--- /dev/null
+From abf3a3ea9acb5c886c8729191a670744ecd42024 Mon Sep 17 00:00:00 2001
+From: David Virag <virag.david003@gmail.com>
+Date: Tue, 6 Aug 2024 14:11:44 +0200
+Subject: dt-bindings: clock: exynos7885: Fix duplicated binding
+
+From: David Virag <virag.david003@gmail.com>
+
+commit abf3a3ea9acb5c886c8729191a670744ecd42024 upstream.
+
+The numbering in Exynos7885's FSYS CMU bindings has 4 duplicated by
+accident, with the rest of the bindings continuing with 5.
+
+Fix this by moving CLK_MOUT_FSYS_USB30DRD_USER to the end as 11.
+
+Since CLK_MOUT_FSYS_USB30DRD_USER is not used in any device tree as of
+now, and there are no other clocks affected (maybe apart from
+CLK_MOUT_FSYS_MMC_SDIO_USER which the number was shared with, also not
+used in a device tree), this is the least impactful way to solve this
+problem.
+
+Fixes: cd268e309c29 ("dt-bindings: clock: Add bindings for Exynos7885 CMU_FSYS")
+Cc: stable@vger.kernel.org
+Signed-off-by: David Virag <virag.david003@gmail.com>
+Link: https://lore.kernel.org/r/20240806121157.479212-2-virag.david003@gmail.com
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/dt-bindings/clock/exynos7885.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/dt-bindings/clock/exynos7885.h
++++ b/include/dt-bindings/clock/exynos7885.h
+@@ -136,12 +136,12 @@
+ #define CLK_MOUT_FSYS_MMC_CARD_USER 2
+ #define CLK_MOUT_FSYS_MMC_EMBD_USER 3
+ #define CLK_MOUT_FSYS_MMC_SDIO_USER 4
+-#define CLK_MOUT_FSYS_USB30DRD_USER 4
+ #define CLK_GOUT_MMC_CARD_ACLK 5
+ #define CLK_GOUT_MMC_CARD_SDCLKIN 6
+ #define CLK_GOUT_MMC_EMBD_ACLK 7
+ #define CLK_GOUT_MMC_EMBD_SDCLKIN 8
+ #define CLK_GOUT_MMC_SDIO_ACLK 9
+ #define CLK_GOUT_MMC_SDIO_SDCLKIN 10
++#define CLK_MOUT_FSYS_USB30DRD_USER 11
+
+ #endif /* _DT_BINDINGS_CLOCK_EXYNOS_7885_H */
--- /dev/null
+From 9c3a62c20f7fb00294a4237e287254456ba8a48b Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Fri, 16 Aug 2024 15:57:21 +0200
+Subject: firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp()
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit 9c3a62c20f7fb00294a4237e287254456ba8a48b upstream.
+
+mbox_client_to_bpmp() is not used, W=1 builds:
+
+ drivers/firmware/tegra/bpmp.c:28:1: error: unused function 'mbox_client_to_bpmp' [-Werror,-Wunused-function]
+
+Fixes: cdfa358b248e ("firmware: tegra: Refactor BPMP driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/firmware/tegra/bpmp.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+--- a/drivers/firmware/tegra/bpmp.c
++++ b/drivers/firmware/tegra/bpmp.c
+@@ -24,12 +24,6 @@
+ #define MSG_RING BIT(1)
+ #define TAG_SZ 32
+
+-static inline struct tegra_bpmp *
+-mbox_client_to_bpmp(struct mbox_client *client)
+-{
+- return container_of(client, struct tegra_bpmp, mbox.client);
+-}
+-
+ static inline const struct tegra_bpmp_ops *
+ channel_to_ops(struct tegra_bpmp_channel *channel)
+ {
--- /dev/null
+From 8d3cefaf659265aa82b0373a563fdb9d16a2b947 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Thu, 15 Aug 2024 21:44:50 +0200
+Subject: i2c: core: Lock address during client device instantiation
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+commit 8d3cefaf659265aa82b0373a563fdb9d16a2b947 upstream.
+
+Krzysztof reported an issue [0] which is caused by parallel attempts to
+instantiate the same I2C client device. This can happen if driver
+supports auto-detection, but certain devices are also instantiated
+explicitly.
+The original change isn't actually wrong, it just revealed that I2C core
+isn't prepared yet to handle this scenario.
+Calls to i2c_new_client_device() can be nested, therefore we can't use a
+simple mutex here. Parallel instantiation of devices at different addresses
+is ok, so we just have to prevent parallel instantiation at the same address.
+We can use a bitmap with one bit per 7-bit I2C client address, and atomic
+bit operations to set/check/clear bits.
+Now a parallel attempt to instantiate a device at the same address will
+result in -EBUSY being returned, avoiding the "sysfs: cannot create duplicate
+filename" splash.
+
+Note: This patch version includes small cosmetic changes to the Tested-by
+ version, only functional change is that address locking is supported
+ for slave addresses too.
+
+[0] https://lore.kernel.org/linux-i2c/9479fe4e-eb0c-407e-84c0-bd60c15baf74@ans.pl/T/#m12706546e8e2414d8f1a0dc61c53393f731685cc
+
+Fixes: caba40ec3531 ("eeprom: at24: Probe for DDR3 thermal sensor in the SPD case")
+Cc: stable@vger.kernel.org
+Tested-by: Krzysztof Piotr Oledzki <ole@ans.pl>
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/i2c-core-base.c | 28 ++++++++++++++++++++++++++++
+ include/linux/i2c.h | 3 +++
+ 2 files changed, 31 insertions(+)
+
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -915,6 +915,27 @@ int i2c_dev_irq_from_resources(const str
+ return 0;
+ }
+
++/*
++ * Serialize device instantiation in case it can be instantiated explicitly
++ * and by auto-detection
++ */
++static int i2c_lock_addr(struct i2c_adapter *adap, unsigned short addr,
++ unsigned short flags)
++{
++ if (!(flags & I2C_CLIENT_TEN) &&
++ test_and_set_bit(addr, adap->addrs_in_instantiation))
++ return -EBUSY;
++
++ return 0;
++}
++
++static void i2c_unlock_addr(struct i2c_adapter *adap, unsigned short addr,
++ unsigned short flags)
++{
++ if (!(flags & I2C_CLIENT_TEN))
++ clear_bit(addr, adap->addrs_in_instantiation);
++}
++
+ /**
+ * i2c_new_client_device - instantiate an i2c device
+ * @adap: the adapter managing the device
+@@ -962,6 +983,10 @@ i2c_new_client_device(struct i2c_adapter
+ goto out_err_silent;
+ }
+
++ status = i2c_lock_addr(adap, client->addr, client->flags);
++ if (status)
++ goto out_err_silent;
++
+ /* Check for address business */
+ status = i2c_check_addr_busy(adap, i2c_encode_flags_to_addr(client));
+ if (status)
+@@ -993,6 +1018,8 @@ i2c_new_client_device(struct i2c_adapter
+ dev_dbg(&adap->dev, "client [%s] registered with bus id %s\n",
+ client->name, dev_name(&client->dev));
+
++ i2c_unlock_addr(adap, client->addr, client->flags);
++
+ return client;
+
+ out_remove_swnode:
+@@ -1004,6 +1031,7 @@ out_err:
+ dev_err(&adap->dev,
+ "Failed to register i2c client %s at 0x%02x (%d)\n",
+ client->name, client->addr, status);
++ i2c_unlock_addr(adap, client->addr, client->flags);
+ out_err_silent:
+ if (need_put)
+ put_device(&client->dev);
+--- a/include/linux/i2c.h
++++ b/include/linux/i2c.h
+@@ -761,6 +761,9 @@ struct i2c_adapter {
+ struct regulator *bus_regulator;
+
+ struct dentry *debugfs;
++
++ /* 7bit address space */
++ DECLARE_BITMAP(addrs_in_instantiation, 1 << 7);
+ };
+ #define to_i2c_adapter(d) container_of(d, struct i2c_adapter, dev)
+
--- /dev/null
+From 5d69d5a00f80488ddcb4dee7d1374a0709398178 Mon Sep 17 00:00:00 2001
+From: Kimriver Liu <kimriver.liu@siengine.com>
+Date: Fri, 13 Sep 2024 11:31:46 +0800
+Subject: i2c: designware: fix controller is holding SCL low while ENABLE bit is disabled
+
+From: Kimriver Liu <kimriver.liu@siengine.com>
+
+commit 5d69d5a00f80488ddcb4dee7d1374a0709398178 upstream.
