--- /dev/null
+From 1b841567f3342cc15f5126cc638656a9ba392961 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Apr 2025 14:01:26 +0300
+Subject: dma-buf/sw_sync: Decrement refcount on error in
+ sw_sync_ioctl_get_deadline()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit d27326a9999286fa45ad063f760e63329254f130 ]
+
+Call dma_fence_put(fence) before returning an error if
+dma_fence_to_sync_pt() fails. Use an unwind ladder at the
+end of the function to do the cleanup.
+
+Fixes: 70e67aaec2f4 ("dma-buf/sw_sync: Add fence deadline support")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/a010a1ac-107b-4fc0-a052-9fd3706ad690@stanley.mountain
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma-buf/sw_sync.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/dma-buf/sw_sync.c b/drivers/dma-buf/sw_sync.c
+index f5905d67dedbb..22a808995f106 100644
+--- a/drivers/dma-buf/sw_sync.c
++++ b/drivers/dma-buf/sw_sync.c
+@@ -438,15 +438,17 @@ static int sw_sync_ioctl_get_deadline(struct sync_timeline *obj, unsigned long a
+ return -EINVAL;
+
+ pt = dma_fence_to_sync_pt(fence);
+- if (!pt)
+- return -EINVAL;
++ if (!pt) {
++ ret = -EINVAL;
++ goto put_fence;
++ }
+
+ spin_lock_irqsave(fence->lock, flags);
+- if (test_bit(SW_SYNC_HAS_DEADLINE_BIT, &fence->flags)) {
+- data.deadline_ns = ktime_to_ns(pt->deadline);
+- } else {
++ if (!test_bit(SW_SYNC_HAS_DEADLINE_BIT, &fence->flags)) {
+ ret = -ENOENT;
++ goto unlock;
+ }
++ data.deadline_ns = ktime_to_ns(pt->deadline);
+ spin_unlock_irqrestore(fence->lock, flags);
+
+ dma_fence_put(fence);
+@@ -458,6 +460,13 @@ static int sw_sync_ioctl_get_deadline(struct sync_timeline *obj, unsigned long a
+ return -EFAULT;
+
+ return 0;
++
++unlock:
++ spin_unlock_irqrestore(fence->lock, flags);
++put_fence:
++ dma_fence_put(fence);
++
++ return ret;
+ }
+
+ static long sw_sync_ioctl(struct file *file, unsigned int cmd,
+--
+2.39.5
+
--- /dev/null
+From cb9aa3411d23b07b871b367bc230eebfce3ea56a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Mar 2025 08:00:06 -0700
+Subject: drm/msm/a6xx+: Don't let IB_SIZE overflow
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit 9d78f02503227d3554d26cf8ca73276105c98f3e ]
+
+IB_SIZE is only b0..b19. Starting with a6xx gen3, additional fields
+were added above the IB_SIZE. Accidentially setting them can cause
+badness. Fix this by properly defining the CP_INDIRECT_BUFFER packet
+and using the generated builder macro to ensure unintended bits are not
+set.
+
+v2: add missing type attribute for IB_BASE
+v3: fix offset attribute in xml
+
+Reported-by: Connor Abbott <cwabbott0@gmail.com>
+Fixes: a83366ef19ea ("drm/msm/a6xx: add A640/A650 to gpulist")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Patchwork: https://patchwork.freedesktop.org/patch/643396/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 8 ++++----
+ drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml | 7 +++++++
+ 2 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+index 0ae29a7c8a4d3..2a317cdb8eaa1 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -242,10 +242,10 @@ static void a6xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
+ break;
+ fallthrough;
+ case MSM_SUBMIT_CMD_BUF:
+- OUT_PKT7(ring, CP_INDIRECT_BUFFER_PFE, 3);
++ OUT_PKT7(ring, CP_INDIRECT_BUFFER, 3);
+ OUT_RING(ring, lower_32_bits(submit->cmd[i].iova));
+ OUT_RING(ring, upper_32_bits(submit->cmd[i].iova));
+- OUT_RING(ring, submit->cmd[i].size);
++ OUT_RING(ring, A5XX_CP_INDIRECT_BUFFER_2_IB_SIZE(submit->cmd[i].size));
+ ibs++;
+ break;
+ }
+@@ -377,10 +377,10 @@ static void a7xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
+ break;
+ fallthrough;
+ case MSM_SUBMIT_CMD_BUF:
+- OUT_PKT7(ring, CP_INDIRECT_BUFFER_PFE, 3);
++ OUT_PKT7(ring, CP_INDIRECT_BUFFER, 3);
+ OUT_RING(ring, lower_32_bits(submit->cmd[i].iova));
+ OUT_RING(ring, upper_32_bits(submit->cmd[i].iova));
+- OUT_RING(ring, submit->cmd[i].size);
++ OUT_RING(ring, A5XX_CP_INDIRECT_BUFFER_2_IB_SIZE(submit->cmd[i].size));
+ ibs++;
+ break;
+ }
+diff --git a/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml b/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml
+index 55a35182858cc..5a6ae9fc31945 100644
+--- a/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml
++++ b/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml
+@@ -2259,5 +2259,12 @@ opcode: CP_LOAD_STATE4 (30) (4 dwords)
+ </reg32>
+ </domain>
+
++<domain name="CP_INDIRECT_BUFFER" width="32" varset="chip" prefix="chip" variants="A5XX-">
++ <reg64 offset="0" name="IB_BASE" type="address"/>
++ <reg32 offset="2" name="2">
++ <bitfield name="IB_SIZE" low="0" high="19"/>
++ </reg32>
++</domain>
++
+ </database>
+
+--
+2.39.5
+
--- /dev/null
+From a8bf8fbc503a74280e36744ec726bc7860b858c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Apr 2025 16:02:44 +0300
+Subject: drm/msm/dpu: drop rogue intr_tear_rd_ptr values
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+[ Upstream commit ddfa00afae800b3dea02fa36f3f4012a8379ae58 ]
+
+The commit 5a9d50150c2c ("drm/msm/dpu: shift IRQ indices by 1") shifted
+IRQ indices by 1, making 'NO_IRQ' to be 0 rather than -1 (and allowing
+to skip the definition if the IRQ is not present).
