--- /dev/null
+From 67d15c7aa0864dfd82325c7e7e7d8548b5224c7b Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@linaro.org>
+Date: Fri, 7 Mar 2025 11:41:48 +0300
+Subject: accel/qaic: Fix integer overflow in qaic_validate_req()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+commit 67d15c7aa0864dfd82325c7e7e7d8548b5224c7b upstream.
+
+These are u64 variables that come from the user via
+qaic_attach_slice_bo_ioctl(). Use check_add_overflow() to ensure that
+the math doesn't have an integer wrapping bug.
+
+Cc: stable@vger.kernel.org
+Fixes: ff13be830333 ("accel/qaic: Add datapath")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/176388fa-40fe-4cb4-9aeb-2c91c22130bd@stanley.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/accel/qaic/qaic_data.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/accel/qaic/qaic_data.c
++++ b/drivers/accel/qaic/qaic_data.c
+@@ -557,6 +557,7 @@ static bool invalid_sem(struct qaic_sem
+ static int qaic_validate_req(struct qaic_device *qdev, struct qaic_attach_slice_entry *slice_ent,
+ u32 count, u64 total_size)
+ {
++ u64 total;
+ int i;
+
+ for (i = 0; i < count; i++) {
+@@ -566,7 +567,8 @@ static int qaic_validate_req(struct qaic
+ invalid_sem(&slice_ent[i].sem2) || invalid_sem(&slice_ent[i].sem3))
+ return -EINVAL;
+
+- if (slice_ent[i].offset + slice_ent[i].size > total_size)
++ if (check_add_overflow(slice_ent[i].offset, slice_ent[i].size, &total) ||
++ total > total_size)
+ return -EINVAL;
+ }
+
--- /dev/null
+From 83964a29379cb08929a39172780a4c2992bc7c93 Mon Sep 17 00:00:00 2001
+From: Stefan Eichenberger <stefan.eichenberger@toradex.com>
+Date: Fri, 10 Jan 2025 16:18:29 +0100
+Subject: ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6
+
+From: Stefan Eichenberger <stefan.eichenberger@toradex.com>
+
+commit 83964a29379cb08929a39172780a4c2992bc7c93 upstream.
+
+The current solution for powering off the Apalis iMX6 is not functioning
+as intended. To resolve this, it is necessary to power off the
+vgen2_reg, which will also set the POWER_ENABLE_MOCI signal to a low
+state. This ensures the carrier board is properly informed to initiate
+its power-off sequence.
+
+The new solution uses the regulator-poweroff driver, which will power
+off the regulator during a system shutdown.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 4eb56e26f92e ("ARM: dts: imx6q-apalis: Command pmic to standby for poweroff")
+Signed-off-by: Stefan Eichenberger <stefan.eichenberger@toradex.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi
++++ b/arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi
+@@ -108,6 +108,11 @@
+ };
+ };
+
++ poweroff {
++ compatible = "regulator-poweroff";
++ cpu-supply = <&vgen2_reg>;
++ };
++
+ reg_module_3v3: regulator-module-3v3 {
+ compatible = "regulator-fixed";
+ regulator-always-on;
+@@ -236,10 +241,6 @@
+ status = "disabled";
+ };
+
+-&clks {
+- fsl,pmic-stby-poweroff;
+-};
+-
+ /* Apalis SPI1 */
+ &ecspi1 {
+ cs-gpios = <&gpio5 25 GPIO_ACTIVE_LOW>;
+@@ -527,7 +528,6 @@
+
+ pmic: pmic@8 {
+ compatible = "fsl,pfuze100";
+- fsl,pmic-stby-poweroff;
+ reg = <0x08>;
+
+ regulators {
--- /dev/null
+From 379c590113ce46f605439d4887996c60ab8820cc Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Mon, 10 Mar 2025 14:12:20 +0100
+Subject: ARM: shmobile: smp: Enforce shmobile_smp_* alignment
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit 379c590113ce46f605439d4887996c60ab8820cc upstream.
+
+When the addresses of the shmobile_smp_mpidr, shmobile_smp_fn, and
+shmobile_smp_arg variables are not multiples of 4 bytes, secondary CPU
+bring-up fails:
+
+ smp: Bringing up secondary CPUs ...
+ CPU1: failed to come online
+ CPU2: failed to come online
+ CPU3: failed to come online
+ smp: Brought up 1 node, 1 CPU
+
+Fix this by adding the missing alignment directive.
+
+Fixes: 4e960f52fce16a3b ("ARM: shmobile: Move shmobile_smp_{mpidr, fn, arg}[] from .text to .bss")
+Closes: https://lore.kernel.org/r/CAMuHMdU=QR-JLgEHKWpsr6SbaZRc-Hz9r91JfpP8c3n2G-OjqA@mail.gmail.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Link: https://lore.kernel.org/c499234d559a0d95ad9472883e46077311051cd8.1741612208.git.geert+renesas@glider.be
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-shmobile/headsmp.S | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/mach-shmobile/headsmp.S
++++ b/arch/arm/mach-shmobile/headsmp.S
+@@ -136,6 +136,7 @@ ENDPROC(shmobile_smp_sleep)
+ .long shmobile_smp_arg - 1b
+
+ .bss
++ .align 2
+ .globl shmobile_smp_mpidr
+ shmobile_smp_mpidr:
+ .space NR_CPUS * 4
--- /dev/null
+From 2c1092823eb03f8508d6769e2f38eef7e1fe62a0 Mon Sep 17 00:00:00 2001
+From: Stefan Eichenberger <stefan.eichenberger@toradex.com>
+Date: Mon, 17 Feb 2025 15:56:41 +0100
+Subject: arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card
+
+From: Stefan Eichenberger <stefan.eichenberger@toradex.com>
+
+commit 2c1092823eb03f8508d6769e2f38eef7e1fe62a0 upstream.
+
+The simple-audio-card's microphone widget currently connects to the
+headphone jack. Routing the microphone input to the microphone jack
+allows for independent operation of the microphone and headphones.
+
+This resolves the following boot-time kernel log message, which
+indicated a conflict when the microphone and headphone functions were
+not separated:
+ debugfs: File 'Headphone Jack' in directory 'dapm' already present!
+
+Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini")
+Signed-off-by: Stefan Eichenberger <stefan.eichenberger@toradex.com>
+Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm-verdin-dahlia.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/arm64/boot/dts/freescale/imx8mm-verdin-dahlia.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm-verdin-dahlia.dtsi
+@@ -16,10 +16,10 @@
+ "Headphone Jack", "HPOUTR",
+ "IN2L", "Line In Jack",
+ "IN2R", "Line In Jack",
+- "Headphone Jack", "MICBIAS",
+- "IN1L", "Headphone Jack";
++ "Microphone Jack", "MICBIAS",
++ "IN1L", "Microphone Jack";
+ simple-audio-card,widgets =
+- "Microphone", "Headphone Jack",
++ "Microphone", "Microphone Jack",
+ "Headphone", "Headphone Jack",
+ "Line", "Line In Jack";
+
--- /dev/null
+From b0612fdba9afdce261bfb8684e0cece6f2e2b0bb Mon Sep 17 00:00:00 2001
+From: Stefan Eichenberger <stefan.eichenberger@toradex.com>
+Date: Mon, 17 Feb 2025 15:56:40 +0100
+Subject: arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card
+
+From: Stefan Eichenberger <stefan.eichenberger@toradex.com>
+
+commit b0612fdba9afdce261bfb8684e0cece6f2e2b0bb upstream.
+
+The simple-audio-card's microphone widget currently connects to the
+headphone jack. Routing the microphone input to the microphone jack
+allows for independent operation of the microphone and headphones.
+
+This resolves the following boot-time kernel log message, which
+indicated a conflict when the microphone and headphone functions were
+not separated:
+ debugfs: File 'Headphone Jack' in directory 'dapm' already present!
+
+Fixes: 874958916844 ("arm64: dts: freescale: verdin-imx8mp: dahlia: add sound card")
+Signed-off-by: Stefan Eichenberger <stefan.eichenberger@toradex.com>
+Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mp-verdin-dahlia.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/arm64/boot/dts/freescale/imx8mp-verdin-dahlia.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mp-verdin-dahlia.dtsi
+@@ -28,10 +28,10 @@
+ "Headphone Jack", "HPOUTR",
+ "IN2L", "Line In Jack",
+ "IN2R", "Line In Jack",
+- "Headphone Jack", "MICBIAS",
+- "IN1L", "Headphone Jack";
++ "Microphone Jack", "MICBIAS",
++ "IN1L", "Microphone Jack";
+ simple-audio-card,widgets =
+- "Microphone", "Headphone Jack",
++ "Microphone", "Microphone Jack",
+ "Headphone", "Headphone Jack",
+ "Line", "Line In Jack";
+
--- /dev/null
+From ffcef3df680c437ca33ff434be18ec24d72907c2 Mon Sep 17 00:00:00 2001
+From: Dragan Simic <dsimic@manjaro.org>
+Date: Sun, 2 Mar 2025 19:48:04 +0100
+Subject: arm64: dts: rockchip: Add missing PCIe supplies to RockPro64 board dtsi
+
+From: Dragan Simic <dsimic@manjaro.org>
+
+commit ffcef3df680c437ca33ff434be18ec24d72907c2 upstream.
+
+Add missing "vpcie0v9-supply" and "vpcie1v8-supply" properties to the "pcie0"
+node in the Pine64 RockPro64 board dtsi file. This eliminates the following
+warnings from the kernel log:
+
+ rockchip-pcie f8000000.pcie: supply vpcie1v8 not found, using dummy regulator
+ rockchip-pcie f8000000.pcie: supply vpcie0v9 not found, using dummy regulator
+
+These additions improve the accuracy of hardware description of the RockPro64
+and, in theory, they should result in no functional changes to the way board
+works after the changes, because the "vcca_0v9" and "vcca_1v8" regulators are
+always enabled. [1][2] However, extended reliability testing, performed by
+Chris, [3] has proven that the age-old issues with some PCI Express cards,
+when used with a Pine64 RockPro64, are also resolved.
+
+Those issues were already mentioned in the commit 43853e843aa6 (arm64: dts:
+rockchip: Remove unsupported node from the Pinebook Pro dts, 2024-04-01),
+together with a brief description of the out-of-tree enumeration delay patch
+that reportedly resolves those issues. In a nutshell, booting a RockPro64
+with some PCI Express cards attached to it caused a kernel oops. [4]
+
+Symptomatically enough, to the commit author's best knowledge, only the Pine64
+RockPro64, out of all RK3399-based boards and devices supported upstream, has
+been reported to suffer from those PCI Express issues, and only the RockPro64
+had some of the PCI Express supplies missing in its DT. Thus, perhaps some
+weird timing issues exist that caused the "vcca_1v8" always-on regulator,
+which is part of the RK808 PMIC, to actually not be enabled before the PCI
+Express is initialized and enumerated on the RockPro64, causing oopses with
+some PCIe cards, and the aforementioned enumeration delay patch [4] probably
+acted as just a workaround for the underlying timing issue.
+
+Admittedly, the Pine64 RockPro64 is a bit specific board by having a standard
+PCI Express slot, allowing use of various standard cards, but pretty much
+standard PCI Express cards have been attached to other RK3399 boards as well,
+and the commit author is unaware ot such issues reported for them.
+
+It's quite hard to be sure that the PCI Express issues are fully resolved by
+these additions to the DT, without some really extensive and time-consuming
+testing. However, these additions to the DT can result in good things and
+improvements anyway, making them perfectly safe from the standpoint of being
+unable to do any harm or cause some unforeseen regressions.
+
+These changes apply to the both supported hardware revisions of the Pine64
+RockPro64, i.e. to the production-run revisions 2.0 and 2.1. [1][2]
+
+[1] https://files.pine64.org/doc/rockpro64/rockpro64_v21-SCH.pdf
+[2] https://files.pine64.org/doc/rockpro64/rockpro64_v20-SCH.pdf
+[3] https://z9.de/hedgedoc/s/nF4d5G7rg#reboot-tests-for-PCIe-improvements
+[4] https://lore.kernel.org/lkml/20230509153912.515218-1-vincenzopalazzodev@gmail.com/T/#u
+
+Fixes: bba821f5479e ("arm64: dts: rockchip: add PCIe nodes on rk3399-rockpro64")
+Cc: stable@vger.kernel.org
+Cc: Vincenzo Palazzo <vincenzopalazzodev@gmail.com>
+Cc: Peter Geis <pgwipeout@gmail.com>
+Cc: Bjorn Helgaas <helgaas@kernel.org>
+Reported-by: Diederik de Haas <didi.debian@cknow.org>
+Tested-by: Chris Vogel <chris@z9.de>
+Signed-off-by: Dragan Simic <dsimic@manjaro.org>
+Tested-by: Diederik de Haas <didi.debian@cknow.org>
+Link: https://lore.kernel.org/r/b39cfd7490d8194f053bf3971f13a43472d1769e.1740941097.git.dsimic@manjaro.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dtsi
+@@ -661,6 +661,8 @@
+ num-lanes = <4>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pcie_perst>;
++ vpcie0v9-supply = <&vcca_0v9>;
++ vpcie1v8-supply = <&vcca_1v8>;
+ vpcie12v-supply = <&vcc12v_dcin>;
+ vpcie3v3-supply = <&vcc3v3_pcie>;
+ status = "okay";
--- /dev/null
+From 2db7d29c7b1629ced3cbab3de242511eb3c22066 Mon Sep 17 00:00:00 2001
+From: Quentin Schulz <quentin.schulz@cherry.de>
+Date: Tue, 25 Feb 2025 12:53:29 +0100
+Subject: arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Quentin Schulz <quentin.schulz@cherry.de>
+
+commit 2db7d29c7b1629ced3cbab3de242511eb3c22066 upstream.
+
+UART0 pinmux by default configures GPIO0_B5 in its UART RTS function for
+UART0. However, by default on Haikou, it is used as GPIO as UART RTS for
+UART5.
+
+Therefore, let's update UART0 pinmux to not configure the pin in that
+mode, a later commit will make UART5 request the GPIO pinmux.
+
+Fixes: c484cf93f61b ("arm64: dts: rockchip: add PX30-µQ7 (Ringneck) SoM with Haikou baseboard")
+Cc: stable@vger.kernel.org
+Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
+Link: https://lore.kernel.org/r/20250225-ringneck-dtbos-v3-1-853a9a6dd597@cherry.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/rockchip/px30-ringneck-haikou.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm64/boot/dts/rockchip/px30-ringneck-haikou.dts
++++ b/arch/arm64/boot/dts/rockchip/px30-ringneck-haikou.dts
+@@ -222,6 +222,8 @@
+ };
+
+ &uart0 {
++ pinctrl-names = "default";
++ pinctrl-0 = <&uart0_xfer>;
+ status = "okay";
+ };
+
--- /dev/null
+From 55de171bba1b8c0e3dd18b800955ac4b46a63d4b Mon Sep 17 00:00:00 2001
+From: Quentin Schulz <quentin.schulz@cherry.de>
+Date: Tue, 25 Feb 2025 12:53:30 +0100
+Subject: arm64: dts: rockchip: fix pinmux of UART5 for PX30 Ringneck on Haikou
+
+From: Quentin Schulz <quentin.schulz@cherry.de>
+
+commit 55de171bba1b8c0e3dd18b800955ac4b46a63d4b upstream.
+
+UART5 uses GPIO0_B5 as UART RTS but muxed in its GPIO function,
+therefore UART5 must request this pin to be muxed in that function, so
+let's do that.
+
+Fixes: 5963d97aa780 ("arm64: dts: rockchip: add rs485 support on uart5 of px30-ringneck-haikou")
+Cc: stable@vger.kernel.org
+Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
+Link: https://lore.kernel.org/r/20250225-ringneck-dtbos-v3-2-853a9a6dd597@cherry.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/rockchip/px30-ringneck-haikou.dts | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/arch/arm64/boot/dts/rockchip/px30-ringneck-haikou.dts
++++ b/arch/arm64/boot/dts/rockchip/px30-ringneck-haikou.dts
+@@ -194,6 +194,13 @@
+ <3 RK_PB3 RK_FUNC_GPIO &pcfg_pull_none>;
+ };
+ };
++
++ uart {
++ uart5_rts_pin: uart5-rts-pin {
++ rockchip,pins =
++ <0 RK_PB5 RK_FUNC_GPIO &pcfg_pull_none>;
++ };
++ };
+ };
+
+ &pwm0 {
+@@ -228,6 +235,9 @@
+ };
+
+ &uart5 {
++ /* Add pinmux for rts-gpios (uart5_rts_pin) */
++ pinctrl-names = "default";
++ pinctrl-0 = <&uart5_xfer &uart5_rts_pin>;
+ rts-gpios = <&gpio0 RK_PB5 GPIO_ACTIVE_HIGH>;
+ status = "okay";
+ };
--- /dev/null
+From 548b0c5de7619ef53bbde5590700693f2f6d2a56 Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Sun, 2 Feb 2025 17:04:13 +0100
+Subject: batman-adv: Ignore own maximum aggregation size during RX
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit 548b0c5de7619ef53bbde5590700693f2f6d2a56 upstream.
+
+An OGMv1 and OGMv2 packet receive processing were not only limited by the
+number of bytes in the received packet but also by the nodes maximum
+aggregation packet size limit. But this limit is relevant for TX and not
+for RX. It must not be enforced by batadv_(i)v_ogm_aggr_packet to avoid
+loss of information in case of a different limit for sender and receiver.
+
+This has a minor side effect for B.A.T.M.A.N. IV because the
+batadv_iv_ogm_aggr_packet is also used for the preprocessing for the TX.
+But since the aggregation code itself will not allow more than
+BATADV_MAX_AGGREGATION_BYTES bytes, this check was never triggering (in
+this context) prior of removing it.
