--- /dev/null
+From 65b0e307a1a9193571db12910f382f84195a3d29 Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Tue, 8 Nov 2022 13:37:55 +0100
+Subject: ARM: ux500: do not directly dereference __iomem
+
+From: Jason A. Donenfeld <Jason@zx2c4.com>
+
+commit 65b0e307a1a9193571db12910f382f84195a3d29 upstream.
+
+Sparse reports that calling add_device_randomness() on `uid` is a
+violation of address spaces. And indeed the next usage uses readl()
+properly, but that was left out when passing it toadd_device_
+randomness(). So instead copy the whole thing to the stack first.
+
+Fixes: 4040d10a3d44 ("ARM: ux500: add DB serial number to entropy pool")
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/all/202210230819.loF90KDh-lkp@intel.com/
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Link: https://lore.kernel.org/r/20221108123755.207438-1-Jason@zx2c4.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/ux500/ux500-soc-id.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+--- a/drivers/soc/ux500/ux500-soc-id.c
++++ b/drivers/soc/ux500/ux500-soc-id.c
+@@ -167,20 +167,18 @@ ATTRIBUTE_GROUPS(ux500_soc);
+ static const char *db8500_read_soc_id(struct device_node *backupram)
+ {
+ void __iomem *base;
+- void __iomem *uid;
+ const char *retstr;
++ u32 uid[5];
+
+ base = of_iomap(backupram, 0);
+ if (!base)
+ return NULL;
+- uid = base + 0x1fc0;
++ memcpy_fromio(uid, base + 0x1fc0, sizeof(uid));
+
+ /* Throw these device-specific numbers into the entropy pool */
+- add_device_randomness(uid, 0x14);
++ add_device_randomness(uid, sizeof(uid));
+ retstr = kasprintf(GFP_KERNEL, "%08x%08x%08x%08x%08x",
+- readl((u32 *)uid+0),
+- readl((u32 *)uid+1), readl((u32 *)uid+2),
+- readl((u32 *)uid+3), readl((u32 *)uid+4));
++ uid[0], uid[1], uid[2], uid[3], uid[4]);
+ iounmap(base);
+ return retstr;
+ }
--- /dev/null
+From 0953777640354dc459a22369eea488603d225dd9 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Mon, 5 Dec 2022 11:08:37 +0100
+Subject: arm64: dts: qcom: sc8280xp: fix UFS DMA coherency
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 0953777640354dc459a22369eea488603d225dd9 upstream.
+
+The SC8280XP UFS controllers are cache coherent and must be marked as
+such in the devicetree to avoid potential data corruption.
+
+Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform")
+Cc: stable@vger.kernel.org # 6.0
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221205100837.29212-3-johan+linaro@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+@@ -855,6 +855,7 @@
+ required-opps = <&rpmhpd_opp_nom>;
+
+ iommus = <&apps_smmu 0xe0 0x0>;
++ dma-coherent;
+
+ clocks = <&gcc GCC_UFS_PHY_AXI_CLK>,
+ <&gcc GCC_AGGRE_UFS_PHY_AXI_CLK>,
+@@ -923,6 +924,7 @@
+ power-domains = <&gcc UFS_CARD_GDSC>;
+
+ iommus = <&apps_smmu 0x4a0 0x0>;
++ dma-coherent;
+
+ clocks = <&gcc GCC_UFS_CARD_AXI_CLK>,
+ <&gcc GCC_AGGRE_UFS_CARD_AXI_CLK>,
--- /dev/null
+From f446022b932aff1d6a308ca5d537ec2b512debdc Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Fri, 4 Nov 2022 10:20:44 +0100
+Subject: arm64: dts: qcom: sc8280xp: fix UFS reference clocks
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit f446022b932aff1d6a308ca5d537ec2b512debdc upstream.
+
+There are three UFS reference clocks on SC8280XP which are used as
+follows:
+
+ - The GCC_UFS_REF_CLKREF_CLK clock is fed to any UFS device connected
+ to either controller.
+
+ - The GCC_UFS_1_CARD_CLKREF_CLK and GCC_UFS_CARD_CLKREF_CLK clocks
+ provide reference clocks to the two PHYs.
+
+Note that this depends on first updating the clock driver to reflect
+that all three clocks are sourced from CXO. Specifically, the UFS
+controller driver expects the device reference clock to have a valid
+frequency:
+
+ ufshcd-qcom 1d84000.ufs: invalid ref_clk setting = 0
+
+Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform")
+Fixes: 8d6b458ce6e9 ("arm64: dts: qcom: sc8280xp: fix ufs_card_phy ref clock")
+Fixes: f3aa975e230e ("arm64: dts: qcom: sc8280xp: correct ref clock for ufs_mem_phy")
+Link: https://lore.kernel.org/lkml/Y2OEjNAPXg5BfOxH@hovoldconsulting.com/
+Cc: stable@vger.kernel.org # 5.20
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Reviewed-by: Brian Masney <bmasney@redhat.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@somainline.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221104092045.17410-2-johan+linaro@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+@@ -861,7 +861,7 @@
+ <&gcc GCC_AGGRE_UFS_PHY_AXI_CLK>,
+ <&gcc GCC_UFS_PHY_AHB_CLK>,
+ <&gcc GCC_UFS_PHY_UNIPRO_CORE_CLK>,
+- <&rpmhcc RPMH_CXO_CLK>,
++ <&gcc GCC_UFS_REF_CLKREF_CLK>,
+ <&gcc GCC_UFS_PHY_TX_SYMBOL_0_CLK>,
+ <&gcc GCC_UFS_PHY_RX_SYMBOL_0_CLK>,
+ <&gcc GCC_UFS_PHY_RX_SYMBOL_1_CLK>;
+@@ -892,7 +892,7 @@
+ ranges;
+ clock-names = "ref",
+ "ref_aux";
+- clocks = <&gcc GCC_UFS_REF_CLKREF_CLK>,
++ clocks = <&gcc GCC_UFS_CARD_CLKREF_CLK>,
+ <&gcc GCC_UFS_PHY_PHY_AUX_CLK>;
+
+ resets = <&ufs_mem_hc 0>;
+@@ -930,7 +930,7 @@
+ <&gcc GCC_AGGRE_UFS_CARD_AXI_CLK>,
+ <&gcc GCC_UFS_CARD_AHB_CLK>,
+ <&gcc GCC_UFS_CARD_UNIPRO_CORE_CLK>,
+- <&rpmhcc RPMH_CXO_CLK>,
++ <&gcc GCC_UFS_REF_CLKREF_CLK>,
+ <&gcc GCC_UFS_CARD_TX_SYMBOL_0_CLK>,
+ <&gcc GCC_UFS_CARD_RX_SYMBOL_0_CLK>,
+ <&gcc GCC_UFS_CARD_RX_SYMBOL_1_CLK>;
+@@ -961,7 +961,7 @@
+ ranges;
+ clock-names = "ref",
+ "ref_aux";
+- clocks = <&gcc GCC_UFS_REF_CLKREF_CLK>,
++ clocks = <&gcc GCC_UFS_1_CARD_CLKREF_CLK>,
+ <&gcc GCC_UFS_CARD_PHY_AUX_CLK>;
+
+ resets = <&ufs_card_hc 0>;
--- /dev/null
+From 9905370560d9c29adc15f4937c5a0c0dac05f0b4 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Mon, 10 Oct 2022 07:44:13 -0400
+Subject: arm64: dts: qcom: sdm845-db845c: correct SPI2 pins drive strength
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit 9905370560d9c29adc15f4937c5a0c0dac05f0b4 upstream.
+
+The pin configuration (done with generic pin controller helpers and
+as expressed by bindings) requires children nodes with either:
+1. "pins" property and the actual configuration,
+2. another set of nodes with above point.
+
+The qup_spi2_default pin configuration uses alreaady the second method
+with a "pinmux" child, so configure drive-strength similarly in
+"pinconf". Otherwise the PIN drive strength would not be applied.
+
+Fixes: 8d23a0040475 ("arm64: dts: qcom: db845c: add Low speed expansion i2c and spi nodes")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221010114417.29859-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
++++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+@@ -1123,7 +1123,10 @@
+
+ /* PINCTRL - additions to nodes defined in sdm845.dtsi */
+ &qup_spi2_default {
+- drive-strength = <16>;
++ pinconf {
++ pins = "gpio27", "gpio28", "gpio29", "gpio30";
++ drive-strength = <16>;
++ };
+ };
+
+ &qup_uart3_default{
--- /dev/null
+From fd49776d8f458bba5499384131eddc0b8bcaf50c Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Fri, 30 Sep 2022 21:20:37 +0200
+Subject: arm64: dts: qcom: sdm850-lenovo-yoga-c630: correct I2C12 pins drive strength
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit fd49776d8f458bba5499384131eddc0b8bcaf50c upstream.
+
+The pin configuration (done with generic pin controller helpers and
+as expressed by bindings) requires children nodes with either:
+1. "pins" property and the actual configuration,
+2. another set of nodes with above point.
+
+The qup_i2c12_default pin configuration used second method - with a
+"pinmux" child.
+
+Fixes: 44acee207844 ("arm64: dts: qcom: Add Lenovo Yoga C630")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Tested-by: Steev Klimaszewski <steev@kali.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@somainline.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20220930192039.240486-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
++++ b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
+@@ -487,8 +487,10 @@
+ };
+
+ &qup_i2c12_default {
+- drive-strength = <2>;
+- bias-disable;
++ pinmux {
++ drive-strength = <2>;
++ bias-disable;
++ };
+ };
+
+ &qup_uart6_default {
--- /dev/null
+From 3638ea010c37e1e6d93474c4b3368f403600413f Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Fri, 30 Sep 2022 21:20:38 +0200
+Subject: arm64: dts: qcom: sdm850-samsung-w737: correct I2C12 pins drive strength
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit 3638ea010c37e1e6d93474c4b3368f403600413f upstream.
+
+The pin configuration (done with generic pin controller helpers and
+as expressed by bindings) requires children nodes with either:
+1. "pins" property and the actual configuration,
+2. another set of nodes with above point.
+
+The qup_i2c12_default pin configuration used second method - with a
+"pinmux" child.
+
+Fixes: d4b341269efb ("arm64: dts: qcom: Add support for Samsung Galaxy Book2")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@somainline.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20220930192039.240486-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/qcom/sdm850-samsung-w737.dts | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/qcom/sdm850-samsung-w737.dts
++++ b/arch/arm64/boot/dts/qcom/sdm850-samsung-w737.dts
+@@ -415,8 +415,10 @@
+ };
+
+ &qup_i2c12_default {
+- drive-strength = <2>;
+- bias-disable;
++ pinmux {
++ drive-strength = <2>;
++ bias-disable;
++ };
+ };
+
+ &qup_uart6_default {
--- /dev/null
+From 0fbcd8abf3375052cc7627cc53aba6f2eb189fbb Mon Sep 17 00:00:00 2001
+From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
+Date: Fri, 2 Dec 2022 11:18:33 +0900
+Subject: arm64: Prohibit instrumentation on arch_stack_walk()
+
+From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+
+commit 0fbcd8abf3375052cc7627cc53aba6f2eb189fbb upstream.
+
+Mark arch_stack_walk() as noinstr instead of notrace and inline functions
+called from arch_stack_walk() as __always_inline so that user does not
+put any instrumentations on it, because this function can be used from
+return_address() which is used by lockdep.
+
+Without this, if the kernel built with CONFIG_LOCKDEP=y, just probing
+arch_stack_walk() via <tracefs>/kprobe_events will crash the kernel on
+arm64.
+
+ # echo p arch_stack_walk >> ${TRACEFS}/kprobe_events
+ # echo 1 > ${TRACEFS}/events/kprobes/enable
+ kprobes: Failed to recover from reentered kprobes.
+ kprobes: Dump kprobe:
+ .symbol_name = arch_stack_walk, .offset = 0, .addr = arch_stack_walk+0x0/0x1c0
+ ------------[ cut here ]------------
+ kernel BUG at arch/arm64/kernel/probes/kprobes.c:241!
+ kprobes: Failed to recover from reentered kprobes.
+ kprobes: Dump kprobe:
+ .symbol_name = arch_stack_walk, .offset = 0, .addr = arch_stack_walk+0x0/0x1c0
+ ------------[ cut here ]------------
+ kernel BUG at arch/arm64/kernel/probes/kprobes.c:241!
+ PREEMPT SMP
+ Modules linked in:
+ CPU: 0 PID: 17 Comm: migration/0 Tainted: G N 6.1.0-rc5+ #6
+ Hardware name: linux,dummy-virt (DT)
+ Stopper: 0x0 <- 0x0
+ pstate: 600003c5 (nZCv DAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+ pc : kprobe_breakpoint_handler+0x178/0x17c
+ lr : kprobe_breakpoint_handler+0x178/0x17c
+ sp : ffff8000080d3090
+ x29: ffff8000080d3090 x28: ffff0df5845798c0 x27: ffffc4f59057a774
+ x26: ffff0df5ffbba770 x25: ffff0df58f420f18 x24: ffff49006f641000
+ x23: ffffc4f590579768 x22: ffff0df58f420f18 x21: ffff8000080d31c0
+ x20: ffffc4f590579768 x19: ffffc4f590579770 x18: 0000000000000006
+ x17: 5f6b636174735f68 x16: 637261203d207264 x15: 64612e202c30203d
+ x14: 2074657366666f2e x13: 30633178302f3078 x12: 302b6b6c61775f6b
+ x11: 636174735f686372 x10: ffffc4f590dc5bd8 x9 : ffffc4f58eb31958
+ x8 : 00000000ffffefff x7 : ffffc4f590dc5bd8 x6 : 80000000fffff000
+ x5 : 000000000000bff4 x4 : 0000000000000000 x3 : 0000000000000000
+ x2 : 0000000000000000 x1 : ffff0df5845798c0 x0 : 0000000000000064
+ Call trace:
+ kprobes: Failed to recover from reentered kprobes.