+Several platform files were sketched before that commit, but got applied
+afterwards. As such, they inherited historical (and currently incorrect)
+setting of .intr_tear_rd_ptr = -1 for 'NO_IRQ' value.
+
+Drop that setting for all the affected platforms.
+
+Fixes: 62af6e1cb596 ("drm/msm/dpu: Add support for MSM8917")
+Fixes: c079680bb0fa ("drm/msm/dpu: Add support for MSM8937")
+Fixes: 7a6109ce1c2c ("drm/msm/dpu: Add support for MSM8953")
+Fixes: daf9a92daeb8 ("drm/msm/dpu: Add support for MSM8996")
+Fixes: 7204df5e7e68 ("drm/msm/dpu: add support for SDM660 and SDM630 platforms")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/647486/
+Link: https://lore.kernel.org/r/20250408-dpu-drop-intr-rd-ptr-v1-1-eeac337d88f8@oss.qualcomm.com
+Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_14_msm8937.h | 2 --
+ drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_15_msm8917.h | 1 -
+ drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_16_msm8953.h | 3 ---
+ drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_7_msm8996.h | 4 ----
+ drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_2_sdm660.h | 3 ---
+ drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_3_sdm630.h | 2 --
+ 6 files changed, 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_14_msm8937.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_14_msm8937.h
+index ab3dfb0b374ea..cb89d8cf300f9 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_14_msm8937.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_14_msm8937.h
+@@ -132,7 +132,6 @@ static const struct dpu_intf_cfg msm8937_intf[] = {
+ .prog_fetch_lines_worst_case = 14,
+ .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+ .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+- .intr_tear_rd_ptr = -1,
+ }, {
+ .name = "intf_2", .id = INTF_2,
+ .base = 0x6b000, .len = 0x268,
+@@ -141,7 +140,6 @@ static const struct dpu_intf_cfg msm8937_intf[] = {
+ .prog_fetch_lines_worst_case = 14,
+ .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28),
+ .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29),
+- .intr_tear_rd_ptr = -1,
+ },
+ };
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_15_msm8917.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_15_msm8917.h
+index 6bdaecca67614..b2a38e62d3a93 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_15_msm8917.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_15_msm8917.h
+@@ -118,7 +118,6 @@ static const struct dpu_intf_cfg msm8917_intf[] = {
+ .prog_fetch_lines_worst_case = 14,
+ .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+ .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+- .intr_tear_rd_ptr = -1,
+ },
+ };
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_16_msm8953.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_16_msm8953.h
+index 14f36ea6ad0eb..06859984d2a5c 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_16_msm8953.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_16_msm8953.h
+@@ -131,7 +131,6 @@ static const struct dpu_intf_cfg msm8953_intf[] = {
+ .prog_fetch_lines_worst_case = 14,
+ .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24),
+ .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25),
+- .intr_tear_rd_ptr = -1,
+ }, {
+ .name = "intf_1", .id = INTF_1,
+ .base = 0x6a800, .len = 0x268,
+@@ -140,7 +139,6 @@ static const struct dpu_intf_cfg msm8953_intf[] = {
+ .prog_fetch_lines_worst_case = 14,
+ .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+ .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+- .intr_tear_rd_ptr = -1,
+ }, {
+ .name = "intf_2", .id = INTF_2,
+ .base = 0x6b000, .len = 0x268,
+@@ -149,7 +147,6 @@ static const struct dpu_intf_cfg msm8953_intf[] = {
+ .prog_fetch_lines_worst_case = 14,
+ .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28),
+ .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29),
+- .intr_tear_rd_ptr = -1,
+ },
+ };
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_7_msm8996.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_7_msm8996.h
+index 491f6f5827d15..153e275513c31 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_7_msm8996.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_7_msm8996.h
+@@ -241,7 +241,6 @@ static const struct dpu_intf_cfg msm8996_intf[] = {
+ .prog_fetch_lines_worst_case = 25,
+ .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24),
+ .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25),
+- .intr_tear_rd_ptr = -1,
+ }, {
+ .name = "intf_1", .id = INTF_1,
+ .base = 0x6a800, .len = 0x268,
+@@ -250,7 +249,6 @@ static const struct dpu_intf_cfg msm8996_intf[] = {
+ .prog_fetch_lines_worst_case = 25,
+ .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+ .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+- .intr_tear_rd_ptr = -1,
+ }, {
+ .name = "intf_2", .id = INTF_2,
+ .base = 0x6b000, .len = 0x268,
+@@ -259,7 +257,6 @@ static const struct dpu_intf_cfg msm8996_intf[] = {
+ .prog_fetch_lines_worst_case = 25,
+ .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28),
