--- /dev/null
+From 736d149646ac8238a497c7e127af81c1004ec560 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Mar 2024 19:31:03 +0100
+Subject: ARM: dts: samsung: exynos4412-origen: fix keypad no-autorepeat
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 88208d3cd79821117fd3fb80d9bcab618467d37b ]
+
+Although the Samsung SoC keypad binding defined
+linux,keypad-no-autorepeat property, Linux driver never implemented it
+and always used linux,input-no-autorepeat. Correct the DTS to use
+property actually implemented.
+
+This also fixes dtbs_check errors like:
+
+ exynos4412-origen.dtb: keypad@100a0000: 'linux,keypad-no-autorepeat' does not match any of the regexes: '^key-[0-9a-z]+$', 'pinctrl-[0-9]+'
+
+Cc: <stable@vger.kernel.org>
+Fixes: bd08f6277e44 ("ARM: dts: Add keypad entries to Exynos4412 based Origen")
+Link: https://lore.kernel.org/r/20240312183105.715735-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos4412-origen.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos4412-origen.dts b/arch/arm/boot/dts/exynos4412-origen.dts
+index 0acb05f0a2b7c..68ed31821a282 100644
+--- a/arch/arm/boot/dts/exynos4412-origen.dts
++++ b/arch/arm/boot/dts/exynos4412-origen.dts
+@@ -448,7 +448,7 @@
+ &keypad {
+ samsung,keypad-num-rows = <3>;
+ samsung,keypad-num-columns = <2>;
+- linux,keypad-no-autorepeat;
++ linux,input-no-autorepeat;
+ wakeup-source;
+ pinctrl-0 = <&keypad_rows &keypad_cols>;
+ pinctrl-names = "default";
+--
+2.43.0
+
--- /dev/null
+From 18c3121474b5d648ce37f5be848ed43b2de0a40a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Mar 2024 19:31:04 +0100
+Subject: ARM: dts: samsung: smdk4412: fix keypad no-autorepeat
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 4ac4c1d794e7ff454d191bbdab7585ed8dbf3758 ]
+
+Although the Samsung SoC keypad binding defined
+linux,keypad-no-autorepeat property, Linux driver never implemented it
+and always used linux,input-no-autorepeat. Correct the DTS to use
+property actually implemented.
+
+This also fixes dtbs_check errors like:
+
+ exynos4412-smdk4412.dtb: keypad@100a0000: 'key-A', 'key-B', 'key-C', 'key-D', 'key-E', 'linux,keypad-no-autorepeat' do not match any of the regexes: '^key-[0-9a-z]+$', 'pinctrl-[0-9]+'
+
+Cc: <stable@vger.kernel.org>
+Fixes: c9b92dd70107 ("ARM: dts: Add keypad entries to SMDK4412")
+Link: https://lore.kernel.org/r/20240312183105.715735-3-krzysztof.kozlowski@linaro.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos4412-smdk4412.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos4412-smdk4412.dts b/arch/arm/boot/dts/exynos4412-smdk4412.dts
+index cc99b955af0c8..deebed6ea0031 100644
+--- a/arch/arm/boot/dts/exynos4412-smdk4412.dts
++++ b/arch/arm/boot/dts/exynos4412-smdk4412.dts
+@@ -65,7 +65,7 @@
+ &keypad {
+ samsung,keypad-num-rows = <3>;
+ samsung,keypad-num-columns = <8>;
+- linux,keypad-no-autorepeat;
++ linux,input-no-autorepeat;
+ wakeup-source;
+ pinctrl-0 = <&keypad_rows &keypad_cols>;
+ pinctrl-names = "default";
+--
+2.43.0
+
--- /dev/null
+From 2094db981d75e9cf60108350d5bb32f6545a85e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Mar 2024 19:31:02 +0100
+Subject: ARM: dts: samsung: smdkv310: fix keypad no-autorepeat
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 87d8e522d6f5a004f0aa06c0def302df65aff296 ]
+
+Although the Samsung SoC keypad binding defined
+linux,keypad-no-autorepeat property, Linux driver never implemented it
+and always used linux,input-no-autorepeat. Correct the DTS to use
+property actually implemented.
+
+This also fixes dtbs_check errors like:
+
+ exynos4210-smdkv310.dtb: keypad@100a0000: 'linux,keypad-no-autorepeat' does not match any of the regexes: '^key-[0-9a-z]+$', 'pinctrl-[0-9]+'
+
+Cc: <stable@vger.kernel.org>
+Fixes: 0561ceabd0f1 ("ARM: dts: Add intial dts file for EXYNOS4210 SoC, SMDKV310 and ORIGEN")
+Link: https://lore.kernel.org/r/20240312183105.715735-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos4210-smdkv310.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos4210-smdkv310.dts b/arch/arm/boot/dts/exynos4210-smdkv310.dts
+index d5797a67bf48d..4cf6ee4a813fc 100644
+--- a/arch/arm/boot/dts/exynos4210-smdkv310.dts
++++ b/arch/arm/boot/dts/exynos4210-smdkv310.dts
+@@ -84,7 +84,7 @@
+ &keypad {
+ samsung,keypad-num-rows = <2>;
+ samsung,keypad-num-columns = <8>;
+- linux,keypad-no-autorepeat;
++ linux,input-no-autorepeat;
+ wakeup-source;
+ pinctrl-names = "default";
+ pinctrl-0 = <&keypad_rows &keypad_cols>;
+--
+2.43.0
+
--- /dev/null
+From 7fcf549e9512ef0e5b829a7b84bc5369e53e194b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 May 2024 09:11:17 +0800
+Subject: bcache: fix variable length array abuse in btree_iter
+
+From: Matthew Mirvish <matthew@mm12.xyz>
+
+[ Upstream commit 3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31 ]
+
+btree_iter is used in two ways: either allocated on the stack with a
+fixed size MAX_BSETS, or from a mempool with a dynamic size based on the
+specific cache set. Previously, the struct had a fixed-length array of
+size MAX_BSETS which was indexed out-of-bounds for the dynamically-sized
+iterators, which causes UBSAN to complain.
+
+This patch uses the same approach as in bcachefs's sort_iter and splits
+the iterator into a btree_iter with a flexible array member and a
+btree_iter_stack which embeds a btree_iter as well as a fixed-length
+data array.
+
+Cc: stable@vger.kernel.org
+Closes: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039368
+Signed-off-by: Matthew Mirvish <matthew@mm12.xyz>
+Signed-off-by: Coly Li <colyli@suse.de>
+Link: https://lore.kernel.org/r/20240509011117.2697-3-colyli@suse.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/bset.c | 44 +++++++++++++++++------------------
+ drivers/md/bcache/bset.h | 28 ++++++++++++++--------
+ drivers/md/bcache/btree.c | 40 ++++++++++++++++---------------
+ drivers/md/bcache/super.c | 5 ++--
+ drivers/md/bcache/sysfs.c | 2 +-
+ drivers/md/bcache/writeback.c | 10 ++++----
+ 6 files changed, 70 insertions(+), 59 deletions(-)
+
+diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c
+index 94d38e8a59b32..cb544207427b1 100644
+--- a/drivers/md/bcache/bset.c
++++ b/drivers/md/bcache/bset.c
+@@ -54,7 +54,7 @@ void bch_dump_bucket(struct btree_keys *b)
+ int __bch_count_data(struct btree_keys *b)
+ {
+ unsigned int ret = 0;
+- struct btree_iter iter;
++ struct btree_iter_stack iter;
+ struct bkey *k;
+
+ if (b->ops->is_extents)
+@@ -67,7 +67,7 @@ void __bch_check_keys(struct btree_keys *b, const char *fmt, ...)
+ {
+ va_list args;
+ struct bkey *k, *p = NULL;
+- struct btree_iter iter;
++ struct btree_iter_stack iter;
+ const char *err;
+
+ for_each_key(b, k, &iter) {
+@@ -879,7 +879,7 @@ unsigned int bch_btree_insert_key(struct btree_keys *b, struct bkey *k,
+ unsigned int status = BTREE_INSERT_STATUS_NO_INSERT;
+ struct bset *i = bset_tree_last(b)->data;
+ struct bkey *m, *prev = NULL;
+- struct btree_iter iter;
++ struct btree_iter_stack iter;
+ struct bkey preceding_key_on_stack = ZERO_KEY;
+ struct bkey *preceding_key_p = &preceding_key_on_stack;
+
+@@ -895,9 +895,9 @@ unsigned int bch_btree_insert_key(struct btree_keys *b, struct bkey *k,
+ else
+ preceding_key(k, &preceding_key_p);
+
+- m = bch_btree_iter_init(b, &iter, preceding_key_p);
++ m = bch_btree_iter_stack_init(b, &iter, preceding_key_p);
+
+- if (b->ops->insert_fixup(b, k, &iter, replace_key))
++ if (b->ops->insert_fixup(b, k, &iter.iter, replace_key))
+ return status;
+
+ status = BTREE_INSERT_STATUS_INSERT;
+@@ -1100,33 +1100,33 @@ void bch_btree_iter_push(struct btree_iter *iter, struct bkey *k,
+ btree_iter_cmp));
+ }
+
+-static struct bkey *__bch_btree_iter_init(struct btree_keys *b,
+- struct btree_iter *iter,
+- struct bkey *search,
+- struct bset_tree *start)
++static struct bkey *__bch_btree_iter_stack_init(struct btree_keys *b,
++ struct btree_iter_stack *iter,
++ struct bkey *search,
++ struct bset_tree *start)
+ {
+ struct bkey *ret = NULL;
+
+- iter->size = ARRAY_SIZE(iter->data);
+- iter->used = 0;
++ iter->iter.size = ARRAY_SIZE(iter->stack_data);
++ iter->iter.used = 0;
+
+ #ifdef CONFIG_BCACHE_DEBUG
+- iter->b = b;
++ iter->iter.b = b;
+ #endif
+
+ for (; start <= bset_tree_last(b); start++) {
+ ret = bch_bset_search(b, start, search);
+- bch_btree_iter_push(iter, ret, bset_bkey_last(start->data));
++ bch_btree_iter_push(&iter->iter, ret, bset_bkey_last(start->data));
+ }
+
+ return ret;
+ }
+
+-struct bkey *bch_btree_iter_init(struct btree_keys *b,
+- struct btree_iter *iter,
++struct bkey *bch_btree_iter_stack_init(struct btree_keys *b,
++ struct btree_iter_stack *iter,
+ struct bkey *search)
+ {
+- return __bch_btree_iter_init(b, iter, search, b->set);
++ return __bch_btree_iter_stack_init(b, iter, search, b->set);
+ }
+
+ static inline struct bkey *__bch_btree_iter_next(struct btree_iter *iter,
+@@ -1293,10 +1293,10 @@ void bch_btree_sort_partial(struct btree_keys *b, unsigned int start,
+ struct bset_sort_state *state)
+ {
+ size_t order = b->page_order, keys = 0;
+- struct btree_iter iter;
++ struct btree_iter_stack iter;
+ int oldsize = bch_count_data(b);
+
+- __bch_btree_iter_init(b, &iter, NULL, &b->set[start]);
++ __bch_btree_iter_stack_init(b, &iter, NULL, &b->set[start]);
+
+ if (start) {
+ unsigned int i;
+@@ -1307,7 +1307,7 @@ void bch_btree_sort_partial(struct btree_keys *b, unsigned int start,
+ order = get_order(__set_bytes(b->set->data, keys));
+ }
+
+- __btree_sort(b, &iter, start, order, false, state);
++ __btree_sort(b, &iter.iter, start, order, false, state);
+
+ EBUG_ON(oldsize >= 0 && bch_count_data(b) != oldsize);
+ }
+@@ -1323,11 +1323,11 @@ void bch_btree_sort_into(struct btree_keys *b, struct btree_keys *new,
+ struct bset_sort_state *state)
+ {
+ uint64_t start_time = local_clock();
+- struct btree_iter iter;
++ struct btree_iter_stack iter;
+
+- bch_btree_iter_init(b, &iter, NULL);
++ bch_btree_iter_stack_init(b, &iter, NULL);
+
+- btree_mergesort(b, new->set->data, &iter, false, true);
++ btree_mergesort(b, new->set->data, &iter.iter, false, true);
+
+ bch_time_stats_update(&state->time, start_time);
+
+diff --git a/drivers/md/bcache/bset.h b/drivers/md/bcache/bset.h
+index a50dcfda656f5..2ed6dbd35d6e5 100644
+--- a/drivers/md/bcache/bset.h
++++ b/drivers/md/bcache/bset.h
+@@ -321,7 +321,14 @@ struct btree_iter {
+ #endif
+ struct btree_iter_set {
+ struct bkey *k, *end;
+- } data[MAX_BSETS];
++ } data[];
++};
++
++/* Fixed-size btree_iter that can be allocated on the stack */
++
++struct btree_iter_stack {
++ struct btree_iter iter;
++ struct btree_iter_set stack_data[MAX_BSETS];
+ };
+
+ typedef bool (*ptr_filter_fn)(struct btree_keys *b, const struct bkey *k);
+@@ -333,9 +340,9 @@ struct bkey *bch_btree_iter_next_filter(struct btree_iter *iter,
+
+ void bch_btree_iter_push(struct btree_iter *iter, struct bkey *k,
+ struct bkey *end);
+-struct bkey *bch_btree_iter_init(struct btree_keys *b,
+- struct btree_iter *iter,
+- struct bkey *search);
++struct bkey *bch_btree_iter_stack_init(struct btree_keys *b,
++ struct btree_iter_stack *iter,
++ struct bkey *search);
+
+ struct bkey *__bch_bset_search(struct btree_keys *b, struct bset_tree *t,
+ const struct bkey *search);
+@@ -350,13 +357,14 @@ static inline struct bkey *bch_bset_search(struct btree_keys *b,
+ return search ? __bch_bset_search(b, t, search) : t->data->start;
+ }
+
+-#define for_each_key_filter(b, k, iter, filter) \
+- for (bch_btree_iter_init((b), (iter), NULL); \
+- ((k) = bch_btree_iter_next_filter((iter), (b), filter));)
++#define for_each_key_filter(b, k, stack_iter, filter) \
++ for (bch_btree_iter_stack_init((b), (stack_iter), NULL); \
++ ((k) = bch_btree_iter_next_filter(&((stack_iter)->iter), (b), \
++ filter));)
+
+-#define for_each_key(b, k, iter) \
+- for (bch_btree_iter_init((b), (iter), NULL); \