+ kprobes: Dump kprobe:
+ .symbol_name = arch_stack_walk, .offset = 0, .addr = arch_stack_walk+0x0/0x1c0
+ ------------[ cut here ]------------
+ kernel BUG at arch/arm64/kernel/probes/kprobes.c:241!
+
+Fixes: 39ef362d2d45 ("arm64: Make return_address() use arch_stack_walk()")
+Cc: stable@vger.kernel.org
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Link: https://lore.kernel.org/r/166994751368.439920.3236636557520824664.stgit@devnote3
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kernel/stacktrace.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/arm64/kernel/stacktrace.c
++++ b/arch/arm64/kernel/stacktrace.c
+@@ -23,8 +23,8 @@
+ *
+ * The regs must be on a stack currently owned by the calling task.
+ */
+-static inline void unwind_init_from_regs(struct unwind_state *state,
+- struct pt_regs *regs)
++static __always_inline void unwind_init_from_regs(struct unwind_state *state,
++ struct pt_regs *regs)
+ {
+ unwind_init_common(state, current);
+
+@@ -58,8 +58,8 @@ static __always_inline void unwind_init_
+ * duration of the unwind, or the unwind will be bogus. It is never valid to
+ * call this for the current task.
+ */
+-static inline void unwind_init_from_task(struct unwind_state *state,
+- struct task_struct *task)
++static __always_inline void unwind_init_from_task(struct unwind_state *state,
++ struct task_struct *task)
+ {
+ unwind_init_common(state, task);
+
+@@ -186,7 +186,7 @@ void show_stack(struct task_struct *tsk,
+ : stackinfo_get_unknown(); \
+ })
+
+-noinline notrace void arch_stack_walk(stack_trace_consume_fn consume_entry,
++noinline noinstr void arch_stack_walk(stack_trace_consume_fn consume_entry,
+ void *cookie, struct task_struct *task,
+ struct pt_regs *regs)
+ {
--- /dev/null
+From 1742e1c90c3da344f3bb9b1f1309b3f47482756a Mon Sep 17 00:00:00 2001
+From: void0red <void0red@gmail.com>
+Date: Wed, 23 Nov 2022 22:39:45 +0800
+Subject: btrfs: fix extent map use-after-free when handling missing device in read_one_chunk
+
+From: void0red <void0red@gmail.com>
+
+commit 1742e1c90c3da344f3bb9b1f1309b3f47482756a upstream.
+
+Store the error code before freeing the extent_map. Though it's
+reference counted structure, in that function it's the first and last
+allocation so this would lead to a potential use-after-free.
+
+The error can happen eg. when chunk is stored on a missing device and
+the degraded mount option is missing.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216721
+Reported-by: eriri <1527030098@qq.com>
+Fixes: adfb69af7d8c ("btrfs: add_missing_dev() should return the actual error")
+CC: stable@vger.kernel.org # 4.9+
+Signed-off-by: void0red <void0red@gmail.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/volumes.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -7241,8 +7241,9 @@ static int read_one_chunk(struct btrfs_k
+ map->stripes[i].dev = handle_missing_device(fs_info,
+ devid, uuid);
+ if (IS_ERR(map->stripes[i].dev)) {
++ ret = PTR_ERR(map->stripes[i].dev);
+ free_extent_map(em);
+- return PTR_ERR(map->stripes[i].dev);
++ return ret;
+ }
+ }
+
--- /dev/null
+From 560840afc3e63bbe5d9c5ef6b2ecf8f3589adff6 Mon Sep 17 00:00:00 2001
+From: Boris Burkov <boris@bur.io>
+Date: Wed, 14 Dec 2022 15:05:08 -0800
+Subject: btrfs: fix resolving backrefs for inline extent followed by prealloc
+
+From: Boris Burkov <boris@bur.io>
+
+commit 560840afc3e63bbe5d9c5ef6b2ecf8f3589adff6 upstream.
+
+If a file consists of an inline extent followed by a regular or prealloc
+extent, then a legitimate attempt to resolve a logical address in the
+non-inline region will result in add_all_parents reading the invalid
+offset field of the inline extent. If the inline extent item is placed
+in the leaf eb s.t. it is the first item, attempting to access the
+offset field will not only be meaningless, it will go past the end of
+the eb and cause this panic:
+
+ [17.626048] BTRFS warning (device dm-2): bad eb member end: ptr 0x3fd4 start 30834688 member offset 16377 size 8
+ [17.631693] general protection fault, probably for non-canonical address 0x5088000000000: 0000 [#1] SMP PTI
+ [17.635041] CPU: 2 PID: 1267 Comm: btrfs Not tainted 5.12.0-07246-g75175d5adc74-dirty #199
+ [17.637969] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
+ [17.641995] RIP: 0010:btrfs_get_64+0xe7/0x110
+ [17.649890] RSP: 0018:ffffc90001f73a08 EFLAGS: 00010202
+ [17.651652] RAX: 0000000000000001 RBX: ffff88810c42d000 RCX: 0000000000000000
+ [17.653921] RDX: 0005088000000000 RSI: ffffc90001f73a0f RDI: 0000000000000001
+ [17.656174] RBP: 0000000000000ff9 R08: 0000000000000007 R09: c0000000fffeffff
+ [17.658441] R10: ffffc90001f73790 R11: ffffc90001f73788 R12: ffff888106afe918
+ [17.661070] R13: 0000000000003fd4 R14: 0000000000003f6f R15: cdcdcdcdcdcdcdcd
+ [17.663617] FS: 00007f64e7627d80(0000) GS:ffff888237c80000(0000) knlGS:0000000000000000
+ [17.666525] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ [17.668664] CR2: 000055d4a39152e8 CR3: 000000010c596002 CR4: 0000000000770ee0
+ [17.671253] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ [17.673634] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ [17.676034] PKRU: 55555554
+ [17.677004] Call Trace:
+ [17.677877] add_all_parents+0x276/0x480
+ [17.679325] find_parent_nodes+0xfae/0x1590
+ [17.680771] btrfs_find_all_leafs+0x5e/0xa0
+ [17.682217] iterate_extent_inodes+0xce/0x260
+ [17.683809] ? btrfs_inode_flags_to_xflags+0x50/0x50
+ [17.685597] ? iterate_inodes_from_logical+0xa1/0xd0
+ [17.687404] iterate_inodes_from_logical+0xa1/0xd0
+ [17.689121] ? btrfs_inode_flags_to_xflags+0x50/0x50
+ [17.691010] btrfs_ioctl_logical_to_ino+0x131/0x190
+ [17.692946] btrfs_ioctl+0x104a/0x2f60
+ [17.694384] ? selinux_file_ioctl+0x182/0x220
+ [17.695995] ? __x64_sys_ioctl+0x84/0xc0
+ [17.697394] __x64_sys_ioctl+0x84/0xc0
+ [17.698697] do_syscall_64+0x33/0x40
+ [17.700017] entry_SYSCALL_64_after_hwframe+0x44/0xae
+ [17.701753] RIP: 0033:0x7f64e72761b7
+ [17.709355] RSP: 002b:00007ffefb067f58 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
+ [17.712088] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f64e72761b7
+ [17.714667] RDX: 00007ffefb067fb0 RSI: 00000000c0389424 RDI: 0000000000000003
+ [17.717386] RBP: 00007ffefb06d188 R08: 000055d4a390d2b0 R09: 00007f64e7340a60
+ [17.719938] R10: 0000000000000231 R11: 0000000000000246 R12: 0000000000000001
+ [17.722383] R13: 0000000000000000 R14: 00000000c0389424 R15: 000055d4a38fd2a0
+ [17.724839] Modules linked in:
+
+Fix the bug by detecting the inline extent item in add_all_parents and
+skipping to the next extent item.
+
+CC: stable@vger.kernel.org # 4.9+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Boris Burkov <boris@bur.io>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/backref.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/btrfs/backref.c
++++ b/fs/btrfs/backref.c
+@@ -433,6 +433,7 @@ static int add_all_parents(struct btrfs_
+ u64 wanted_disk_byte = ref->wanted_disk_byte;
+ u64 count = 0;
+ u64 data_offset;
++ u8 type;
+
+ if (level != 0) {
+ eb = path->nodes[level];
+@@ -487,6 +488,9 @@ static int add_all_parents(struct btrfs_
+ continue;
+ }
+ fi = btrfs_item_ptr(eb, slot, struct btrfs_file_extent_item);
++ type = btrfs_file_extent_type(eb, fi);
++ if (type == BTRFS_FILE_EXTENT_INLINE)
++ goto next;
+ disk_byte = btrfs_file_extent_disk_bytenr(eb, fi);
+ data_offset = btrfs_file_extent_offset(eb, fi);
+
--- /dev/null
+From d7c9e1be2876f63fb2178a24e0c1d5733ff98d47 Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Date: Fri, 18 Nov 2022 15:06:09 -0500
+Subject: btrfs: fix uninitialized parent in insert_state
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+commit d7c9e1be2876f63fb2178a24e0c1d5733ff98d47 upstream.
+
+I don't know how this isn't caught when we build this in the kernel, but
+while syncing extent-io-tree.c into btrfs-progs I got an error because
+parent could potentially be uninitialized when we link in a new node,
+specifically when the extent_io_tree is empty. This means we could have
+garbage in the parent color. I don't know what the ramifications are of
+that, but it's probably not great, so fix this by initializing parent to
+NULL. I spot checked all of our other usages in btrfs and we appear to
+be doing the correct thing everywhere else.
+
+Fixes: c7e118cf98c7 ("btrfs: open code rbtree search in insert_state")
+CC: stable@vger.kernel.org # 6.0+
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/extent-io-tree.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/btrfs/extent-io-tree.c
++++ b/fs/btrfs/extent-io-tree.c
+@@ -397,7 +397,7 @@ static int insert_state(struct extent_io
+ u32 bits, struct extent_changeset *changeset)
+ {
+ struct rb_node **node;
+- struct rb_node *parent;
++ struct rb_node *parent = NULL;
+ const u64 end = state->end;
+
+ set_state_bits(tree, state, bits, changeset);
--- /dev/null
+From 5c51054896bcce1d33d39fead2af73fec24f40b6 Mon Sep 17 00:00:00 2001
+From: Yongqiang Liu <liuyongqiang13@huawei.com>
+Date: Thu, 10 Nov 2022 14:23:07 +0000
+Subject: cpufreq: Init completion before kobject_init_and_add()
+
+From: Yongqiang Liu <liuyongqiang13@huawei.com>
+
+commit 5c51054896bcce1d33d39fead2af73fec24f40b6 upstream.
+
+In cpufreq_policy_alloc(), it will call uninitialed completion in
+cpufreq_sysfs_release() when kobject_init_and_add() fails. And
+that will cause a crash such as the following page fault in complete:
+
+BUG: unable to handle page fault for address: fffffffffffffff8
+[..]
+RIP: 0010:complete+0x98/0x1f0
+[..]
+Call Trace:
+ kobject_put+0x1be/0x4c0
+ cpufreq_online.cold+0xee/0x1fd
+ cpufreq_add_dev+0x183/0x1e0
+ subsys_interface_register+0x3f5/0x4e0
+ cpufreq_register_driver+0x3b7/0x670
+ acpi_cpufreq_init+0x56c/0x1000 [acpi_cpufreq]
+ do_one_initcall+0x13d/0x780
+ do_init_module+0x1c3/0x630
+ load_module+0x6e67/0x73b0
+ __do_sys_finit_module+0x181/0x240
+ do_syscall_64+0x35/0x80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Fixes: 4ebe36c94aed ("cpufreq: Fix kobject memleak")
+Signed-off-by: Yongqiang Liu <liuyongqiang13@huawei.com>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Cc: 5.2+ <stable@vger.kernel.org> # 5.2+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cpufreq/cpufreq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -1207,6 +1207,7 @@ static struct cpufreq_policy *cpufreq_po
+ if (!zalloc_cpumask_var(&policy->real_cpus, GFP_KERNEL))
+ goto err_free_rcpumask;
+
++ init_completion(&policy->kobj_unregister);
+ ret = kobject_init_and_add(&policy->kobj, &ktype_cpufreq,
+ cpufreq_global_kobject, "policy%u", cpu);
+ if (ret) {
+@@ -1245,7 +1246,6 @@ static struct cpufreq_policy *cpufreq_po
+ init_rwsem(&policy->rwsem);
+ spin_lock_init(&policy->transition_lock);
+ init_waitqueue_head(&policy->transition_wait);
+- init_completion(&policy->kobj_unregister);
+ INIT_WORK(&policy->update, handle_update);
+
+ policy->cpu = cpu;
--- /dev/null
+From f04facfb993de47e2133b2b842d72b97b1c50162 Mon Sep 17 00:00:00 2001
+From: Fan Ni <fan.ni@samsung.com>
+Date: Mon, 7 Nov 2022 21:22:31 +0000
+Subject: cxl/region: Fix memdev reuse check
+
+From: Fan Ni <fan.ni@samsung.com>
+
+commit f04facfb993de47e2133b2b842d72b97b1c50162 upstream.
+
+Due to a typo, the check of whether or not a memdev has already been
+used as a target for the region (above code piece) will always be
+skipped. Given a memdev with more than one HDM decoder, an interleaved
+region can be created that maps multiple HPAs to the same DPA. According
+to CXL spec 3.0 8.1.3.8.4, "Aliasing (mapping more than one Host
+Physical Address (HPA) to a single Device Physical Address) is
+forbidden."
