Wa_15016589081 applies to xe2_hpg renderCS

V2(Gustavo)
  - rename bit macro
Signed-off-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
Reviewed-by: Gustavo Sousa <gustavo.sousa@intel.com>
Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240904101333.2049655-1-tejas.upadhyay@intel.comSigned-off-by: Nirmoy Das <nirmoy.das@intel.com>
(cherry picked from commit 9db969b36b2fbca13ad4088aff725ebd5e8142f5)
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>

When we fail to map a BO in the GGTT, we release our GGTT node
placeholder, but leave stale bo->ggtt_node pointer to it, which
triggers an assert immediately followed by a crash, due to UAF:

[ ] xe 0000:00:02.0: [drm] Assertion `bo->ggtt_node->base.size == bo->size` failed!
[ ] WARNING: CPU: 4 PID: 126 at drivers/gpu/drm/xe/xe_ggtt.c:689 xe_ggtt_remove_bo+0x1d9/0x250 [xe]
[ ] RIP: 0010:xe_ggtt_remove_bo+0x1d9/0x250 [xe]
[ ] Call Trace:
[ ]  <TASK>
[ ]  ? __warn+0x88/0x190
[ ]  ? xe_ggtt_remove_bo+0x1d9/0x250 [xe]
[ ]  ? report_bug+0x1c3/0x1d0
[ ]  ? handle_bug+0x42/0x70
[ ]  ? exc_invalid_op+0x14/0x70
[ ]  ? asm_exc_invalid_op+0x16/0x20
[ ]  ? xe_ggtt_remove_bo+0x1d9/0x250 [xe]
[ ]  ? xe_ggtt_remove_bo+0x1d9/0x250 [xe]
[ ]  xe_ttm_bo_destroy+0x11f/0x260 [xe]
[ ]  ? ttm_bo_release+0x31c/0x350 [ttm]
[ ]  ? __mutex_unlock_slowpath+0x35/0x270
[ ]  __xe_bo_create_locked+0x4a0/0x550 [xe]
[ ]  ? mark_held_locks+0x49/0x80
[ ]  xe_bo_create_pin_map_at+0x37/0x200 [xe]
[ ]  xe_bo_create_pin_map+0x11/0x20 [xe]

While around, for similar reason, also don't keep an error pointer
if we fail to allocate ggtt_node placeholder.

Fixes: 34e80422 ("drm/xe: Make xe_ggtt_node struct independent")
Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240906220348.1836-1-michal.wajdeczko@intel.com
(cherry picked from commit f2710d95724ebbfa35d6d4b82017eeab70994509)
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>

Fix memleak caused by missing xe_vm_put

Fixes: 852856e3 ("drm/xe: Use reserved copy engine for user binds on faulting devices")
Signed-off-by: Dafna Hirschfeld <dhirschfeld@habana.ai>
Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240901044227.1177211-1-dhirschfeld@habana.aiSigned-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
(cherry picked from commit 249df8cbecf0ab4877eab66cae857748631831a9)
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>

The 'runtime_status' field is an implementation detail of the
power management code, so a device driver should not normally
touch this:

drivers/gpu/drm/xe/xe_pm.c: In function 'xe_pm_suspending_or_resuming':
drivers/gpu/drm/xe/xe_pm.c:606:26: error: 'struct dev_pm_info' has no member named 'runtime_status'
  606 |         return dev->power.runtime_status == RPM_SUSPENDING ||
      |                          ^
drivers/gpu/drm/xe/xe_pm.c:607:27: error: 'struct dev_pm_info' has no member named 'runtime_status'
  607 |                 dev->power.runtime_status == RPM_RESUMING;
      |                           ^
drivers/gpu/drm/xe/xe_pm.c:608:1: error: control reaches end of non-void function [-Werror=return-type]

Add an #ifdef check to avoid the build regression.