+ .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29),
+- .intr_tear_rd_ptr = -1,
+ }, {
+ .name = "intf_3", .id = INTF_3,
+ .base = 0x6b800, .len = 0x268,
+@@ -267,7 +264,6 @@ static const struct dpu_intf_cfg msm8996_intf[] = {
+ .prog_fetch_lines_worst_case = 25,
+ .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 30),
+ .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 31),
+- .intr_tear_rd_ptr = -1,
+ },
+ };
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_2_sdm660.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_2_sdm660.h
+index 424815e7fb7dd..f247625ed7e5b 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_2_sdm660.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_2_sdm660.h
+@@ -202,7 +202,6 @@ static const struct dpu_intf_cfg sdm660_intf[] = {
+ .prog_fetch_lines_worst_case = 21,
+ .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24),
+ .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25),
+- .intr_tear_rd_ptr = -1,
+ }, {
+ .name = "intf_1", .id = INTF_1,
+ .base = 0x6a800, .len = 0x280,
+@@ -211,7 +210,6 @@ static const struct dpu_intf_cfg sdm660_intf[] = {
+ .prog_fetch_lines_worst_case = 21,
+ .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+ .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+- .intr_tear_rd_ptr = -1,
+ }, {
+ .name = "intf_2", .id = INTF_2,
+ .base = 0x6b000, .len = 0x280,
+@@ -220,7 +218,6 @@ static const struct dpu_intf_cfg sdm660_intf[] = {
+ .prog_fetch_lines_worst_case = 21,
+ .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28),
+ .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29),
+- .intr_tear_rd_ptr = -1,
+ },
+ };
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_3_sdm630.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_3_sdm630.h
+index df01227fc3646..5ddd2b3c0cd2e 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_3_sdm630.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_3_sdm630.h
+@@ -147,7 +147,6 @@ static const struct dpu_intf_cfg sdm630_intf[] = {
+ .prog_fetch_lines_worst_case = 21,
+ .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24),
+ .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25),
+- .intr_tear_rd_ptr = -1,
+ }, {
+ .name = "intf_1", .id = INTF_1,
+ .base = 0x6a800, .len = 0x280,
+@@ -156,7 +155,6 @@ static const struct dpu_intf_cfg sdm630_intf[] = {
+ .prog_fetch_lines_worst_case = 21,
+ .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26),
+ .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27),
+- .intr_tear_rd_ptr = -1,
+ },
+ };
+
+--
+2.39.5
+
--- /dev/null
+From 37baa169b2256ca5772bf2b5ce401f3855376782 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Mar 2025 20:10:04 -0500
+Subject: drm/msm/dpu: Fix error pointers in dpu_plane_virtual_atomic_check
+
+From: Chenyuan Yang <chenyuan0y@gmail.com>
+
+[ Upstream commit 5cb1b130e1cd04239cc9c26a98279f4660dce583 ]
+
+The function dpu_plane_virtual_atomic_check was dereferencing pointers
+returned by drm_atomic_get_plane_state without checking for errors. This
+could lead to undefined behavior if the function returns an error pointer.
+
+This commit adds checks using IS_ERR to ensure that plane_state is
+valid before dereferencing them.
+
+Similar to commit da29abe71e16
+("drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed").
+
+Fixes: 774bcfb73176 ("drm/msm/dpu: add support for virtual planes")
+Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/643132/
+Link: https://lore.kernel.org/r/20250314011004.663804-1-chenyuan0y@gmail.com
+Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
+index af3e541f60c30..b19193b02ab32 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
+@@ -1059,6 +1059,9 @@ static int dpu_plane_virtual_atomic_check(struct drm_plane *plane,
+ struct drm_crtc_state *crtc_state;
+ int ret;
+
++ if (IS_ERR(plane_state))
++ return PTR_ERR(plane_state);
++
+ if (plane_state->crtc)
+ crtc_state = drm_atomic_get_new_crtc_state(state,
+ plane_state->crtc);
+--
+2.39.5
+
--- /dev/null
+From 8c308ac3222cdf8f9af09b77e5ff061d53fb4111 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Apr 2025 17:50:06 -0300
+Subject: drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maíra Canal <mcanal@igalia.com>
+
+[ Upstream commit dcdae6e92d4e062da29235fe88980604595e3f0f ]
+
+This commit is a resubmission of commit 1fe1c66274fb ("drm/v3d: Fix
+Indirect Dispatch configuration for V3D 7.1.6 and later"), which was
+accidentally reverted by commit 91dae758bdb8 ("Merge tag
+'drm-misc-next-2024-08-01' of https://gitlab.freedesktop.org/drm/misc/kernel
+into drm-next"), likely due to an unfortunate conflict resolution.
+
+From the original commit message:
+
+```
+`args->cfg[4]` is configured in Indirect Dispatch using the number of
+batches. Currently, for all V3D tech versions, `args->cfg[4]` equals the
+number of batches subtracted by 1. But, for V3D 7.1.6 and later, we must not
+subtract 1 from the number of batches.
+
+Implement the fix by checking the V3D tech version and revision.
+
+Fixes several `dEQP-VK.synchronization*` CTS tests related to Indirect Dispatch.