+
+Cc: stable@vger.kernel.org
+Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
+Fixes: 9323158ef9f4 ("batman-adv: OGMv2 - implement originators logic")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/batman-adv/bat_iv_ogm.c | 3 +--
+ net/batman-adv/bat_v_ogm.c | 3 +--
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+--- a/net/batman-adv/bat_iv_ogm.c
++++ b/net/batman-adv/bat_iv_ogm.c
+@@ -324,8 +324,7 @@ batadv_iv_ogm_aggr_packet(int buff_pos,
+ /* check if there is enough space for the optional TVLV */
+ next_buff_pos += ntohs(ogm_packet->tvlv_len);
+
+- return (next_buff_pos <= packet_len) &&
+- (next_buff_pos <= BATADV_MAX_AGGREGATION_BYTES);
++ return next_buff_pos <= packet_len;
+ }
+
+ /* send a batman ogm to a given interface */
+--- a/net/batman-adv/bat_v_ogm.c
++++ b/net/batman-adv/bat_v_ogm.c
+@@ -839,8 +839,7 @@ batadv_v_ogm_aggr_packet(int buff_pos, i
+ /* check if there is enough space for the optional TVLV */
+ next_buff_pos += ntohs(ogm2_packet->tvlv_len);
+
+- return (next_buff_pos <= packet_len) &&
+- (next_buff_pos <= BATADV_MAX_AGGREGATION_BYTES);
++ return next_buff_pos <= packet_len;
+ }
+
+ /**
--- /dev/null
+From 5a19143124be42900b3fbc9ada3c919632eb45eb Mon Sep 17 00:00:00 2001
+From: Haibo Chen <haibo.chen@nxp.com>
+Date: Fri, 14 Mar 2025 19:01:45 +0800
+Subject: can: flexcan: disable transceiver during system PM
+
+From: Haibo Chen <haibo.chen@nxp.com>
+
+commit 5a19143124be42900b3fbc9ada3c919632eb45eb upstream.
+
+During system PM, if no wakeup requirement, disable transceiver to
+save power.
+
+Fixes: 4de349e786a3 ("can: flexcan: fix resume function")
+Cc: stable@vger.kernel.org
+Reviewed-by: Frank Li <frank.li@nxp.com>
+Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
+Link: https://patch.msgid.link/20250314110145.899179-2-haibo.chen@nxp.com
+[mkl: add newlines]
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/flexcan/flexcan-core.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/can/flexcan/flexcan-core.c
++++ b/drivers/net/can/flexcan/flexcan-core.c
+@@ -2260,6 +2260,10 @@ static int __maybe_unused flexcan_suspen
+
+ flexcan_chip_interrupts_disable(dev);
+
++ err = flexcan_transceiver_disable(priv);
++ if (err)
++ return err;
++
+ err = pinctrl_pm_select_sleep_state(device);
+ if (err)
+ return err;
+@@ -2292,10 +2296,16 @@ static int __maybe_unused flexcan_resume
+ if (err)
+ return err;
+
+- err = flexcan_chip_start(dev);
++ err = flexcan_transceiver_enable(priv);
+ if (err)
+ return err;
+
++ err = flexcan_chip_start(dev);
++ if (err) {
++ flexcan_transceiver_disable(priv);
++ return err;
++ }
++
+ flexcan_chip_interrupts_enable(dev);
+ }
+
--- /dev/null
+From fd99d6ed20234b83d65b9c5417794343577cf3e5 Mon Sep 17 00:00:00 2001
+From: Haibo Chen <haibo.chen@nxp.com>
+Date: Fri, 14 Mar 2025 19:01:44 +0800
+Subject: can: flexcan: only change CAN state when link up in system PM
+
+From: Haibo Chen <haibo.chen@nxp.com>
+
+commit fd99d6ed20234b83d65b9c5417794343577cf3e5 upstream.
+
+After a suspend/resume cycle on a down interface, it will come up as
+ERROR-ACTIVE.
+
+$ ip -details -s -s a s dev flexcan0
+3: flexcan0: <NOARP,ECHO> mtu 16 qdisc pfifo_fast state DOWN group default qlen 10
+ link/can promiscuity 0 allmulti 0 minmtu 0 maxmtu 0
+ can state STOPPED (berr-counter tx 0 rx 0) restart-ms 1000
+
+$ sudo systemctl suspend
+
+$ ip -details -s -s a s dev flexcan0
+3: flexcan0: <NOARP,ECHO> mtu 16 qdisc pfifo_fast state DOWN group default qlen 10
+ link/can promiscuity 0 allmulti 0 minmtu 0 maxmtu 0
+ can state ERROR-ACTIVE (berr-counter tx 0 rx 0) restart-ms 1000
+
+And only set CAN state to CAN_STATE_ERROR_ACTIVE when resume process
+has no issue, otherwise keep in CAN_STATE_SLEEPING as suspend did.
+
+Fixes: 4de349e786a3 ("can: flexcan: fix resume function")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
+Link: https://patch.msgid.link/20250314110145.899179-1-haibo.chen@nxp.com
+Reported-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Closes: https://lore.kernel.org/all/20250314-married-polar-elephant-b15594-mkl@pengutronix.de
+[mkl: add newlines]
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/flexcan/flexcan-core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/can/flexcan/flexcan-core.c
++++ b/drivers/net/can/flexcan/flexcan-core.c
+@@ -2266,8 +2266,9 @@ static int __maybe_unused flexcan_suspen
+ }
+ netif_stop_queue(dev);
+ netif_device_detach(dev);
++
++ priv->can.state = CAN_STATE_SLEEPING;
+ }
+- priv->can.state = CAN_STATE_SLEEPING;
+
+ return 0;
+ }
+@@ -2278,7 +2279,6 @@ static int __maybe_unused flexcan_resume
+ struct flexcan_priv *priv = netdev_priv(dev);
+ int err;
+
+- priv->can.state = CAN_STATE_ERROR_ACTIVE;
+ if (netif_running(dev)) {
+ netif_device_attach(dev);
+ netif_start_queue(dev);
+@@ -2298,6 +2298,8 @@ static int __maybe_unused flexcan_resume
+
+ flexcan_chip_interrupts_enable(dev);
+ }
++
++ priv->can.state = CAN_STATE_ERROR_ACTIVE;
+ }
+
+ return 0;
--- /dev/null
+From 1dba0a37644ed3022558165bbb5cb9bda540eaf7 Mon Sep 17 00:00:00 2001
+From: Biju Das <biju.das.jz@bp.renesas.com>
+Date: Fri, 7 Mar 2025 17:03:27 +0000
+Subject: can: rcar_canfd: Fix page entries in the AFL list
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+commit 1dba0a37644ed3022558165bbb5cb9bda540eaf7 upstream.
+
+There are a total of 96 AFL pages and each page has 16 entries with
+registers CFDGAFLIDr, CFDGAFLMr, CFDGAFLP0r, CFDGAFLP1r holding
+the rule entries (r = 0..15).
+
+Currently, RCANFD_GAFL* macros use a start variable to find AFL entries,
+which is incorrect as the testing on RZ/G3E shows ch1 and ch4
+gets a start value of 0 and the register contents are overwritten.
+
+Fix this issue by using rule_entry corresponding to the channel
+to find the page entries in the AFL list.
+
+Fixes: dd3bd23eb438 ("can: rcar_canfd: Add Renesas R-Car CAN FD driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20250307170330.173425-3-biju.das.jz@bp.renesas.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/rcar/rcar_canfd.c | 28 +++++++++++-----------------
+ 1 file changed, 11 insertions(+), 17 deletions(-)
+
+--- a/drivers/net/can/rcar/rcar_canfd.c
++++ b/drivers/net/can/rcar/rcar_canfd.c
+@@ -787,22 +787,14 @@ static void rcar_canfd_configure_control
+ }
+
+ static void rcar_canfd_configure_afl_rules(struct rcar_canfd_global *gpriv,
+- u32 ch)
++ u32 ch, u32 rule_entry)
+ {
+- u32 cfg;
+- int offset, start, page, num_rules = RCANFD_CHANNEL_NUMRULES;
++ int offset, page, num_rules = RCANFD_CHANNEL_NUMRULES;
++ u32 rule_entry_index = rule_entry % 16;
+ u32 ridx = ch + RCANFD_RFFIFO_IDX;
+
+- if (ch == 0) {
+- start = 0; /* Channel 0 always starts from 0th rule */
+- } else {
+- /* Get number of Channel 0 rules and adjust */
+- cfg = rcar_canfd_read(gpriv->base, RCANFD_GAFLCFG(ch));
+- start = RCANFD_GAFLCFG_GETRNC(gpriv, 0, cfg);
+- }
+-
+ /* Enable write access to entry */
+- page = RCANFD_GAFL_PAGENUM(start);
++ page = RCANFD_GAFL_PAGENUM(rule_entry);
+ rcar_canfd_set_bit(gpriv->base, RCANFD_GAFLECTR,
+ (RCANFD_GAFLECTR_AFLPN(gpriv, page) |
+ RCANFD_GAFLECTR_AFLDAE));
+@@ -818,13 +810,13 @@ static void rcar_canfd_configure_afl_rul
+ offset = RCANFD_C_GAFL_OFFSET;
+
+ /* Accept all IDs */
+- rcar_canfd_write(gpriv->base, RCANFD_GAFLID(offset, start), 0);
++ rcar_canfd_write(gpriv->base, RCANFD_GAFLID(offset, rule_entry_index), 0);
+ /* IDE or RTR is not considered for matching */
+- rcar_canfd_write(gpriv->base, RCANFD_GAFLM(offset, start), 0);
++ rcar_canfd_write(gpriv->base, RCANFD_GAFLM(offset, rule_entry_index), 0);
+ /* Any data length accepted */
+- rcar_canfd_write(gpriv->base, RCANFD_GAFLP0(offset, start), 0);
++ rcar_canfd_write(gpriv->base, RCANFD_GAFLP0(offset, rule_entry_index), 0);
+ /* Place the msg in corresponding Rx FIFO entry */
+- rcar_canfd_set_bit(gpriv->base, RCANFD_GAFLP1(offset, start),
++ rcar_canfd_set_bit(gpriv->base, RCANFD_GAFLP1(offset, rule_entry_index),
+ RCANFD_GAFLP1_GAFLFDP(ridx));
+
+ /* Disable write access to page */
+@@ -1851,6 +1843,7 @@ static int rcar_canfd_probe(struct platf
+ unsigned long channels_mask = 0;
+ int err, ch_irq, g_irq;
+ int g_err_irq, g_recc_irq;
++ u32 rule_entry = 0;
+ bool fdmode = true; /* CAN FD only mode - default */
+ char name[9] = "channelX";
+ int i;
+@@ -2023,7 +2016,8 @@ static int rcar_canfd_probe(struct platf
+ rcar_canfd_configure_tx(gpriv, ch);
+
+ /* Configure receive rules */
+- rcar_canfd_configure_afl_rules(gpriv, ch);
++ rcar_canfd_configure_afl_rules(gpriv, ch, rule_entry);
++ rule_entry += RCANFD_CHANNEL_NUMRULES;
+ }
+
+ /* Configure common interrupts */
--- /dev/null
+From 1d22a122ffb116c3cf78053e812b8b21f8852ee9 Mon Sep 17 00:00:00 2001
+From: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
+Date: Tue, 18 Feb 2025 23:32:28 +0900
+Subject: can: ucan: fix out of bound read in strscpy() source
+
+From: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
+
+commit 1d22a122ffb116c3cf78053e812b8b21f8852ee9 upstream.
+
+Commit 7fdaf8966aae ("can: ucan: use strscpy() to instead of strncpy()")
+unintentionally introduced a one byte out of bound read on strscpy()'s
+source argument (which is kind of ironic knowing that strscpy() is meant
+to be a more secure alternative :)).
+
+Let's consider below buffers:
+
+ dest[len + 1]; /* will be NUL terminated */
+ src[len]; /* may not be NUL terminated */
+
+When doing:
+
+ strncpy(dest, src, len);
+ dest[len] = '\0';
+
+strncpy() will read up to len bytes from src.
+
+On the other hand:
+
+ strscpy(dest, src, len + 1);
+
+will read up to len + 1 bytes from src, that is to say, an out of bound
+read of one byte will occur on src if it is not NUL terminated. Note
+that the src[len] byte is never copied, but strscpy() still needs to
+read it to check whether a truncation occurred or not.
+
+This exact pattern happened in ucan.
+
+The root cause is that the source is not NUL terminated. Instead of
+doing a copy in a local buffer, directly NUL terminate it as soon as
+usb_control_msg() returns. With this, the local firmware_str[] variable
+can be removed.
+
+On top of this do a couple refactors:
+
+ - ucan_ctl_payload->raw is only used for the firmware string, so
+ rename it to ucan_ctl_payload->fw_str and change its type from u8 to
+ char.
+
+ - ucan_device_request_in() is only used to retrieve the firmware
+ string, so rename it to ucan_get_fw_str() and refactor it to make it
+ directly handle all the string termination logic.
+
+Reported-by: syzbot+d7d8c418e8317899e88c@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/linux-can/67b323a4.050a0220.173698.002b.GAE@google.com/
+Fixes: 7fdaf8966aae ("can: ucan: use strscpy() to instead of strncpy()")
+Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
+Link: https://patch.msgid.link/20250218143515.627682-2-mailhol.vincent@wanadoo.fr
+Cc: stable@vger.kernel.org
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/usb/ucan.c | 43 ++++++++++++++++++-------------------------
+ 1 file changed, 18 insertions(+), 25 deletions(-)
+
+--- a/drivers/net/can/usb/ucan.c
++++ b/drivers/net/can/usb/ucan.c
+@@ -186,7 +186,7 @@ union ucan_ctl_payload {
+ */
+ struct ucan_ctl_cmd_get_protocol_version cmd_get_protocol_version;
+
+- u8 raw[128];
++ u8 fw_str[128];
+ } __packed;
+
+ enum {
+@@ -424,18 +424,20 @@ static int ucan_ctrl_command_out(struct
+ UCAN_USB_CTL_PIPE_TIMEOUT);
+ }
+
+-static int ucan_device_request_in(struct ucan_priv *up,
+- u8 cmd, u16 subcmd, u16 datalen)
++static void ucan_get_fw_str(struct ucan_priv *up, char *fw_str, size_t size)
+ {
+- return usb_control_msg(up->udev,
+- usb_rcvctrlpipe(up->udev, 0),
+- cmd,
+- USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+- subcmd,
+- 0,
+- up->ctl_msg_buffer,
+- datalen,
+- UCAN_USB_CTL_PIPE_TIMEOUT);
++ int ret;
++
++ ret = usb_control_msg(up->udev, usb_rcvctrlpipe(up->udev, 0),
++ UCAN_DEVICE_GET_FW_STRING,
++ USB_DIR_IN | USB_TYPE_VENDOR |
++ USB_RECIP_DEVICE,
++ 0, 0, fw_str, size - 1,
++ UCAN_USB_CTL_PIPE_TIMEOUT);
++ if (ret > 0)
++ fw_str[ret] = '\0';
++ else
++ strscpy(fw_str, "unknown", size);
+ }
+
+ /* Parse the device information structure reported by the device and
+@@ -1314,7 +1316,6 @@ static int ucan_probe(struct usb_interfa
+ u8 in_ep_addr;
+ u8 out_ep_addr;
+ union ucan_ctl_payload *ctl_msg_buffer;
+- char firmware_str[sizeof(union ucan_ctl_payload) + 1];
+
+ udev = interface_to_usbdev(intf);
+
+@@ -1527,17 +1528,6 @@ static int ucan_probe(struct usb_interfa
+ */
+ ucan_parse_device_info(up, &ctl_msg_buffer->cmd_get_device_info);
+
+- /* just print some device information - if available */
+- ret = ucan_device_request_in(up, UCAN_DEVICE_GET_FW_STRING, 0,
+- sizeof(union ucan_ctl_payload));
+- if (ret > 0) {
+- /* copy string while ensuring zero termination */
+- strscpy(firmware_str, up->ctl_msg_buffer->raw,
+- sizeof(union ucan_ctl_payload) + 1);
+- } else {
+- strcpy(firmware_str, "unknown");
+- }
+-
+ /* device is compatible, reset it */
+ ret = ucan_ctrl_command_out(up, UCAN_COMMAND_RESET, 0, 0);
+ if (ret < 0)
+@@ -1555,7 +1545,10 @@ static int ucan_probe(struct usb_interfa
+
+ /* initialisation complete, log device info */
+ netdev_info(up->netdev, "registered device\n");
+- netdev_info(up->netdev, "firmware string: %s\n", firmware_str);
++ ucan_get_fw_str(up, up->ctl_msg_buffer->fw_str,
++ sizeof(up->ctl_msg_buffer->fw_str));
++ netdev_info(up->netdev, "firmware string: %s\n",
++ up->ctl_msg_buffer->fw_str);
+
+ /* success */
+ return 0;
--- /dev/null
+From 35f0f9f421390f66cb062f4d79f4924af5f55b04 Mon Sep 17 00:00:00 2001
+From: Yilin Chen <Yilin.Chen@amd.com>
+Date: Wed, 5 Mar 2025 12:19:49 -0500
+Subject: drm/amd/display: Fix message for support_edp0_on_dp1
+
+From: Yilin Chen <Yilin.Chen@amd.com>
+
+commit 35f0f9f421390f66cb062f4d79f4924af5f55b04 upstream.