+- ((k) = bch_btree_iter_next(iter));)
++#define for_each_key(b, k, stack_iter) \
++ for (bch_btree_iter_stack_init((b), (stack_iter), NULL); \
++ ((k) = bch_btree_iter_next(&((stack_iter)->iter)));)
+
+ /* Sorting */
+
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index e22dfcf1ed6d8..066b4aafd49e5 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -1283,7 +1283,7 @@ static bool btree_gc_mark_node(struct btree *b, struct gc_stat *gc)
+ uint8_t stale = 0;
+ unsigned int keys = 0, good_keys = 0;
+ struct bkey *k;
+- struct btree_iter iter;
++ struct btree_iter_stack iter;
+ struct bset_tree *t;
+
+ gc->nodes++;
+@@ -1544,7 +1544,7 @@ static int btree_gc_rewrite_node(struct btree *b, struct btree_op *op,
+ static unsigned int btree_gc_count_keys(struct btree *b)
+ {
+ struct bkey *k;
+- struct btree_iter iter;
++ struct btree_iter_stack iter;
+ unsigned int ret = 0;
+
+ for_each_key_filter(&b->keys, k, &iter, bch_ptr_bad)
+@@ -1585,17 +1585,18 @@ static int btree_gc_recurse(struct btree *b, struct btree_op *op,
+ int ret = 0;
+ bool should_rewrite;
+ struct bkey *k;
+- struct btree_iter iter;
++ struct btree_iter_stack iter;
+ struct gc_merge_info r[GC_MERGE_NODES];
+ struct gc_merge_info *i, *last = r + ARRAY_SIZE(r) - 1;
+
+- bch_btree_iter_init(&b->keys, &iter, &b->c->gc_done);
++ bch_btree_iter_stack_init(&b->keys, &iter, &b->c->gc_done);
+
+ for (i = r; i < r + ARRAY_SIZE(r); i++)
+ i->b = ERR_PTR(-EINTR);
+
+ while (1) {
+- k = bch_btree_iter_next_filter(&iter, &b->keys, bch_ptr_bad);
++ k = bch_btree_iter_next_filter(&iter.iter, &b->keys,
++ bch_ptr_bad);
+ if (k) {
+ r->b = bch_btree_node_get(b->c, op, k, b->level - 1,
+ true, b);
+@@ -1885,7 +1886,7 @@ static int bch_btree_check_recurse(struct btree *b, struct btree_op *op)
+ {
+ int ret = 0;
+ struct bkey *k, *p = NULL;
+- struct btree_iter iter;
++ struct btree_iter_stack iter;
+
+ for_each_key_filter(&b->keys, k, &iter, bch_ptr_invalid)
+ bch_initial_mark_key(b->c, b->level, k);
+@@ -1893,10 +1894,10 @@ static int bch_btree_check_recurse(struct btree *b, struct btree_op *op)
+ bch_initial_mark_key(b->c, b->level + 1, &b->key);
+
+ if (b->level) {
+- bch_btree_iter_init(&b->keys, &iter, NULL);
++ bch_btree_iter_stack_init(&b->keys, &iter, NULL);
+
+ do {
+- k = bch_btree_iter_next_filter(&iter, &b->keys,
++ k = bch_btree_iter_next_filter(&iter.iter, &b->keys,
+ bch_ptr_bad);
+ if (k) {
+ btree_node_prefetch(b, k);
+@@ -1924,7 +1925,7 @@ static int bch_btree_check_thread(void *arg)
+ struct btree_check_info *info = arg;
+ struct btree_check_state *check_state = info->state;
+ struct cache_set *c = check_state->c;
+- struct btree_iter iter;
++ struct btree_iter_stack iter;
+ struct bkey *k, *p;
+ int cur_idx, prev_idx, skip_nr;
+
+@@ -1933,8 +1934,8 @@ static int bch_btree_check_thread(void *arg)
+ ret = 0;
+
+ /* root node keys are checked before thread created */
+- bch_btree_iter_init(&c->root->keys, &iter, NULL);
+- k = bch_btree_iter_next_filter(&iter, &c->root->keys, bch_ptr_bad);
++ bch_btree_iter_stack_init(&c->root->keys, &iter, NULL);
++ k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad);
+ BUG_ON(!k);
+
+ p = k;
+@@ -1952,7 +1953,7 @@ static int bch_btree_check_thread(void *arg)
+ skip_nr = cur_idx - prev_idx;
+
+ while (skip_nr) {
+- k = bch_btree_iter_next_filter(&iter,
++ k = bch_btree_iter_next_filter(&iter.iter,
+ &c->root->keys,
+ bch_ptr_bad);
+ if (k)
+@@ -2025,7 +2026,7 @@ int bch_btree_check(struct cache_set *c)
+ int ret = 0;
+ int i;
+ struct bkey *k = NULL;
+- struct btree_iter iter;
++ struct btree_iter_stack iter;
+ struct btree_check_state check_state;
+
+ /* check and mark root node keys */
+@@ -2521,11 +2522,11 @@ static int bch_btree_map_nodes_recurse(struct btree *b, struct btree_op *op,
+
+ if (b->level) {
+ struct bkey *k;
+- struct btree_iter iter;
++ struct btree_iter_stack iter;
+
+- bch_btree_iter_init(&b->keys, &iter, from);
++ bch_btree_iter_stack_init(&b->keys, &iter, from);
+
+- while ((k = bch_btree_iter_next_filter(&iter, &b->keys,
++ while ((k = bch_btree_iter_next_filter(&iter.iter, &b->keys,
+ bch_ptr_bad))) {
+ ret = bcache_btree(map_nodes_recurse, k, b,
+ op, from, fn, flags);
+@@ -2554,11 +2555,12 @@ int bch_btree_map_keys_recurse(struct btree *b, struct btree_op *op,
+ {
+ int ret = MAP_CONTINUE;
+ struct bkey *k;
+- struct btree_iter iter;
++ struct btree_iter_stack iter;
+
+- bch_btree_iter_init(&b->keys, &iter, from);
++ bch_btree_iter_stack_init(&b->keys, &iter, from);
+
+- while ((k = bch_btree_iter_next_filter(&iter, &b->keys, bch_ptr_bad))) {
++ while ((k = bch_btree_iter_next_filter(&iter.iter, &b->keys,
++ bch_ptr_bad))) {
+ ret = !b->level
+ ? fn(op, b, k)
+ : bcache_btree(map_keys_recurse, k,
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 8ec48d8a5821c..48624e6bf0d79 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1920,8 +1920,9 @@ struct cache_set *bch_cache_set_alloc(struct cache_sb *sb)
+ INIT_LIST_HEAD(&c->btree_cache_freed);
+ INIT_LIST_HEAD(&c->data_buckets);
+
+- iter_size = ((meta_bucket_pages(sb) * PAGE_SECTORS) / sb->block_size + 1) *
+- sizeof(struct btree_iter_set);
++ iter_size = sizeof(struct btree_iter) +
++ ((meta_bucket_pages(sb) * PAGE_SECTORS) / sb->block_size) *
++ sizeof(struct btree_iter_set);
+
+ c->devices = kcalloc(c->nr_uuids, sizeof(void *), GFP_KERNEL);
+ if (!c->devices)
+diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
+index fa146012003df..7024eaed8d486 100644
+--- a/drivers/md/bcache/sysfs.c
++++ b/drivers/md/bcache/sysfs.c
+@@ -658,7 +658,7 @@ static unsigned int bch_root_usage(struct cache_set *c)
+ unsigned int bytes = 0;
+ struct bkey *k;
+ struct btree *b;
+- struct btree_iter iter;
++ struct btree_iter_stack iter;
+
+ goto lock_root;
+
+diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
+index 1e96679afcf4a..142eaf0ff9aea 100644
+--- a/drivers/md/bcache/writeback.c
++++ b/drivers/md/bcache/writeback.c
+@@ -898,15 +898,15 @@ static int bch_dirty_init_thread(void *arg)
+ struct dirty_init_thrd_info *info = arg;
+ struct bch_dirty_init_state *state = info->state;
+ struct cache_set *c = state->c;
+- struct btree_iter iter;
++ struct btree_iter_stack iter;
+ struct bkey *k, *p;
+ int cur_idx, prev_idx, skip_nr;
+
+ k = p = NULL;
+ prev_idx = 0;
+
+- bch_btree_iter_init(&c->root->keys, &iter, NULL);
+- k = bch_btree_iter_next_filter(&iter, &c->root->keys, bch_ptr_bad);
++ bch_btree_iter_stack_init(&c->root->keys, &iter, NULL);
++ k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad);
+ BUG_ON(!k);
+
+ p = k;
+@@ -920,7 +920,7 @@ static int bch_dirty_init_thread(void *arg)
+ skip_nr = cur_idx - prev_idx;
+
+ while (skip_nr) {
+- k = bch_btree_iter_next_filter(&iter,
++ k = bch_btree_iter_next_filter(&iter.iter,
+ &c->root->keys,
+ bch_ptr_bad);
+ if (k)
+@@ -969,7 +969,7 @@ void bch_sectors_dirty_init(struct bcache_device *d)
+ int i;
+ struct btree *b = NULL;
+ struct bkey *k = NULL;
+- struct btree_iter iter;
++ struct btree_iter_stack iter;
+ struct sectors_dirty_init op;
+ struct cache_set *c = d->c;
+ struct bch_dirty_init_state state;
+--
+2.43.0
+
--- /dev/null
+From 7e7ca6b8536c77517905658406daaf0f901e3a74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Apr 2024 18:23:10 +0200
+Subject: drm/i915/gt: Disarm breadcrumbs if engines are already idle
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+[ Upstream commit 70cb9188ffc75e643debf292fcddff36c9dbd4ae ]
+
+The breadcrumbs use a GT wakeref for guarding the interrupt, but are
+disarmed during release of the engine wakeref. This leaves a hole where
+we may attach a breadcrumb just as the engine is parking (after it has
+parked its breadcrumbs), execute the irq worker with some signalers still
+attached, but never be woken again.
+
+That issue manifests itself in CI with IGT runner timeouts while tests
+are waiting indefinitely for release of all GT wakerefs.
+
+<6> [209.151778] i915: Running live_engine_pm_selftests/live_engine_busy_stats
+<7> [209.231628] i915 0000:00:02.0: [drm:intel_power_well_disable [i915]] disabling PW_5
+<7> [209.231816] i915 0000:00:02.0: [drm:intel_power_well_disable [i915]] disabling PW_4
+<7> [209.231944] i915 0000:00:02.0: [drm:intel_power_well_disable [i915]] disabling PW_3
+<7> [209.232056] i915 0000:00:02.0: [drm:intel_power_well_disable [i915]] disabling PW_2
+<7> [209.232166] i915 0000:00:02.0: [drm:intel_power_well_disable [i915]] disabling DC_off
+<7> [209.232270] i915 0000:00:02.0: [drm:skl_enable_dc6 [i915]] Enabling DC6
+<7> [209.232368] i915 0000:00:02.0: [drm:gen9_set_dc_state.part.0 [i915]] Setting DC state from 00 to 02
+<4> [299.356116] [IGT] Inactivity timeout exceeded. Killing the current test with SIGQUIT.
+...
+<6> [299.356526] sysrq: Show State
+...
+<6> [299.373964] task:i915_selftest state:D stack:11784 pid:5578 tgid:5578 ppid:873 flags:0x00004002
+<6> [299.373967] Call Trace:
+<6> [299.373968] <TASK>
+<6> [299.373970] __schedule+0x3bb/0xda0
+<6> [299.373974] schedule+0x41/0x110
+<6> [299.373976] intel_wakeref_wait_for_idle+0x82/0x100 [i915]
+<6> [299.374083] ? __pfx_var_wake_function+0x10/0x10
+<6> [299.374087] live_engine_busy_stats+0x9b/0x500 [i915]
+<6> [299.374173] __i915_subtests+0xbe/0x240 [i915]
+<6> [299.374277] ? __pfx___intel_gt_live_setup+0x10/0x10 [i915]
+<6> [299.374369] ? __pfx___intel_gt_live_teardown+0x10/0x10 [i915]
+<6> [299.374456] intel_engine_live_selftests+0x1c/0x30 [i915]
+<6> [299.374547] __run_selftests+0xbb/0x190 [i915]
+<6> [299.374635] i915_live_selftests+0x4b/0x90 [i915]
+<6> [299.374717] i915_pci_probe+0x10d/0x210 [i915]
+
+At the end of the interrupt worker, if there are no more engines awake,
+disarm the breadcrumb and go to sleep.
+
+Fixes: 9d5612ca165a ("drm/i915/gt: Defer enabling the breadcrumb interrupt to after submission")
+Closes: https://gitlab.freedesktop.org/drm/intel/issues/10026
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Andrzej Hajda <andrzej.hajda@intel.com>
+Cc: <stable@vger.kernel.org> # v5.12+
+Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
+Acked-by: Nirmoy Das <nirmoy.das@intel.com>
+Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com>
+Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
+Signed-off-by: Andi Shyti <andi.shyti@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240423165505.465734-2-janusz.krzysztofik@linux.intel.com
+(cherry picked from commit fbad43eccae5cb14594195c20113369aabaa22b5)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/intel_breadcrumbs.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/intel_breadcrumbs.c b/drivers/gpu/drm/i915/gt/intel_breadcrumbs.c
+index e8cd7effea2b0..56985edda8baf 100644
+--- a/drivers/gpu/drm/i915/gt/intel_breadcrumbs.c
++++ b/drivers/gpu/drm/i915/gt/intel_breadcrumbs.c
+@@ -257,8 +257,13 @@ static void signal_irq_work(struct irq_work *work)
+ i915_request_put(rq);
+ }
+
++ /* Lazy irq enabling after HW submission */
+ if (!READ_ONCE(b->irq_armed) && !list_empty(&b->signalers))
+ intel_breadcrumbs_arm_irq(b);
++
++ /* And confirm that we still want irqs enabled before we yield */
++ if (READ_ONCE(b->irq_armed) && !atomic_read(&b->active))
++ intel_breadcrumbs_disarm_irq(b);
+ }
+
+ struct intel_breadcrumbs *
+@@ -309,13 +314,7 @@ void __intel_breadcrumbs_park(struct intel_breadcrumbs *b)
+ return;
+
+ /* Kick the work once more to drain the signalers, and disarm the irq */
+- irq_work_sync(&b->irq_work);
+- while (READ_ONCE(b->irq_armed) && !atomic_read(&b->active)) {
+- local_irq_disable();
+- signal_irq_work(&b->irq_work);
+- local_irq_enable();
+- cond_resched();
+- }
++ irq_work_queue(&b->irq_work);
+ }
+
+ void intel_breadcrumbs_free(struct kref *kref)
+@@ -398,7 +397,7 @@ static void insert_breadcrumb(struct i915_request *rq)
+ * the request as it may have completed and raised the interrupt as
+ * we were attaching it into the lists.