+```
+
+Fixes: 91dae758bdb8 ("Merge tag 'drm-misc-next-2024-08-01' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next")
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Reviewed-by: Iago Toral Quiroga <itoral@igalia.com>
+Link: https://lore.kernel.org/r/20250409205051.9639-1-mcanal@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/v3d/v3d_sched.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/v3d/v3d_sched.c b/drivers/gpu/drm/v3d/v3d_sched.c
+index 05608c894ed93..6db503a569180 100644
+--- a/drivers/gpu/drm/v3d/v3d_sched.c
++++ b/drivers/gpu/drm/v3d/v3d_sched.c
+@@ -428,7 +428,8 @@ v3d_rewrite_csd_job_wg_counts_from_indirect(struct v3d_cpu_job *job)
+ struct v3d_bo *bo = to_v3d_bo(job->base.bo[0]);
+ struct v3d_bo *indirect = to_v3d_bo(indirect_csd->indirect);
+ struct drm_v3d_submit_csd *args = &indirect_csd->job->args;
+- u32 *wg_counts;
++ struct v3d_dev *v3d = job->base.v3d;
++ u32 num_batches, *wg_counts;
+
+ v3d_get_bo_vaddr(bo);
+ v3d_get_bo_vaddr(indirect);
+@@ -441,8 +442,17 @@ v3d_rewrite_csd_job_wg_counts_from_indirect(struct v3d_cpu_job *job)
+ args->cfg[0] = wg_counts[0] << V3D_CSD_CFG012_WG_COUNT_SHIFT;
+ args->cfg[1] = wg_counts[1] << V3D_CSD_CFG012_WG_COUNT_SHIFT;
+ args->cfg[2] = wg_counts[2] << V3D_CSD_CFG012_WG_COUNT_SHIFT;
+- args->cfg[4] = DIV_ROUND_UP(indirect_csd->wg_size, 16) *
+- (wg_counts[0] * wg_counts[1] * wg_counts[2]) - 1;
++
++ num_batches = DIV_ROUND_UP(indirect_csd->wg_size, 16) *
++ (wg_counts[0] * wg_counts[1] * wg_counts[2]);
++
++ /* V3D 7.1.6 and later don't subtract 1 from the number of batches */
++ if (v3d->ver < 71 || (v3d->ver == 71 && v3d->rev < 6))
++ args->cfg[4] = num_batches - 1;
++ else
++ args->cfg[4] = num_batches;
++
++ WARN_ON(args->cfg[4] == ~0);
+
+ for (int i = 0; i < 3; i++) {
+ /* 0xffffffff indicates that the uniform rewrite is not needed */
+--
+2.39.5
+
--- /dev/null
+From bfd4f4b93c6b0d4fc5f6dcfe285c194b4af59493 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Feb 2025 10:22:25 -0700
+Subject: eventpoll: abstract out ep_try_send_events() helper
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit 38d203560118a673018df5892a6555bb0aba7762 ]
+
+In preparation for reusing this helper in another epoll setup helper,
+abstract it out.
+
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Link: https://lore.kernel.org/r/20250219172552.1565603-3-axboe@kernel.dk
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Stable-dep-of: 0a65bc27bd64 ("eventpoll: Set epoll timeout if it's in the future")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/eventpoll.c | 28 ++++++++++++++++++----------
+ 1 file changed, 18 insertions(+), 10 deletions(-)
+
+diff --git a/fs/eventpoll.c b/fs/eventpoll.c
+index 7c0980db77b31..67d1808fda0e5 100644
+--- a/fs/eventpoll.c
++++ b/fs/eventpoll.c
+@@ -1980,6 +1980,22 @@ static int ep_autoremove_wake_function(struct wait_queue_entry *wq_entry,
+ return ret;
+ }
+
++static int ep_try_send_events(struct eventpoll *ep,
++ struct epoll_event __user *events, int maxevents)
++{
++ int res;
++
++ /*
++ * Try to transfer events to user space. In case we get 0 events and
++ * there's still timeout left over, we go trying again in search of
++ * more luck.
++ */
++ res = ep_send_events(ep, events, maxevents);
++ if (res > 0)
++ ep_suspend_napi_irqs(ep);
++ return res;
++}
++
+ /**
+ * ep_poll - Retrieves ready events, and delivers them to the caller-supplied
+ * event buffer.
+@@ -2031,17 +2047,9 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events,
+
+ while (1) {
+ if (eavail) {
+- /*
+- * Try to transfer events to user space. In case we get
+- * 0 events and there's still timeout left over, we go
+- * trying again in search of more luck.
+- */
+- res = ep_send_events(ep, events, maxevents);
+- if (res) {
+- if (res > 0)
+- ep_suspend_napi_irqs(ep);
++ res = ep_try_send_events(ep, events, maxevents);
++ if (res)
+ return res;
+- }
+ }
+
+ if (timed_out)
+--
+2.39.5
+
--- /dev/null
+From 3d80440c9ad6fa4ec98dc29a7bab1fa2caf6f5e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Apr 2025 18:58:25 +0000
+Subject: eventpoll: Set epoll timeout if it's in the future
+
+From: Joe Damato <jdamato@fastly.com>
+
+[ Upstream commit 0a65bc27bd645894175c059397b4916e31955fb2 ]
+
+Avoid an edge case where epoll_wait arms a timer and calls schedule()
+even if the timer will expire immediately.
+
+For example: if the user has specified an epoll busy poll usecs which is
+equal or larger than the epoll_wait/epoll_pwait2 timeout, it is
+unnecessary to call schedule_hrtimeout_range; the busy poll usecs have
+consumed the entire timeout duration so it is unnecessary to induce
+scheduling latency by calling schedule() (via schedule_hrtimeout_range).
