testing/selftests/net/lib.sh
+@@ -86,6 +86,41 @@ busywait()
+ loopy_wait : "$timeout_ms" "$@"
+ }
+
++# timeout in seconds
++slowwait()
++{
++ local timeout_sec=$1; shift
++
++ loopy_wait "sleep 0.1" "$((timeout_sec * 1000))" "$@"
++}
++
++until_counter_is()
++{
++ local expr=$1; shift
++ local current=$("$@")
++
++ echo $((current))
++ ((current $expr))
++}
++
++busywait_for_counter()
++{
++ local timeout=$1; shift
++ local delta=$1; shift
++
++ local base=$("$@")
++ busywait "$timeout" until_counter_is ">= $((base + delta))" "$@"
++}
++
++slowwait_for_counter()
++{
++ local timeout=$1; shift
++ local delta=$1; shift
++
++ local base=$("$@")
++ slowwait "$timeout" until_counter_is ">= $((base + delta))" "$@"
++}
++
+ cleanup_ns()
+ {
+ local ns=""
+@@ -145,3 +180,26 @@ setup_ns()
+ done
+ NS_LIST="$NS_LIST $ns_list"
+ }
++
++tc_rule_stats_get()
++{
++ local dev=$1; shift
++ local pref=$1; shift
++ local dir=$1; shift
++ local selector=${1:-.packets}; shift
++
++ tc -j -s filter show dev $dev ${dir:-ingress} pref $pref \
++ | jq ".[1].options.actions[].stats$selector"
++}
++
++tc_rule_handle_stats_get()
++{
++ local id=$1; shift
++ local handle=$1; shift
++ local selector=${1:-.packets}; shift
++ local netns=${1:-""}; shift
++
++ tc $netns -j -s filter show $id \
++ | jq ".[] | select(.options.handle == $handle) | \
++ .options.actions[0].stats$selector"
++}
+--
+2.43.0
+
--- /dev/null
+From d6b02f56f55bee650ec8e5efa5b15bb170c609e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Apr 2024 21:23:17 +1000
+Subject: selftests/powerpc/dexcr: Add -no-pie to hashchk tests
+
+From: Benjamin Gray <bgray@linux.ibm.com>
+
+[ Upstream commit d7228a58d9438d6f219dc7f33eab0d1980b3bd2f ]
+
+The hashchk tests want to verify that the hash key is changed over exec.
+It does so by calculating hashes at the same address across an exec.
+This is made simpler by disabling PIE functionality, so we can
+re-execute ourselves and be using the same addresses in the child.
+
+While -fno-pie is already added, -no-pie is also required.
+
+Fixes: bdb07f35a52f ("selftests/powerpc/dexcr: Add hashst/hashchk test")
+Signed-off-by: Benjamin Gray <bgray@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20240417112325.728010-2-bgray@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/powerpc/dexcr/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/powerpc/dexcr/Makefile b/tools/testing/selftests/powerpc/dexcr/Makefile
+index 76210f2bcec3c..829ad075b4a44 100644
+--- a/tools/testing/selftests/powerpc/dexcr/Makefile
++++ b/tools/testing/selftests/powerpc/dexcr/Makefile
+@@ -3,7 +3,7 @@ TEST_GEN_FILES := lsdexcr
+
+ include ../../lib.mk
+
+-$(OUTPUT)/hashchk_test: CFLAGS += -fno-pie $(call cc-option,-mno-rop-protect)
++$(OUTPUT)/hashchk_test: CFLAGS += -fno-pie -no-pie $(call cc-option,-mno-rop-protect)
+
+ $(TEST_GEN_PROGS): ../harness.c ../utils.c ./dexcr.c
+ $(TEST_GEN_FILES): ../utils.c ./dexcr.c
+--
+2.43.0
+
selftests-harness-use-1024-in-place-of-line_max.patch
mailbox-mtk-cmdq-fix-pm_runtime_get_sync-warning-in-.patch
gpiolib-acpi-fix-failed-in-acpi_gpiochip_find-by-add.patch
+input-ims-pcu-fix-printf-string-overflow.patch
+input-ioc3kbd-add-device-table.patch
+mmc-sdhci_am654-add-tuning-algorithm-for-delay-chain.patch
+mmc-sdhci_am654-write-itapdly-for-ddr52-timing.patch
+mmc-sdhci_am654-add-otap-itap-delay-enable.patch
+mmc-sdhci_am654-add-itapdlysel-in-sdhci_j721e_4bit_s.patch
+mmc-sdhci_am654-fix-itapdly-for-hs400-timing.patch
+x86-percpu-unify-arch_raw_cpu_ptr-defines.patch
+x86-percpu-use-__force-to-cast-from-__percpu-address.patch
+phy-qcom-qmp-combo-fix-sm8650-voltage-swing-table.patch
+input-pm8xxx-vibrator-correct-vib_max_levels-calcula.patch
+media-ti-j721e-csi2rx-fix-races-while-restarting-dma.patch
+media-v4l-don-t-turn-on-privacy-led-if-streamon-fail.patch
+media-ov2680-clear-the-ret-variable-on-success.patch
+media-ov2680-allow-probing-if-link-frequencies-is-ab.patch
+media-ov2680-do-not-fail-if-data-lanes-property-is-a.patch
+drm-msm-dsi-print-dual-dsi-adjusted-pclk-instead-of-.patch
+drm-msm-dpu-always-flush-the-slave-intf-on-the-ctl.patch
+drm-msm-dpu-allow-configuring-multiple-active-dsc-bl.patch
+drm-mediatek-dp-fix-mtk_dp_aux_transfer-return-value.patch
+drm-meson-gate-px_clk-when-setting-rate.patch
+um-fix-return-value-in-ubd_init.patch
+um-add-winch-to-winch_handlers-before-registering-wi.patch
+um-vector-fix-bpfflash-parameter-evaluation.patch
+fs-ntfs3-check-folio-pointer-for-null.patch
+fs-ntfs3-use-64-bit-variable-to-avoid-32-bit-overflo.patch
+fs-ntfs3-use-variable-length-array-instead-of-fixed-.patch
+drm-msm-dpu-add-callback-function-pointer-check-befo.patch
+drm-bridge-tc358775-fix-support-for-jeida-18-and-jei.patch
+media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
+drm-make-drivers-depends-on-drm_dw_hdmi.patch
+drm-bridge-imx-fix-unmet-depenency-for-phy_fsl_samsu.patch
+string_kunit-add-test-cases-for-str-cmp-functions.patch
+string-prepare-to-merge-strscpy_kunit.c-into-string_.patch
+string-prepare-to-merge-strcat-kunit-tests-into-stri.patch
+input-cyapa-add-missing-input-core-locking-to-suspen.patch
+drm-amdgpu-init-microcode-chip-name-from-ip-versions.patch
+drm-amdgpu-fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
+media-mediatek-vcodec-fix-possible-unbalanced-pm-cou.patch
+tools-arch-x86-intel_sdsi-fix-maximum-meter-bundle-l.patch
+tools-arch-x86-intel_sdsi-fix-meter_show-display.patch
+tools-arch-x86-intel_sdsi-fix-meter_certificate-deco.patch
+platform-x86-thinkpad_acpi-take-hotkey_mutex-during-.patch
+media-flexcop-usb-fix-sanity-check-of-bnumendpoints.patch
+powerpc-pseries-add-failure-related-checks-for-h_get.patch
+asoc-sof-debug-handle-cases-when-fw_lib_prefix-is-no.patch
+um-fix-the-wmissing-prototypes-warning-for-__switch_.patch
+um-fix-the-wmissing-prototypes-warning-for-get_threa.patch
+um-fix-the-declaration-of-kasan_map_memory.patch
+cxl-trace-correct-dpa-field-masks-for-general_media-.patch
+cxl-region-fix-cxlr_pmem-leaks.patch
+media-sunxi-a83-mips-csi2-also-select-generic_phy.patch
+media-cec-cec-adap-always-cancel-work-in-cec_transmi.patch
+media-cec-cec-api-add-locking-in-cec_release.patch
+media-cec-core-avoid-recursive-cec_claim_log_addrs.patch
+media-cec-core-avoid-confusing-transmit-timed-out-me.patch
+revert-drm-bridge-ti-sn65dsi83-fix-enable-error-path.patch
+drm-zynqmp_dpsub-always-register-bridge.patch
+asoc-amd-acp-fix-for-acp-platform-device-creation-fa.patch
+selftests-powerpc-dexcr-add-no-pie-to-hashchk-tests.patch
+drm-msm-adreno-fix-cp-cycles-stat-retrieval-on-a7xx.patch
+drm-msm-a6xx-avoid-a-nullptr-dereference-when-speedb.patch
+asoc-tas2781-fix-a-warning-reported-by-robot-kernel-.patch
+null_blk-fix-the-warning-modpost-missing-module_desc.patch
+printk-fix-log_cpu_max_buf_shift-when-base_small-is-.patch
+powerpc-bpf-32-fix-failing-test_bpf-tests.patch
+kvm-ppc-book3s-hv-nestedv2-cancel-pending-dec-except.patch
+kvm-ppc-book3s-hv-nestedv2-fix-an-error-handling-pat.patch
+kvm-arm64-destroy-mpidr_data-for-late-vcpu-creation.patch
+nilfs2-make-superblock-data-array-index-computation-.patch
+alsa-hda-cs_dsp_ctl-use-private_free-for-control-cle.patch
+alsa-hda-hda_component-initialize-shared-data-during.patch
+alsa-hda-cs35l56-fix-lifetime-of-cs_dsp-instance.patch
+asoc-mediatek-mt8192-fix-register-configuration-for-.patch
+asoc-rt715-sdca-sdw-fix-wrong-complete-waiting-in-rt.patch
+alsa-hda-realtek-drop-doubly-quirk-entry-for-103c-8a.patch
+drm-nouveau-use-tile_mode-and-pte_kind-for-vm_bind-b.patch
+bluetooth-iso-handle-pa-sync-when-no-biginfo-reports.patch
+bluetooth-l2cap-fix-div-by-zero-in-l2cap_le_flowctl_.patch
+blk-cgroup-fix-list-corruption-from-resetting-io-sta.patch
+blk-cgroup-fix-list-corruption-from-reorder-of-write.patch
+blk-cgroup-properly-propagate-the-iostat-update-up-t.patch
+regulator-bd71828-don-t-overwrite-runtime-voltages.patch
+xen-x86-add-extra-pages-to-unpopulated-alloc-if-avai.patch
+perf-arm-dmc620-fix-lockdep-assert-in-event_init.patch
+ubsan-restore-dependency-on-arch_has_ubsan.patch
+x86-kconfig-select-arch_want_frame_pointers-again-wh.patch
+net-always-descend-into-dsa-folder-with-config_net_d.patch
+ipv6-sr-fix-missing-sk_buff-release-in-seg6_input_co.patch
+selftests-net-kill-smcrouted-in-the-cleanup-logic-in.patch
+nfc-nci-fix-uninit-value-in-nci_rx_work.patch
+asoc-tas2552-add-tx-path-for-capturing-audio-out-dat.patch
+asoc-tas2781-fix-wrong-loading-calibrated-data-seque.patch
+nfsv4-fixup-smatch-warning-for-ambiguous-return.patch
+nfs-keep-server-info-for-remounts.patch
+sunrpc-fix-nfsacl-rpc-retry-on-soft-mount.patch
+rpcrdma-fix-handling-for-rdma_cm_event_device_remova.patch
+regulator-pickable-ranges-don-t-always-cache-vsel.patch
+regulator-tps6287x-force-writing-vsel-bit.patch
+af_unix-update-unix_sk-sk-oob_skb-under-sk_receive_q.patch
+ipv6-sr-fix-memleak-in-seg6_hmac_init_algo.patch
+selftests-forwarding-change-inappropriate-log_test_s.patch
+selftests-forwarding-have-ret-track-kselftest-framew.patch
+selftests-forwarding-convert-log_test-to-recognize-r.patch
+selftests-net-unify-code-of-busywait-and-slowwait.patch
+selftests-net-use-tc-rule-to-filter-the-na-packet.patch
+regulator-tps6594-regulator-correct-multi-phase-conf.patch
+tcp-fix-shift-out-of-bounds-in-dctcp_update_alpha.patch
+pnfs-filelayout-fixup-pnfs-allocation-modes.patch
+openvswitch-set-the-skbuff-pkt_type-for-proper-pmtud.patch
+arm64-asm-bug-add-.align-2-to-the-end-of-__bug_entry.patch
+rv-update-rv_en-dis-able_monitor-doc-to-match-kernel.patch
+net-lan966x-remove-ptp-traps-in-case-the-ptp-is-not-.patch
+virtio_balloon-give-the-balloon-its-own-wakeup-sourc.patch
+virtio-delete-vq-in-vp_find_vqs_msix-when-request_ir.patch
+riscv-cpufeature-fix-thead-vector-hwcap-removal.patch
+riscv-cpufeature-fix-extension-subset-checking.patch
+i3c-master-svc-change-enxio-to-eagain-when-ibi-occur.patch
+riscv-stacktrace-fixed-walk_stackframe.patch
+riscv-selftests-add-hwprobe-binaries-to-.gitignore.patch
+revert-ixgbe-manual-an-37-for-troublesome-link-partn.patch
+net-fec-avoid-lock-evasion-when-reading-pps_enable.patch
+tls-fix-missing-memory-barrier-in-tls_init.patch
+tcp-remove-64-kbyte-limit-for-initial-tp-rcv_wnd-val.patch
+net-relax-socket-state-check-at-accept-time.patch
+nfc-nci-fix-handling-of-zero-length-payload-packets-.patch
+drivers-xen-improve-the-late-xenstore-init-protocol.patch
+ice-interpret-.set_channels-input-differently.patch
+idpf-interpret-.set_channels-input-differently.patch
+null_blk-fix-null-ptr-dereference-while-configuring-.patch
+netfs-fix-setting-of-bdp_async-from-iocb-flags.patch
+kasan-fortify-properly-rename-memintrinsics.patch
+cifs-set-zero_point-in-the-copy_file_range-and-remap.patch
+cifs-fix-missing-set-of-remote_i_size.patch
+tracing-probes-fix-error-check-in-parse_btf_field.patch
+tpm_tis_spi-account-for-spi-header-when-allocating-t.patch
--- /dev/null
+From d95f5c07c4fdf467ae32a8587c5bd0d71c277a9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Apr 2024 07:01:52 -0700
+Subject: string: Prepare to merge strcat KUnit tests into string_kunit.c
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 6e4ef1429f3be236e145c6115b539acdbd2e299c ]
+
+The test naming convention differs between string_kunit.c and
+strcat_kunit.c. Move "test" to the beginning of the function name.