+ */
+- if (!b->irq_armed || __i915_request_is_complete(rq))
++ if (!READ_ONCE(b->irq_armed) || __i915_request_is_complete(rq))
+ irq_work_queue(&b->irq_work);
+ }
+
+--
+2.43.0
+
--- /dev/null
+From 6c0472cc86b51587403a366162fd724367ba39cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Jul 2022 16:20:13 +0200
+Subject: drm/i915/gt: Only kick the signal worker if there's been an update
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+[ Upstream commit c877bed82e1017c102c137d432933ccbba92c119 ]
+
+One impact of commit 047a1b877ed4 ("dma-buf & drm/amdgpu: remove
+dma_resv workaround") is that it stores many, many more fences. Whereas
+adding an exclusive fence used to remove the shared fence list, that
+list is now preserved and the write fences included into the list. Not
+just a single write fence, but now a write/read fence per context. That
+causes us to have to track more fences than before (albeit half of those
+are redundant), and we trigger more interrupts for multi-engine
+workloads.
+
+As part of reducing the impact from handling more signaling, we observe
+we only need to kick the signal worker after adding a fence iff we have
+good cause to believe that there is work to be done in processing the
+fence i.e. we either need to enable the interrupt or the request is
+already complete but we don't know if we saw the interrupt and so need
+to check signaling.
+
+References: 047a1b877ed4 ("dma-buf & drm/amdgpu: remove dma_resv workaround")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Karolina Drobnik <karolina.drobnik@intel.com>
+Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/d7b953c7a4ba747c8196a164e2f8c5aef468d048.1657289332.git.karolina.drobnik@intel.com
+Stable-dep-of: 70cb9188ffc7 ("drm/i915/gt: Disarm breadcrumbs if engines are already idle")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/intel_breadcrumbs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/intel_breadcrumbs.c b/drivers/gpu/drm/i915/gt/intel_breadcrumbs.c
+index 209cf265bf746..e8cd7effea2b0 100644
+--- a/drivers/gpu/drm/i915/gt/intel_breadcrumbs.c
++++ b/drivers/gpu/drm/i915/gt/intel_breadcrumbs.c
+@@ -398,7 +398,8 @@ static void insert_breadcrumb(struct i915_request *rq)
+ * the request as it may have completed and raised the interrupt as
+ * we were attaching it into the lists.
+ */
+- irq_work_queue(&b->irq_work);
++ if (!b->irq_armed || __i915_request_is_complete(rq))
++ irq_work_queue(&b->irq_work);
+ }
+
+ bool i915_request_enable_breadcrumb(struct i915_request *rq)
+--
+2.43.0
+
--- /dev/null
+From 1693182d8099bb39a3f7ca797ed70f6f852a7d77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 May 2024 11:32:43 +0000
+Subject: kheaders: explicitly define file modes for archived headers
+
+From: Matthias Maennich <maennich@google.com>
+
+[ Upstream commit 3bd27a847a3a4827a948387cc8f0dbc9fa5931d5 ]
+
+Build environments might be running with different umask settings
+resulting in indeterministic file modes for the files contained in
+kheaders.tar.xz. The file itself is served with 444, i.e. world
+readable. Archive the files explicitly with 744,a+X to improve
+reproducibility across build environments.
+
+--mode=0444 is not suitable as directories need to be executable. Also,
+444 makes it hard to delete all the readonly files after extraction.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Matthias Maennich <maennich@google.com>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/gen_kheaders.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/gen_kheaders.sh b/kernel/gen_kheaders.sh
+index 5ab483a3ee5a5..c618e37ccea98 100755
+--- a/kernel/gen_kheaders.sh
++++ b/kernel/gen_kheaders.sh
+@@ -82,7 +82,7 @@ find $cpio_dir -type f -print0 |
+
+ # Create archive and try to normalize metadata for reproducibility.
+ tar "${KBUILD_BUILD_TIMESTAMP:+--mtime=$KBUILD_BUILD_TIMESTAMP}" \
+- --owner=0 --group=0 --sort=name --numeric-owner \
++ --owner=0 --group=0 --sort=name --numeric-owner --mode=u=rw,go=r,a+X \
+ -I $XZ -cf $tarfile -C $cpio_dir/ . > /dev/null
+
+ echo $headers_md5 > kernel/kheaders.md5
+--
+2.43.0
+
--- /dev/null
+From bc7f90a9d82f4aee0064fedf2a83a9e150bdb56c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2024 22:56:17 +0900
+Subject: ksmbd: ignore trailing slashes in share paths
+
+From: Nandor Kracser <bonifaido@gmail.com>
+
+[ Upstream commit 405ee4097c4bc3e70556520aed5ba52a511c2266 ]
+
+Trailing slashes in share paths (like: /home/me/Share/) caused permission
+issues with shares for clients on iOS and on Android TV for me,
+but otherwise they work fine with plain old Samba.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Nandor Kracser <bonifaido@gmail.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ksmbd/mgmt/share_config.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ksmbd/mgmt/share_config.c b/fs/ksmbd/mgmt/share_config.c
+index a2f0a2edceb8a..e0a6b758094fc 100644
+--- a/fs/ksmbd/mgmt/share_config.c
++++ b/fs/ksmbd/mgmt/share_config.c
+@@ -165,8 +165,12 @@ static struct ksmbd_share_config *share_config_request(struct unicode_map *um,
+
+ share->path = kstrndup(ksmbd_share_config_path(resp), path_len,
+ GFP_KERNEL);
+- if (share->path)
++ if (share->path) {
+ share->path_sz = strlen(share->path);
++ while (share->path_sz > 1 &&
++ share->path[share->path_sz - 1] == '/')
++ share->path[--share->path_sz] = '\0';
++ }
+ share->create_mask = resp->create_mask;
+ share->directory_mask = resp->directory_mask;
+ share->force_create_mode = resp->force_create_mode;
+--
+2.43.0
+
--- /dev/null
+From e93e11a518b4e0f71efa8a5b7d2839095c1db1ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 May 2022 23:23:52 +0530
+Subject: mmc: core: Capture eMMC and SD card errors
+
+From: Shaik Sajida Bhanu <quic_c_sbhanu@quicinc.com>
+
+[ Upstream commit 91f059c95c6a5dbc0907a5f871e7915a5e93c1f9 ]
+
+Add changes to capture eMMC and SD card errors.
+This is useful for debug and testing.
+
+Signed-off-by: Liangliang Lu <quic_luliang@quicinc.com>
+Signed-off-by: Sayali Lokhande <quic_sayalil@quicinc.com>
+Signed-off-by: Bao D. Nguyen <quic_nguyenb@quicinc.com>
+Signed-off-by: Ram Prakash Gupta <quic_rampraka@quicinc.com>
+Signed-off-by: Shaik Sajida Bhanu <quic_c_sbhanu@quicinc.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/1653674036-21829-2-git-send-email-quic_c_sbhanu@quicinc.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Stable-dep-of: b3855668d98c ("mmc: sdhci: Add support for "Tuning Error" interrupts")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/core.c | 10 +++++++++-
+ include/linux/mmc/host.h | 26 ++++++++++++++++++++++++++
+ 2 files changed, 35 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index a6dcc68d68eec..3a8e49ffe98ef 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -948,9 +948,11 @@ int mmc_execute_tuning(struct mmc_card *card)
+ }
+
+ /* Only print error when we don't check for card removal */
+- if (!host->detect_change)
++ if (!host->detect_change) {
+ pr_err("%s: tuning execution failed: %d\n",
+ mmc_hostname(host), err);
++ mmc_debugfs_err_stats_inc(host, MMC_ERR_TUNING);
++ }
+
+ return err;
+ }
+@@ -2258,6 +2260,12 @@ void mmc_rescan(struct work_struct *work)
+ if (freqs[i] <= host->f_min)
+ break;
+ }
++
++ /*
++ * Ignore the command timeout errors observed during
++ * the card init as those are excepted.
++ */
++ host->err_stats[MMC_ERR_CMD_TIMEOUT] = 0;
+ mmc_release_host(host);
+
+ out:
+diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
+index a4ec7269b6295..cdc82cc228601 100644
+--- a/include/linux/mmc/host.h
++++ b/include/linux/mmc/host.h
+@@ -93,6 +93,25 @@ struct mmc_clk_phase_map {
+
+ struct mmc_host;
+
++enum mmc_err_stat {
++ MMC_ERR_CMD_TIMEOUT,
++ MMC_ERR_CMD_CRC,
++ MMC_ERR_DAT_TIMEOUT,
++ MMC_ERR_DAT_CRC,
++ MMC_ERR_AUTO_CMD,
++ MMC_ERR_ADMA,
++ MMC_ERR_TUNING,
++ MMC_ERR_CMDQ_RED,
++ MMC_ERR_CMDQ_GCE,
++ MMC_ERR_CMDQ_ICCE,
++ MMC_ERR_REQ_TIMEOUT,
++ MMC_ERR_CMDQ_REQ_TIMEOUT,
++ MMC_ERR_ICE_CFG,
++ MMC_ERR_CTRL_TIMEOUT,
++ MMC_ERR_UNEXPECTED_IRQ,
++ MMC_ERR_MAX,
++};
++
+ struct mmc_host_ops {
+ /*
+ * It is optional for the host to implement pre_req and post_req in
+@@ -499,6 +518,7 @@ struct mmc_host {
+ /* Host Software Queue support */
+ bool hsq_enabled;
+
++ u32 err_stats[MMC_ERR_MAX];
+ unsigned long private[] ____cacheline_aligned;
+ };
+
+@@ -635,6 +655,12 @@ static inline enum dma_data_direction mmc_get_dma_dir(struct mmc_data *data)
+ return data->flags & MMC_DATA_WRITE ? DMA_TO_DEVICE : DMA_FROM_DEVICE;
+ }
+
++static inline void mmc_debugfs_err_stats_inc(struct mmc_host *host,
++ enum mmc_err_stat stat)
++{
++ host->err_stats[stat] += 1;
++}
++
+ int mmc_send_tuning(struct mmc_host *host, u32 opcode, int *cmd_error);
+ int mmc_send_abort_tuning(struct mmc_host *host, u32 opcode);
+
+--
+2.43.0
+
--- /dev/null
+From 5f0d7873f6c22c8acf5dae68f0e6e0b5b2e2b8e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Apr 2024 21:16:35 +0200
+Subject: mmc: sdhci: Add support for "Tuning Error" interrupts
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit b3855668d98cf9c6aec2db999dd27d872f8ba878 ]
+
+Most Bay Trail devices do not enable UHS modes for the external sdcard slot
+the Lenovo Yoga Tablet 2 830 / 1050 and Lenovo Yoga Tablet 2 Pro 1380 (8",
+10" and 13") models however do enable this.
+
+Using a UHS cards in these tablets results in errors like this one:
+
+[ 225.272001] mmc2: Unexpected interrupt 0x04000000.
+[ 225.272024] mmc2: sdhci: ============ SDHCI REGISTER DUMP ===========
+[ 225.272034] mmc2: sdhci: Sys addr: 0x0712c400 | Version: 0x0000b502
+[ 225.272044] mmc2: sdhci: Blk size: 0x00007200 | Blk cnt: 0x00000007
+[ 225.272054] mmc2: sdhci: Argument: 0x00000000 | Trn mode: 0x00000023
+[ 225.272064] mmc2: sdhci: Present: 0x01e20002 | Host ctl: 0x00000016
+[ 225.272073] mmc2: sdhci: Power: 0x0000000f | Blk gap: 0x00000000
+[ 225.272082] mmc2: sdhci: Wake-up: 0x00000000 | Clock: 0x00000107
+[ 225.272092] mmc2: sdhci: Timeout: 0x0000000e | Int stat: 0x00000001
+[ 225.272101] mmc2: sdhci: Int enab: 0x03ff000b | Sig enab: 0x03ff000b
+[ 225.272110] mmc2: sdhci: ACmd stat: 0x00000000 | Slot int: 0x00000001
+[ 225.272119] mmc2: sdhci: Caps: 0x076864b2 | Caps_1: 0x00000004
+[ 225.272129] mmc2: sdhci: Cmd: 0x00000c1b | Max curr: 0x00000000
+[ 225.272138] mmc2: sdhci: Resp[0]: 0x00000c00 | Resp[1]: 0x00000000
+[ 225.272147] mmc2: sdhci: Resp[2]: 0x00000000 | Resp[3]: 0x00000900
+[ 225.272155] mmc2: sdhci: Host ctl2: 0x0000000c
+[ 225.272164] mmc2: sdhci: ADMA Err: 0x00000003 | ADMA Ptr: 0x0712c200
+[ 225.272172] mmc2: sdhci: ============================================
+
+which results in IO errors leading to issues accessing the sdcard.
+
+0x04000000 is a so-called "Tuning Error" which sofar the SDHCI driver
+does not support / enable. Modify the IRQ handler to process these.
+
+This fixes UHS microsd cards not working with these tablets.