+
+It was observed that issuing the ABORT bit (IC_ENABLE[1]) will not
+work when IC_ENABLE is already disabled.
+
+Check if the ENABLE bit (IC_ENABLE[0]) is disabled when the controller
+is holding SCL low. If the ENABLE bit is disabled, the software needs
+to enable it before trying to issue the ABORT bit. otherwise,
+the controller ignores any write to ABORT bit.
+
+These kernel logs show up whenever an I2C transaction is
+attempted after this failure.
+i2c_designware e95e0000.i2c: timeout waiting for bus ready
+i2c_designware e95e0000.i2c: timeout in disabling adapter
+
+The patch fixes the issue where the controller cannot be disabled
+while SCL is held low if the ENABLE bit is already disabled.
+
+Fixes: 2409205acd3c ("i2c: designware: fix __i2c_dw_disable() in case master is holding SCL low")
+Signed-off-by: Kimriver Liu <kimriver.liu@siengine.com>
+Cc: <stable@vger.kernel.org> # v6.6+
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-designware-common.c | 14 ++++++++++
+ drivers/i2c/busses/i2c-designware-core.h | 1
+ drivers/i2c/busses/i2c-designware-master.c | 38 +++++++++++++++++++++++++++++
+ 3 files changed, 53 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-designware-common.c
++++ b/drivers/i2c/busses/i2c-designware-common.c
+@@ -441,6 +441,7 @@ err_release_lock:
+
+ void __i2c_dw_disable(struct dw_i2c_dev *dev)
+ {
++ struct i2c_timings *t = &dev->timings;
+ unsigned int raw_intr_stats;
+ unsigned int enable;
+ int timeout = 100;
+@@ -453,6 +454,19 @@ void __i2c_dw_disable(struct dw_i2c_dev
+
+ abort_needed = raw_intr_stats & DW_IC_INTR_MST_ON_HOLD;
+ if (abort_needed) {
++ if (!(enable & DW_IC_ENABLE_ENABLE)) {
++ regmap_write(dev->map, DW_IC_ENABLE, DW_IC_ENABLE_ENABLE);
++ /*
++ * Wait 10 times the signaling period of the highest I2C
++ * transfer supported by the driver (for 400KHz this is
++ * 25us) to ensure the I2C ENABLE bit is already set
++ * as described in the DesignWare I2C databook.
++ */
++ fsleep(DIV_ROUND_CLOSEST_ULL(10 * MICRO, t->bus_freq_hz));
++ /* Set ENABLE bit before setting ABORT */
++ enable |= DW_IC_ENABLE_ENABLE;
++ }
++
+ regmap_write(dev->map, DW_IC_ENABLE, enable | DW_IC_ENABLE_ABORT);
+ ret = regmap_read_poll_timeout(dev->map, DW_IC_ENABLE, enable,
+ !(enable & DW_IC_ENABLE_ABORT), 10,
+--- a/drivers/i2c/busses/i2c-designware-core.h
++++ b/drivers/i2c/busses/i2c-designware-core.h
+@@ -109,6 +109,7 @@
+ DW_IC_INTR_RX_UNDER | \
+ DW_IC_INTR_RD_REQ)
+
++#define DW_IC_ENABLE_ENABLE BIT(0)
+ #define DW_IC_ENABLE_ABORT BIT(1)
+
+ #define DW_IC_STATUS_ACTIVITY BIT(0)
+--- a/drivers/i2c/busses/i2c-designware-master.c
++++ b/drivers/i2c/busses/i2c-designware-master.c
+@@ -253,6 +253,34 @@ static void i2c_dw_xfer_init(struct dw_i
+ __i2c_dw_write_intr_mask(dev, DW_IC_INTR_MASTER_MASK);
+ }
+
++/*
++ * This function waits for the controller to be idle before disabling I2C
++ * When the controller is not in the IDLE state, the MST_ACTIVITY bit
++ * (IC_STATUS[5]) is set.
++ *
++ * Values:
++ * 0x1 (ACTIVE): Controller not idle
++ * 0x0 (IDLE): Controller is idle
++ *
++ * The function is called after completing the current transfer.
++ *
++ * Returns:
++ * False when the controller is in the IDLE state.
++ * True when the controller is in the ACTIVE state.
++ */
++static bool i2c_dw_is_controller_active(struct dw_i2c_dev *dev)
++{
++ u32 status;
++
++ regmap_read(dev->map, DW_IC_STATUS, &status);
++ if (!(status & DW_IC_STATUS_MASTER_ACTIVITY))
++ return false;
++
++ return regmap_read_poll_timeout(dev->map, DW_IC_STATUS, status,
++ !(status & DW_IC_STATUS_MASTER_ACTIVITY),
++ 1100, 20000) != 0;
++}
++
+ static int i2c_dw_check_stopbit(struct dw_i2c_dev *dev)
+ {
+ u32 val;
+@@ -789,6 +817,16 @@ i2c_dw_xfer(struct i2c_adapter *adap, st
+ }
+
+ /*
++ * This happens rarely (~1:500) and is hard to reproduce. Debug trace
++ * showed that IC_STATUS had value of 0x23 when STOP_DET occurred,
++ * if disable IC_ENABLE.ENABLE immediately that can result in
++ * IC_RAW_INTR_STAT.MASTER_ON_HOLD holding SCL low. Check if
++ * controller is still ACTIVE before disabling I2C.
++ */
++ if (i2c_dw_is_controller_active(dev))
++ dev_err(dev->dev, "controller active\n");
++
++ /*
+ * We must disable the adapter before returning and signaling the end
+ * of the current transfer. Otherwise the hardware might continue
+ * generating interrupts which in turn causes a race condition with
--- /dev/null
+From e2c85d85a05f16af2223fcc0195ff50a7938b372 Mon Sep 17 00:00:00 2001
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+Date: Thu, 12 Sep 2024 11:34:59 +0800
+Subject: i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+commit e2c85d85a05f16af2223fcc0195ff50a7938b372 upstream.
+
+disable_irq() after request_irq() still has a time gap in which
+interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will
+disable IRQ auto-enable when request IRQ.