+
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Tested-by: Ivan Orlov <ivan.orlov0322@gmail.com>
+Link: https://lore.kernel.org/r/20240419140155.3028912-3-keescook@chromium.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Stable-dep-of: 5bb288c4abc2 ("scsi: mptfusion: Avoid possible run-time warning with long manufacturer strings")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/strcat_kunit.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/lib/strcat_kunit.c b/lib/strcat_kunit.c
+index e21be95514afa..ca09f7f0e6a26 100644
+--- a/lib/strcat_kunit.c
++++ b/lib/strcat_kunit.c
+@@ -10,7 +10,7 @@
+
+ static volatile int unconst;
+
+-static void strcat_test(struct kunit *test)
++static void test_strcat(struct kunit *test)
+ {
+ char dest[8];
+
+@@ -29,7 +29,7 @@ static void strcat_test(struct kunit *test)
+ KUNIT_EXPECT_STREQ(test, dest, "fourAB");
+ }
+
+-static void strncat_test(struct kunit *test)
++static void test_strncat(struct kunit *test)
+ {
+ char dest[8];
+
+@@ -56,7 +56,7 @@ static void strncat_test(struct kunit *test)
+ KUNIT_EXPECT_STREQ(test, dest, "fourAB");
+ }
+
+-static void strlcat_test(struct kunit *test)
++static void test_strlcat(struct kunit *test)
+ {
+ char dest[8] = "";
+ int len = sizeof(dest) + unconst;
+@@ -88,9 +88,9 @@ static void strlcat_test(struct kunit *test)
+ }
+
+ static struct kunit_case strcat_test_cases[] = {
+- KUNIT_CASE(strcat_test),
+- KUNIT_CASE(strncat_test),
+- KUNIT_CASE(strlcat_test),
++ KUNIT_CASE(test_strcat),
++ KUNIT_CASE(test_strncat),
++ KUNIT_CASE(test_strlcat),
+ {}
+ };
+
+--
+2.43.0
+
--- /dev/null
+From 996fbf410a035c8897a29deefe0829813408d5dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Apr 2024 07:01:50 -0700
+Subject: string: Prepare to merge strscpy_kunit.c into string_kunit.c
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit b03442f761aae4bbb093a281ad2205bc346188f5 ]
+
+In preparation for moving the strscpy_kunit.c tests into string_kunit.c,
+rename "tc" to "strscpy_check" for better readability.
+
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Tested-by: Ivan Orlov <ivan.orlov0322@gmail.com>
+Link: https://lore.kernel.org/r/20240419140155.3028912-1-keescook@chromium.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Stable-dep-of: 5bb288c4abc2 ("scsi: mptfusion: Avoid possible run-time warning with long manufacturer strings")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/strscpy_kunit.c | 51 +++++++++++++++++++++++----------------------
+ 1 file changed, 26 insertions(+), 25 deletions(-)
+
+diff --git a/lib/strscpy_kunit.c b/lib/strscpy_kunit.c
+index a6b6344354ed5..b6d1d93a88832 100644
+--- a/lib/strscpy_kunit.c
++++ b/lib/strscpy_kunit.c
+@@ -8,22 +8,23 @@
+ #include <kunit/test.h>
+ #include <linux/string.h>
+
+-/*
+- * tc() - Run a specific test case.
++/**
++ * strscpy_check() - Run a specific test case.
++ * @test: KUnit test context pointer
+ * @src: Source string, argument to strscpy_pad()
+ * @count: Size of destination buffer, argument to strscpy_pad()
+ * @expected: Expected return value from call to strscpy_pad()
+- * @terminator: 1 if there should be a terminating null byte 0 otherwise.
+ * @chars: Number of characters from the src string expected to be
+ * written to the dst buffer.
++ * @terminator: 1 if there should be a terminating null byte 0 otherwise.
+ * @pad: Number of pad characters expected (in the tail of dst buffer).
+ * (@pad does not include the null terminator byte.)
+ *
+ * Calls strscpy_pad() and verifies the return value and state of the
+ * destination buffer after the call returns.
+ */
+-static void tc(struct kunit *test, char *src, int count, int expected,
+- int chars, int terminator, int pad)
++static void strscpy_check(struct kunit *test, char *src, int count,
++ int expected, int chars, int terminator, int pad)
+ {
+ int nr_bytes_poison;
+ int max_expected;
+@@ -79,12 +80,12 @@ static void tc(struct kunit *test, char *src, int count, int expected,
+ }
+ }
+
+-static void strscpy_test(struct kunit *test)
++static void test_strscpy(struct kunit *test)
+ {
+ char dest[8];
+
+ /*
+- * tc() uses a destination buffer of size 6 and needs at
++ * strscpy_check() uses a destination buffer of size 6 and needs at
+ * least 2 characters spare (one for null and one to check for
+ * overflow). This means we should only call tc() with
+ * strings up to a maximum of 4 characters long and 'count'
+@@ -92,27 +93,27 @@ static void strscpy_test(struct kunit *test)
+ * the buffer size in tc().
+ */
+
+- /* tc(test, src, count, expected, chars, terminator, pad) */
+- tc(test, "a", 0, -E2BIG, 0, 0, 0);
+- tc(test, "", 0, -E2BIG, 0, 0, 0);
++ /* strscpy_check(test, src, count, expected, chars, terminator, pad) */
++ strscpy_check(test, "a", 0, -E2BIG, 0, 0, 0);
++ strscpy_check(test, "", 0, -E2BIG, 0, 0, 0);
+
+- tc(test, "a", 1, -E2BIG, 0, 1, 0);
+- tc(test, "", 1, 0, 0, 1, 0);
++ strscpy_check(test, "a", 1, -E2BIG, 0, 1, 0);
++ strscpy_check(test, "", 1, 0, 0, 1, 0);
+
+- tc(test, "ab", 2, -E2BIG, 1, 1, 0);
+- tc(test, "a", 2, 1, 1, 1, 0);
+- tc(test, "", 2, 0, 0, 1, 1);
++ strscpy_check(test, "ab", 2, -E2BIG, 1, 1, 0);
++ strscpy_check(test, "a", 2, 1, 1, 1, 0);
++ strscpy_check(test, "", 2, 0, 0, 1, 1);
+
+- tc(test, "abc", 3, -E2BIG, 2, 1, 0);
+- tc(test, "ab", 3, 2, 2, 1, 0);
+- tc(test, "a", 3, 1, 1, 1, 1);
+- tc(test, "", 3, 0, 0, 1, 2);
++ strscpy_check(test, "abc", 3, -E2BIG, 2, 1, 0);
++ strscpy_check(test, "ab", 3, 2, 2, 1, 0);
++ strscpy_check(test, "a", 3, 1, 1, 1, 1);
++ strscpy_check(test, "", 3, 0, 0, 1, 2);
+
+- tc(test, "abcd", 4, -E2BIG, 3, 1, 0);
+- tc(test, "abc", 4, 3, 3, 1, 0);
+- tc(test, "ab", 4, 2, 2, 1, 1);
+- tc(test, "a", 4, 1, 1, 1, 2);
+- tc(test, "", 4, 0, 0, 1, 3);
++ strscpy_check(test, "abcd", 4, -E2BIG, 3, 1, 0);
++ strscpy_check(test, "abc", 4, 3, 3, 1, 0);
++ strscpy_check(test, "ab", 4, 2, 2, 1, 1);
++ strscpy_check(test, "a", 4, 1, 1, 1, 2);
++ strscpy_check(test, "", 4, 0, 0, 1, 3);
+
+ /* Compile-time-known source strings. */
+ KUNIT_EXPECT_EQ(test, strscpy(dest, "", ARRAY_SIZE(dest)), 0);
+@@ -127,7 +128,7 @@ static void strscpy_test(struct kunit *test)
+ }
+
+ static struct kunit_case strscpy_test_cases[] = {
+- KUNIT_CASE(strscpy_test),
++ KUNIT_CASE(test_strscpy),
+ {}
+ };
+
+--
+2.43.0
+
--- /dev/null
+From c3b2bf825a15a665fe3d6f3a43d8a5e80bafa9b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Apr 2024 00:30:33 +0100
+Subject: string_kunit: Add test cases for str*cmp functions
+
+From: Ivan Orlov <ivan.orlov0322@gmail.com>
+
+[ Upstream commit 9259a4721699947ceb397037991c0e4acc496b21 ]
+
+Currently, str*cmp functions (strcmp, strncmp, strcasecmp and
+strncasecmp) are not covered with tests. Extend the `string_kunit.c`
+test by adding the test cases for them.
+
+This patch adds 8 more test cases:
+
+1) strcmp test
+2) strcmp test on long strings (2048 chars)
+3) strncmp test
+4) strncmp test on long strings (2048 chars)
+5) strcasecmp test
+6) strcasecmp test on long strings
+7) strncasecmp test
+8) strncasecmp test on long strings
+
+These test cases aim at covering as many edge cases as possible,
+including the tests on empty strings, situations when the different
+symbol is placed at the end of one of the strings, etc.
