--- /dev/null
+From b871cb971c683f7f212e7ca3c9a6709a75785116 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 20 Mar 2023 15:09:54 +0100
+Subject: ALSA: hda/conexant: Partial revert of a quirk for Lenovo
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit b871cb971c683f7f212e7ca3c9a6709a75785116 upstream.
+
+The recent commit f83bb2592482 ("ALSA: hda/conexant: Add quirk for
+LENOVO 20149 Notebook model") introduced a quirk for the device with
+17aa:3977, but this caused a regression on another model (Lenovo
+Ideadpad U31) with the very same PCI SSID. And, through skimming over
+the net, it seems that this PCI SSID is used for multiple different
+models, so it's no good idea to apply the quirk with the SSID.
+
+Although we may take a different ID check (e.g. the codec SSID instead
+of the PCI SSID), unfortunately, the original patch author couldn't
+identify the hardware details any longer as the machine was returned,
+and we can't develop the further proper fix.
+
+In this patch, instead, we partially revert the change so that the
+quirk won't be applied as default for addressing the regression.
+Meanwhile, the quirk function itself is kept, and it's now made to be
+applicable via the explicit model=lenovo-20149 option.
+
+Fixes: f83bb2592482 ("ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model")
+Reported-by: Jetro Jormalainen <jje-lxkl@jetro.fi>
+Link: https://lore.kernel.org/r/20230308215009.4d3e58a6@mopti
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20230320140954.31154-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_conexant.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -980,7 +980,10 @@ static const struct snd_pci_quirk cxt506
+ SND_PCI_QUIRK(0x17aa, 0x3905, "Lenovo G50-30", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x390b, "Lenovo G50-80", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC),
+- SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_PINCFG_LENOVO_NOTEBOOK),
++ /* NOTE: we'd need to extend the quirk for 17aa:3977 as the same
++ * PCI SSID is used on multiple Lenovo models
++ */
++ SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo G50-70", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", CXT_FIXUP_THINKPAD_ACPI),
+@@ -1003,6 +1006,7 @@ static const struct hda_model_fixup cxt5
+ { .id = CXT_FIXUP_MUTE_LED_GPIO, .name = "mute-led-gpio" },
+ { .id = CXT_FIXUP_HP_ZBOOK_MUTE_LED, .name = "hp-zbook-mute-led" },
+ { .id = CXT_FIXUP_HP_MIC_NO_PRESENCE, .name = "hp-mic-fix" },
++ { .id = CXT_PINCFG_LENOVO_NOTEBOOK, .name = "lenovo-20149" },
+ {}
+ };
+
--- /dev/null
+From 52aad39385e1bfdb34a1b405f699a8ef302c58b0 Mon Sep 17 00:00:00 2001
+From: huangwenhui <huangwenhuia@uniontech.com>
+Date: Tue, 28 Mar 2023 15:46:44 +0800
+Subject: ALSA: hda/realtek: Add quirk for Lenovo ZhaoYang CF4620Z
+
+From: huangwenhui <huangwenhuia@uniontech.com>
+
+commit 52aad39385e1bfdb34a1b405f699a8ef302c58b0 upstream.
+
+Fix headset microphone detection on Lenovo ZhaoYang CF4620Z.
+
+[ adjusted to be applicable to the latest tree -- tiwai ]
+
+Signed-off-by: huangwenhui <huangwenhuia@uniontech.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20230328074644.30142-1-huangwenhuia@uniontech.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9712,6 +9712,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x17aa, 0x511e, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x511f, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
++ SND_PCI_QUIRK(0x17aa, 0x9e56, "Lenovo ZhaoYang CF4620Z", ALC286_FIXUP_SONY_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1849, 0x1233, "ASRock NUC Box 1100", ALC233_FIXUP_NO_AUDIO_JACK),
+ SND_PCI_QUIRK(0x1849, 0xa233, "Positivo Master C6300", ALC269_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MACH-WX9", ALC256_FIXUP_HUAWEI_MACH_WX9_PINS),
--- /dev/null
+From b7a5822810c4398515300d614d988cf638adecad Mon Sep 17 00:00:00 2001
+From: Tim Crawford <tcrawford@system76.com>
+Date: Fri, 17 Mar 2023 08:18:25 -0600
+Subject: ALSA: hda/realtek: Add quirks for some Clevo laptops
+
+From: Tim Crawford <tcrawford@system76.com>
+
+commit b7a5822810c4398515300d614d988cf638adecad upstream.
+
+Add the audio quirk for some of Clevo's latest RPL laptops:
+
+- NP50RNJS (ALC256)
+- NP70SNE (ALC256)
+- PD50SNE (ALC1220)
+- PE60RNE (ALC1220)
+
+Co-authored-by: Jeremy Soller <jeremy@system76.com>
+Signed-off-by: Tim Crawford <tcrawford@system76.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20230317141825.11807-1-tcrawford@system76.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2631,6 +2631,7 @@ static const struct snd_pci_quirk alc882
+ SND_PCI_QUIRK(0x1558, 0x65e5, "Clevo PC50D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x65f1, "Clevo PC50HS", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x65f5, "Clevo PD50PN[NRT]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x66a2, "Clevo PE60RNE", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+@@ -2651,6 +2652,7 @@ static const struct snd_pci_quirk alc882
+ SND_PCI_QUIRK(0x1558, 0x96e1, "Clevo P960[ER][CDFN]-K", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x97e1, "Clevo P970[ER][CDFN]", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x97e2, "Clevo P970RC-M", ALC1220_FIXUP_CLEVO_P950),
++ SND_PCI_QUIRK(0x1558, 0xd502, "Clevo PD50SNE", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", ALC882_FIXUP_LENOVO_Y530),
+@@ -9574,6 +9576,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1558, 0x5101, "Clevo S510WU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x5157, "Clevo W517GU1", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x51a1, "Clevo NS50MU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x5630, "Clevo NP50RNJS", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x70a1, "Clevo NB70T[HJK]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x70b3, "Clevo NK70SB", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x70f2, "Clevo NH79EPY", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+@@ -9608,6 +9611,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1558, 0x971d, "Clevo N970T[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0xa500, "Clevo NL5[03]RU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0xa600, "Clevo NL50NU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0xa671, "Clevo NP70SN[CDE]", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0xb018, "Clevo NP50D[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0xb019, "Clevo NH77D[BE]Q", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0xb022, "Clevo NH77D[DC][QW]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
--- /dev/null
+From fa4e7a6fa12b1132340785e14bd439cbe95b7a5a Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 24 Mar 2023 08:50:05 +0100
+Subject: ALSA: usb-audio: Fix regression on detection of Roland VS-100
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit fa4e7a6fa12b1132340785e14bd439cbe95b7a5a upstream.
+
+It's been reported that the recent kernel can't probe the PCM devices
+on Roland VS-100 properly, and it turned out to be a regression by the
+recent addition of the bit shift range check for the format bits.
+In the old code, we just did bit-shift and it resulted in zero, which
+is then corrected to the standard PCM format, while the new code
+explicitly returns an error in such a case.
+
+For addressing the regression, relax the check and fallback to the
+standard PCM type (with the info output).
+
+Fixes: 43d5ca88dfcd ("ALSA: usb-audio: Fix potential out-of-bounds shift")
+Cc: <stable@vger.kernel.org>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=217084
+Link: https://lore.kernel.org/r/20230324075005.19403-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/format.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/sound/usb/format.c
++++ b/sound/usb/format.c
+@@ -39,8 +39,12 @@ static u64 parse_audio_format_i_type(str
+ case UAC_VERSION_1:
+ default: {
+ struct uac_format_type_i_discrete_descriptor *fmt = _fmt;
+- if (format >= 64)
+- return 0; /* invalid format */
++ if (format >= 64) {
++ usb_audio_info(chip,
++ "%u:%d: invalid format type 0x%llx is detected, processed as PCM\n",
++ fp->iface, fp->altsetting, format);
++ format = UAC_FORMAT_TYPE_I_PCM;
++ }
+ sample_width = fmt->bBitResolution;
+ sample_bytes = fmt->bSubframeSize;
+ format = 1ULL << format;
--- /dev/null
+From d1366b283d94ac4537a4b3a1e8668da4df7ce7e9 Mon Sep 17 00:00:00 2001
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+Date: Fri, 24 Mar 2023 14:01:41 +0100
+Subject: can: j1939: prevent deadlock by moving j1939_sk_errqueue()
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+commit d1366b283d94ac4537a4b3a1e8668da4df7ce7e9 upstream.
+
+This commit addresses a deadlock situation that can occur in certain
+scenarios, such as when running data TP/ETP transfer and subscribing to
+the error queue while receiving a net down event. The deadlock involves
+locks in the following order:
+
+3
+ j1939_session_list_lock -> active_session_list_lock
+ j1939_session_activate
+ ...
+ j1939_sk_queue_activate_next -> sk_session_queue_lock
+ ...
+ j1939_xtp_rx_eoma_one
+
+2
+ j1939_sk_queue_drop_all -> sk_session_queue_lock
+ ...
+ j1939_sk_netdev_event_netdown -> j1939_socks_lock
+ j1939_netdev_notify
+
+1
+ j1939_sk_errqueue -> j1939_socks_lock
+ __j1939_session_cancel -> active_session_list_lock
+ j1939_tp_rxtimer
+
+ CPU0 CPU1
+ ---- ----
+ lock(&priv->active_session_list_lock);
+ lock(&jsk->sk_session_queue_lock);
+ lock(&priv->active_session_list_lock);
+ lock(&priv->j1939_socks_lock);
+
+The solution implemented in this commit is to move the
+j1939_sk_errqueue() call out of the active_session_list_lock context,
+thus preventing the deadlock situation.