+
+Fixes: 37692de5d523 ("i2c: i2c-qcom-geni: Add bus driver for the Qualcomm GENI I2C controller")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Cc: <stable@vger.kernel.org> # v4.19+
+Acked-by: Mukesh Kumar Savaliya <quic_msavaliy@quicinc.com>
+Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-qcom-geni.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-qcom-geni.c
++++ b/drivers/i2c/busses/i2c-qcom-geni.c
+@@ -818,15 +818,13 @@ static int geni_i2c_probe(struct platfor
+ init_completion(&gi2c->done);
+ spin_lock_init(&gi2c->lock);
+ platform_set_drvdata(pdev, gi2c);
+- ret = devm_request_irq(dev, gi2c->irq, geni_i2c_irq, 0,
++ ret = devm_request_irq(dev, gi2c->irq, geni_i2c_irq, IRQF_NO_AUTOEN,
+ dev_name(dev), gi2c);
+ if (ret) {
+ dev_err(dev, "Request_irq failed:%d: err:%d\n",
+ gi2c->irq, ret);
+ return ret;
+ }
+- /* Disable the interrupt so that the system can enter low-power mode */
+- disable_irq(gi2c->irq);
+ i2c_set_adapdata(&gi2c->adap, gi2c);
+ gi2c->adap.dev.parent = dev;
+ gi2c->adap.dev.of_node = dev->of_node;
--- /dev/null
+From 048bbbdbf85e5e00258dfb12f5e368f908801d7b Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@denx.de>
+Date: Mon, 30 Sep 2024 21:27:41 +0200
+Subject: i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
+
+From: Marek Vasut <marex@denx.de>
+
+commit 048bbbdbf85e5e00258dfb12f5e368f908801d7b upstream.
+
+In case there is any sort of clock controller attached to this I2C bus
+controller, for example Versaclock or even an AIC32x4 I2C codec, then
+an I2C transfer triggered from the clock controller clk_ops .prepare
+callback may trigger a deadlock on drivers/clk/clk.c prepare_lock mutex.
+
+This is because the clock controller first grabs the prepare_lock mutex
+and then performs the prepare operation, including its I2C access. The
+I2C access resumes this I2C bus controller via .runtime_resume callback,
+which calls clk_prepare_enable(), which attempts to grab the prepare_lock
+mutex again and deadlocks.
+
+Since the clock are already prepared since probe() and unprepared in
+remove(), use simple clk_enable()/clk_disable() calls to enable and
+disable the clock on runtime suspend and resume, to avoid hitting the
+prepare_lock mutex.
+
+Acked-by: Alain Volmat <alain.volmat@foss.st.com>
+Signed-off-by: Marek Vasut <marex@denx.de>
+Fixes: 4e7bca6fc07b ("i2c: i2c-stm32f7: add PM Runtime support")
+Cc: <stable@vger.kernel.org> # v5.0+
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-stm32f7.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-stm32f7.c
++++ b/drivers/i2c/busses/i2c-stm32f7.c
+@@ -2395,7 +2395,7 @@ static int __maybe_unused stm32f7_i2c_ru
+ struct stm32f7_i2c_dev *i2c_dev = dev_get_drvdata(dev);
+
+ if (!stm32f7_i2c_is_slave_registered(i2c_dev))
+- clk_disable_unprepare(i2c_dev->clk);
++ clk_disable(i2c_dev->clk);
+
+ return 0;
+ }
+@@ -2406,9 +2406,9 @@ static int __maybe_unused stm32f7_i2c_ru
+ int ret;
+
+ if (!stm32f7_i2c_is_slave_registered(i2c_dev)) {
+- ret = clk_prepare_enable(i2c_dev->clk);
++ ret = clk_enable(i2c_dev->clk);
+ if (ret) {
+- dev_err(dev, "failed to prepare_enable clock\n");
++ dev_err(dev, "failed to enable clock\n");
+ return ret;
+ }
+ }
--- /dev/null
+From f2990f8630531a99cad4dc5c44cb2a11ded42492 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Thu, 12 Sep 2024 12:46:31 +0200
+Subject: i2c: synquacer: Deal with optional PCLK correctly
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+commit f2990f8630531a99cad4dc5c44cb2a11ded42492 upstream.
+
+ACPI boot does not provide clocks and regulators, but instead, provides
+the PCLK rate directly, and enables the clock in firmware. So deal
+gracefully with this.
+
+Fixes: 55750148e559 ("i2c: synquacer: Fix an error handling path in synquacer_i2c_probe()")
+Cc: stable@vger.kernel.org # v6.10+
+Cc: Andi Shyti <andi.shyti@kernel.org>
+Cc: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-synquacer.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-synquacer.c
++++ b/drivers/i2c/busses/i2c-synquacer.c
+@@ -550,12 +550,13 @@ static int synquacer_i2c_probe(struct pl
+ device_property_read_u32(&pdev->dev, "socionext,pclk-rate",
+ &i2c->pclkrate);
+
+- pclk = devm_clk_get_enabled(&pdev->dev, "pclk");
++ pclk = devm_clk_get_optional_enabled(&pdev->dev, "pclk");
+ if (IS_ERR(pclk))
+ return dev_err_probe(&pdev->dev, PTR_ERR(pclk),
+ "failed to get and enable clock\n");
+
+- i2c->pclkrate = clk_get_rate(pclk);
++ if (pclk)
++ i2c->pclkrate = clk_get_rate(pclk);
+
+ if (i2c->pclkrate < SYNQUACER_I2C_MIN_CLK_RATE ||
+ i2c->pclkrate > SYNQUACER_I2C_MAX_CLK_RATE)
--- /dev/null
+From 0c8d604dea437b69a861479b413d629bc9b3da70 Mon Sep 17 00:00:00 2001
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+Date: Mon, 23 Sep 2024 11:42:50 +0800
+Subject: i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+commit 0c8d604dea437b69a861479b413d629bc9b3da70 upstream.
+
+It is not valid to call pm_runtime_set_suspended() for devices
+with runtime PM enabled because it returns -EAGAIN if it is enabled
+already and working. So, call pm_runtime_disable() before to fix it.
+
+Fixes: 36ecbcab84d0 ("i2c: xiic: Implement power management")
+Cc: <stable@vger.kernel.org> # v4.6+
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-xiic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -1337,8 +1337,8 @@ static int xiic_i2c_probe(struct platfor
+ return 0;
+
+ err_pm_disable:
+- pm_runtime_set_suspended(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
++ pm_runtime_set_suspended(&pdev->dev);
+
+ return ret;
+ }
--- /dev/null
+From 521da1e9225450bd323db5fa5bca942b1dc485b7 Mon Sep 17 00:00:00 2001
+From: Robert Hancock <robert.hancock@calian.com>
+Date: Tue, 21 Nov 2023 18:11:16 +0000
+Subject: i2c: xiic: Wait for TX empty to avoid missed TX NAKs
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+commit 521da1e9225450bd323db5fa5bca942b1dc485b7 upstream.
+
+Frequently an I2C write will be followed by a read, such as a register
+address write followed by a read of the register value. In this driver,
+when the TX FIFO half empty interrupt was raised and it was determined
+that there was enough space in the TX FIFO to send the following read
+command, it would do so without waiting for the TX FIFO to actually
+empty.
+
+Unfortunately it appears that in some cases this can result in a NAK
+that was raised by the target device on the write, such as due to an
+unsupported register address, being ignored and the subsequent read
+being done anyway. This can potentially put the I2C bus into an
+invalid state and/or result in invalid read data being processed.
+
+To avoid this, once a message has been fully written to the TX FIFO,
+wait for the TX FIFO empty interrupt before moving on to the next
+message, to ensure NAKs are handled properly.