+
+Signed-off-by: Ivan Orlov <ivan.orlov0322@gmail.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Link: https://lore.kernel.org/r/20240417233033.717596-1-ivan.orlov0322@gmail.com
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Stable-dep-of: 5bb288c4abc2 ("scsi: mptfusion: Avoid possible run-time warning with long manufacturer strings")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/string_kunit.c | 155 +++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 155 insertions(+)
+
+diff --git a/lib/string_kunit.c b/lib/string_kunit.c
+index eabf025cf77c9..dd19bd7748aa2 100644
+--- a/lib/string_kunit.c
++++ b/lib/string_kunit.c
+@@ -11,6 +11,12 @@
+ #include <linux/slab.h>
+ #include <linux/string.h>
+
++#define STRCMP_LARGE_BUF_LEN 2048
++#define STRCMP_CHANGE_POINT 1337
++#define STRCMP_TEST_EXPECT_EQUAL(test, fn, ...) KUNIT_EXPECT_EQ(test, fn(__VA_ARGS__), 0)
++#define STRCMP_TEST_EXPECT_LOWER(test, fn, ...) KUNIT_EXPECT_LT(test, fn(__VA_ARGS__), 0)
++#define STRCMP_TEST_EXPECT_GREATER(test, fn, ...) KUNIT_EXPECT_GT(test, fn(__VA_ARGS__), 0)
++
+ static void test_memset16(struct kunit *test)
+ {
+ unsigned i, j, k;
+@@ -179,6 +185,147 @@ static void test_strspn(struct kunit *test)
+ }
+ }
+
++static char strcmp_buffer1[STRCMP_LARGE_BUF_LEN];
++static char strcmp_buffer2[STRCMP_LARGE_BUF_LEN];
++
++static void strcmp_fill_buffers(char fill1, char fill2)
++{
++ memset(strcmp_buffer1, fill1, STRCMP_LARGE_BUF_LEN);
++ memset(strcmp_buffer2, fill2, STRCMP_LARGE_BUF_LEN);
++ strcmp_buffer1[STRCMP_LARGE_BUF_LEN - 1] = 0;
++ strcmp_buffer2[STRCMP_LARGE_BUF_LEN - 1] = 0;
++}
++
++static void test_strcmp(struct kunit *test)
++{
++ /* Equal strings */
++ STRCMP_TEST_EXPECT_EQUAL(test, strcmp, "Hello, Kernel!", "Hello, Kernel!");
++ /* First string is lexicographically less than the second */
++ STRCMP_TEST_EXPECT_LOWER(test, strcmp, "Hello, KUnit!", "Hello, Kernel!");
++ /* First string is lexicographically larger than the second */
++ STRCMP_TEST_EXPECT_GREATER(test, strcmp, "Hello, Kernel!", "Hello, KUnit!");
++ /* Empty string is always lexicographically less than any non-empty string */
++ STRCMP_TEST_EXPECT_LOWER(test, strcmp, "", "Non-empty string");
++ /* Two empty strings should be equal */
++ STRCMP_TEST_EXPECT_EQUAL(test, strcmp, "", "");
++ /* Compare two strings which have only one char difference */
++ STRCMP_TEST_EXPECT_LOWER(test, strcmp, "Abacaba", "Abadaba");
++ /* Compare two strings which have the same prefix*/
++ STRCMP_TEST_EXPECT_LOWER(test, strcmp, "Just a string", "Just a string and something else");
++}
++
++static void test_strcmp_long_strings(struct kunit *test)
++{
++ strcmp_fill_buffers('B', 'B');
++ STRCMP_TEST_EXPECT_EQUAL(test, strcmp, strcmp_buffer1, strcmp_buffer2);
++
++ strcmp_buffer1[STRCMP_CHANGE_POINT] = 'A';
++ STRCMP_TEST_EXPECT_LOWER(test, strcmp, strcmp_buffer1, strcmp_buffer2);
++
++ strcmp_buffer1[STRCMP_CHANGE_POINT] = 'C';
++ STRCMP_TEST_EXPECT_GREATER(test, strcmp, strcmp_buffer1, strcmp_buffer2);
++}
++
++static void test_strncmp(struct kunit *test)
++{
++ /* Equal strings */
++ STRCMP_TEST_EXPECT_EQUAL(test, strncmp, "Hello, KUnit!", "Hello, KUnit!", 13);
++ /* First string is lexicographically less than the second */
++ STRCMP_TEST_EXPECT_LOWER(test, strncmp, "Hello, KUnit!", "Hello, Kernel!", 13);
++ /* Result is always 'equal' when count = 0 */
++ STRCMP_TEST_EXPECT_EQUAL(test, strncmp, "Hello, Kernel!", "Hello, KUnit!", 0);
++ /* Strings with common prefix are equal if count = length of prefix */
++ STRCMP_TEST_EXPECT_EQUAL(test, strncmp, "Abacaba", "Abadaba", 3);
++ /* Strings with common prefix are not equal when count = length of prefix + 1 */
++ STRCMP_TEST_EXPECT_LOWER(test, strncmp, "Abacaba", "Abadaba", 4);
++ /* If one string is a prefix of another, the shorter string is lexicographically smaller */
++ STRCMP_TEST_EXPECT_LOWER(test, strncmp, "Just a string", "Just a string and something else",
++ strlen("Just a string and something else"));
++ /*
++ * If one string is a prefix of another, and we check first length
++ * of prefix chars, the result is 'equal'
++ */
++ STRCMP_TEST_EXPECT_EQUAL(test, strncmp, "Just a string", "Just a string and something else",
++ strlen("Just a string"));
++}
++
++static void test_strncmp_long_strings(struct kunit *test)
++{
++ strcmp_fill_buffers('B', 'B');
++ STRCMP_TEST_EXPECT_EQUAL(test, strncmp, strcmp_buffer1,
++ strcmp_buffer2, STRCMP_LARGE_BUF_LEN);
++
++ strcmp_buffer1[STRCMP_CHANGE_POINT] = 'A';
++ STRCMP_TEST_EXPECT_LOWER(test, strncmp, strcmp_buffer1,
++ strcmp_buffer2, STRCMP_LARGE_BUF_LEN);
++
++ strcmp_buffer1[STRCMP_CHANGE_POINT] = 'C';
++ STRCMP_TEST_EXPECT_GREATER(test, strncmp, strcmp_buffer1,
++ strcmp_buffer2, STRCMP_LARGE_BUF_LEN);
++ /* the strings are equal up to STRCMP_CHANGE_POINT */
++ STRCMP_TEST_EXPECT_EQUAL(test, strncmp, strcmp_buffer1,
++ strcmp_buffer2, STRCMP_CHANGE_POINT);
++ STRCMP_TEST_EXPECT_GREATER(test, strncmp, strcmp_buffer1,
++ strcmp_buffer2, STRCMP_CHANGE_POINT + 1);
++}
++
++static void test_strcasecmp(struct kunit *test)
++{
++ /* Same strings in different case should be equal */
++ STRCMP_TEST_EXPECT_EQUAL(test, strcasecmp, "Hello, Kernel!", "HeLLO, KErNeL!");
++ /* Empty strings should be equal */
++ STRCMP_TEST_EXPECT_EQUAL(test, strcasecmp, "", "");
++ /* Despite ascii code for 'a' is larger than ascii code for 'B', 'a' < 'B' */
++ STRCMP_TEST_EXPECT_LOWER(test, strcasecmp, "a", "B");
++ STRCMP_TEST_EXPECT_GREATER(test, strcasecmp, "B", "a");
++ /* Special symbols and numbers should be processed correctly */
++ STRCMP_TEST_EXPECT_EQUAL(test, strcasecmp, "-+**.1230ghTTT~^", "-+**.1230Ghttt~^");
++}
++
++static void test_strcasecmp_long_strings(struct kunit *test)
++{
++ strcmp_fill_buffers('b', 'B');
++ STRCMP_TEST_EXPECT_EQUAL(test, strcasecmp, strcmp_buffer1, strcmp_buffer2);
++
++ strcmp_buffer1[STRCMP_CHANGE_POINT] = 'a';
++ STRCMP_TEST_EXPECT_LOWER(test, strcasecmp, strcmp_buffer1, strcmp_buffer2);
++
++ strcmp_buffer1[STRCMP_CHANGE_POINT] = 'C';
++ STRCMP_TEST_EXPECT_GREATER(test, strcasecmp, strcmp_buffer1, strcmp_buffer2);
++}
++
++static void test_strncasecmp(struct kunit *test)
++{
++ /* Same strings in different case should be equal */
++ STRCMP_TEST_EXPECT_EQUAL(test, strncasecmp, "AbAcAbA", "Abacaba", strlen("Abacaba"));
++ /* strncasecmp should check 'count' chars only */
++ STRCMP_TEST_EXPECT_EQUAL(test, strncasecmp, "AbaCaBa", "abaCaDa", 5);
++ STRCMP_TEST_EXPECT_LOWER(test, strncasecmp, "a", "B", 1);
++ STRCMP_TEST_EXPECT_GREATER(test, strncasecmp, "B", "a", 1);
++ /* Result is always 'equal' when count = 0 */
++ STRCMP_TEST_EXPECT_EQUAL(test, strncasecmp, "Abacaba", "Not abacaba", 0);
++}
++
++static void test_strncasecmp_long_strings(struct kunit *test)
++{
++ strcmp_fill_buffers('b', 'B');
++ STRCMP_TEST_EXPECT_EQUAL(test, strncasecmp, strcmp_buffer1,
++ strcmp_buffer2, STRCMP_LARGE_BUF_LEN);
++
++ strcmp_buffer1[STRCMP_CHANGE_POINT] = 'a';
++ STRCMP_TEST_EXPECT_LOWER(test, strncasecmp, strcmp_buffer1,
++ strcmp_buffer2, STRCMP_LARGE_BUF_LEN);
++
++ strcmp_buffer1[STRCMP_CHANGE_POINT] = 'C';
++ STRCMP_TEST_EXPECT_GREATER(test, strncasecmp, strcmp_buffer1,
++ strcmp_buffer2, STRCMP_LARGE_BUF_LEN);
++
++ STRCMP_TEST_EXPECT_EQUAL(test, strncasecmp, strcmp_buffer1,
++ strcmp_buffer2, STRCMP_CHANGE_POINT);
++ STRCMP_TEST_EXPECT_GREATER(test, strncasecmp, strcmp_buffer1,
++ strcmp_buffer2, STRCMP_CHANGE_POINT + 1);
++}
++
+ static struct kunit_case string_test_cases[] = {
+ KUNIT_CASE(test_memset16),
+ KUNIT_CASE(test_memset32),
+@@ -186,6 +333,14 @@ static struct kunit_case string_test_cases[] = {
+ KUNIT_CASE(test_strchr),
+ KUNIT_CASE(test_strnchr),
+ KUNIT_CASE(test_strspn),
++ KUNIT_CASE(test_strcmp),
++ KUNIT_CASE(test_strcmp_long_strings),
++ KUNIT_CASE(test_strncmp),
++ KUNIT_CASE(test_strncmp_long_strings),
++ KUNIT_CASE(test_strcasecmp),
++ KUNIT_CASE(test_strcasecmp_long_strings),
++ KUNIT_CASE(test_strncasecmp),
++ KUNIT_CASE(test_strncasecmp_long_strings),
+ {}
+ };
+
+--
+2.43.0
+
--- /dev/null
+From 32dc832323c04d9c1501f407989bd9d70a261d8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Apr 2024 13:49:38 +0300
+Subject: sunrpc: fix NFSACL RPC retry on soft mount
+
+From: Dan Aloni <dan.aloni@vastdata.com>
+
+[ Upstream commit 0dc9f430027b8bd9073fdafdfcdeb1a073ab5594 ]
+
+It used to be quite awhile ago since 1b63a75180c6 ('SUNRPC: Refactor
+rpc_clone_client()'), in 2012, that `cl_timeout` was copied in so that
+all mount parameters propagate to NFSACL clients. However since that
+change, if mount options as follows are given:
+
+ soft,timeo=50,retrans=16,vers=3
+
+The resultant NFSACL client receives:
+
+ cl_softrtry: 1
+ cl_timeout: to_initval=60000, to_maxval=60000, to_increment=0, to_retries=2, to_exponential=0
+
+These values lead to NFSACL operations not being retried under the
+condition of transient network outages with soft mount. Instead, getacl
+call fails after 60 seconds with EIO.
+
+The simple fix is to pass the existing client's `cl_timeout` as the new
+client timeout.