+
+Link: https://lore.kernel.org/r/199bb4aa-c6b5-453e-be37-58bbf468800c@intel.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20240410191639.526324-3-hdegoede@redhat.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci.c | 10 ++++++++--
+ drivers/mmc/host/sdhci.h | 3 ++-
+ 2 files changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 0c181ccd5d03a..167a18724e1a4 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -3425,12 +3425,18 @@ static void sdhci_data_irq(struct sdhci_host *host, u32 intmask)
+ host->data->error = -EILSEQ;
+ if (!mmc_op_tuning(SDHCI_GET_CMD(sdhci_readw(host, SDHCI_COMMAND))))
+ sdhci_err_stats_inc(host, DAT_CRC);
+- } else if ((intmask & SDHCI_INT_DATA_CRC) &&
++ } else if ((intmask & (SDHCI_INT_DATA_CRC | SDHCI_INT_TUNING_ERROR)) &&
+ SDHCI_GET_CMD(sdhci_readw(host, SDHCI_COMMAND))
+ != MMC_BUS_TEST_R) {
+ host->data->error = -EILSEQ;
+ if (!mmc_op_tuning(SDHCI_GET_CMD(sdhci_readw(host, SDHCI_COMMAND))))
+ sdhci_err_stats_inc(host, DAT_CRC);
++ if (intmask & SDHCI_INT_TUNING_ERROR) {
++ u16 ctrl2 = sdhci_readw(host, SDHCI_HOST_CONTROL2);
++
++ ctrl2 &= ~SDHCI_CTRL_TUNED_CLK;
++ sdhci_writew(host, ctrl2, SDHCI_HOST_CONTROL2);
++ }
+ } else if (intmask & SDHCI_INT_ADMA_ERROR) {
+ pr_err("%s: ADMA error: 0x%08x\n", mmc_hostname(host->mmc),
+ intmask);
+@@ -3967,7 +3973,7 @@ bool sdhci_cqe_irq(struct sdhci_host *host, u32 intmask, int *cmd_error,
+ } else
+ *cmd_error = 0;
+
+- if (intmask & (SDHCI_INT_DATA_END_BIT | SDHCI_INT_DATA_CRC)) {
++ if (intmask & (SDHCI_INT_DATA_END_BIT | SDHCI_INT_DATA_CRC | SDHCI_INT_TUNING_ERROR)) {
+ *data_error = -EILSEQ;
+ if (!mmc_op_tuning(host->cmd->opcode))
+ sdhci_err_stats_inc(host, DAT_CRC);
+diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
+index 0edd576dbe51d..e3906991016bd 100644
+--- a/drivers/mmc/host/sdhci.h
++++ b/drivers/mmc/host/sdhci.h
+@@ -151,6 +151,7 @@
+ #define SDHCI_INT_BUS_POWER 0x00800000
+ #define SDHCI_INT_AUTO_CMD_ERR 0x01000000
+ #define SDHCI_INT_ADMA_ERROR 0x02000000
++#define SDHCI_INT_TUNING_ERROR 0x04000000
+
+ #define SDHCI_INT_NORMAL_MASK 0x00007FFF
+ #define SDHCI_INT_ERROR_MASK 0xFFFF8000
+@@ -162,7 +163,7 @@
+ SDHCI_INT_DATA_AVAIL | SDHCI_INT_SPACE_AVAIL | \
+ SDHCI_INT_DATA_TIMEOUT | SDHCI_INT_DATA_CRC | \
+ SDHCI_INT_DATA_END_BIT | SDHCI_INT_ADMA_ERROR | \
+- SDHCI_INT_BLK_GAP)
++ SDHCI_INT_BLK_GAP | SDHCI_INT_TUNING_ERROR)
+ #define SDHCI_INT_ALL_MASK ((unsigned int)-1)
+
+ #define SDHCI_CQE_INT_ERR_MASK ( \
+--
+2.43.0
+
--- /dev/null
+From 8be3b882cfb789cc333ff564a974969e9620e80e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 May 2022 23:23:53 +0530
+Subject: mmc: sdhci: Capture eMMC and SD card errors
+
+From: Shaik Sajida Bhanu <quic_c_sbhanu@quicinc.com>
+
+[ Upstream commit efe8f5c9b5e118070f424205078ababc46fd130a ]
+
+Add changes to capture eMMC and SD card errors.
+This is useful for debug and testing.
+
+Signed-off-by: Liangliang Lu <quic_luliang@quicinc.com>
+Signed-off-by: Sayali Lokhande <quic_sayalil@quicinc.com>
+Signed-off-by: Bao D. Nguyen <quic_nguyenb@quicinc.com>
+Signed-off-by: Shaik Sajida Bhanu <quic_c_sbhanu@quicinc.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/1653674036-21829-3-git-send-email-quic_c_sbhanu@quicinc.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Stable-dep-of: b3855668d98c ("mmc: sdhci: Add support for "Tuning Error" interrupts")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci.c | 59 ++++++++++++++++++++++++++++++----------
+ drivers/mmc/host/sdhci.h | 3 ++
+ include/linux/mmc/mmc.h | 6 ++++
+ 3 files changed, 53 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index ca8b147687986..0c181ccd5d03a 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -224,6 +224,7 @@ void sdhci_reset(struct sdhci_host *host, u8 mask)
+ if (timedout) {
+ pr_err("%s: Reset 0x%x never completed.\n",
+ mmc_hostname(host->mmc), (int)mask);
++ sdhci_err_stats_inc(host, CTRL_TIMEOUT);
+ sdhci_dumpregs(host);
+ return;
+ }
+@@ -1720,6 +1721,7 @@ static bool sdhci_send_command_retry(struct sdhci_host *host,
+ if (!timeout--) {
+ pr_err("%s: Controller never released inhibit bit(s).\n",
+ mmc_hostname(host->mmc));
++ sdhci_err_stats_inc(host, CTRL_TIMEOUT);
+ sdhci_dumpregs(host);
+ cmd->error = -EIO;
+ return false;
+@@ -1969,6 +1971,7 @@ void sdhci_enable_clk(struct sdhci_host *host, u16 clk)
+ if (timedout) {
+ pr_err("%s: Internal clock never stabilised.\n",
+ mmc_hostname(host->mmc));
++ sdhci_err_stats_inc(host, CTRL_TIMEOUT);
+ sdhci_dumpregs(host);
+ return;
+ }
+@@ -1991,6 +1994,7 @@ void sdhci_enable_clk(struct sdhci_host *host, u16 clk)
+ if (timedout) {
+ pr_err("%s: PLL clock never stabilised.\n",
+ mmc_hostname(host->mmc));
++ sdhci_err_stats_inc(host, CTRL_TIMEOUT);
+ sdhci_dumpregs(host);
+ return;
+ }
+@@ -3190,6 +3194,7 @@ static void sdhci_timeout_timer(struct timer_list *t)
+ if (host->cmd && !sdhci_data_line_cmd(host->cmd)) {
+ pr_err("%s: Timeout waiting for hardware cmd interrupt.\n",
+ mmc_hostname(host->mmc));
++ sdhci_err_stats_inc(host, REQ_TIMEOUT);
+ sdhci_dumpregs(host);
+
+ host->cmd->error = -ETIMEDOUT;
+@@ -3212,6 +3217,7 @@ static void sdhci_timeout_data_timer(struct timer_list *t)
+ (host->cmd && sdhci_data_line_cmd(host->cmd))) {
+ pr_err("%s: Timeout waiting for hardware interrupt.\n",
+ mmc_hostname(host->mmc));
++ sdhci_err_stats_inc(host, REQ_TIMEOUT);
+ sdhci_dumpregs(host);
+
+ if (host->data) {
+@@ -3263,17 +3269,21 @@ static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask, u32 *intmask_p)
+ return;
+ pr_err("%s: Got command interrupt 0x%08x even though no command operation was in progress.\n",
+ mmc_hostname(host->mmc), (unsigned)intmask);
++ sdhci_err_stats_inc(host, UNEXPECTED_IRQ);
+ sdhci_dumpregs(host);
+ return;
+ }
+
+ if (intmask & (SDHCI_INT_TIMEOUT | SDHCI_INT_CRC |
+ SDHCI_INT_END_BIT | SDHCI_INT_INDEX)) {
+- if (intmask & SDHCI_INT_TIMEOUT)
++ if (intmask & SDHCI_INT_TIMEOUT) {
+ host->cmd->error = -ETIMEDOUT;
+- else
++ sdhci_err_stats_inc(host, CMD_TIMEOUT);
++ } else {
+ host->cmd->error = -EILSEQ;
+-
++ if (!mmc_op_tuning(host->cmd->opcode))
++ sdhci_err_stats_inc(host, CMD_CRC);
++ }
+ /* Treat data command CRC error the same as data CRC error */
+ if (host->cmd->data &&
+ (intmask & (SDHCI_INT_CRC | SDHCI_INT_TIMEOUT)) ==
+@@ -3295,6 +3305,8 @@ static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask, u32 *intmask_p)
+ -ETIMEDOUT :
+ -EILSEQ;
+
++ sdhci_err_stats_inc(host, AUTO_CMD);
++
+ if (sdhci_auto_cmd23(host, mrq)) {
+ mrq->sbc->error = err;
+ __sdhci_finish_mrq(host, mrq);
+@@ -3371,6 +3383,7 @@ static void sdhci_data_irq(struct sdhci_host *host, u32 intmask)
+ if (intmask & SDHCI_INT_DATA_TIMEOUT) {
+ host->data_cmd = NULL;
+ data_cmd->error = -ETIMEDOUT;
++ sdhci_err_stats_inc(host, CMD_TIMEOUT);
+ __sdhci_finish_mrq(host, data_cmd->mrq);
+ return;
+ }
+@@ -3399,23 +3412,30 @@ static void sdhci_data_irq(struct sdhci_host *host, u32 intmask)
+
+ pr_err("%s: Got data interrupt 0x%08x even though no data operation was in progress.\n",
+ mmc_hostname(host->mmc), (unsigned)intmask);
++ sdhci_err_stats_inc(host, UNEXPECTED_IRQ);
+ sdhci_dumpregs(host);
+
+ return;
+ }
+
+- if (intmask & SDHCI_INT_DATA_TIMEOUT)
++ if (intmask & SDHCI_INT_DATA_TIMEOUT) {
+ host->data->error = -ETIMEDOUT;
+- else if (intmask & SDHCI_INT_DATA_END_BIT)
++ sdhci_err_stats_inc(host, DAT_TIMEOUT);
++ } else if (intmask & SDHCI_INT_DATA_END_BIT) {
+ host->data->error = -EILSEQ;
+- else if ((intmask & SDHCI_INT_DATA_CRC) &&
++ if (!mmc_op_tuning(SDHCI_GET_CMD(sdhci_readw(host, SDHCI_COMMAND))))
++ sdhci_err_stats_inc(host, DAT_CRC);
++ } else if ((intmask & SDHCI_INT_DATA_CRC) &&
+ SDHCI_GET_CMD(sdhci_readw(host, SDHCI_COMMAND))
+- != MMC_BUS_TEST_R)
++ != MMC_BUS_TEST_R) {
+ host->data->error = -EILSEQ;
+- else if (intmask & SDHCI_INT_ADMA_ERROR) {
++ if (!mmc_op_tuning(SDHCI_GET_CMD(sdhci_readw(host, SDHCI_COMMAND))))
++ sdhci_err_stats_inc(host, DAT_CRC);
++ } else if (intmask & SDHCI_INT_ADMA_ERROR) {
+ pr_err("%s: ADMA error: 0x%08x\n", mmc_hostname(host->mmc),
+ intmask);
+ sdhci_adma_show_error(host);
++ sdhci_err_stats_inc(host, ADMA);
+ host->data->error = -EIO;
+ if (host->ops->adma_workaround)
+ host->ops->adma_workaround(host, intmask);
+@@ -3613,6 +3633,7 @@ static irqreturn_t sdhci_irq(int irq, void *dev_id)
+ if (unexpected) {
+ pr_err("%s: Unexpected interrupt 0x%08x.\n",
+ mmc_hostname(host->mmc), unexpected);
++ sdhci_err_stats_inc(host, UNEXPECTED_IRQ);
+ sdhci_dumpregs(host);
+ }
+
+@@ -3936,20 +3957,27 @@ bool sdhci_cqe_irq(struct sdhci_host *host, u32 intmask, int *cmd_error,
+ if (!host->cqe_on)
+ return false;
+
+- if (intmask & (SDHCI_INT_INDEX | SDHCI_INT_END_BIT | SDHCI_INT_CRC))
++ if (intmask & (SDHCI_INT_INDEX | SDHCI_INT_END_BIT | SDHCI_INT_CRC)) {
+ *cmd_error = -EILSEQ;
+- else if (intmask & SDHCI_INT_TIMEOUT)
++ if (!mmc_op_tuning(host->cmd->opcode))
++ sdhci_err_stats_inc(host, CMD_CRC);
++ } else if (intmask & SDHCI_INT_TIMEOUT) {
+ *cmd_error = -ETIMEDOUT;
+- else
++ sdhci_err_stats_inc(host, CMD_TIMEOUT);
++ } else
+ *cmd_error = 0;
+
+- if (intmask & (SDHCI_INT_DATA_END_BIT | SDHCI_INT_DATA_CRC))
++ if (intmask & (SDHCI_INT_DATA_END_BIT | SDHCI_INT_DATA_CRC)) {
+ *data_error = -EILSEQ;
+- else if (intmask & SDHCI_INT_DATA_TIMEOUT)
++ if (!mmc_op_tuning(host->cmd->opcode))
++ sdhci_err_stats_inc(host, DAT_CRC);
++ } else if (intmask & SDHCI_INT_DATA_TIMEOUT) {
+ *data_error = -ETIMEDOUT;
+- else if (intmask & SDHCI_INT_ADMA_ERROR)
++ sdhci_err_stats_inc(host, DAT_TIMEOUT);
++ } else if (intmask & SDHCI_INT_ADMA_ERROR) {
+ *data_error = -EIO;
+- else
++ sdhci_err_stats_inc(host, ADMA);
++ } else
+ *data_error = 0;
+
+ /* Clear selected interrupts. */
+@@ -3965,6 +3993,7 @@ bool sdhci_cqe_irq(struct sdhci_host *host, u32 intmask, int *cmd_error,
+ sdhci_writel(host, intmask, SDHCI_INT_STATUS);
+ pr_err("%s: CQE: Unexpected interrupt 0x%08x.\n",
+ mmc_hostname(host->mmc), intmask);
++ sdhci_err_stats_inc(host, UNEXPECTED_IRQ);
+ sdhci_dumpregs(host);
+ }
+
+diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
+index 6a5cc05576cd5..0edd576dbe51d 100644
+--- a/drivers/mmc/host/sdhci.h
++++ b/drivers/mmc/host/sdhci.h
+@@ -356,6 +356,9 @@ struct sdhci_adma2_64_desc {
+ */
+ #define MMC_CMD_TRANSFER_TIME (10 * NSEC_PER_MSEC) /* max 10 ms */
+
++#define sdhci_err_stats_inc(host, err_name) \
++ mmc_debugfs_err_stats_inc((host)->mmc, MMC_ERR_##err_name)
++
+ enum sdhci_cookie {
+ COOKIE_UNMAPPED,
+ COOKIE_PRE_MAPPED, /* mapped by sdhci_pre_req() */
+diff --git a/include/linux/mmc/mmc.h b/include/linux/mmc/mmc.h
+index 545578fb814b0..6f7993803ee78 100644
+--- a/include/linux/mmc/mmc.h
++++ b/include/linux/mmc/mmc.h
+@@ -99,6 +99,12 @@ static inline bool mmc_op_multi(u32 opcode)
+ opcode == MMC_READ_MULTIPLE_BLOCK;
+ }
+
++static inline bool mmc_op_tuning(u32 opcode)
++{
++ return opcode == MMC_SEND_TUNING_BLOCK ||
++ opcode == MMC_SEND_TUNING_BLOCK_HS200;
++}
++
+ /*
+ * MMC_SWITCH argument format:
+ *
+--
+2.43.0
+
--- /dev/null
+From 639b191590ec3b36f8e1c336f1c181b55743bbff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Aug 2021 18:33:45 +0900
+Subject: mmc: sdhci: Change the code to check auto_cmd23
+
+From: ChanWoo Lee <cw9316.lee@samsung.com>
+
+[ Upstream commit 38929d4f0d811df399c99398ce0599f546369bd4 ]
+
+It is replaced with a function that is already declared.