+
+Fix this by using existing iterator for memdev reuse check.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 384e624bb211 ("cxl/region: Attach endpoint decoders")
+Signed-off-by: Fan Ni <fan.ni@samsung.com>
+Link: https://lore.kernel.org/r/20221107212153.745993-1-fan.ni@samsung.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cxl/core/region.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/cxl/core/region.c
++++ b/drivers/cxl/core/region.c
+@@ -1226,7 +1226,7 @@ static int cxl_region_attach(struct cxl_
+ struct cxl_endpoint_decoder *cxled_target;
+ struct cxl_memdev *cxlmd_target;
+
+- cxled_target = p->targets[pos];
++ cxled_target = p->targets[i];
+ if (!cxled_target)
+ continue;
+
--- /dev/null
+From bf3e5da8cb43a671b32fc125fa81b8f6a3677192 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Thu, 1 Dec 2022 14:03:24 -0800
+Subject: cxl/region: Fix missing probe failure
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit bf3e5da8cb43a671b32fc125fa81b8f6a3677192 upstream.
+
+cxl_region_probe() allows for regions not in the 'commit' state to be
+enabled. Fail probe when the region is not committed otherwise the
+kernel may indicate that an address range is active when none of the
+decoders are active.
+
+Fixes: 8d48817df6ac ("cxl/region: Add region driver boiler plate")
+Cc: <stable@vger.kernel.org>
+Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Link: https://lore.kernel.org/r/166993220462.1995348.1698008475198427361.stgit@dwillia2-xfh.jf.intel.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cxl/core/region.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/cxl/core/region.c
++++ b/drivers/cxl/core/region.c
+@@ -1923,6 +1923,9 @@ static int cxl_region_probe(struct devic
+ */
+ up_read(&cxl_region_rwsem);
+
++ if (rc)
++ return rc;
++
+ switch (cxlr->mode) {
+ case CXL_DECODER_PMEM:
+ return devm_cxl_add_pmem_region(cxlr);
--- /dev/null
+From 32a7819ff8e25375c7515aaae5cfcb8c44a461b7 Mon Sep 17 00:00:00 2001
+From: Evan Quan <evan.quan@amd.com>
+Date: Mon, 5 Dec 2022 14:53:34 +0800
+Subject: drm/amd/pm: correct SMU13.0.0 pstate profiling clock settings
+
+From: Evan Quan <evan.quan@amd.com>
+
+commit 32a7819ff8e25375c7515aaae5cfcb8c44a461b7 upstream.
+
+Correct the pstate standard/peak profiling mode clock settings
+for SMU13.0.0.
+
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 6.0.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 22 ++++++++++++-------
+ 1 file changed, 15 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
+@@ -1349,9 +1349,17 @@ static int smu_v13_0_0_populate_umd_stat
+ &dpm_context->dpm_tables.fclk_table;
+ struct smu_umd_pstate_table *pstate_table =
+ &smu->pstate_table;
++ struct smu_table_context *table_context = &smu->smu_table;
++ PPTable_t *pptable = table_context->driver_pptable;
++ DriverReportedClocks_t driver_clocks =
++ pptable->SkuTable.DriverReportedClocks;
+
+ pstate_table->gfxclk_pstate.min = gfx_table->min;
+- pstate_table->gfxclk_pstate.peak = gfx_table->max;
++ if (driver_clocks.GameClockAc &&
++ (driver_clocks.GameClockAc < gfx_table->max))
++ pstate_table->gfxclk_pstate.peak = driver_clocks.GameClockAc;
++ else
++ pstate_table->gfxclk_pstate.peak = gfx_table->max;
+
+ pstate_table->uclk_pstate.min = mem_table->min;
+ pstate_table->uclk_pstate.peak = mem_table->max;
+@@ -1368,12 +1376,12 @@ static int smu_v13_0_0_populate_umd_stat
+ pstate_table->fclk_pstate.min = fclk_table->min;
+ pstate_table->fclk_pstate.peak = fclk_table->max;
+
+- /*
+- * For now, just use the mininum clock frequency.
+- * TODO: update them when the real pstate settings available
+- */
+- pstate_table->gfxclk_pstate.standard = gfx_table->min;
+- pstate_table->uclk_pstate.standard = mem_table->min;
++ if (driver_clocks.BaseClockAc &&
++ driver_clocks.BaseClockAc < gfx_table->max)
++ pstate_table->gfxclk_pstate.standard = driver_clocks.BaseClockAc;
++ else
++ pstate_table->gfxclk_pstate.standard = gfx_table->max;
++ pstate_table->uclk_pstate.standard = mem_table->max;
+ pstate_table->socclk_pstate.standard = soc_table->min;
+ pstate_table->vclk_pstate.standard = vclk_table->min;
+ pstate_table->dclk_pstate.standard = dclk_table->min;
--- /dev/null
+From 7a18e089eff02f17eaee49fc18641f5d16a8284b Mon Sep 17 00:00:00 2001
+From: Evan Quan <evan.quan@amd.com>
+Date: Mon, 5 Dec 2022 15:33:31 +0800
+Subject: drm/amd/pm: update SMU13.0.0 reported maximum shader clock
+
+From: Evan Quan <evan.quan@amd.com>
+
+commit 7a18e089eff02f17eaee49fc18641f5d16a8284b upstream.
+
+Update the reported maximum shader clock to the value which can
+be guarded to be achieved on all cards. This is to align with
+Window setting.
+
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 6.0.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 70 ++++++++++++++++++-
+ 1 file changed, 69 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
+@@ -517,6 +517,23 @@ static int smu_v13_0_0_set_default_dpm_t
+ dpm_table);
+ if (ret)
+ return ret;
++
++ /*
++ * Update the reported maximum shader clock to the value
++ * which can be guarded to be achieved on all cards. This
++ * is aligned with Window setting. And considering that value
++ * might be not the peak frequency the card can achieve, it
++ * is normal some real-time clock frequency can overtake this
++ * labelled maximum clock frequency(for example in pp_dpm_sclk
++ * sysfs output).
++ */
++ if (skutable->DriverReportedClocks.GameClockAc &&
++ (dpm_table->dpm_levels[dpm_table->count - 1].value >
++ skutable->DriverReportedClocks.GameClockAc)) {
++ dpm_table->dpm_levels[dpm_table->count - 1].value =
++ skutable->DriverReportedClocks.GameClockAc;
++ dpm_table->max = skutable->DriverReportedClocks.GameClockAc;
++ }
+ } else {
+ dpm_table->count = 1;
+ dpm_table->dpm_levels[0].value = smu->smu_table.boot_values.gfxclk / 100;
+@@ -779,6 +796,57 @@ static int smu_v13_0_0_get_smu_metrics_d
+ return ret;
+ }
+
++static int smu_v13_0_0_get_dpm_ultimate_freq(struct smu_context *smu,
++ enum smu_clk_type clk_type,
++ uint32_t *min,
++ uint32_t *max)
++{
++ struct smu_13_0_dpm_context *dpm_context =
++ smu->smu_dpm.dpm_context;
++ struct smu_13_0_dpm_table *dpm_table;
++
++ switch (clk_type) {
++ case SMU_MCLK:
++ case SMU_UCLK:
++ /* uclk dpm table */
++ dpm_table = &dpm_context->dpm_tables.uclk_table;
++ break;
++ case SMU_GFXCLK:
++ case SMU_SCLK:
++ /* gfxclk dpm table */
++ dpm_table = &dpm_context->dpm_tables.gfx_table;
++ break;
++ case SMU_SOCCLK:
++ /* socclk dpm table */
++ dpm_table = &dpm_context->dpm_tables.soc_table;
++ break;
++ case SMU_FCLK:
++ /* fclk dpm table */
++ dpm_table = &dpm_context->dpm_tables.fclk_table;
++ break;
++ case SMU_VCLK:
++ case SMU_VCLK1:
++ /* vclk dpm table */
++ dpm_table = &dpm_context->dpm_tables.vclk_table;
++ break;
++ case SMU_DCLK:
++ case SMU_DCLK1:
++ /* dclk dpm table */
++ dpm_table = &dpm_context->dpm_tables.dclk_table;
++ break;
++ default:
++ dev_err(smu->adev->dev, "Unsupported clock type!\n");
++ return -EINVAL;
++ }
++
++ if (min)
++ *min = dpm_table->min;
++ if (max)
++ *max = dpm_table->max;
++
++ return 0;
++}
++
+ static int smu_v13_0_0_read_sensor(struct smu_context *smu,
+ enum amd_pp_sensors sensor,
+ void *data,
+@@ -1813,7 +1881,7 @@ static const struct pptable_funcs smu_v1
+ .get_enabled_mask = smu_cmn_get_enabled_mask,
+ .dpm_set_vcn_enable = smu_v13_0_set_vcn_enable,
+ .dpm_set_jpeg_enable = smu_v13_0_set_jpeg_enable,
+- .get_dpm_ultimate_freq = smu_v13_0_get_dpm_ultimate_freq,
++ .get_dpm_ultimate_freq = smu_v13_0_0_get_dpm_ultimate_freq,
+ .get_vbios_bootup_values = smu_v13_0_get_vbios_bootup_values,
+ .read_sensor = smu_v13_0_0_read_sensor,
+ .feature_is_enabled = smu_cmn_feature_is_enabled,
--- /dev/null
+From 25836ce1df827cb4830291cb2325067efb46753a Mon Sep 17 00:00:00 2001
+From: Yazen Ghannam <yazen.ghannam@amd.com>
+Date: Tue, 18 Oct 2022 10:36:30 -0500
+Subject: EDAC/mc_sysfs: Increase legacy channel support to 12
+
+From: Yazen Ghannam <yazen.ghannam@amd.com>
+
+commit 25836ce1df827cb4830291cb2325067efb46753a upstream.
+
+Newer AMD systems, such as Genoa, can support up to 12 channels per EDAC
+"mc" device. These are detected by the device's EDAC module, and the
+current EDAC interface is properly enumerated. However, the legacy EDAC
+sysfs interface provides device attributes only for channels 0 to 7.
+Therefore, channels 8 to 11 will not be visible in the legacy interface.
+This was overlooked in the initial support for AMD Genoa.
+
+Add additional device attributes so that up to 12 channels are visible
+in the legacy EDAC sysfs interface.
+
+Fixes: e2be5955a886 ("EDAC/amd64: Add support for AMD Family 19h Models 10h-1Fh and A0h-AFh")
+Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20221018153630.14664-1-yazen.ghannam@amd.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/edac/edac_mc_sysfs.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- a/drivers/edac/edac_mc_sysfs.c
++++ b/drivers/edac/edac_mc_sysfs.c
+@@ -298,6 +298,14 @@ DEVICE_CHANNEL(ch6_dimm_label, S_IRUGO |
+ channel_dimm_label_show, channel_dimm_label_store, 6);
+ DEVICE_CHANNEL(ch7_dimm_label, S_IRUGO | S_IWUSR,
+ channel_dimm_label_show, channel_dimm_label_store, 7);
++DEVICE_CHANNEL(ch8_dimm_label, S_IRUGO | S_IWUSR,
++ channel_dimm_label_show, channel_dimm_label_store, 8);
++DEVICE_CHANNEL(ch9_dimm_label, S_IRUGO | S_IWUSR,
++ channel_dimm_label_show, channel_dimm_label_store, 9);
++DEVICE_CHANNEL(ch10_dimm_label, S_IRUGO | S_IWUSR,
++ channel_dimm_label_show, channel_dimm_label_store, 10);
++DEVICE_CHANNEL(ch11_dimm_label, S_IRUGO | S_IWUSR,
++ channel_dimm_label_show, channel_dimm_label_store, 11);
+
+ /* Total possible dynamic DIMM Label attribute file table */
+ static struct attribute *dynamic_csrow_dimm_attr[] = {
+@@ -309,6 +317,10 @@ static struct attribute *dynamic_csrow_d
+ &dev_attr_legacy_ch5_dimm_label.attr.attr,
+ &dev_attr_legacy_ch6_dimm_label.attr.attr,
+ &dev_attr_legacy_ch7_dimm_label.attr.attr,
++ &dev_attr_legacy_ch8_dimm_label.attr.attr,
++ &dev_attr_legacy_ch9_dimm_label.attr.attr,
++ &dev_attr_legacy_ch10_dimm_label.attr.attr,
++ &dev_attr_legacy_ch11_dimm_label.attr.attr,
+ NULL
+ };
+
+@@ -329,6 +341,14 @@ DEVICE_CHANNEL(ch6_ce_count, S_IRUGO,
+ channel_ce_count_show, NULL, 6);
+ DEVICE_CHANNEL(ch7_ce_count, S_IRUGO,
+ channel_ce_count_show, NULL, 7);
++DEVICE_CHANNEL(ch8_ce_count, S_IRUGO,
++ channel_ce_count_show, NULL, 8);
++DEVICE_CHANNEL(ch9_ce_count, S_IRUGO,
++ channel_ce_count_show, NULL, 9);
++DEVICE_CHANNEL(ch10_ce_count, S_IRUGO,
++ channel_ce_count_show, NULL, 10);
++DEVICE_CHANNEL(ch11_ce_count, S_IRUGO,
++ channel_ce_count_show, NULL, 11);
+
+ /* Total possible dynamic ce_count attribute file table */
+ static struct attribute *dynamic_csrow_ce_count_attr[] = {
+@@ -340,6 +360,10 @@ static struct attribute *dynamic_csrow_c
+ &dev_attr_legacy_ch5_ce_count.attr.attr,
+ &dev_attr_legacy_ch6_ce_count.attr.attr,
+ &dev_attr_legacy_ch7_ce_count.attr.attr,
++ &dev_attr_legacy_ch8_ce_count.attr.attr,
++ &dev_attr_legacy_ch9_ce_count.attr.attr,
++ &dev_attr_legacy_ch10_ce_count.attr.attr,
++ &dev_attr_legacy_ch11_ce_count.attr.attr,
+ NULL
+ };
+
--- /dev/null
+From 27e714c007e4ad01837bf0fac5c11913a38d7695 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Sat, 26 Nov 2022 03:17:17 +0000
+Subject: ext2: unbugger ext2_empty_dir()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 27e714c007e4ad01837bf0fac5c11913a38d7695 upstream.