Fixes: ad92f523 ("drm/xe: Suppress missing outer rpm protection warning")
Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20240909202521.1018439-1-arnd@kernel.orgSigned-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
(cherry picked from commit 1c129ed07de47684ff2471e32b52fa823533aa06)
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>

Do not raise a WARN if we are likely within suspending or resuming
path. This is likely this false positive:

rpm_status:           0000:03:00.0 status=RPM_SUSPENDING
console:              xe_bo_evict_all (called from suspend)
xe_sched_job_create:  dev=0000:03:00.0, ...
xe_sched_job_exec:    dev=0000:03:00.0, ...
xe_pm_runtime_put:    dev=0000:03:00.0, ...
xe_sched_job_run:     dev=0000:03:00.0, ...
rpm_usage:            0000:03:00.0 flags-0 cnt-2  ...
rpm_usage:            0000:03:00.0 flags-0 cnt-2  ...
rpm_usage:            0000:03:00.0 flags-0 cnt-2  ...
console:              xe 0000:03:00.0: [drm] Missing outer runtime
                                                     PM protection
console:               xe_guc_ct_send+0x15/0x50 [xe]
console:               guc_exec_queue_run_job+0x1509/0x3950 [xe]
[snip]
console:               drm_sched_run_job_work+0x649/0xc20

At this point, BOs are getting evicted from VRAM with rpm
usage-counter = 2, but rpm status = SUSPENDING.

The xe->pm_callback_task won't be equal 'current' because this call is
coming from a work queue.

So, pm_runtime_get_if_active() will be called and return 0 because rpm
status != ACTIVE (but equal SUSPENDING or RESUMING).

v2: Still get the reference even on non suspending/resuming
    path (Jonathan, Brost).

Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Matthew Auld <matthew.auld@intel.com>
Reviewed-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240905140215.56404-1-rodrigo.vivi@intel.comSigned-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
(cherry picked from commit cb85e39dc5d1717fab82810984cce0e54712a3c2)
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>

The node ptr can point to an already freed ptr, if we hit the path with
an already allocated node. We later dereference that pointer with:

	xe_gt_assert(gt, !xe_ggtt_node_allocated(node));

which is a potential UAF. Fix this by not stashing the ptr for node.
Also since it is likely a bad idea to leave config->ggtt_region pointing
to a stale ptr, also set that to NULL by calling
pf_release_vf_config_ggtt() instead of pf_release_ggtt().

Fixes: 34e80422 ("drm/xe: Make xe_ggtt_node struct independent")
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240828104341.180111-2-matthew.auld@intel.com
(cherry picked from commit 89076b5a8b4e0a01040585e156a0b014cd472fd3)
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>

Thomas needs 5a498d4d ("drm/fbdev-dma: Only install deferred I/O
if necessary") in drm-misc, so start the backmerge cascade.
Signed-off-by: Simona Vetter <simona.vetter@ffwll.ch>

Merge tag 'drm-misc-next-fixes-2024-09-05' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

Short summary of fixes pull:

tegra:
- Fix uninitialized variable in EDID code
Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20240905113836.GA292407@linux.fritz.box

Merge tag 'exynos-drm-next-for-v6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-next

Three cleanups
- Drop stale exynos file pattern from MAINTAINERS file
  The old "exynos" directory is removed from MAINTAINERS as Samsung Exynos display bindings have been relocated. This resolves a warning from get_maintainers.pl about no files matching the outdated directory.

- Constify struct exynos_drm_ipp_funcs
  By making struct exynos_drm_ipp_funcs constant, the patch enhances security by moving the structure to a read-only section of memory. This change results in a slight reduction in the data section size.

- Remove unnecessary code
  The function exynos_atomic_commit is removed as it became redundant after a previous update. This cleans up the code and eliminates unused function declarations.