+
+Reported-by: syzbot+ee1cd780f69483a8616b@syzkaller.appspotmail.com
+Fixes: 5b9272e93f2e ("can: j1939: extend UAPI to notify about RX status")
+Co-developed-by: Hillf Danton <hdanton@sina.com>
+Signed-off-by: Hillf Danton <hdanton@sina.com>
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Link: https://lore.kernel.org/all/20230324130141.2132787-1-o.rempel@pengutronix.de
+Cc: stable@vger.kernel.org
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/can/j1939/transport.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/net/can/j1939/transport.c
++++ b/net/can/j1939/transport.c
+@@ -1124,8 +1124,6 @@ static void __j1939_session_cancel(struc
+
+ if (session->sk)
+ j1939_sk_send_loop_abort(session->sk, session->err);
+- else
+- j1939_sk_errqueue(session, J1939_ERRQUEUE_RX_ABORT);
+ }
+
+ static void j1939_session_cancel(struct j1939_session *session,
+@@ -1140,6 +1138,9 @@ static void j1939_session_cancel(struct
+ }
+
+ j1939_session_list_unlock(session->priv);
++
++ if (!session->sk)
++ j1939_sk_errqueue(session, J1939_ERRQUEUE_RX_ABORT);
+ }
+
+ static enum hrtimer_restart j1939_tp_txtimer(struct hrtimer *hrtimer)
+@@ -1253,6 +1254,9 @@ static enum hrtimer_restart j1939_tp_rxt
+ __j1939_session_cancel(session, J1939_XTP_ABORT_TIMEOUT);
+ }
+ j1939_session_list_unlock(session->priv);
++
++ if (!session->sk)
++ j1939_sk_errqueue(session, J1939_ERRQUEUE_RX_ABORT);
+ }
+
+ j1939_session_put(session);
--- /dev/null
+From 666eed46769d929c3e13636134ecfc67d75ef548 Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@kernel.org>
+Date: Thu, 30 Mar 2023 15:09:29 -0400
+Subject: dm: fix __send_duplicate_bios() to always allow for splitting IO
+
+From: Mike Snitzer <snitzer@kernel.org>
+
+commit 666eed46769d929c3e13636134ecfc67d75ef548 upstream.
+
+Commit 7dd76d1feec70 ("dm: improve bio splitting and associated IO
+accounting") only called setup_split_accounting() from
+__send_duplicate_bios() if a single bio were being issued. But the case
+where duplicate bios are issued must call it too.
+
+Otherwise the bio won't be split and resubmitted (via recursion through
+block core back to DM) to submit the later portions of a bio (which may
+map to an entirely different target).
+
+For example, when discarding an entire DM striped device with the
+following DM table:
+ vg-lvol0: 0 159744 striped 2 128 7:0 2048 7:1 2048
+ vg-lvol0: 159744 45056 striped 2 128 7:2 2048 7:3 2048
+
+Before (broken, discards the first striped target's devices twice):
+ device-mapper: striped: target_stripe=0, bdev=7:0, start=2048 len=79872
+ device-mapper: striped: target_stripe=1, bdev=7:1, start=2048 len=79872
+ device-mapper: striped: target_stripe=0, bdev=7:0, start=2049 len=22528
+ device-mapper: striped: target_stripe=1, bdev=7:1, start=2048 len=22528
+
+After (works as expected):
+ device-mapper: striped: target_stripe=0, bdev=7:0, start=2048 len=79872
+ device-mapper: striped: target_stripe=1, bdev=7:1, start=2048 len=79872
+ device-mapper: striped: target_stripe=0, bdev=7:2, start=2048 len=22528
+ device-mapper: striped: target_stripe=1, bdev=7:3, start=2048 len=22528
+
+Fixes: 7dd76d1feec70 ("dm: improve bio splitting and associated IO accounting")
+Cc: stable@vger.kernel.org
+Reported-by: Orange Kao <orange@aiven.io>
+Signed-off-by: Mike Snitzer <snitzer@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -1509,6 +1509,8 @@ static int __send_duplicate_bios(struct
+ ret = 1;
+ break;
+ default:
++ if (len)
++ setup_split_accounting(ci, *len);
+ /* dm_accept_partial_bio() is not supported with shared tio->len_ptr */
+ alloc_multiple_bios(&blist, ci, ti, num_bios);
+ while ((clone = bio_list_pop(&blist))) {
--- /dev/null
+From f4f3b7dedbe849e780c779ba67365bb1db0d8637 Mon Sep 17 00:00:00 2001
+From: Fangzhi Zuo <Jerry.Zuo@amd.com>
+Date: Fri, 24 Feb 2023 13:45:21 -0500
+Subject: drm/amd/display: Add DSC Support for Synaptics Cascaded MST Hub
+
+From: Fangzhi Zuo <Jerry.Zuo@amd.com>
+
+commit f4f3b7dedbe849e780c779ba67365bb1db0d8637 upstream.
+
+Traditional synaptics hub has one MST branch device without virtual dpcd.
+Synaptics cascaded hub has two chained MST branch devices. DSC decoding
+is performed via root MST branch device, instead of the second MST branch
+device.
+
+Reviewed-by: Hersen Wu <hersenxs.wu@amd.com>
+Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
+Signed-off-by: Fangzhi Zuo <Jerry.Zuo@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 19 ++++++++++++
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h | 12 +++++++
+ 2 files changed, 31 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+@@ -208,6 +208,21 @@ bool needs_dsc_aux_workaround(struct dc_
+ return false;
+ }
+
++bool is_synaptics_cascaded_panamera(struct dc_link *link, struct drm_dp_mst_port *port)
++{
++ u8 branch_vendor_data[4] = { 0 }; // Vendor data 0x50C ~ 0x50F
++
++ if (drm_dp_dpcd_read(port->mgr->aux, DP_BRANCH_VENDOR_SPECIFIC_START, &branch_vendor_data, 4) == 4) {
++ if (link->dpcd_caps.branch_dev_id == DP_BRANCH_DEVICE_ID_90CC24 &&
++ IS_SYNAPTICS_CASCADED_PANAMERA(link->dpcd_caps.branch_dev_name, branch_vendor_data)) {
++ DRM_INFO("Synaptics Cascaded MST hub\n");
++ return true;
++ }
++ }
++
++ return false;
++}
++
+ static bool validate_dsc_caps_on_connector(struct amdgpu_dm_connector *aconnector)
+ {
+ struct dc_sink *dc_sink = aconnector->dc_sink;
+@@ -231,6 +246,10 @@ static bool validate_dsc_caps_on_connect
+ needs_dsc_aux_workaround(aconnector->dc_link))
+ aconnector->dsc_aux = &aconnector->mst_port->dm_dp_aux.aux;
+
++ /* synaptics cascaded MST hub case */
++ if (!aconnector->dsc_aux && is_synaptics_cascaded_panamera(aconnector->dc_link, port))
++ aconnector->dsc_aux = port->mgr->aux;
++
+ if (!aconnector->dsc_aux)
+ return false;
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h
+@@ -34,6 +34,18 @@
+ #define SYNAPTICS_RC_OFFSET 0x4BC
+ #define SYNAPTICS_RC_DATA 0x4C0
+
++#define DP_BRANCH_VENDOR_SPECIFIC_START 0x50C
++
++/**
++ * Panamera MST Hub detection
++ * Offset DPCD 050Eh == 0x5A indicates cascaded MST hub case
++ * Check from beginning of branch device vendor specific field (050Ch)
++ */
++#define IS_SYNAPTICS_PANAMERA(branchDevName) (((int)branchDevName[4] & 0xF0) == 0x50 ? 1 : 0)
++#define BRANCH_HW_REVISION_PANAMERA_A2 0x10
++#define SYNAPTICS_CASCADED_HUB_ID 0x5A
++#define IS_SYNAPTICS_CASCADED_PANAMERA(devName, data) ((IS_SYNAPTICS_PANAMERA(devName) && ((int)data[2] == SYNAPTICS_CASCADED_HUB_ID)) ? 1 : 0)
++
+ struct amdgpu_display_manager;
+ struct amdgpu_dm_connector;
+
--- /dev/null
+From 68dc1846c3a44d5e633be145c169ce2fd5420695 Mon Sep 17 00:00:00 2001
+From: Fangzhi Zuo <Jerry.Zuo@amd.com>
+Date: Tue, 28 Feb 2023 21:34:58 -0500
+Subject: drm/amd/display: Take FEC Overhead into Timeslot Calculation
+
+From: Fangzhi Zuo <Jerry.Zuo@amd.com>
+
+commit 68dc1846c3a44d5e633be145c169ce2fd5420695 upstream.
+
+8b/10b encoding needs to add 3% fec overhead into the pbn.
+In the Synapcis Cascaded MST hub, the first stage MST branch device
+needs the information to determine the timeslot count for the
+second stage MST branch device. Missing this overhead will leads to
+insufficient timeslot allocation.