+
+Fixes: e1d5b6598cdc ("i2c: Add support for Xilinx XPS IIC Bus Interface")
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Cc: <stable@vger.kernel.org> # v2.6.34+
+Reviewed-by: Manikanta Guntupalli <manikanta.guntupalli@amd.com>
+Acked-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-xiic.c | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -772,14 +772,17 @@ static irqreturn_t xiic_process(int irq,
+ goto out;
+ }
+
+- xiic_fill_tx_fifo(i2c);
+-
+- /* current message sent and there is space in the fifo */
+- if (!xiic_tx_space(i2c) && xiic_tx_fifo_space(i2c) >= 2) {
++ if (xiic_tx_space(i2c)) {
++ xiic_fill_tx_fifo(i2c);
++ } else {
++ /* current message fully written */
+ dev_dbg(i2c->adap.dev.parent,
+ "%s end of message sent, nmsgs: %d\n",
+ __func__, i2c->nmsgs);
+- if (i2c->nmsgs > 1) {
++ /* Don't move onto the next message until the TX FIFO empties,
++ * to ensure that a NAK is not missed.
++ */
++ if (i2c->nmsgs > 1 && (pend & XIIC_INTR_TX_EMPTY_MASK)) {
+ i2c->nmsgs--;
+ i2c->tx_msg++;
+ xfer_more = 1;
+@@ -790,11 +793,7 @@ static irqreturn_t xiic_process(int irq,
+ "%s Got TX IRQ but no more to do...\n",
+ __func__);
+ }
+- } else if (!xiic_tx_space(i2c) && (i2c->nmsgs == 1))
+- /* current frame is sent and is last,
+- * make sure to disable tx half
+- */
+- xiic_irq_dis(i2c, XIIC_INTR_TX_HALF_MASK);
++ }
+ }
+
+ if (pend & XIIC_INTR_BNB_MASK) {
--- /dev/null
+From a1d402abf8e3ff1d821e88993fc5331784fac0da Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <maz@kernel.org>
+Date: Wed, 2 Oct 2024 21:42:39 +0100
+Subject: KVM: arm64: Fix kvm_has_feat*() handling of negative features
+
+From: Marc Zyngier <maz@kernel.org>
+
+commit a1d402abf8e3ff1d821e88993fc5331784fac0da upstream.
+
+Oliver reports that the kvm_has_feat() helper is not behaviing as
+expected for negative feature. On investigation, the main issue
+seems to be caused by the following construct:
+
+ #define get_idreg_field(kvm, id, fld) \
+ (id##_##fld##_SIGNED ? \
+ get_idreg_field_signed(kvm, id, fld) : \
+ get_idreg_field_unsigned(kvm, id, fld))
+
+where one side of the expression evaluates as something signed,
+and the other as something unsigned. In retrospect, this is totally
+braindead, as the compiler converts this into an unsigned expression.
+When compared to something that is 0, the test is simply elided.
+
+Epic fail. Similar issue exists in the expand_field_sign() macro.
+
+The correct way to handle this is to chose between signed and unsigned
+comparisons, so that both sides of the ternary expression are of the
+same type (bool).
+
+In order to keep the code readable (sort of), we introduce new
+comparison primitives taking an operator as a parameter, and
+rewrite the kvm_has_feat*() helpers in terms of these primitives.
+
+Fixes: c62d7a23b947 ("KVM: arm64: Add feature checking helpers")
+Reported-by: Oliver Upton <oliver.upton@linux.dev>
+Tested-by: Oliver Upton <oliver.upton@linux.dev>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20241002204239.2051637-1-maz@kernel.org
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/include/asm/kvm_host.h | 25 +++++++++++++------------
+ 1 file changed, 13 insertions(+), 12 deletions(-)
+
+--- a/arch/arm64/include/asm/kvm_host.h
++++ b/arch/arm64/include/asm/kvm_host.h
+@@ -1423,11 +1423,6 @@ void kvm_set_vm_id_reg(struct kvm *kvm,
+ sign_extend64(__val, id##_##fld##_WIDTH - 1); \
+ })
+
+-#define expand_field_sign(id, fld, val) \
+- (id##_##fld##_SIGNED ? \
+- __expand_field_sign_signed(id, fld, val) : \
+- __expand_field_sign_unsigned(id, fld, val))
+-
+ #define get_idreg_field_unsigned(kvm, id, fld) \
+ ({ \
+ u64 __val = kvm_read_vm_id_reg((kvm), SYS_##id); \
+@@ -1443,20 +1438,26 @@ void kvm_set_vm_id_reg(struct kvm *kvm,
+ #define get_idreg_field_enum(kvm, id, fld) \
+ get_idreg_field_unsigned(kvm, id, fld)
+
+-#define get_idreg_field(kvm, id, fld) \
++#define kvm_cmp_feat_signed(kvm, id, fld, op, limit) \
++ (get_idreg_field_signed((kvm), id, fld) op __expand_field_sign_signed(id, fld, limit))
++
++#define kvm_cmp_feat_unsigned(kvm, id, fld, op, limit) \
++ (get_idreg_field_unsigned((kvm), id, fld) op __expand_field_sign_unsigned(id, fld, limit))
++
++#define kvm_cmp_feat(kvm, id, fld, op, limit) \
+ (id##_##fld##_SIGNED ? \
+- get_idreg_field_signed(kvm, id, fld) : \
+- get_idreg_field_unsigned(kvm, id, fld))
++ kvm_cmp_feat_signed(kvm, id, fld, op, limit) : \
++ kvm_cmp_feat_unsigned(kvm, id, fld, op, limit))
+
+ #define kvm_has_feat(kvm, id, fld, limit) \
+- (get_idreg_field((kvm), id, fld) >= expand_field_sign(id, fld, limit))
++ kvm_cmp_feat(kvm, id, fld, >=, limit)
+
+ #define kvm_has_feat_enum(kvm, id, fld, val) \
+- (get_idreg_field_unsigned((kvm), id, fld) == __expand_field_sign_unsigned(id, fld, val))
++ kvm_cmp_feat_unsigned(kvm, id, fld, ==, val)
+
+ #define kvm_has_feat_range(kvm, id, fld, min, max) \
+- (get_idreg_field((kvm), id, fld) >= expand_field_sign(id, fld, min) && \
+- get_idreg_field((kvm), id, fld) <= expand_field_sign(id, fld, max))
++ (kvm_cmp_feat(kvm, id, fld, >=, min) && \
++ kvm_cmp_feat(kvm, id, fld, <=, max))
+
+ /* Check for a given level of PAuth support */
+ #define kvm_has_pauth(k, l) \
--- /dev/null
+From bee1aed819a8cda47927436685d216906ed17f62 Mon Sep 17 00:00:00 2001
+From: Alexander Shiyan <eagle.alexander923@gmail.com>
+Date: Thu, 29 Aug 2024 08:48:49 +0300
+Subject: media: i2c: ar0521: Use cansleep version of gpiod_set_value()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexander Shiyan <eagle.alexander923@gmail.com>
+
+commit bee1aed819a8cda47927436685d216906ed17f62 upstream.
+
+If we use GPIO reset from I2C port expander, we must use *_cansleep()
+variant of GPIO functions.
+This was not done in ar0521_power_on()/ar0521_power_off() functions.
+Let's fix that.