One fixup
- Fix wrong assignment in gsc_bind()
  A double assignment in gsc_bind() was flagged by the cocci tool and corrected to fix an incorrect assignment, addressing a potential issue introduced in a prior commit.
Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Inki Dae <inki.dae@samsung.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240909004641.406858-1-inki.dae@samsung.com

Merge tag 'amd-drm-next-6.12-2024-09-06' of https://gitlab.freedesktop.org/agd5f/linux into drm-next

amd-drm-next-6.12-2024-09-06:

amdgpu:
- IPS updates
- Post divider fix
- DML2 updates
- Misc static checker fixes
- DCN 3.5 fixes
- Replay fixes
- DMCUB updates
- SWSMU fixes
- DP MST fixes
- Add debug flag for per queue resets
- devcoredump updates
- SR-IOV fixes
- MES fixes
- Always allocate cleared VRAM for GEM
- Pipe reset for GC 9.4.3
- ODM policy fixes
- Per queue reset support for GC 10
- Per queue reset support for GC 11
- Per queue reset support for GC 12
- Display flickering fixes
- MPO fixes
- Display sharpening updates

amdkfd:
- SVM fix for IH for APUs
Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Alex Deucher <alexander.deucher@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240906211008.3072097-1-alexander.deucher@amd.com

Merge tag 'drm-intel-gt-next-2024-09-06' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next

Driver Changes:

- Expose fan speed via hwmon (Raag)
- Correction to Wa_14019159160 on ARL (John H)
- Whitelist COMMON_SLICE_CHICKEN1 for UMD access on DG2/MTL/ARL (Dnyaneshwar)
- Do not attempt to load the GSC multiple times to avoid hanging GSC HW (Daniele)

- Populate /sys/class/drm/cardX/engines/ even if one engine fails (Andi)
- Use kmemdup_array instead of kmemdup for multiple allocation (Yu)
- Remove extra unlikely() (Hongbo)
Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/Ztrfr_Wuurfa-3Rv@jlahtine-mobl.ger.corp.intel.com

Cross-subsystem Changes:
- Split dma fence array creation into alloc and arm (Matthew Brost)

Driver Changes:
- Move kernel_lrc to execlist backend (Ilia)
- Fix type width for pcode coommand (Karthik)
- Make xe_drm.h include unambiguous (Jani)
- Fixes and debug improvements for GSC load (Daniele)
- Track resources and VF state by PF (Michal Wajdeczko)
- Fix memory leak on error path (Nirmoy)
- Cleanup header includes (Matt Roper)
- Move pcode logic to tile scope (Matt Roper)
- Move hwmon logic to device scope (Matt Roper)
- Fix media TLB invalidation (Matthew Brost)
- Threshold config fixes for PF (Michal Wajdeczko)
- Remove extra "[drm]" from logs (Michal Wajdeczko)
- Add missing runtime ref (Rodrigo Vivi)
- Fix circular locking on runtime suspend (Rodrigo Vivi)
- Fix rpm in TTM swapout path (Thomas)
Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/eirx5vdvoflbbqlrzi5cip6bpu3zjojm2pxseufu3rlq4pp6xv@eytjvhizfyu6

Pull timer fixes from Borislav Petkov:

 - Remove percpu irq related code in the timer-of initialization routine
   as it is broken but also unused (Daniel Lezcano)

 - Fix return -ETIME when delta exceeds INT_MAX and the next event not
   taking effect sometimes (Jacky Bai)

* tag 'timers_urgent_for_v6.11_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  clocksource/drivers/imx-tpm: Fix next event not taking effect sometime
  clocksource/drivers/imx-tpm: Fix return -ETIME when delta exceeds INT_MAX
  clocksource/drivers/timer-of: Remove percpu irq related code

Pull perf fixes from Borislav Petkov:

 - Fix perf's AUX buffer serialization

 - Prevent uninitialized struct members in perf's uprobes handling

* tag 'perf_urgent_for_v6.11_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf/aux: Fix AUX buffer serialization
  uprobes: Use kzalloc to allocate xol area

Pull char/misc driver fixes from Greg KH:
 "Here are some small char/misc/other driver fixes for 6.11-rc7. It's
  nothing huge, just a bunch of small fixes of reported problems,
  including:

   - lots of tiny iio driver fixes

   - nvmem driver fixex

   - binder UAF bugfix

   - uio driver crash fix

   - other small fixes

  All of these have been in linux-next this week with no reported
  problems"