+
+This can be measured using a simple bpftrace script:
+
+tracepoint:sched:sched_switch
+/ args->prev_pid == $1 /
+{
+ print(kstack());
+ print(ustack());
+}
+
+Before this patch is applied:
+
+ Testing an epoll_wait app with busy poll usecs set to 1000, and
+ epoll_wait timeout set to 1ms using the script above shows:
+
+ __traceiter_sched_switch+69
+ __schedule+1495
+ schedule+32
+ schedule_hrtimeout_range+159
+ do_epoll_wait+1424
+ __x64_sys_epoll_wait+97
+ do_syscall_64+95
+ entry_SYSCALL_64_after_hwframe+118
+
+ epoll_wait+82
+
+ Which is unexpected; the busy poll usecs should have consumed the
+ entire timeout and there should be no reason to arm a timer.
+
+After this patch is applied: the same test scenario does not generate a
+call to schedule() in the above edge case. If the busy poll usecs are
+reduced (for example usecs: 100, epoll_wait timeout 1ms) the timer is
+armed as expected.
+
+Fixes: bf3b9f6372c4 ("epoll: Add busy poll support to epoll with socket fds.")
+Signed-off-by: Joe Damato <jdamato@fastly.com>
+Link: https://lore.kernel.org/20250416185826.26375-1-jdamato@fastly.com
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/eventpoll.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/fs/eventpoll.c b/fs/eventpoll.c
+index 67d1808fda0e5..c01234bbac498 100644
+--- a/fs/eventpoll.c
++++ b/fs/eventpoll.c
+@@ -1996,6 +1996,14 @@ static int ep_try_send_events(struct eventpoll *ep,
+ return res;
+ }
+
++static int ep_schedule_timeout(ktime_t *to)
++{
++ if (to)
++ return ktime_after(*to, ktime_get());
++ else
++ return 1;
++}
++
+ /**
+ * ep_poll - Retrieves ready events, and delivers them to the caller-supplied
+ * event buffer.
+@@ -2103,7 +2111,7 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events,
+
+ write_unlock_irq(&ep->lock);
+
+- if (!eavail)
++ if (!eavail && ep_schedule_timeout(to))
+ timed_out = !schedule_hrtimeout_range(to, slack,
+ HRTIMER_MODE_ABS);
+ __set_current_state(TASK_RUNNING);
+--
+2.39.5
+
--- /dev/null
+From ba72f014dfdcb5896817f3bc8f141da311a7b75d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Apr 2025 08:40:42 +0200
+Subject: fs: move the bdex_statx call to vfs_getattr_nosec
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 777d0961ff95b26d5887fdae69900374364976f3 ]
+
+Currently bdex_statx is only called from the very high-level
+vfs_statx_path function, and thus bypassing it for in-kernel calls
+to vfs_getattr or vfs_getattr_nosec.
+
+This breaks querying the block ѕize of the underlying device in the
+loop driver and also is a pitfall for any other new kernel caller.
+
+Move the call into the lowest level helper to ensure all callers get
+the right results.
+
+Fixes: 2d985f8c6b91 ("vfs: support STATX_DIOALIGN on block devices")
+Fixes: f4774e92aab8 ("loop: take the file system minimum dio alignment into account")
+Reported-by: "Darrick J. Wong" <djwong@kernel.org>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/20250417064042.712140-1-hch@lst.de
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bdev.c | 3 +--
+ fs/stat.c | 32 ++++++++++++++++++--------------
+ include/linux/blkdev.h | 6 +++---
+ 3 files changed, 22 insertions(+), 19 deletions(-)
+
+diff --git a/block/bdev.c b/block/bdev.c
+index 9d73a8fbf7f99..e5147cab21b21 100644
+--- a/block/bdev.c
++++ b/block/bdev.c
+@@ -1268,8 +1268,7 @@ void sync_bdevs(bool wait)
+ /*
+ * Handle STATX_{DIOALIGN, WRITE_ATOMIC} for block devices.
+ */
+-void bdev_statx(struct path *path, struct kstat *stat,
+- u32 request_mask)
++void bdev_statx(const struct path *path, struct kstat *stat, u32 request_mask)
+ {
+ struct inode *backing_inode;
+ struct block_device *bdev;
+diff --git a/fs/stat.c b/fs/stat.c
+index f13308bfdc983..3d9222807214a 100644
+--- a/fs/stat.c
++++ b/fs/stat.c
+@@ -204,12 +204,25 @@ int vfs_getattr_nosec(const struct path *path, struct kstat *stat,
+ STATX_ATTR_DAX);
+
+ idmap = mnt_idmap(path->mnt);
+- if (inode->i_op->getattr)
+- return inode->i_op->getattr(idmap, path, stat,
+- request_mask,
+- query_flags);
++ if (inode->i_op->getattr) {
++ int ret;
++
++ ret = inode->i_op->getattr(idmap, path, stat, request_mask,
++ query_flags);
++ if (ret)
++ return ret;
++ } else {
++ generic_fillattr(idmap, request_mask, inode, stat);
++ }
++
++ /*
++ * If this is a block device inode, override the filesystem attributes
++ * with the block device specific parameters that need to be obtained
++ * from the bdev backing inode.