+
+Cc: Chuck Lever <chuck.lever@oracle.com>
+Cc: Benjamin Coddington <bcodding@redhat.com>
+Link: https://lore.kernel.org/all/20231105154857.ryakhmgaptq3hb6b@gmail.com/T/
+Fixes: 1b63a75180c6 ('SUNRPC: Refactor rpc_clone_client()')
+Signed-off-by: Dan Aloni <dan.aloni@vastdata.com>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/clnt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index 28f3749f6dc6c..59b2fbd88e5eb 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1071,6 +1071,7 @@ struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *old,
+ .authflavor = old->cl_auth->au_flavor,
+ .cred = old->cl_cred,
+ .stats = old->cl_stats,
++ .timeout = old->cl_timeout,
+ };
+ struct rpc_clnt *clnt;
+ int err;
+--
+2.43.0
+
--- /dev/null
+From 7f5bf2f0194552ce5821098c1a7e68b3a93b3e7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 May 2024 18:16:26 +0900
+Subject: tcp: Fix shift-out-of-bounds in dctcp_update_alpha().
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit 3ebc46ca8675de6378e3f8f40768e180bb8afa66 ]
+
+In dctcp_update_alpha(), we use a module parameter dctcp_shift_g
+as follows:
+
+ alpha -= min_not_zero(alpha, alpha >> dctcp_shift_g);
+ ...
+ delivered_ce <<= (10 - dctcp_shift_g);
+
+It seems syzkaller started fuzzing module parameters and triggered
+shift-out-of-bounds [0] by setting 100 to dctcp_shift_g:
+
+ memcpy((void*)0x20000080,
+ "/sys/module/tcp_dctcp/parameters/dctcp_shift_g\000", 47);
+ res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000080ul,
+ /*flags=*/2ul, /*mode=*/0ul);
+ memcpy((void*)0x20000000, "100\000", 4);
+ syscall(__NR_write, /*fd=*/r[0], /*val=*/0x20000000ul, /*len=*/4ul);
+
+Let's limit the max value of dctcp_shift_g by param_set_uint_minmax().
+
+With this patch:
+
+ # echo 10 > /sys/module/tcp_dctcp/parameters/dctcp_shift_g
+ # cat /sys/module/tcp_dctcp/parameters/dctcp_shift_g
+ 10
+ # echo 11 > /sys/module/tcp_dctcp/parameters/dctcp_shift_g
+ -bash: echo: write error: Invalid argument
+
+[0]:
+UBSAN: shift-out-of-bounds in net/ipv4/tcp_dctcp.c:143:12
+shift exponent 100 is too large for 32-bit type 'u32' (aka 'unsigned int')
+CPU: 0 PID: 8083 Comm: syz-executor345 Not tainted 6.9.0-05151-g1b294a1f3561 #2
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
+1.13.0-1ubuntu1.1 04/01/2014
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ dump_stack_lvl+0x201/0x300 lib/dump_stack.c:114
+ ubsan_epilogue lib/ubsan.c:231 [inline]
+ __ubsan_handle_shift_out_of_bounds+0x346/0x3a0 lib/ubsan.c:468
+ dctcp_update_alpha+0x540/0x570 net/ipv4/tcp_dctcp.c:143
+ tcp_in_ack_event net/ipv4/tcp_input.c:3802 [inline]
+ tcp_ack+0x17b1/0x3bc0 net/ipv4/tcp_input.c:3948
+ tcp_rcv_state_process+0x57a/0x2290 net/ipv4/tcp_input.c:6711
+ tcp_v4_do_rcv+0x764/0xc40 net/ipv4/tcp_ipv4.c:1937
+ sk_backlog_rcv include/net/sock.h:1106 [inline]
+ __release_sock+0x20f/0x350 net/core/sock.c:2983
+ release_sock+0x61/0x1f0 net/core/sock.c:3549
+ mptcp_subflow_shutdown+0x3d0/0x620 net/mptcp/protocol.c:2907
+ mptcp_check_send_data_fin+0x225/0x410 net/mptcp/protocol.c:2976
+ __mptcp_close+0x238/0xad0 net/mptcp/protocol.c:3072
+ mptcp_close+0x2a/0x1a0 net/mptcp/protocol.c:3127
+ inet_release+0x190/0x1f0 net/ipv4/af_inet.c:437
+ __sock_release net/socket.c:659 [inline]
+ sock_close+0xc0/0x240 net/socket.c:1421
+ __fput+0x41b/0x890 fs/file_table.c:422
+ task_work_run+0x23b/0x300 kernel/task_work.c:180
+ exit_task_work include/linux/task_work.h:38 [inline]
+ do_exit+0x9c8/0x2540 kernel/exit.c:878
+ do_group_exit+0x201/0x2b0 kernel/exit.c:1027
+ __do_sys_exit_group kernel/exit.c:1038 [inline]
+ __se_sys_exit_group kernel/exit.c:1036 [inline]
+ __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1036
+ do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+ do_syscall_64+0xe4/0x240 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x67/0x6f
+RIP: 0033:0x7f6c2b5005b6
+Code: Unable to access opcode bytes at 0x7f6c2b50058c.
+RSP: 002b:00007ffe883eb948 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
+RAX: ffffffffffffffda RBX: 00007f6c2b5862f0 RCX: 00007f6c2b5005b6
+RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001
+RBP: 0000000000000001 R08: 00000000000000e7 R09: ffffffffffffffc0
+R10: 0000000000000006 R11: 0000000000000246 R12: 00007f6c2b5862f0
+R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
+ </TASK>
+
+Reported-by: syzkaller <syzkaller@googlegroups.com>
+Reported-by: Yue Sun <samsun1006219@gmail.com>
+Reported-by: xingwei lee <xrivendell7@gmail.com>
+Closes: https://lore.kernel.org/netdev/CAEkJfYNJM=cw-8x7_Vmj1J6uYVCWMbbvD=EFmDPVBGpTsqOxEA@mail.gmail.com/
+Fixes: e3118e8359bb ("net: tcp: add DCTCP congestion control algorithm")
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://lore.kernel.org/r/20240517091626.32772-1-kuniyu@amazon.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_dctcp.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c
+index e33fbe4933e42..b004280855f87 100644
+--- a/net/ipv4/tcp_dctcp.c
++++ b/net/ipv4/tcp_dctcp.c
+@@ -58,7 +58,18 @@ struct dctcp {
+ };
+
+ static unsigned int dctcp_shift_g __read_mostly = 4; /* g = 1/2^4 */
+-module_param(dctcp_shift_g, uint, 0644);
++
++static int dctcp_shift_g_set(const char *val, const struct kernel_param *kp)
++{
++ return param_set_uint_minmax(val, kp, 0, 10);
++}
++
++static const struct kernel_param_ops dctcp_shift_g_ops = {
++ .set = dctcp_shift_g_set,
++ .get = param_get_uint,
++};
++
++module_param_cb(dctcp_shift_g, &dctcp_shift_g_ops, &dctcp_shift_g, 0644);
+ MODULE_PARM_DESC(dctcp_shift_g, "parameter g for updating dctcp_alpha");
+
+ static unsigned int dctcp_alpha_on_init __read_mostly = DCTCP_MAX_ALPHA;
+--
+2.43.0
+
--- /dev/null
+From 60a7bcc7a2afccc4f028031313d60907cbba4321 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2024 21:42:20 +0800
+Subject: tcp: remove 64 KByte limit for initial tp->rcv_wnd value
+
+From: Jason Xing <kernelxing@tencent.com>
+
+[ Upstream commit 378979e94e953c2070acb4f0e0c98d29260bd09d ]
+
+Recently, we had some servers upgraded to the latest kernel and noticed
+the indicator from the user side showed worse results than before. It is
+caused by the limitation of tp->rcv_wnd.
+
+In 2018 commit a337531b942b ("tcp: up initial rmem to 128KB and SYN rwin
+to around 64KB") limited the initial value of tp->rcv_wnd to 65535, most
+CDN teams would not benefit from this change because they cannot have a
+large window to receive a big packet, which will be slowed down especially
+in long RTT. Small rcv_wnd means slow transfer speed, to some extent. It's
+the side effect for the latency/time-sensitive users.
+
+To avoid future confusion, current change doesn't affect the initial
+receive window on the wire in a SYN or SYN+ACK packet which are set within
+65535 bytes according to RFC 7323 also due to the limit in
+__tcp_transmit_skb():
+
+ th->window = htons(min(tp->rcv_wnd, 65535U));
+
+In one word, __tcp_transmit_skb() already ensures that constraint is
+respected, no matter how large tp->rcv_wnd is. The change doesn't violate
+RFC.
+
+Let me provide one example if with or without the patch:
+Before:
+client --- SYN: rwindow=65535 ---> server
+client <--- SYN+ACK: rwindow=65535 ---- server
+client --- ACK: rwindow=65536 ---> server
+Note: for the last ACK, the calculation is 512 << 7.
+
+After:
+client --- SYN: rwindow=65535 ---> server
+client <--- SYN+ACK: rwindow=65535 ---- server
+client --- ACK: rwindow=175232 ---> server
+Note: I use the following command to make it work:
+ip route change default via [ip] dev eth0 metric 100 initrwnd 120
+For the last ACK, the calculation is 1369 << 7.
+
+When we apply such a patch, having a large rcv_wnd if the user tweak this
+knob can help transfer data more rapidly and save some rtts.
+
+Fixes: a337531b942b ("tcp: up initial rmem to 128KB and SYN rwin to around 64KB")
+Signed-off-by: Jason Xing <kernelxing@tencent.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+Link: https://lore.kernel.org/r/20240521134220.12510-1-kerneljasonxing@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_output.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 02caeb7bcf634..16ef24a37c498 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -229,7 +229,7 @@ void tcp_select_initial_window(const struct sock *sk, int __space, __u32 mss,
+ if (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_workaround_signed_windows))
+ (*rcv_wnd) = min(space, MAX_TCP_WINDOW);
+ else
+- (*rcv_wnd) = min_t(u32, space, U16_MAX);
++ (*rcv_wnd) = space;
+
+ if (init_rcv_wnd)
+ *rcv_wnd = min(*rcv_wnd, init_rcv_wnd * mss);
+--
+2.43.0
+
--- /dev/null
+From 03064f30334e5d3b585f8b33d748d8d43dbdccef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2024 19:34:38 +0900
+Subject: tls: fix missing memory barrier in tls_init
+
+From: Dae R. Jeong <threeearcat@gmail.com>
+
+[ Upstream commit 91e61dd7a0af660408e87372d8330ceb218be302 ]
+
+In tls_init(), a write memory barrier is missing, and store-store
+reordering may cause NULL dereference in tls_{setsockopt,getsockopt}.
+
+CPU0 CPU1
+----- -----
+// In tls_init()
+// In tls_ctx_create()
+ctx = kzalloc()
+ctx->sk_proto = READ_ONCE(sk->sk_prot) -(1)
+
+// In update_sk_prot()
+WRITE_ONCE(sk->sk_prot, tls_prots) -(2)
+
+ // In sock_common_setsockopt()
+ READ_ONCE(sk->sk_prot)->setsockopt()
+
+ // In tls_{setsockopt,getsockopt}()
+ ctx->sk_proto->setsockopt() -(3)
+
+In the above scenario, when (1) and (2) are reordered, (3) can observe
+the NULL value of ctx->sk_proto, causing NULL dereference.
+
+To fix it, we rely on rcu_assign_pointer() which implies the release
+barrier semantic. By moving rcu_assign_pointer() after ctx->sk_proto is
+initialized, we can ensure that ctx->sk_proto are visible when
+changing sk->sk_prot.