* tag 'char-misc-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (21 commits)
  VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
  Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic
  uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
  misc: keba: Fix sysfs group creation
  dt-bindings: nvmem: Use soc-nvmem node name instead of nvmem
  nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc
  nvmem: u-boot-env: error if NVMEM device is too small
  misc: fastrpc: Fix double free of 'buf' in error path
  binder: fix UAF caused by offsets overwrite
  iio: imu: inv_mpu6050: fix interrupt status read for old buggy chips
  iio: adc: ad7173: fix GPIO device info
  iio: adc: ad7124: fix DT configuration parsing
  iio: adc: ad_sigma_delta: fix irq_flags on irq request
  iio: adc: ads1119: Fix IRQ flags
  iio: fix scale application in iio_convert_raw_to_processed_unlocked
  iio: adc: ad7124: fix config comparison
  iio: adc: ad7124: fix chip ID mismatch
  iio: adc: ad7173: Fix incorrect compatible string
  iio: buffer-dmaengine: fix releasing dma channel on error
  iio: adc: ad7606: remove frstdata check for serial mode
  ...

Pull USB fixes from Greg KH:
 "Here are a handful of small USB fixes for 6.11-rc7. Included in here
  are:

   - dwc3 driver fixes for two reported problems

   - two typec ucsi driver fixes

   - cdns2 controller reset fix

  All of these have been in linux-next this week with no reported
  problems"

* tag 'usb-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  usb: typec: ucsi: Fix cable registration
  usb: typec: ucsi: Fix the partner PD revision
  usb: cdns2: Fix controller reset issue
  usb: dwc3: core: update LC timer as per USB Spec V3.2
  usb: dwc3: Avoid waking up gadget during startxfer

Pull clk fixes from Stephen Boyd:
 "A pile of Qualcomm clk driver fixes with two main themes: the alpha
  PLL driver and shared RCGs, and one fix for the Starfive JH7110 SoC.

   - The Alpha PLL clk_ops had multiple problems around setting rates.

     There are a handful of patches here that fix masks and skip
     enabling the clk from set_rate() when the PLL is disabled. The PLLs
     are crucial to operation of the system as almost all frequencies in
     the system are derived from them.

   - Parking shared RCGs at a slow always on clk at registration time
     breaks stuff.

     USB host mode can't handle such a slow frequency and the serial
     console gets all garbled when the UART clk is handed over to the
     kernel. There's a few patches that don't use the shared clk_ops for
     the UART clks and another one to skip parking the USB clk at
     registration time.

   - The Starfive PLL driver used for the CPU was busted causing cpufreq
     to fail because the clk didn't change to a safe parent during
     set_rate().

     The fix is to register a notifier and switch to a safe parent so
     the PLL can change rate in a glitch free manner"

* tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
  clk: qcom: gcc-sc8280xp: don't use parking clk_ops for QUPs
  clk: starfive: jh7110-sys: Add notifier for PLL0 clock
  clk: qcom: gcc-sm8650: Don't use shared clk_ops for QUPs
  clk: qcom: gcc-sm8550: Don't park the USB RCG at registration time
  clk: qcom: gcc-sm8550: Don't use parking clk_ops for QUPs
  clk: qcom: gcc-x1e80100: Don't use parking clk_ops for QUPs
  clk: qcom: ipq9574: Update the alpha PLL type for GPLLs
  clk: qcom: gcc-x1e80100: Fix USB 0 and 1 PHY GDSC pwrsts flags
  clk: qcom: clk-alpha-pll: Update set_rate for Zonda PLL
  clk: qcom: clk-alpha-pll: Fix zonda set_rate failure when PLL is disabled
  clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API
  clk: qcom: clk-alpha-pll: Fix the pll post div mask

Pull SCSI fix from James Bottomley:
 "Single ufs driver fix quirking around another device spec violation"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: ufs: ufs-mediatek: Add UFSHCD_QUIRK_BROKEN_LSDBS_CAP

Pull pin control fix from Linus Walleij:
 "A single fix for Qualcomm laptops that are affected by
  missing wakeup IRQs"