+//[1/5] mmc: sdhci: Add helpers for the auto-CMD23 flag
+//20200412090349.1607-2-adrian.hunter@intel.com
+
+Signed-off-by: ChanWoo Lee <cw9316.lee@samsung.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20210825093345.14706-1-cw9316.lee@samsung.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Stable-dep-of: b3855668d98c ("mmc: sdhci: Add support for "Tuning Error" interrupts")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index d897c981b079f..ca8b147687986 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -3295,7 +3295,7 @@ static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask, u32 *intmask_p)
+ -ETIMEDOUT :
+ -EILSEQ;
+
+- if (mrq->sbc && (host->flags & SDHCI_AUTO_CMD23)) {
++ if (sdhci_auto_cmd23(host, mrq)) {
+ mrq->sbc->error = err;
+ __sdhci_finish_mrq(host, mrq);
+ return;
+--
+2.43.0
+
--- /dev/null
+From 582342d70384c7bfbcf18cf51f4933b67049f0a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Nov 2021 19:33:11 +0530
+Subject: PCI: Add PCI_ERROR_RESPONSE and related definitions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Naveen Naidu <naveennaidu479@gmail.com>
+
+[ Upstream commit 57bdeef4716689d9b0e3571034d65cf420f6efcd ]
+
+A config or MMIO read from a PCI device that doesn't exist or doesn't
+respond causes a PCI error. There's no real data to return to satisfy the
+CPU read, so most hardware fabricates ~0 data.
+
+Add a PCI_ERROR_RESPONSE definition for that and use it where appropriate
+to make these checks consistent and easier to find.
+
+Also add helper definitions PCI_SET_ERROR_RESPONSE() and
+PCI_POSSIBLE_ERROR() to make the code more readable.
+
+Suggested-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://lore.kernel.org/r/55563bf4dfc5d3fdc96695373c659d099bf175b1.1637243717.git.naveennaidu479@gmail.com
+Signed-off-by: Naveen Naidu <naveennaidu479@gmail.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Pali Rohár <pali@kernel.org>
+Stable-dep-of: c625dabbf1c4 ("x86/amd_nb: Check for invalid SMN reads")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/pci.h | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 25e2e7756b1d8..32805c3a37bb3 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -154,6 +154,15 @@ enum pci_interrupt_pin {
+ /* The number of legacy PCI INTx interrupts */
+ #define PCI_NUM_INTX 4
+
++/*
++ * Reading from a device that doesn't respond typically returns ~0. A
++ * successful read from a device may also return ~0, so you need additional
++ * information to reliably identify errors.
++ */
++#define PCI_ERROR_RESPONSE (~0ULL)
++#define PCI_SET_ERROR_RESPONSE(val) (*(val) = ((typeof(*(val))) PCI_ERROR_RESPONSE))
++#define PCI_POSSIBLE_ERROR(val) ((val) == ((typeof(val)) PCI_ERROR_RESPONSE))
++
+ /*
+ * pci_power_t values must match the bits in the Capabilities PME_Support
+ * and Control/Status PowerState fields in the Power Management capability.
+--
+2.43.0
+
--- /dev/null
+From 5763c50cd8d4541e5927382ae26935e23c10e7d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 May 2024 10:39:48 +0000
+Subject: perf/core: Fix missing wakeup when waiting for context reference
+
+From: Haifeng Xu <haifeng.xu@shopee.com>
+
+[ Upstream commit 74751ef5c1912ebd3e65c3b65f45587e05ce5d36 ]
+
+In our production environment, we found many hung tasks which are
+blocked for more than 18 hours. Their call traces are like this:
+
+[346278.191038] __schedule+0x2d8/0x890
+[346278.191046] schedule+0x4e/0xb0
+[346278.191049] perf_event_free_task+0x220/0x270
+[346278.191056] ? init_wait_var_entry+0x50/0x50
+[346278.191060] copy_process+0x663/0x18d0
+[346278.191068] kernel_clone+0x9d/0x3d0
+[346278.191072] __do_sys_clone+0x5d/0x80
+[346278.191076] __x64_sys_clone+0x25/0x30
+[346278.191079] do_syscall_64+0x5c/0xc0
+[346278.191083] ? syscall_exit_to_user_mode+0x27/0x50
+[346278.191086] ? do_syscall_64+0x69/0xc0
+[346278.191088] ? irqentry_exit_to_user_mode+0x9/0x20
+[346278.191092] ? irqentry_exit+0x19/0x30
+[346278.191095] ? exc_page_fault+0x89/0x160
+[346278.191097] ? asm_exc_page_fault+0x8/0x30
+[346278.191102] entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+The task was waiting for the refcount become to 1, but from the vmcore,
+we found the refcount has already been 1. It seems that the task didn't
+get woken up by perf_event_release_kernel() and got stuck forever. The
+below scenario may cause the problem.
+
+Thread A Thread B
+... ...
+perf_event_free_task perf_event_release_kernel
+ ...
+ acquire event->child_mutex
+ ...
+ get_ctx
+ ... release event->child_mutex
+ acquire ctx->mutex
+ ...
+ perf_free_event (acquire/release event->child_mutex)
+ ...
+ release ctx->mutex
+ wait_var_event
+ acquire ctx->mutex
+ acquire event->child_mutex
+ # move existing events to free_list
+ release event->child_mutex
+ release ctx->mutex
+ put_ctx
+... ...
+
+In this case, all events of the ctx have been freed, so we couldn't
+find the ctx in free_list and Thread A will miss the wakeup. It's thus
+necessary to add a wakeup after dropping the reference.
+
+Fixes: 1cf8dfe8a661 ("perf/core: Fix race between close() and fork()")
+Signed-off-by: Haifeng Xu <haifeng.xu@shopee.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20240513103948.33570-1-haifeng.xu@shopee.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/core.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index e79cd0fd1d2b7..80d9c8fcc30a6 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -5276,6 +5276,7 @@ int perf_event_release_kernel(struct perf_event *event)
+ again:
+ mutex_lock(&event->child_mutex);
+ list_for_each_entry(child, &event->child_list, child_list) {
++ void *var = NULL;
+
+ /*
+ * Cannot change, child events are not migrated, see the
+@@ -5316,11 +5317,23 @@ int perf_event_release_kernel(struct perf_event *event)
+ * this can't be the last reference.
+ */
+ put_event(event);
++ } else {
++ var = &ctx->refcount;
+ }
+
+ mutex_unlock(&event->child_mutex);
+ mutex_unlock(&ctx->mutex);
+ put_ctx(ctx);
++
++ if (var) {
++ /*
++ * If perf_event_free_task() has deleted all events from the
++ * ctx while the child_mutex got released above, make sure to
++ * notify about the preceding put_ctx().
++ */
++ smp_mb(); /* pairs with wait_var_event() */
++ wake_up_var(var);
++ }
+ goto again;
+ }
+ mutex_unlock(&event->child_mutex);
+--
+2.43.0
+
--- /dev/null
+From 0bb2daf21a4dc64fdda65b157bdd5225c0ecfb71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Feb 2024 15:40:45 +0800
+Subject: perf: script: add raw|disasm arguments to --insn-trace option
+
+From: Changbin Du <changbin.du@huawei.com>
+
+[ Upstream commit 6750ba4b6442fa5ea4bf5c0e4b4ff8b0249ef71d ]
+
+Now '--insn-trace' accept a argument to specify the output format:
+ - raw: display raw instructions.
+ - disasm: display mnemonic instructions (if capstone is installed).
+
+$ sudo perf script --insn-trace=raw
+ ls 1443864 [006] 2275506.209908875: 7f216b426100 _start+0x0 (/usr/lib/x86_64-linux-gnu/ld-2.31.so) insn: 48 89 e7
+ ls 1443864 [006] 2275506.209908875: 7f216b426103 _start+0x3 (/usr/lib/x86_64-linux-gnu/ld-2.31.so) insn: e8 e8 0c 00 00
+ ls 1443864 [006] 2275506.209908875: 7f216b426df0 _dl_start+0x0 (/usr/lib/x86_64-linux-gnu/ld-2.31.so) insn: f3 0f 1e fa
+
+$ sudo perf script --insn-trace=disasm
+ ls 1443864 [006] 2275506.209908875: 7f216b426100 _start+0x0 (/usr/lib/x86_64-linux-gnu/ld-2.31.so) movq %rsp, %rdi
+ ls 1443864 [006] 2275506.209908875: 7f216b426103 _start+0x3 (/usr/lib/x86_64-linux-gnu/ld-2.31.so) callq _dl_start+0x0
+ ls 1443864 [006] 2275506.209908875: 7f216b426df0 _dl_start+0x0 (/usr/lib/x86_64-linux-gnu/ld-2.31.so) illegal instruction
+ ls 1443864 [006] 2275506.209908875: 7f216b426df4 _dl_start+0x4 (/usr/lib/x86_64-linux-gnu/ld-2.31.so) pushq %rbp
+ ls 1443864 [006] 2275506.209908875: 7f216b426df5 _dl_start+0x5 (/usr/lib/x86_64-linux-gnu/ld-2.31.so) movq %rsp, %rbp
+ ls 1443864 [006] 2275506.209908875: 7f216b426df8 _dl_start+0x8 (/usr/lib/x86_64-linux-gnu/ld-2.31.so) pushq %r15
+
+Signed-off-by: Changbin Du <changbin.du@huawei.com>
+Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: changbin.du@gmail.com
+Cc: Thomas Richter <tmricht@linux.ibm.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20240217074046.4100789-5-changbin.du@huawei.com
+Stable-dep-of: d4a98b45fbe6 ("perf script: Show also errors for --insn-trace option")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/Documentation/perf-script.txt | 7 ++++---
+ tools/perf/builtin-script.c | 22 ++++++++++++++++++----
+ 2 files changed, 22 insertions(+), 7 deletions(-)
+
+diff --git a/tools/perf/Documentation/perf-script.txt b/tools/perf/Documentation/perf-script.txt
+index c80515243560c..fa6a78c472bc1 100644
+--- a/tools/perf/Documentation/perf-script.txt
++++ b/tools/perf/Documentation/perf-script.txt
+@@ -423,9 +423,10 @@ include::itrace.txt[]
+ will be printed. Each entry has function name and file/line. Enabled by
+ default, disable with --no-inline.
+
+---insn-trace::
+- Show instruction stream for intel_pt traces. Combine with --xed to
+- show disassembly.
++--insn-trace[=<raw|disasm>]::
++ Show instruction stream in bytes (raw) or disassembled (disasm)
++ for intel_pt traces. The default is 'raw'. To use xed, combine
++ 'raw' with --xed to show disassembly done by xed.
+
+ --xed::
+ Run xed disassembler on output. Requires installing the xed disassembler.
+diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
+index 34e809c934d72..45ccce87d1223 100644
+--- a/tools/perf/builtin-script.c
++++ b/tools/perf/builtin-script.c
+@@ -3585,10 +3585,24 @@ static int perf_script__process_auxtrace_info(struct perf_session *session,
+ #endif
+
+ static int parse_insn_trace(const struct option *opt __maybe_unused,
+- const char *str __maybe_unused,
+- int unset __maybe_unused)
++ const char *str, int unset __maybe_unused)
+ {
+- parse_output_fields(NULL, "+insn,-event,-period", 0);
++ const char *fields = "+insn,-event,-period";
++ int ret;
++
++ if (str) {
++ if (strcmp(str, "disasm") == 0)
++ fields = "+disasm,-event,-period";
++ else if (strlen(str) != 0 && strcmp(str, "raw") != 0) {
++ fprintf(stderr, "Only accept raw|disasm\n");
++ return -EINVAL;
++ }
++ }
++
++ ret = parse_output_fields(NULL, fields, 0);
++ if (ret < 0)
++ return ret;
++
+ itrace_parse_synth_opts(opt, "i0ns", 0);
+ symbol_conf.nanosecs = true;
+ return 0;
+@@ -3728,7 +3742,7 @@ int cmd_script(int argc, const char **argv)
+ "only consider these symbols"),
+ OPT_INTEGER(0, "addr-range", &symbol_conf.addr_range,
+ "Use with -S to list traced records within address range"),
+- OPT_CALLBACK_OPTARG(0, "insn-trace", &itrace_synth_opts, NULL, NULL,
++ OPT_CALLBACK_OPTARG(0, "insn-trace", &itrace_synth_opts, NULL, "raw|disasm",
+ "Decode instructions from itrace", parse_insn_trace),
+ OPT_CALLBACK_OPTARG(0, "xed", NULL, NULL, NULL,
+ "Run xed disassembler on output", parse_xed),
+--
+2.43.0
+
--- /dev/null
+From a9cb9d05d5f152a0e7458851da3eb700dd98eafd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Mar 2024 09:13:33 +0200
+Subject: perf script: Show also errors for --insn-trace option
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit d4a98b45fbe6d06f4b79ed90d0bb05ced8674c23 ]
+
+The trace could be misleading if trace errors are not taken into
+account, so display them also by adding the itrace "e" option.