+
+In 27cfa258951a "ext2: fix fs corruption when trying to remove
+a non-empty directory with IO error" a funny thing has happened:
+
+- page = ext2_get_page(inode, i, dir_has_error, &page_addr);
++ page = ext2_get_page(inode, i, 0, &page_addr);
+
+ - if (IS_ERR(page)) {
+ - dir_has_error = 1;
+ - continue;
+ - }
+ + if (IS_ERR(page))
+ + goto not_empty;
+
+And at not_empty: we hit ext2_put_page(page, page_addr), which does
+put_page(page). Which, unless I'm very mistaken, should oops
+immediately when given ERR_PTR(-E...) as page.
+
+OK, shit happens, insufficiently tested patches included. But when
+commit in question describes the fault-injection test that exercised
+that particular failure exit...
+
+Ow.
+
+CC: stable@vger.kernel.org
+Fixes: 27cfa258951a ("ext2: fix fs corruption when trying to remove a non-empty directory with IO error")
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext2/dir.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/ext2/dir.c
++++ b/fs/ext2/dir.c
+@@ -679,7 +679,7 @@ int ext2_empty_dir (struct inode * inode
+ page = ext2_get_page(inode, i, 0, &page_addr);
+
+ if (IS_ERR(page))
+- goto not_empty;
++ return 0;
+
+ kaddr = page_addr;
+ de = (ext2_dirent *)kaddr;
--- /dev/null
+From d87a7b4c77a997d5388566dd511ca8e6b8e8a0a8 Mon Sep 17 00:00:00 2001
+From: Bixuan Cui <cuibixuan@linux.alibaba.com>
+Date: Tue, 11 Oct 2022 19:33:44 +0800
+Subject: jbd2: use the correct print format
+
+From: Bixuan Cui <cuibixuan@linux.alibaba.com>
+
+commit d87a7b4c77a997d5388566dd511ca8e6b8e8a0a8 upstream.
+
+The print format error was found when using ftrace event:
+ <...>-1406 [000] .... 23599442.895823: jbd2_end_commit: dev 252,8 transaction -1866216965 sync 0 head -1866217368
+ <...>-1406 [000] .... 23599442.896299: jbd2_start_commit: dev 252,8 transaction -1866216964 sync 0
+
+Use the correct print format for transaction, head and tid.
+
+Fixes: 879c5e6b7cb4 ('jbd2: convert instrumentation from markers to tracepoints')
+Signed-off-by: Bixuan Cui <cuibixuan@linux.alibaba.com>
+Reviewed-by: Jason Yan <yanaijie@huawei.com>
+Link: https://lore.kernel.org/r/1665488024-95172-1-git-send-email-cuibixuan@linux.alibaba.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/trace/events/jbd2.h | 44 ++++++++++++++++++++++----------------------
+ 1 file changed, 22 insertions(+), 22 deletions(-)
+
+--- a/include/trace/events/jbd2.h
++++ b/include/trace/events/jbd2.h
+@@ -40,7 +40,7 @@ DECLARE_EVENT_CLASS(jbd2_commit,
+ TP_STRUCT__entry(
+ __field( dev_t, dev )
+ __field( char, sync_commit )
+- __field( int, transaction )
++ __field( tid_t, transaction )
+ ),
+
+ TP_fast_assign(
+@@ -49,7 +49,7 @@ DECLARE_EVENT_CLASS(jbd2_commit,
+ __entry->transaction = commit_transaction->t_tid;
+ ),
+
+- TP_printk("dev %d,%d transaction %d sync %d",
++ TP_printk("dev %d,%d transaction %u sync %d",
+ MAJOR(__entry->dev), MINOR(__entry->dev),
+ __entry->transaction, __entry->sync_commit)
+ );
+@@ -97,8 +97,8 @@ TRACE_EVENT(jbd2_end_commit,
+ TP_STRUCT__entry(
+ __field( dev_t, dev )
+ __field( char, sync_commit )
+- __field( int, transaction )
+- __field( int, head )
++ __field( tid_t, transaction )
++ __field( tid_t, head )
+ ),
+
+ TP_fast_assign(
+@@ -108,7 +108,7 @@ TRACE_EVENT(jbd2_end_commit,
+ __entry->head = journal->j_tail_sequence;
+ ),
+
+- TP_printk("dev %d,%d transaction %d sync %d head %d",
++ TP_printk("dev %d,%d transaction %u sync %d head %u",
+ MAJOR(__entry->dev), MINOR(__entry->dev),
+ __entry->transaction, __entry->sync_commit, __entry->head)
+ );
+@@ -134,14 +134,14 @@ TRACE_EVENT(jbd2_submit_inode_data,
+ );
+
+ DECLARE_EVENT_CLASS(jbd2_handle_start_class,
+- TP_PROTO(dev_t dev, unsigned long tid, unsigned int type,
++ TP_PROTO(dev_t dev, tid_t tid, unsigned int type,
+ unsigned int line_no, int requested_blocks),
+
+ TP_ARGS(dev, tid, type, line_no, requested_blocks),
+
+ TP_STRUCT__entry(
+ __field( dev_t, dev )
+- __field( unsigned long, tid )
++ __field( tid_t, tid )
+ __field( unsigned int, type )
+ __field( unsigned int, line_no )
+ __field( int, requested_blocks)
+@@ -155,28 +155,28 @@ DECLARE_EVENT_CLASS(jbd2_handle_start_cl
+ __entry->requested_blocks = requested_blocks;
+ ),
+
+- TP_printk("dev %d,%d tid %lu type %u line_no %u "
++ TP_printk("dev %d,%d tid %u type %u line_no %u "
+ "requested_blocks %d",
+ MAJOR(__entry->dev), MINOR(__entry->dev), __entry->tid,
+ __entry->type, __entry->line_no, __entry->requested_blocks)
+ );
+
+ DEFINE_EVENT(jbd2_handle_start_class, jbd2_handle_start,
+- TP_PROTO(dev_t dev, unsigned long tid, unsigned int type,
++ TP_PROTO(dev_t dev, tid_t tid, unsigned int type,
+ unsigned int line_no, int requested_blocks),
+
+ TP_ARGS(dev, tid, type, line_no, requested_blocks)
+ );
+
+ DEFINE_EVENT(jbd2_handle_start_class, jbd2_handle_restart,
+- TP_PROTO(dev_t dev, unsigned long tid, unsigned int type,
++ TP_PROTO(dev_t dev, tid_t tid, unsigned int type,
+ unsigned int line_no, int requested_blocks),
+
+ TP_ARGS(dev, tid, type, line_no, requested_blocks)
+ );
+
+ TRACE_EVENT(jbd2_handle_extend,
+- TP_PROTO(dev_t dev, unsigned long tid, unsigned int type,
++ TP_PROTO(dev_t dev, tid_t tid, unsigned int type,
+ unsigned int line_no, int buffer_credits,
+ int requested_blocks),
+
+@@ -184,7 +184,7 @@ TRACE_EVENT(jbd2_handle_extend,
+
+ TP_STRUCT__entry(
+ __field( dev_t, dev )
+- __field( unsigned long, tid )
++ __field( tid_t, tid )
+ __field( unsigned int, type )
+ __field( unsigned int, line_no )
+ __field( int, buffer_credits )
+@@ -200,7 +200,7 @@ TRACE_EVENT(jbd2_handle_extend,
+ __entry->requested_blocks = requested_blocks;
+ ),
+
+- TP_printk("dev %d,%d tid %lu type %u line_no %u "
++ TP_printk("dev %d,%d tid %u type %u line_no %u "
+ "buffer_credits %d requested_blocks %d",
+ MAJOR(__entry->dev), MINOR(__entry->dev), __entry->tid,
+ __entry->type, __entry->line_no, __entry->buffer_credits,
+@@ -208,7 +208,7 @@ TRACE_EVENT(jbd2_handle_extend,
+ );
+
+ TRACE_EVENT(jbd2_handle_stats,
+- TP_PROTO(dev_t dev, unsigned long tid, unsigned int type,
++ TP_PROTO(dev_t dev, tid_t tid, unsigned int type,
+ unsigned int line_no, int interval, int sync,
+ int requested_blocks, int dirtied_blocks),
+
+@@ -217,7 +217,7 @@ TRACE_EVENT(jbd2_handle_stats,
+
+ TP_STRUCT__entry(
+ __field( dev_t, dev )
+- __field( unsigned long, tid )
++ __field( tid_t, tid )
+ __field( unsigned int, type )
+ __field( unsigned int, line_no )
+ __field( int, interval )
+@@ -237,7 +237,7 @@ TRACE_EVENT(jbd2_handle_stats,
+ __entry->dirtied_blocks = dirtied_blocks;
+ ),
+
+- TP_printk("dev %d,%d tid %lu type %u line_no %u interval %d "
++ TP_printk("dev %d,%d tid %u type %u line_no %u interval %d "
+ "sync %d requested_blocks %d dirtied_blocks %d",
+ MAJOR(__entry->dev), MINOR(__entry->dev), __entry->tid,
+ __entry->type, __entry->line_no, __entry->interval,
+@@ -246,14 +246,14 @@ TRACE_EVENT(jbd2_handle_stats,
+ );
+
+ TRACE_EVENT(jbd2_run_stats,
+- TP_PROTO(dev_t dev, unsigned long tid,
++ TP_PROTO(dev_t dev, tid_t tid,
+ struct transaction_run_stats_s *stats),
+
+ TP_ARGS(dev, tid, stats),
+
+ TP_STRUCT__entry(
+ __field( dev_t, dev )
+- __field( unsigned long, tid )
++ __field( tid_t, tid )
+ __field( unsigned long, wait )
+ __field( unsigned long, request_delay )
+ __field( unsigned long, running )
+@@ -279,7 +279,7 @@ TRACE_EVENT(jbd2_run_stats,
+ __entry->blocks_logged = stats->rs_blocks_logged;
+ ),
+
+- TP_printk("dev %d,%d tid %lu wait %u request_delay %u running %u "
++ TP_printk("dev %d,%d tid %u wait %u request_delay %u running %u "
+ "locked %u flushing %u logging %u handle_count %u "
+ "blocks %u blocks_logged %u",
+ MAJOR(__entry->dev), MINOR(__entry->dev), __entry->tid,
+@@ -294,14 +294,14 @@ TRACE_EVENT(jbd2_run_stats,
+ );
+
+ TRACE_EVENT(jbd2_checkpoint_stats,
+- TP_PROTO(dev_t dev, unsigned long tid,
++ TP_PROTO(dev_t dev, tid_t tid,
+ struct transaction_chp_stats_s *stats),
+
+ TP_ARGS(dev, tid, stats),
+
+ TP_STRUCT__entry(
+ __field( dev_t, dev )
+- __field( unsigned long, tid )
++ __field( tid_t, tid )
+ __field( unsigned long, chp_time )
+ __field( __u32, forced_to_close )
+ __field( __u32, written )
+@@ -317,7 +317,7 @@ TRACE_EVENT(jbd2_checkpoint_stats,
+ __entry->dropped = stats->cs_dropped;
+ ),
+
+- TP_printk("dev %d,%d tid %lu chp_time %u forced_to_close %u "
++ TP_printk("dev %d,%d tid %u chp_time %u forced_to_close %u "
+ "written %u dropped %u",
+ MAJOR(__entry->dev), MINOR(__entry->dev), __entry->tid,
+ jiffies_to_msecs(__entry->chp_time),
--- /dev/null
+From 26df05a8c1420ad3de314fdd407e7fc2058cc7aa Mon Sep 17 00:00:00 2001
+From: Steven Rostedt <rostedt@goodmis.org>
+Date: Wed, 30 Nov 2022 17:54:34 -0500
+Subject: kest.pl: Fix grub2 menu handling for rebooting
+
+From: Steven Rostedt <rostedt@goodmis.org>
+
+commit 26df05a8c1420ad3de314fdd407e7fc2058cc7aa upstream.
+
+grub2 has submenus where to use grub-reboot, it requires:
+
+ grub-reboot X>Y
+
+where X is the main index and Y is the submenu. Thus if you have:
+
+menuentry 'Debian GNU/Linux' --class debian --class gnu-linux ...
+ [...]
+}
+submenu 'Advanced options for Debian GNU/Linux' $menuentry_id_option ...
+ menuentry 'Debian GNU/Linux, with Linux 6.0.0-4-amd64' --class debian --class gnu-linux ...
+ [...]
+ }
+ menuentry 'Debian GNU/Linux, with Linux 6.0.0-4-amd64 (recovery mode)' --class debian --class gnu-linux ...
+ [...]
+ }
+ menuentry 'Debian GNU/Linux, with Linux test' --class debian --class gnu-linux ...
+ [...]
+ }
+
+And wanted to boot to the "Linux test" kernel, you need to run:
+
+ # grub-reboot 1>2
+
+As 1 is the second top menu (the submenu) and 2 is the third of the sub
+menu entries.
+
+Have the grub.cfg parsing for grub2 handle such cases.