+
+Cc: stable@vger.kernel.org
+Cc: Mario Limonciello <mario.limonciello@amd.com>
+Reviewed-by: Hersen Wu <hersenxs.wu@amd.com>
+Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
+Signed-off-by: Fangzhi Zuo <Jerry.Zuo@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 32 +++++++++---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h | 3 +
+ 2 files changed, 27 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+@@ -646,12 +646,25 @@ struct dsc_mst_fairness_params {
+ struct amdgpu_dm_connector *aconnector;
+ };
+
+-static int kbps_to_peak_pbn(int kbps)
++static uint16_t get_fec_overhead_multiplier(struct dc_link *dc_link)
++{
++ u8 link_coding_cap;
++ uint16_t fec_overhead_multiplier_x1000 = PBN_FEC_OVERHEAD_MULTIPLIER_8B_10B;
++
++ link_coding_cap = dc_link_dp_mst_decide_link_encoding_format(dc_link);
++ if (link_coding_cap == DP_128b_132b_ENCODING)
++ fec_overhead_multiplier_x1000 = PBN_FEC_OVERHEAD_MULTIPLIER_128B_132B;
++
++ return fec_overhead_multiplier_x1000;
++}
++
++static int kbps_to_peak_pbn(int kbps, uint16_t fec_overhead_multiplier_x1000)
+ {
+ u64 peak_kbps = kbps;
+
+ peak_kbps *= 1006;
+- peak_kbps = div_u64(peak_kbps, 1000);
++ peak_kbps *= fec_overhead_multiplier_x1000;
++ peak_kbps = div_u64(peak_kbps, 1000 * 1000);
+ return (int) DIV64_U64_ROUND_UP(peak_kbps * 64, (54 * 8 * 1000));
+ }
+
+@@ -745,11 +758,12 @@ static int increase_dsc_bpp(struct drm_a
+ int link_timeslots_used;
+ int fair_pbn_alloc;
+ int ret = 0;
++ uint16_t fec_overhead_multiplier_x1000 = get_fec_overhead_multiplier(dc_link);
+
+ for (i = 0; i < count; i++) {
+ if (vars[i + k].dsc_enabled) {
+ initial_slack[i] =
+- kbps_to_peak_pbn(params[i].bw_range.max_kbps) - vars[i + k].pbn;
++ kbps_to_peak_pbn(params[i].bw_range.max_kbps, fec_overhead_multiplier_x1000) - vars[i + k].pbn;
+ bpp_increased[i] = false;
+ remaining_to_increase += 1;
+ } else {
+@@ -845,6 +859,7 @@ static int try_disable_dsc(struct drm_at
+ int next_index;
+ int remaining_to_try = 0;
+ int ret;
++ uint16_t fec_overhead_multiplier_x1000 = get_fec_overhead_multiplier(dc_link);
+
+ for (i = 0; i < count; i++) {
+ if (vars[i + k].dsc_enabled
+@@ -874,7 +889,7 @@ static int try_disable_dsc(struct drm_at
+ if (next_index == -1)
+ break;
+
+- vars[next_index].pbn = kbps_to_peak_pbn(params[next_index].bw_range.stream_kbps);
++ vars[next_index].pbn = kbps_to_peak_pbn(params[next_index].bw_range.stream_kbps, fec_overhead_multiplier_x1000);
+ ret = drm_dp_atomic_find_time_slots(state,
+ params[next_index].port->mgr,
+ params[next_index].port,
+@@ -887,7 +902,7 @@ static int try_disable_dsc(struct drm_at
+ vars[next_index].dsc_enabled = false;
+ vars[next_index].bpp_x16 = 0;
+ } else {
+- vars[next_index].pbn = kbps_to_peak_pbn(params[next_index].bw_range.max_kbps);
++ vars[next_index].pbn = kbps_to_peak_pbn(params[next_index].bw_range.max_kbps, fec_overhead_multiplier_x1000);
+ ret = drm_dp_atomic_find_time_slots(state,
+ params[next_index].port->mgr,
+ params[next_index].port,
+@@ -916,6 +931,7 @@ static int compute_mst_dsc_configs_for_l
+ int count = 0;
+ int i, k, ret;
+ bool debugfs_overwrite = false;
++ uint16_t fec_overhead_multiplier_x1000 = get_fec_overhead_multiplier(dc_link);
+
+ memset(params, 0, sizeof(params));
+
+@@ -977,7 +993,7 @@ static int compute_mst_dsc_configs_for_l
+ /* Try no compression */
+ for (i = 0; i < count; i++) {
+ vars[i + k].aconnector = params[i].aconnector;
+- vars[i + k].pbn = kbps_to_peak_pbn(params[i].bw_range.stream_kbps);
++ vars[i + k].pbn = kbps_to_peak_pbn(params[i].bw_range.stream_kbps, fec_overhead_multiplier_x1000);
+ vars[i + k].dsc_enabled = false;
+ vars[i + k].bpp_x16 = 0;
+ ret = drm_dp_atomic_find_time_slots(state, params[i].port->mgr, params[i].port,
+@@ -996,7 +1012,7 @@ static int compute_mst_dsc_configs_for_l
+ /* Try max compression */
+ for (i = 0; i < count; i++) {
+ if (params[i].compression_possible && params[i].clock_force_enable != DSC_CLK_FORCE_DISABLE) {
+- vars[i + k].pbn = kbps_to_peak_pbn(params[i].bw_range.min_kbps);
++ vars[i + k].pbn = kbps_to_peak_pbn(params[i].bw_range.min_kbps, fec_overhead_multiplier_x1000);
+ vars[i + k].dsc_enabled = true;
+ vars[i + k].bpp_x16 = params[i].bw_range.min_target_bpp_x16;
+ ret = drm_dp_atomic_find_time_slots(state, params[i].port->mgr,
+@@ -1004,7 +1020,7 @@ static int compute_mst_dsc_configs_for_l
+ if (ret < 0)
+ return ret;
+ } else {
+- vars[i + k].pbn = kbps_to_peak_pbn(params[i].bw_range.stream_kbps);
++ vars[i + k].pbn = kbps_to_peak_pbn(params[i].bw_range.stream_kbps, fec_overhead_multiplier_x1000);
+ vars[i + k].dsc_enabled = false;
+ vars[i + k].bpp_x16 = 0;
+ ret = drm_dp_atomic_find_time_slots(state, params[i].port->mgr,
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h
+@@ -46,6 +46,9 @@
+ #define SYNAPTICS_CASCADED_HUB_ID 0x5A
+ #define IS_SYNAPTICS_CASCADED_PANAMERA(devName, data) ((IS_SYNAPTICS_PANAMERA(devName) && ((int)data[2] == SYNAPTICS_CASCADED_HUB_ID)) ? 1 : 0)
+
++#define PBN_FEC_OVERHEAD_MULTIPLIER_8B_10B 1031
++#define PBN_FEC_OVERHEAD_MULTIPLIER_128B_132B 1000
++
+ struct amdgpu_display_manager;
+ struct amdgpu_dm_connector;
+
--- /dev/null
+From 2fec9dc8e0acc3dfb56d1389151bcf405f087b10 Mon Sep 17 00:00:00 2001
+From: Tim Huang <tim.huang@amd.com>
+Date: Thu, 30 Mar 2023 10:33:02 +0800
+Subject: drm/amdgpu: allow more APUs to do mode2 reset when go to S4
+
+From: Tim Huang <tim.huang@amd.com>
+
+commit 2fec9dc8e0acc3dfb56d1389151bcf405f087b10 upstream.
+
+Skip mode2 reset only for IMU enabled APUs when do S4.
+
+This patch is to fix the regression issue
+https://gitlab.freedesktop.org/drm/amd/-/issues/2483
+It is generated by commit b589626674de ("drm/amdgpu: skip ASIC reset
+for APUs when go to S4").
+
+Fixes: b589626674de ("drm/amdgpu: skip ASIC reset for APUs when go to S4")
+Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2483
+Tested-by: Yuan Perry <Perry.Yuan@amd.com>
+Signed-off-by: Tim Huang <tim.huang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 6.1.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+@@ -981,7 +981,12 @@ static bool amdgpu_atcs_pci_probe_handle
+ */
+ bool amdgpu_acpi_should_gpu_reset(struct amdgpu_device *adev)
+ {
+- if (adev->flags & AMD_IS_APU)
++ if ((adev->flags & AMD_IS_APU) &&
++ adev->gfx.imu.funcs) /* Not need to do mode2 reset for IMU enabled APUs */
++ return false;
++
++ if ((adev->flags & AMD_IS_APU) &&
++ amdgpu_acpi_is_s3_active(adev))
+ return false;
+
+ if (amdgpu_sriov_vf(adev))
--- /dev/null
+From 963b2e8c428f79489ceeb058e8314554ec9cbe6f Mon Sep 17 00:00:00 2001
+From: Lucas Stach <l.stach@pengutronix.de>
+Date: Fri, 24 Feb 2023 18:21:54 +0100
+Subject: drm/etnaviv: fix reference leak when mmaping imported buffer
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+commit 963b2e8c428f79489ceeb058e8314554ec9cbe6f upstream.
+
+drm_gem_prime_mmap() takes a reference on the GEM object, but before that
+drm_gem_mmap_obj() already takes a reference, which will be leaked as only
+one reference is dropped when the mapping is closed. Drop the extra
+reference when dma_buf_mmap() succeeds.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
+@@ -91,7 +91,15 @@ static void *etnaviv_gem_prime_vmap_impl
+ static int etnaviv_gem_prime_mmap_obj(struct etnaviv_gem_object *etnaviv_obj,
+ struct vm_area_struct *vma)
+ {
+- return dma_buf_mmap(etnaviv_obj->base.dma_buf, vma, 0);
++ int ret;
++
++ ret = dma_buf_mmap(etnaviv_obj->base.dma_buf, vma, 0);
++ if (!ret) {
++ /* Drop the reference acquired by drm_gem_mmap_obj(). */
++ drm_gem_object_put(&etnaviv_obj->base);
++ }
++
++ return ret;
+ }
+
+ static const struct etnaviv_gem_ops etnaviv_gem_prime_ops = {
--- /dev/null
+From 3413881e1ecc3cba722a2e87ec099692eed5be28 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Mon, 20 Mar 2023 11:05:17 +0200
+Subject: drm/i915/dpt: Treat the DPT BO as a framebuffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 3413881e1ecc3cba722a2e87ec099692eed5be28 upstream.
+
+Currently i915_gem_object_is_framebuffer() doesn't treat the
+BO containing the framebuffer's DPT as a framebuffer itself.
+This means eg. that the shrinker can evict the DPT BO while
+leaving the actual FB BO bound, when the DPT is allocated
+from regular shmem.
+
+That causes an immediate oops during hibernate as we
+try to rewrite the PTEs inside the already evicted
+DPT obj.
+
+TODO: presumably this might also be the reason for the
+DPT related display faults under heavy memory pressure,
+but I'm still not sure how that would happen as the object
+should be pinned by intel_dpt_pin() while in active use by
+the display engine...
+
+Cc: stable@vger.kernel.org
+Cc: Juha-Pekka Heikkila <juhapekka.heikkila@gmail.com>
+Cc: Matthew Auld <matthew.auld@intel.com>
+Cc: Imre Deak <imre.deak@intel.com>
+Fixes: 0dc987b699ce ("drm/i915/display: Add smem fallback allocation for dpt")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230320090522.9909-2-ville.syrjala@linux.intel.com
+Reviewed-by: Juha-Pekka Heikkila <juhapekka.heikkila@gmail.com>
+(cherry picked from commit 779cb5ba64ec7df80675a956c9022929514f517a)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_dpt.c | 2 ++
+ drivers/gpu/drm/i915/gem/i915_gem_object.h | 2 +-
+ drivers/gpu/drm/i915/gem/i915_gem_object_types.h | 3 +++
+ 3 files changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_dpt.c
++++ b/drivers/gpu/drm/i915/display/intel_dpt.c
+@@ -301,6 +301,7 @@ intel_dpt_create(struct intel_framebuffe
+ vm->pte_encode = gen8_ggtt_pte_encode;
+
+ dpt->obj = dpt_obj;
++ dpt->obj->is_dpt = true;
+
+ return &dpt->vm;
+ }
+@@ -309,5 +310,6 @@ void intel_dpt_destroy(struct i915_addre
+ {
+ struct i915_dpt *dpt = i915_vm_to_dpt(vm);
+
++ dpt->obj->is_dpt = false;
+ i915_vm_put(&dpt->vm);
+ }
+--- a/drivers/gpu/drm/i915/gem/i915_gem_object.h
++++ b/drivers/gpu/drm/i915/gem/i915_gem_object.h
+@@ -319,7 +319,7 @@ i915_gem_object_never_mmap(const struct
+ static inline bool
+ i915_gem_object_is_framebuffer(const struct drm_i915_gem_object *obj)
+ {
+- return READ_ONCE(obj->frontbuffer);
++ return READ_ONCE(obj->frontbuffer) || obj->is_dpt;
+ }
+
+ static inline unsigned int
+--- a/drivers/gpu/drm/i915/gem/i915_gem_object_types.h
++++ b/drivers/gpu/drm/i915/gem/i915_gem_object_types.h
+@@ -491,6 +491,9 @@ struct drm_i915_gem_object {
+ */
+ unsigned int cache_dirty:1;
+
++ /* @is_dpt: Object houses a display page table (DPT) */
++ unsigned int is_dpt:1;
++
+ /**
+ * @read_domains: Read memory domains.