+
+Note --call-trace and --call-ret-trace already add the itrace "e"
+option.
+
+Fixes: b585ebdb5912cf14 ("perf script: Add --insn-trace for instruction decoding")
+Reviewed-by: Andi Kleen <ak@linux.intel.com>
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20240315071334.3478-1-adrian.hunter@intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-script.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
+index 45ccce87d1223..78ee2c2978ac3 100644
+--- a/tools/perf/builtin-script.c
++++ b/tools/perf/builtin-script.c
+@@ -3603,7 +3603,7 @@ static int parse_insn_trace(const struct option *opt __maybe_unused,
+ if (ret < 0)
+ return ret;
+
+- itrace_parse_synth_opts(opt, "i0ns", 0);
++ itrace_parse_synth_opts(opt, "i0nse", 0);
+ symbol_conf.nanosecs = true;
+ return 0;
+ }
+--
+2.43.0
+
--- /dev/null
+From f3db8c9afda4e870c8a796f37220f574fda13db3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Apr 2024 19:00:23 +0300
+Subject: pmdomain: ti-sci: Fix duplicate PD referrals
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 670c900f69645db394efb38934b3344d8804171a ]
+
+When the dts file has multiple referrers to a single PD (e.g.
+simple-framebuffer and dss nodes both point to the DSS power-domain) the
+ti-sci driver will create two power domains, both with the same ID, and
+that will cause problems as one of the power domains will hide the other
+one.
+
+Fix this checking if a PD with the ID has already been created, and only
+create a PD for new IDs.
+
+Fixes: efa5c01cd7ee ("soc: ti: ti_sci_pm_domains: switch to use multiple genpds instead of one")
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20240415-ti-sci-pd-v1-1-a0e56b8ad897@ideasonboard.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/ti_sci_pm_domains.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soc/ti/ti_sci_pm_domains.c b/drivers/soc/ti/ti_sci_pm_domains.c
+index a33ec7eaf23d1..17984a7bffba5 100644
+--- a/drivers/soc/ti/ti_sci_pm_domains.c
++++ b/drivers/soc/ti/ti_sci_pm_domains.c
+@@ -114,6 +114,18 @@ static const struct of_device_id ti_sci_pm_domain_matches[] = {
+ };
+ MODULE_DEVICE_TABLE(of, ti_sci_pm_domain_matches);
+
++static bool ti_sci_pm_idx_exists(struct ti_sci_genpd_provider *pd_provider, u32 idx)
++{
++ struct ti_sci_pm_domain *pd;
++
++ list_for_each_entry(pd, &pd_provider->pd_list, node) {
++ if (pd->idx == idx)
++ return true;
++ }
++
++ return false;
++}
++
+ static int ti_sci_pm_domain_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+@@ -153,8 +165,14 @@ static int ti_sci_pm_domain_probe(struct platform_device *pdev)
+ break;
+
+ if (args.args_count >= 1 && args.np == dev->of_node) {
+- if (args.args[0] > max_id)
++ if (args.args[0] > max_id) {
+ max_id = args.args[0];
++ } else {
++ if (ti_sci_pm_idx_exists(pd_provider, args.args[0])) {
++ index++;
++ continue;
++ }
++ }
+
+ pd = devm_kzalloc(dev, sizeof(*pd), GFP_KERNEL);
+ if (!pd)
+--
+2.43.0
+
--- /dev/null
+From fa25973994c56834900378670ea0ace621316b0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 May 2023 22:23:35 +0900
+Subject: Revert "kheaders: substituting --sort in archive creation"
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 49c386ebbb43394ff4773ce24f726f6afc4c30c8 ]
+
+This reverts commit 700dea5a0bea9f64eba89fae7cb2540326fdfdc1.
+
+The reason for that commit was --sort=ORDER introduced in
+tar 1.28 (2014). More than 3 years have passed since then.
+
+Requiring GNU tar 1.28 should be fine now because we require
+GCC 5.1 (2015).
+
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Reviewed-by: Nicolas Schier <nicolas@fjasle.eu>
+Stable-dep-of: 3bd27a847a3a ("kheaders: explicitly define file modes for archived headers")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/gen_kheaders.sh | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/gen_kheaders.sh b/kernel/gen_kheaders.sh
+index 1966a749e0d96..5ab483a3ee5a5 100755
+--- a/kernel/gen_kheaders.sh
++++ b/kernel/gen_kheaders.sh
+@@ -81,12 +81,9 @@ find $cpio_dir -type f -print0 |
+ xargs -0 -P8 -n1 perl -pi -e 'BEGIN {undef $/;}; s/\/\*((?!SPDX).)*?\*\///smg;'
+
+ # Create archive and try to normalize metadata for reproducibility.
+-# For compatibility with older versions of tar, files are fed to tar
+-# pre-sorted, as --sort=name might not be available.
+-find $cpio_dir -printf "./%P\n" | LC_ALL=C sort | \
+- tar "${KBUILD_BUILD_TIMESTAMP:+--mtime=$KBUILD_BUILD_TIMESTAMP}" \
+- --owner=0 --group=0 --numeric-owner --no-recursion \
+- -I $XZ -cf $tarfile -C $cpio_dir/ -T - > /dev/null
++tar "${KBUILD_BUILD_TIMESTAMP:+--mtime=$KBUILD_BUILD_TIMESTAMP}" \
++ --owner=0 --group=0 --sort=name --numeric-owner \
++ -I $XZ -cf $tarfile -C $cpio_dir/ . > /dev/null
+
+ echo $headers_md5 > kernel/kheaders.md5
+ echo "$this_file_md5" >> kernel/kheaders.md5
+--
+2.43.0
+
--- /dev/null
+From 1bc057fce6fe51523bce0695934f3e016eb57a5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Apr 2024 13:52:01 +0200
+Subject: riscv: fix overlap of allocated page and PTR_ERR
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nam Cao <namcao@linutronix.de>
+
+[ Upstream commit 994af1825a2aa286f4903ff64a1c7378b52defe6 ]
+
+On riscv32, it is possible for the last page in virtual address space
+(0xfffff000) to be allocated. This page overlaps with PTR_ERR, so that
+shouldn't happen.
+
+There is already some code to ensure memblock won't allocate the last page.
+However, buddy allocator is left unchecked.
+
+Fix this by reserving physical memory that would be mapped at virtual
+addresses greater than 0xfffff000.
+
+Reported-by: Björn Töpel <bjorn@kernel.org>
+Closes: https://lore.kernel.org/linux-riscv/878r1ibpdn.fsf@all.your.base.are.belong.to.us
+Fixes: 76d2a0493a17 ("RISC-V: Init and Halt Code")
+Signed-off-by: Nam Cao <namcao@linutronix.de>
+Cc: <stable@vger.kernel.org>
+Tested-by: Björn Töpel <bjorn@rivosinc.com>
+Reviewed-by: Björn Töpel <bjorn@rivosinc.com>
+Reviewed-by: Mike Rapoport (IBM) <rppt@kernel.org>
+Link: https://lore.kernel.org/r/20240425115201.3044202-1-namcao@linutronix.de
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/mm/init.c | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
+index c9d63c476d315..c30cc3ac93a72 100644
+--- a/arch/riscv/mm/init.c
++++ b/arch/riscv/mm/init.c
+@@ -192,18 +192,19 @@ static void __init setup_bootmem(void)
+ phys_ram_base = memblock_start_of_DRAM();
+ #endif
+ /*
+- * memblock allocator is not aware of the fact that last 4K bytes of
+- * the addressable memory can not be mapped because of IS_ERR_VALUE
+- * macro. Make sure that last 4k bytes are not usable by memblock
+- * if end of dram is equal to maximum addressable memory. For 64-bit
+- * kernel, this problem can't happen here as the end of the virtual
+- * address space is occupied by the kernel mapping then this check must
+- * be done as soon as the kernel mapping base address is determined.
++ * Reserve physical address space that would be mapped to virtual
++ * addresses greater than (void *)(-PAGE_SIZE) because:
++ * - This memory would overlap with ERR_PTR
++ * - This memory belongs to high memory, which is not supported
++ *
++ * This is not applicable to 64-bit kernel, because virtual addresses
++ * after (void *)(-PAGE_SIZE) are not linearly mapped: they are
++ * occupied by kernel mapping. Also it is unrealistic for high memory
++ * to exist on 64-bit platforms.
+ */
+ if (!IS_ENABLED(CONFIG_64BIT)) {
+- max_mapped_addr = __pa(~(ulong)0);
+- if (max_mapped_addr == (phys_ram_end - 1))
+- memblock_set_current_limit(max_mapped_addr - 4096);
++ max_mapped_addr = __va_to_pa_nodebug(-PAGE_SIZE);
++ memblock_reserve(max_mapped_addr, (phys_addr_t)-max_mapped_addr);
+ }
+
+ min_low_pfn = PFN_UP(phys_ram_base);
+--
+2.43.0
+
--- /dev/null
+From ee5aab7767c076e8d4c9a22e0cc0b54fc2e810f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Dec 2021 23:03:50 +0800
+Subject: riscv: mm: init: try best to use IS_ENABLED(CONFIG_64BIT) instead of
+ #ifdef
+
+From: Jisheng Zhang <jszhang@kernel.org>
+
+[ Upstream commit 07aabe8fb6d1ac3163cc74c856521f2ee746270b ]
+
+Try our best to replace the conditional compilation using
+"#ifdef CONFIG_64BIT" by a check for "IS_ENABLED(CONFIG_64BIT)", to
+simplify the code and to increase compile coverage.
+
+Now we can also remove the __maybe_unused used in max_mapped_addr
+declaration.
+
+We also remove the BUG_ON check of mapping the last 4K bytes of the
+addressable memory since this is always true for every kernel actually.
+
+Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
+Reviewed-by: Alexandre Ghiti <alex@ghiti.fr>
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Stable-dep-of: 994af1825a2a ("riscv: fix overlap of allocated page and PTR_ERR")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/mm/init.c | 43 ++++++++++++++++---------------------------
+ 1 file changed, 16 insertions(+), 27 deletions(-)
+
+diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
+index d7115acab3501..c9d63c476d315 100644
+--- a/arch/riscv/mm/init.c
++++ b/arch/riscv/mm/init.c
+@@ -105,10 +105,9 @@ static void __init print_vm_layout(void)
+ #endif
+ print_mlm("lowmem", (unsigned long)PAGE_OFFSET,
+ (unsigned long)high_memory);
+-#ifdef CONFIG_64BIT
+- print_mlm("kernel", (unsigned long)KERNEL_LINK_ADDR,
+- (unsigned long)ADDRESS_SPACE_END);
+-#endif
++ if (IS_ENABLED(CONFIG_64BIT))
++ print_mlm("kernel", (unsigned long)KERNEL_LINK_ADDR,
++ (unsigned long)ADDRESS_SPACE_END);
+ }
+ #else
+ static void print_vm_layout(void) { }
+@@ -166,7 +165,7 @@ static void __init setup_bootmem(void)
+ {
+ phys_addr_t vmlinux_end = __pa_symbol(&_end);
+ phys_addr_t vmlinux_start = __pa_symbol(&_start);
+- phys_addr_t __maybe_unused max_mapped_addr;
++ phys_addr_t max_mapped_addr;
+ phys_addr_t phys_ram_end;
+
+ #ifdef CONFIG_XIP_KERNEL
+@@ -175,17 +174,16 @@ static void __init setup_bootmem(void)
+
+ memblock_enforce_memory_limit(memory_limit);
+
+- /*
+- * Reserve from the start of the kernel to the end of the kernel
+- */
+-#if defined(CONFIG_64BIT) && defined(CONFIG_STRICT_KERNEL_RWX)
+ /*
+ * Make sure we align the reservation on PMD_SIZE since we will
+ * map the kernel in the linear mapping as read-only: we do not want
+ * any allocation to happen between _end and the next pmd aligned page.
+ */
+- vmlinux_end = (vmlinux_end + PMD_SIZE - 1) & PMD_MASK;
+-#endif
++ if (IS_ENABLED(CONFIG_64BIT) && IS_ENABLED(CONFIG_STRICT_KERNEL_RWX))
++ vmlinux_end = (vmlinux_end + PMD_SIZE - 1) & PMD_MASK;
++ /*
++ * Reserve from the start of the kernel to the end of the kernel
++ */
+ memblock_reserve(vmlinux_start, vmlinux_end - vmlinux_start);
+
+
+@@ -193,7 +191,6 @@ static void __init setup_bootmem(void)
+ #ifndef CONFIG_XIP_KERNEL
+ phys_ram_base = memblock_start_of_DRAM();
+ #endif
+-#ifndef CONFIG_64BIT
+ /*
+ * memblock allocator is not aware of the fact that last 4K bytes of
+ * the addressable memory can not be mapped because of IS_ERR_VALUE
+@@ -203,10 +200,11 @@ static void __init setup_bootmem(void)
+ * address space is occupied by the kernel mapping then this check must
+ * be done as soon as the kernel mapping base address is determined.
+ */
+- max_mapped_addr = __pa(~(ulong)0);
+- if (max_mapped_addr == (phys_ram_end - 1))
+- memblock_set_current_limit(max_mapped_addr - 4096);
+-#endif
++ if (!IS_ENABLED(CONFIG_64BIT)) {
++ max_mapped_addr = __pa(~(ulong)0);
++ if (max_mapped_addr == (phys_ram_end - 1))
++ memblock_set_current_limit(max_mapped_addr - 4096);
++ }
+
+ min_low_pfn = PFN_UP(phys_ram_base);
+ max_low_pfn = max_pfn = PFN_DOWN(phys_ram_end);
+@@ -630,14 +628,6 @@ asmlinkage void __init setup_vm(uintptr_t dtb_pa)
+ BUG_ON((PAGE_OFFSET % PGDIR_SIZE) != 0);
+ BUG_ON((kernel_map.phys_addr % PMD_SIZE) != 0);
+
+-#ifdef CONFIG_64BIT
+- /*
+- * The last 4K bytes of the addressable memory can not be mapped because
+- * of IS_ERR_VALUE macro.