+
+Cc: stable@vger.kernel.org
+Fixes: a15ba91361d46 ("ktest: Add support for grub2")
+Reviewed-by: John 'Warthog9' Hawley (VMware) <warthog9@eaglescrag.net>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/ktest/ktest.pl | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+--- a/tools/testing/ktest/ktest.pl
++++ b/tools/testing/ktest/ktest.pl
+@@ -1963,7 +1963,7 @@ sub run_scp_mod {
+
+ sub _get_grub_index {
+
+- my ($command, $target, $skip) = @_;
++ my ($command, $target, $skip, $submenu) = @_;
+
+ return if (defined($grub_number) && defined($last_grub_menu) &&
+ $last_grub_menu eq $grub_menu && defined($last_machine) &&
+@@ -1980,11 +1980,16 @@ sub _get_grub_index {
+
+ my $found = 0;
+
++ my $submenu_number = 0;
++
+ while (<IN>) {
+ if (/$target/) {
+ $grub_number++;
+ $found = 1;
+ last;
++ } elsif (defined($submenu) && /$submenu/) {
++ $submenu_number++;
++ $grub_number = -1;
+ } elsif (/$skip/) {
+ $grub_number++;
+ }
+@@ -1993,6 +1998,9 @@ sub _get_grub_index {
+
+ dodie "Could not find '$grub_menu' through $command on $machine"
+ if (!$found);
++ if ($submenu_number > 0) {
++ $grub_number = "$submenu_number>$grub_number";
++ }
+ doprint "$grub_number\n";
+ $last_grub_menu = $grub_menu;
+ $last_machine = $machine;
+@@ -2003,6 +2011,7 @@ sub get_grub_index {
+ my $command;
+ my $target;
+ my $skip;
++ my $submenu;
+ my $grub_menu_qt;
+
+ if ($reboot_type !~ /^grub/) {
+@@ -2017,8 +2026,9 @@ sub get_grub_index {
+ $skip = '^\s*title\s';
+ } elsif ($reboot_type eq "grub2") {
+ $command = "cat $grub_file";
+- $target = '^menuentry.*' . $grub_menu_qt;
+- $skip = '^menuentry\s|^submenu\s';
++ $target = '^\s*menuentry.*' . $grub_menu_qt;
++ $skip = '^\s*menuentry';
++ $submenu = '^\s*submenu\s';
+ } elsif ($reboot_type eq "grub2bls") {
+ $command = $grub_bls_get;
+ $target = '^title=.*' . $grub_menu_qt;
+@@ -2027,7 +2037,7 @@ sub get_grub_index {
+ return;
+ }
+
+- _get_grub_index($command, $target, $skip);
++ _get_grub_index($command, $target, $skip, $submenu);
+ }
+
+ sub wait_for_input {
+@@ -2090,7 +2100,7 @@ sub reboot_to {
+ if ($reboot_type eq "grub") {
+ run_ssh "'(echo \"savedefault --default=$grub_number --once\" | grub --batch)'";
+ } elsif (($reboot_type eq "grub2") or ($reboot_type eq "grub2bls")) {
+- run_ssh "$grub_reboot $grub_number";
++ run_ssh "$grub_reboot \"'$grub_number'\"";
+ } elsif ($reboot_type eq "syslinux") {
+ run_ssh "$syslinux --once \\\"$syslinux_label\\\" $syslinux_path";
+ } elsif (defined $reboot_script) {
--- /dev/null
+From ef784eebb56425eed6e9b16e7d47e5c00dcf9c38 Mon Sep 17 00:00:00 2001
+From: Steven Rostedt <rostedt@goodmis.org>
+Date: Fri, 2 Dec 2022 11:59:36 -0500
+Subject: ktest.pl minconfig: Unset configs instead of just removing them
+
+From: Steven Rostedt <rostedt@goodmis.org>
+
+commit ef784eebb56425eed6e9b16e7d47e5c00dcf9c38 upstream.
+
+After a full run of a make_min_config test, I noticed there were a lot of
+CONFIGs still enabled that really should not be. Looking at them, I
+noticed they were all defined as "default y". The issue is that the test
+simple removes the config and re-runs make oldconfig, which enables it
+again because it is set to default 'y'. Instead, explicitly disable the
+config with writing "# CONFIG_FOO is not set" to the file to keep it from
+being set again.
+
+With this change, one of my box's minconfigs went from 768 configs set,
+down to 521 configs set.
+
+Link: https://lkml.kernel.org/r/20221202115936.016fce23@gandalf.local.home
+
+Cc: stable@vger.kernel.org
+Fixes: 0a05c769a9de5 ("ktest: Added config_bisect test type")
+Reviewed-by: John 'Warthog9' Hawley (VMware) <warthog9@eaglescrag.net>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/ktest/ktest.pl | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/tools/testing/ktest/ktest.pl
++++ b/tools/testing/ktest/ktest.pl
+@@ -3778,9 +3778,10 @@ sub test_this_config {
+ # .config to make sure it is missing the config that
+ # we had before
+ my %configs = %min_configs;
+- delete $configs{$config};
++ $configs{$config} = "# $config is not set";
+ make_new_config ((values %configs), (values %keep_configs));
+ make_oldconfig;
++ delete $configs{$config};
+ undef %configs;
+ assign_configs \%configs, $output_config;
+
--- /dev/null
+From d3f3c2fe54e30b0636496d842ffbb5ad3a547f9b Mon Sep 17 00:00:00 2001
+From: Smitha T Murthy <smitha.t@samsung.com>
+Date: Wed, 7 Sep 2022 16:02:26 +0530
+Subject: media: s5p-mfc: Clear workbit to handle error condition
+
+From: Smitha T Murthy <smitha.t@samsung.com>
+
+commit d3f3c2fe54e30b0636496d842ffbb5ad3a547f9b upstream.
+
+During error on CLOSE_INSTANCE command, ctx_work_bits was not getting
+cleared. During consequent mfc execution NULL pointer dereferencing of
+this context led to kernel panic. This patch fixes this issue by making
+sure to clear ctx_work_bits always.
+
+Fixes: 818cd91ab8c6 ("[media] s5p-mfc: Extract open/close MFC instance commands")
+Cc: stable@vger.kernel.org
+Cc: linux-fsd@tesla.com
+Signed-off-by: Smitha T Murthy <smitha.t@samsung.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/samsung/s5p-mfc/s5p_mfc_ctrl.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/platform/samsung/s5p-mfc/s5p_mfc_ctrl.c
++++ b/drivers/media/platform/samsung/s5p-mfc/s5p_mfc_ctrl.c
+@@ -468,8 +468,10 @@ void s5p_mfc_close_mfc_inst(struct s5p_m
+ s5p_mfc_hw_call(dev->mfc_ops, try_run, dev);
+ /* Wait until instance is returned or timeout occurred */
+ if (s5p_mfc_wait_for_done_ctx(ctx,
+- S5P_MFC_R2H_CMD_CLOSE_INSTANCE_RET, 0))
++ S5P_MFC_R2H_CMD_CLOSE_INSTANCE_RET, 0)){
++ clear_work_bit_irqsave(ctx);
+ mfc_err("Err returning instance\n");
++ }
+
+ /* Free resources */
+ s5p_mfc_hw_call(dev->mfc_ops, release_codec_buffers, ctx);
--- /dev/null
+From 06710cd5d2436135046898d7e4b9408c8bb99446 Mon Sep 17 00:00:00 2001
+From: Smitha T Murthy <smitha.t@samsung.com>
+Date: Wed, 7 Sep 2022 16:02:25 +0530
+Subject: media: s5p-mfc: Fix in register read and write for H264
+
+From: Smitha T Murthy <smitha.t@samsung.com>
+
+commit 06710cd5d2436135046898d7e4b9408c8bb99446 upstream.
+
+Few of the H264 encoder registers written were not getting reflected
+since the read values were not stored and getting overwritten.
+
+Fixes: 6a9c6f681257 ("[media] s5p-mfc: Add variants to access mfc registers")
+
+Cc: stable@vger.kernel.org
+Cc: linux-fsd@tesla.com
+Signed-off-by: Smitha T Murthy <smitha.t@samsung.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/samsung/s5p-mfc/s5p_mfc_opr_v6.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/media/platform/samsung/s5p-mfc/s5p_mfc_opr_v6.c
++++ b/drivers/media/platform/samsung/s5p-mfc/s5p_mfc_opr_v6.c
+@@ -1060,7 +1060,7 @@ static int s5p_mfc_set_enc_params_h264(s
+ }
+
+ /* aspect ratio VUI */
+- readl(mfc_regs->e_h264_options);
++ reg = readl(mfc_regs->e_h264_options);
+ reg &= ~(0x1 << 5);
+ reg |= ((p_h264->vui_sar & 0x1) << 5);
+ writel(reg, mfc_regs->e_h264_options);
+@@ -1083,7 +1083,7 @@ static int s5p_mfc_set_enc_params_h264(s
+
+ /* intra picture period for H.264 open GOP */
+ /* control */
+- readl(mfc_regs->e_h264_options);
++ reg = readl(mfc_regs->e_h264_options);
+ reg &= ~(0x1 << 4);
+ reg |= ((p_h264->open_gop & 0x1) << 4);
+ writel(reg, mfc_regs->e_h264_options);
+@@ -1097,23 +1097,23 @@ static int s5p_mfc_set_enc_params_h264(s
+ }
+
+ /* 'WEIGHTED_BI_PREDICTION' for B is disable */
+- readl(mfc_regs->e_h264_options);
++ reg = readl(mfc_regs->e_h264_options);
+ reg &= ~(0x3 << 9);
+ writel(reg, mfc_regs->e_h264_options);
+
+ /* 'CONSTRAINED_INTRA_PRED_ENABLE' is disable */
+- readl(mfc_regs->e_h264_options);
++ reg = readl(mfc_regs->e_h264_options);
+ reg &= ~(0x1 << 14);
+ writel(reg, mfc_regs->e_h264_options);
+
+ /* ASO */
+- readl(mfc_regs->e_h264_options);
++ reg = readl(mfc_regs->e_h264_options);
+ reg &= ~(0x1 << 6);
+ reg |= ((p_h264->aso & 0x1) << 6);
+ writel(reg, mfc_regs->e_h264_options);
+
+ /* hier qp enable */
+- readl(mfc_regs->e_h264_options);
++ reg = readl(mfc_regs->e_h264_options);
+ reg &= ~(0x1 << 8);
+ reg |= ((p_h264->open_gop & 0x1) << 8);
+ writel(reg, mfc_regs->e_h264_options);
+@@ -1134,7 +1134,7 @@ static int s5p_mfc_set_enc_params_h264(s
+ writel(reg, mfc_regs->e_h264_num_t_layer);
+
+ /* frame packing SEI generation */
+- readl(mfc_regs->e_h264_options);
++ reg = readl(mfc_regs->e_h264_options);
+ reg &= ~(0x1 << 25);
+ reg |= ((p_h264->sei_frame_packing & 0x1) << 25);
+ writel(reg, mfc_regs->e_h264_options);
--- /dev/null
+From d8a46bc4e1e0446459daa77c4ce14218d32dacf9 Mon Sep 17 00:00:00 2001
+From: Smitha T Murthy <smitha.t@samsung.com>
+Date: Wed, 7 Sep 2022 16:02:27 +0530
+Subject: media: s5p-mfc: Fix to handle reference queue during finishing
+
+From: Smitha T Murthy <smitha.t@samsung.com>
+
+commit d8a46bc4e1e0446459daa77c4ce14218d32dacf9 upstream.
+
+On receiving last buffer driver puts MFC to MFCINST_FINISHING state which
+in turn skips transferring of frame from SRC to REF queue. This causes
+driver to stop MFC encoding and last frame is lost.
+
+This patch guarantees safe handling of frames during MFCINST_FINISHING and
+correct clearing of workbit to avoid early stopping of encoding.
+
+Fixes: af9357467810 ("[media] MFC: Add MFC 5.1 V4L2 driver")
+
+Cc: stable@vger.kernel.org
+Cc: linux-fsd@tesla.com
+Signed-off-by: Smitha T Murthy <smitha.t@samsung.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/samsung/s5p-mfc/s5p_mfc_enc.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/samsung/s5p-mfc/s5p_mfc_enc.c
++++ b/drivers/media/platform/samsung/s5p-mfc/s5p_mfc_enc.c
+@@ -1218,6 +1218,7 @@ static int enc_post_frame_start(struct s
+ unsigned long mb_y_addr, mb_c_addr;
+ int slice_type;
+ unsigned int strm_size;
++ bool src_ready;
+
+ slice_type = s5p_mfc_hw_call(dev->mfc_ops, get_enc_slice_type, dev);
+ strm_size = s5p_mfc_hw_call(dev->mfc_ops, get_enc_strm_size, dev);
+@@ -1257,7 +1258,8 @@ static int enc_post_frame_start(struct s
+ }
+ }
+ }
+- if ((ctx->src_queue_cnt > 0) && (ctx->state == MFCINST_RUNNING)) {
++ if (ctx->src_queue_cnt > 0 && (ctx->state == MFCINST_RUNNING ||
++ ctx->state == MFCINST_FINISHING)) {
+ mb_entry = list_entry(ctx->src_queue.next, struct s5p_mfc_buf,
+ list);
+ if (mb_entry->flags & MFC_BUF_FLAG_USED) {
+@@ -1288,7 +1290,13 @@ static int enc_post_frame_start(struct s
+ vb2_set_plane_payload(&mb_entry->b->vb2_buf, 0, strm_size);
+ vb2_buffer_done(&mb_entry->b->vb2_buf, VB2_BUF_STATE_DONE);
+ }
+- if ((ctx->src_queue_cnt == 0) || (ctx->dst_queue_cnt == 0))
++
++ src_ready = true;
++ if (ctx->state == MFCINST_RUNNING && ctx->src_queue_cnt == 0)
++ src_ready = false;
++ if (ctx->state == MFCINST_FINISHING && ctx->ref_queue_cnt == 0)
++ src_ready = false;
++ if (!src_ready || ctx->dst_queue_cnt == 0)
+ clear_work_bit(ctx);
+
+ return 0;
--- /dev/null
+From 7392134428c92a4cb541bd5c8f4f5c8d2e88364d Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Mon, 24 Oct 2022 17:23:43 +0200
+Subject: media: stv0288: use explicitly signed char
+
+From: Jason A. Donenfeld <Jason@zx2c4.com>
+
+commit 7392134428c92a4cb541bd5c8f4f5c8d2e88364d upstream.