+
+[WHY]
+The info message was wrong when support_edp0_on_dp1 is enabled
+
+[HOW]
+Use correct info message for support_edp0_on_dp1
+
+Fixes: f6d17270d18a ("drm/amd/display: add a quirk to enable eDP0 on DP1")
+Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Yilin Chen <Yilin.Chen@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 79538e6365c99d7b1c3e560d1ea8d11ef8313465)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1720,7 +1720,7 @@ static void retrieve_dmi_info(struct amd
+ }
+ if (quirk_entries.support_edp0_on_dp1) {
+ init_data->flags.support_edp0_on_dp1 = true;
+- drm_info(dev, "aux_hpd_discon_quirk attached\n");
++ drm_info(dev, "support_edp0_on_dp1 attached\n");
+ }
+ }
+
--- /dev/null
+From acbf16a6ae775b4db86f537448cc466288aa307e Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@amd.com>
+Date: Fri, 7 Mar 2025 15:55:20 -0600
+Subject: drm/amd/display: Use HW lock mgr for PSR1 when only one eDP
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+commit acbf16a6ae775b4db86f537448cc466288aa307e upstream.
+
+[WHY]
+DMUB locking is important to make sure that registers aren't accessed
+while in PSR. Previously it was enabled but caused a deadlock in
+situations with multiple eDP panels.
+
+[HOW]
+Detect if multiple eDP panels are in use to decide whether to use
+lock. Refactor the function so that the first check is for PSR-SU
+and then replay is in use to prevent having to look up number
+of eDP panels for those configurations.
+
+Fixes: f245b400a223 ("Revert "drm/amd/display: Use HW lock mgr for PSR1"")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3965
+Reviewed-by: ChiaHsuan Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit ed569e1279a3045d6b974226c814e071fa0193a6)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c
+@@ -69,5 +69,16 @@ bool should_use_dmub_lock(struct dc_link
+ if (link->replay_settings.replay_feature_enabled)
+ return true;
+
++ /* only use HW lock for PSR1 on single eDP */
++ if (link->psr_settings.psr_version == DC_PSR_VERSION_1) {
++ struct dc_link *edp_links[MAX_NUM_EDP];
++ int edp_num;
++
++ dc_get_edp_links(link->dc, edp_links, &edp_num);
++
++ if (edp_num == 1)
++ return true;
++ }
++
+ return false;
+ }
--- /dev/null
+From 19b53f96856b5316ee1fd6ca485af0889e001677 Mon Sep 17 00:00:00 2001
+From: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Date: Tue, 11 Mar 2025 14:15:18 -0400
+Subject: drm/amd/pm: add unique_id for gfx12
+
+From: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+
+commit 19b53f96856b5316ee1fd6ca485af0889e001677 upstream.
+
+Expose unique_id for gfx12
+
+Signed-off-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 16fbc18cb07470cd33fb5f37ad181b51583e6dc0)
+Cc: stable@vger.kernel.org # 6.12.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/amdgpu_pm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c
++++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
+@@ -2493,6 +2493,8 @@ static int default_attr_update(struct am
+ case IP_VERSION(11, 0, 1):
+ case IP_VERSION(11, 0, 2):
+ case IP_VERSION(11, 0, 3):
++ case IP_VERSION(12, 0, 0):
++ case IP_VERSION(12, 0, 1):
+ *states = ATTR_STATE_SUPPORTED;
+ break;
+ default:
--- /dev/null
+From ec33964d9d88488fa954a03d476a8b811efc6e85 Mon Sep 17 00:00:00 2001
+From: David Rosca <david.rosca@amd.com>
+Date: Fri, 28 Feb 2025 13:34:49 +0100
+Subject: drm/amdgpu: Fix JPEG video caps max size for navi1x and raven
+
+From: David Rosca <david.rosca@amd.com>
+
+commit ec33964d9d88488fa954a03d476a8b811efc6e85 upstream.
+
+8192x8192 is the maximum supported resolution.
+
+Signed-off-by: David Rosca <david.rosca@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Ruijing Dong <ruijing.dong@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 6e0d2fde3ae8fdb5b47e10389f23ed2cb4daec5d)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/nv.c | 2 +-
+ drivers/gpu/drm/amd/amdgpu/soc15.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/nv.c
++++ b/drivers/gpu/drm/amd/amdgpu/nv.c
+@@ -83,7 +83,7 @@ static const struct amdgpu_video_codec_i
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 1920, 1088, 4)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)},
+- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 8192, 8192, 0)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)},
+ };
+
+--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
+@@ -124,7 +124,7 @@ static const struct amdgpu_video_codec_i
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 1920, 1088, 4)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 4096, 186)},
+- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 8192, 8192, 0)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 4096, 4096, 0)},
+ };
+
--- /dev/null
+From f0105e173103c9d30a2bb959f7399437d536c848 Mon Sep 17 00:00:00 2001
+From: David Rosca <david.rosca@amd.com>
+Date: Fri, 28 Feb 2025 13:32:46 +0100
+Subject: drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size
+
+From: David Rosca <david.rosca@amd.com>
+
+commit f0105e173103c9d30a2bb959f7399437d536c848 upstream.
+
+1920x1088 is the maximum supported resolution.
+
+Signed-off-by: David Rosca <david.rosca@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Ruijing Dong <ruijing.dong@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 1a0807feb97082bff2b1342dbbe55a2a9a8bdb88)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/nv.c | 18 +++++++++---------
+ drivers/gpu/drm/amd/amdgpu/soc15.c | 18 +++++++++---------
+ drivers/gpu/drm/amd/amdgpu/vi.c | 36 ++++++++++++++++++------------------
+ 3 files changed, 36 insertions(+), 36 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/nv.c
++++ b/drivers/gpu/drm/amd/amdgpu/nv.c
+@@ -78,10 +78,10 @@ static const struct amdgpu_video_codecs
+
+ /* Navi1x */
+ static const struct amdgpu_video_codec_info nv_video_codecs_decode_array[] = {
+- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)},
+- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 1920, 1088, 3)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 1920, 1088, 5)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)},
+- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 1920, 1088, 4)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)},
+@@ -104,10 +104,10 @@ static const struct amdgpu_video_codecs
+ };
+
+ static const struct amdgpu_video_codec_info sc_video_codecs_decode_array_vcn0[] = {
+- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)},
+- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 1920, 1088, 3)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 1920, 1088, 5)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)},
+- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 1920, 1088, 4)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 16384, 16384, 0)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)},
+@@ -115,10 +115,10 @@ static const struct amdgpu_video_codec_i
+ };
+
+ static const struct amdgpu_video_codec_info sc_video_codecs_decode_array_vcn1[] = {
+- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)},
+- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 1920, 1088, 3)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 1920, 1088, 5)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)},
+- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 1920, 1088, 4)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 16384, 16384, 0)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)},
+--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
+@@ -103,10 +103,10 @@ static const struct amdgpu_video_codecs
+ /* Vega */
+ static const struct amdgpu_video_codec_info vega_video_codecs_decode_array[] =
+ {
+- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)},
+- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 1920, 1088, 3)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 1920, 1088, 5)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)},
+- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 1920, 1088, 4)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 4096, 186)},
+ };
+
+@@ -119,10 +119,10 @@ static const struct amdgpu_video_codecs
+ /* Raven */
+ static const struct amdgpu_video_codec_info rv_video_codecs_decode_array[] =
+ {
+- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)},
+- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 1920, 1088, 3)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 1920, 1088, 5)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)},
+- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 1920, 1088, 4)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 4096, 186)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 4096, 4096, 0)},
+@@ -137,10 +137,10 @@ static const struct amdgpu_video_codecs
+ /* Renoir, Arcturus */
+ static const struct amdgpu_video_codec_info rn_video_codecs_decode_array[] =
+ {
+- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)},
+- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 4096, 4096, 5)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 1920, 1088, 3)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4, 1920, 1088, 5)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)},
+- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)},
++ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 1920, 1088, 4)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 8192, 4352, 186)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 16384, 16384, 0)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VP9, 8192, 4352, 0)},
+--- a/drivers/gpu/drm/amd/amdgpu/vi.c
++++ b/drivers/gpu/drm/amd/amdgpu/vi.c
+@@ -167,16 +167,16 @@ static const struct amdgpu_video_codec_i
+ {
+ {
+ .codec_type = AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2,
+- .max_width = 4096,
+- .max_height = 4096,
+- .max_pixels_per_frame = 4096 * 4096,
++ .max_width = 1920,
++ .max_height = 1088,
++ .max_pixels_per_frame = 1920 * 1088,
+ .max_level = 3,
+ },
+ {
+ .codec_type = AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4,
+- .max_width = 4096,
+- .max_height = 4096,
+- .max_pixels_per_frame = 4096 * 4096,
++ .max_width = 1920,
++ .max_height = 1088,
++ .max_pixels_per_frame = 1920 * 1088,
+ .max_level = 5,
+ },
+ {
+@@ -188,9 +188,9 @@ static const struct amdgpu_video_codec_i
+ },
+ {
+ .codec_type = AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1,
+- .max_width = 4096,
+- .max_height = 4096,
+- .max_pixels_per_frame = 4096 * 4096,
++ .max_width = 1920,
++ .max_height = 1088,
++ .max_pixels_per_frame = 1920 * 1088,
+ .max_level = 4,
+ },
+ };
+@@ -206,16 +206,16 @@ static const struct amdgpu_video_codec_i
+ {
+ {
+ .codec_type = AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2,
+- .max_width = 4096,
+- .max_height = 4096,
+- .max_pixels_per_frame = 4096 * 4096,
++ .max_width = 1920,
++ .max_height = 1088,
++ .max_pixels_per_frame = 1920 * 1088,
+ .max_level = 3,
+ },
+ {
+ .codec_type = AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4,
+- .max_width = 4096,
+- .max_height = 4096,
+- .max_pixels_per_frame = 4096 * 4096,
++ .max_width = 1920,
++ .max_height = 1088,
++ .max_pixels_per_frame = 1920 * 1088,
+ .max_level = 5,
+ },
+ {
+@@ -227,9 +227,9 @@ static const struct amdgpu_video_codec_i
+ },
+ {
+ .codec_type = AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1,
+- .max_width = 4096,
+- .max_height = 4096,
+- .max_pixels_per_frame = 4096 * 4096,
++ .max_width = 1920,
++ .max_height = 1088,
++ .max_pixels_per_frame = 1920 * 1088,
+ .max_level = 4,
+ },
+ {
--- /dev/null
+From 86730b5261d4d8dae3f5b97709d40d694ecf1ddf Mon Sep 17 00:00:00 2001
+From: Wentao Liang <vulab@iscas.ac.cn>
+Date: Wed, 12 Mar 2025 14:31:06 +0800
+Subject: drm/amdgpu/gfx12: correct cleanup of 'me' field with gfx_v12_0_me_fini()
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+commit 86730b5261d4d8dae3f5b97709d40d694ecf1ddf upstream.
+
+In gfx_v12_0_cp_gfx_load_me_microcode_rs64(), gfx_v12_0_pfp_fini() is
+incorrectly used to free 'me' field of 'gfx', since gfx_v12_0_pfp_fini()
+can only release 'pfp' field of 'gfx'. The release function of 'me' field
+should be gfx_v12_0_me_fini().
+
+Fixes: 52cb80c12e8a ("drm/amdgpu: Add gfx v12_0 ip block support (v6)")
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit ebdc52607a46cda08972888178c6aa9cd6965141)
+Cc: stable@vger.kernel.org # 6.12.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
+@@ -2395,7 +2395,7 @@ static int gfx_v12_0_cp_gfx_load_me_micr
+ (void **)&adev->gfx.me.me_fw_data_ptr);
+ if (r) {
+ dev_err(adev->dev, "(%d) failed to create me data bo\n", r);
+- gfx_v12_0_pfp_fini(adev);
++ gfx_v12_0_me_fini(adev);
+ return r;
+ }
+
--- /dev/null
+From d9d4cb224e4140f51847642aa5a4a5c3eb998af0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tomasz=20Paku=C5=82a?= <tomasz.pakula.oficjalny@gmail.com>
+Date: Tue, 11 Mar 2025 22:38:33 +0100
+Subject: drm/amdgpu/pm: Handle SCLK offset correctly in overdrive for smu 14.0.2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
+
+commit d9d4cb224e4140f51847642aa5a4a5c3eb998af0 upstream.
+
+Currently, it seems like the code was carried over from RDNA3 because
+it assumes two possible values to set. RDNA4, instead of having:
+0: min SCLK
+1: max SCLK
+only has
+0: SCLK offset
+
+This change makes it so it only reports current offset value instead of
+showing possible min/max values and their indices. Moreover, it now only
+accepts the offset as a value, without the indice index.
+
+Additionally, the lower bound was printed as %u by mistake.
+
+Old:
+OD_SCLK_OFFSET:
+0: -500Mhz
+1: 1000Mhz
+OD_MCLK:
+0: 97Mhz
+1: 1259MHz
+OD_VDDGFX_OFFSET:
+0mV
+OD_RANGE:
+SCLK_OFFSET: -500Mhz 1000Mhz
+MCLK: 97Mhz 1500Mhz
+VDDGFX_OFFSET: -200mv 0mv
+
+New:
+OD_SCLK_OFFSET:
+0Mhz
+OD_MCLK:
+0: 97Mhz
+1: 1259MHz
+OD_VDDGFX_OFFSET:
+0mV
+OD_RANGE:
+SCLK_OFFSET: -500Mhz 1000Mhz
+MCLK: 97Mhz 1500Mhz
+VDDGFX_OFFSET: -200mv 0mv
+
+Setting this offset:
+Old: "s 1 <offset>"
+New: "s <offset>"
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4036
+Reviewed-by: Yang Wang <kevinyang.wang@amd.com>
+Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 1cfeb60e6e8837b1de5eb4e17df7cf31f4442144)
+Cc: stable@vger.kernel.org # 6.12.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 59 +++++--------------
+ 1 file changed, 18 insertions(+), 41 deletions(-)
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c
+@@ -1206,16 +1206,9 @@ static int smu_v14_0_2_print_clk_levels(
+ PP_OD_FEATURE_GFXCLK_BIT))
+ break;
+
+- PPTable_t *pptable = smu->smu_table.driver_pptable;
+- const OverDriveLimits_t * const overdrive_upperlimits =
+- &pptable->SkuTable.OverDriveLimitsBasicMax;
+- const OverDriveLimits_t * const overdrive_lowerlimits =
+- &pptable->SkuTable.OverDriveLimitsBasicMin;
+-
+ size += sysfs_emit_at(buf, size, "OD_SCLK_OFFSET:\n");
+- size += sysfs_emit_at(buf, size, "0: %dMhz\n1: %uMhz\n",
+- overdrive_lowerlimits->GfxclkFoffset,
+- overdrive_upperlimits->GfxclkFoffset);
++ size += sysfs_emit_at(buf, size, "%dMhz\n",
++ od_table->OverDriveTable.GfxclkFoffset);
+ break;
+
+ case SMU_OD_MCLK:
+@@ -1350,12 +1343,8 @@ static int smu_v14_0_2_print_clk_levels(
+
+ if (smu_v14_0_2_is_od_feature_supported(smu, PP_OD_FEATURE_GFXCLK_BIT)) {
+ smu_v14_0_2_get_od_setting_limits(smu,
+- PP_OD_FEATURE_GFXCLK_FMIN,
+- &min_value,
+- NULL);
+- smu_v14_0_2_get_od_setting_limits(smu,
+ PP_OD_FEATURE_GFXCLK_FMAX,
+- NULL,
++ &min_value,
+ &max_value);
+ size += sysfs_emit_at(buf, size, "SCLK_OFFSET: %7dMhz %10uMhz\n",
+ min_value, max_value);
+@@ -2429,36 +2418,24 @@ static int smu_v14_0_2_od_edit_dpm_table
+ return -ENOTSUPP;
+ }
+
+- for (i = 0; i < size; i += 2) {
+- if (i + 2 > size) {
+- dev_info(adev->dev, "invalid number of input parameters %d\n", size);
+- return -EINVAL;
+- }
++ if (size != 1) {
++ dev_info(adev->dev, "invalid number of input parameters %d\n", size);
++ return -EINVAL;
++ }
+
+- switch (input[i]) {
+- case 1:
+- smu_v14_0_2_get_od_setting_limits(smu,
+- PP_OD_FEATURE_GFXCLK_FMAX,
+- &minimum,
+- &maximum);
+- if (input[i + 1] < minimum ||
+- input[i + 1] > maximum) {
+- dev_info(adev->dev, "GfxclkFmax (%ld) must be within [%u, %u]!\n",
+- input[i + 1], minimum, maximum);
+- return -EINVAL;
+- }
+-
+- od_table->OverDriveTable.GfxclkFoffset = input[i + 1];
+- od_table->OverDriveTable.FeatureCtrlMask |= 1U << PP_OD_FEATURE_GFXCLK_BIT;
+- break;
+-
+- default:
+- dev_info(adev->dev, "Invalid SCLK_VDDC_TABLE index: %ld\n", input[i]);
+- dev_info(adev->dev, "Supported indices: [0:min,1:max]\n");
+- return -EINVAL;
+- }
++ smu_v14_0_2_get_od_setting_limits(smu,
++ PP_OD_FEATURE_GFXCLK_FMAX,
++ &minimum,
++ &maximum);
++ if (input[0] < minimum ||
++ input[0] > maximum) {
++ dev_info(adev->dev, "GfxclkFoffset must be within [%d, %u]!\n",
++ minimum, maximum);
++ return -EINVAL;
+ }
+
++ od_table->OverDriveTable.GfxclkFoffset = input[0];
++ od_table->OverDriveTable.FeatureCtrlMask |= 1U << PP_OD_FEATURE_GFXCLK_BIT;
+ break;
+
+ case PP_OD_EDIT_MCLK_VDDC_TABLE:
--- /dev/null
+From 5ca0040ecfe8ba0dee9df1f559e8d7587f12bf89 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 11 Mar 2025 10:34:36 -0400
+Subject: drm/amdgpu/pm: wire up hwmon fan speed for smu 14.0.2
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 5ca0040ecfe8ba0dee9df1f559e8d7587f12bf89 upstream.