+- */
+- BUG_ON((kernel_map.virt_addr + kernel_map.size) > ADDRESS_SPACE_END - SZ_4K);
+-#endif
+-
+ pt_ops.alloc_pte = alloc_pte_early;
+ pt_ops.get_pte_virt = get_pte_virt_early;
+ #ifndef __PAGETABLE_PMD_FOLDED
+@@ -760,10 +750,9 @@ static void __init setup_vm_final(void)
+ }
+ }
+
+-#ifdef CONFIG_64BIT
+ /* Map the kernel */
+- create_kernel_page_table(swapper_pg_dir, false);
+-#endif
++ if (IS_ENABLED(CONFIG_64BIT))
++ create_kernel_page_table(swapper_pg_dir, false);
+
+ /* Clear fixmap PTE and PMD mappings */
+ clear_fixmap(FIX_PTE);
+--
+2.43.0
+
--- /dev/null
+From 6833d46a92105b87a33e3ef0832531e910bd4075 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Nov 2021 11:22:33 -0800
+Subject: rtlwifi: rtl8192de: Style clean-ups
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 69831173fcbbfebb7aa2d76523deaf0b87b8eddd ]
+
+Clean up some style issues:
+- Use ARRAY_SIZE() even though it's a u8 array.
+- Remove redundant CHANNEL_MAX_NUMBER_2G define.
+Additionally fix some dead code WARNs.
+
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://lore.kernel.org/lkml/57d0d1b6064342309f680f692192556c@realtek.com/
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20211119192233.1021063-1-keescook@chromium.org
+Stable-dep-of: de4d4be4fa64 ("wifi: rtlwifi: rtl8192de: Fix 5 GHz TX power")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../wireless/realtek/rtlwifi/rtl8192de/phy.c | 17 +++++++----------
+ drivers/net/wireless/realtek/rtlwifi/wifi.h | 1 -
+ 2 files changed, 7 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
+index c3c07ca77614a..d835a27429f0f 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
+@@ -892,7 +892,7 @@ static u8 _rtl92c_phy_get_rightchnlplace(u8 chnl)
+ u8 place = chnl;
+
+ if (chnl > 14) {
+- for (place = 14; place < sizeof(channel5g); place++) {
++ for (place = 14; place < ARRAY_SIZE(channel5g); place++) {
+ if (channel5g[place] == chnl) {
+ place++;
+ break;
+@@ -1359,7 +1359,7 @@ u8 rtl92d_get_rightchnlplace_for_iqk(u8 chnl)
+ u8 place;
+
+ if (chnl > 14) {
+- for (place = 14; place < sizeof(channel_all); place++) {
++ for (place = 14; place < ARRAY_SIZE(channel_all); place++) {
+ if (channel_all[place] == chnl)
+ return place - 13;
+ }
+@@ -2417,7 +2417,7 @@ static bool _rtl92d_is_legal_5g_channel(struct ieee80211_hw *hw, u8 channel)
+
+ int i;
+
+- for (i = 0; i < sizeof(channel5g); i++)
++ for (i = 0; i < ARRAY_SIZE(channel5g); i++)
+ if (channel == channel5g[i])
+ return true;
+ return false;
+@@ -2681,9 +2681,8 @@ void rtl92d_phy_reset_iqk_result(struct ieee80211_hw *hw)
+ u8 i;
+
+ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
+- "settings regs %d default regs %d\n",
+- (int)(sizeof(rtlphy->iqk_matrix) /
+- sizeof(struct iqk_matrix_regs)),
++ "settings regs %zu default regs %d\n",
++ ARRAY_SIZE(rtlphy->iqk_matrix),
+ IQK_MATRIX_REG_NUM);
+ /* 0xe94, 0xe9c, 0xea4, 0xeac, 0xeb4, 0xebc, 0xec4, 0xecc */
+ for (i = 0; i < IQK_MATRIX_SETTINGS_NUM; i++) {
+@@ -2850,16 +2849,14 @@ u8 rtl92d_phy_sw_chnl(struct ieee80211_hw *hw)
+ case BAND_ON_5G:
+ /* Get first channel error when change between
+ * 5G and 2.4G band. */
+- if (channel <= 14)
++ if (WARN_ONCE(channel <= 14, "rtl8192de: 5G but channel<=14\n"))
+ return 0;
+- WARN_ONCE((channel <= 14), "rtl8192de: 5G but channel<=14\n");
+ break;
+ case BAND_ON_2_4G:
+ /* Get first channel error when change between
+ * 5G and 2.4G band. */
+- if (channel > 14)
++ if (WARN_ONCE(channel > 14, "rtl8192de: 2G but channel>14\n"))
+ return 0;
+- WARN_ONCE((channel > 14), "rtl8192de: 2G but channel>14\n");
+ break;
+ default:
+ WARN_ONCE(true, "rtl8192de: Invalid WirelessMode(%#x)!!\n",
+diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h
+index a1f223c8848b9..0bac788ccd6e3 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h
+@@ -108,7 +108,6 @@
+ #define CHANNEL_GROUP_IDX_5GM 6
+ #define CHANNEL_GROUP_IDX_5GH 9
+ #define CHANNEL_GROUP_MAX_5G 9
+-#define CHANNEL_MAX_NUMBER_2G 14
+ #define AVG_THERMAL_NUM 8
+ #define AVG_THERMAL_NUM_88E 4
+ #define AVG_THERMAL_NUM_8723BE 4
+--
+2.43.0
+
i2c-ocores-set-iack-bit-after-core-is-enabled.patch
dt-bindings-i2c-google-cros-ec-i2c-tunnel-correct-path-to-i2c-controller-schema.patch
arm64-dts-imx8qm-mek-fix-gpio-number-for-reg_usdhc2_vmmc.patch
+perf-script-add-raw-disasm-arguments-to-insn-trace-o.patch
+perf-script-show-also-errors-for-insn-trace-option.patch
+arm-dts-samsung-smdkv310-fix-keypad-no-autorepeat.patch
+arm-dts-samsung-exynos4412-origen-fix-keypad-no-auto.patch
+arm-dts-samsung-smdk4412-fix-keypad-no-autorepeat.patch
+mmc-sdhci-change-the-code-to-check-auto_cmd23.patch
+mmc-core-capture-emmc-and-sd-card-errors.patch
+mmc-sdhci-capture-emmc-and-sd-card-errors.patch
+mmc-sdhci-add-support-for-tuning-error-interrupts.patch
+rtlwifi-rtl8192de-style-clean-ups.patch
+wifi-rtlwifi-rtl8192de-fix-5-ghz-tx-power.patch
+pmdomain-ti-sci-fix-duplicate-pd-referrals.patch
+bcache-fix-variable-length-array-abuse-in-btree_iter.patch
+tracing-add-module_description-to-preemptirq_delay_t.patch
+x86-cpu-vfm-add-new-macros-to-work-with-vendor-famil.patch
+x86-cpu-fix-x86_match_cpu-to-match-just-x86_vendor_i.patch
+ksmbd-ignore-trailing-slashes-in-share-paths.patch
+drm-i915-gt-only-kick-the-signal-worker-if-there-s-b.patch
+drm-i915-gt-disarm-breadcrumbs-if-engines-are-alread.patch
+revert-kheaders-substituting-sort-in-archive-creatio.patch
+kheaders-explicitly-define-file-modes-for-archived-h.patch
+riscv-mm-init-try-best-to-use-is_enabled-config_64bi.patch
+riscv-fix-overlap-of-allocated-page-and-ptr_err.patch
+perf-core-fix-missing-wakeup-when-waiting-for-contex.patch
+pci-add-pci_error_response-and-related-definitions.patch
+x86-amd_nb-check-for-invalid-smn-reads.patch
+smb-client-fix-deadlock-in-smb2_find_smb_tcon.patch
--- /dev/null
+From e7531a5c4d5425d96c4b1d1eadbc67077e2700f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Jun 2024 13:13:13 -0300
+Subject: smb: client: fix deadlock in smb2_find_smb_tcon()
+
+From: Enzo Matsumiya <ematsumiya@suse.de>
+
+[ Upstream commit 02c418774f76a0a36a6195c9dbf8971eb4130a15 ]
+
+Unlock cifs_tcp_ses_lock before calling cifs_put_smb_ses() to avoid such
+deadlock.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
+Reviewed-by: Shyam Prasad N <sprasad@microsoft.com>
+Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smb2transport.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c
+index 0f2e0ce84a03f..ffae3a7f46ce4 100644
+--- a/fs/cifs/smb2transport.c
++++ b/fs/cifs/smb2transport.c
+@@ -194,8 +194,8 @@ smb2_find_smb_tcon(struct TCP_Server_Info *server, __u64 ses_id, __u32 tid)
+ }
+ tcon = smb2_find_smb_sess_tcon_unlocked(ses, tid);
+ if (!tcon) {
+- cifs_put_smb_ses(ses);
+ spin_unlock(&cifs_tcp_ses_lock);
++ cifs_put_smb_ses(ses);
+ return NULL;
+ }
+ spin_unlock(&cifs_tcp_ses_lock);
+--
+2.43.0
+
--- /dev/null
+From b42861dd931f7213b83d9fc8582943f45d22360e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 May 2024 15:54:49 -0700
+Subject: tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test
+
+From: Jeff Johnson <quic_jjohnson@quicinc.com>
+
+[ Upstream commit 23748e3e0fbfe471eff5ce439921629f6a427828 ]
+
+Fix the 'make W=1' warning:
+
+WARNING: modpost: missing MODULE_DESCRIPTION() in kernel/trace/preemptirq_delay_test.o
+
+Link: https://lore.kernel.org/linux-trace-kernel/20240518-md-preemptirq_delay_test-v1-1-387d11b30d85@quicinc.com
+
+Cc: stable@vger.kernel.org
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Fixes: f96e8577da10 ("lib: Add module for testing preemptoff/irqsoff latency tracers")
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/preemptirq_delay_test.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/trace/preemptirq_delay_test.c b/kernel/trace/preemptirq_delay_test.c
+index 8c4ffd0761624..cb0871fbdb07f 100644
+--- a/kernel/trace/preemptirq_delay_test.c
++++ b/kernel/trace/preemptirq_delay_test.c
+@@ -215,4 +215,5 @@ static void __exit preemptirq_delay_exit(void)
+
+ module_init(preemptirq_delay_init)
+ module_exit(preemptirq_delay_exit)
++MODULE_DESCRIPTION("Preempt / IRQ disable delay thread to test latency tracers");
+ MODULE_LICENSE("GPL v2");
+--
+2.43.0
+
--- /dev/null
+From 9a227787229b62af4e1a60731c36b99285f3b184 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Apr 2024 21:09:21 +0300
+Subject: wifi: rtlwifi: rtl8192de: Fix 5 GHz TX power
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit de4d4be4fa64ed7b4aa1c613061015bd8fa98b24 ]
+
+Different channels have different TX power settings. rtl8192de is using
+the TX power setting from the wrong channel in the 5 GHz band because
+_rtl92c_phy_get_rightchnlplace expects an array which includes all the
+channel numbers, but it's using an array which includes only the 5 GHz
+channel numbers.
+
+Use the array channel_all (defined in rtl8192de/phy.c) instead of
+the incorrect channel5g (defined in core.c).
+
+Tested only with rtl8192du, which will use the same TX power code.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://msgid.link/c7653517-cf88-4f57-b79a-8edb0a8b32f0@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
+index d835a27429f0f..56b5cd032a9ac 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
+@@ -892,8 +892,8 @@ static u8 _rtl92c_phy_get_rightchnlplace(u8 chnl)
+ u8 place = chnl;
+
+ if (chnl > 14) {
+- for (place = 14; place < ARRAY_SIZE(channel5g); place++) {
+- if (channel5g[place] == chnl) {
++ for (place = 14; place < ARRAY_SIZE(channel_all); place++) {
++ if (channel_all[place] == chnl) {
+ place++;
+ break;
+ }
+--
+2.43.0
+
--- /dev/null
+From bd163d35121623ef310a7c9e6f5a5803d88fe7e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Apr 2023 16:42:44 +0000
+Subject: x86/amd_nb: Check for invalid SMN reads
+
+From: Yazen Ghannam <yazen.ghannam@amd.com>
+
+[ Upstream commit c625dabbf1c4a8e77e4734014f2fde7aa9071a1f ]
+
+AMD Zen-based systems use a System Management Network (SMN) that
+provides access to implementation-specific registers.
+
+SMN accesses are done indirectly through an index/data pair in PCI
+config space. The PCI config access may fail and return an error code.
+This would prevent the "read" value from being updated.
+
+However, the PCI config access may succeed, but the return value may be
+invalid. This is in similar fashion to PCI bad reads, i.e. return all
+bits set.
+
+Most systems will return 0 for SMN addresses that are not accessible.
+This is in line with AMD convention that unavailable registers are
+Read-as-Zero/Writes-Ignored.
+
+However, some systems will return a "PCI Error Response" instead. This
+value, along with an error code of 0 from the PCI config access, will
+confuse callers of the amd_smn_read() function.
+
+Check for this condition, clear the return value, and set a proper error
+code.