+
+------------[ cut here ]------------
+WARNING: CPU: 0 PID: 11 at drivers/gpio/gpiolib.c:3496 gpiod_set_value+0x74/0x7c
+Modules linked in:
+CPU: 0 PID: 11 Comm: kworker/u16:0 Not tainted 6.10.0 #53
+Hardware name: Diasom DS-RK3568-SOM-EVB (DT)
+Workqueue: events_unbound deferred_probe_work_func
+pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : gpiod_set_value+0x74/0x7c
+lr : ar0521_power_on+0xcc/0x290
+sp : ffffff8001d7ab70
+x29: ffffff8001d7ab70 x28: ffffff80027dcc90 x27: ffffff8003c82000
+x26: ffffff8003ca9250 x25: ffffffc080a39c60 x24: ffffff8003ca9088
+x23: ffffff8002402720 x22: ffffff8003ca9080 x21: ffffff8003ca9088
+x20: 0000000000000000 x19: ffffff8001eb2a00 x18: ffffff80efeeac80
+x17: 756d2d6332692f30 x16: 0000000000000000 x15: 0000000000000000
+x14: ffffff8001d91d40 x13: 0000000000000016 x12: ffffffc080e98930
+x11: ffffff8001eb2880 x10: 0000000000000890 x9 : ffffff8001d7a9f0
+x8 : ffffff8001d92570 x7 : ffffff80efeeac80 x6 : 000000003fc6e780
+x5 : ffffff8001d91c80 x4 : 0000000000000002 x3 : 0000000000000000
+x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000001
+Call trace:
+ gpiod_set_value+0x74/0x7c
+ ar0521_power_on+0xcc/0x290
+...
+
+Signed-off-by: Alexander Shiyan <eagle.alexander923@gmail.com>
+Fixes: 852b50aeed15 ("media: On Semi AR0521 sensor driver")
+Cc: stable@vger.kernel.org
+Acked-by: Krzysztof Hałasa <khalasa@piap.pl>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/ar0521.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/ar0521.c
++++ b/drivers/media/i2c/ar0521.c
+@@ -844,7 +844,8 @@ static int ar0521_power_off(struct devic
+ clk_disable_unprepare(sensor->extclk);
+
+ if (sensor->reset_gpio)
+- gpiod_set_value(sensor->reset_gpio, 1); /* assert RESET signal */
++ /* assert RESET signal */
++ gpiod_set_value_cansleep(sensor->reset_gpio, 1);
+
+ for (i = ARRAY_SIZE(ar0521_supply_names) - 1; i >= 0; i--) {
+ if (sensor->supplies[i])
+@@ -878,7 +879,7 @@ static int ar0521_power_on(struct device
+
+ if (sensor->reset_gpio)
+ /* deassert RESET signal */
+- gpiod_set_value(sensor->reset_gpio, 0);
++ gpiod_set_value_cansleep(sensor->reset_gpio, 0);
+ usleep_range(4500, 5000); /* min 45000 clocks */
+
+ for (cnt = 0; cnt < ARRAY_SIZE(initial_regs); cnt++) {
--- /dev/null
+From 67dd9e861add38755a7c5d29e25dd0f6cb4116ab Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Mon, 12 Aug 2024 14:30:55 +0200
+Subject: memory: tegra186-emc: drop unused to_tegra186_emc()
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit 67dd9e861add38755a7c5d29e25dd0f6cb4116ab upstream.
+
+to_tegra186_emc() is not used, W=1 builds:
+
+ tegra186-emc.c:38:36: error: unused function 'to_tegra186_emc' [-Werror,-Wunused-function]
+
+Fixes: 9a38cb27668e ("memory: tegra: Add interconnect support for DRAM scaling in Tegra234")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20240812123055.124123-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/memory/tegra/tegra186-emc.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/memory/tegra/tegra186-emc.c
++++ b/drivers/memory/tegra/tegra186-emc.c
+@@ -35,11 +35,6 @@ struct tegra186_emc {
+ struct icc_provider provider;
+ };
+
+-static inline struct tegra186_emc *to_tegra186_emc(struct icc_provider *provider)
+-{
+- return container_of(provider, struct tegra186_emc, provider);
+-}
+-
+ /*
+ * debugfs interface
+ *
--- /dev/null
+From 6c4a5f96450415735c31ed70ff354f0ee5cbf67b Mon Sep 17 00:00:00 2001
+From: Mike Baynton <mike@mbaynton.com>
+Date: Wed, 10 Jul 2024 22:52:04 -0500
+Subject: ovl: fail if trusted xattrs are needed but caller lacks permission
+
+From: Mike Baynton <mike@mbaynton.com>
+
+commit 6c4a5f96450415735c31ed70ff354f0ee5cbf67b upstream.
+
+Some overlayfs features require permission to read/write trusted.*
+xattrs. These include redirect_dir, verity, metacopy, and data-only
+layers. This patch adds additional validations at mount time to stop
+overlays from mounting in certain cases where the resulting mount would
+not function according to the user's expectations because they lack
+permission to access trusted.* xattrs (for example, not global root.)
+
+Similar checks in ovl_make_workdir() that disable features instead of
+failing are still relevant and used in cases where the resulting mount
+can still work "reasonably well." Generally, if the feature was enabled
+through kernel config or module option, any mount that worked before
+will still work the same; this applies to redirect_dir and metacopy. The
+user must explicitly request these features in order to generate a mount
+failure. Verity and data-only layers on the other hand must be explictly
+requested and have no "reasonable" disabled or degraded alternative, so
+mounts attempting either always fail.
+
+"lower data-only dirs require metacopy support" moved down in case
+userxattr is set, which disables metacopy.
+
+Cc: stable@vger.kernel.org # v6.6+
+Signed-off-by: Mike Baynton <mike@mbaynton.com>
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/overlayfs/params.c | 38 +++++++++++++++++++++++++++++++++-----
+ 1 file changed, 33 insertions(+), 5 deletions(-)
+
+--- a/fs/overlayfs/params.c
++++ b/fs/overlayfs/params.c
+@@ -755,11 +755,6 @@ int ovl_fs_params_verify(const struct ov
+ {
+ struct ovl_opt_set set = ctx->set;
+
+- if (ctx->nr_data > 0 && !config->metacopy) {
+- pr_err("lower data-only dirs require metacopy support.\n");
+- return -EINVAL;
+- }
+-
+ /* Workdir/index are useless in non-upper mount */
+ if (!config->upperdir) {
+ if (config->workdir) {
+@@ -911,6 +906,39 @@ int ovl_fs_params_verify(const struct ov
+ config->metacopy = false;
+ }
+
++ /*
++ * Fail if we don't have trusted xattr capability and a feature was
++ * explicitly requested that requires them.
++ */
++ if (!config->userxattr && !capable(CAP_SYS_ADMIN)) {
++ if (set.redirect &&
++ config->redirect_mode != OVL_REDIRECT_NOFOLLOW) {
++ pr_err("redirect_dir requires permission to access trusted xattrs\n");
++ return -EPERM;
++ }
++ if (config->metacopy && set.metacopy) {
++ pr_err("metacopy requires permission to access trusted xattrs\n");
++ return -EPERM;
++ }
++ if (config->verity_mode) {
++ pr_err("verity requires permission to access trusted xattrs\n");
++ return -EPERM;
++ }
++ if (ctx->nr_data > 0) {
++ pr_err("lower data-only dirs require permission to access trusted xattrs\n");
++ return -EPERM;
++ }
++ /*
++ * Other xattr-dependent features should be disabled without
++ * great disturbance to the user in ovl_make_workdir().
++ */
++ }
++
++ if (ctx->nr_data > 0 && !config->metacopy) {
++ pr_err("lower data-only dirs require metacopy support.\n");
++ return -EINVAL;
++ }
++
+ return 0;
+ }
+
--- /dev/null
+From 7d59ac07ccb58f8f604f8057db63b8efcebeb3de Mon Sep 17 00:00:00 2001
+From: Zach Wade <zachwade.k@gmail.com>
+Date: Mon, 23 Sep 2024 22:45:08 +0800
+Subject: platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
+
+From: Zach Wade <zachwade.k@gmail.com>
+
+commit 7d59ac07ccb58f8f604f8057db63b8efcebeb3de upstream.