+
+Add callbacks for fan speed fetching.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4034
+Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 90df6db62fa78a8ab0b705ec38db99c7973b95d6)
+Cc: stable@vger.kernel.org # 6.12.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 35 +++++++++++++++++++
+ 1 file changed, 35 insertions(+)
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c
+@@ -1628,6 +1628,39 @@ out:
+ adev->unique_id = ((uint64_t)upper32 << 32) | lower32;
+ }
+
++static int smu_v14_0_2_get_fan_speed_pwm(struct smu_context *smu,
++ uint32_t *speed)
++{
++ int ret;
++
++ if (!speed)
++ return -EINVAL;
++
++ ret = smu_v14_0_2_get_smu_metrics_data(smu,
++ METRICS_CURR_FANPWM,
++ speed);
++ if (ret) {
++ dev_err(smu->adev->dev, "Failed to get fan speed(PWM)!");
++ return ret;
++ }
++
++ /* Convert the PMFW output which is in percent to pwm(255) based */
++ *speed = min(*speed * 255 / 100, (uint32_t)255);
++
++ return 0;
++}
++
++static int smu_v14_0_2_get_fan_speed_rpm(struct smu_context *smu,
++ uint32_t *speed)
++{
++ if (!speed)
++ return -EINVAL;
++
++ return smu_v14_0_2_get_smu_metrics_data(smu,
++ METRICS_CURR_FANSPEED,
++ speed);
++}
++
+ static int smu_v14_0_2_get_power_limit(struct smu_context *smu,
+ uint32_t *current_power_limit,
+ uint32_t *default_power_limit,
+@@ -2794,6 +2827,8 @@ static const struct pptable_funcs smu_v1
+ .set_performance_level = smu_v14_0_set_performance_level,
+ .gfx_off_control = smu_v14_0_gfx_off_control,
+ .get_unique_id = smu_v14_0_2_get_unique_id,
++ .get_fan_speed_pwm = smu_v14_0_2_get_fan_speed_pwm,
++ .get_fan_speed_rpm = smu_v14_0_2_get_fan_speed_rpm,
+ .get_power_limit = smu_v14_0_2_get_power_limit,
+ .set_power_limit = smu_v14_0_2_set_power_limit,
+ .get_power_profile_mode = smu_v14_0_2_get_power_profile_mode,
--- /dev/null
+From 7fc0765208502e53297ce72c49ca43729f9d6ff3 Mon Sep 17 00:00:00 2001
+From: David Rosca <david.rosca@amd.com>
+Date: Fri, 28 Feb 2025 14:12:10 +0100
+Subject: drm/amdgpu: Remove JPEG from vega and carrizo video caps
+
+From: David Rosca <david.rosca@amd.com>
+
+commit 7fc0765208502e53297ce72c49ca43729f9d6ff3 upstream.
+
+JPEG is only supported for VCN1+.
+
+Signed-off-by: David Rosca <david.rosca@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Ruijing Dong <ruijing.dong@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 0a6e7b06bdbead2e43d56a2274b7e0c9c86d536e)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/soc15.c | 1 -
+ drivers/gpu/drm/amd/amdgpu/vi.c | 7 -------
+ 2 files changed, 8 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
+@@ -108,7 +108,6 @@ static const struct amdgpu_video_codec_i
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 4096, 52)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_VC1, 4096, 4096, 4)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 4096, 186)},
+- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG, 4096, 4096, 0)},
+ };
+
+ static const struct amdgpu_video_codecs vega_video_codecs_decode =
+--- a/drivers/gpu/drm/amd/amdgpu/vi.c
++++ b/drivers/gpu/drm/amd/amdgpu/vi.c
+@@ -239,13 +239,6 @@ static const struct amdgpu_video_codec_i
+ .max_pixels_per_frame = 4096 * 4096,
+ .max_level = 186,
+ },
+- {
+- .codec_type = AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_JPEG,
+- .max_width = 4096,
+- .max_height = 4096,
+- .max_pixels_per_frame = 4096 * 4096,
+- .max_level = 0,
+- },
+ };
+
+ static const struct amdgpu_video_codecs cz_video_codecs_decode =
--- /dev/null
+From 35b6162bb790555ad56b7f0d120e307b8334d778 Mon Sep 17 00:00:00 2001
+From: David Belanger <david.belanger@amd.com>
+Date: Tue, 2 Jul 2024 17:56:41 -0400
+Subject: drm/amdgpu: Restore uncached behaviour on GFX12
+
+From: David Belanger <david.belanger@amd.com>
+
+commit 35b6162bb790555ad56b7f0d120e307b8334d778 upstream.
+
+Always use MTYPE_UC if UNCACHED flag is specified.
+
+This makes kernarg region uncached and it restores
+usermode cache disable debug flag functionality.
+
+Do not set MTYPE_UC for COHERENT flag, on GFX12 coherence is handled by
+shader code.
+
+Signed-off-by: David Belanger <david.belanger@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit eb6cdfb807d038d9b9986b5c87188f28a4071eae)
+Cc: stable@vger.kernel.org # 6.12.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c | 22 ++--------------------
+ drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 8 +-------
+ 2 files changed, 3 insertions(+), 27 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c
+@@ -498,9 +498,6 @@ static void gmc_v12_0_get_vm_pte(struct
+ uint64_t *flags)
+ {
+ struct amdgpu_bo *bo = mapping->bo_va->base.bo;
+- struct amdgpu_device *bo_adev;
+- bool coherent, is_system;
+-
+
+ *flags &= ~AMDGPU_PTE_EXECUTABLE;
+ *flags |= mapping->flags & AMDGPU_PTE_EXECUTABLE;
+@@ -516,26 +513,11 @@ static void gmc_v12_0_get_vm_pte(struct
+ *flags &= ~AMDGPU_PTE_VALID;
+ }
+
+- if (!bo)
+- return;
+-
+- if (bo->flags & (AMDGPU_GEM_CREATE_COHERENT |
+- AMDGPU_GEM_CREATE_UNCACHED))
+- *flags = AMDGPU_PTE_MTYPE_GFX12(*flags, MTYPE_UC);
+-
+- bo_adev = amdgpu_ttm_adev(bo->tbo.bdev);
+- coherent = bo->flags & AMDGPU_GEM_CREATE_COHERENT;
+- is_system = bo->tbo.resource &&
+- (bo->tbo.resource->mem_type == TTM_PL_TT ||
+- bo->tbo.resource->mem_type == AMDGPU_PL_PREEMPT);
+-
+ if (bo && bo->flags & AMDGPU_GEM_CREATE_GFX12_DCC)
+ *flags |= AMDGPU_PTE_DCC;
+
+- /* WA for HW bug */
+- if (is_system || ((bo_adev != adev) && coherent))
+- *flags = AMDGPU_PTE_MTYPE_GFX12(*flags, MTYPE_NC);
+-
++ if (bo && bo->flags & AMDGPU_GEM_CREATE_UNCACHED)
++ *flags = AMDGPU_PTE_MTYPE_GFX12(*flags, MTYPE_UC);
+ }
+
+ static unsigned gmc_v12_0_get_vbios_fb_size(struct amdgpu_device *adev)
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+@@ -1276,13 +1276,7 @@ svm_range_get_pte_flags(struct kfd_node
+ break;
+ case IP_VERSION(12, 0, 0):
+ case IP_VERSION(12, 0, 1):
+- if (domain == SVM_RANGE_VRAM_DOMAIN) {
+- if (bo_node != node)
+- mapping_flags |= AMDGPU_VM_MTYPE_NC;
+- } else {
+- mapping_flags |= coherent ?
+- AMDGPU_VM_MTYPE_UC : AMDGPU_VM_MTYPE_NC;
+- }
++ mapping_flags |= AMDGPU_VM_MTYPE_NC;
+ break;
+ default:
+ mapping_flags |= coherent ?
--- /dev/null
+From 542c3bb836733a1325874310d54d25b4907ed10e Mon Sep 17 00:00:00 2001
+From: Philip Yang <Philip.Yang@amd.com>
+Date: Wed, 29 Jan 2025 12:37:30 -0500
+Subject: drm/amdkfd: Fix user queue validation on Gfx7/8
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Philip Yang <Philip.Yang@amd.com>
+
+commit 542c3bb836733a1325874310d54d25b4907ed10e upstream.
+
+To workaround queue full h/w issue on Gfx7/8, when application create
+AQL queue, the ring buffer bo allocate size is queue_size/2 and
+map queue_size ring buffer to GPU in 2 pieces using 2 attachments, each
+attachment map size is queue_size/2, with same ring_bo backing memory.
+
+For Gfx7/8, user queue buffer validation should use queue_size/2 to
+verify ring_bo allocation and mapping size.
+
+Fixes: 68e599db7a54 ("drm/amdkfd: Validate user queue buffers")
+Suggested-by: Tomáš Trnka <trnka@scm.com>
+Signed-off-by: Philip Yang <Philip.Yang@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit e7a477735f1771b9a9346a5fbd09d7ff0641723a)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_queue.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
+index 24396a2c77bd..4afff7094caf 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_queue.c
+@@ -233,6 +233,7 @@ void kfd_queue_buffer_put(struct amdgpu_bo **bo)
+ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_properties *properties)
+ {
+ struct kfd_topology_device *topo_dev;
++ u64 expected_queue_size;
+ struct amdgpu_vm *vm;
+ u32 total_cwsr_size;
+ int err;
+@@ -241,6 +242,15 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope
+ if (!topo_dev)
+ return -EINVAL;
+
++ /* AQL queues on GFX7 and GFX8 appear twice their actual size */
++ if (properties->type == KFD_QUEUE_TYPE_COMPUTE &&
++ properties->format == KFD_QUEUE_FORMAT_AQL &&
++ topo_dev->node_props.gfx_target_version >= 70000 &&
++ topo_dev->node_props.gfx_target_version < 90000)
++ expected_queue_size = properties->queue_size / 2;
++ else
++ expected_queue_size = properties->queue_size;
++
+ vm = drm_priv_to_vm(pdd->drm_priv);
+ err = amdgpu_bo_reserve(vm->root.bo, false);
+ if (err)
+@@ -255,7 +265,7 @@ int kfd_queue_acquire_buffers(struct kfd_process_device *pdd, struct queue_prope
+ goto out_err_unreserve;
+
+ err = kfd_queue_buffer_get(vm, (void *)properties->queue_address,
+- &properties->ring_bo, properties->queue_size);
++ &properties->ring_bo, expected_queue_size);
+ if (err)
+ goto out_err_unreserve;
+
+--
+2.49.0
+
--- /dev/null
+From dd8689b52a24807c2d5ce0a17cb26dc87f75235c Mon Sep 17 00:00:00 2001
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Date: Tue, 11 Mar 2025 14:14:59 +0300
+Subject: drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+commit dd8689b52a24807c2d5ce0a17cb26dc87f75235c upstream.
+
+On the off chance that command stream passed from userspace via
+ioctl() call to radeon_vce_cs_parse() is weirdly crafted and
+first command to execute is to encode (case 0x03000001), the function
+in question will attempt to call radeon_vce_cs_reloc() with size
+argument that has not been properly initialized. Specifically, 'size'
+will point to 'tmp' variable before the latter had a chance to be
+assigned any value.
+
+Play it safe and init 'tmp' with 0, thus ensuring that
+radeon_vce_cs_reloc() will catch an early error in cases like these.
+
+Found by Linux Verification Center (linuxtesting.org) with static
+analysis tool SVACE.
+
+Fixes: 2fc5703abda2 ("drm/radeon: check VCE relocation buffer range v3")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/radeon/radeon_vce.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_vce.c
++++ b/drivers/gpu/drm/radeon/radeon_vce.c
+@@ -557,7 +557,7 @@ int radeon_vce_cs_parse(struct radeon_cs
+ {
+ int session_idx = -1;
+ bool destroyed = false, created = false, allocated = false;
+- uint32_t tmp, handle = 0;
++ uint32_t tmp = 0, handle = 0;
+ uint32_t *size = &tmp;
+ int i, r = 0;
+
--- /dev/null
+From a952f1ab696873be124e31ce5ef964d36bce817f Mon Sep 17 00:00:00 2001
+From: qianyi liu <liuqianyi125@gmail.com>
+Date: Tue, 11 Mar 2025 14:02:51 +0800
+Subject: drm/sched: Fix fence reference count leak
+
+From: qianyi liu <liuqianyi125@gmail.com>
+
+commit a952f1ab696873be124e31ce5ef964d36bce817f upstream.
+
+The last_scheduled fence leaks when an entity is being killed and adding
+the cleanup callback fails.
+
+Decrement the reference count of prev when dma_fence_add_callback()
+fails, ensuring proper balance.
+
+Cc: stable@vger.kernel.org # v6.2+
+[phasta: add git tag info for stable kernel]
+Fixes: 2fdb8a8f07c2 ("drm/scheduler: rework entity flush, kill and fini")
+Signed-off-by: qianyi liu <liuqianyi125@gmail.com>
+Signed-off-by: Philipp Stanner <phasta@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250311060251.4041101-1-liuqianyi125@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/scheduler/sched_entity.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/scheduler/sched_entity.c
++++ b/drivers/gpu/drm/scheduler/sched_entity.c
+@@ -259,9 +259,16 @@ static void drm_sched_entity_kill(struct
+ struct drm_sched_fence *s_fence = job->s_fence;
+
+ dma_fence_get(&s_fence->finished);
+- if (!prev || dma_fence_add_callback(prev, &job->finish_cb,
+- drm_sched_entity_kill_jobs_cb))
++ if (!prev ||
++ dma_fence_add_callback(prev, &job->finish_cb,
++ drm_sched_entity_kill_jobs_cb)) {
++ /*
++ * Adding callback above failed.
++ * dma_fence_put() checks for NULL.
++ */
++ dma_fence_put(prev);
+ drm_sched_entity_kill_jobs_cb(NULL, &job->finish_cb);
++ }
+
+ prev = &s_fence->finished;
+ }
--- /dev/null
+From 80cbee810e4e13cdbd3ae9654e9ecddf17f3e828 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ma=C3=ADra=20Canal?= <mcanal@igalia.com>
+Date: Thu, 13 Mar 2025 11:43:26 -0300
+Subject: drm/v3d: Don't run jobs that have errors flagged in its fence
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maíra Canal <mcanal@igalia.com>
+
+commit 80cbee810e4e13cdbd3ae9654e9ecddf17f3e828 upstream.
+
+The V3D driver still relies on `drm_sched_increase_karma()` and
+`drm_sched_resubmit_jobs()` for resubmissions when a timeout occurs.
+The function `drm_sched_increase_karma()` marks the job as guilty, while
+`drm_sched_resubmit_jobs()` sets an error (-ECANCELED) in the DMA fence of
+that guilty job.
+
+Because of this, we must check whether the job’s DMA fence has been
+flagged with an error before executing the job. Otherwise, the same guilty
+job may be resubmitted indefinitely, causing repeated GPU resets.
+
+This patch adds a check for an error on the job's fence to prevent running
+a guilty job that was previously flagged when the GPU timed out.
+
+Note that the CPU and CACHE_CLEAN queues do not require this check, as
+their jobs are executed synchronously once the DRM scheduler starts them.
+
+Cc: stable@vger.kernel.org
+Fixes: d223f98f0209 ("drm/v3d: Add support for compute shader dispatch.")
+Fixes: 1584f16ca96e ("drm/v3d: Add support for submitting jobs to the TFU.")
+Reviewed-by: Iago Toral Quiroga <itoral@igalia.com>
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250313-v3d-gpu-reset-fixes-v4-1-c1e780d8e096@igalia.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/v3d/v3d_sched.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/v3d/v3d_sched.c
++++ b/drivers/gpu/drm/v3d/v3d_sched.c
+@@ -319,11 +319,15 @@ v3d_tfu_job_run(struct drm_sched_job *sc
+ struct drm_device *dev = &v3d->drm;
+ struct dma_fence *fence;
+
++ if (unlikely(job->base.base.s_fence->finished.error))
++ return NULL;
++
++ v3d->tfu_job = job;
++
+ fence = v3d_fence_create(v3d, V3D_TFU);
+ if (IS_ERR(fence))
+ return NULL;
+
+- v3d->tfu_job = job;
+ if (job->base.irq_fence)
+ dma_fence_put(job->base.irq_fence);
+ job->base.irq_fence = dma_fence_get(fence);
+@@ -361,6 +365,9 @@ v3d_csd_job_run(struct drm_sched_job *sc
+ struct dma_fence *fence;
+ int i, csd_cfg0_reg;
+
++ if (unlikely(job->base.base.s_fence->finished.error))
++ return NULL;
++
+ v3d->csd_job = job;
+
+ v3d_invalidate_caches(v3d);
--- /dev/null
+From 50af7cab7520e46680cf4633bba6801443b75856 Mon Sep 17 00:00:00 2001
+From: Tomasz Rusinowicz <tomasz.rusinowicz@intel.com>
+Date: Tue, 18 Feb 2025 11:03:53 +0100
+Subject: drm/xe: Fix exporting xe buffers multiple times
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tomasz Rusinowicz <tomasz.rusinowicz@intel.com>
+
+commit 50af7cab7520e46680cf4633bba6801443b75856 upstream.
+
+The `struct ttm_resource->placement` contains TTM_PL_FLAG_* flags, but
+it was incorrectly tested for XE_PL_* flags.
+This caused xe_dma_buf_pin() to always fail when invoked for
+the second time. Fix this by checking the `mem_type` field instead.