+
+Fixes: d5bee7374b68 ("net/tls: Annotate access to sk_prot with READ_ONCE/WRITE_ONCE")
+Signed-off-by: Yewon Choi <woni9911@gmail.com>
+Signed-off-by: Dae R. Jeong <threeearcat@gmail.com>
+Link: https://lore.kernel.org/netdev/ZU4OJG56g2V9z_H7@dragonet/T/
+Link: https://lore.kernel.org/r/Zkx4vjSFp0mfpjQ2@libra05
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_main.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
+index b4674f03d71a9..90b7f253d3632 100644
+--- a/net/tls/tls_main.c
++++ b/net/tls/tls_main.c
+@@ -816,9 +816,17 @@ struct tls_context *tls_ctx_create(struct sock *sk)
+ return NULL;
+
+ mutex_init(&ctx->tx_lock);
+- rcu_assign_pointer(icsk->icsk_ulp_data, ctx);
+ ctx->sk_proto = READ_ONCE(sk->sk_prot);
+ ctx->sk = sk;
++ /* Release semantic of rcu_assign_pointer() ensures that
++ * ctx->sk_proto is visible before changing sk->sk_prot in
++ * update_sk_prot(), and prevents reading uninitialized value in
++ * tls_{getsockopt, setsockopt}. Note that we do not need a
++ * read barrier in tls_{getsockopt,setsockopt} as there is an
++ * address dependency between sk->sk_proto->{getsockopt,setsockopt}
++ * and ctx->sk_proto.
++ */
++ rcu_assign_pointer(icsk->icsk_ulp_data, ctx);
+ return ctx;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From ed38350d85d25239ba9e115b65001622826530ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Apr 2024 19:58:52 -0700
+Subject: tools/arch/x86/intel_sdsi: Fix maximum meter bundle length
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David E. Box <david.e.box@linux.intel.com>
+
+[ Upstream commit a66f962f67ebbbdf7c82c6652180930c0169cf13 ]
+
+The maximum number of bundles in the meter certificate was set to 8 which
+is much less than the maximum. Instead, since the bundles appear at the end
+of the file, set it based on the remaining file size from the bundle start
+position.
+
+Fixes: 7fdc03a7370f ("tools/arch/x86: intel_sdsi: Add support for reading meter certificates")
+Signed-off-by: David E. Box <david.e.box@linux.intel.com>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Link: https://lore.kernel.org/r/20240411025856.2782476-6-david.e.box@linux.intel.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/arch/x86/intel_sdsi/intel_sdsi.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/tools/arch/x86/intel_sdsi/intel_sdsi.c b/tools/arch/x86/intel_sdsi/intel_sdsi.c
+index 2cd92761f1714..7eaffcbff788c 100644
+--- a/tools/arch/x86/intel_sdsi/intel_sdsi.c
++++ b/tools/arch/x86/intel_sdsi/intel_sdsi.c
+@@ -43,7 +43,6 @@
+ #define METER_CERT_MAX_SIZE 4096
+ #define STATE_MAX_NUM_LICENSES 16
+ #define STATE_MAX_NUM_IN_BUNDLE (uint32_t)8
+-#define METER_MAX_NUM_BUNDLES 8
+
+ #define __round_mask(x, y) ((__typeof__(x))((y) - 1))
+ #define round_up(x, y) ((((x) - 1) | __round_mask(x, y)) + 1)
+@@ -167,6 +166,11 @@ struct bundle_encoding_counter {
+ uint32_t encoding;
+ uint32_t counter;
+ };
++#define METER_BUNDLE_SIZE sizeof(struct bundle_encoding_counter)
++#define BUNDLE_COUNT(length) ((length) / METER_BUNDLE_SIZE)
++#define METER_MAX_NUM_BUNDLES \
++ ((METER_CERT_MAX_SIZE - sizeof(struct meter_certificate)) / \
++ sizeof(struct bundle_encoding_counter))
+
+ struct sdsi_dev {
+ struct sdsi_regs regs;
+@@ -386,9 +390,9 @@ static int sdsi_meter_cert_show(struct sdsi_dev *s)
+ return -1;
+ }
+
+- if (mc->bundle_length > METER_MAX_NUM_BUNDLES * 8) {
+- fprintf(stderr, "More than %d bundles: %d\n",
+- METER_MAX_NUM_BUNDLES, mc->bundle_length / 8);
++ if (mc->bundle_length > METER_MAX_NUM_BUNDLES * METER_BUNDLE_SIZE) {
++ fprintf(stderr, "More than %ld bundles: actual %ld\n",
++ METER_MAX_NUM_BUNDLES, BUNDLE_COUNT(mc->bundle_length));
+ return -1;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From d39b5765aad126262a8a18554321780f2ea6ed7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Apr 2024 19:58:54 -0700
+Subject: tools/arch/x86/intel_sdsi: Fix meter_certificate decoding
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David E. Box <david.e.box@linux.intel.com>
+
+[ Upstream commit 09d70ded6c566fd00886be32c26d0b2004ef239c ]
+
+Fix errors in the calculation of the start position of the counters and in
+the display loop. While here, use a #define for the bundle count and size.
+
+Fixes: 7fdc03a7370f ("tools/arch/x86: intel_sdsi: Add support for reading meter certificates")
+Signed-off-by: David E. Box <david.e.box@linux.intel.com>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Link: https://lore.kernel.org/r/20240411025856.2782476-8-david.e.box@linux.intel.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/arch/x86/intel_sdsi/intel_sdsi.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/tools/arch/x86/intel_sdsi/intel_sdsi.c b/tools/arch/x86/intel_sdsi/intel_sdsi.c
+index ae29214da1029..ba2a6b6645ae8 100644
+--- a/tools/arch/x86/intel_sdsi/intel_sdsi.c
++++ b/tools/arch/x86/intel_sdsi/intel_sdsi.c
+@@ -394,7 +394,7 @@ static int sdsi_meter_cert_show(struct sdsi_dev *s)
+ printf("MMRC encoding: %.4s\n", name);
+
+ printf("MMRC counter: %d\n", mc->mmrc_counter);
+- if (mc->bundle_length % 8) {
++ if (mc->bundle_length % METER_BUNDLE_SIZE) {
+ fprintf(stderr, "Invalid bundle length\n");
+ return -1;
+ }
+@@ -405,15 +405,16 @@ static int sdsi_meter_cert_show(struct sdsi_dev *s)
+ return -1;
+ }
+
+- bec = (void *)(mc) + sizeof(mc);
++ bec = (struct bundle_encoding_counter *)(mc + 1);
+
+ printf("Number of Feature Counters: %ld\n", BUNDLE_COUNT(mc->bundle_length));
+- while (count++ < mc->bundle_length / 8) {
++ while (count < BUNDLE_COUNT(mc->bundle_length)) {
+ char feature[5];
+
+ feature[4] = '\0';
+ get_feature(bec[count].encoding, feature);
+ printf(" %s: %d\n", feature, bec[count].counter);
++ ++count;
+ }
+
+ return 0;
+--
+2.43.0
+
--- /dev/null
+From a04170938ebc3e230e0248c278425d56bd3ed257 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Apr 2024 19:58:53 -0700
+Subject: tools/arch/x86/intel_sdsi: Fix meter_show display
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David E. Box <david.e.box@linux.intel.com>
+
+[ Upstream commit 76f2bc17428c890754d11aa6aea14b332ba130c5 ]
+
+Fixes sdsi_meter_cert_show() to correctly decode and display the meter
+certificate output. Adds and displays a missing version field, displays the
+ASCII name of the signature, and fixes the print alignment.
+
+Fixes: 7fdc03a7370f ("tools/arch/x86: intel_sdsi: Add support for reading meter certificates")
+Signed-off-by: David E. Box <david.e.box@linux.intel.com>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Link: https://lore.kernel.org/r/20240411025856.2782476-7-david.e.box@linux.intel.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/arch/x86/intel_sdsi/intel_sdsi.c | 29 +++++++++++++++++---------
+ 1 file changed, 19 insertions(+), 10 deletions(-)
+
+diff --git a/tools/arch/x86/intel_sdsi/intel_sdsi.c b/tools/arch/x86/intel_sdsi/intel_sdsi.c
+index 7eaffcbff788c..ae29214da1029 100644
+--- a/tools/arch/x86/intel_sdsi/intel_sdsi.c
++++ b/tools/arch/x86/intel_sdsi/intel_sdsi.c
+@@ -153,11 +153,12 @@ struct bundle_encoding {
+ };
+
+ struct meter_certificate {
+- uint32_t block_signature;
+- uint32_t counter_unit;
++ uint32_t signature;
++ uint32_t version;
+ uint64_t ppin;
++ uint32_t counter_unit;
+ uint32_t bundle_length;
+- uint32_t reserved;
++ uint64_t reserved;
+ uint32_t mmrc_encoding;
+ uint32_t mmrc_counter;
+ };
+@@ -338,6 +339,7 @@ static int sdsi_meter_cert_show(struct sdsi_dev *s)
+ uint32_t count = 0;
+ FILE *cert_ptr;
+ int ret, size;
++ char name[4];
+
+ ret = sdsi_update_registers(s);
+ if (ret)
+@@ -379,12 +381,19 @@ static int sdsi_meter_cert_show(struct sdsi_dev *s)
+ printf("\n");
+ printf("Meter certificate for device %s\n", s->dev_name);
+ printf("\n");
+- printf("Block Signature: 0x%x\n", mc->block_signature);
+- printf("Count Unit: %dms\n", mc->counter_unit);
+- printf("PPIN: 0x%lx\n", mc->ppin);
+- printf("Feature Bundle Length: %d\n", mc->bundle_length);
+- printf("MMRC encoding: %d\n", mc->mmrc_encoding);
+- printf("MMRC counter: %d\n", mc->mmrc_counter);
++
++ get_feature(mc->signature, name);
++ printf("Signature: %.4s\n", name);
++
++ printf("Version: %d\n", mc->version);
++ printf("Count Unit: %dms\n", mc->counter_unit);
++ printf("PPIN: 0x%lx\n", mc->ppin);
++ printf("Feature Bundle Length: %d\n", mc->bundle_length);
++
++ get_feature(mc->mmrc_encoding, name);
++ printf("MMRC encoding: %.4s\n", name);
++
++ printf("MMRC counter: %d\n", mc->mmrc_counter);
+ if (mc->bundle_length % 8) {
+ fprintf(stderr, "Invalid bundle length\n");
+ return -1;
+@@ -398,7 +407,7 @@ static int sdsi_meter_cert_show(struct sdsi_dev *s)
+
+ bec = (void *)(mc) + sizeof(mc);
+
+- printf("Number of Feature Counters: %d\n", mc->bundle_length / 8);
++ printf("Number of Feature Counters: %ld\n", BUNDLE_COUNT(mc->bundle_length));
+ while (count++ < mc->bundle_length / 8) {
+ char feature[5];
+
+--
+2.43.0
+
--- /dev/null
+From cfe71aa3d4babf30fb467c45b31309bdd13bbd60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 May 2024 15:06:40 +0300
+Subject: tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer
+ buffer
+
+From: Matthew R. Ochs <mochs@nvidia.com>
+
+[ Upstream commit 195aba96b854dd664768f382cd1db375d8181f88 ]
+
+The TPM SPI transfer mechanism uses MAX_SPI_FRAMESIZE for computing the
+maximum transfer length and the size of the transfer buffer. As such, it
+does not account for the 4 bytes of header that prepends the SPI data
+frame. This can result in out-of-bounds accesses and was confirmed with
+KASAN.
+
+Introduce SPI_HDRSIZE to account for the header and use to allocate the
+transfer buffer.