+ *
--- /dev/null
+From d032ca43f2c80049ce5aabd3f208dc3849359497 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris.p.wilson@linux.intel.com>
+Date: Thu, 16 Mar 2023 17:59:18 +0100
+Subject: drm/i915/gem: Flush lmem contents after construction
+
+From: Chris Wilson <chris.p.wilson@linux.intel.com>
+
+commit d032ca43f2c80049ce5aabd3f208dc3849359497 upstream.
+
+i915_gem_object_create_lmem_from_data() lacks the flush of the data
+written to lmem to ensure the object is marked as dirty and the writes
+flushed to the backing store. Once created, we can immediately release
+the obj->mm.mapping caching of the vmap.
+
+Fixes: 7acbbc7cf485 ("drm/i915/guc: put all guc objects in lmem when available")
+Cc: Matthew Auld <matthew.auld@intel.com>
+Cc: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Cc: Andi Shyti <andi.shyti@linux.intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Cc: John Harrison <John.C.Harrison@Intel.com>
+Signed-off-by: Chris Wilson <chris.p.wilson@linux.intel.com>
+Cc: <stable@vger.kernel.org> # v5.16+
+Signed-off-by: Nirmoy Das <nirmoy.das@intel.com>
+Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
+Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230316165918.13074-1-nirmoy.das@intel.com
+(cherry picked from commit e2ee10474ce766686e7a7496585cdfaf79e3a1bf)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gem/i915_gem_lmem.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/gem/i915_gem_lmem.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_lmem.c
+@@ -127,7 +127,8 @@ i915_gem_object_create_lmem_from_data(st
+
+ memcpy(map, data, size);
+
+- i915_gem_object_unpin_map(obj);
++ i915_gem_object_flush_map(obj);
++ __i915_gem_object_release_map(obj);
+
+ return obj;
+ }
--- /dev/null
+From a56cde41340ac4049fa6edac9e6cfbcd2804074e Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Tue, 14 Feb 2023 15:26:43 +0100
+Subject: dt-bindings: mtd: jedec,spi-nor: Document CPOL/CPHA support
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit a56cde41340ac4049fa6edac9e6cfbcd2804074e upstream.
+
+SPI EEPROMs typically support both SPI Mode 0 (CPOL=CPHA=0) and Mode 3
+(CPOL=CPHA=1). However, using the latter is currently flagged as an
+error by "make dtbs_check", e.g.:
+
+ arch/arm/boot/dts/r8a7791-koelsch.dtb: flash@0: Unevaluated properties are not allowed ('spi-cpha', 'spi-cpol' were unexpected)
+ From schema: Documentation/devicetree/bindings/mtd/jedec,spi-nor.yaml
+
+Fix this by documenting support for CPOL=CPHA=1.
+
+Fixes: 233363aba72ac638 ("spi/panel: dt-bindings: drop CPHA and CPOL from common properties")
+Cc: stable@vger.kernel.org
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/afe470603028db9374930b0c57464b1f6d52bdd3.1676384304.git.geert+renesas@glider.be
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/mtd/jedec,spi-nor.yaml | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/Documentation/devicetree/bindings/mtd/jedec,spi-nor.yaml
++++ b/Documentation/devicetree/bindings/mtd/jedec,spi-nor.yaml
+@@ -76,6 +76,13 @@ properties:
+ If "broken-flash-reset" is present then having this property does not
+ make any difference.
+
++ spi-cpol: true
++ spi-cpha: true
++
++dependencies:
++ spi-cpol: [ spi-cpha ]
++ spi-cpha: [ spi-cpol ]
++
+ unevaluatedProperties: false
+
+ examples:
--- /dev/null
+From fb27e70f6e408dee5d22b083e7a38a59e6118253 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Wed, 22 Mar 2023 19:11:45 +0100
+Subject: modpost: Fix processing of CRCs on 32-bit build machines
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+commit fb27e70f6e408dee5d22b083e7a38a59e6118253 upstream.
+
+modpost now reads CRCs from .*.cmd files, parsing them using strtol().
+This is inconsistent with its parsing of Module.symvers and with their
+definition as *unsigned* 32-bit values.
+
+strtol() clamps values to [LONG_MIN, LONG_MAX], and when building on a
+32-bit system this changes all CRCs >= 0x80000000 to be 0x7fffffff.
+
+Change extract_crcs_for_object() to use strtoul() instead.
+
+Cc: stable@vger.kernel.org
+Fixes: f292d875d0dc ("modpost: extract symbol versions from *.cmd files")
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ scripts/mod/modpost.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -1733,7 +1733,7 @@ static void extract_crcs_for_object(cons
+ if (!isdigit(*p))
+ continue; /* skip this line */
+
+- crc = strtol(p, &p, 0);
++ crc = strtoul(p, &p, 0);
+ if (*p != '\n')
+ continue; /* skip this line */
+
--- /dev/null
+From 82e2c39f9ef78896e9b634dfd82dc042e6956bb7 Mon Sep 17 00:00:00 2001
+From: Josua Mayer <josua@solid-run.com>
+Date: Thu, 23 Mar 2023 12:25:36 +0200
+Subject: net: phy: dp83869: fix default value for tx-/rx-internal-delay
+
+From: Josua Mayer <josua@solid-run.com>
+
+commit 82e2c39f9ef78896e9b634dfd82dc042e6956bb7 upstream.
+
+dp83869 internally uses a look-up table for mapping supported delays in
+nanoseconds to register values.
+When specific delays are defined in device-tree, phy_get_internal_delay
+does the lookup automatically returning an index.
+
+The default case wrongly assigns the nanoseconds value from the lookup
+table, resulting in numeric value 2000 applied to delay configuration
+register, rather than the expected index values 0-7 (7 for 2000).
+Ultimately this issue broke RX for 1Gbps links.
+
+Fix default delay configuration by assigning the intended index value
+directly.
+
+Cc: stable@vger.kernel.org
+Fixes: 736b25afe284 ("net: dp83869: Add RGMII internal delay configuration")
+Co-developed-by: Yazan Shhady <yazan.shhady@solid-run.com>
+Signed-off-by: Yazan Shhady <yazan.shhady@solid-run.com>
+Signed-off-by: Josua Mayer <josua@solid-run.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/r/20230323102536.31988-1-josua@solid-run.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/dp83869.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/phy/dp83869.c
++++ b/drivers/net/phy/dp83869.c
+@@ -588,15 +588,13 @@ static int dp83869_of_init(struct phy_de
+ &dp83869_internal_delay[0],
+ delay_size, true);
+ if (dp83869->rx_int_delay < 0)
+- dp83869->rx_int_delay =
+- dp83869_internal_delay[DP83869_CLK_DELAY_DEF];
++ dp83869->rx_int_delay = DP83869_CLK_DELAY_DEF;
+
+ dp83869->tx_int_delay = phy_get_internal_delay(phydev, dev,
+ &dp83869_internal_delay[0],
+ delay_size, false);
+ if (dp83869->tx_int_delay < 0)
+- dp83869->tx_int_delay =
+- dp83869_internal_delay[DP83869_CLK_DELAY_DEF];
++ dp83869->tx_int_delay = DP83869_CLK_DELAY_DEF;
+
+ return ret;
+ }
--- /dev/null
+From 6165a16a5ad9b237bb3131cff4d3c601ccb8f9a3 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Tue, 21 Mar 2023 00:17:36 -0400
+Subject: NFSv4: Fix hangs when recovering open state after a server reboot
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+commit 6165a16a5ad9b237bb3131cff4d3c601ccb8f9a3 upstream.
+
+When we're using a cached open stateid or a delegation in order to avoid
+sending a CLAIM_PREVIOUS open RPC call to the server, we don't have a
+new open stateid to present to update_open_stateid().
+Instead rely on nfs4_try_open_cached(), just as if we were doing a
+normal open.
+
+Fixes: d2bfda2e7aa0 ("NFSv4: don't reprocess cached open CLAIM_PREVIOUS")
+Cc: stable@vger.kernel.org
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs/nfs4proc.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1980,8 +1980,7 @@ _nfs4_opendata_reclaim_to_nfs4_state(str
+ if (!data->rpc_done) {
+ if (data->rpc_status)
+ return ERR_PTR(data->rpc_status);
+- /* cached opens have already been processed */
+- goto update;
++ return nfs4_try_open_cached(data);
+ }
+
+ ret = nfs_refresh_inode(inode, &data->f_attr);
+@@ -1990,7 +1989,7 @@ _nfs4_opendata_reclaim_to_nfs4_state(str
+
+ if (data->o_res.delegation_type != 0)
+ nfs4_opendata_check_deleg(data, state);
+-update:
++
+ if (!update_open_stateid(state, &data->o_res.stateid,
+ NULL, data->o_arg.fmode))
+ return ERR_PTR(-EAGAIN);
--- /dev/null
+From b26cd9325be4c1fcd331b77f10acb627c560d4d7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Kornel=20Dul=C4=99ba?= <korneld@chromium.org>
+Date: Mon, 20 Mar 2023 09:32:59 +0000
+Subject: pinctrl: amd: Disable and mask interrupts on resume
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kornel Dulęba <korneld@chromium.org>
+
+commit b26cd9325be4c1fcd331b77f10acb627c560d4d7 upstream.
+
+This fixes a similar problem to the one observed in:
+commit 4e5a04be88fe ("pinctrl: amd: disable and mask interrupts on probe").
+
+On some systems, during suspend/resume cycle firmware leaves
+an interrupt enabled on a pin that is not used by the kernel.