+
+Fixes: 7764222d54b7 ("drm/xe: Disallow pinning dma-bufs in VRAM")
+Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: Lucas De Marchi <lucas.demarchi@intel.com>
+Cc: "Thomas Hellström" <thomas.hellstrom@linux.intel.com>
+Cc: Michal Wajdeczko <michal.wajdeczko@intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Cc: Matthew Auld <matthew.auld@intel.com>
+Cc: Nirmoy Das <nirmoy.das@intel.com>
+Cc: Jani Nikula <jani.nikula@intel.com>
+Cc: intel-xe@lists.freedesktop.org
+Cc: <stable@vger.kernel.org> # v6.8+
+Signed-off-by: Tomasz Rusinowicz <tomasz.rusinowicz@intel.com>
+Signed-off-by: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250218100353.2137964-1-jacek.lawrynowicz@linux.intel.com
+Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+(cherry picked from commit b96dabdba9b95f71ded50a1c094ee244408b2a8e)
+Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_bo.h | 2 --
+ drivers/gpu/drm/xe/xe_dma_buf.c | 2 +-
+ 2 files changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/xe/xe_bo.h
++++ b/drivers/gpu/drm/xe/xe_bo.h
+@@ -314,7 +314,6 @@ static inline unsigned int xe_sg_segment
+
+ #define i915_gem_object_flush_if_display(obj) ((void)(obj))
+
+-#if IS_ENABLED(CONFIG_DRM_XE_KUNIT_TEST)
+ /**
+ * xe_bo_is_mem_type - Whether the bo currently resides in the given
+ * TTM memory type
+@@ -329,4 +328,3 @@ static inline bool xe_bo_is_mem_type(str
+ return bo->ttm.resource->mem_type == mem_type;
+ }
+ #endif
+-#endif
+--- a/drivers/gpu/drm/xe/xe_dma_buf.c
++++ b/drivers/gpu/drm/xe/xe_dma_buf.c
+@@ -58,7 +58,7 @@ static int xe_dma_buf_pin(struct dma_buf
+ * 1) Avoid pinning in a placement not accessible to some importers.
+ * 2) Pinning in VRAM requires PIN accounting which is a to-do.
+ */
+- if (xe_bo_is_pinned(bo) && bo->ttm.resource->placement != XE_PL_TT) {
++ if (xe_bo_is_pinned(bo) && !xe_bo_is_mem_type(bo, XE_PL_TT)) {
+ drm_dbg(&xe->drm, "Can't migrate pinned bo for dma-buf pin.\n");
+ return -EINVAL;
+ }
--- /dev/null
+From 51f6fc9eb1d77ae5cacc796fc043dedc1f0f0073 Mon Sep 17 00:00:00 2001
+From: Biju Das <biju.das.jz@bp.renesas.com>
+Date: Fri, 7 Mar 2025 17:03:26 +0000
+Subject: dt-bindings: can: renesas,rcar-canfd: Fix typo in pattern properties for R-Car V4M
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+commit 51f6fc9eb1d77ae5cacc796fc043dedc1f0f0073 upstream.
+
+The Renesas R-Car V4M(R8A779H0) SoC, supports up to four channels.
+Fix the typo 5->4 in pattern properties.
+
+Fixes: ced52c6ed257 ("dt-bindings: can: renesas,rcar-canfd: Document R-Car V4M support")
+Cc: stable@vger.kernel.org
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Acked-by: "Rob Herring (Arm)" <robh@kernel.org>
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://patch.msgid.link/20250307170330.173425-2-biju.das.jz@bp.renesas.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ .../devicetree/bindings/net/can/renesas,rcar-canfd.yaml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/net/can/renesas,rcar-canfd.yaml b/Documentation/devicetree/bindings/net/can/renesas,rcar-canfd.yaml
+index 7c5ac5d2e880..f6884f6e59e7 100644
+--- a/Documentation/devicetree/bindings/net/can/renesas,rcar-canfd.yaml
++++ b/Documentation/devicetree/bindings/net/can/renesas,rcar-canfd.yaml
+@@ -170,7 +170,7 @@ allOf:
+ const: renesas,r8a779h0-canfd
+ then:
+ patternProperties:
+- "^channel[5-7]$": false
++ "^channel[4-7]$": false
+ else:
+ if:
+ not:
+--
+2.49.0
+
--- /dev/null
+From cb16dfed0093217a68c0faa9394fa5823927e04c Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Fri, 14 Mar 2025 12:03:33 +0100
+Subject: efi/libstub: Avoid physical address 0x0 when doing random allocation
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+commit cb16dfed0093217a68c0faa9394fa5823927e04c upstream.
+
+Ben reports spurious EFI zboot failures on a system where physical RAM
+starts at 0x0. When doing random memory allocation from the EFI stub on
+such a platform, a random seed of 0x0 (which means no entropy source is
+available) will result in the allocation to be placed at address 0x0 if
+sufficient space is available.
+
+When this allocation is subsequently passed on to the decompression
+code, the 0x0 address is mistaken for NULL and the code complains and
+gives up.
+
+So avoid address 0x0 when doing random allocation, and set the minimum
+address to the minimum alignment.
+
+Cc: <stable@vger.kernel.org>
+Reported-by: Ben Schneider <ben@bens.haus>
+Tested-by: Ben Schneider <ben@bens.haus>
+Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/firmware/efi/libstub/randomalloc.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/firmware/efi/libstub/randomalloc.c
++++ b/drivers/firmware/efi/libstub/randomalloc.c
+@@ -75,6 +75,10 @@ efi_status_t efi_random_alloc(unsigned l
+ if (align < EFI_ALLOC_ALIGN)
+ align = EFI_ALLOC_ALIGN;
+
++ /* Avoid address 0x0, as it can be mistaken for NULL */
++ if (alloc_min == 0)
++ alloc_min = align;
++
+ size = round_up(size, EFI_ALLOC_ALIGN);
+
+ /* count the suitable slots in each memory map entry */
--- /dev/null
+From da8d493a80993972c427002684d0742560f3be4a Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Mon, 20 Jan 2025 16:10:00 +0100
+Subject: firmware: qcom: uefisecapp: fix efivars registration race
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit da8d493a80993972c427002684d0742560f3be4a upstream.
+
+Since the conversion to using the TZ allocator, the efivars service is
+registered before the memory pool has been allocated, something which
+can lead to a NULL-pointer dereference in case of a racing EFI variable
+access.
+
+Make sure that all resources have been set up before registering the
+efivars.
+
+Fixes: 6612103ec35a ("firmware: qcom: qseecom: convert to using the TZ allocator")
+Cc: stable@vger.kernel.org # 6.11
+Cc: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Reviewed-by: Maximilian Luz <luzmaximilian@gmail.com>
+Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Link: https://lore.kernel.org/r/20250120151000.13870-1-johan+linaro@kernel.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/firmware/qcom/qcom_qseecom_uefisecapp.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/firmware/qcom/qcom_qseecom_uefisecapp.c
++++ b/drivers/firmware/qcom/qcom_qseecom_uefisecapp.c
+@@ -814,15 +814,6 @@ static int qcom_uefisecapp_probe(struct
+
+ qcuefi->client = container_of(aux_dev, struct qseecom_client, aux_dev);
+
+- auxiliary_set_drvdata(aux_dev, qcuefi);
+- status = qcuefi_set_reference(qcuefi);
+- if (status)
+- return status;
+-
+- status = efivars_register(&qcuefi->efivars, &qcom_efivar_ops);
+- if (status)
+- qcuefi_set_reference(NULL);
+-
+ memset(&pool_config, 0, sizeof(pool_config));
+ pool_config.initial_size = SZ_4K;
+ pool_config.policy = QCOM_TZMEM_POLICY_MULTIPLIER;
+@@ -833,6 +824,15 @@ static int qcom_uefisecapp_probe(struct
+ if (IS_ERR(qcuefi->mempool))
+ return PTR_ERR(qcuefi->mempool);
+
++ auxiliary_set_drvdata(aux_dev, qcuefi);
++ status = qcuefi_set_reference(qcuefi);
++ if (status)
++ return status;
++
++ status = efivars_register(&qcuefi->efivars, &qcom_efivar_ops);
++ if (status)
++ qcuefi_set_reference(NULL);
++
+ return status;
+ }
+
--- /dev/null
+From 285df995f90e3d61d97f327d34b9659d92313314 Mon Sep 17 00:00:00 2001
+From: Andreas Kemnade <andreas@kemnade.info>
+Date: Fri, 28 Feb 2025 15:04:20 +0100
+Subject: i2c: omap: fix IRQ storms
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+commit 285df995f90e3d61d97f327d34b9659d92313314 upstream.
+
+On the GTA04A5 writing a reset command to the gyroscope causes IRQ
+storms because NACK IRQs are enabled and therefore triggered but not
+acked.
+
+Sending a reset command to the gyroscope by
+i2cset 1 0x69 0x14 0xb6
+with an additional debug print in the ISR (not the thread) itself
+causes
+
+[ 363.353515] i2c i2c-1: ioctl, cmd=0x720, arg=0xbe801b00
+[ 363.359039] omap_i2c 48072000.i2c: addr: 0x0069, len: 2, flags: 0x0, stop: 1
+[ 363.366180] omap_i2c 48072000.i2c: IRQ LL (ISR = 0x1110)
+[ 363.371673] omap_i2c 48072000.i2c: IRQ (ISR = 0x0010)
+[ 363.376892] omap_i2c 48072000.i2c: IRQ LL (ISR = 0x0102)
+[ 363.382263] omap_i2c 48072000.i2c: IRQ LL (ISR = 0x0102)
+[ 363.387664] omap_i2c 48072000.i2c: IRQ LL (ISR = 0x0102)
+repeating till infinity
+[...]
+(0x2 = NACK, 0x100 = Bus free, which is not enabled)
+Apparently no other IRQ bit gets set, so this stalls.
+
+Do not ignore enabled interrupts and make sure they are acked.
+If the NACK IRQ is not needed, it should simply not enabled, but
+according to the above log, caring about it is necessary unless
+the Bus free IRQ is enabled and handled. The assumption that is
+will always come with a ARDY IRQ, which was the idea behind
+ignoring it, proves wrong.
+It is true for simple reads from an unused address.
+
+To still avoid the i2cdetect trouble which is the reason for
+commit c770657bd261 ("i2c: omap: Fix standard mode false ACK readings"),
+avoid doing much about NACK in omap_i2c_xfer_data() which is used
+by both IRQ mode and polling mode, so also the false detection fix
+is extended to polling usage and IRQ storms are avoided.
+
+By changing this, the hardirq handler is not needed anymore to filter
+stuff.
+
+The mentioned gyro reset now just causes a -ETIMEDOUT instead of
+hanging the system.
+
+Fixes: c770657bd261 ("i2c: omap: Fix standard mode false ACK readings").
+CC: stable@kernel.org
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Tested-by: Nishanth Menon <nm@ti.com>
+Reviewed-by: Aniket Limaye <a-limaye@ti.com>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Link: https://lore.kernel.org/r/20250228140420.379498-1-andreas@kemnade.info
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-omap.c | 26 +++++++-------------------
+ 1 file changed, 7 insertions(+), 19 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-omap.c
++++ b/drivers/i2c/busses/i2c-omap.c
+@@ -1048,23 +1048,6 @@ static int omap_i2c_transmit_data(struct
+ return 0;
+ }
+
+-static irqreturn_t
+-omap_i2c_isr(int irq, void *dev_id)
+-{
+- struct omap_i2c_dev *omap = dev_id;
+- irqreturn_t ret = IRQ_HANDLED;
+- u16 mask;
+- u16 stat;
+-
+- stat = omap_i2c_read_reg(omap, OMAP_I2C_STAT_REG);
+- mask = omap_i2c_read_reg(omap, OMAP_I2C_IE_REG) & ~OMAP_I2C_STAT_NACK;
+-
+- if (stat & mask)
+- ret = IRQ_WAKE_THREAD;
+-
+- return ret;
+-}
+-
+ static int omap_i2c_xfer_data(struct omap_i2c_dev *omap)
+ {
+ u16 bits;
+@@ -1095,8 +1078,13 @@ static int omap_i2c_xfer_data(struct oma
+ }
+
+ if (stat & OMAP_I2C_STAT_NACK) {
+- err |= OMAP_I2C_STAT_NACK;
++ omap->cmd_err |= OMAP_I2C_STAT_NACK;
+ omap_i2c_ack_stat(omap, OMAP_I2C_STAT_NACK);
++
++ if (!(stat & ~OMAP_I2C_STAT_NACK)) {
++ err = -EAGAIN;
++ break;
++ }
+ }
+
+ if (stat & OMAP_I2C_STAT_AL) {
+@@ -1472,7 +1460,7 @@ omap_i2c_probe(struct platform_device *p
+ IRQF_NO_SUSPEND, pdev->name, omap);
+ else
+ r = devm_request_threaded_irq(&pdev->dev, omap->irq,
+- omap_i2c_isr, omap_i2c_isr_thread,
++ NULL, omap_i2c_isr_thread,
+ IRQF_NO_SUSPEND | IRQF_ONESHOT,
+ pdev->name, omap);
+
--- /dev/null
+From cc34d8330e036b6bffa88db9ea537bae6b03948f Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Thu, 20 Mar 2025 12:25:12 -0600
+Subject: io_uring/net: don't clear REQ_F_NEED_CLEANUP unconditionally
+
+From: Jens Axboe <axboe@kernel.dk>
+
+commit cc34d8330e036b6bffa88db9ea537bae6b03948f upstream.
+
+io_req_msg_cleanup() relies on the fact that io_netmsg_recycle() will
+always fully recycle, but that may not be the case if the msg cache
+was already full. To ensure that normal cleanup always gets run,
+let io_netmsg_recycle() deal with clearing the relevant cleanup flags,
+as it knows exactly when that should be done.
+
+Cc: stable@vger.kernel.org
+Reported-by: David Wei <dw@davidwei.uk>
+Fixes: 75191341785e ("io_uring/net: add iovec recycling")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/net.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/io_uring/net.c
++++ b/io_uring/net.c
+@@ -152,7 +152,7 @@ static void io_netmsg_recycle(struct io_
+ if (iov)
+ kasan_mempool_poison_object(iov);
+ req->async_data = NULL;
+- req->flags &= ~REQ_F_ASYNC_DATA;
++ req->flags &= ~(REQ_F_ASYNC_DATA|REQ_F_NEED_CLEANUP);
+ }
+ }
+
+@@ -447,7 +447,6 @@ int io_sendmsg_prep(struct io_kiocb *req
+ static void io_req_msg_cleanup(struct io_kiocb *req,
+ unsigned int issue_flags)
+ {
+- req->flags &= ~REQ_F_NEED_CLEANUP;
+ io_netmsg_recycle(req, issue_flags);
+ }
+
--- /dev/null
+From 75845c6c1a64483e9985302793dbf0dfa5f71e32 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Wed, 19 Mar 2025 15:57:46 +0000
+Subject: keys: Fix UAF in key_put()
+
+From: David Howells <dhowells@redhat.com>
+
+commit 75845c6c1a64483e9985302793dbf0dfa5f71e32 upstream.
+
+Once a key's reference count has been reduced to 0, the garbage collector
+thread may destroy it at any time and so key_put() is not allowed to touch
+the key after that point. The most key_put() is normally allowed to do is
+to touch key_gc_work as that's a static global variable.
+
+However, in an effort to speed up the reclamation of quota, this is now
+done in key_put() once the key's usage is reduced to 0 - but now the code
+is looking at the key after the deadline, which is forbidden.
+
+Fix this by using a flag to indicate that a key can be gc'd now rather than
+looking at the key's refcount in the garbage collector.
+
+Fixes: 9578e327b2b4 ("keys: update key quotas in key_put()")
+Reported-by: syzbot+6105ffc1ded71d194d6d@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/673b6aec.050a0220.87769.004a.GAE@google.com/
+Signed-off-by: David Howells <dhowells@redhat.com>
+Tested-by: syzbot+6105ffc1ded71d194d6d@syzkaller.appspotmail.com
+Reviewed-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/key.h | 1 +
+ security/keys/gc.c | 4 +++-
+ security/keys/key.c | 2 ++
+ 3 files changed, 6 insertions(+), 1 deletion(-)
+
+--- a/include/linux/key.h
++++ b/include/linux/key.h
+@@ -236,6 +236,7 @@ struct key {
+ #define KEY_FLAG_ROOT_CAN_INVAL 7 /* set if key can be invalidated by root without permission */
+ #define KEY_FLAG_KEEP 8 /* set if key should not be removed */
+ #define KEY_FLAG_UID_KEYRING 9 /* set if key is a user or user session keyring */
++#define KEY_FLAG_FINAL_PUT 10 /* set if final put has happened on key */
+
+ /* the key type and key description string
+ * - the desc is used to match a key against search criteria
+--- a/security/keys/gc.c
++++ b/security/keys/gc.c
+@@ -218,8 +218,10 @@ continue_scanning:
+ key = rb_entry(cursor, struct key, serial_node);
+ cursor = rb_next(cursor);
+
+- if (refcount_read(&key->usage) == 0)
++ if (test_bit(KEY_FLAG_FINAL_PUT, &key->flags)) {
++ smp_mb(); /* Clobber key->user after FINAL_PUT seen. */
+ goto found_unreferenced_key;
++ }
+
+ if (unlikely(gc_state & KEY_GC_REAPING_DEAD_1)) {
+ if (key->type == key_gc_dead_keytype) {
+--- a/security/keys/key.c
++++ b/security/keys/key.c
+@@ -658,6 +658,8 @@ void key_put(struct key *key)
+ key->user->qnbytes -= key->quotalen;
+ spin_unlock_irqrestore(&key->user->lock, flags);
+ }
++ smp_mb(); /* key->user before FINAL_PUT set. */
++ set_bit(KEY_FLAG_FINAL_PUT, &key->flags);
+ schedule_work(&key_gc_work);
+ }
+ }
--- /dev/null
+From 9f01b4954490d4ccdbcc2b9be34a9921ceee9cbb Mon Sep 17 00:00:00 2001
+From: Shakeel Butt <shakeel.butt@linux.dev>
+Date: Mon, 10 Mar 2025 16:09:34 -0700
+Subject: memcg: drain obj stock on cpu hotplug teardown
+
+From: Shakeel Butt <shakeel.butt@linux.dev>
+
+commit 9f01b4954490d4ccdbcc2b9be34a9921ceee9cbb upstream.