++ */
++ if (S_ISBLK(stat->mode))
++ bdev_statx(path, stat, request_mask);
+
+- generic_fillattr(idmap, request_mask, inode, stat);
+ return 0;
+ }
+ EXPORT_SYMBOL(vfs_getattr_nosec);
+@@ -295,15 +308,6 @@ static int vfs_statx_path(struct path *path, int flags, struct kstat *stat,
+ if (path_mounted(path))
+ stat->attributes |= STATX_ATTR_MOUNT_ROOT;
+ stat->attributes_mask |= STATX_ATTR_MOUNT_ROOT;
+-
+- /*
+- * If this is a block device inode, override the filesystem
+- * attributes with the block device specific parameters that need to be
+- * obtained from the bdev backing inode.
+- */
+- if (S_ISBLK(stat->mode))
+- bdev_statx(path, stat, request_mask);
+-
+ return 0;
+ }
+
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index d37751789bf58..38fc78501ef2d 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -1664,7 +1664,7 @@ int sync_blockdev(struct block_device *bdev);
+ int sync_blockdev_range(struct block_device *bdev, loff_t lstart, loff_t lend);
+ int sync_blockdev_nowait(struct block_device *bdev);
+ void sync_bdevs(bool wait);
+-void bdev_statx(struct path *, struct kstat *, u32);
++void bdev_statx(const struct path *path, struct kstat *stat, u32 request_mask);
+ void printk_all_partitions(void);
+ int __init early_lookup_bdev(const char *pathname, dev_t *dev);
+ #else
+@@ -1682,8 +1682,8 @@ static inline int sync_blockdev_nowait(struct block_device *bdev)
+ static inline void sync_bdevs(bool wait)
+ {
+ }
+-static inline void bdev_statx(struct path *path, struct kstat *stat,
+- u32 request_mask)
++static inline void bdev_statx(const struct path *path, struct kstat *stat,
++ u32 request_mask)
+ {
+ }
+ static inline void printk_all_partitions(void)
+--
+2.39.5
+
--- /dev/null
+From bbe2b5735d7b9107b1db40ac1080d9d044564846 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Apr 2025 09:44:44 +0800
+Subject: ftrace: fix incorrect hash size in register_ftrace_direct()
+
+From: Menglong Dong <menglong8.dong@gmail.com>
+
+[ Upstream commit 92f1d3b40179b15630d72e2c6e4e25a899b67ba9 ]
+
+The maximum of the ftrace hash bits is made fls(32) in
+register_ftrace_direct(), which seems illogical. So, we fix it by making
+the max hash bits FTRACE_HASH_MAX_BITS instead.
+
+Link: https://lore.kernel.org/20250413014444.36724-1-dongml2@chinatelecom.cn
+Fixes: d05cb470663a ("ftrace: Fix modification of direct_function hash while in use")
+Signed-off-by: Menglong Dong <dongml2@chinatelecom.cn>
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/ftrace.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 62d300eee7eb8..201e770185dde 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -5912,9 +5912,10 @@ int register_ftrace_direct(struct ftrace_ops *ops, unsigned long addr)
+
+ /* Make a copy hash to place the new and the old entries in */
+ size = hash->count + direct_functions->count;
+- if (size > 32)
+- size = 32;
+- new_hash = alloc_ftrace_hash(fls(size));
++ size = fls(size);
++ if (size > FTRACE_HASH_MAX_BITS)
++ size = FTRACE_HASH_MAX_BITS;
++ new_hash = alloc_ftrace_hash(size);
+ if (!new_hash)
+ goto out_unlock;
+
+--
+2.39.5
+
--- /dev/null
+From c192c1120bd38d00fc37698d2e62487986648eee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Mar 2025 10:16:46 +0300
+Subject: i2c: atr: Fix wrong include
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 75caec0c2aa3a7ec84348d438c74cb8a2eb4de97 ]
+
+The fwnode.h is not supposed to be used by the drivers as it
+has the definitions for the core parts for different device
+property provider implementations. Drop it.
+
+Note, that fwnode API for drivers is provided in property.h
+which is included here.
+
+Fixes: a076a860acae ("media: i2c: add I2C Address Translator (ATR) support")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Mukesh Kumar Savaliya <quic_msavaliy@quicinc.com>
+Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+[wsa: reworded subject]
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/i2c-atr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/i2c-atr.c b/drivers/i2c/i2c-atr.c
+index 8fe9ddff8e96f..783fb8df2ebee 100644
+--- a/drivers/i2c/i2c-atr.c
++++ b/drivers/i2c/i2c-atr.c
+@@ -8,12 +8,12 @@
+ * Originally based on i2c-mux.c
+ */
+
+-#include <linux/fwnode.h>
+ #include <linux/i2c-atr.h>
+ #include <linux/i2c.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/mutex.h>
++#include <linux/property.h>
+ #include <linux/slab.h>
+ #include <linux/spinlock.h>
+
+--
+2.39.5
+
--- /dev/null
+From 76236f06f6c3648a00e2bfcd90e784bd81450564 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Apr 2025 15:02:21 -0700
+Subject: nfs: add missing selections of CONFIG_CRC32
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit cd35b6cb46649750b7dbd0df0e2d767415d8917b ]
+
+nfs.ko, nfsd.ko, and lockd.ko all use crc32_le(), which is available
+only when CONFIG_CRC32 is enabled. But the only NFS kconfig option that
+selected CONFIG_CRC32 was CONFIG_NFS_DEBUG, which is client-specific and
+did not actually guard the use of crc32_le() even on the client.