+
+Fixes: a86a42ac2bd6 ("tpm_tis_spi: Add hardware wait polling")
+Signed-off-by: Matthew R. Ochs <mochs@nvidia.com>
+Tested-by: Carol Soto <csoto@nvidia.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_spi_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_spi_main.c b/drivers/char/tpm/tpm_tis_spi_main.c
+index 3f9eaf27b41b8..c9eca24bbad47 100644
+--- a/drivers/char/tpm/tpm_tis_spi_main.c
++++ b/drivers/char/tpm/tpm_tis_spi_main.c
+@@ -37,6 +37,7 @@
+ #include "tpm_tis_spi.h"
+
+ #define MAX_SPI_FRAMESIZE 64
++#define SPI_HDRSIZE 4
+
+ /*
+ * TCG SPI flow control is documented in section 6.4 of the spec[1]. In short,
+@@ -247,7 +248,7 @@ static int tpm_tis_spi_write_bytes(struct tpm_tis_data *data, u32 addr,
+ int tpm_tis_spi_init(struct spi_device *spi, struct tpm_tis_spi_phy *phy,
+ int irq, const struct tpm_tis_phy_ops *phy_ops)
+ {
+- phy->iobuf = devm_kmalloc(&spi->dev, MAX_SPI_FRAMESIZE, GFP_KERNEL);
++ phy->iobuf = devm_kmalloc(&spi->dev, SPI_HDRSIZE + MAX_SPI_FRAMESIZE, GFP_KERNEL);
+ if (!phy->iobuf)
+ return -ENOMEM;
+
+--
+2.43.0
+
--- /dev/null
+From a79bc93d66201215774c9c98be203233eb57d1ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 May 2024 11:43:52 +0200
+Subject: tracing/probes: fix error check in parse_btf_field()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Carlos López <clopez@suse.de>
+
+[ Upstream commit e569eb34970281438e2b48a3ef11c87459fcfbcb ]
+
+btf_find_struct_member() might return NULL or an error via the
+ERR_PTR() macro. However, its caller in parse_btf_field() only checks
+for the NULL condition. Fix this by using IS_ERR() and returning the
+error up the stack.
+
+Link: https://lore.kernel.org/all/20240527094351.15687-1-clopez@suse.de/
+
+Fixes: c440adfbe3025 ("tracing/probes: Support BTF based data structure field access")
+Signed-off-by: Carlos López <clopez@suse.de>
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_probe.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
+index 42bc0f3622263..1a7e7cf944938 100644
+--- a/kernel/trace/trace_probe.c
++++ b/kernel/trace/trace_probe.c
+@@ -553,6 +553,10 @@ static int parse_btf_field(char *fieldname, const struct btf_type *type,
+ anon_offs = 0;
+ field = btf_find_struct_member(ctx->btf, type, fieldname,
+ &anon_offs);
++ if (IS_ERR(field)) {
++ trace_probe_log_err(ctx->offset, BAD_BTF_TID);
++ return PTR_ERR(field);
++ }
+ if (!field) {
+ trace_probe_log_err(ctx->offset, NO_BTF_FIELD);
+ return -ENOENT;
+--
+2.43.0
+
--- /dev/null
+From f6171c217cb107bf59794997674d736847819da5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 May 2024 16:37:48 -0700
+Subject: ubsan: Restore dependency on ARCH_HAS_UBSAN
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 890a64810d59b1a58ed26efc28cfd821fc068e84 ]
+
+While removing CONFIG_UBSAN_SANITIZE_ALL, ARCH_HAS_UBSAN wasn't correctly
+depended on. Restore this, as we do not want to attempt UBSAN builds
+unless it's actually been tested on a given architecture.
+
+Reported-by: Masahiro Yamada <masahiroy@kernel.org>
+Closes: https://lore.kernel.org/all/20240514095427.541201-1-masahiroy@kernel.org
+Fixes: 918327e9b7ff ("ubsan: Remove CONFIG_UBSAN_SANITIZE_ALL")
+Link: https://lore.kernel.org/r/20240514233747.work.441-kees@kernel.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/Kconfig.ubsan | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/Kconfig.ubsan b/lib/Kconfig.ubsan
+index e81e1ac4a919b..bdda600f8dfbe 100644
+--- a/lib/Kconfig.ubsan
++++ b/lib/Kconfig.ubsan
+@@ -4,6 +4,7 @@ config ARCH_HAS_UBSAN
+
+ menuconfig UBSAN
+ bool "Undefined behaviour sanity checker"
++ depends on ARCH_HAS_UBSAN
+ help
+ This option enables the Undefined Behaviour sanity checker.
+ Compile-time instrumentation is used to detect various undefined
+--
+2.43.0
+
--- /dev/null
+From 7c71168ba1f93c6ea2c111e2e5a16073d7624dc3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 11:49:26 +0100
+Subject: um: Add winch to winch_handlers before registering winch IRQ
+
+From: Roberto Sassu <roberto.sassu@huawei.com>
+
+[ Upstream commit a0fbbd36c156b9f7b2276871d499c9943dfe5101 ]
+
+Registering a winch IRQ is racy, an interrupt may occur before the winch is
+added to the winch_handlers list.
+
+If that happens, register_winch_irq() adds to that list a winch that is
+scheduled to be (or has already been) freed, causing a panic later in
+winch_cleanup().
+
+Avoid the race by adding the winch to the winch_handlers list before
+registering the IRQ, and rolling back if um_request_irq() fails.
+
+Fixes: 42a359e31a0e ("uml: SIGIO support cleanup")
+Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
+Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/drivers/line.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c
+index ffc5cb92fa367..d82bc3fdb86e7 100644
+--- a/arch/um/drivers/line.c
++++ b/arch/um/drivers/line.c
+@@ -676,24 +676,26 @@ void register_winch_irq(int fd, int tty_fd, int pid, struct tty_port *port,
+ goto cleanup;
+ }
+
+- *winch = ((struct winch) { .list = LIST_HEAD_INIT(winch->list),
+- .fd = fd,
++ *winch = ((struct winch) { .fd = fd,
+ .tty_fd = tty_fd,
+ .pid = pid,
+ .port = port,
+ .stack = stack });
+
++ spin_lock(&winch_handler_lock);
++ list_add(&winch->list, &winch_handlers);
++ spin_unlock(&winch_handler_lock);
++
+ if (um_request_irq(WINCH_IRQ, fd, IRQ_READ, winch_interrupt,
+ IRQF_SHARED, "winch", winch) < 0) {
+ printk(KERN_ERR "register_winch_irq - failed to register "
+ "IRQ\n");
++ spin_lock(&winch_handler_lock);
++ list_del(&winch->list);
++ spin_unlock(&winch_handler_lock);
+ goto out_free;
+ }
+
+- spin_lock(&winch_handler_lock);
+- list_add(&winch->list, &winch_handlers);
+- spin_unlock(&winch_handler_lock);
+-
+ return;
+
+ out_free:
+--
+2.43.0
+
--- /dev/null
+From d7bb0d1a7ccc2149a1bb8c9d4643629859f8cc65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Mar 2024 17:12:59 +0800
+Subject: um: Fix return value in ubd_init()
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit 31a5990ed253a66712d7ddc29c92d297a991fdf2 ]
+
+When kmalloc_array() fails to allocate memory, the ubd_init()
+should return -ENOMEM instead of -1. So, fix it.
+
+Fixes: f88f0bdfc32f ("um: UBD Improvements")
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/drivers/ubd_kern.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
+index 63fc062add708..ef805eaa9e013 100644
+--- a/arch/um/drivers/ubd_kern.c
++++ b/arch/um/drivers/ubd_kern.c
+@@ -1092,7 +1092,7 @@ static int __init ubd_init(void)
+
+ if (irq_req_buffer == NULL) {
+ printk(KERN_ERR "Failed to initialize ubd buffering\n");
+- return -1;
++ return -ENOMEM;
+ }
+ io_req_buffer = kmalloc_array(UBD_REQ_BUFFER_SIZE,
+ sizeof(struct io_thread_req *),
+@@ -1103,7 +1103,7 @@ static int __init ubd_init(void)
+
+ if (io_req_buffer == NULL) {
+ printk(KERN_ERR "Failed to initialize ubd buffering\n");
+- return -1;
++ return -ENOMEM;
+ }
+ platform_driver_register(&ubd_driver);
+ mutex_lock(&ubd_lock);
+--
+2.43.0
+
--- /dev/null
+From 98fc981981fa1fecd845db4634caccc8343a07b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Apr 2024 20:58:55 +0800
+Subject: um: Fix the declaration of kasan_map_memory
+
+From: Tiwei Bie <tiwei.btw@antgroup.com>
+
+[ Upstream commit 6a85e34c4d07d2ec0c153067baff338ac0db55ca ]
+
+Make it match its definition (size_t vs unsigned long). And declare
+it in a shared header to fix the -Wmissing-prototypes warning, as it
+is defined in the user code and called in the kernel code.
+
+Fixes: 5b301409e8bc ("UML: add support for KASAN under x86_64")
+Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/include/asm/kasan.h | 1 -
+ arch/um/include/shared/kern_util.h | 2 ++
+ arch/um/os-Linux/mem.c | 1 +
+ 3 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/um/include/asm/kasan.h b/arch/um/include/asm/kasan.h
+index 0d6547f4ec85c..f97bb1f7b8514 100644
+--- a/arch/um/include/asm/kasan.h
++++ b/arch/um/include/asm/kasan.h
+@@ -24,7 +24,6 @@
+
+ #ifdef CONFIG_KASAN
+ void kasan_init(void);
+-void kasan_map_memory(void *start, unsigned long len);
+ extern int kasan_um_is_ready;
+
+ #ifdef CONFIG_STATIC_LINK
+diff --git a/arch/um/include/shared/kern_util.h b/arch/um/include/shared/kern_util.h
+index 789b83013f355..af8cdfc75897e 100644
+--- a/arch/um/include/shared/kern_util.h
++++ b/arch/um/include/shared/kern_util.h
+@@ -66,4 +66,6 @@ extern void fatal_sigsegv(void) __attribute__ ((noreturn));
+
+ void um_idle_sleep(void);
+
++void kasan_map_memory(void *start, size_t len);
++
+ #endif
+diff --git a/arch/um/os-Linux/mem.c b/arch/um/os-Linux/mem.c
+index 8530b2e086049..c6c9495b14321 100644
+--- a/arch/um/os-Linux/mem.c
++++ b/arch/um/os-Linux/mem.c
+@@ -15,6 +15,7 @@
+ #include <sys/vfs.h>
+ #include <linux/magic.h>
+ #include <init.h>
++#include <kern_util.h>
+ #include <os.h>
+
+ /*
+--
+2.43.0
+
--- /dev/null
+From f7f7a5642cb5fa38ec7bf3b2fce43a9cacca36d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Apr 2024 20:58:53 +0800
+Subject: um: Fix the -Wmissing-prototypes warning for __switch_mm
+
+From: Tiwei Bie <tiwei.btw@antgroup.com>
+
+[ Upstream commit 2cbade17b18c0f0fd9963f26c9fc9b057eb1cb3a ]
+
+The __switch_mm function is defined in the user code, and is called
+by the kernel code. It should be declared in a shared header.
+
+Fixes: 4dc706c2f292 ("um: take um_mmu.h to asm/mmu.h, clean asm/mmu_context.h a bit")
+Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/include/asm/mmu.h | 2 --
+ arch/um/include/shared/skas/mm_id.h | 2 ++
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/um/include/asm/mmu.h b/arch/um/include/asm/mmu.h
+index a7555e43ed14a..f2923c767bb9a 100644
+--- a/arch/um/include/asm/mmu.h
++++ b/arch/um/include/asm/mmu.h
+@@ -14,8 +14,6 @@ typedef struct mm_context {
+ struct uml_arch_mm_context arch;
+ } mm_context_t;
+
+-extern void __switch_mm(struct mm_id * mm_idp);
+-
+ /* Avoid tangled inclusion with asm/ldt.h */
+ extern long init_new_ldt(struct mm_context *to_mm, struct mm_context *from_mm);
+ extern void free_ldt(struct mm_context *mm);
+diff --git a/arch/um/include/shared/skas/mm_id.h b/arch/um/include/shared/skas/mm_id.h
+index e82e203f5f419..92dbf727e3842 100644
+--- a/arch/um/include/shared/skas/mm_id.h
++++ b/arch/um/include/shared/skas/mm_id.h
+@@ -15,4 +15,6 @@ struct mm_id {
+ int kill;
+ };
+
++void __switch_mm(struct mm_id *mm_idp);
++
+ #endif
+--
+2.43.0
+
--- /dev/null
+From 65953c0a00030863924da3e2361c09afeff13615 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Apr 2024 20:58:54 +0800
+Subject: um: Fix the -Wmissing-prototypes warning for get_thread_reg
+
+From: Tiwei Bie <tiwei.btw@antgroup.com>
+
+[ Upstream commit 3144013e48f4f6e5127223c4ebc488016815dedb ]
+
+The get_thread_reg function is defined in the user code, and is
+called by the kernel code. It should be declared in a shared header.
