--- /dev/null
+From 84fccd999c2b4566e142091b7dbbaeb5aca9e386 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 14:48:22 +0300
+Subject: accel/habanalabs: add pci health check during heartbeat
+
+From: Ofir Bitton <obitton@habana.ai>
+
+[ Upstream commit d8b9cea584661b30305cf341bf9f675dc0a25471 ]
+
+Currently upon a heartbeat failure, we don't know if the failure
+is due to firmware hang or due to a bad PCI link. Hence, we
+are reading a PCI config space register with a known value (vendor ID)
+so we will know which of the two possibilities caused the heartbeat
+failure.
+
+Signed-off-by: Ofir Bitton <obitton@habana.ai>
+Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/habanalabs/common/device.c | 15 ++++++++++++++-
+ drivers/accel/habanalabs/common/habanalabs.h | 2 ++
+ drivers/accel/habanalabs/common/habanalabs_drv.c | 2 --
+ 3 files changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/accel/habanalabs/common/device.c b/drivers/accel/habanalabs/common/device.c
+index fabfc501ef543..a39dd346a1678 100644
+--- a/drivers/accel/habanalabs/common/device.c
++++ b/drivers/accel/habanalabs/common/device.c
+@@ -981,6 +981,18 @@ static void device_early_fini(struct hl_device *hdev)
+ hdev->asic_funcs->early_fini(hdev);
+ }
+
++static bool is_pci_link_healthy(struct hl_device *hdev)
++{
++ u16 vendor_id;
++
++ if (!hdev->pdev)
++ return false;
++
++ pci_read_config_word(hdev->pdev, PCI_VENDOR_ID, &vendor_id);
++
++ return (vendor_id == PCI_VENDOR_ID_HABANALABS);
++}
++
+ static void hl_device_heartbeat(struct work_struct *work)
+ {
+ struct hl_device *hdev = container_of(work, struct hl_device,
+@@ -995,7 +1007,8 @@ static void hl_device_heartbeat(struct work_struct *work)
+ goto reschedule;
+
+ if (hl_device_operational(hdev, NULL))
+- dev_err(hdev->dev, "Device heartbeat failed!\n");
++ dev_err(hdev->dev, "Device heartbeat failed! PCI link is %s\n",
++ is_pci_link_healthy(hdev) ? "healthy" : "broken");
+
+ info.err_type = HL_INFO_FW_HEARTBEAT_ERR;
+ info.event_mask = &event_mask;
+diff --git a/drivers/accel/habanalabs/common/habanalabs.h b/drivers/accel/habanalabs/common/habanalabs.h
+index eaae69a9f8178..7f5d1b6e3fb08 100644
+--- a/drivers/accel/habanalabs/common/habanalabs.h
++++ b/drivers/accel/habanalabs/common/habanalabs.h
+@@ -36,6 +36,8 @@
+ struct hl_device;
+ struct hl_fpriv;
+
++#define PCI_VENDOR_ID_HABANALABS 0x1da3
++
+ /* Use upper bits of mmap offset to store habana driver specific information.
+ * bits[63:59] - Encode mmap type
+ * bits[45:0] - mmap offset value
+diff --git a/drivers/accel/habanalabs/common/habanalabs_drv.c b/drivers/accel/habanalabs/common/habanalabs_drv.c
+index d9df64e75f33a..1ec97da3dddb8 100644
+--- a/drivers/accel/habanalabs/common/habanalabs_drv.c
++++ b/drivers/accel/habanalabs/common/habanalabs_drv.c
+@@ -54,8 +54,6 @@ module_param(boot_error_status_mask, ulong, 0444);
+ MODULE_PARM_DESC(boot_error_status_mask,
+ "Mask of the error status during device CPU boot (If bitX is cleared then error X is masked. Default all 1's)");
+
+-#define PCI_VENDOR_ID_HABANALABS 0x1da3
+-
+ #define PCI_IDS_GOYA 0x0001
+ #define PCI_IDS_GAUDI 0x1000
+ #define PCI_IDS_GAUDI_SEC 0x1010
+--
+2.40.1
+
--- /dev/null
+From f626f22820b8fe9e414750e4ac21c3f8b4477874 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Apr 2023 18:36:17 +0300
+Subject: accel/habanalabs: fix mem leak in capture user mappings
+
+From: Moti Haimovski <mhaimovski@habana.ai>
+
+[ Upstream commit 314a7ffd7c196b27eedd50cb7553029e17789b55 ]
+
+This commit fixes a memory leak caused when clearing the user_mappings
+info when a new context is opened immediately after user_mapping is
+captured and a hard reset is performed.