* tag 'pinctrl-v6.11-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  pinctrl: qcom: x1e80100: Bypass PDC wakeup parent for now

Updates for v6.12

DPU:
- Fix implement DP/PHY mapping on SC8180X
- Enable writeback on SM8150, SC8180X, SM6125, SM6350

DP:
- Enable widebus on all relevant chipsets

DSI:
- Fix PHY programming on SM8350 / SM8450

HDMI:
- Add support for HDMI on MSM8998

MDP5:
- NULL string fix

GPU:
- A642L speedbin support
- A615 support
- A306 support
- A621 support
- Expand UBWC uapi
- A7xx GPU devcoredump fixes
- A5xx preemption fixes
- cleanups
Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Rob Clark <robdclark@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/CAF6AEGudK7YMiKDhtvYgp=bY64OZZt0UQSkEkSxLo4rLmeVd9g@mail.gmail.com

Merge tag 'linux_kselftest-kunit-fixes-6.11-rc7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest

PullKUnit fix from Shuah Khan:
 "Fix to a missing function parameter warning found during documentation
  build in linux-next"

* tag 'linux_kselftest-kunit-fixes-6.11-rc7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
  kunit: Fix missing kerneldoc comment

Pull pci fixes from Bjorn Helgaas:

 - Unregister platform devices for child nodes when stopping a PCI
   device, even if the PCI core has already cleared the OF_POPULATED bit
   and of_platform_depopulate() doesn't do anything (Bartosz
   Golaszewski)

 - Rescan the bus from a separate thread so we don't deadlock when
   triggering rescan from sysfs (Bartosz Golaszewski)

* tag 'pci-v6.11-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:
  PCI/pwrctl: Rescan bus on a separate thread
  PCI: Don't rely on of_platform_depopulate() for reused OF-nodes

Pull smb client fixes from Steve French:

 - fix potential mount hang

 - fix retry problem in two types of compound operations

 - important netfs integration fix in SMB1 read paths

 - fix potential uninitialized zero point of inode

 - minor patch to improve debugging for potential crediting problems

* tag 'v6.11-rc6-cifs-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  netfs, cifs: Improve some debugging bits
  cifs: Fix SMB1 readv/writev callback in the same way as SMB2/3
  cifs: Fix zero_point init on inode initialisation
  smb: client: fix double put of @cfile in smb2_set_path_size()
  smb: client: fix double put of @cfile in smb2_rename_path()
  smb: client: fix hang in wait_for_response() for negproto

clang warns on this because it has an unannotated fall-through between
cases:

   arch/x86/kvm/x86.c:4819:2: error: unannotated fall-through between switch labels [-Werror,-Wimplicit-fallthrough]

and while we could annotate it as a fallthrough, the proper fix is to
just add the break for this case, instead of falling through to the
default case and the break there.

gcc also has that warning, but it looks like gcc only warns for the
cases where they fall through to "real code", rather than to just a
break.  Odd.

Fixes: d30d9ee9 ("KVM: x86: Only advertise KVM_CAP_READONLY_MEM when supported by VM")
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Tom Dohrmann <erbse.13@gmx.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull arm64 fix from Catalin Marinas:
 "Fix the arm64 usage of ftrace_graph_ret_addr() to pass the
  &state->graph_idx pointer instead of NULL, otherwise this function
  just returns early"

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: stacktrace: fix the usage of ftrace_graph_ret_addr()

Pull RISC-V fixes from Palmer Dabbelt:

 - A revert for the mmap() change that ties the allocation range to the
   hint adress, as what we tried to do ended up regressing on other
   userspace workloads.

 - A fix to avoid a kernel memory leak when emulating misaligned
   accesses from userspace.

 - A Kconfig fix for toolchain vector detection, which now correctly
   detects vector support on toolchains where the V extension depends on
   the M extension.

 - A fix to avoid failing the linear mapping bootmem bounds check on
   NOMMU systems.

 - A fix for early alternatives on relocatable kernels.