+
+Fixes: dbba7f704aa0 ("um: stop polluting the namespace with registers.h contents")
+Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/include/asm/processor-generic.h | 1 -
+ arch/x86/um/shared/sysdep/archsetjmp.h | 7 +++++++
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/arch/um/include/asm/processor-generic.h b/arch/um/include/asm/processor-generic.h
+index 6c3779541845b..5a7c05275aa74 100644
+--- a/arch/um/include/asm/processor-generic.h
++++ b/arch/um/include/asm/processor-generic.h
+@@ -94,7 +94,6 @@ extern struct cpuinfo_um boot_cpu_data;
+ #define current_cpu_data boot_cpu_data
+ #define cache_line_size() (boot_cpu_data.cache_alignment)
+
+-extern unsigned long get_thread_reg(int reg, jmp_buf *buf);
+ #define KSTK_REG(tsk, reg) get_thread_reg(reg, &tsk->thread.switch_buf)
+ extern unsigned long __get_wchan(struct task_struct *p);
+
+diff --git a/arch/x86/um/shared/sysdep/archsetjmp.h b/arch/x86/um/shared/sysdep/archsetjmp.h
+index 166cedbab9266..8c81d1a604a94 100644
+--- a/arch/x86/um/shared/sysdep/archsetjmp.h
++++ b/arch/x86/um/shared/sysdep/archsetjmp.h
+@@ -1,6 +1,13 @@
+ /* SPDX-License-Identifier: GPL-2.0 */
++#ifndef __X86_UM_SYSDEP_ARCHSETJMP_H
++#define __X86_UM_SYSDEP_ARCHSETJMP_H
++
+ #ifdef __i386__
+ #include "archsetjmp_32.h"
+ #else
+ #include "archsetjmp_64.h"
+ #endif
++
++unsigned long get_thread_reg(int reg, jmp_buf *buf);
++
++#endif /* __X86_UM_SYSDEP_ARCHSETJMP_H */
+--
+2.43.0
+
--- /dev/null
+From a1f94a2d02bbd326bd1230e8a1625971ec5cfce2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Mar 2024 10:06:36 +0100
+Subject: um: vector: fix bpfflash parameter evaluation
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 584ed2f76ff5fe360d87a04d17b6520c7999e06b ]
+
+With W=1 the build complains about a pointer compared to
+zero, clearly the result should've been compared.
+
+Fixes: 9807019a62dc ("um: Loadable BPF "Firmware" for vector drivers")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Tiwei Bie <tiwei.btw@antgroup.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/drivers/vector_kern.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/um/drivers/vector_kern.c b/arch/um/drivers/vector_kern.c
+index dc2feae789cbb..63e5f108a6b95 100644
+--- a/arch/um/drivers/vector_kern.c
++++ b/arch/um/drivers/vector_kern.c
+@@ -141,7 +141,7 @@ static bool get_bpf_flash(struct arglist *def)
+
+ if (allow != NULL) {
+ if (kstrtoul(allow, 10, &result) == 0)
+- return (allow > 0);
++ return result > 0;
+ }
+ return false;
+ }
+--
+2.43.0
+
--- /dev/null
+From f3a11e00d66baff04adc100b7bc1f9b722987065 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Apr 2024 17:08:45 +0200
+Subject: virtio: delete vq in vp_find_vqs_msix() when request_irq() fails
+
+From: Jiri Pirko <jiri@nvidia.com>
+
+[ Upstream commit 89875151fccdd024d571aa884ea97a0128b968b6 ]
+
+When request_irq() fails, error path calls vp_del_vqs(). There, as vq is
+present in the list, free_irq() is called for the same vector. That
+causes following splat:
+
+[ 0.414355] Trying to free already-free IRQ 27
+[ 0.414403] WARNING: CPU: 1 PID: 1 at kernel/irq/manage.c:1899 free_irq+0x1a1/0x2d0
+[ 0.414510] Modules linked in:
+[ 0.414540] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.9.0-rc4+ #27
+[ 0.414540] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014
+[ 0.414540] RIP: 0010:free_irq+0x1a1/0x2d0
+[ 0.414540] Code: 1e 00 48 83 c4 08 48 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 90 8b 74 24 04 48 c7 c7 98 80 6c b1 e8 00 c9 f7 ff 90 <0f> 0b 90 90 48 89 ee 4c 89 ef e8 e0 20 b8 00 49 8b 47 40 48 8b 40
+[ 0.414540] RSP: 0000:ffffb71480013ae0 EFLAGS: 00010086
+[ 0.414540] RAX: 0000000000000000 RBX: ffffa099c2722000 RCX: 0000000000000000
+[ 0.414540] RDX: 0000000000000000 RSI: ffffb71480013998 RDI: 0000000000000001
+[ 0.414540] RBP: 0000000000000246 R08: 00000000ffffdfff R09: 0000000000000001
+[ 0.414540] R10: 00000000ffffdfff R11: ffffffffb18729c0 R12: ffffa099c1c91760
+[ 0.414540] R13: ffffa099c1c916a4 R14: ffffa099c1d2f200 R15: ffffa099c1c91600
+[ 0.414540] FS: 0000000000000000(0000) GS:ffffa099fec40000(0000) knlGS:0000000000000000
+[ 0.414540] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 0.414540] CR2: 0000000000000000 CR3: 0000000008e3e001 CR4: 0000000000370ef0
+[ 0.414540] Call Trace:
+[ 0.414540] <TASK>
+[ 0.414540] ? __warn+0x80/0x120
+[ 0.414540] ? free_irq+0x1a1/0x2d0
+[ 0.414540] ? report_bug+0x164/0x190
+[ 0.414540] ? handle_bug+0x3b/0x70
+[ 0.414540] ? exc_invalid_op+0x17/0x70
+[ 0.414540] ? asm_exc_invalid_op+0x1a/0x20
+[ 0.414540] ? free_irq+0x1a1/0x2d0
+[ 0.414540] vp_del_vqs+0xc1/0x220
+[ 0.414540] vp_find_vqs_msix+0x305/0x470
+[ 0.414540] vp_find_vqs+0x3e/0x1a0
+[ 0.414540] vp_modern_find_vqs+0x1b/0x70
+[ 0.414540] init_vqs+0x387/0x600
+[ 0.414540] virtnet_probe+0x50a/0xc80
+[ 0.414540] virtio_dev_probe+0x1e0/0x2b0
+[ 0.414540] really_probe+0xc0/0x2c0
+[ 0.414540] ? __pfx___driver_attach+0x10/0x10
+[ 0.414540] __driver_probe_device+0x73/0x120
+[ 0.414540] driver_probe_device+0x1f/0xe0
+[ 0.414540] __driver_attach+0x88/0x180
+[ 0.414540] bus_for_each_dev+0x85/0xd0
+[ 0.414540] bus_add_driver+0xec/0x1f0
+[ 0.414540] driver_register+0x59/0x100
+[ 0.414540] ? __pfx_virtio_net_driver_init+0x10/0x10
+[ 0.414540] virtio_net_driver_init+0x90/0xb0
+[ 0.414540] do_one_initcall+0x58/0x230
+[ 0.414540] kernel_init_freeable+0x1a3/0x2d0
+[ 0.414540] ? __pfx_kernel_init+0x10/0x10
+[ 0.414540] kernel_init+0x1a/0x1c0
+[ 0.414540] ret_from_fork+0x31/0x50
+[ 0.414540] ? __pfx_kernel_init+0x10/0x10
+[ 0.414540] ret_from_fork_asm+0x1a/0x30
+[ 0.414540] </TASK>
+
+Fix this by calling deleting the current vq when request_irq() fails.
+
+Fixes: 0b0f9dc52ed0 ("Revert "virtio_pci: use shared interrupts for virtqueues"")
+Signed-off-by: Jiri Pirko <jiri@nvidia.com>
+Message-Id: <20240426150845.3999481-1-jiri@resnulli.us>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virtio/virtio_pci_common.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
+index b655fccaf7733..584af7816532b 100644
+--- a/drivers/virtio/virtio_pci_common.c
++++ b/drivers/virtio/virtio_pci_common.c
+@@ -348,8 +348,10 @@ static int vp_find_vqs_msix(struct virtio_device *vdev, unsigned int nvqs,
+ vring_interrupt, 0,
+ vp_dev->msix_names[msix_vec],
+ vqs[i]);
+- if (err)
++ if (err) {
++ vp_del_vq(vqs[i]);
+ goto error_find;
++ }
+ }
+ return 0;
+
+--
+2.43.0
+
--- /dev/null
+From 30859bfc8a841eac49882a8fdec2c45d139f02c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Mar 2024 10:24:44 +0900
+Subject: virtio_balloon: Give the balloon its own wakeup source
+
+From: David Stevens <stevensd@chromium.org>
+
+[ Upstream commit 810d831bbbf3cbd86e5aa91c8485b4d35186144d ]
+
+Wakeup sources don't support nesting multiple events, so sharing a
+single object between multiple drivers can result in one driver
+overriding the wakeup event processing period specified by another
+driver. Have the virtio balloon driver use the wakeup source of the
+device it is bound to rather than the wakeup source of the parent
+device, to avoid conflicts with the transport layer.
+
+Note that although the virtio balloon's virtio_device itself isn't what
+actually wakes up the device, it is responsible for processing wakeup
+events. In the same way that EPOLLWAKEUP uses a dedicated wakeup_source
+to prevent suspend when userspace is processing wakeup events, a
+dedicated wakeup_source is necessary when processing wakeup events in a
+higher layer in the kernel.
+
+Fixes: b12fbc3f787e ("virtio_balloon: stay awake while adjusting balloon")
+Signed-off-by: David Stevens <stevensd@chromium.org>
+Acked-by: David Hildenbrand <david@redhat.com>
+Message-Id: <20240321012445.1593685-2-stevensd@google.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virtio/virtio_balloon.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
+index 1f5b3dd31fcfc..89bc8da80519f 100644
+--- a/drivers/virtio/virtio_balloon.c
++++ b/drivers/virtio/virtio_balloon.c
+@@ -450,7 +450,7 @@ static void start_update_balloon_size(struct virtio_balloon *vb)
+ vb->adjustment_signal_pending = true;
+ if (!vb->adjustment_in_progress) {
+ vb->adjustment_in_progress = true;
+- pm_stay_awake(vb->vdev->dev.parent);
++ pm_stay_awake(&vb->vdev->dev);
+ }
+ spin_unlock_irqrestore(&vb->adjustment_lock, flags);
+
+@@ -462,7 +462,7 @@ static void end_update_balloon_size(struct virtio_balloon *vb)
+ spin_lock_irq(&vb->adjustment_lock);
+ if (!vb->adjustment_signal_pending && vb->adjustment_in_progress) {
+ vb->adjustment_in_progress = false;
+- pm_relax(vb->vdev->dev.parent);
++ pm_relax(&vb->vdev->dev);
+ }
+ spin_unlock_irq(&vb->adjustment_lock);
+ }
+@@ -1029,6 +1029,15 @@ static int virtballoon_probe(struct virtio_device *vdev)
+
+ spin_lock_init(&vb->adjustment_lock);
+
++ /*
++ * The virtio balloon itself can't wake up the device, but it is
++ * responsible for processing wakeup events passed up from the transport
++ * layer. Wakeup sources don't support nesting/chaining calls, so we use
++ * our own wakeup source to ensure wakeup events are properly handled
++ * without trampling on the transport layer's wakeup source.
++ */
++ device_set_wakeup_capable(&vb->vdev->dev, true);
++
+ virtio_device_ready(vdev);
+
+ if (towards_target(vb))
+--
+2.43.0
+
--- /dev/null
+From 292c8b045edbc06f8effd570e9f6ae3b0cc960b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Feb 2024 21:20:03 +0900
+Subject: x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when
+ UNWINDER_FRAME_POINTER=y
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 66ee3636eddcc82ab82b539d08b85fb5ac1dff9b ]
+
+It took me some time to understand the purpose of the tricky code at
+the end of arch/x86/Kconfig.debug.