+
+With char becoming unsigned by default, and with `char` alone being
+ambiguous and based on architecture, signed chars need to be marked
+explicitly as such. Use `s8` and `u8` types here, since that's what
+surrounding code does. This fixes:
+
+drivers/media/dvb-frontends/stv0288.c:471 stv0288_set_frontend() warn: assigning (-9) to unsigned variable 'tm'
+drivers/media/dvb-frontends/stv0288.c:471 stv0288_set_frontend() warn: we never enter this loop
+
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Cc: linux-media@vger.kernel.org
+Cc: stable@vger.kernel.org
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/dvb-frontends/stv0288.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/dvb-frontends/stv0288.c
++++ b/drivers/media/dvb-frontends/stv0288.c
+@@ -440,9 +440,8 @@ static int stv0288_set_frontend(struct d
+ struct stv0288_state *state = fe->demodulator_priv;
+ struct dtv_frontend_properties *c = &fe->dtv_property_cache;
+
+- char tm;
+- unsigned char tda[3];
+- u8 reg, time_out = 0;
++ u8 tda[3], reg, time_out = 0;
++ s8 tm;
+
+ dprintk("%s : FE_SET_FRONTEND\n", __func__);
+
--- /dev/null
+From ff874dbc4f868af128b412a9bd92637103cf11d7 Mon Sep 17 00:00:00 2001
+From: Wenchao Chen <wenchao.chen@unisoc.com>
+Date: Wed, 7 Dec 2022 13:19:09 +0800
+Subject: mmc: sdhci-sprd: Disable CLK_AUTO when the clock is less than 400K
+
+From: Wenchao Chen <wenchao.chen@unisoc.com>
+
+commit ff874dbc4f868af128b412a9bd92637103cf11d7 upstream.
+
+When the clock is less than 400K, some SD cards fail to initialize
+because CLK_AUTO is enabled.
+
+Fixes: fb8bd90f83c4 ("mmc: sdhci-sprd: Add Spreadtrum's initial host controller")
+Signed-off-by: Wenchao Chen <wenchao.chen@unisoc.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20221207051909.32126-1-wenchao.chen@unisoc.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci-sprd.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+--- a/drivers/mmc/host/sdhci-sprd.c
++++ b/drivers/mmc/host/sdhci-sprd.c
+@@ -228,13 +228,15 @@ static inline void _sdhci_sprd_set_clock
+ div = ((div & 0x300) >> 2) | ((div & 0xFF) << 8);
+ sdhci_enable_clk(host, div);
+
+- /* enable auto gate sdhc_enable_auto_gate */
+- val = sdhci_readl(host, SDHCI_SPRD_REG_32_BUSY_POSI);
+- mask = SDHCI_SPRD_BIT_OUTR_CLK_AUTO_EN |
+- SDHCI_SPRD_BIT_INNR_CLK_AUTO_EN;
+- if (mask != (val & mask)) {
+- val |= mask;
+- sdhci_writel(host, val, SDHCI_SPRD_REG_32_BUSY_POSI);
++ /* Enable CLK_AUTO when the clock is greater than 400K. */
++ if (clk > 400000) {
++ val = sdhci_readl(host, SDHCI_SPRD_REG_32_BUSY_POSI);
++ mask = SDHCI_SPRD_BIT_OUTR_CLK_AUTO_EN |
++ SDHCI_SPRD_BIT_INNR_CLK_AUTO_EN;
++ if (mask != (val & mask)) {
++ val |= mask;
++ sdhci_writel(host, val, SDHCI_SPRD_REG_32_BUSY_POSI);
++ }
+ }
+ }
+
--- /dev/null
+From 6532783310e2b2f50dc13f46c49aa6546cb6e7a3 Mon Sep 17 00:00:00 2001
+From: Alexander Antonov <alexander.antonov@linux.intel.com>
+Date: Thu, 17 Nov 2022 12:28:25 +0000
+Subject: perf/x86/intel/uncore: Clear attr_update properly
+
+From: Alexander Antonov <alexander.antonov@linux.intel.com>
+
+commit 6532783310e2b2f50dc13f46c49aa6546cb6e7a3 upstream.
+
+Current clear_attr_update procedure in pmu_set_mapping() sets attr_update
+field in NULL that is not correct because intel_uncore_type pmu types can
+contain several groups in attr_update field. For example, SPR platform
+already has uncore_alias_group to update and then UPI topology group will
+be added in next patches.
+
+Fix current behavior and clear attr_update group related to mapping only.
+
+Fixes: bb42b3d39781 ("perf/x86/intel/uncore: Expose an Uncore unit to IIO PMON mapping")
+Signed-off-by: Alexander Antonov <alexander.antonov@linux.intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20221117122833.3103580-4-alexander.antonov@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/events/intel/uncore_snbep.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/events/intel/uncore_snbep.c
++++ b/arch/x86/events/intel/uncore_snbep.c
+@@ -3804,6 +3804,21 @@ static const struct attribute_group *skx
+ NULL,
+ };
+
++static void pmu_clear_mapping_attr(const struct attribute_group **groups,
++ struct attribute_group *ag)
++{
++ int i;
++
++ for (i = 0; groups[i]; i++) {
++ if (groups[i] == ag) {
++ for (i++; groups[i]; i++)
++ groups[i - 1] = groups[i];
++ groups[i - 1] = NULL;
++ break;
++ }
++ }
++}
++
+ static int
+ pmu_iio_set_mapping(struct intel_uncore_type *type, struct attribute_group *ag)
+ {
+@@ -3852,7 +3867,7 @@ clear_attrs:
+ clear_topology:
+ kfree(type->topology);
+ clear_attr_update:
+- type->attr_update = NULL;
++ pmu_clear_mapping_attr(type->attr_update, ag);
+ return ret;
+ }
+
--- /dev/null
+From efe062705d149b20a15498cb999a9edbb8241e6f Mon Sep 17 00:00:00 2001
+From: Alexander Antonov <alexander.antonov@linux.intel.com>
+Date: Thu, 17 Nov 2022 12:28:26 +0000
+Subject: perf/x86/intel/uncore: Disable I/O stacks to PMU mapping on ICX-D
+
+From: Alexander Antonov <alexander.antonov@linux.intel.com>
+
+commit efe062705d149b20a15498cb999a9edbb8241e6f upstream.
+
+Current implementation of I/O stacks to PMU mapping doesn't support ICX-D.
+Detect ICX-D system to disable mapping.
+
+Fixes: 10337e95e04c ("perf/x86/intel/uncore: Enable I/O stacks to IIO PMON mapping on ICX")
+Signed-off-by: Alexander Antonov <alexander.antonov@linux.intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20221117122833.3103580-5-alexander.antonov@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/events/intel/uncore.h | 1 +
+ arch/x86/events/intel/uncore_snbep.c | 5 +++++
+ 2 files changed, 6 insertions(+)
+
+--- a/arch/x86/events/intel/uncore.h
++++ b/arch/x86/events/intel/uncore.h
+@@ -2,6 +2,7 @@
+ #include <linux/slab.h>
+ #include <linux/pci.h>
+ #include <asm/apicdef.h>
++#include <asm/intel-family.h>
+ #include <linux/io-64-nonatomic-lo-hi.h>
+
+ #include <linux/perf_event.h>
+--- a/arch/x86/events/intel/uncore_snbep.c
++++ b/arch/x86/events/intel/uncore_snbep.c
+@@ -5144,6 +5144,11 @@ static int icx_iio_get_topology(struct i
+
+ static int icx_iio_set_mapping(struct intel_uncore_type *type)
+ {
++ /* Detect ICX-D system. This case is not supported */
++ if (boot_cpu_data.x86_model == INTEL_FAM6_ICELAKE_D) {
++ pmu_clear_mapping_attr(type->attr_update, &icx_iio_mapping_group);
++ return -EPERM;
++ }
+ return pmu_iio_set_mapping(type, &icx_iio_mapping_group);
+ }
+
--- /dev/null
+From d8a5b59c5fc75c99ba17e3eb1a8f580d8d172b28 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Mon, 14 Nov 2022 09:13:41 +0100
+Subject: phy: qcom-qmp-combo: fix out-of-bounds clock access
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit d8a5b59c5fc75c99ba17e3eb1a8f580d8d172b28 upstream.
+
+The SM8250 only uses three clocks but the DP configuration erroneously
+described four clocks.
+
+In case the DP part of the PHY is initialised before the USB part, this
+would lead to uninitialised memory beyond the bulk-clocks array to be
+treated as a clock pointer as the clocks are requested based on the USB
+configuration.
+
+Fixes: aff188feb5e1 ("phy: qcom-qmp: add support for sm8250-usb3-dp phy")
+Cc: stable@vger.kernel.org # 5.13
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Link: https://lore.kernel.org/r/20221114081346.5116-2-johan+linaro@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/phy/qualcomm/phy-qcom-qmp-combo.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
++++ b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
+@@ -1328,8 +1328,8 @@ static const struct qmp_phy_cfg sm8250_d
+ .swing_hbr3_hbr2 = &qmp_dp_v3_voltage_swing_hbr3_hbr2,
+ .pre_emphasis_hbr3_hbr2 = &qmp_dp_v3_pre_emphasis_hbr3_hbr2,
+
+- .clk_list = qmp_v4_phy_clk_l,
+- .num_clks = ARRAY_SIZE(qmp_v4_phy_clk_l),
++ .clk_list = qmp_v4_sm8250_usbphy_clk_l,
++ .num_clks = ARRAY_SIZE(qmp_v4_sm8250_usbphy_clk_l),
+ .reset_list = msm8996_usb3phy_reset_l,
+ .num_resets = ARRAY_SIZE(msm8996_usb3phy_reset_l),
+ .vreg_list = qmp_phy_vreg_l,
--- /dev/null
+From 5fdded8448924e3631d466eea499b11606c43640 Mon Sep 17 00:00:00 2001
+From: Kant Fan <kant@allwinnertech.com>
+Date: Tue, 25 Oct 2022 15:21:09 +0800
+Subject: PM/devfreq: governor: Add a private governor_data for governor
+
+From: Kant Fan <kant@allwinnertech.com>
+
+commit 5fdded8448924e3631d466eea499b11606c43640 upstream.
+
+The member void *data in the structure devfreq can be overwrite
+by governor_userspace. For example:
+1. The device driver assigned the devfreq governor to simple_ondemand
+by the function devfreq_add_device() and init the devfreq member
+void *data to a pointer of a static structure devfreq_simple_ondemand_data
+by the function devfreq_add_device().
+2. The user changed the devfreq governor to userspace by the command
+"echo userspace > /sys/class/devfreq/.../governor".
+3. The governor userspace alloced a dynamic memory for the struct
+userspace_data and assigend the member void *data of devfreq to
+this memory by the function userspace_init().
+4. The user changed the devfreq governor back to simple_ondemand
+by the command "echo simple_ondemand > /sys/class/devfreq/.../governor".
+5. The governor userspace exited and assigned the member void *data
+in the structure devfreq to NULL by the function userspace_exit().
+6. The governor simple_ondemand fetched the static information of
+devfreq_simple_ondemand_data in the function
+devfreq_simple_ondemand_func() but the member void *data of devfreq was
+assigned to NULL by the function userspace_exit().
+7. The information of upthreshold and downdifferential is lost
+and the governor simple_ondemand can't work correctly.
+
+The member void *data in the structure devfreq is designed for
+a static pointer used in a governor and inited by the function
+devfreq_add_device(). This patch add an element named governor_data
+in the devfreq structure which can be used by a governor(E.g userspace)
+who want to assign a private data to do some private things.
+
+Fixes: ce26c5bb9569 ("PM / devfreq: Add basic governors")
+Cc: stable@vger.kernel.org # 5.10+
+Reviewed-by: Chanwoo Choi <cwchoi00@gmail.com>
+Acked-by: MyungJoo Ham <myungjoo.ham@samsung.com>
+Signed-off-by: Kant Fan <kant@allwinnertech.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/devfreq/devfreq.c | 6 ++----
+ drivers/devfreq/governor_userspace.c | 12 ++++++------
+ include/linux/devfreq.h | 7 ++++---
+ 3 files changed, 12 insertions(+), 13 deletions(-)
+
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -776,8 +776,7 @@ static void remove_sysfs_files(struct de
+ * @dev: the device to add devfreq feature.
+ * @profile: device-specific profile to run devfreq.
+ * @governor_name: name of the policy to choose frequency.
+- * @data: private data for the governor. The devfreq framework does not
+- * touch this value.
++ * @data: devfreq driver pass to governors, governor should not change it.
+ */
+ struct devfreq *devfreq_add_device(struct device *dev,
+ struct devfreq_dev_profile *profile,
+@@ -1011,8 +1010,7 @@ static void devm_devfreq_dev_release(str
+ * @dev: the device to add devfreq feature.
+ * @profile: device-specific profile to run devfreq.
+ * @governor_name: name of the policy to choose frequency.
+- * @data: private data for the governor. The devfreq framework does not
+- * touch this value.
++ * @data: devfreq driver pass to governors, governor should not change it.
+ *
+ * This function manages automatically the memory of devfreq device using device
+ * resource management and simplify the free operation for memory of devfreq
+--- a/drivers/devfreq/governor_userspace.c
++++ b/drivers/devfreq/governor_userspace.c
+@@ -21,7 +21,7 @@ struct userspace_data {
+
+ static int devfreq_userspace_func(struct devfreq *df, unsigned long *freq)
+ {
+- struct userspace_data *data = df->data;
++ struct userspace_data *data = df->governor_data;
+
+ if (data->valid)
+ *freq = data->user_frequency;
+@@ -40,7 +40,7 @@ static ssize_t set_freq_store(struct dev
+ int err = 0;
+
+ mutex_lock(&devfreq->lock);
+- data = devfreq->data;
++ data = devfreq->governor_data;
+
+ sscanf(buf, "%lu", &wanted);
+ data->user_frequency = wanted;
+@@ -60,7 +60,7 @@ static ssize_t set_freq_show(struct devi
+ int err = 0;
+
+ mutex_lock(&devfreq->lock);
+- data = devfreq->data;
++ data = devfreq->governor_data;
+
+ if (data->valid)
+ err = sprintf(buf, "%lu\n", data->user_frequency);
+@@ -91,7 +91,7 @@ static int userspace_init(struct devfreq
+ goto out;
+ }
+ data->valid = false;
+- devfreq->data = data;
++ devfreq->governor_data = data;
+
+ err = sysfs_create_group(&devfreq->dev.kobj, &dev_attr_group);
+ out:
+@@ -107,8 +107,8 @@ static void userspace_exit(struct devfre
+ if (devfreq->dev.kobj.sd)
+ sysfs_remove_group(&devfreq->dev.kobj, &dev_attr_group);
+
+- kfree(devfreq->data);
+- devfreq->data = NULL;
++ kfree(devfreq->governor_data);
++ devfreq->governor_data = NULL;
+ }
+
+ static int devfreq_userspace_handler(struct devfreq *devfreq,
+--- a/include/linux/devfreq.h
++++ b/include/linux/devfreq.h
+@@ -152,8 +152,8 @@ struct devfreq_stats {
+ * @max_state: count of entry present in the frequency table.