+This confuses the AMD pinctrl driver and causes spurious interrupts.
+
+The driver already has logic to detect if a pin is used by the kernel.
+Leverage it to re-initialize interrupt fields of a pin only if it's not
+used by us.
+
+Cc: stable@vger.kernel.org
+Fixes: dbad75dd1f25 ("pinctrl: add AMD GPIO driver support.")
+Signed-off-by: Kornel Dulęba <korneld@chromium.org>
+Link: https://lore.kernel.org/r/20230320093259.845178-1-korneld@chromium.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/pinctrl-amd.c | 36 ++++++++++++++++++++----------------
+ 1 file changed, 20 insertions(+), 16 deletions(-)
+
+--- a/drivers/pinctrl/pinctrl-amd.c
++++ b/drivers/pinctrl/pinctrl-amd.c
+@@ -865,32 +865,34 @@ static const struct pinconf_ops amd_pinc
+ .pin_config_group_set = amd_pinconf_group_set,
+ };
+
+-static void amd_gpio_irq_init(struct amd_gpio *gpio_dev)
++static void amd_gpio_irq_init_pin(struct amd_gpio *gpio_dev, int pin)
+ {
+- struct pinctrl_desc *desc = gpio_dev->pctrl->desc;
++ const struct pin_desc *pd;
+ unsigned long flags;
+ u32 pin_reg, mask;
+- int i;
+
+ mask = BIT(WAKE_CNTRL_OFF_S0I3) | BIT(WAKE_CNTRL_OFF_S3) |
+ BIT(INTERRUPT_MASK_OFF) | BIT(INTERRUPT_ENABLE_OFF) |
+ BIT(WAKE_CNTRL_OFF_S4);
+
+- for (i = 0; i < desc->npins; i++) {
+- int pin = desc->pins[i].number;
+- const struct pin_desc *pd = pin_desc_get(gpio_dev->pctrl, pin);
+-
+- if (!pd)
+- continue;
++ pd = pin_desc_get(gpio_dev->pctrl, pin);
++ if (!pd)
++ return;
+
+- raw_spin_lock_irqsave(&gpio_dev->lock, flags);
++ raw_spin_lock_irqsave(&gpio_dev->lock, flags);
++ pin_reg = readl(gpio_dev->base + pin * 4);
++ pin_reg &= ~mask;
++ writel(pin_reg, gpio_dev->base + pin * 4);
++ raw_spin_unlock_irqrestore(&gpio_dev->lock, flags);
++}
+
+- pin_reg = readl(gpio_dev->base + i * 4);
+- pin_reg &= ~mask;
+- writel(pin_reg, gpio_dev->base + i * 4);
++static void amd_gpio_irq_init(struct amd_gpio *gpio_dev)
++{
++ struct pinctrl_desc *desc = gpio_dev->pctrl->desc;
++ int i;
+
+- raw_spin_unlock_irqrestore(&gpio_dev->lock, flags);
+- }
++ for (i = 0; i < desc->npins; i++)
++ amd_gpio_irq_init_pin(gpio_dev, i);
+ }
+
+ #ifdef CONFIG_PM_SLEEP
+@@ -943,8 +945,10 @@ static int amd_gpio_resume(struct device
+ for (i = 0; i < desc->npins; i++) {
+ int pin = desc->pins[i].number;
+
+- if (!amd_gpio_should_save(gpio_dev, pin))
++ if (!amd_gpio_should_save(gpio_dev, pin)) {
++ amd_gpio_irq_init_pin(gpio_dev, pin);
+ continue;
++ }
+
+ raw_spin_lock_irqsave(&gpio_dev->lock, flags);
+ gpio_dev->saved_regs[i] |= readl(gpio_dev->base + pin * 4) & PIN_IRQ_PENDING;
--- /dev/null
+From 7bb97e360acdd38b68ad0a1defb89c6e89c85596 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Fri, 24 Feb 2023 14:08:28 +0100
+Subject: pinctrl: at91-pio4: fix domain name assignment
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 7bb97e360acdd38b68ad0a1defb89c6e89c85596 upstream.
+
+Since commit d59f6617eef0 ("genirq: Allow fwnode to carry name
+information only") an IRQ domain is always given a name during
+allocation (e.g. used for the debugfs entry).
+
+Drop the no longer valid name assignment, which would lead to an attempt
+to free a string constant when removing the domain on late probe
+failures (e.g. probe deferral).
+
+Fixes: d59f6617eef0 ("genirq: Allow fwnode to carry name information only")
+Cc: stable@vger.kernel.org # 4.13
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Tested-by: Claudiu Beznea <claudiu.beznea@microchip.com> # on SAMA7G5
+Link: https://lore.kernel.org/r/20230224130828.27985-1-johan+linaro@kernel.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/pinctrl-at91-pio4.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/pinctrl/pinctrl-at91-pio4.c
++++ b/drivers/pinctrl/pinctrl-at91-pio4.c
+@@ -1206,7 +1206,6 @@ static int atmel_pinctrl_probe(struct pl
+ dev_err(dev, "can't add the irq domain\n");
+ return -ENODEV;
+ }
+- atmel_pioctrl->irq_domain->name = "atmel gpio";
+
+ for (i = 0; i < atmel_pioctrl->npins; i++) {
+ int irq = irq_create_mapping(atmel_pioctrl->irq_domain, i);
--- /dev/null
+From e3271a5917d1501089b1a224d702aa053e2877f4 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 30 Mar 2023 21:46:44 +0200
+Subject: platform/x86: ideapad-laptop: Stop sending KEY_TOUCHPAD_TOGGLE
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit e3271a5917d1501089b1a224d702aa053e2877f4 upstream.
+
+Commit 5829f8a897e4 ("platform/x86: ideapad-laptop: Send
+KEY_TOUCHPAD_TOGGLE on some models") made ideapad-laptop send
+KEY_TOUCHPAD_TOGGLE when we receive an ACPI notify with VPC event bit 5 set
+and the touchpad-state has not been changed by the EC itself already.
+
+This was done under the assumption that this would be good to do to make
+the touchpad-toggle hotkey work on newer models where the EC does not
+toggle the touchpad on/off itself (because it is not routed through
+the PS/2 controller, but uses I2C).
+
+But it turns out that at least some models, e.g. the Yoga 7-15ITL5 the EC
+triggers an ACPI notify with VPC event bit 5 set on resume, which would
+now cause a spurious KEY_TOUCHPAD_TOGGLE on resume to which the desktop
+environment responds by disabling the touchpad in software, breaking
+the touchpad (until manually re-enabled) on resume.
+
+It was never confirmed that sending KEY_TOUCHPAD_TOGGLE actually improves
+things on new models and at least some new models like the Yoga 7-15ITL5
+don't have a touchpad on/off toggle hotkey at all, while still sending
+ACPI notify events with VPC event bit 5 set.
+
+So it seems best to revert the change to send KEY_TOUCHPAD_TOGGLE when
+receiving an ACPI notify events with VPC event bit 5 and the touchpad
+state as reported by the EC has not changed.
+
+Note this is not a full revert the code to cache the last EC touchpad
+state is kept to avoid sending spurious KEY_TOUCHPAD_ON / _OFF events
+on resume.
+
+Fixes: 5829f8a897e4 ("platform/x86: ideapad-laptop: Send KEY_TOUCHPAD_TOGGLE on some models")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=217234
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20230330194644.64628-1-hdegoede@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/ideapad-laptop.c | 23 ++++++++++-------------
+ 1 file changed, 10 insertions(+), 13 deletions(-)
+
+--- a/drivers/platform/x86/ideapad-laptop.c
++++ b/drivers/platform/x86/ideapad-laptop.c
+@@ -1170,7 +1170,6 @@ static const struct key_entry ideapad_ke
+ { KE_KEY, 65, { KEY_PROG4 } },
+ { KE_KEY, 66, { KEY_TOUCHPAD_OFF } },
+ { KE_KEY, 67, { KEY_TOUCHPAD_ON } },
+- { KE_KEY, 68, { KEY_TOUCHPAD_TOGGLE } },
+ { KE_KEY, 128, { KEY_ESC } },
+
+ /*
+@@ -1526,18 +1525,16 @@ static void ideapad_sync_touchpad_state(
+ if (priv->features.ctrl_ps2_aux_port)
+ i8042_command(¶m, value ? I8042_CMD_AUX_ENABLE : I8042_CMD_AUX_DISABLE);
+
+- if (send_events) {
+- /*
+- * On older models the EC controls the touchpad and toggles it
+- * on/off itself, in this case we report KEY_TOUCHPAD_ON/_OFF.
+- * If the EC did not toggle, report KEY_TOUCHPAD_TOGGLE.
+- */
+- if (value != priv->r_touchpad_val) {
+- ideapad_input_report(priv, value ? 67 : 66);
+- sysfs_notify(&priv->platform_device->dev.kobj, NULL, "touchpad");
+- } else {
+- ideapad_input_report(priv, 68);
+- }
++ /*
++ * On older models the EC controls the touchpad and toggles it on/off
++ * itself, in this case we report KEY_TOUCHPAD_ON/_OFF. Some models do
++ * an acpi-notify with VPC bit 5 set on resume, so this function get
++ * called with send_events=true on every resume. Therefor if the EC did
++ * not toggle, do nothing to avoid sending spurious KEY_TOUCHPAD_TOGGLE.
++ */
++ if (send_events && value != priv->r_touchpad_val) {
++ ideapad_input_report(priv, value ? 67 : 66);
++ sysfs_notify(&priv->platform_device->dev.kobj, NULL, "touchpad");
+ }
+
+ priv->r_touchpad_val = value;
--- /dev/null
+From 1abce0580b89464546ae06abd5891ebec43c9470 Mon Sep 17 00:00:00 2001
+From: Benjamin Gray <bgray@linux.ibm.com>
+Date: Fri, 3 Mar 2023 09:59:47 +1100
+Subject: powerpc/64s: Fix __pte_needs_flush() false positive warning
+
+From: Benjamin Gray <bgray@linux.ibm.com>
+
+commit 1abce0580b89464546ae06abd5891ebec43c9470 upstream.
+
+Userspace PROT_NONE ptes set _PAGE_PRIVILEGED, triggering a false
+positive debug assertion that __pte_flags_need_flush() is not called
+on a kernel mapping.
+
+Detect when it is a userspace PROT_NONE page by checking the required
+bits of PAGE_NONE are set, and none of the RWX bits are set.