+
+Without it, the following would be shown:
+
+ WARNING: unmet direct dependencies detected for FRAME_POINTER
+
+because
+
+ 81d387190039 ("x86/kconfig: Consolidate unwinders into multiple choice selection")
+
+removed 'select ARCH_WANT_FRAME_POINTERS'.
+
+The correct and more straightforward approach should have been to move
+it where 'select FRAME_POINTER' is located.
+
+Several architectures properly handle the conditional selection of
+ARCH_WANT_FRAME_POINTERS. For example, 'config UNWINDER_FRAME_POINTER'
+in arch/arm/Kconfig.debug.
+
+Fixes: 81d387190039 ("x86/kconfig: Consolidate unwinders into multiple choice selection")
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Acked-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Link: https://lore.kernel.org/r/20240204122003.53795-1-masahiroy@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/Kconfig.debug | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
+index c5d614d28a759..74777a97e394a 100644
+--- a/arch/x86/Kconfig.debug
++++ b/arch/x86/Kconfig.debug
+@@ -248,6 +248,7 @@ config UNWINDER_ORC
+
+ config UNWINDER_FRAME_POINTER
+ bool "Frame pointer unwinder"
++ select ARCH_WANT_FRAME_POINTERS
+ select FRAME_POINTER
+ help
+ This option enables the frame pointer unwinder for unwinding kernel
+@@ -271,7 +272,3 @@ config UNWINDER_GUESS
+ overhead.
+
+ endchoice
+-
+-config FRAME_POINTER
+- depends on !UNWINDER_ORC && !UNWINDER_GUESS
+- bool
+--
+2.43.0
+
--- /dev/null
+From 55b57071fb9f11886ca11a85d5ead04ed570b038 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2024 11:27:14 +0100
+Subject: x86/percpu: Unify arch_raw_cpu_ptr() defines
+
+From: Uros Bizjak <ubizjak@gmail.com>
+
+[ Upstream commit 4e5b0e8003df05983b6dabcdde7ff447d53b49d7 ]
+
+When building a 32-bit vDSO for a 64-bit kernel, games are played with
+CONFIG_X86_64. {this,raw}_cpu_read_8() macros are conditionally defined
+on CONFIG_X86_64 and when CONFIG_X86_64 is undefined in fake_32bit_build.h
+various build failures in generic percpu header files can happen. To make
+things worse, the build of 32-bit vDSO for a 64-bit kernel grew dependency
+on arch_raw_cpu_ptr() macro and the build fails if arch_raw_cpu_ptr()
+macro is not defined.
+
+To mitigate these issues, x86 carefully defines arch_raw_cpu_ptr() to
+avoid any dependency on raw_cpu_read_8() and thus CONFIG_X86_64. W/o
+segment register support, the definition uses size-agnostic MOV asm
+mnemonic and hopes that _ptr argument won't ever be 64-bit size on
+32-bit targets (although newer GCCs warn for this situation with
+"unsupported size for integer register"), and w/ segment register
+support the definition uses size-agnostic __raw_cpu_read() macro.
+
+Fortunately, raw_cpu_read() is not used in 32-bit vDSO for a 64-bit kernel.
+However, we can't simply omit the definition of arch_raw_cpu_read(),
+since the build will fail when building vdso/vdso32/vclock_gettime.o.
+
+The patch defines arch_raw_cpu_ptr to BUILD_BUG() when BUILD_VDSO32_64
+macro is defined. This way, we are sure that arch_raw_cpu_ptr() won't
+actually be used in 32-bit VDSO for a 64-bit kernel, but it is still
+defined to prevent build failure.
+
+Finally, we can unify arch_raw_cpu_ptr() between builds w/ and w/o
+x86 segment register support, substituting two tricky macro definitions
+with a straightforward implementation.
+
+There is no size difference and no difference in number of this_cpu_off
+accesses between patched and unpatched kernel when the kernel is built
+either w/ and w/o segment register support.
+
+Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Link: https://lore.kernel.org/r/20240322102730.209141-1-ubizjak@gmail.com
+Stable-dep-of: a55c1fdad5f6 ("x86/percpu: Use __force to cast from __percpu address space")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/percpu.h | 42 +++++++++++++++--------------------
+ 1 file changed, 18 insertions(+), 24 deletions(-)
+
+diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h
+index b77bbb67e77b0..dbfde44d88a31 100644
+--- a/arch/x86/include/asm/percpu.h
++++ b/arch/x86/include/asm/percpu.h
+@@ -59,36 +59,30 @@
+ #define __force_percpu_prefix "%%"__stringify(__percpu_seg)":"
+ #define __my_cpu_offset this_cpu_read(this_cpu_off)
+
+-#ifdef CONFIG_USE_X86_SEG_SUPPORT
+-/*
+- * Efficient implementation for cases in which the compiler supports
+- * named address spaces. Allows the compiler to perform additional
+- * optimizations that can save more instructions.
+- */
+-#define arch_raw_cpu_ptr(ptr) \
+-({ \
+- unsigned long tcp_ptr__; \
+- tcp_ptr__ = __raw_cpu_read(, this_cpu_off); \
+- \
+- tcp_ptr__ += (__force unsigned long)(ptr); \
+- (typeof(*(ptr)) __kernel __force *)tcp_ptr__; \
+-})
+-#else /* CONFIG_USE_X86_SEG_SUPPORT */
++#ifdef CONFIG_X86_64
++#define __raw_my_cpu_offset raw_cpu_read_8(this_cpu_off);
++#else
++#define __raw_my_cpu_offset raw_cpu_read_4(this_cpu_off);
++#endif
++
+ /*
+ * Compared to the generic __my_cpu_offset version, the following
+ * saves one instruction and avoids clobbering a temp register.
++ *
++ * arch_raw_cpu_ptr should not be used in 32-bit VDSO for a 64-bit
++ * kernel, because games are played with CONFIG_X86_64 there and
++ * sizeof(this_cpu_off) becames 4.
+ */
+-#define arch_raw_cpu_ptr(ptr) \
++#ifndef BUILD_VDSO32_64
++#define arch_raw_cpu_ptr(_ptr) \
+ ({ \
+- unsigned long tcp_ptr__; \
+- asm ("mov " __percpu_arg(1) ", %0" \
+- : "=r" (tcp_ptr__) \
+- : "m" (__my_cpu_var(this_cpu_off))); \
+- \
+- tcp_ptr__ += (unsigned long)(ptr); \
+- (typeof(*(ptr)) __kernel __force *)tcp_ptr__; \
++ unsigned long tcp_ptr__ = __raw_my_cpu_offset; \
++ tcp_ptr__ += (unsigned long)(_ptr); \
++ (typeof(*(_ptr)) __kernel __force *)tcp_ptr__; \
+ })
+-#endif /* CONFIG_USE_X86_SEG_SUPPORT */
++#else
++#define arch_raw_cpu_ptr(_ptr) ({ BUILD_BUG(); (typeof(_ptr))0; })
++#endif
+
+ #define PER_CPU_VAR(var) %__percpu_seg:(var)__percpu_rel
+
+--
+2.43.0
+
--- /dev/null
+From 630d104c20f3075b584bc06fbe66b71c0b94877e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Apr 2024 19:50:38 +0200
+Subject: x86/percpu: Use __force to cast from __percpu address space
+
+From: Uros Bizjak <ubizjak@gmail.com>
+
+[ Upstream commit a55c1fdad5f61b4bfe42319694b23671a758cb28 ]
+
+Fix Sparse warning when casting from __percpu address space by using
+__force in the cast. x86 named address spaces are not considered to
+be subspaces of the generic (flat) address space, so explicit casts
+are required to convert pointers between these address spaces and the
+generic address space (the application should cast to uintptr_t and
+apply the segment base offset). The cast to uintptr_t removes
+__percpu address space tag and Sparse reports:
+
+ warning: cast removes address space '__percpu' of expression
+
+Use __force to inform Sparse that the cast is intentional.
+
+Fixes: 9a462b9eafa6 ("x86/percpu: Use compiler segment prefix qualifier")
+Reported-by: Charlemagne Lasse <charlemagnelasse@gmail.com>
+Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Link: https://lore.kernel.org/r/20240402175058.52649-1-ubizjak@gmail.com
+
+Closes: https://lore.kernel.org/lkml/CAFGhKbzev7W4aHwhFPWwMZQEHenVgZUj7=aunFieVqZg3mt14A@mail.gmail.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/percpu.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h
+index dbfde44d88a31..ce5111cec36e2 100644
+--- a/arch/x86/include/asm/percpu.h
++++ b/arch/x86/include/asm/percpu.h
+@@ -77,7 +77,7 @@
+ #define arch_raw_cpu_ptr(_ptr) \
+ ({ \
+ unsigned long tcp_ptr__ = __raw_my_cpu_offset; \
+- tcp_ptr__ += (unsigned long)(_ptr); \
++ tcp_ptr__ += (__force unsigned long)(_ptr); \
+ (typeof(*(_ptr)) __kernel __force *)tcp_ptr__; \
+ })
+ #else
+--
+2.43.0
+
--- /dev/null
+From 7f5dbc6f3aa98836265951bdd24e37a979810a6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Apr 2024 17:50:53 +0200
+Subject: xen/x86: add extra pages to unpopulated-alloc if available
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Roger Pau Monne <roger.pau@citrix.com>
+
+[ Upstream commit a6aa4eb994ee9ced905743817c5de8451d26b911 ]
+
+Commit 262fc47ac174 ('xen/balloon: don't use PV mode extra memory for zone
+device allocations') removed the addition of the extra memory ranges to the
+unpopulated range allocator, using those only for the balloon driver.
+
+This forces the unpopulated allocator to attach hotplug ranges even when spare
+memory (as part of the extra memory ranges) is available. Furthermore, on PVH
+domains it defeats the purpose of commit 38620fc4e893 ('x86/xen: attempt to
+inflate the memory balloon on PVH'), as extra memory ranges would only be
+used to map foreign memory if the kernel is built without XEN_UNPOPULATED_ALLOC
+support.
+
+Fix this by adding a helpers that adds the extra memory ranges to the list of
+unpopulated pages, and zeroes the ranges so they are not also consumed by the
+balloon driver.
+
+This should have been part of 38620fc4e893, hence the fixes tag.
+
+Note the current logic relies on unpopulated_init() (and hence
+arch_xen_unpopulated_init()) always being called ahead of balloon_init(), so
+that the extra memory regions are consumed by arch_xen_unpopulated_init().
+
+Fixes: 38620fc4e893 ('x86/xen: attempt to inflate the memory balloon on PVH')
+Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Link: https://lore.kernel.org/r/20240429155053.72509-1-roger.pau@citrix.com
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/xen/enlighten.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
+index a01ca255b0c64..b88722dfc4f86 100644
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -382,3 +382,36 @@ void __init xen_add_extra_mem(unsigned long start_pfn, unsigned long n_pfns)
+
+ memblock_reserve(PFN_PHYS(start_pfn), PFN_PHYS(n_pfns));
+ }
++
++#ifdef CONFIG_XEN_UNPOPULATED_ALLOC
++int __init arch_xen_unpopulated_init(struct resource **res)
++{
++ unsigned int i;
++
++ if (!xen_domain())
++ return -ENODEV;
++
++ /* Must be set strictly before calling xen_free_unpopulated_pages(). */
++ *res = &iomem_resource;
++
++ /*
++ * Initialize with pages from the extra memory regions (see
++ * arch/x86/xen/setup.c).
++ */
++ for (i = 0; i < XEN_EXTRA_MEM_MAX_REGIONS; i++) {
++ unsigned int j;
++
++ for (j = 0; j < xen_extra_mem[i].n_pfns; j++) {
++ struct page *pg =
++ pfn_to_page(xen_extra_mem[i].start_pfn + j);
++
++ xen_free_unpopulated_pages(1, &pg);
++ }
++
++ /* Zero so region is not also added to the balloon driver. */
++ xen_extra_mem[i].n_pfns = 0;
++ }
++
++ return 0;
++}
++#endif
+--
+2.43.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