* tag 'riscv-for-linus-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
  riscv: Fix RISCV_ALTERNATIVE_EARLY
  riscv: Do not restrict memory size because of linear mapping on nommu
  riscv: Fix toolchain vector detection
  riscv: misaligned: Restrict user access to kernel memory
  riscv: mm: Do not restrict mmap address based on hint
  riscv: selftests: Remove mmap hint address checks
  Revert "RISC-V: mm: Document mmap changes"

Pull powerpc fixes from Michael Ellerman:

 - Fix a deadlock in the powerpc qspinlock MCS queue logic

 - Fix the return type of pgd_val() to not truncate 64-bit PTEs on 85xx

 - Allow the check for dynamic relocations in the VDSO to work correctly

 - Make mmu_pte_psize static to fix a build error

Thanks to Christophe Leroy, Nysal Jan K.A., Nicholas Piggin, Geetika
Moolchandani, Jijo Varghese, and Vaishnavi Bhat.

* tag 'powerpc-6.11-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
  powerpc/qspinlock: Fix deadlock in MCS queue
  powerpc/mm: Fix return type of pgd_val()
  powerpc/vdso: Don't discard rela sections
  powerpc/64e: Define mmu_pte_psize static

Pull x86 kvm fixes from Paolo Bonzini:
 "Many small fixes that accumulated while I was on vacation...

   - Fixup missed comments from the REMOVED_SPTE => FROZEN_SPTE rename

   - Ensure a root is successfully loaded when pre-faulting SPTEs

   - Grab kvm->srcu when handling KVM_SET_VCPU_EVENTS to guard against
     accessing memslots if toggling SMM happens to force a VM-Exit

   - Emulate MSR_{FS,GS}_BASE on SVM even though interception is always
     disabled, so that KVM does the right thing if KVM's emulator
     encounters {RD,WR}MSR

   - Explicitly clear BUS_LOCK_DETECT from KVM's caps on AMD, as KVM
     doesn't yet virtualize BUS_LOCK_DETECT on AMD

   - Cleanup the help message for CONFIG_KVM_AMD_SEV, and call out that
     KVM now supports SEV-SNP too

   - Specialize return value of
     KVM_CHECK_EXTENSION(KVM_CAP_READONLY_MEM), based on VM type

   - Remove unnecessary dependency on CONFIG_HIGH_RES_TIMERS

   - Note an RCU quiescent state on guest exit. This avoids a call to
     rcu_core() if there was a grace period request while guest was
     running"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: Remove HIGH_RES_TIMERS dependency
  kvm: Note an RCU quiescent state on guest exit
  KVM: x86: Only advertise KVM_CAP_READONLY_MEM when supported by VM
  KVM: SEV: Update KVM_AMD_SEV Kconfig entry and mention SEV-SNP
  KVM: SVM: Don't advertise Bus Lock Detect to guest if SVM support is missing
  KVM: SVM: fix emulation of msr reads/writes of MSR_FS_BASE and MSR_GS_BASE
  KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS
  KVM: x86/mmu: Check that root is valid/loaded when pre-faulting SPTEs
  KVM: x86/mmu: Fixup comments missed by the REMOVED_SPTE=>FROZEN_SPTE rename

Pull power management fix from Rafael Wysocki:
 "Fix an incorrect warning emitted by the amd-pstate driver on
  processors that don't support X86_FEATURE_CPPC (Gautham Shenoy)"

* tag 'pm-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  cpufreq/amd-pstate: Remove warning for X86_FEATURE_CPPC on certain Zen models

Pull block fixes from Jens Axboe:
 "Mostly just some fixlets for NVMe, but also a bug fix for the ublk
  driver and an integrity fix"

* tag 'block-6.11-20240906' of git://git.kernel.dk/linux:
  bio-integrity: don't restrict the size of integrity metadata
  ublk_drv: fix NULL pointer dereference in ublk_ctrl_start_recovery()
  nvmet: Identify-Active Namespace ID List command should reject invalid nsid
  nvme: set BLK_FEAT_ZONED for ZNS multipath disks
  nvme-pci: Add sleep quirk for Samsung 990 Evo
  nvme-pci: allocate tagset on reset if necessary
  nvmet-tcp: fix kernel crash if commands allocation fails
  nvme: use better description for async reset reason
  nvmet: Make nvmet_debugfs static

Pull sound fixes from Takashi Iwai:
 "Hopefully the last PR for 6.11, at least for this level of amount.