+
+Attaching SST PCI device to VM causes "BUG: KASAN: slab-out-of-bounds".
+kasan report:
+[ 19.411889] ==================================================================
+[ 19.413702] BUG: KASAN: slab-out-of-bounds in _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]
+[ 19.415634] Read of size 8 at addr ffff888829e65200 by task cpuhp/16/113
+[ 19.417368]
+[ 19.418627] CPU: 16 PID: 113 Comm: cpuhp/16 Tainted: G E 6.9.0 #10
+[ 19.420435] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.20192059.B64.2207280713 07/28/2022
+[ 19.422687] Call Trace:
+[ 19.424091] <TASK>
+[ 19.425448] dump_stack_lvl+0x5d/0x80
+[ 19.426963] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]
+[ 19.428694] print_report+0x19d/0x52e
+[ 19.430206] ? __pfx__raw_spin_lock_irqsave+0x10/0x10
+[ 19.431837] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]
+[ 19.433539] kasan_report+0xf0/0x170
+[ 19.435019] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]
+[ 19.436709] _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]
+[ 19.438379] ? __pfx_sched_clock_cpu+0x10/0x10
+[ 19.439910] isst_if_cpu_online+0x406/0x58f [isst_if_common]
+[ 19.441573] ? __pfx_isst_if_cpu_online+0x10/0x10 [isst_if_common]
+[ 19.443263] ? ttwu_queue_wakelist+0x2c1/0x360
+[ 19.444797] cpuhp_invoke_callback+0x221/0xec0
+[ 19.446337] cpuhp_thread_fun+0x21b/0x610
+[ 19.447814] ? __pfx_cpuhp_thread_fun+0x10/0x10
+[ 19.449354] smpboot_thread_fn+0x2e7/0x6e0
+[ 19.450859] ? __pfx_smpboot_thread_fn+0x10/0x10
+[ 19.452405] kthread+0x29c/0x350
+[ 19.453817] ? __pfx_kthread+0x10/0x10
+[ 19.455253] ret_from_fork+0x31/0x70
+[ 19.456685] ? __pfx_kthread+0x10/0x10
+[ 19.458114] ret_from_fork_asm+0x1a/0x30
+[ 19.459573] </TASK>
+[ 19.460853]
+[ 19.462055] Allocated by task 1198:
+[ 19.463410] kasan_save_stack+0x30/0x50
+[ 19.464788] kasan_save_track+0x14/0x30
+[ 19.466139] __kasan_kmalloc+0xaa/0xb0
+[ 19.467465] __kmalloc+0x1cd/0x470
+[ 19.468748] isst_if_cdev_register+0x1da/0x350 [isst_if_common]
+[ 19.470233] isst_if_mbox_init+0x108/0xff0 [isst_if_mbox_msr]
+[ 19.471670] do_one_initcall+0xa4/0x380
+[ 19.472903] do_init_module+0x238/0x760
+[ 19.474105] load_module+0x5239/0x6f00
+[ 19.475285] init_module_from_file+0xd1/0x130
+[ 19.476506] idempotent_init_module+0x23b/0x650
+[ 19.477725] __x64_sys_finit_module+0xbe/0x130
+[ 19.476506] idempotent_init_module+0x23b/0x650
+[ 19.477725] __x64_sys_finit_module+0xbe/0x130
+[ 19.478920] do_syscall_64+0x82/0x160
+[ 19.480036] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[ 19.481292]
+[ 19.482205] The buggy address belongs to the object at ffff888829e65000
+ which belongs to the cache kmalloc-512 of size 512
+[ 19.484818] The buggy address is located 0 bytes to the right of
+ allocated 512-byte region [ffff888829e65000, ffff888829e65200)
+[ 19.487447]
+[ 19.488328] The buggy address belongs to the physical page:
+[ 19.489569] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888829e60c00 pfn:0x829e60
+[ 19.491140] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
+[ 19.492466] anon flags: 0x57ffffc0000840(slab|head|node=1|zone=2|lastcpupid=0x1fffff)
+[ 19.493914] page_type: 0xffffffff()
+[ 19.494988] raw: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001
+[ 19.496451] raw: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000
+[ 19.497906] head: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001
+[ 19.499379] head: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000
+[ 19.500844] head: 0057ffffc0000003 ffffea0020a79801 ffffea0020a79848 00000000ffffffff
+[ 19.502316] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000
+[ 19.503784] page dumped because: kasan: bad access detected
+[ 19.505058]
+[ 19.505970] Memory state around the buggy address:
+[ 19.507172] ffff888829e65100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 19.508599] ffff888829e65180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 19.510013] >ffff888829e65200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[ 19.510014] ^
+[ 19.510016] ffff888829e65280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[ 19.510018] ffff888829e65300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[ 19.515367] ==================================================================
+
+The reason for this error is physical_package_ids assigned by VMware VMM
+are not continuous and have gaps. This will cause value returned by
+topology_physical_package_id() to be more than topology_max_packages().
+
+Here the allocation uses topology_max_packages(). The call to
+topology_max_packages() returns maximum logical package ID not physical
+ID. Hence use topology_logical_package_id() instead of
+topology_physical_package_id().
+
+Fixes: 9a1aac8a96dc ("platform/x86: ISST: PUNIT device mapping with Sub-NUMA clustering")
+Cc: stable@vger.kernel.org
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Zach Wade <zachwade.k@gmail.com>
+Link: https://lore.kernel.org/r/20240923144508.1764-1-zachwade.k@gmail.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/intel/speed_select_if/isst_if_common.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/platform/x86/intel/speed_select_if/isst_if_common.c
++++ b/drivers/platform/x86/intel/speed_select_if/isst_if_common.c
+@@ -316,7 +316,9 @@ static struct pci_dev *_isst_if_get_pci_
+ cpu >= nr_cpu_ids || cpu >= num_possible_cpus())
+ return NULL;
+
+- pkg_id = topology_physical_package_id(cpu);
++ pkg_id = topology_logical_package_id(cpu);
++ if (pkg_id >= topology_max_packages())
++ return NULL;
+
+ bus_number = isst_cpu_info[cpu].bus_info[bus_no];
+ if (bus_number < 0)
--- /dev/null
+From 2fae3129c0c08e72b1fe93e61fd8fd203252094a Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sat, 5 Oct 2024 15:05:45 +0200
+Subject: platform/x86: x86-android-tablets: Fix use after free on platform_device_register() errors
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 2fae3129c0c08e72b1fe93e61fd8fd203252094a upstream.
+
+x86_android_tablet_remove() frees the pdevs[] array, so it should not
+be used after calling x86_android_tablet_remove().
+
+When platform_device_register() fails, store the pdevs[x] PTR_ERR() value
+into the local ret variable before calling x86_android_tablet_remove()
+to avoid using pdevs[] after it has been freed.