+pte_protnone() is insufficient here because it always returns 0 when
+CONFIG_NUMA_BALANCING=n.
+
+Fixes: b11931e9adc1 ("powerpc/64s: add pte_needs_flush and huge_pmd_needs_flush")
+Cc: stable@vger.kernel.org # v6.1+
+Reported-by: Russell Currey <ruscur@russell.cc>
+Signed-off-by: Benjamin Gray <bgray@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230302225947.81083-1-bgray@linux.ibm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/include/asm/book3s/64/tlbflush.h | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/include/asm/book3s/64/tlbflush.h
++++ b/arch/powerpc/include/asm/book3s/64/tlbflush.h
+@@ -148,6 +148,11 @@ static inline void flush_tlb_fix_spuriou
+ */
+ }
+
++static inline bool __pte_protnone(unsigned long pte)
++{
++ return (pte & (pgprot_val(PAGE_NONE) | _PAGE_RWX)) == pgprot_val(PAGE_NONE);
++}
++
+ static inline bool __pte_flags_need_flush(unsigned long oldval,
+ unsigned long newval)
+ {
+@@ -164,8 +169,8 @@ static inline bool __pte_flags_need_flus
+ /*
+ * We do not expect kernel mappings or non-PTEs or not-present PTEs.
+ */
+- VM_WARN_ON_ONCE(oldval & _PAGE_PRIVILEGED);
+- VM_WARN_ON_ONCE(newval & _PAGE_PRIVILEGED);
++ VM_WARN_ON_ONCE(!__pte_protnone(oldval) && oldval & _PAGE_PRIVILEGED);
++ VM_WARN_ON_ONCE(!__pte_protnone(newval) && newval & _PAGE_PRIVILEGED);
+ VM_WARN_ON_ONCE(!(oldval & _PAGE_PTE));
+ VM_WARN_ON_ONCE(!(newval & _PAGE_PTE));
+ VM_WARN_ON_ONCE(!(oldval & _PAGE_PRESENT));
--- /dev/null
+From fd7276189450110ed835eb0a334e62d2f1c4e3be Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Sun, 26 Mar 2023 16:15:57 -0600
+Subject: powerpc: Don't try to copy PPR for task with NULL pt_regs
+
+From: Jens Axboe <axboe@kernel.dk>
+
+commit fd7276189450110ed835eb0a334e62d2f1c4e3be upstream.
+
+powerpc sets up PF_KTHREAD and PF_IO_WORKER with a NULL pt_regs, which
+from my (arguably very short) checking is not commonly done for other
+archs. This is fine, except when PF_IO_WORKER's have been created and
+the task does something that causes a coredump to be generated. Then we
+get this crash:
+
+ Kernel attempted to read user page (160) - exploit attempt? (uid: 1000)
+ BUG: Kernel NULL pointer dereference on read at 0x00000160
+ Faulting instruction address: 0xc0000000000c3a60
+ Oops: Kernel access of bad area, sig: 11 [#1]
+ LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=32 NUMA pSeries
+ Modules linked in: bochs drm_vram_helper drm_kms_helper xts binfmt_misc ecb ctr syscopyarea sysfillrect cbc sysimgblt drm_ttm_helper aes_generic ttm sg libaes evdev joydev virtio_balloon vmx_crypto gf128mul drm dm_mod fuse loop configfs drm_panel_orientation_quirks ip_tables x_tables autofs4 hid_generic usbhid hid xhci_pci xhci_hcd usbcore usb_common sd_mod
+ CPU: 1 PID: 1982 Comm: ppc-crash Not tainted 6.3.0-rc2+ #88
+ Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1202 0xf000005 of:SLOF,HEAD hv:linux,kvm pSeries
+ NIP: c0000000000c3a60 LR: c000000000039944 CTR: c0000000000398e0
+ REGS: c0000000041833b0 TRAP: 0300 Not tainted (6.3.0-rc2+)
+ MSR: 800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 88082828 XER: 200400f8
+ ...
+ NIP memcpy_power7+0x200/0x7d0
+ LR ppr_get+0x64/0xb0
+ Call Trace:
+ ppr_get+0x40/0xb0 (unreliable)
+ __regset_get+0x180/0x1f0
+ regset_get_alloc+0x64/0x90
+ elf_core_dump+0xb98/0x1b60
+ do_coredump+0x1c34/0x24a0
+ get_signal+0x71c/0x1410
+ do_notify_resume+0x140/0x6f0
+ interrupt_exit_user_prepare_main+0x29c/0x320
+ interrupt_exit_user_prepare+0x6c/0xa0
+ interrupt_return_srr_user+0x8/0x138
+
+Because ppr_get() is trying to copy from a PF_IO_WORKER with a NULL
+pt_regs.
+
+Check for a valid pt_regs in both ppc_get/ppr_set, and return an error
+if not set. The actual error value doesn't seem to be important here, so
+just pick -EINVAL.
+
+Fixes: fa439810cc1b ("powerpc/ptrace: Enable support for NT_PPPC_TAR, NT_PPC_PPR, NT_PPC_DSCR")
+Cc: stable@vger.kernel.org # v4.8+
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+[mpe: Trim oops in change log, add Fixes & Cc stable]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/d9f63344-fe7c-56ae-b420-4a1a04a2ae4c@kernel.dk
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/kernel/ptrace/ptrace-view.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/arch/powerpc/kernel/ptrace/ptrace-view.c
++++ b/arch/powerpc/kernel/ptrace/ptrace-view.c
+@@ -290,6 +290,9 @@ static int gpr_set(struct task_struct *t
+ static int ppr_get(struct task_struct *target, const struct user_regset *regset,
+ struct membuf to)
+ {
++ if (!target->thread.regs)
++ return -EINVAL;
++
+ return membuf_write(&to, &target->thread.regs->ppr, sizeof(u64));
+ }
+
+@@ -297,6 +300,9 @@ static int ppr_set(struct task_struct *t
+ unsigned int pos, unsigned int count, const void *kbuf,
+ const void __user *ubuf)
+ {
++ if (!target->thread.regs)
++ return -EINVAL;
++
+ return user_regset_copyin(&pos, &count, &kbuf, &ubuf,
+ &target->thread.regs->ppr, 0, sizeof(u64));
+ }
--- /dev/null
+From eca9f6e6f83b6725b84e1c76fdde19b003cff0eb Mon Sep 17 00:00:00 2001
+From: Haren Myneni <haren@linux.ibm.com>
+Date: Mon, 20 Mar 2023 19:50:08 -0700
+Subject: powerpc/pseries/vas: Ignore VAS update for DLPAR if copy/paste is not enabled
+
+From: Haren Myneni <haren@linux.ibm.com>
+
+commit eca9f6e6f83b6725b84e1c76fdde19b003cff0eb upstream.
+
+The hypervisor supports user-mode NX from Power10.
+
+pseries_vas_dlpar_cpu() is called from lparcfg_write() to update VAS
+windows for DLPAR event in shared processor mode and the kernel gets
+-ENOTSUPP for HCALLs if the user-mode NX is not supported. The current
+VAS implementation also supports only with Radix page tables. Whereas in
+dedicated processor mode, pseries_vas_notifier() is registered only if
+the copy/paste feature is enabled. So instead of displaying HCALL error
+messages, update VAS capabilities if the copy/paste feature is
+available.
+
+This patch ignores updating VAS capabilities in pseries_vas_dlpar_cpu()
+and returns success if the copy/paste feature is not enabled. Then
+lparcfg_write() completes the processor DLPAR operations without any
+failures.
+
+Fixes: 2147783d6bf0 ("powerpc/pseries: Use lparcfg to reconfig VAS windows for DLPAR CPU")
+Cc: stable@vger.kernel.org # v6.1+
+Signed-off-by: Haren Myneni <haren@linux.ibm.com>
+Reviewed-by: Nathan Lynch <nathanl@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/1d0e727e7dbd9a28627ef08ca9df9c86a50175e2.camel@linux.ibm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/platforms/pseries/vas.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/arch/powerpc/platforms/pseries/vas.c
++++ b/arch/powerpc/platforms/pseries/vas.c
+@@ -857,6 +857,13 @@ int pseries_vas_dlpar_cpu(void)
+ {
+ int new_nr_creds, rc;
+
++ /*
++ * NX-GZIP is not enabled. Nothing to do for DLPAR event
++ */
++ if (!copypaste_feat)
++ return 0;
++
++
+ rc = h_query_vas_capabilities(H_QUERY_VAS_CAPABILITIES,
+ vascaps[VAS_GZIP_DEF_FEAT_TYPE].feat,
+ (u64)virt_to_phys(&hv_cop_caps));
+@@ -1013,6 +1020,7 @@ static int __init pseries_vas_init(void)
+ * Linux supports user space COPY/PASTE only with Radix
+ */
+ if (!radix_enabled()) {
++ copypaste_feat = false;
+ pr_err("API is supported only with radix page tables\n");
+ return -ENOTSUPP;
+ }
--- /dev/null
+From d18a04157fc171fd48075e3dc96471bd3b87f0dd Mon Sep 17 00:00:00 2001
+From: Douglas Raillard <douglas.raillard@arm.com>
+Date: Mon, 6 Mar 2023 12:27:43 +0000
+Subject: rcu: Fix rcu_torture_read ftrace event
+
+From: Douglas Raillard <douglas.raillard@arm.com>
+
+commit d18a04157fc171fd48075e3dc96471bd3b87f0dd upstream.
+
+Fix the rcutorturename field so that its size is correctly reported in
+the text format embedded in trace.dat files. As it stands, it is
+reported as being of size 1:
+
+ field:char rcutorturename[8]; offset:8; size:1; signed:0;
+
+Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>
+Reviewed-by: Mukesh Ojha <quic_mojha@quicinc.com>
+Cc: stable@vger.kernel.org
+Fixes: 04ae87a52074e ("ftrace: Rework event_create_dir()")
+Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+[ boqun: Add "Cc" and "Fixes" tags per Steven ]
+Signed-off-by: Boqun Feng <boqun.feng@gmail.com>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/trace/events/rcu.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/trace/events/rcu.h
++++ b/include/trace/events/rcu.h
+@@ -768,7 +768,7 @@ TRACE_EVENT_RCU(rcu_torture_read,
+ TP_ARGS(rcutorturename, rhp, secs, c_old, c),
+
+ TP_STRUCT__entry(
+- __field(char, rcutorturename[RCUTORTURENAME_LEN])
++ __array(char, rcutorturename, RCUTORTURENAME_LEN)
+ __field(struct rcu_head *, rhp)
+ __field(unsigned long, secs)
+ __field(unsigned long, c_old)
--- /dev/null
+From 7bb2107e63d8a4a13bbb6fe0e1cbd68784a2e9ac Mon Sep 17 00:00:00 2001
+From: "Jiri Slaby (SUSE)" <jirislaby@kernel.org>
+Date: Thu, 16 Mar 2023 12:28:09 +0100
+Subject: s390: reintroduce expoline dependence to scripts
+
+From: Jiri Slaby (SUSE) <jirislaby@kernel.org>
+
+commit 7bb2107e63d8a4a13bbb6fe0e1cbd68784a2e9ac upstream.