  In addition to the usual HD-audio quirks, there are more changes in
  ASoC, but all look small and device-specific fixes, and nothing stands
  out. The only slightly big change is sunxi I2S fix, which looks quite
  safe to apply, too"

* tag 'sound-6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (21 commits)
  ALSA: hda/realtek - Fix inactive headset mic jack for ASUS Vivobook 15 X1504VAP
  ALSA: hda/realtek: Support mute LED on HP Laptop 14-dq2xxx
  ALSA: hda/realtek: Enable Mute Led for HP Victus 15-fb1xxx
  ALSA: hda/realtek: extend quirks for Clevo V5[46]0
  ASoC: codecs: lpass-va-macro: set the default codec version for sm8250
  ALSA: hda: add HDMI codec ID for Intel PTL
  ALSA: hda/realtek: add patch for internal mic in Lenovo V145
  ASoC: sunxi: sun4i-i2s: fix LRCLK polarity in i2s mode
  ASoC: amd: yc: Add a quirk for MSI Bravo 17 (D7VEK)
  ASoC: mediatek: mt8188-mt6359: Modify key
  ASoc: SOF: topology: Clear SOF link platform name upon unload
  ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices
  ASoC: SOF: ipc: replace "enum sof_comp_type" field with "uint32_t"
  ASoC: fix module autoloading
  ASoC: tda7419: fix module autoloading
  ASoC: google: fix module autoloading
  ASoC: intel: fix module autoloading
  ASoC: tegra: Fix CBB error during probe()
  ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
  ASoC: Intel: soc-acpi-cht: Make Lenovo Yoga Tab 3 X90F DMI match less strict
  ...

Pull MMC fixes from Ulf Hansson:
 "MMC core:
   - Apply SD quirks earlier during probe so they become relevant

  MMC host:
   - cqhci: Fix checking of CQHCI_HALT state
   - dw_mmc: Fix IDMAC operation with pages bigger than 4K
   - sdhci-of-aspeed: Fix module autoloading"

* tag 'mmc-v6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
  mmc: cqhci: Fix checking of CQHCI_HALT state
  mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K
  mmc: sdhci-of-aspeed: fix module autoloading
  mmc: core: apply SD quirks earlier during probe

Pull gpio fixes from Bartosz Golaszewski:

 - fix an OF node reference leak in gpio-rockchip

 - add the missing module device table to gpio-modepin

* tag 'gpio-fixes-for-v6.11-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  gpio: modepin: Enable module autoloading
  gpio: rockchip: fix OF node leak in probe()

Pull pmdomain fix from Ulf Hansson:

 - Fix support for required OPPs for multiple PM domains

* tag 'pmdomain-v6.11-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:
  OPP: Fix support for required OPPs for multiple PM domains

Pull pwm fix from Uwe Kleine-König:
 "Fix an off-by-one in the stm32 driver.

  Hardware engineers tend to start counting at 1 while the software guys
  usually start with 0. This isn't so nice because that results in
  drivers where pwm device #2 needs to use the hardware registers with
  index 3.

  This was noticed by Fabrice Gasnier.

  A small patch fixing that mismatch is the only change included here"

* tag 'pwm/for-6.11-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux:
  pwm: stm32: Use the right CCxNP bit in stm32_pwm_enable()

Pull drm fixes from Dave Airlie:
 "This has a fair few patches in it, but I reviewed them all and they
  seem like real things, amdgpu, i915 and xe each have a bunch of fixes
  for various things, then there is a some bridge suspend/resume
  ordering fixes for a recent rework, and then some single driver
  changes in a few others.