+
+Fixes: 5eba0141206e ("platform/x86: x86-android-tablets: Add support for instantiating platform-devs")
+Fixes: e2200d3f26da ("platform/x86: x86-android-tablets: Add gpio_keys support to x86_android_tablet_init()")
+Cc: stable@vger.kernel.org
+Reported-by: Aleksandr Burakov <a.burakov@rosalinux.ru>
+Closes: https://lore.kernel.org/platform-driver-x86/20240917120458.7300-1-a.burakov@rosalinux.ru/
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20241005130545.64136-1-hdegoede@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/x86-android-tablets/core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/platform/x86/x86-android-tablets/core.c
++++ b/drivers/platform/x86/x86-android-tablets/core.c
+@@ -390,8 +390,9 @@ static __init int x86_android_tablet_pro
+ for (i = 0; i < pdev_count; i++) {
+ pdevs[i] = platform_device_register_full(&dev_info->pdev_info[i]);
+ if (IS_ERR(pdevs[i])) {
++ ret = PTR_ERR(pdevs[i]);
+ x86_android_tablet_remove(pdev);
+- return PTR_ERR(pdevs[i]);
++ return ret;
+ }
+ }
+
+@@ -443,8 +444,9 @@ static __init int x86_android_tablet_pro
+ PLATFORM_DEVID_AUTO,
+ &pdata, sizeof(pdata));
+ if (IS_ERR(pdevs[pdev_count])) {
++ ret = PTR_ERR(pdevs[pdev_count]);
+ x86_android_tablet_remove(pdev);
+- return PTR_ERR(pdevs[pdev_count]);
++ return ret;
+ }
+ pdev_count++;
+ }
--- /dev/null
+From e50a57d16f897e45de1112eb6478577b197fab52 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sun, 8 Sep 2024 20:53:37 +0200
+Subject: power: supply: hwmon: Fix missing temp1_max_alarm attribute
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit e50a57d16f897e45de1112eb6478577b197fab52 upstream.
+
+Temp channel 0 aka temp1 can have a temp1_max_alarm attribute for
+power_supply devices which have a POWER_SUPPLY_PROP_TEMP_ALERT_MAX
+property.
+
+HWMON_T_MAX_ALARM was missing from power_supply_hwmon_info for
+temp channel 0, causing the hwmon temp1_max_alarm attribute to be
+missing from such power_supply devices.
+
+Add this to power_supply_hwmon_info to fix this.
+
+Fixes: f1d33ae806ec ("power: supply: remove duplicated argument in power_supply_hwmon_info")
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20240908185337.103696-2-hdegoede@redhat.com
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/power/supply/power_supply_hwmon.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/power/supply/power_supply_hwmon.c
++++ b/drivers/power/supply/power_supply_hwmon.c
+@@ -318,7 +318,8 @@ static const struct hwmon_channel_info *
+ HWMON_T_INPUT |
+ HWMON_T_MAX |
+ HWMON_T_MIN |
+- HWMON_T_MIN_ALARM,
++ HWMON_T_MIN_ALARM |
++ HWMON_T_MAX_ALARM,
+
+ HWMON_T_LABEL |
+ HWMON_T_INPUT |
--- /dev/null
+From 3f7f36a4559ef78a6418c5f0447fbfbdcf671956 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 2 Oct 2024 17:59:39 +0200
+Subject: Revert "ALSA: hda: Conditionally use snooping for AMD HDMI"
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 3f7f36a4559ef78a6418c5f0447fbfbdcf671956 upstream.
+
+This reverts commit 478689b5990deb626a0b3f1ebf165979914d6be4.
+
+The fix seems leading to regressions for other systems.
+Also, the way to check the presence of IOMMU via get_dma_ops() isn't
+reliable and it's no longer applicable for 6.12. After all, it's no
+right fix, so let's revert it at first.
+
+To be noted, the PCM buffer allocation has been changed to try the
+continuous pages at first since 6.12, so the problem could be already
+addressed without this hackish workaround.
+
+Reported-by: Salvatore Bonaccorso <carnil@debian.org>
+Closes: https://lore.kernel.org/ZvgCdYfKgwHpJXGE@eldamar.lan
+Link: https://patch.msgid.link/20241002155948.4859-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/hda_controller.h | 2 +-
+ sound/pci/hda/hda_intel.c | 10 +---------
+ 2 files changed, 2 insertions(+), 10 deletions(-)
+
+--- a/sound/pci/hda/hda_controller.h
++++ b/sound/pci/hda/hda_controller.h
+@@ -28,7 +28,7 @@
+ #else
+ #define AZX_DCAPS_I915_COMPONENT 0 /* NOP */
+ #endif
+-#define AZX_DCAPS_AMD_ALLOC_FIX (1 << 14) /* AMD allocation workaround */
++/* 14 unused */
+ #define AZX_DCAPS_CTX_WORKAROUND (1 << 15) /* X-Fi workaround */
+ #define AZX_DCAPS_POSFIX_LPIB (1 << 16) /* Use LPIB as default */
+ #define AZX_DCAPS_AMD_WORKAROUND (1 << 17) /* AMD-specific workaround */
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -40,7 +40,6 @@
+
+ #ifdef CONFIG_X86
+ /* for snoop control */
+-#include <linux/dma-map-ops.h>
+ #include <asm/set_memory.h>
+ #include <asm/cpufeature.h>
+ #endif
+@@ -307,7 +306,7 @@ enum {
+
+ /* quirks for ATI HDMI with snoop off */
+ #define AZX_DCAPS_PRESET_ATI_HDMI_NS \
+- (AZX_DCAPS_PRESET_ATI_HDMI | AZX_DCAPS_AMD_ALLOC_FIX)
++ (AZX_DCAPS_PRESET_ATI_HDMI | AZX_DCAPS_SNOOP_OFF)
+
+ /* quirks for AMD SB */
+ #define AZX_DCAPS_PRESET_AMD_SB \
+@@ -1703,13 +1702,6 @@ static void azx_check_snoop_available(st
+ if (chip->driver_caps & AZX_DCAPS_SNOOP_OFF)
+ snoop = false;
+
+-#ifdef CONFIG_X86
+- /* check the presence of DMA ops (i.e. IOMMU), disable snoop conditionally */
+- if ((chip->driver_caps & AZX_DCAPS_AMD_ALLOC_FIX) &&
+- !get_dma_ops(chip->card->dev))
+- snoop = false;
+-#endif
+-
+ chip->snoop = snoop;
+ if (!snoop) {
+ dev_info(chip->card->dev, "Force to non-snoop mode\n");
--- /dev/null
+From a8ee30f45d5d57467ddb7877ed6914d0eba0af7f Mon Sep 17 00:00:00 2001
+From: Alice Ryhl <aliceryhl@google.com>
+Date: Sun, 15 Sep 2024 14:41:28 +0000
+Subject: rust: sync: require `T: Sync` for `LockedBy::access`
+
+From: Alice Ryhl <aliceryhl@google.com>
+
+commit a8ee30f45d5d57467ddb7877ed6914d0eba0af7f upstream.
+
+The `LockedBy::access` method only requires a shared reference to the
+owner, so if we have shared access to the `LockedBy` from several
+threads at once, then two threads could call `access` in parallel and
+both obtain a shared reference to the inner value. Thus, require that
+`T: Sync` when calling the `access` method.
+
+An alternative is to require `T: Sync` in the `impl Sync for LockedBy`.
+This patch does not choose that approach as it gives up the ability to
+use `LockedBy` with `!Sync` types, which is okay as long as you only use
+`access_mut`.
+
+Cc: stable@vger.kernel.org
+Fixes: 7b1f55e3a984 ("rust: sync: introduce `LockedBy`")
+Signed-off-by: Alice Ryhl <aliceryhl@google.com>
+Suggested-by: Boqun Feng <boqun.feng@gmail.com>
+Reviewed-by: Gary Guo <gary@garyguo.net>
+Link: https://lore.kernel.org/r/20240915-locked-by-sync-fix-v2-1-1a8d89710392@google.com
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ rust/kernel/sync/locked_by.rs | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+--- a/rust/kernel/sync/locked_by.rs
++++ b/rust/kernel/sync/locked_by.rs
+@@ -83,8 +83,12 @@ pub struct LockedBy<T: ?Sized, U: ?Sized
+ // SAFETY: `LockedBy` can be transferred across thread boundaries iff the data it protects can.