+
+Currently on cpu hotplug teardown, only memcg stock is drained but we
+need to drain the obj stock as well otherwise we will miss the stats
+accumulated on the target cpu as well as the nr_bytes cached. The stats
+include MEMCG_KMEM, NR_SLAB_RECLAIMABLE_B & NR_SLAB_UNRECLAIMABLE_B. In
+addition we are leaking reference to struct obj_cgroup object.
+
+Link: https://lkml.kernel.org/r/20250310230934.2913113-1-shakeel.butt@linux.dev
+Fixes: bf4f059954dc ("mm: memcg/slab: obj_cgroup API")
+Signed-off-by: Shakeel Butt <shakeel.butt@linux.dev>
+Reviewed-by: Roman Gushchin <roman.gushchin@linux.dev>
+Acked-by: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Muchun Song <muchun.song@linux.dev>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/memcontrol.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -1882,9 +1882,18 @@ void drain_all_stock(struct mem_cgroup *
+ static int memcg_hotplug_cpu_dead(unsigned int cpu)
+ {
+ struct memcg_stock_pcp *stock;
++ struct obj_cgroup *old;
++ unsigned long flags;
+
+ stock = &per_cpu(memcg_stock, cpu);
++
++ /* drain_obj_stock requires stock_lock */
++ local_lock_irqsave(&memcg_stock.stock_lock, flags);
++ old = drain_obj_stock(stock);
++ local_unlock_irqrestore(&memcg_stock.stock_lock, flags);
++
+ drain_stock(stock);
++ obj_cgroup_put(old);
+
+ return 0;
+ }
--- /dev/null
+From 182db972c9568dc530b2f586a2f82dfd039d9f2a Mon Sep 17 00:00:00 2001
+From: "Raphael S. Carvalho" <raphaelsc@scylladb.com>
+Date: Mon, 24 Feb 2025 11:37:00 -0300
+Subject: mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Raphael S. Carvalho <raphaelsc@scylladb.com>
+
+commit 182db972c9568dc530b2f586a2f82dfd039d9f2a upstream.
+
+original report:
+https://lore.kernel.org/all/CAKhLTr1UL3ePTpYjXOx2AJfNk8Ku2EdcEfu+CH1sf3Asr=B-Dw@mail.gmail.com/T/
+
+When doing buffered writes with FGP_NOWAIT, under memory pressure, the
+system returned ENOMEM despite there being plenty of available memory, to
+be reclaimed from page cache. The user space used io_uring interface,
+which in turn submits I/O with FGP_NOWAIT (the fast path).
+
+retsnoop pointed to iomap_get_folio:
+
+00:34:16.180612 -> 00:34:16.180651 TID/PID 253786/253721
+(reactor-1/combined_tests):
+
+ entry_SYSCALL_64_after_hwframe+0x76
+ do_syscall_64+0x82
+ __do_sys_io_uring_enter+0x265
+ io_submit_sqes+0x209
+ io_issue_sqe+0x5b
+ io_write+0xdd
+ xfs_file_buffered_write+0x84
+ iomap_file_buffered_write+0x1a6
+ 32us [-ENOMEM] iomap_write_begin+0x408
+iter=&{.inode=0xffff8c67aa031138,.len=4096,.flags=33,.iomap={.addr=0xffffffffffffffff,.length=4096,.type=1,.flags=3,.bdev=0x…
+pos=0 len=4096 foliop=0xffffb32c296b7b80
+! 4us [-ENOMEM] iomap_get_folio
+iter=&{.inode=0xffff8c67aa031138,.len=4096,.flags=33,.iomap={.addr=0xffffffffffffffff,.length=4096,.type=1,.flags=3,.bdev=0x…
+pos=0 len=4096
+
+This is likely a regression caused by 66dabbb65d67 ("mm: return an ERR_PTR
+from __filemap_get_folio"), which moved error handling from
+io_map_get_folio() to __filemap_get_folio(), but broke FGP_NOWAIT
+handling, so ENOMEM is being escaped to user space. Had it correctly
+returned -EAGAIN with NOWAIT, either io_uring or user space itself would
+be able to retry the request.
+
+It's not enough to patch io_uring since the iomap interface is the one
+responsible for it, and pwritev2(RWF_NOWAIT) and AIO interfaces must
+return the proper error too.
+
+The patch was tested with scylladb test suite (its original reproducer),
+and the tests all pass now when memory is pressured.
+
+Link: https://lkml.kernel.org/r/20250224143700.23035-1-raphaelsc@scylladb.com
+Fixes: 66dabbb65d67 ("mm: return an ERR_PTR from __filemap_get_folio")
+Signed-off-by: Raphael S. Carvalho <raphaelsc@scylladb.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Cc: "Darrick J. Wong" <djwong@kernel.org>
+Cc: Matthew Wilcow (Oracle) <willy@infradead.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/filemap.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -1966,8 +1966,19 @@ no_page:
+
+ if (err == -EEXIST)
+ goto repeat;
+- if (err)
++ if (err) {
++ /*
++ * When NOWAIT I/O fails to allocate folios this could
++ * be due to a nonblocking memory allocation and not
++ * because the system actually is out of memory.
++ * Return -EAGAIN so that there caller retries in a
++ * blocking fashion instead of propagating -ENOMEM
++ * to the application.
++ */
++ if ((fgp_flags & FGP_NOWAIT) && err == -ENOMEM)
++ err = -EAGAIN;
+ return ERR_PTR(err);
++ }
+ /*
+ * filemap_add_folio locks the page, and for mmap
+ * we expect an unlocked page.
--- /dev/null
+From 60cf233b585cdf1f3c5e52d1225606b86acd08b0 Mon Sep 17 00:00:00 2001
+From: Zi Yan <ziy@nvidia.com>
+Date: Wed, 5 Mar 2025 15:04:03 -0500
+Subject: mm/migrate: fix shmem xarray update during migration
+
+From: Zi Yan <ziy@nvidia.com>
+
+commit 60cf233b585cdf1f3c5e52d1225606b86acd08b0 upstream.
+
+A shmem folio can be either in page cache or in swap cache, but not at the
+same time. Namely, once it is in swap cache, folio->mapping should be
+NULL, and the folio is no longer in a shmem mapping.
+
+In __folio_migrate_mapping(), to determine the number of xarray entries to
+update, folio_test_swapbacked() is used, but that conflates shmem in page
+cache case and shmem in swap cache case. It leads to xarray multi-index
+entry corruption, since it turns a sibling entry to a normal entry during
+xas_store() (see [1] for a userspace reproduction). Fix it by only using
+folio_test_swapcache() to determine whether xarray is storing swap cache
+entries or not to choose the right number of xarray entries to update.
+
+[1] https://lore.kernel.org/linux-mm/Z8idPCkaJW1IChjT@casper.infradead.org/
+
+Note:
+In __split_huge_page(), folio_test_anon() && folio_test_swapcache() is
+used to get swap_cache address space, but that ignores the shmem folio in
+swap cache case. It could lead to NULL pointer dereferencing when a
+in-swap-cache shmem folio is split at __xa_store(), since
+!folio_test_anon() is true and folio->mapping is NULL. But fortunately,
+its caller split_huge_page_to_list_to_order() bails out early with EBUSY
+when folio->mapping is NULL. So no need to take care of it here.
+
+Link: https://lkml.kernel.org/r/20250305200403.2822855-1-ziy@nvidia.com
+Fixes: fc346d0a70a1 ("mm: migrate high-order folios in swap cache correctly")
+Signed-off-by: Zi Yan <ziy@nvidia.com>
+Reported-by: Liu Shixin <liushixin2@huawei.com>
+Closes: https://lore.kernel.org/all/28546fb4-5210-bf75-16d6-43e1f8646080@huawei.com/
+Suggested-by: Hugh Dickins <hughd@google.com>
+Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
+Cc: Barry Song <baohua@kernel.org>
+Cc: Charan Teja Kalla <quic_charante@quicinc.com>
+Cc: David Hildenbrand <david@redhat.com>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: Lance Yang <ioworker0@gmail.com>
+Cc: Ryan Roberts <ryan.roberts@arm.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/migrate.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -526,15 +526,13 @@ static int __folio_migrate_mapping(struc
+ if (folio_test_anon(folio) && folio_test_large(folio))
+ mod_mthp_stat(folio_order(folio), MTHP_STAT_NR_ANON, 1);
+ folio_ref_add(newfolio, nr); /* add cache reference */
+- if (folio_test_swapbacked(folio)) {
++ if (folio_test_swapbacked(folio))
+ __folio_set_swapbacked(newfolio);
+- if (folio_test_swapcache(folio)) {
+- folio_set_swapcache(newfolio);
+- newfolio->private = folio_get_private(folio);
+- }
++ if (folio_test_swapcache(folio)) {
++ folio_set_swapcache(newfolio);
++ newfolio->private = folio_get_private(folio);
+ entries = nr;
+ } else {
+- VM_BUG_ON_FOLIO(folio_test_swapcache(folio), folio);
+ entries = 1;
+ }
+
--- /dev/null
+From 800f1059c99e2b39899bdc67a7593a7bea6375d8 Mon Sep 17 00:00:00 2001
+From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+Date: Mon, 10 Mar 2025 10:28:55 +0200
+Subject: mm/page_alloc: fix memory accept before watermarks gets initialized
+
+From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+
+commit 800f1059c99e2b39899bdc67a7593a7bea6375d8 upstream.
+
+Watermarks are initialized during the postcore initcall. Until then, all
+watermarks are set to zero. This causes cond_accept_memory() to
+incorrectly skip memory acceptance because a watermark of 0 is always met.
+
+This can lead to a premature OOM on boot.
+
+To ensure progress, accept one MAX_ORDER page if the watermark is zero.
+
+Link: https://lkml.kernel.org/r/20250310082855.2587122-1-kirill.shutemov@linux.intel.com
+Fixes: dcdfdd40fa82 ("mm: Add support for unaccepted memory")
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Tested-by: Farrah Chen <farrah.chen@intel.com>
+Reported-by: Farrah Chen <farrah.chen@intel.com>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Cc: Ashish Kalra <ashish.kalra@amd.com>
+Cc: David Hildenbrand <david@redhat.com>
+Cc: "Edgecombe, Rick P" <rick.p.edgecombe@intel.com>
+Cc: Mel Gorman <mgorman@techsingularity.net>
+Cc: "Mike Rapoport (IBM)" <rppt@kernel.org>
+Cc: Thomas Lendacky <thomas.lendacky@amd.com>
+Cc: <stable@vger.kernel.org> [6.5+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/page_alloc.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -7094,7 +7094,7 @@ static inline bool has_unaccepted_memory
+
+ static bool cond_accept_memory(struct zone *zone, unsigned int order)
+ {
+- long to_accept;
++ long to_accept, wmark;
+ bool ret = false;
+
+ if (!has_unaccepted_memory())
+@@ -7103,8 +7103,18 @@ static bool cond_accept_memory(struct zo
+ if (list_empty(&zone->unaccepted_pages))
+ return false;
+
++ wmark = promo_wmark_pages(zone);
++
++ /*
++ * Watermarks have not been initialized yet.
++ *
++ * Accepting one MAX_ORDER page to ensure progress.
++ */
++ if (!wmark)
++ return try_to_accept_memory_one(zone);
++
+ /* How much to accept to get to promo watermark? */
+- to_accept = promo_wmark_pages(zone) -
++ to_accept = wmark -
+ (zone_page_state(zone, NR_FREE_PAGES) -
+ __zone_watermark_unusable_free(zone, order, 0) -
+ zone_page_state(zone, NR_UNACCEPTED));
--- /dev/null
+From e51a349d2dcf1df8422dabb90b2f691dc7df6f92 Mon Sep 17 00:00:00 2001
+From: Gu Bowen <gubowen5@huawei.com>
+Date: Tue, 25 Feb 2025 10:28:56 +0800
+Subject: mmc: atmel-mci: Add missing clk_disable_unprepare()
+
+From: Gu Bowen <gubowen5@huawei.com>
+
+commit e51a349d2dcf1df8422dabb90b2f691dc7df6f92 upstream.
+
+The error path when atmci_configure_dma() set dma fails in atmci driver
+does not correctly disable the clock.
+Add the missing clk_disable_unprepare() to the error path for pair with
+clk_prepare_enable().
+
+Fixes: 467e081d23e6 ("mmc: atmel-mci: use probe deferring if dma controller is not ready yet")
+Signed-off-by: Gu Bowen <gubowen5@huawei.com>
+Acked-by: Aubin Constans <aubin.constans@microchip.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20250225022856.3452240-1-gubowen5@huawei.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/atmel-mci.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/atmel-mci.c
++++ b/drivers/mmc/host/atmel-mci.c
+@@ -2499,8 +2499,10 @@ static int atmci_probe(struct platform_d
+ /* Get MCI capabilities and set operations according to it */
+ atmci_get_cap(host);
+ ret = atmci_configure_dma(host);
+- if (ret == -EPROBE_DEFER)
++ if (ret == -EPROBE_DEFER) {
++ clk_disable_unprepare(host->mck);
+ goto err_dma_probe_defer;
++ }
+ if (ret == 0) {
+ host->prepare_data = &atmci_prepare_data_dma;
+ host->submit_data = &atmci_submit_data_dma;
--- /dev/null
+From 723ef0e20dbb2aa1b5406d2bb75374fc48187daa Mon Sep 17 00:00:00 2001
+From: Kamal Dasu <kamal.dasu@broadcom.com>
+Date: Tue, 11 Mar 2025 12:59:35 -0400
+Subject: mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops
+
+From: Kamal Dasu <kamal.dasu@broadcom.com>
+
+commit 723ef0e20dbb2aa1b5406d2bb75374fc48187daa upstream.
+
+cqhci timeouts observed on brcmstb platforms during suspend:
+ ...
+ [ 164.832853] mmc0: cqhci: timeout for tag 18
+ ...
+
+Adding cqhci_suspend()/resume() calls to disable cqe
+in sdhci_brcmstb_suspend()/resume() respectively to fix
+CQE timeouts seen on PM suspend.
+
+Fixes: d46ba2d17f90 ("mmc: sdhci-brcmstb: Add support for Command Queuing (CQE)")
+Cc: stable@vger.kernel.org
+Signed-off-by: Kamal Dasu <kamal.dasu@broadcom.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Link: https://lore.kernel.org/r/20250311165946.28190-1-kamal.dasu@broadcom.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci-brcmstb.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/mmc/host/sdhci-brcmstb.c
++++ b/drivers/mmc/host/sdhci-brcmstb.c
+@@ -503,8 +503,15 @@ static int sdhci_brcmstb_suspend(struct
+ struct sdhci_host *host = dev_get_drvdata(dev);
+ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ struct sdhci_brcmstb_priv *priv = sdhci_pltfm_priv(pltfm_host);
++ int ret;
+
+ clk_disable_unprepare(priv->base_clk);
++ if (host->mmc->caps2 & MMC_CAP2_CQE) {
++ ret = cqhci_suspend(host->mmc);
++ if (ret)
++ return ret;
++ }
++
+ return sdhci_pltfm_suspend(dev);
+ }
+
+@@ -529,6 +536,9 @@ static int sdhci_brcmstb_resume(struct d
+ ret = clk_set_rate(priv->base_clk, priv->base_freq_hz);
+ }
+
++ if (host->mmc->caps2 & MMC_CAP2_CQE)
++ ret = cqhci_resume(host->mmc);
++
+ return ret;
+ }
+ #endif
--- /dev/null
+From 2fc8a346625eb1abfe202062c7e6a13d76cde5ea Mon Sep 17 00:00:00 2001
+From: Haiyang Zhang <haiyangz@microsoft.com>
+Date: Tue, 11 Mar 2025 13:12:54 -0700
+Subject: net: mana: Support holes in device list reply msg
+
+From: Haiyang Zhang <haiyangz@microsoft.com>
+
+commit 2fc8a346625eb1abfe202062c7e6a13d76cde5ea upstream.
+
+According to GDMA protocol, holes (zeros) are allowed at the beginning
+or middle of the gdma_list_devices_resp message. The existing code
+cannot properly handle this, and may miss some devices in the list.
+
+To fix, scan the entire list until the num_of_devs are found, or until
+the end of the list.