  Nothing looks too serious, hopefully next week is quiet.

  amdgpu:
   - IPS workaround
   - Fix compatibility with older MES firmware
   - Fix CPU spikes when clearing VRAM
   - Backlight fix
   - PMO fix
   - Revert SWSMU change to fix regression

  xe:
   - GSC loading fix
   - PCODE mutex fix
   - Suspend/Resume fixes
   - RPM fixes

  i915:
   - Do not attempt to load the GSC multiple times
   - Fix readout degamma_lut mismatch on ilk/snb
   - Mark debug_fence_init_onstack() with __maybe_unused
   - fence: Mark debug_fence_free() with __maybe_unused
   - display: Add mechanism to use sink model when applying quirk
   - display: Increase Fast Wake Sync length as a quirk

  komeda:
   - zpos normalization fix

  nouveau:
   - incorrect register fix

  imagination:
   - memory leak fix

  bridge:
   - hdmi/bridge rework fixes

  panthor:
   - cache coherency fix
   - hi priority access fix

  panel:
   - change of compatible string

  fbdev:
   - deferred-io init with no struct page fix"

* tag 'drm-fixes-2024-09-06' of https://gitlab.freedesktop.org/drm/kernel: (29 commits)
  Revert "drm/amdgpu: align pp_power_profile_mode with kernel docs"
  drm/fbdev-dma: Only install deferred I/O if necessary
  drm/panthor: flush FW AS caches in slow reset path
  drm: panel: nv3052c: Correct WL-355608-A8 panel compatible
  dt-bindings: display: panel: Rename WL-355608-A8 panel to rg35xx-*-panel
  drm/panthor: Restrict high priorities on group_create
  drm/xe/display: Avoid encoder_suspend at runtime suspend
  drm/xe: Suspend/resume user access only during system s/r
  drm/xe/display: Match i915 driver suspend/resume sequences better
  drm/xe: Add missing runtime reference to wedged upon gt_reset
  drm/xe/pcode: Treat pcode as per-tile rather than per-GT
  drm/xe/gsc: Do not attempt to load the GSC multiple times
  drm/bridge-connector: reset the HDMI connector state
  drm/bridge-connector: move to DRM_DISPLAY_HELPER module
  drm/display: stop depending on DRM_DISPLAY_HELPER
  drm/i915/display: Increase Fast Wake Sync length as a quirk
  drm/i915/display: Add mechanism to use sink model when applying quirk
  drm/amd/display: Block timing sync for different signals in PMO
  drm/amd/display: Lock DC and exit IPS when changing backlight
  drm/amdgpu: always allocate cleared VRAM for GEM allocations
  ...

get_stashed_dentry() tries to optimistically retrieve a stashed dentry
from a provided location.  It needs to ensure to hold rcu lock before it
dereference the stashed location to prevent UAF issues.  Use
rcu_dereference() instead of READ_ONCE() it's effectively equivalent
with some lockdep bells and whistles and it communicates clearly that
this expects rcu protection.

Link: https://lore.kernel.org/r/20240906-vfs-hotfix-5959800ffa68@brauner
Fixes: 07fd7c32 ("libfs: add path_from_stashed()")
Reported-by: syzbot+f82b36bffae7ef78b6a7@syzkaller.appspotmail.com
Fixes: syzbot+f82b36bffae7ef78b6a7@syzkaller.appspotmail.com
Reported-by: syzbot+cbe4b96e1194b0e34db6@syzkaller.appspotmail.com
Fixes: syzbot+cbe4b96e1194b0e34db6@syzkaller.appspotmail.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

cocci reported a double assignment problem. Upon reviewing previous
commits, it appears this may actually be an incorrect assignment.

Fixes: 8b955034 ("drm/ipp: clean up debug messages")
Signed-off-by: Yuesong Li <liyuesong@vivo.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>

Function usage exynos_atomic_commit was removed in
commit 41cbf0fd ("drm/exynos: use atomic helper commit").
Remove unnecessary function declare.
Signed-off-by: Kwanghoon Son <k.son@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>