+ unsafe impl<T: ?Sized + Send, U: ?Sized> Send for LockedBy<T, U> {}
+
+-// SAFETY: `LockedBy` serialises the interior mutability it provides, so it is `Sync` as long as the
+-// data it protects is `Send`.
++// SAFETY: If `T` is not `Sync`, then parallel shared access to this `LockedBy` allows you to use
++// `access_mut` to hand out `&mut T` on one thread at the time. The requirement that `T: Send` is
++// sufficient to allow that.
++//
++// If `T` is `Sync`, then the `access` method also becomes available, which allows you to obtain
++// several `&T` from several threads at once. However, this is okay as `T` is `Sync`.
+ unsafe impl<T: ?Sized + Send, U: ?Sized> Sync for LockedBy<T, U> {}
+
+ impl<T, U> LockedBy<T, U> {
+@@ -118,7 +122,10 @@ impl<T: ?Sized, U> LockedBy<T, U> {
+ ///
+ /// Panics if `owner` is different from the data protected by the lock used in
+ /// [`new`](LockedBy::new).
+- pub fn access<'a>(&'a self, owner: &'a U) -> &'a T {
++ pub fn access<'a>(&'a self, owner: &'a U) -> &'a T
++ where
++ T: Sync,
++ {
+ build_assert!(
+ size_of::<U>() > 0,
+ "`U` cannot be a ZST because `owner` wouldn't be unique"
+@@ -127,7 +134,10 @@ impl<T: ?Sized, U> LockedBy<T, U> {
+ panic!("mismatched owners");
+ }
+
+- // SAFETY: `owner` is evidence that the owner is locked.
++ // SAFETY: `owner` is evidence that there are only shared references to the owner for the
++ // duration of 'a, so it's not possible to use `Self::access_mut` to obtain a mutable
++ // reference to the inner value that aliases with this shared reference. The type is `Sync`
++ // so there are no other requirements.
+ unsafe { &*self.data.get() }
+ }
+
f2fs-increase-bg-gc-migration-window-granularity-whe.patch
f2fs-do-fg_gc-when-gc-boosting-is-required-for-zoned.patch
f2fs-forcibly-migrate-to-secure-space-for-zoned-devi.patch
+revert-alsa-hda-conditionally-use-snooping-for-amd-hdmi.patch
+platform-x86-x86-android-tablets-fix-use-after-free-on-platform_device_register-errors.patch
+platform-x86-isst-fix-the-kasan-report-slab-out-of-bounds-bug.patch
+kvm-arm64-fix-kvm_has_feat-handling-of-negative-features.patch
+i2c-stm32f7-do-not-prepare-unprepare-clock-during-runtime-suspend-resume.patch
+i2c-qcom-geni-use-irqf_no_autoen-flag-in-request_irq.patch
+i2c-xiic-wait-for-tx-empty-to-avoid-missed-tx-naks.patch
+media-i2c-ar0521-use-cansleep-version-of-gpiod_set_value.patch
+i2c-core-lock-address-during-client-device-instantiation.patch
+i2c-xiic-fix-pm_runtime_set_suspended-with-runtime-pm-enabled.patch
+i2c-designware-fix-controller-is-holding-scl-low-while-enable-bit-is-disabled.patch
+i2c-synquacer-deal-with-optional-pclk-correctly.patch
+rust-sync-require-t-sync-for-lockedby-access.patch
+ovl-fail-if-trusted-xattrs-are-needed-but-caller-lacks-permission.patch
+firmware-tegra-bpmp-drop-unused-mbox_client_to_bpmp.patch
+memory-tegra186-emc-drop-unused-to_tegra186_emc.patch
+dt-bindings-clock-exynos7885-fix-duplicated-binding.patch
+spi-bcm63xx-fix-module-autoloading.patch
+spi-bcm63xx-fix-missing-pm_runtime_disable.patch
+power-supply-hwmon-fix-missing-temp1_max_alarm-attribute.patch
--- /dev/null
+From 265697288ec2160ca84707565d6641d46f69b0ff Mon Sep 17 00:00:00 2001
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+Date: Mon, 19 Aug 2024 20:33:49 +0800
+Subject: spi: bcm63xx: Fix missing pm_runtime_disable()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+commit 265697288ec2160ca84707565d6641d46f69b0ff upstream.
+
+The pm_runtime_disable() is missing in the remove function, fix it
+by using devm_pm_runtime_enable(), so the pm_runtime_disable() in
+the probe error path can also be removed.
+
+Fixes: 2d13f2ff6073 ("spi: bcm63xx-spi: fix pm_runtime")
+Cc: stable@vger.kernel.org # v5.13+
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Suggested-by: Jonas Gorski <jonas.gorski@gmail.com>
+Link: https://patch.msgid.link/20240819123349.4020472-3-ruanjinjie@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-bcm63xx.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/spi/spi-bcm63xx.c
++++ b/drivers/spi/spi-bcm63xx.c
+@@ -584,13 +584,15 @@ static int bcm63xx_spi_probe(struct plat
+
+ bcm_spi_writeb(bs, SPI_INTR_CLEAR_ALL, SPI_INT_STATUS);
+
+- pm_runtime_enable(&pdev->dev);
++ ret = devm_pm_runtime_enable(&pdev->dev);
++ if (ret)
++ goto out_clk_disable;
+
+ /* register and we are done */
+ ret = devm_spi_register_controller(dev, host);
+ if (ret) {
+ dev_err(dev, "spi register failed\n");
+- goto out_pm_disable;
++ goto out_clk_disable;
+ }
+
+ dev_info(dev, "at %pr (irq %d, FIFOs size %d)\n",
+@@ -598,8 +600,6 @@ static int bcm63xx_spi_probe(struct plat
+
+ return 0;
+
+-out_pm_disable:
+- pm_runtime_disable(&pdev->dev);
+ out_clk_disable:
+ clk_disable_unprepare(clk);
+ out_err:
--- /dev/null
+From 909f34f2462a99bf876f64c5c61c653213e32fce Mon Sep 17 00:00:00 2001
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+Date: Mon, 19 Aug 2024 20:33:48 +0800
+Subject: spi: bcm63xx: Fix module autoloading
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+commit 909f34f2462a99bf876f64c5c61c653213e32fce upstream.
+
+Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded
+based on the alias from platform_device_id table.
+
+Fixes: 44d8fb30941d ("spi/bcm63xx: move register definitions into the driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Reviewed-by: Jonas Gorski <jonas.gorski@gmail.com>
+Link: https://patch.msgid.link/20240819123349.4020472-2-ruanjinjie@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-bcm63xx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/spi/spi-bcm63xx.c
++++ b/drivers/spi/spi-bcm63xx.c
+@@ -466,6 +466,7 @@ static const struct platform_device_id b
+ {
+ },
+ };
++MODULE_DEVICE_TABLE(platform, bcm63xx_spi_dev_match);
+
+ static const struct of_device_id bcm63xx_spi_of_match[] = {
+ { .compatible = "brcm,bcm6348-spi", .data = &bcm6348_spi_reg_offsets },
projects / thirdparty / kernel / stable-queue.git / commitdiff