+ * @previous_freq: previously configured frequency value.
+ * @last_status: devfreq user device info, performance statistics
+- * @data: Private data of the governor. The devfreq framework does not
+- * touch this.
++ * @data: devfreq driver pass to governors, governor should not change it.
++ * @governor_data: private data for governors, devfreq core doesn't touch it.
+ * @user_min_freq_req: PM QoS minimum frequency request from user (via sysfs)
+ * @user_max_freq_req: PM QoS maximum frequency request from user (via sysfs)
+ * @scaling_min_freq: Limit minimum frequency requested by OPP interface
+@@ -193,7 +193,8 @@ struct devfreq {
+ unsigned long previous_freq;
+ struct devfreq_dev_status last_status;
+
+- void *data; /* private data for governors */
++ void *data;
++ void *governor_data;
+
+ struct dev_pm_qos_request user_min_freq_req;
+ struct dev_pm_qos_request user_max_freq_req;
--- /dev/null
+From 7f576b2593a978451416424e75f69ad1e3ae4efe Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Wed, 19 Oct 2022 23:19:35 -0600
+Subject: random: add helpers for random numbers with given floor or range
+
+From: Jason A. Donenfeld <Jason@zx2c4.com>
+
+commit 7f576b2593a978451416424e75f69ad1e3ae4efe upstream.
+
+Now that we have get_random_u32_below(), it's nearly trivial to make
+inline helpers to compute get_random_u32_above() and
+get_random_u32_inclusive(), which will help clean up open coded loops
+and manual computations throughout the tree.
+
+One snag is that in order to make get_random_u32_inclusive() operate on
+closed intervals, we have to do some (unlikely) special case handling if
+get_random_u32_inclusive(0, U32_MAX) is called. The least expensive way
+of doing this is actually to adjust the slowpath of
+get_random_u32_below() to have its undefined 0 result just return the
+output of get_random_u32(). We can make this basically free by calling
+get_random_u32() before the branch, so that the branch latency gets
+interleaved.
+
+Cc: stable@vger.kernel.org # to ease future backports that use this api
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/random.c | 18 +++++++++++++++++-
+ include/linux/random.h | 25 +++++++++++++++++++++++++
+ 2 files changed, 42 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -161,6 +161,8 @@ EXPORT_SYMBOL(wait_for_random_bytes);
+ * u16 get_random_u16()
+ * u32 get_random_u32()
+ * u32 get_random_u32_below(u32 ceil)
++ * u32 get_random_u32_above(u32 floor)
++ * u32 get_random_u32_inclusive(u32 floor, u32 ceil)
+ * u64 get_random_u64()
+ * unsigned long get_random_long()
+ *
+@@ -522,7 +524,21 @@ u32 __get_random_u32_below(u32 ceil)
+ * of `-ceil % ceil` is analogous to `2^32 % ceil`, but is computable
+ * in 32-bits.
+ */
+- u64 mult = (u64)ceil * get_random_u32();
++ u32 rand = get_random_u32();
++ u64 mult;
++
++ /*
++ * This function is technically undefined for ceil == 0, and in fact
++ * for the non-underscored constant version in the header, we build bug
++ * on that. But for the non-constant case, it's convenient to have that
++ * evaluate to being a straight call to get_random_u32(), so that
++ * get_random_u32_inclusive() can work over its whole range without
++ * undefined behavior.
++ */
++ if (unlikely(!ceil))
++ return rand;
++
++ mult = (u64)ceil * rand;
+ if (unlikely((u32)mult < ceil)) {
+ u32 bound = -ceil % ceil;
+ while (unlikely((u32)mult < bound))
+--- a/include/linux/random.h
++++ b/include/linux/random.h
+@@ -92,6 +92,31 @@ static inline u32 get_random_u32_below(u
+ }
+
+ /*
++ * Returns a random integer in the interval (floor, U32_MAX], with uniform
++ * distribution, suitable for all uses. Fastest when floor is a constant, but
++ * still fast for variable floor as well.
++ */
++static inline u32 get_random_u32_above(u32 floor)
++{
++ BUILD_BUG_ON_MSG(__builtin_constant_p(floor) && floor == U32_MAX,
++ "get_random_u32_above() must take floor < U32_MAX");
++ return floor + 1 + get_random_u32_below(U32_MAX - floor);
++}
++
++/*
++ * Returns a random integer in the interval [floor, ceil], with uniform
++ * distribution, suitable for all uses. Fastest when floor and ceil are
++ * constant, but still fast for variable floor and ceil as well.
++ */
++static inline u32 get_random_u32_inclusive(u32 floor, u32 ceil)
++{
++ BUILD_BUG_ON_MSG(__builtin_constant_p(floor) && __builtin_constant_p(ceil) &&
++ (floor > ceil || ceil - floor == U32_MAX),
++ "get_random_u32_inclusive() must take floor <= ceil");
++ return floor + get_random_u32_below(ceil - floor + 1);
++}
++
++/*
+ * On 64-bit architectures, protect against non-terminated C string overflows
+ * by zeroing out the first byte of the canary; this leaves 56 bits of entropy.
+ */
--- /dev/null
+From e9a688bcb19348862afe30d7c85bc37c4c293471 Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Sat, 8 Oct 2022 20:42:54 -0600
+Subject: random: use rejection sampling for uniform bounded random integers
+
+From: Jason A. Donenfeld <Jason@zx2c4.com>
+
+commit e9a688bcb19348862afe30d7c85bc37c4c293471 upstream.
+
+Until the very recent commits, many bounded random integers were
+calculated using `get_random_u32() % max_plus_one`, which not only
+incurs the price of a division -- indicating performance mostly was not
+a real issue -- but also does not result in a uniformly distributed
+output if max_plus_one is not a power of two. Recent commits moved to
+using `prandom_u32_max(max_plus_one)`, which replaces the division with
+a faster multiplication, but still does not solve the issue with
+non-uniform output.
+
+For some users, maybe this isn't a problem, and for others, maybe it is,
+but for the majority of users, probably the question has never been
+posed and analyzed, and nobody thought much about it, probably assuming
+random is random is random. In other words, the unthinking expectation
+of most users is likely that the resultant numbers are uniform.
+
+So we implement here an efficient way of generating uniform bounded
+random integers. Through use of compile-time evaluation, and avoiding
+divisions as much as possible, this commit introduces no measurable
+overhead. At least for hot-path uses tested, any potential difference
+was lost in the noise. On both clang and gcc, code generation is pretty
+small.
+
+The new function, get_random_u32_below(), lives in random.h, rather than
+prandom.h, and has a "get_random_xxx" function name, because it is
+suitable for all uses, including cryptography.
+
+In order to be efficient, we implement a kernel-specific variant of
+Daniel Lemire's algorithm from "Fast Random Integer Generation in an
+Interval", linked below. The kernel's variant takes advantage of
+constant folding to avoid divisions entirely in the vast majority of
+cases, works on both 32-bit and 64-bit architectures, and requests a
+minimal amount of bytes from the RNG.
+
+Link: https://arxiv.org/pdf/1805.10941.pdf
+Cc: stable@vger.kernel.org # to ease future backports that use this api
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/random.c | 22 ++++++++++++++++++++++
+ include/linux/prandom.h | 18 ++----------------
+ include/linux/random.h | 40 ++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 64 insertions(+), 16 deletions(-)
+
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -160,6 +160,7 @@ EXPORT_SYMBOL(wait_for_random_bytes);
+ * u8 get_random_u8()
+ * u16 get_random_u16()
+ * u32 get_random_u32()
++ * u32 get_random_u32_below(u32 ceil)
+ * u64 get_random_u64()
+ * unsigned long get_random_long()
+ *
+@@ -510,6 +511,27 @@ DEFINE_BATCHED_ENTROPY(u16)
+ DEFINE_BATCHED_ENTROPY(u32)
+ DEFINE_BATCHED_ENTROPY(u64)
+
++u32 __get_random_u32_below(u32 ceil)
++{
++ /*
++ * This is the slow path for variable ceil. It is still fast, most of
++ * the time, by doing traditional reciprocal multiplication and
++ * opportunistically comparing the lower half to ceil itself, before
++ * falling back to computing a larger bound, and then rejecting samples
++ * whose lower half would indicate a range indivisible by ceil. The use
++ * of `-ceil % ceil` is analogous to `2^32 % ceil`, but is computable
++ * in 32-bits.
++ */
++ u64 mult = (u64)ceil * get_random_u32();
++ if (unlikely((u32)mult < ceil)) {
++ u32 bound = -ceil % ceil;
++ while (unlikely((u32)mult < bound))
++ mult = (u64)ceil * get_random_u32();
++ }
++ return mult >> 32;
++}
++EXPORT_SYMBOL(__get_random_u32_below);
++
+ #ifdef CONFIG_SMP
+ /*
+ * This function is called when the CPU is coming up, with entry
+--- a/include/linux/prandom.h
++++ b/include/linux/prandom.h
+@@ -23,24 +23,10 @@ void prandom_seed_full_state(struct rnd_
+ #define prandom_init_once(pcpu_state) \
+ DO_ONCE(prandom_seed_full_state, (pcpu_state))
+
+-/**
+- * prandom_u32_max - returns a pseudo-random number in interval [0, ep_ro)
+- * @ep_ro: right open interval endpoint
+- *
+- * Returns a pseudo-random number that is in interval [0, ep_ro). This is
+- * useful when requesting a random index of an array containing ep_ro elements,
+- * for example. The result is somewhat biased when ep_ro is not a power of 2,
+- * so do not use this for cryptographic purposes.
+- *
+- * Returns: pseudo-random number in interval [0, ep_ro)
+- */
++/* Deprecated: use get_random_u32_below() instead. */
+ static inline u32 prandom_u32_max(u32 ep_ro)
+ {
+- if (__builtin_constant_p(ep_ro <= 1U << 8) && ep_ro <= 1U << 8)
+- return (get_random_u8() * ep_ro) >> 8;
+- if (__builtin_constant_p(ep_ro <= 1U << 16) && ep_ro <= 1U << 16)
+- return (get_random_u16() * ep_ro) >> 16;
+- return ((u64)get_random_u32() * ep_ro) >> 32;
++ return get_random_u32_below(ep_ro);
+ }
+
+ /*
+--- a/include/linux/random.h
++++ b/include/linux/random.h
+@@ -51,6 +51,46 @@ static inline unsigned long get_random_l
+ #endif
+ }
+
++u32 __get_random_u32_below(u32 ceil);
++
++/*
++ * Returns a random integer in the interval [0, ceil), with uniform
++ * distribution, suitable for all uses. Fastest when ceil is a constant, but
++ * still fast for variable ceil as well.
++ */
++static inline u32 get_random_u32_below(u32 ceil)
++{
++ if (!__builtin_constant_p(ceil))
++ return __get_random_u32_below(ceil);
++
++ /*
++ * For the fast path, below, all operations on ceil are precomputed by
++ * the compiler, so this incurs no overhead for checking pow2, doing
++ * divisions, or branching based on integer size. The resultant
++ * algorithm does traditional reciprocal multiplication (typically
++ * optimized by the compiler into shifts and adds), rejecting samples
++ * whose lower half would indicate a range indivisible by ceil.
++ */
++ BUILD_BUG_ON_MSG(!ceil, "get_random_u32_below() must take ceil > 0");
++ if (ceil <= 1)
++ return 0;
++ for (;;) {
++ if (ceil <= 1U << 8) {
++ u32 mult = ceil * get_random_u8();
++ if (likely(is_power_of_2(ceil) || (u8)mult >= (1U << 8) % ceil))
++ return mult >> 8;
++ } else if (ceil <= 1U << 16) {
++ u32 mult = ceil * get_random_u16();
++ if (likely(is_power_of_2(ceil) || (u16)mult >= (1U << 16) % ceil))
++ return mult >> 16;
++ } else {
++ u64 mult = (u64)ceil * get_random_u32();
++ if (likely(is_power_of_2(ceil) || (u32)mult >= -ceil % ceil))
++ return mult >> 32;
++ }
++ }
++}
++
+ /*
+ * On 64-bit architectures, protect against non-terminated C string overflows
+ * by zeroing out the first byte of the canary; this leaves 56 bits of entropy.
--- /dev/null
+From de3ee3f63400a23954e7c1ad1cb8c20f29ab6fe3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= <mic@digikod.net>
+Date: Fri, 9 Sep 2022 12:39:01 +0200
+Subject: selftests: Use optional USERCFLAGS and USERLDFLAGS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mickaël Salaün <mic@digikod.net>
+
+commit de3ee3f63400a23954e7c1ad1cb8c20f29ab6fe3 upstream.
+
+This change enables to extend CFLAGS and LDFLAGS from command line, e.g.
+to extend compiler checks: make USERCFLAGS=-Werror USERLDFLAGS=-static
+
+USERCFLAGS and USERLDFLAGS are documented in
+Documentation/kbuild/makefiles.rst and Documentation/kbuild/kbuild.rst
+
+This should be backported (down to 5.10) to improve previous kernel
+versions testing as well.
+
+Cc: Shuah Khan <skhan@linuxfoundation.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Mickaël Salaün <mic@digikod.net>
+Link: https://lore.kernel.org/r/20220909103901.1503436-1-mic@digikod.net
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/lib.mk | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/tools/testing/selftests/lib.mk
++++ b/tools/testing/selftests/lib.mk
+@@ -123,6 +123,11 @@ endef
+ clean:
+ $(CLEAN)
+
++# Enables to extend CFLAGS and LDFLAGS from command line, e.g.