+
+Cc: stable@vger.kernel.org
+Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)")
+Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
+Reviewed-by: Long Li <longli@microsoft.com>
+Reviewed-by: Shradha Gupta <shradhagupta@microsoft.com>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Link: https://patch.msgid.link/1741723974-1534-1-git-send-email-haiyangz@microsoft.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/microsoft/mana/gdma_main.c | 14 ++++++++++----
+ include/net/mana/gdma.h | 11 +++++++----
+ 2 files changed, 17 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/microsoft/mana/gdma_main.c
++++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c
+@@ -131,9 +131,10 @@ static int mana_gd_detect_devices(struct
+ struct gdma_list_devices_resp resp = {};
+ struct gdma_general_req req = {};
+ struct gdma_dev_id dev;
+- u32 i, max_num_devs;
++ int found_dev = 0;
+ u16 dev_type;
+ int err;
++ u32 i;
+
+ mana_gd_init_req_hdr(&req.hdr, GDMA_LIST_DEVICES, sizeof(req),
+ sizeof(resp));
+@@ -145,12 +146,17 @@ static int mana_gd_detect_devices(struct
+ return err ? err : -EPROTO;
+ }
+
+- max_num_devs = min_t(u32, MAX_NUM_GDMA_DEVICES, resp.num_of_devs);
+-
+- for (i = 0; i < max_num_devs; i++) {
++ for (i = 0; i < GDMA_DEV_LIST_SIZE &&
++ found_dev < resp.num_of_devs; i++) {
+ dev = resp.devs[i];
+ dev_type = dev.type;
+
++ /* Skip empty devices */
++ if (dev.as_uint32 == 0)
++ continue;
++
++ found_dev++;
++
+ /* HWC is already detected in mana_hwc_create_channel(). */
+ if (dev_type == GDMA_DEVICE_HWC)
+ continue;
+--- a/include/net/mana/gdma.h
++++ b/include/net/mana/gdma.h
+@@ -406,8 +406,6 @@ struct gdma_context {
+ struct gdma_dev mana_ib;
+ };
+
+-#define MAX_NUM_GDMA_DEVICES 4
+-
+ static inline bool mana_gd_is_mana(struct gdma_dev *gd)
+ {
+ return gd->dev_id.type == GDMA_DEVICE_MANA;
+@@ -554,11 +552,15 @@ enum {
+ #define GDMA_DRV_CAP_FLAG_1_HWC_TIMEOUT_RECONFIG BIT(3)
+ #define GDMA_DRV_CAP_FLAG_1_VARIABLE_INDIRECTION_TABLE_SUPPORT BIT(5)
+
++/* Driver can handle holes (zeros) in the device list */
++#define GDMA_DRV_CAP_FLAG_1_DEV_LIST_HOLES_SUP BIT(11)
++
+ #define GDMA_DRV_CAP_FLAGS1 \
+ (GDMA_DRV_CAP_FLAG_1_EQ_SHARING_MULTI_VPORT | \
+ GDMA_DRV_CAP_FLAG_1_NAPI_WKDONE_FIX | \
+ GDMA_DRV_CAP_FLAG_1_HWC_TIMEOUT_RECONFIG | \
+- GDMA_DRV_CAP_FLAG_1_VARIABLE_INDIRECTION_TABLE_SUPPORT)
++ GDMA_DRV_CAP_FLAG_1_VARIABLE_INDIRECTION_TABLE_SUPPORT | \
++ GDMA_DRV_CAP_FLAG_1_DEV_LIST_HOLES_SUP)
+
+ #define GDMA_DRV_CAP_FLAGS2 0
+
+@@ -619,11 +621,12 @@ struct gdma_query_max_resources_resp {
+ }; /* HW DATA */
+
+ /* GDMA_LIST_DEVICES */
++#define GDMA_DEV_LIST_SIZE 64
+ struct gdma_list_devices_resp {
+ struct gdma_resp_hdr hdr;
+ u32 num_of_devs;
+ u32 reserved;
+- struct gdma_dev_id devs[64];
++ struct gdma_dev_id devs[GDMA_DEV_LIST_SIZE];
+ }; /* HW DATA */
+
+ /* GDMA_REGISTER_DEVICE */
--- /dev/null
+From 344b7ef248f420ed4ba3a3539cb0a0fc18df9a6c Mon Sep 17 00:00:00 2001
+From: Max Kellermann <max.kellermann@ionos.com>
+Date: Fri, 14 Mar 2025 16:41:57 +0000
+Subject: netfs: Call `invalidate_cache` only if implemented
+
+From: Max Kellermann <max.kellermann@ionos.com>
+
+commit 344b7ef248f420ed4ba3a3539cb0a0fc18df9a6c upstream.
+
+Many filesystems such as NFS and Ceph do not implement the
+`invalidate_cache` method. On those filesystems, if writing to the
+cache (`NETFS_WRITE_TO_CACHE`) fails for some reason, the kernel
+crashes like this:
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000000
+ #PF: supervisor instruction fetch in kernel mode
+ #PF: error_code(0x0010) - not-present page
+ PGD 0 P4D 0
+ Oops: Oops: 0010 [#1] SMP PTI
+ CPU: 9 UID: 0 PID: 3380 Comm: kworker/u193:11 Not tainted 6.13.3-cm4all1-hp #437
+ Hardware name: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 10/17/2018
+ Workqueue: events_unbound netfs_write_collection_worker
+ RIP: 0010:0x0
+ Code: Unable to access opcode bytes at 0xffffffffffffffd6.
+ RSP: 0018:ffff9b86e2ca7dc0 EFLAGS: 00010202
+ RAX: 0000000000000000 RBX: 0000000000000000 RCX: 7fffffffffffffff
+ RDX: 0000000000000001 RSI: ffff89259d576a18 RDI: ffff89259d576900
+ RBP: ffff89259d5769b0 R08: ffff9b86e2ca7d28 R09: 0000000000000002
+ R10: ffff89258ceaca80 R11: 0000000000000001 R12: 0000000000000020
+ R13: ffff893d158b9338 R14: ffff89259d576900 R15: ffff89259d5769b0
+ FS: 0000000000000000(0000) GS:ffff893c9fa40000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: ffffffffffffffd6 CR3: 000000054442e003 CR4: 00000000001706f0
+ Call Trace:
+ <TASK>
+ ? __die+0x1f/0x60
+ ? page_fault_oops+0x15c/0x460
+ ? try_to_wake_up+0x2d2/0x530
+ ? exc_page_fault+0x5e/0x100
+ ? asm_exc_page_fault+0x22/0x30
+ netfs_write_collection_worker+0xe9f/0x12b0
+ ? xs_poll_check_readable+0x3f/0x80
+ ? xs_stream_data_receive_workfn+0x8d/0x110
+ process_one_work+0x134/0x2d0
+ worker_thread+0x299/0x3a0
+ ? __pfx_worker_thread+0x10/0x10
+ kthread+0xba/0xe0
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork+0x30/0x50
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork_asm+0x1a/0x30
+ </TASK>
+ Modules linked in:
+ CR2: 0000000000000000
+
+This patch adds the missing `NULL` check.
+
+Fixes: 0e0f2dfe880f ("netfs: Dispatch write requests to process a writeback slice")
+Fixes: 288ace2f57c9 ("netfs: New writeback implementation")
+Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://lore.kernel.org/r/20250314164201.1993231-3-dhowells@redhat.com
+Acked-by: "Paulo Alcantara (Red Hat)" <pc@manguebit.com>
+cc: netfs@lists.linux.dev
+cc: linux-cifs@vger.kernel.org
+cc: linux-fsdevel@vger.kernel.org
+cc: stable@vger.kernel.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/netfs/write_collect.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/netfs/write_collect.c
++++ b/fs/netfs/write_collect.c
+@@ -576,7 +576,8 @@ void netfs_write_collection_worker(struc
+ trace_netfs_rreq(wreq, netfs_rreq_trace_write_done);
+
+ if (wreq->io_streams[1].active &&
+- wreq->io_streams[1].failed) {
++ wreq->io_streams[1].failed &&
++ ictx->ops->invalidate_cache) {
+ /* Cache write failure doesn't prevent writeback completion
+ * unless we're in disconnected mode.
+ */
--- /dev/null
+From ef17b519088ee0c167cf507820609732ec8bad1a Mon Sep 17 00:00:00 2001
+From: Xianwei Zhao <xianwei.zhao@amlogic.com>
+Date: Mon, 3 Mar 2025 17:06:05 +0800
+Subject: pmdomain: amlogic: fix T7 ISP secpower
+
+From: Xianwei Zhao <xianwei.zhao@amlogic.com>
+
+commit ef17b519088ee0c167cf507820609732ec8bad1a upstream.
+
+ISP and MIPI_ISP, these two have a parent-child relationship,
+ISP depends on MIPI_ISP.
+
+Fixes: ca75e4b214c6 ("pmdomain: amlogic: Add support for T7 power domains controller")
+Signed-off-by: Xianwei Zhao <xianwei.zhao@amlogic.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20250303-fix-t7-pwrc-v1-1-b563612bcd86@amlogic.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pmdomain/amlogic/meson-secure-pwrc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pmdomain/amlogic/meson-secure-pwrc.c
++++ b/drivers/pmdomain/amlogic/meson-secure-pwrc.c
+@@ -221,7 +221,7 @@ static const struct meson_secure_pwrc_do
+ SEC_PD(T7_VI_CLK2, 0),
+ /* ETH is for ethernet online wakeup, and should be always on */
+ SEC_PD(T7_ETH, GENPD_FLAG_ALWAYS_ON),
+- SEC_PD(T7_ISP, 0),
++ TOP_PD(T7_ISP, 0, PWRC_T7_MIPI_ISP_ID),
+ SEC_PD(T7_MIPI_ISP, 0),
+ TOP_PD(T7_GDC, 0, PWRC_T7_NIC3_ID),
+ TOP_PD(T7_DEWARP, 0, PWRC_T7_NIC3_ID),
--- /dev/null
+From 654b33ada4ab5e926cd9c570196fefa7bec7c1df Mon Sep 17 00:00:00 2001
+From: Ye Bin <yebin10@huawei.com>
+Date: Sat, 1 Mar 2025 15:06:24 +0300
+Subject: proc: fix UAF in proc_get_inode()
+
+From: Ye Bin <yebin10@huawei.com>
+
+commit 654b33ada4ab5e926cd9c570196fefa7bec7c1df upstream.
+
+Fix race between rmmod and /proc/XXX's inode instantiation.
+
+The bug is that pde->proc_ops don't belong to /proc, it belongs to a
+module, therefore dereferencing it after /proc entry has been registered
+is a bug unless use_pde/unuse_pde() pair has been used.
+
+use_pde/unuse_pde can be avoided (2 atomic ops!) because pde->proc_ops
+never changes so information necessary for inode instantiation can be
+saved _before_ proc_register() in PDE itself and used later, avoiding
+pde->proc_ops->... dereference.
+
+ rmmod lookup
+sys_delete_module
+ proc_lookup_de
+ pde_get(de);
+ proc_get_inode(dir->i_sb, de);
+ mod->exit()
+ proc_remove
+ remove_proc_subtree
+ proc_entry_rundown(de);
+ free_module(mod);
+
+ if (S_ISREG(inode->i_mode))
+ if (de->proc_ops->proc_read_iter)
+ --> As module is already freed, will trigger UAF
+
+BUG: unable to handle page fault for address: fffffbfff80a702b
+PGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0
+Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI
+CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
+RIP: 0010:proc_get_inode+0x302/0x6e0
+RSP: 0018:ffff88811c837998 EFLAGS: 00010a06
+RAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007
+RDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158
+RBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20
+R10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0
+R13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001
+FS: 00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ <TASK>
+ proc_lookup_de+0x11f/0x2e0
+ __lookup_slow+0x188/0x350
+ walk_component+0x2ab/0x4f0
+ path_lookupat+0x120/0x660
+ filename_lookup+0x1ce/0x560
+ vfs_statx+0xac/0x150
+ __do_sys_newstat+0x96/0x110
+ do_syscall_64+0x5f/0x170
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+[adobriyan@gmail.com: don't do 2 atomic ops on the common path]
+Link: https://lkml.kernel.org/r/3d25ded0-1739-447e-812b-e34da7990dcf@p183
+Fixes: 778f3dd5a13c ("Fix procfs compat_ioctl regression")
+Signed-off-by: Ye Bin <yebin10@huawei.com>
+Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/proc/generic.c | 10 +++++++++-
+ fs/proc/inode.c | 6 +++---
+ fs/proc/internal.h | 14 ++++++++++++++
+ include/linux/proc_fs.h | 7 +++++--
+ 4 files changed, 31 insertions(+), 6 deletions(-)
+
+--- a/fs/proc/generic.c
++++ b/fs/proc/generic.c
+@@ -557,10 +557,16 @@ struct proc_dir_entry *proc_create_reg(c
+ return p;
+ }
+
+-static inline void pde_set_flags(struct proc_dir_entry *pde)
++static void pde_set_flags(struct proc_dir_entry *pde)
+ {
+ if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT)
+ pde->flags |= PROC_ENTRY_PERMANENT;
++ if (pde->proc_ops->proc_read_iter)
++ pde->flags |= PROC_ENTRY_proc_read_iter;
++#ifdef CONFIG_COMPAT
++ if (pde->proc_ops->proc_compat_ioctl)
++ pde->flags |= PROC_ENTRY_proc_compat_ioctl;
++#endif
+ }
+
+ struct proc_dir_entry *proc_create_data(const char *name, umode_t mode,
+@@ -624,6 +630,7 @@ struct proc_dir_entry *proc_create_seq_p
+ p->proc_ops = &proc_seq_ops;
+ p->seq_ops = ops;
+ p->state_size = state_size;
++ pde_set_flags(p);
+ return proc_register(parent, p);
+ }
+ EXPORT_SYMBOL(proc_create_seq_private);
+@@ -654,6 +661,7 @@ struct proc_dir_entry *proc_create_singl
+ return NULL;
+ p->proc_ops = &proc_single_ops;
+ p->single_show = show;
++ pde_set_flags(p);
+ return proc_register(parent, p);
+ }
+ EXPORT_SYMBOL(proc_create_single_data);
+--- a/fs/proc/inode.c
++++ b/fs/proc/inode.c
+@@ -656,13 +656,13 @@ struct inode *proc_get_inode(struct supe
+
+ if (S_ISREG(inode->i_mode)) {
+ inode->i_op = de->proc_iops;
+- if (de->proc_ops->proc_read_iter)
++ if (pde_has_proc_read_iter(de))
+ inode->i_fop = &proc_iter_file_ops;
+ else
+ inode->i_fop = &proc_reg_file_ops;
+ #ifdef CONFIG_COMPAT
+- if (de->proc_ops->proc_compat_ioctl) {
+- if (de->proc_ops->proc_read_iter)
++ if (pde_has_proc_compat_ioctl(de)) {
++ if (pde_has_proc_read_iter(de))
+ inode->i_fop = &proc_iter_file_ops_compat;
+ else
+ inode->i_fop = &proc_reg_file_ops_compat;
+--- a/fs/proc/internal.h
++++ b/fs/proc/internal.h
+@@ -85,6 +85,20 @@ static inline void pde_make_permanent(st
+ pde->flags |= PROC_ENTRY_PERMANENT;
+ }
+
++static inline bool pde_has_proc_read_iter(const struct proc_dir_entry *pde)
++{
++ return pde->flags & PROC_ENTRY_proc_read_iter;
++}
++
++static inline bool pde_has_proc_compat_ioctl(const struct proc_dir_entry *pde)
++{
++#ifdef CONFIG_COMPAT
++ return pde->flags & PROC_ENTRY_proc_compat_ioctl;
++#else
++ return false;
++#endif
++}
++
+ extern struct kmem_cache *proc_dir_entry_cache;
+ void pde_free(struct proc_dir_entry *pde);
+
+--- a/include/linux/proc_fs.h
++++ b/include/linux/proc_fs.h
+@@ -20,10 +20,13 @@ enum {
+ * If in doubt, ignore this flag.
+ */
+ #ifdef MODULE
+- PROC_ENTRY_PERMANENT = 0U,
++ PROC_ENTRY_PERMANENT = 0U,
+ #else
+- PROC_ENTRY_PERMANENT = 1U << 0,
++ PROC_ENTRY_PERMANENT = 1U << 0,
+ #endif
++
++ PROC_ENTRY_proc_read_iter = 1U << 1,
++ PROC_ENTRY_proc_compat_ioctl = 1U << 2,
+ };
+
+ struct proc_ops {
--- /dev/null
+From 2c7a50bec4958f1d1c84d19cde518d0e96a676fd Mon Sep 17 00:00:00 2001
+From: Christian Eggers <ceggers@arri.de>
+Date: Thu, 13 Mar 2025 11:27:39 +0100
+Subject: regulator: check that dummy regulator has been probed before using it
+
+From: Christian Eggers <ceggers@arri.de>
+
+commit 2c7a50bec4958f1d1c84d19cde518d0e96a676fd upstream.
+
+Due to asynchronous driver probing there is a chance that the dummy
+regulator hasn't already been probed when first accessing it.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Christian Eggers <ceggers@arri.de>
+Link: https://patch.msgid.link/20250313103051.32430-3-ceggers@arri.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/regulator/core.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -2024,6 +2024,10 @@ static int regulator_resolve_supply(stru
+
+ if (have_full_constraints()) {
+ r = dummy_regulator_rdev;
++ if (!r) {
++ ret = -EPROBE_DEFER;
++ goto out;
++ }
+ get_device(&r->dev);
+ } else {
+ dev_err(dev, "Failed to resolve %s-supply for %s\n",
+@@ -2041,6 +2045,10 @@ static int regulator_resolve_supply(stru
+ goto out;
+ }
+ r = dummy_regulator_rdev;
++ if (!r) {
++ ret = -EPROBE_DEFER;
++ goto out;
++ }
+ get_device(&r->dev);
+ }
+
+@@ -2166,8 +2174,10 @@ struct regulator *_regulator_get_common(
+ * enabled, even if it isn't hooked up, and just
+ * provide a dummy.
+ */
+- dev_warn(dev, "supply %s not found, using dummy regulator\n", id);
+ rdev = dummy_regulator_rdev;
++ if (!rdev)
++ return ERR_PTR(-EPROBE_DEFER);
++ dev_warn(dev, "supply %s not found, using dummy regulator\n", id);
+ get_device(&rdev->dev);
+ break;
+
--- /dev/null
+From 8619909b38eeebd3e60910158d7d68441fc954e9 Mon Sep 17 00:00:00 2001
+From: Christian Eggers <ceggers@arri.de>
+Date: Tue, 11 Mar 2025 10:18:02 +0100
+Subject: regulator: dummy: force synchronous probing
+
+From: Christian Eggers <ceggers@arri.de>
+
+commit 8619909b38eeebd3e60910158d7d68441fc954e9 upstream.
+
+Sometimes I get a NULL pointer dereference at boot time in kobject_get()
+with the following call stack:
+
+anatop_regulator_probe()
+ devm_regulator_register()
+ regulator_register()
+ regulator_resolve_supply()
+ kobject_get()
+
+By placing some extra BUG_ON() statements I could verify that this is
+raised because probing of the 'dummy' regulator driver is not completed
+('dummy_regulator_rdev' is still NULL).
+
+In the JTAG debugger I can see that dummy_regulator_probe() and
+anatop_regulator_probe() can be run by different kernel threads
+(kworker/u4:*). I haven't further investigated whether this can be
+changed or if there are other possibilities to force synchronization
+between these two probe routines. On the other hand I don't expect much
+boot time penalty by probing the 'dummy' regulator synchronously.