+
+The code worked around this bug by only actually calling crc32_le() when
+CONFIG_CRC32 is built-in, instead hard-coding '0' in other cases. This
+avoided randconfig build errors, and in real kernels the fallback code
+was unlikely to be reached since CONFIG_CRC32 is 'default y'. But, this
+really needs to just be done properly, especially now that I'm planning
+to update CONFIG_CRC32 to not be 'default y'.
+
+Therefore, make CONFIG_NFS_FS, CONFIG_NFSD, and CONFIG_LOCKD select
+CONFIG_CRC32. Then remove the fallback code that becomes unnecessary,
+as well as the selection of CONFIG_CRC32 from CONFIG_NFS_DEBUG.
+
+Fixes: 1264a2f053a3 ("NFS: refactor code for calculating the crc32 hash of a filehandle")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Acked-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/Kconfig | 1 +
+ fs/nfs/Kconfig | 2 +-
+ fs/nfs/internal.h | 7 -------
+ fs/nfs/nfs4session.h | 4 ----
+ fs/nfsd/Kconfig | 1 +
+ fs/nfsd/nfsfh.h | 7 -------
+ include/linux/nfs.h | 7 -------
+ 7 files changed, 3 insertions(+), 26 deletions(-)
+
+diff --git a/fs/Kconfig b/fs/Kconfig
+index 64d420e3c4758..8fd1011f7d628 100644
+--- a/fs/Kconfig
++++ b/fs/Kconfig
+@@ -368,6 +368,7 @@ config GRACE_PERIOD
+ config LOCKD
+ tristate
+ depends on FILE_LOCKING
++ select CRC32
+ select GRACE_PERIOD
+
+ config LOCKD_V4
+diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig
+index d3f76101ad4b9..07932ce9246c1 100644
+--- a/fs/nfs/Kconfig
++++ b/fs/nfs/Kconfig
+@@ -2,6 +2,7 @@
+ config NFS_FS
+ tristate "NFS client support"
+ depends on INET && FILE_LOCKING && MULTIUSER
++ select CRC32
+ select LOCKD
+ select SUNRPC
+ select NFS_COMMON
+@@ -196,7 +197,6 @@ config NFS_USE_KERNEL_DNS
+ config NFS_DEBUG
+ bool
+ depends on NFS_FS && SUNRPC_DEBUG
+- select CRC32
+ default y
+
+ config NFS_DISABLE_UDP_SUPPORT
+diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
+index fae2c7ae4acc2..59bb4d0338f39 100644
+--- a/fs/nfs/internal.h
++++ b/fs/nfs/internal.h
+@@ -899,18 +899,11 @@ u64 nfs_timespec_to_change_attr(const struct timespec64 *ts)
+ return ((u64)ts->tv_sec << 30) + ts->tv_nsec;
+ }
+
+-#ifdef CONFIG_CRC32
+ static inline u32 nfs_stateid_hash(const nfs4_stateid *stateid)
+ {
+ return ~crc32_le(0xFFFFFFFF, &stateid->other[0],
+ NFS4_STATEID_OTHER_SIZE);
+ }
+-#else
+-static inline u32 nfs_stateid_hash(nfs4_stateid *stateid)
+-{
+- return 0;
+-}
+-#endif
+
+ static inline bool nfs_error_is_fatal(int err)
+ {
+diff --git a/fs/nfs/nfs4session.h b/fs/nfs/nfs4session.h
+index 351616c61df54..f9c291e2165cd 100644
+--- a/fs/nfs/nfs4session.h
++++ b/fs/nfs/nfs4session.h
+@@ -148,16 +148,12 @@ static inline void nfs4_copy_sessionid(struct nfs4_sessionid *dst,
+ memcpy(dst->data, src->data, NFS4_MAX_SESSIONID_LEN);
+ }
+
+-#ifdef CONFIG_CRC32
+ /*
+ * nfs_session_id_hash - calculate the crc32 hash for the session id
+ * @session - pointer to session
+ */
+ #define nfs_session_id_hash(sess_id) \
+ (~crc32_le(0xFFFFFFFF, &(sess_id)->data[0], sizeof((sess_id)->data)))
+-#else
+-#define nfs_session_id_hash(session) (0)
+-#endif
+ #else /* defined(CONFIG_NFS_V4_1) */
+
+ static inline int nfs4_init_session(struct nfs_client *clp)
+diff --git a/fs/nfsd/Kconfig b/fs/nfsd/Kconfig
+index 792d3fed1b45f..731a88f6313eb 100644
+--- a/fs/nfsd/Kconfig
++++ b/fs/nfsd/Kconfig
+@@ -4,6 +4,7 @@ config NFSD
+ depends on INET
+ depends on FILE_LOCKING
+ depends on FSNOTIFY
++ select CRC32
+ select LOCKD
+ select SUNRPC
+ select EXPORTFS
+diff --git a/fs/nfsd/nfsfh.h b/fs/nfsd/nfsfh.h
+index 876152a91f122..5103c2f4d2253 100644
+--- a/fs/nfsd/nfsfh.h
++++ b/fs/nfsd/nfsfh.h
+@@ -267,7 +267,6 @@ static inline bool fh_fsid_match(const struct knfsd_fh *fh1,
+ return true;
+ }
+
+-#ifdef CONFIG_CRC32
+ /**
+ * knfsd_fh_hash - calculate the crc32 hash for the filehandle
+ * @fh - pointer to filehandle
+@@ -279,12 +278,6 @@ static inline u32 knfsd_fh_hash(const struct knfsd_fh *fh)
+ {
+ return ~crc32_le(0xFFFFFFFF, fh->fh_raw, fh->fh_size);
+ }
+-#else
+-static inline u32 knfsd_fh_hash(const struct knfsd_fh *fh)
+-{
+- return 0;
+-}
+-#endif
+
+ /**