+
+Fixes: ddfe43cdc0da ("x86/amd_nb: Add SMN and Indirect Data Fabric access for AMD Fam17h")
+Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20230403164244.471141-1-yazen.ghannam@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/amd_nb.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c
+index c92c9c774c0e5..62cd2af806b47 100644
+--- a/arch/x86/kernel/amd_nb.c
++++ b/arch/x86/kernel/amd_nb.c
+@@ -172,7 +172,14 @@ static int __amd_smn_rw(u16 node, u32 address, u32 *value, bool write)
+
+ int amd_smn_read(u16 node, u32 address, u32 *value)
+ {
+- return __amd_smn_rw(node, address, value, false);
++ int err = __amd_smn_rw(node, address, value, false);
++
++ if (PCI_POSSIBLE_ERROR(*value)) {
++ err = -ENODEV;
++ *value = 0;
++ }
++
++ return err;
+ }
+ EXPORT_SYMBOL_GPL(amd_smn_read);
+
+--
+2.43.0
+
--- /dev/null
+From 77b2c7b78b8e374fb75e0daef2f76ed995e8860f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 May 2024 15:45:33 -0700
+Subject: x86/cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL
+
+From: Tony Luck <tony.luck@intel.com>
+
+[ Upstream commit 93022482b2948a9a7e9b5a2bb685f2e1cb4c3348 ]
+
+Code in v6.9 arch/x86/kernel/smpboot.c was changed by commit
+
+ 4db64279bc2b ("x86/cpu: Switch to new Intel CPU model defines") from:
+
+ static const struct x86_cpu_id intel_cod_cpu[] = {
+ X86_MATCH_INTEL_FAM6_MODEL(HASWELL_X, 0), /* COD */
+ X86_MATCH_INTEL_FAM6_MODEL(BROADWELL_X, 0), /* COD */
+ X86_MATCH_INTEL_FAM6_MODEL(ANY, 1), /* SNC */ <--- 443
+ {}
+ };
+
+ static bool match_llc(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
+ {
+ const struct x86_cpu_id *id = x86_match_cpu(intel_cod_cpu);
+
+to:
+
+ static const struct x86_cpu_id intel_cod_cpu[] = {
+ X86_MATCH_VFM(INTEL_HASWELL_X, 0), /* COD */
+ X86_MATCH_VFM(INTEL_BROADWELL_X, 0), /* COD */
+ X86_MATCH_VFM(INTEL_ANY, 1), /* SNC */
+ {}
+ };
+
+ static bool match_llc(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
+ {
+ const struct x86_cpu_id *id = x86_match_cpu(intel_cod_cpu);
+
+On an Intel CPU with SNC enabled this code previously matched the rule on line
+443 to avoid printing messages about insane cache configuration. The new code
+did not match any rules.
+
+Expanding the macros for the intel_cod_cpu[] array shows that the old is
+equivalent to:
+
+ static const struct x86_cpu_id intel_cod_cpu[] = {
+ [0] = { .vendor = 0, .family = 6, .model = 0x3F, .steppings = 0, .feature = 0, .driver_data = 0 },
+ [1] = { .vendor = 0, .family = 6, .model = 0x4F, .steppings = 0, .feature = 0, .driver_data = 0 },
+ [2] = { .vendor = 0, .family = 6, .model = 0x00, .steppings = 0, .feature = 0, .driver_data = 1 },
+ [3] = { .vendor = 0, .family = 0, .model = 0x00, .steppings = 0, .feature = 0, .driver_data = 0 }
+ }
+
+while the new code expands to:
+
+ static const struct x86_cpu_id intel_cod_cpu[] = {
+ [0] = { .vendor = 0, .family = 6, .model = 0x3F, .steppings = 0, .feature = 0, .driver_data = 0 },
+ [1] = { .vendor = 0, .family = 6, .model = 0x4F, .steppings = 0, .feature = 0, .driver_data = 0 },
+ [2] = { .vendor = 0, .family = 0, .model = 0x00, .steppings = 0, .feature = 0, .driver_data = 1 },
+ [3] = { .vendor = 0, .family = 0, .model = 0x00, .steppings = 0, .feature = 0, .driver_data = 0 }
+ }
+
+Looking at the code for x86_match_cpu():
+
+ const struct x86_cpu_id *x86_match_cpu(const struct x86_cpu_id *match)
+ {
+ const struct x86_cpu_id *m;
+ struct cpuinfo_x86 *c = &boot_cpu_data;
+
+ for (m = match;
+ m->vendor | m->family | m->model | m->steppings | m->feature;
+ m++) {
+ ...
+ }
+ return NULL;
+
+it is clear that there was no match because the ANY entry in the table (array
+index 2) is now the loop termination condition (all of vendor, family, model,
+steppings, and feature are zero).
+
+So this code was working before because the "ANY" check was looking for any
+Intel CPU in family 6. But fails now because the family is a wild card. So the
+root cause is that x86_match_cpu() has never been able to match on a rule with
+just X86_VENDOR_INTEL and all other fields set to wildcards.
+
+Add a new flags field to struct x86_cpu_id that has a bit set to indicate that
+this entry in the array is valid. Update X86_MATCH*() macros to set that bit.
+Change the end-marker check in x86_match_cpu() to just check the flags field
+for this bit.
+
+Backporter notes: The commit in Fixes is really the one that is broken:
+you can't have m->vendor as part of the loop termination conditional in
+x86_match_cpu() because it can happen - as it has happened above
+- that that whole conditional is 0 albeit vendor == 0 is a valid case
+- X86_VENDOR_INTEL is 0.
+
+However, the only case where the above happens is the SNC check added by
+4db64279bc2b1 so you only need this fix if you have backported that
+other commit
+
+ 4db64279bc2b ("x86/cpu: Switch to new Intel CPU model defines")
+
+Fixes: 644e9cbbe3fc ("Add driver auto probing for x86 features v4")
+Suggested-by: Thomas Gleixner <tglx@linutronix.de>
+Suggested-by: Borislav Petkov <bp@alien8.de>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Cc: <stable+noautosel@kernel.org> # see above
+Link: https://lore.kernel.org/r/20240517144312.GBZkdtAOuJZCvxhFbJ@fat_crate.local
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/cpu_device_id.h | 5 +++++
+ arch/x86/kernel/cpu/match.c | 4 +---
+ include/linux/mod_devicetable.h | 2 ++
+ 3 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/include/asm/cpu_device_id.h b/arch/x86/include/asm/cpu_device_id.h
+index dd7b9463696f5..e8e3dbe7f1730 100644
+--- a/arch/x86/include/asm/cpu_device_id.h
++++ b/arch/x86/include/asm/cpu_device_id.h
+@@ -53,6 +53,9 @@
+ #define X86_CENTAUR_FAM6_C7_D 0xd
+ #define X86_CENTAUR_FAM6_NANO 0xf
+
++/* x86_cpu_id::flags */
++#define X86_CPU_ID_FLAG_ENTRY_VALID BIT(0)
++
+ #define X86_STEPPINGS(mins, maxs) GENMASK(maxs, mins)
+ /**
+ * X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE - Base macro for CPU matching
+@@ -79,6 +82,7 @@
+ .model = _model, \
+ .steppings = _steppings, \
+ .feature = _feature, \
++ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, \
+ .driver_data = (unsigned long) _data \
+ }
+
+@@ -89,6 +93,7 @@
+ .model = _model, \
+ .steppings = _steppings, \
+ .feature = _feature, \
++ .flags = X86_CPU_ID_FLAG_ENTRY_VALID, \
+ .driver_data = (unsigned long) _data \
+ }
+
+diff --git a/arch/x86/kernel/cpu/match.c b/arch/x86/kernel/cpu/match.c
+index ad6776081e60d..ae71b8ef909c9 100644
+--- a/arch/x86/kernel/cpu/match.c
++++ b/arch/x86/kernel/cpu/match.c
+@@ -39,9 +39,7 @@ const struct x86_cpu_id *x86_match_cpu(const struct x86_cpu_id *match)
+ const struct x86_cpu_id *m;
+ struct cpuinfo_x86 *c = &boot_cpu_data;
+
+- for (m = match;
+- m->vendor | m->family | m->model | m->steppings | m->feature;
+- m++) {
++ for (m = match; m->flags & X86_CPU_ID_FLAG_ENTRY_VALID; m++) {
+ if (m->vendor != X86_VENDOR_ANY && c->x86_vendor != m->vendor)
+ continue;
+ if (m->family != X86_FAMILY_ANY && c->x86 != m->family)
+diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
+index ae2e75d15b219..63f804574c4e9 100644
+--- a/include/linux/mod_devicetable.h
++++ b/include/linux/mod_devicetable.h
+@@ -676,6 +676,8 @@ struct x86_cpu_id {
+ __u16 model;
+ __u16 steppings;
+ __u16 feature; /* bit index */
++ /* Solely for kernel-internal use: DO NOT EXPORT to userspace! */
++ __u16 flags;
+ kernel_ulong_t driver_data;
+ };
+
+--
+2.43.0
+
--- /dev/null
+From c7cf296af6c36fa6d6c15c5f8d62a9f972fa58a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Apr 2024 14:19:04 -0700
+Subject: x86/cpu/vfm: Add new macros to work with (vendor/family/model) values
+
+From: Tony Luck <tony.luck@intel.com>
+
+[ Upstream commit e6dfdc2e89a0adedf455814c91b977d6a584cc88 ]
+
+To avoid adding a slew of new macros for each new Intel CPU family
+switch over from providing CPU model number #defines to a new
+scheme that encodes vendor, family, and model in a single number.
+
+ [ bp: s/casted/cast/g ]
+
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20240416211941.9369-3-tony.luck@intel.com
+Stable-dep-of: 93022482b294 ("x86/cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/cpu_device_id.h | 93 ++++++++++++++++++++++++++++
+ 1 file changed, 93 insertions(+)
+
+diff --git a/arch/x86/include/asm/cpu_device_id.h b/arch/x86/include/asm/cpu_device_id.h
+index eb8fcede9e3bf..dd7b9463696f5 100644
+--- a/arch/x86/include/asm/cpu_device_id.h
++++ b/arch/x86/include/asm/cpu_device_id.h
+@@ -2,6 +2,39 @@
+ #ifndef _ASM_X86_CPU_DEVICE_ID
+ #define _ASM_X86_CPU_DEVICE_ID
+
++/*
++ * Can't use <linux/bitfield.h> because it generates expressions that
++ * cannot be used in structure initializers. Bitfield construction
++ * here must match the union in struct cpuinfo_86:
++ * union {
++ * struct {
++ * __u8 x86_model;
++ * __u8 x86;
++ * __u8 x86_vendor;
++ * __u8 x86_reserved;
++ * };
++ * __u32 x86_vfm;
++ * };
++ */
++#define VFM_MODEL_BIT 0
++#define VFM_FAMILY_BIT 8
++#define VFM_VENDOR_BIT 16
++#define VFM_RSVD_BIT 24
++
++#define VFM_MODEL_MASK GENMASK(VFM_FAMILY_BIT - 1, VFM_MODEL_BIT)
++#define VFM_FAMILY_MASK GENMASK(VFM_VENDOR_BIT - 1, VFM_FAMILY_BIT)
++#define VFM_VENDOR_MASK GENMASK(VFM_RSVD_BIT - 1, VFM_VENDOR_BIT)
++
++#define VFM_MODEL(vfm) (((vfm) & VFM_MODEL_MASK) >> VFM_MODEL_BIT)
++#define VFM_FAMILY(vfm) (((vfm) & VFM_FAMILY_MASK) >> VFM_FAMILY_BIT)
++#define VFM_VENDOR(vfm) (((vfm) & VFM_VENDOR_MASK) >> VFM_VENDOR_BIT)
++
++#define VFM_MAKE(_vendor, _family, _model) ( \
++ ((_model) << VFM_MODEL_BIT) | \
++ ((_family) << VFM_FAMILY_BIT) | \
++ ((_vendor) << VFM_VENDOR_BIT) \
++)
++
+ /*
+ * Declare drivers belonging to specific x86 CPUs
+ * Similar in spirit to pci_device_id and related PCI functions
+@@ -49,6 +82,16 @@
+ .driver_data = (unsigned long) _data \
+ }
+
++#define X86_MATCH_VENDORID_FAM_MODEL_STEPPINGS_FEATURE(_vendor, _family, _model, \
++ _steppings, _feature, _data) { \
++ .vendor = _vendor, \
++ .family = _family, \
++ .model = _model, \
++ .steppings = _steppings, \
++ .feature = _feature, \
++ .driver_data = (unsigned long) _data \
++}
++
+ /**
+ * X86_MATCH_VENDOR_FAM_MODEL_FEATURE - Macro for CPU matching
+ * @_vendor: The vendor name, e.g. INTEL, AMD, HYGON, ..., ANY
+@@ -164,6 +207,56 @@
+ X86_MATCH_VENDOR_FAM_MODEL_STEPPINGS_FEATURE(INTEL, 6, INTEL_FAM6_##model, \
+ steppings, X86_FEATURE_ANY, data)
+
++/**
++ * X86_MATCH_VFM - Match encoded vendor/family/model
++ * @vfm: Encoded 8-bits each for vendor, family, model
++ * @data: Driver specific data or NULL. The internal storage
++ * format is unsigned long. The supplied value, pointer
++ * etc. is cast to unsigned long internally.
++ *
++ * Stepping and feature are set to wildcards
++ */
++#define X86_MATCH_VFM(vfm, data) \
++ X86_MATCH_VENDORID_FAM_MODEL_STEPPINGS_FEATURE( \
++ VFM_VENDOR(vfm), \
++ VFM_FAMILY(vfm), \
++ VFM_MODEL(vfm), \
++ X86_STEPPING_ANY, X86_FEATURE_ANY, data)
++
++/**
++ * X86_MATCH_VFM_STEPPINGS - Match encoded vendor/family/model/stepping
++ * @vfm: Encoded 8-bits each for vendor, family, model
++ * @steppings: Bitmask of steppings to match
++ * @data: Driver specific data or NULL. The internal storage
++ * format is unsigned long. The supplied value, pointer
++ * etc. is cast to unsigned long internally.
++ *
++ * feature is set to wildcard
++ */
++#define X86_MATCH_VFM_STEPPINGS(vfm, steppings, data) \
++ X86_MATCH_VENDORID_FAM_MODEL_STEPPINGS_FEATURE( \
++ VFM_VENDOR(vfm), \
++ VFM_FAMILY(vfm), \
++ VFM_MODEL(vfm), \
++ steppings, X86_FEATURE_ANY, data)
++
++/**
++ * X86_MATCH_VFM_FEATURE - Match encoded vendor/family/model/feature
++ * @vfm: Encoded 8-bits each for vendor, family, model
++ * @feature: A X86_FEATURE bit
++ * @data: Driver specific data or NULL. The internal storage
++ * format is unsigned long. The supplied value, pointer
++ * etc. is cast to unsigned long internally.
++ *
++ * Steppings is set to wildcard
++ */
++#define X86_MATCH_VFM_FEATURE(vfm, feature, data) \
++ X86_MATCH_VENDORID_FAM_MODEL_STEPPINGS_FEATURE( \
++ VFM_VENDOR(vfm), \
++ VFM_FAMILY(vfm), \
++ VFM_MODEL(vfm), \
++ X86_STEPPING_ANY, feature, data)
++
+ /*
+ * Match specific microcode revisions.
+ *
+--
+2.43.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