++# make USERCFLAGS=-Werror USERLDFLAGS=-static
++CFLAGS += $(USERCFLAGS)
++LDFLAGS += $(USERLDFLAGS)
++
+ # When make O= with kselftest target from main level
+ # the following aren't defined.
+ #
drm-amdgpu-skip-mes-for-s0ix-as-well-since-it-s-part-of-gfx.patch
drm-amdgpu-skip-mes-self-test-after-s0i3-resume-for-mes-ip-v11.0.patch
+media-stv0288-use-explicitly-signed-char.patch
+cxl-region-fix-memdev-reuse-check.patch
+arm64-dts-qcom-sc8280xp-fix-ufs-dma-coherency.patch
+arm64-prohibit-instrumentation-on-arch_stack_walk.patch
+soc-qcom-select-remap_mmio-for-llcc-driver.patch
+soc-qcom-select-remap_mmio-for-icc_bwmon-driver.patch
+kest.pl-fix-grub2-menu-handling-for-rebooting.patch
+ktest.pl-minconfig-unset-configs-instead-of-just-removing-them.patch
+jbd2-use-the-correct-print-format.patch
+perf-x86-intel-uncore-disable-i-o-stacks-to-pmu-mapping-on-icx-d.patch
+perf-x86-intel-uncore-clear-attr_update-properly.patch
+arm64-dts-qcom-sdm845-db845c-correct-spi2-pins-drive-strength.patch
+arm64-dts-qcom-sc8280xp-fix-ufs-reference-clocks.patch
+mmc-sdhci-sprd-disable-clk_auto-when-the-clock-is-less-than-400k.patch
+phy-qcom-qmp-combo-fix-out-of-bounds-clock-access.patch
+drm-amd-pm-update-smu13.0.0-reported-maximum-shader-clock.patch
+drm-amd-pm-correct-smu13.0.0-pstate-profiling-clock-settings.patch
+btrfs-fix-uninitialized-parent-in-insert_state.patch
+btrfs-fix-extent-map-use-after-free-when-handling-missing-device-in-read_one_chunk.patch
+btrfs-fix-resolving-backrefs-for-inline-extent-followed-by-prealloc.patch
+arm-ux500-do-not-directly-dereference-__iomem.patch
+arm64-dts-qcom-sdm850-samsung-w737-correct-i2c12-pins-drive-strength.patch
+random-use-rejection-sampling-for-uniform-bounded-random-integers.patch
+x86-fpu-xstate-fix-xstate_warn_on-to-emit-relevant-diagnostics.patch
+arm64-dts-qcom-sdm850-lenovo-yoga-c630-correct-i2c12-pins-drive-strength.patch
+cxl-region-fix-missing-probe-failure.patch
+edac-mc_sysfs-increase-legacy-channel-support-to-12.patch
+selftests-use-optional-usercflags-and-userldflags.patch
+x86-mce-amd-clear-dfr-errors-found-in-thr-handler.patch
+random-add-helpers-for-random-numbers-with-given-floor-or-range.patch
+pm-devfreq-governor-add-a-private-governor_data-for-governor.patch
+cpufreq-init-completion-before-kobject_init_and_add.patch
+ext2-unbugger-ext2_empty_dir.patch
+media-s5p-mfc-fix-to-handle-reference-queue-during-finishing.patch
+media-s5p-mfc-clear-workbit-to-handle-error-condition.patch
+media-s5p-mfc-fix-in-register-read-and-write-for-h264.patch
--- /dev/null
+From a84160fbf4f2c8c5ffa588e19ea8f92eabd7ad17 Mon Sep 17 00:00:00 2001
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Date: Tue, 29 Nov 2022 12:50:22 +0530
+Subject: soc: qcom: Select REMAP_MMIO for ICC_BWMON driver
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+commit a84160fbf4f2c8c5ffa588e19ea8f92eabd7ad17 upstream.
+
+ICC_BWMON driver uses REGMAP_MMIO for accessing the hardware registers.
+So select the dependency in Kconfig. Without this, there will be errors
+while building the driver with COMPILE_TEST only:
+
+ERROR: modpost: "__devm_regmap_init_mmio_clk" [drivers/soc/qcom/icc-bwmon.ko] undefined!
+make[1]: *** [scripts/Makefile.modpost:126: Module.symvers] Error 1
+make: *** [Makefile:1944: modpost] Error 2
+
+Cc: <stable@vger.kernel.org> # 6.0
+Cc: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Fixes: b9c2ae6cac40 ("soc: qcom: icc-bwmon: Add bandwidth monitoring driver")
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221129072022.41962-1-manivannan.sadhasivam@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/qcom/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/soc/qcom/Kconfig
++++ b/drivers/soc/qcom/Kconfig
+@@ -237,6 +237,7 @@ config QCOM_ICC_BWMON
+ tristate "QCOM Interconnect Bandwidth Monitor driver"
+ depends on ARCH_QCOM || COMPILE_TEST
+ select PM_OPP
++ select REGMAP_MMIO
+ help
+ Sets up driver monitoring bandwidth on various interconnects and
+ based on that voting for interconnect bandwidth, adjusting their
--- /dev/null
+From 5d2fe2d7b616b8baa18348ead857b504fc2de336 Mon Sep 17 00:00:00 2001
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Date: Tue, 29 Nov 2022 12:41:59 +0530
+Subject: soc: qcom: Select REMAP_MMIO for LLCC driver
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+commit 5d2fe2d7b616b8baa18348ead857b504fc2de336 upstream.
+
+LLCC driver uses REGMAP_MMIO for accessing the hardware registers. So
+select the dependency in Kconfig. Without this, there will be errors
+while building the driver with COMPILE_TEST only:
+
+ERROR: modpost: "__devm_regmap_init_mmio_clk" [drivers/soc/qcom/llcc-qcom.ko] undefined!
+make[1]: *** [scripts/Makefile.modpost:126: Module.symvers] Error 1
+make: *** [Makefile:1944: modpost] Error 2
+
+Cc: <stable@vger.kernel.org> # 4.19
+Fixes: a3134fb09e0b ("drivers: soc: Add LLCC driver")
+Reported-by: Borislav Petkov <bp@alien8.de>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221129071201.30024-2-manivannan.sadhasivam@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/qcom/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/soc/qcom/Kconfig
++++ b/drivers/soc/qcom/Kconfig
+@@ -63,6 +63,7 @@ config QCOM_GSBI
+ config QCOM_LLCC
+ tristate "Qualcomm Technologies, Inc. LLCC driver"
+ depends on ARCH_QCOM || COMPILE_TEST
++ select REGMAP_MMIO
+ help
+ Qualcomm Technologies, Inc. platform specific
+ Last Level Cache Controller(LLCC) driver for platforms such as,
--- /dev/null
+From 48280042f2c6e3ac2cfb1d8b752ab4a7e0baea24 Mon Sep 17 00:00:00 2001
+From: Andrew Cooper <andrew.cooper3@citrix.com>
+Date: Wed, 10 Aug 2022 23:19:09 +0100
+Subject: x86/fpu/xstate: Fix XSTATE_WARN_ON() to emit relevant diagnostics
+
+From: Andrew Cooper <andrew.cooper3@citrix.com>
+
+commit 48280042f2c6e3ac2cfb1d8b752ab4a7e0baea24 upstream.
+
+"XSAVE consistency problem" has been reported under Xen, but that's the extent
+of my divination skills.
+
+Modify XSTATE_WARN_ON() to force the caller to provide relevant diagnostic
+information, and modify each caller suitably.
+
+For check_xstate_against_struct(), this removes a double WARN() where one will
+do perfectly fine.
+
+CC stable as this has been wonky debugging for 7 years and it is good to
+have there too.
+
+Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20220810221909.12768-1-andrew.cooper3@citrix.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/fpu/xstate.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/x86/kernel/fpu/xstate.c
++++ b/arch/x86/kernel/fpu/xstate.c
+@@ -440,8 +440,8 @@ static void __init __xstate_dump_leaves(
+ }
+ }
+
+-#define XSTATE_WARN_ON(x) do { \
+- if (WARN_ONCE(x, "XSAVE consistency problem, dumping leaves")) { \
++#define XSTATE_WARN_ON(x, fmt, ...) do { \
++ if (WARN_ONCE(x, "XSAVE consistency problem: " fmt, ##__VA_ARGS__)) { \
+ __xstate_dump_leaves(); \
+ } \
+ } while (0)
+@@ -554,8 +554,7 @@ static bool __init check_xstate_against_
+ (nr >= XFEATURE_MAX) ||
+ (nr == XFEATURE_PT_UNIMPLEMENTED_SO_FAR) ||
+ ((nr >= XFEATURE_RSRVD_COMP_11) && (nr <= XFEATURE_RSRVD_COMP_16))) {
+- WARN_ONCE(1, "no structure for xstate: %d\n", nr);
+- XSTATE_WARN_ON(1);
++ XSTATE_WARN_ON(1, "No structure for xstate: %d\n", nr);
+ return false;
+ }
+ return true;
+@@ -598,12 +597,13 @@ static bool __init paranoid_xstate_size_
+ * XSAVES.
+ */
+ if (!xsaves && xfeature_is_supervisor(i)) {
+- XSTATE_WARN_ON(1);
++ XSTATE_WARN_ON(1, "Got supervisor feature %d, but XSAVES not advertised\n", i);
+ return false;
+ }
+ }
+ size = xstate_calculate_size(fpu_kernel_cfg.max_features, compacted);
+- XSTATE_WARN_ON(size != kernel_size);
++ XSTATE_WARN_ON(size != kernel_size,
++ "size %u != kernel_size %u\n", size, kernel_size);
+ return size == kernel_size;
+ }
+
--- /dev/null
+From bc1b705b0eee4c645ad8b3bbff3c8a66e9688362 Mon Sep 17 00:00:00 2001
+From: Yazen Ghannam <yazen.ghannam@amd.com>
+Date: Tue, 21 Jun 2022 15:59:43 +0000
+Subject: x86/MCE/AMD: Clear DFR errors found in THR handler
+
+From: Yazen Ghannam <yazen.ghannam@amd.com>
+
+commit bc1b705b0eee4c645ad8b3bbff3c8a66e9688362 upstream.
+
+AMD's MCA Thresholding feature counts errors of all severity levels, not
+just correctable errors. If a deferred error causes the threshold limit
+to be reached (it was the error that caused the overflow), then both a
+deferred error interrupt and a thresholding interrupt will be triggered.
+
+The order of the interrupts is not guaranteed. If the threshold
+interrupt handler is executed first, then it will clear MCA_STATUS for
+the error. It will not check or clear MCA_DESTAT which also holds a copy
+of the deferred error. When the deferred error interrupt handler runs it
+will not find an error in MCA_STATUS, but it will find the error in
+MCA_DESTAT. This will cause two errors to be logged.
+
+Check for deferred errors when handling a threshold interrupt. If a bank
+contains a deferred error, then clear the bank's MCA_DESTAT register.
+
+Define a new helper function to do the deferred error check and clearing
+of MCA_DESTAT.
+
+ [ bp: Simplify, convert comment to passive voice. ]
+
+Fixes: 37d43acfd79f ("x86/mce/AMD: Redo error logging from APIC LVT interrupt handlers")
+Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20220621155943.33623-1-yazen.ghannam@amd.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/cpu/mce/amd.c | 33 ++++++++++++++++++++-------------
+ 1 file changed, 20 insertions(+), 13 deletions(-)
+
+--- a/arch/x86/kernel/cpu/mce/amd.c
++++ b/arch/x86/kernel/cpu/mce/amd.c
+@@ -788,6 +788,24 @@ _log_error_bank(unsigned int bank, u32 m
+ return status & MCI_STATUS_DEFERRED;
+ }
+
++static bool _log_error_deferred(unsigned int bank, u32 misc)
++{
++ if (!_log_error_bank(bank, mca_msr_reg(bank, MCA_STATUS),
++ mca_msr_reg(bank, MCA_ADDR), misc))
++ return false;
++
++ /*
++ * Non-SMCA systems don't have MCA_DESTAT/MCA_DEADDR registers.
++ * Return true here to avoid accessing these registers.
++ */
++ if (!mce_flags.smca)
++ return true;
++
++ /* Clear MCA_DESTAT if the deferred error was logged from MCA_STATUS. */
++ wrmsrl(MSR_AMD64_SMCA_MCx_DESTAT(bank), 0);
++ return true;
++}
++
+ /*
+ * We have three scenarios for checking for Deferred errors:
+ *
+@@ -799,19 +817,8 @@ _log_error_bank(unsigned int bank, u32 m
+ */
+ static void log_error_deferred(unsigned int bank)
+ {
+- bool defrd;
+-
+- defrd = _log_error_bank(bank, mca_msr_reg(bank, MCA_STATUS),
+- mca_msr_reg(bank, MCA_ADDR), 0);
+-
+- if (!mce_flags.smca)
+- return;
+-
+- /* Clear MCA_DESTAT if we logged the deferred error from MCA_STATUS. */
+- if (defrd) {
+- wrmsrl(MSR_AMD64_SMCA_MCx_DESTAT(bank), 0);
++ if (_log_error_deferred(bank, 0))
+ return;
+- }
+
+ /*
+ * Only deferred errors are logged in MCA_DE{STAT,ADDR} so just check
+@@ -832,7 +839,7 @@ static void amd_deferred_error_interrupt
+
+ static void log_error_thresholding(unsigned int bank, u64 misc)
+ {
+- _log_error_bank(bank, mca_msr_reg(bank, MCA_STATUS), mca_msr_reg(bank, MCA_ADDR), misc);
++ _log_error_deferred(bank, misc);
+ }
+
+ static void log_and_reset_block(struct threshold_block *block)
projects / thirdparty / kernel / stable-queue.git / commitdiff