+
+Expolines depend on scripts/basic/fixdep. And build of expolines can now
+race with the fixdep build:
+
+ make[1]: *** Deleting file 'arch/s390/lib/expoline/expoline.o'
+ /bin/sh: line 1: scripts/basic/fixdep: Permission denied
+ make[1]: *** [../scripts/Makefile.build:385: arch/s390/lib/expoline/expoline.o] Error 126
+ make: *** [../arch/s390/Makefile:166: expoline_prepare] Error 2
+
+The dependence was removed in the below Fixes: commit. So reintroduce
+the dependence on scripts.
+
+Fixes: a0b0987a7811 ("s390/nospec: remove unneeded header includes")
+Cc: Joe Lawrence <joe.lawrence@redhat.com>
+Cc: stable@vger.kernel.org
+Cc: Heiko Carstens <hca@linux.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Cc: Alexander Gordeev <agordeev@linux.ibm.com>
+Cc: Christian Borntraeger <borntraeger@linux.ibm.com>
+Cc: Sven Schnelle <svens@linux.ibm.com>
+Cc: linux-s390@vger.kernel.org
+Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
+Link: https://lore.kernel.org/r/20230316112809.7903-1-jirislaby@kernel.org
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/s390/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/s390/Makefile
++++ b/arch/s390/Makefile
+@@ -162,7 +162,7 @@ vdso_prepare: prepare0
+
+ ifdef CONFIG_EXPOLINE_EXTERN
+ modules_prepare: expoline_prepare
+-expoline_prepare:
++expoline_prepare: scripts
+ $(Q)$(MAKE) $(build)=arch/s390/lib/expoline arch/s390/lib/expoline/expoline.o
+ endif
+ endif
--- /dev/null
+From 89aba4c26fae4e459f755a18912845c348ee48f3 Mon Sep 17 00:00:00 2001
+From: Heiko Carstens <hca@linux.ibm.com>
+Date: Thu, 23 Mar 2023 13:09:16 +0100
+Subject: s390/uaccess: add missing earlyclobber annotations to __clear_user()
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+commit 89aba4c26fae4e459f755a18912845c348ee48f3 upstream.
+
+Add missing earlyclobber annotation to size, to, and tmp2 operands of the
+__clear_user() inline assembly since they are modified or written to before
+the last usage of all input operands. This can lead to incorrect register
+allocation for the inline assembly.
+
+Fixes: 6c2a9e6df604 ("[S390] Use alternative user-copy operations for new hardware.")
+Reported-by: Mark Rutland <mark.rutland@arm.com>
+Link: https://lore.kernel.org/all/20230321122514.1743889-3-mark.rutland@arm.com/
+Cc: stable@vger.kernel.org
+Reviewed-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/s390/lib/uaccess.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/s390/lib/uaccess.c
++++ b/arch/s390/lib/uaccess.c
+@@ -172,7 +172,7 @@ unsigned long __clear_user(void __user *
+ "4: slgr %0,%0\n"
+ "5:\n"
+ EX_TABLE(0b,2b) EX_TABLE(6b,2b) EX_TABLE(3b,5b) EX_TABLE(7b,5b)
+- : "+a" (size), "+a" (to), "+a" (tmp1), "=a" (tmp2)
++ : "+&a" (size), "+&a" (to), "+a" (tmp1), "=&a" (tmp2)
+ : "a" (empty_zero_page), [spec] "d" (spec.val)
+ : "cc", "memory", "0");
+ return size;
io_uring-poll-clear-single-double-poll-flags-on-poll-arming.patch
io_uring-rsrc-fix-rogue-rsrc-node-grabbing.patch
io_uring-fix-poll-netmsg-alloc-caches.patch
+vmxnet3-use-gro-callback-when-upt-is-enabled.patch
+zonefs-always-invalidate-last-cached-page-on-append-write.patch
+dm-fix-__send_duplicate_bios-to-always-allow-for-splitting-io.patch
+can-j1939-prevent-deadlock-by-moving-j1939_sk_errqueue.patch
+xen-netback-don-t-do-grant-copy-across-page-boundary.patch
+net-phy-dp83869-fix-default-value-for-tx-rx-internal-delay.patch
+modpost-fix-processing-of-crcs-on-32-bit-build-machines.patch
+pinctrl-amd-disable-and-mask-interrupts-on-resume.patch
+pinctrl-at91-pio4-fix-domain-name-assignment.patch
+platform-x86-ideapad-laptop-stop-sending-key_touchpad_toggle.patch
+thermal-intel-int340x-processor_thermal-fix-additional-deadlock.patch
+powerpc-don-t-try-to-copy-ppr-for-task-with-null-pt_regs.patch
+powerpc-pseries-vas-ignore-vas-update-for-dlpar-if-copy-paste-is-not-enabled.patch
+powerpc-64s-fix-__pte_needs_flush-false-positive-warning.patch
+nfsv4-fix-hangs-when-recovering-open-state-after-a-server-reboot.patch
+alsa-hda-conexant-partial-revert-of-a-quirk-for-lenovo.patch
+alsa-usb-audio-fix-regression-on-detection-of-roland-vs-100.patch
+alsa-hda-realtek-add-quirks-for-some-clevo-laptops.patch
+alsa-hda-realtek-add-quirk-for-lenovo-zhaoyang-cf4620z.patch
+xtensa-fix-kasan-report-for-show_stack.patch
+rcu-fix-rcu_torture_read-ftrace-event.patch
+dt-bindings-mtd-jedec-spi-nor-document-cpol-cpha-support.patch
+s390-uaccess-add-missing-earlyclobber-annotations-to-__clear_user.patch
+s390-reintroduce-expoline-dependence-to-scripts.patch
+drm-etnaviv-fix-reference-leak-when-mmaping-imported-buffer.patch
+drm-amdgpu-allow-more-apus-to-do-mode2-reset-when-go-to-s4.patch
+drm-amd-display-add-dsc-support-for-synaptics-cascaded-mst-hub.patch
+drm-amd-display-take-fec-overhead-into-timeslot-calculation.patch
+drm-i915-gem-flush-lmem-contents-after-construction.patch
+drm-i915-dpt-treat-the-dpt-bo-as-a-framebuffer.patch
--- /dev/null
+From a57cc2dbb3738930d9cb361b9b473f90c8ede0b8 Mon Sep 17 00:00:00 2001
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Date: Wed, 29 Mar 2023 08:22:07 -0700
+Subject: thermal: intel: int340x: processor_thermal: Fix additional deadlock
+
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+
+commit a57cc2dbb3738930d9cb361b9b473f90c8ede0b8 upstream.
+
+Commit 52f04f10b900 ("thermal: intel: int340x: processor_thermal: Fix
+deadlock") addressed deadlock issue during user space trip update. But it
+missed a case when thermal zone device is disabled when user writes 0.
+
+Call to thermal_zone_device_disable() also causes deadlock as it also
+tries to lock tz->lock, which is already claimed by trip_point_temp_store()
+in the thermal core code.
+
+Remove call to thermal_zone_device_disable() in the function
+sys_set_trip_temp(), which is called from trip_point_temp_store().
+
+Fixes: 52f04f10b900 ("thermal: intel: int340x: processor_thermal: Fix deadlock")
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: 6.2+ <stable@vger.kernel.org> # 6.2+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.c
++++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_device_pci.c
+@@ -181,7 +181,6 @@ static int sys_set_trip_temp(struct ther
+ cancel_delayed_work_sync(&pci_info->work);
+ proc_thermal_mmio_write(pci_info, PROC_THERMAL_MMIO_INT_ENABLE_0, 0);
+ proc_thermal_mmio_write(pci_info, PROC_THERMAL_MMIO_THRES_0, 0);
+- thermal_zone_device_disable(tzd);
+ pci_info->stored_thres = 0;
+ return 0;
+ }
--- /dev/null
+From 3bced313b9a5a237c347e0f079c8c2fe4b3935aa Mon Sep 17 00:00:00 2001
+From: Ronak Doshi <doshir@vmware.com>
+Date: Thu, 23 Mar 2023 13:07:21 -0700
+Subject: vmxnet3: use gro callback when UPT is enabled
+
+From: Ronak Doshi <doshir@vmware.com>
+
+commit 3bced313b9a5a237c347e0f079c8c2fe4b3935aa upstream.
+
+Currently, vmxnet3 uses GRO callback only if LRO is disabled. However,
+on smartNic based setups where UPT is supported, LRO can be enabled
+from guest VM but UPT devicve does not support LRO as of now. In such
+cases, there can be performance degradation as GRO is not being done.
+
+This patch fixes this issue by calling GRO API when UPT is enabled. We
+use updateRxProd to determine if UPT mode is active or not.
+
+To clarify few things discussed over the thread:
+The patch is not neglecting any feature bits nor disabling GRO. It uses
+GRO callback when UPT is active as LRO is not available in UPT.
+GRO callback cannot be used as default for all cases as it degrades
+performance for non-UPT cases or for cases when LRO is already done in
+ESXi.