+ * fh_clear_pre_post_attrs - Reset pre/post attributes
+diff --git a/include/linux/nfs.h b/include/linux/nfs.h
+index 9ad727ddfedb3..0906a0b40c6aa 100644
+--- a/include/linux/nfs.h
++++ b/include/linux/nfs.h
+@@ -55,7 +55,6 @@ enum nfs3_stable_how {
+ NFS_INVALID_STABLE_HOW = -1
+ };
+
+-#ifdef CONFIG_CRC32
+ /**
+ * nfs_fhandle_hash - calculate the crc32 hash for the filehandle
+ * @fh - pointer to filehandle
+@@ -67,10 +66,4 @@ static inline u32 nfs_fhandle_hash(const struct nfs_fh *fh)
+ {
+ return ~crc32_le(0xFFFFFFFF, &fh->data[0], fh->size);
+ }
+-#else /* CONFIG_CRC32 */
+-static inline u32 nfs_fhandle_hash(const struct nfs_fh *fh)
+-{
+- return 0;
+-}
+-#endif /* CONFIG_CRC32 */
+ #endif /* _LINUX_NFS_H */
+--
+2.39.5
+
--- /dev/null
+From 4bce0d36528b397f0925aa3e6a4e225feda738e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Apr 2025 09:57:08 +0800
+Subject: nfsd: decrease sc_count directly if fail to queue dl_recall
+
+From: Li Lingfeng <lilingfeng3@huawei.com>
+
+[ Upstream commit a1d14d931bf700c1025db8c46d6731aa5cf440f9 ]
+
+A deadlock warning occurred when invoking nfs4_put_stid following a failed
+dl_recall queue operation:
+ T1 T2
+ nfs4_laundromat
+ nfs4_get_client_reaplist
+ nfs4_anylock_blockers
+__break_lease
+ spin_lock // ctx->flc_lock
+ spin_lock // clp->cl_lock
+ nfs4_lockowner_has_blockers
+ locks_owner_has_blockers
+ spin_lock // flctx->flc_lock
+ nfsd_break_deleg_cb
+ nfsd_break_one_deleg
+ nfs4_put_stid
+ refcount_dec_and_lock
+ spin_lock // clp->cl_lock
+
+When a file is opened, an nfs4_delegation is allocated with sc_count
+initialized to 1, and the file_lease holds a reference to the delegation.
+The file_lease is then associated with the file through kernel_setlease.
+
+The disassociation is performed in nfsd4_delegreturn via the following
+call chain:
+nfsd4_delegreturn --> destroy_delegation --> destroy_unhashed_deleg -->
+nfs4_unlock_deleg_lease --> kernel_setlease --> generic_delete_lease
+The corresponding sc_count reference will be released after this
+disassociation.
+
+Since nfsd_break_one_deleg executes while holding the flc_lock, the
+disassociation process becomes blocked when attempting to acquire flc_lock
+in generic_delete_lease. This means:
+1) sc_count in nfsd_break_one_deleg will not be decremented to 0;
+2) The nfs4_put_stid called by nfsd_break_one_deleg will not attempt to
+acquire cl_lock;
+3) Consequently, no deadlock condition is created.
+
+Given that sc_count in nfsd_break_one_deleg remains non-zero, we can
+safely perform refcount_dec on sc_count directly. This approach
+effectively avoids triggering deadlock warnings.
+
+Fixes: 230ca758453c ("nfsd: put dl_stid if fail to queue dl_recall")
+Signed-off-by: Li Lingfeng <lilingfeng3@huawei.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4state.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 2de49e2d6ac48..613bee7edb81e 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -5432,7 +5432,7 @@ static void nfsd_break_one_deleg(struct nfs4_delegation *dp)
+ queued = nfsd4_run_cb(&dp->dl_recall);
+ WARN_ON_ONCE(!queued);
+ if (!queued)
+- nfs4_put_stid(&dp->dl_stid);
++ refcount_dec(&dp->dl_stid.sc_count);
+ }
+
+ /* Called from break_lease() with flc_lock held. */
+--
+2.39.5
+
riscv-kgdb-do-not-inline-arch_kgdb_breakpoint.patch
riscv-kgdb-remove-.option-norvc-.option-rvc-for-kgdb.patch
cpufreq-sched-fix-the-usage-of-cpufreq_need_update_l.patch
+drm-v3d-fix-indirect-dispatch-configuration-for-v3d-.patch
+drm-msm-dpu-fix-error-pointers-in-dpu_plane_virtual_.patch
+drm-msm-dpu-drop-rogue-intr_tear_rd_ptr-values.patch
+dma-buf-sw_sync-decrement-refcount-on-error-in-sw_sy.patch
+nfs-add-missing-selections-of-config_crc32.patch
+nfsd-decrease-sc_count-directly-if-fail-to-queue-dl_.patch
+i2c-atr-fix-wrong-include.patch
+eventpoll-abstract-out-ep_try_send_events-helper.patch
+eventpoll-set-epoll-timeout-if-it-s-in-the-future.patch
+fs-move-the-bdex_statx-call-to-vfs_getattr_nosec.patch
+ftrace-fix-incorrect-hash-size-in-register_ftrace_di.patch
+drm-msm-a6xx-don-t-let-ib_size-overflow.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