+
+Cc: stable@vger.kernel.org
+Fixes: 259b93b21a9f ("regulator: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in 4.14")
+Signed-off-by: Christian Eggers <ceggers@arri.de>
+Link: https://patch.msgid.link/20250311091803.31026-1-ceggers@arri.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/regulator/dummy.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/regulator/dummy.c
++++ b/drivers/regulator/dummy.c
+@@ -60,7 +60,7 @@ static struct platform_driver dummy_regu
+ .probe = dummy_regulator_probe,
+ .driver = {
+ .name = "reg-dummy",
+- .probe_type = PROBE_PREFER_ASYNCHRONOUS,
++ .probe_type = PROBE_FORCE_SYNCHRONOUS,
+ },
+ };
+
--- /dev/null
+From 1b133129ad6b28186214259af3bd5fc651a85509 Mon Sep 17 00:00:00 2001
+From: E Shattow <e@freeshell.de>
+Date: Mon, 9 Dec 2024 20:19:56 -0800
+Subject: riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions
+
+From: E Shattow <e@freeshell.de>
+
+commit 1b133129ad6b28186214259af3bd5fc651a85509 upstream.
+
+Fix a typo in StarFive JH7110 pin function definitions for GPOUT_SYS_SDIO1_DATA4
+
+Fixes: e22f09e598d12 ("riscv: dts: starfive: Add StarFive JH7110 pin function definitions")
+Signed-off-by: E Shattow <e@freeshell.de>
+Acked-by: Hal Feng <hal.feng@starfivetech.com>
+CC: stable@vger.kernel.org
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/riscv/boot/dts/starfive/jh7110-pinfunc.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/riscv/boot/dts/starfive/jh7110-pinfunc.h
++++ b/arch/riscv/boot/dts/starfive/jh7110-pinfunc.h
+@@ -89,7 +89,7 @@
+ #define GPOUT_SYS_SDIO1_DATA1 59
+ #define GPOUT_SYS_SDIO1_DATA2 60
+ #define GPOUT_SYS_SDIO1_DATA3 61
+-#define GPOUT_SYS_SDIO1_DATA4 63
++#define GPOUT_SYS_SDIO1_DATA4 62
+ #define GPOUT_SYS_SDIO1_DATA5 63
+ #define GPOUT_SYS_SDIO1_DATA6 64
+ #define GPOUT_SYS_SDIO1_DATA7 65
--- /dev/null
+From 67a2f86846f244d81601cf2e1552c4656b8556d6 Mon Sep 17 00:00:00 2001
+From: Rafael Aquini <raquini@redhat.com>
+Date: Tue, 18 Feb 2025 14:22:51 -0500
+Subject: selftests/mm: run_vmtests.sh: fix half_ufd_size_MB calculation
+
+From: Rafael Aquini <raquini@redhat.com>
+
+commit 67a2f86846f244d81601cf2e1552c4656b8556d6 upstream.
+
+We noticed that uffd-stress test was always failing to run when invoked
+for the hugetlb profiles on x86_64 systems with a processor count of 64 or
+bigger:
+
+ ...
+ # ------------------------------------
+ # running ./uffd-stress hugetlb 128 32
+ # ------------------------------------
+ # ERROR: invalid MiB (errno=9, @uffd-stress.c:459)
+ ...
+ # [FAIL]
+ not ok 3 uffd-stress hugetlb 128 32 # exit=1
+ ...
+
+The problem boils down to how run_vmtests.sh (mis)calculates the size of
+the region it feeds to uffd-stress. The latter expects to see an amount
+of MiB while the former is just giving out the number of free hugepages
+halved down. This measurement discrepancy ends up violating uffd-stress'
+assertion on number of hugetlb pages allocated per CPU, causing it to bail
+out with the error above.
+
+This commit fixes that issue by adjusting run_vmtests.sh's
+half_ufd_size_MB calculation so it properly renders the region size in
+MiB, as expected, while maintaining all of its original constraints in
+place.
+
+Link: https://lkml.kernel.org/r/20250218192251.53243-1-aquini@redhat.com
+Fixes: 2e47a445d7b3 ("selftests/mm: run_vmtests.sh: fix hugetlb mem size calculation")
+Signed-off-by: Rafael Aquini <raquini@redhat.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/mm/run_vmtests.sh | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/tools/testing/selftests/mm/run_vmtests.sh
++++ b/tools/testing/selftests/mm/run_vmtests.sh
+@@ -300,7 +300,9 @@ uffd_stress_bin=./uffd-stress
+ CATEGORY="userfaultfd" run_test ${uffd_stress_bin} anon 20 16
+ # Hugetlb tests require source and destination huge pages. Pass in half
+ # the size of the free pages we have, which is used for *each*.
+-half_ufd_size_MB=$((freepgs / 2))
++# uffd-stress expects a region expressed in MiB, so we adjust
++# half_ufd_size_MB accordingly.
++half_ufd_size_MB=$(((freepgs * hpgsize_KB) / 1024 / 2))
+ CATEGORY="userfaultfd" run_test ${uffd_stress_bin} hugetlb "$half_ufd_size_MB" 32
+ CATEGORY="userfaultfd" run_test ${uffd_stress_bin} hugetlb-private "$half_ufd_size_MB" 32
+ CATEGORY="userfaultfd" run_test ${uffd_stress_bin} shmem 20 16
libfs-fix-duplicate-directory-entry-in-offset_dir_lo.patch
net-neighbor-add-missing-policy-for-ndtpa_queue_lenb.patch
revert-gre-fix-ipv6-link-local-address-generation.patch
+tracing-tprobe-events-fix-leakage-of-module-refcount.patch
+i2c-omap-fix-irq-storms.patch
+net-mana-support-holes-in-device-list-reply-msg.patch
+dt-bindings-can-renesas-rcar-canfd-fix-typo-in-pattern-properties-for-r-car-v4m.patch
+can-rcar_canfd-fix-page-entries-in-the-afl-list.patch
+can-ucan-fix-out-of-bound-read-in-strscpy-source.patch
+can-flexcan-only-change-can-state-when-link-up-in-system-pm.patch
+can-flexcan-disable-transceiver-during-system-pm.patch
+drm-xe-fix-exporting-xe-buffers-multiple-times.patch
+drm-v3d-don-t-run-jobs-that-have-errors-flagged-in-its-fence.patch
+io_uring-net-don-t-clear-req_f_need_cleanup-unconditionally.patch
+riscv-dts-starfive-fix-a-typo-in-starfive-jh7110-pin-function-definitions.patch
+netfs-call-invalidate_cache-only-if-implemented.patch
+regulator-dummy-force-synchronous-probing.patch
+regulator-check-that-dummy-regulator-has-been-probed-before-using-it.patch
+accel-qaic-fix-integer-overflow-in-qaic_validate_req.patch
+arm64-dts-freescale-imx8mp-verdin-dahlia-add-microphone-jack-to-sound-card.patch
+arm64-dts-freescale-imx8mm-verdin-dahlia-add-microphone-jack-to-sound-card.patch
+arm64-dts-rockchip-fix-pinmux-of-uart0-for-px30-ringneck-on-haikou.patch
+arm64-dts-rockchip-fix-pinmux-of-uart5-for-px30-ringneck-on-haikou.patch
+arm64-dts-rockchip-add-missing-pcie-supplies-to-rockpro64-board-dtsi.patch
+mmc-sdhci-brcmstb-add-cqhci-suspend-resume-to-pm-ops.patch
+mmc-atmel-mci-add-missing-clk_disable_unprepare.patch
+selftests-mm-run_vmtests.sh-fix-half_ufd_size_mb-calculation.patch
+mm-fix-error-handling-in-__filemap_get_folio-with-fgp_nowait.patch
+mm-migrate-fix-shmem-xarray-update-during-migration.patch
+mm-page_alloc-fix-memory-accept-before-watermarks-gets-initialized.patch
+proc-fix-uaf-in-proc_get_inode.patch
+memcg-drain-obj-stock-on-cpu-hotplug-teardown.patch
+arm-dts-imx6qdl-apalis-fix-poweroff-on-apalis-imx6.patch
+arm-shmobile-smp-enforce-shmobile_smp_-alignment.patch
+firmware-qcom-uefisecapp-fix-efivars-registration-race.patch
+efi-libstub-avoid-physical-address-0x0-when-doing-random-allocation.patch
+keys-fix-uaf-in-key_put.patch
+xsk-fix-an-integer-overflow-in-xp_create_and_assign_umem.patch
+batman-adv-ignore-own-maximum-aggregation-size-during-rx.patch
+soc-qcom-pdr-fix-the-potential-deadlock.patch
+pmdomain-amlogic-fix-t7-isp-secpower.patch
+drm-radeon-fix-uninitialized-size-issue-in-radeon_vce_cs_parse.patch
+drm-sched-fix-fence-reference-count-leak.patch
+drm-amdgpu-gfx12-correct-cleanup-of-me-field-with-gfx_v12_0_me_fini.patch
+drm-amd-display-fix-message-for-support_edp0_on_dp1.patch
+drm-amd-display-use-hw-lock-mgr-for-psr1-when-only-one-edp.patch
+drm-amd-pm-add-unique_id-for-gfx12.patch
+drm-amdgpu-restore-uncached-behaviour-on-gfx12.patch
+drm-amdgpu-pm-handle-sclk-offset-correctly-in-overdrive-for-smu-14.0.2.patch
+drm-amdgpu-pm-wire-up-hwmon-fan-speed-for-smu-14.0.2.patch
+drm-amdgpu-remove-jpeg-from-vega-and-carrizo-video-caps.patch
+drm-amdgpu-fix-mpeg2-mpeg4-and-vc1-video-caps-max-size.patch
+drm-amdgpu-fix-jpeg-video-caps-max-size-for-navi1x-and-raven.patch
+drm-amdkfd-fix-user-queue-validation-on-gfx7-8.patch
--- /dev/null
+From 2eeb03ad9f42dfece63051be2400af487ddb96d2 Mon Sep 17 00:00:00 2001
+From: Saranya R <quic_sarar@quicinc.com>
+Date: Wed, 12 Feb 2025 22:07:20 +0530
+Subject: soc: qcom: pdr: Fix the potential deadlock
+
+From: Saranya R <quic_sarar@quicinc.com>
+
+commit 2eeb03ad9f42dfece63051be2400af487ddb96d2 upstream.
+
+When some client process A call pdr_add_lookup() to add the look up for
+the service and does schedule locator work, later a process B got a new
+server packet indicating locator is up and call pdr_locator_new_server()
+which eventually sets pdr->locator_init_complete to true which process A
+sees and takes list lock and queries domain list but it will timeout due
+to deadlock as the response will queued to the same qmi->wq and it is
+ordered workqueue and process B is not able to complete new server
+request work due to deadlock on list lock.
+
+Fix it by removing the unnecessary list iteration as the list iteration
+is already being done inside locator work, so avoid it here and just
+call schedule_work() here.
+
+ Process A Process B
+
+ process_scheduled_works()
+pdr_add_lookup() qmi_data_ready_work()
+ process_scheduled_works() pdr_locator_new_server()
+ pdr->locator_init_complete=true;
+ pdr_locator_work()
+ mutex_lock(&pdr->list_lock);
+
+ pdr_locate_service() mutex_lock(&pdr->list_lock);
+
+ pdr_get_domain_list()
+ pr_err("PDR: %s get domain list
+ txn wait failed: %d\n",
+ req->service_name,
+ ret);
+
+Timeout error log due to deadlock:
+
+"
+ PDR: tms/servreg get domain list txn wait failed: -110
+ PDR: service lookup for msm/adsp/sensor_pd:tms/servreg failed: -110
+"
+
+Thanks to Bjorn and Johan for letting me know that this commit also fixes
+an audio regression when using the in-kernel pd-mapper as that makes it
+easier to hit this race. [1]
+
+Link: https://lore.kernel.org/lkml/Zqet8iInnDhnxkT9@hovoldconsulting.com/ # [1]
+Fixes: fbe639b44a82 ("soc: qcom: Introduce Protection Domain Restart helpers")
+CC: stable@vger.kernel.org
+Reviewed-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+Tested-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
+Tested-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Saranya R <quic_sarar@quicinc.com>
+Co-developed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
+Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250212163720.1577876-1-mukesh.ojha@oss.qualcomm.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/qcom/pdr_interface.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+--- a/drivers/soc/qcom/pdr_interface.c
++++ b/drivers/soc/qcom/pdr_interface.c
+@@ -75,7 +75,6 @@ static int pdr_locator_new_server(struct
+ {
+ struct pdr_handle *pdr = container_of(qmi, struct pdr_handle,
+ locator_hdl);
+- struct pdr_service *pds;
+
+ mutex_lock(&pdr->lock);
+ /* Create a local client port for QMI communication */
+@@ -87,12 +86,7 @@ static int pdr_locator_new_server(struct
+ mutex_unlock(&pdr->lock);
+
+ /* Service pending lookup requests */
+- mutex_lock(&pdr->list_lock);
+- list_for_each_entry(pds, &pdr->lookups, node) {
+- if (pds->need_locator_lookup)
+- schedule_work(&pdr->locator_work);
+- }
+- mutex_unlock(&pdr->list_lock);
++ schedule_work(&pdr->locator_work);
+
+ return 0;
+ }
--- /dev/null
+From ac91052f0ae5be9e46211ba92cc31c0e3b0a933a Mon Sep 17 00:00:00 2001
+From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
+Date: Thu, 13 Mar 2025 10:00:10 +0900
+Subject: tracing: tprobe-events: Fix leakage of module refcount
+
+From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+
+commit ac91052f0ae5be9e46211ba92cc31c0e3b0a933a upstream.
+
+When enabling the tracepoint at loading module, the target module
+refcount is incremented by find_tracepoint_in_module(). But it is
+unnecessary because the module is not unloaded while processing
+module loading callbacks.
+Moreover, the refcount is not decremented in that function.
+To be clear the module refcount handling, move the try_module_get()
+callsite to trace_fprobe_create_internal(), where it is actually
+required.
+
+Link: https://lore.kernel.org/all/174182761071.83274.18334217580449925882.stgit@devnote2/
+
+Fixes: 57a7e6de9e30 ("tracing/fprobe: Support raw tracepoints on future loaded modules")
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace_fprobe.c | 21 ++++++++-------------
+ 1 file changed, 8 insertions(+), 13 deletions(-)
+
+--- a/kernel/trace/trace_fprobe.c
++++ b/kernel/trace/trace_fprobe.c
+@@ -889,13 +889,8 @@ static void __find_tracepoint_module_cb(
+
+ if (!data->tpoint && !strcmp(data->tp_name, tp->name)) {
+ data->tpoint = tp;
+- if (!data->mod) {
++ if (!data->mod)
+ data->mod = mod;
+- if (!try_module_get(data->mod)) {
+- data->tpoint = NULL;
+- data->mod = NULL;
+- }
+- }
+ }
+ }
+
+@@ -907,13 +902,7 @@ static void __find_tracepoint_cb(struct
+ data->tpoint = tp;
+ }
+
+-/*
+- * Find a tracepoint from kernel and module. If the tracepoint is in a module,
+- * this increments the module refcount to prevent unloading until the
+- * trace_fprobe is registered to the list. After registering the trace_fprobe
+- * on the trace_fprobe list, the module refcount is decremented because
+- * tracepoint_probe_module_cb will handle it.
+- */
++/* Find a tracepoint from kernel and module. */
+ static struct tracepoint *find_tracepoint(const char *tp_name,
+ struct module **tp_mod)
+ {
+@@ -942,6 +931,7 @@ static void reenable_trace_fprobe(struct
+ }
+ }
+
++/* Find a tracepoint from specified module. */
+ static struct tracepoint *find_tracepoint_in_module(struct module *mod,
+ const char *tp_name)
+ {
+@@ -1177,6 +1167,11 @@ static int __trace_fprobe_create(int arg
+ if (is_tracepoint) {
+ ctx.flags |= TPARG_FL_TPOINT;
+ tpoint = find_tracepoint(symbol, &tp_mod);
++ /* lock module until register this tprobe. */
++ if (tp_mod && !try_module_get(tp_mod)) {
++ tpoint = NULL;
++ tp_mod = NULL;
++ }
+ if (tpoint) {
+ ctx.funcname = kallsyms_lookup(
+ (unsigned long)tpoint->probestub,
--- /dev/null
+From 559847f56769037e5b2e0474d3dbff985b98083d Mon Sep 17 00:00:00 2001
+From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+Date: Thu, 13 Mar 2025 08:50:08 +0000
+Subject: xsk: fix an integer overflow in xp_create_and_assign_umem()
+
+From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+
+commit 559847f56769037e5b2e0474d3dbff985b98083d upstream.
+
+Since the i and pool->chunk_size variables are of type 'u32',
+their product can wrap around and then be cast to 'u64'.
+This can lead to two different XDP buffers pointing to the same
+memory area.
+
+Found by InfoTeCS on behalf of Linux Verification Center
+(linuxtesting.org) with SVACE.
+
+Fixes: 94033cd8e73b ("xsk: Optimize for aligned case")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
+Link: https://patch.msgid.link/20250313085007.3116044-1-Ilia.Gavrilov@infotecs.ru
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/xdp/xsk_buff_pool.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/xdp/xsk_buff_pool.c
++++ b/net/xdp/xsk_buff_pool.c
+@@ -106,7 +106,7 @@ struct xsk_buff_pool *xp_create_and_assi
+ if (pool->unaligned)
+ pool->free_heads[i] = xskb;
+ else
+- xp_init_xskb_addr(xskb, pool, i * pool->chunk_size);
++ xp_init_xskb_addr(xskb, pool, (u64)i * pool->chunk_size);
+ }
+
+ return pool;
projects / thirdparty / kernel / stable-queue.git / commitdiff