+
+Cc: stable@vger.kernel.org
+Fixes: 6f91f4ba046e ("vmxnet3: add support for capability registers")
+Signed-off-by: Ronak Doshi <doshir@vmware.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/r/20230323200721.27622-1-doshir@vmware.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/vmxnet3/vmxnet3_drv.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/vmxnet3/vmxnet3_drv.c
++++ b/drivers/net/vmxnet3/vmxnet3_drv.c
+@@ -1688,7 +1688,9 @@ not_lro:
+ if (unlikely(rcd->ts))
+ __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), rcd->tci);
+
+- if (adapter->netdev->features & NETIF_F_LRO)
++ /* Use GRO callback if UPT is enabled */
++ if ((adapter->netdev->features & NETIF_F_LRO) &&
++ !rq->shared->updateRxProd)
+ netif_receive_skb(skb);
+ else
+ napi_gro_receive(&rq->napi, skb);
--- /dev/null
+From 05310f31ca74673a96567fb14637b7d5d6c82ea5 Mon Sep 17 00:00:00 2001
+From: Juergen Gross <jgross@suse.com>
+Date: Mon, 27 Mar 2023 10:36:45 +0200
+Subject: xen/netback: don't do grant copy across page boundary
+
+From: Juergen Gross <jgross@suse.com>
+
+commit 05310f31ca74673a96567fb14637b7d5d6c82ea5 upstream.
+
+Fix xenvif_get_requests() not to do grant copy operations across local
+page boundaries. This requires to double the maximum number of copy
+operations per queue, as each copy could now be split into 2.
+
+Make sure that struct xenvif_tx_cb doesn't grow too large.
+
+Cc: stable@vger.kernel.org
+Fixes: ad7f402ae4f4 ("xen/netback: Ensure protocol headers don't fall in the non-linear area")
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Paul Durrant <paul@xen.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/xen-netback/common.h | 2 +-
+ drivers/net/xen-netback/netback.c | 25 +++++++++++++++++++++++--
+ 2 files changed, 24 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/xen-netback/common.h
++++ b/drivers/net/xen-netback/common.h
+@@ -166,7 +166,7 @@ struct xenvif_queue { /* Per-queue data
+ struct pending_tx_info pending_tx_info[MAX_PENDING_REQS];
+ grant_handle_t grant_tx_handle[MAX_PENDING_REQS];
+
+- struct gnttab_copy tx_copy_ops[MAX_PENDING_REQS];
++ struct gnttab_copy tx_copy_ops[2 * MAX_PENDING_REQS];
+ struct gnttab_map_grant_ref tx_map_ops[MAX_PENDING_REQS];
+ struct gnttab_unmap_grant_ref tx_unmap_ops[MAX_PENDING_REQS];
+ /* passed to gnttab_[un]map_refs with pages under (un)mapping */
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -334,6 +334,7 @@ static int xenvif_count_requests(struct
+ struct xenvif_tx_cb {
+ u16 copy_pending_idx[XEN_NETBK_LEGACY_SLOTS_MAX + 1];
+ u8 copy_count;
++ u32 split_mask;
+ };
+
+ #define XENVIF_TX_CB(skb) ((struct xenvif_tx_cb *)(skb)->cb)
+@@ -361,6 +362,8 @@ static inline struct sk_buff *xenvif_all
+ struct sk_buff *skb =
+ alloc_skb(size + NET_SKB_PAD + NET_IP_ALIGN,
+ GFP_ATOMIC | __GFP_NOWARN);
++
++ BUILD_BUG_ON(sizeof(*XENVIF_TX_CB(skb)) > sizeof(skb->cb));
+ if (unlikely(skb == NULL))
+ return NULL;
+
+@@ -396,11 +399,13 @@ static void xenvif_get_requests(struct x
+ nr_slots = shinfo->nr_frags + 1;
+
+ copy_count(skb) = 0;
++ XENVIF_TX_CB(skb)->split_mask = 0;
+
+ /* Create copy ops for exactly data_len bytes into the skb head. */
+ __skb_put(skb, data_len);
+ while (data_len > 0) {
+ int amount = data_len > txp->size ? txp->size : data_len;
++ bool split = false;
+
+ cop->source.u.ref = txp->gref;
+ cop->source.domid = queue->vif->domid;
+@@ -413,6 +418,13 @@ static void xenvif_get_requests(struct x
+ cop->dest.u.gmfn = virt_to_gfn(skb->data + skb_headlen(skb)
+ - data_len);
+
++ /* Don't cross local page boundary! */
++ if (cop->dest.offset + amount > XEN_PAGE_SIZE) {
++ amount = XEN_PAGE_SIZE - cop->dest.offset;
++ XENVIF_TX_CB(skb)->split_mask |= 1U << copy_count(skb);
++ split = true;
++ }
++
+ cop->len = amount;
+ cop->flags = GNTCOPY_source_gref;
+
+@@ -420,7 +432,8 @@ static void xenvif_get_requests(struct x
+ pending_idx = queue->pending_ring[index];
+ callback_param(queue, pending_idx).ctx = NULL;
+ copy_pending_idx(skb, copy_count(skb)) = pending_idx;
+- copy_count(skb)++;
++ if (!split)
++ copy_count(skb)++;
+
+ cop++;
+ data_len -= amount;
+@@ -441,7 +454,8 @@ static void xenvif_get_requests(struct x
+ nr_slots--;
+ } else {
+ /* The copy op partially covered the tx_request.
+- * The remainder will be mapped.
++ * The remainder will be mapped or copied in the next
++ * iteration.
+ */
+ txp->offset += amount;
+ txp->size -= amount;
+@@ -539,6 +553,13 @@ static int xenvif_tx_check_gop(struct xe
+ pending_idx = copy_pending_idx(skb, i);
+
+ newerr = (*gopp_copy)->status;
++
++ /* Split copies need to be handled together. */
++ if (XENVIF_TX_CB(skb)->split_mask & (1U << i)) {
++ (*gopp_copy)++;
++ if (!newerr)
++ newerr = (*gopp_copy)->status;
++ }
+ if (likely(!newerr)) {
+ /* The first frag might still have this slot mapped */
+ if (i < copy_count(skb) - 1 || !sharedslot)
--- /dev/null
+From 1d3b7a788ca7435156809a6bd5b20c95b2370d45 Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Thu, 16 Mar 2023 23:00:21 -0700
+Subject: xtensa: fix KASAN report for show_stack
+
+From: Max Filippov <jcmvbkbc@gmail.com>
+
+commit 1d3b7a788ca7435156809a6bd5b20c95b2370d45 upstream.
+
+show_stack dumps raw stack contents which may trigger an unnecessary
+KASAN report. Fix it by copying stack contents to a temporary buffer
+with __memcpy and then printing that buffer instead of passing stack
+pointer directly to the print_hex_dump.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/xtensa/kernel/traps.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+--- a/arch/xtensa/kernel/traps.c
++++ b/arch/xtensa/kernel/traps.c
+@@ -539,7 +539,7 @@ static size_t kstack_depth_to_print = CO
+
+ void show_stack(struct task_struct *task, unsigned long *sp, const char *loglvl)
+ {
+- size_t len;
++ size_t len, off = 0;
+
+ if (!sp)
+ sp = stack_pointer(task);
+@@ -548,9 +548,17 @@ void show_stack(struct task_struct *task
+ kstack_depth_to_print * STACK_DUMP_ENTRY_SIZE);
+
+ printk("%sStack:\n", loglvl);
+- print_hex_dump(loglvl, " ", DUMP_PREFIX_NONE,
+- STACK_DUMP_LINE_SIZE, STACK_DUMP_ENTRY_SIZE,
+- sp, len, false);
++ while (off < len) {
++ u8 line[STACK_DUMP_LINE_SIZE];
++ size_t line_len = len - off > STACK_DUMP_LINE_SIZE ?
++ STACK_DUMP_LINE_SIZE : len - off;
++
++ __memcpy(line, (u8 *)sp + off, line_len);
++ print_hex_dump(loglvl, " ", DUMP_PREFIX_NONE,
++ STACK_DUMP_LINE_SIZE, STACK_DUMP_ENTRY_SIZE,
++ line, line_len, false);
++ off += STACK_DUMP_LINE_SIZE;
++ }
+ show_trace(task, sp, loglvl);
+ }
+
--- /dev/null
+From c1976bd8f23016d8706973908f2bb0ac0d852a8f Mon Sep 17 00:00:00 2001
+From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Date: Wed, 29 Mar 2023 13:16:01 +0900
+Subject: zonefs: Always invalidate last cached page on append write
+
+From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+
+commit c1976bd8f23016d8706973908f2bb0ac0d852a8f upstream.
+
+When a direct append write is executed, the append offset may correspond
+to the last page of a sequential file inode which might have been cached
+already by buffered reads, page faults with mmap-read or non-direct
+readahead. To ensure that the on-disk and cached data is consistant for
+such last cached page, make sure to always invalidate it in
+zonefs_file_dio_append(). If the invalidation fails, return -EBUSY to
+userspace to differentiate from IO errors.
+
+This invalidation will always be a no-op when the FS block size (device
+zone write granularity) is equal to the page size (e.g. 4K).
+
+Reported-by: Hans Holmberg <Hans.Holmberg@wdc.com>
+Fixes: 02ef12a663c7 ("zonefs: use REQ_OP_ZONE_APPEND for sync DIO")
+Cc: stable@vger.kernel.org
+Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Tested-by: Hans Holmberg <hans.holmberg@wdc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/zonefs/file.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/fs/zonefs/file.c
++++ b/fs/zonefs/file.c
+@@ -382,6 +382,7 @@ static ssize_t zonefs_file_dio_append(st
+ struct zonefs_zone *z = zonefs_inode_zone(inode);
+ struct block_device *bdev = inode->i_sb->s_bdev;
+ unsigned int max = bdev_max_zone_append_sectors(bdev);
++ pgoff_t start, end;
+ struct bio *bio;
+ ssize_t size;
+ int nr_pages;
+@@ -390,6 +391,19 @@ static ssize_t zonefs_file_dio_append(st
+ max = ALIGN_DOWN(max << SECTOR_SHIFT, inode->i_sb->s_blocksize);
+ iov_iter_truncate(from, max);
+
++ /*
++ * If the inode block size (zone write granularity) is smaller than the
++ * page size, we may be appending data belonging to the last page of the
++ * inode straddling inode->i_size, with that page already cached due to
++ * a buffered read or readahead. So make sure to invalidate that page.
++ * This will always be a no-op for the case where the block size is
++ * equal to the page size.
++ */
++ start = iocb->ki_pos >> PAGE_SHIFT;
++ end = (iocb->ki_pos + iov_iter_count(from) - 1) >> PAGE_SHIFT;
++ if (invalidate_inode_pages2_range(inode->i_mapping, start, end))
++ return -EBUSY;
++
+ nr_pages = iov_iter_npages(from, BIO_MAX_VECS);
+ if (!nr_pages)
+ return 0;
projects / thirdparty / kernel / stable-queue.git / commitdiff