+
+Signed-off-by: Moti Haimovski <mhaimovski@habana.ai>
+Reviewed-by: Dani Liberman <dliberman@habana.ai>
+Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/habanalabs/common/habanalabs_drv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/accel/habanalabs/common/habanalabs_drv.c b/drivers/accel/habanalabs/common/habanalabs_drv.c
+index 1ec97da3dddb8..70fb2df9a93b8 100644
+--- a/drivers/accel/habanalabs/common/habanalabs_drv.c
++++ b/drivers/accel/habanalabs/common/habanalabs_drv.c
+@@ -13,6 +13,7 @@
+
+ #include <linux/pci.h>
+ #include <linux/module.h>
++#include <linux/vmalloc.h>
+
+ #define CREATE_TRACE_POINTS
+ #include <trace/events/habanalabs.h>
+@@ -218,6 +219,7 @@ int hl_device_open(struct inode *inode, struct file *filp)
+
+ hl_debugfs_add_file(hpriv);
+
++ vfree(hdev->captured_err_info.page_fault_info.user_mappings);
+ memset(&hdev->captured_err_info, 0, sizeof(hdev->captured_err_info));
+ atomic_set(&hdev->captured_err_info.cs_timeout.write_enable, 1);
+ hdev->captured_err_info.undef_opcode.write_enable = true;
+--
+2.40.1
+
--- /dev/null
+From 943603d5def33471b79a02efe35b56ebb7d4d71e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Jul 2023 11:10:16 +0800
+Subject: ALSA: hda: fix a possible null-pointer dereference due to data race
+ in snd_hdac_regmap_sync()
+
+From: Tuo Li <islituo@gmail.com>
+
+[ Upstream commit 1f4a08fed450db87fbb5ff5105354158bdbe1a22 ]
+
+The variable codec->regmap is often protected by the lock
+codec->regmap_lock when is accessed. However, it is accessed without
+holding the lock when is accessed in snd_hdac_regmap_sync():
+
+ if (codec->regmap)
+
+In my opinion, this may be a harmful race, because if codec->regmap is
+set to NULL right after the condition is checked, a null-pointer
+dereference can occur in the called function regcache_sync():
+
+ map->lock(map->lock_arg); --> Line 360 in drivers/base/regmap/regcache.c
+
+To fix this possible null-pointer dereference caused by data race, the
+mutex_lock coverage is extended to protect the if statement as well as the
+function call to regcache_sync().
+
+[ Note: the lack of the regmap_lock itself is harmless for the current
+ codec driver implementations, as snd_hdac_regmap_sync() is only for
+ PM runtime resume that is prohibited during the codec probe.
+ But the change makes the whole code more consistent, so it's merged
+ as is -- tiwai ]
+
+Reported-by: BassCheck <bass@buaa.edu.cn>
+Signed-off-by: Tuo Li <islituo@gmail.com>
+Link: https://lore.kernel.org/r/20230703031016.1184711-1-islituo@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/hdac_regmap.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/sound/hda/hdac_regmap.c b/sound/hda/hdac_regmap.c
+index fe3587547cfec..39610a15bcc98 100644
+--- a/sound/hda/hdac_regmap.c
++++ b/sound/hda/hdac_regmap.c
+@@ -597,10 +597,9 @@ EXPORT_SYMBOL_GPL(snd_hdac_regmap_update_raw_once);
+ */
+ void snd_hdac_regmap_sync(struct hdac_device *codec)
+ {
+- if (codec->regmap) {
+- mutex_lock(&codec->regmap_lock);
++ mutex_lock(&codec->regmap_lock);
++ if (codec->regmap)
+ regcache_sync(codec->regmap);
+- mutex_unlock(&codec->regmap_lock);
+- }
++ mutex_unlock(&codec->regmap_lock);
+ }
+ EXPORT_SYMBOL_GPL(snd_hdac_regmap_sync);
+--
+2.40.1
+
--- /dev/null
+From 93e8a33384bab7441faf8a5c91783ccdc16fd8f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jul 2023 16:46:18 +1200
+Subject: ALSA: hda/realtek: Add quirk for ASUS ROG G614Jx
+
+From: Luke D. Jones <luke@ljones.dev>
+
+[ Upstream commit 33d7c9c3bf70ed91191a2bedbbc03783b824b5de ]
+
+Adds the required quirk to enable the Cirrus amp and correct pins
+on the ASUS ROG G614J series which uses an SPI connected Cirrus amp.
+
+While this works if the related _DSD properties are made available, these
+aren't included in the ACPI of these laptops (yet).
+
+Signed-off-by: Luke D. Jones <luke@ljones.dev>
+Link: https://lore.kernel.org/r/20230704044619.19343-5-luke@ljones.dev
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 1d0f43017f255..9278362e4edb2 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9657,6 +9657,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x1043, 0x1c62, "ASUS GU603", ALC289_FIXUP_ASUS_GA401),
+ SND_PCI_QUIRK(0x1043, 0x1c92, "ASUS ROG Strix G15", ALC285_FIXUP_ASUS_G533Z_PINS),
++ SND_PCI_QUIRK(0x1043, 0x1c9f, "ASUS G614JI", ALC285_FIXUP_ASUS_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1caf, "ASUS G634JYR/JZR", ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS),
+ SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1d1f, "ASUS ROG Strix G17 2023 (G713PV)", ALC287_FIXUP_CS35L41_I2C_2),
+--
+2.40.1
+
--- /dev/null
+From ba14608d9a0464d198fce46b50fd1819b9ddaf00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jul 2023 16:46:16 +1200
+Subject: ALSA: hda/realtek: Add quirk for ASUS ROG GA402X
+
+From: Luke D. Jones <luke@ljones.dev>
+
+[ Upstream commit 9abc77fb144fe916fd2f592dc4b8c7bade02e58a ]
+
+Adds the required quirk to enable the Cirrus amp and correct pins
+on the ASUS ROG GA402X series which uses an I2C connected Cirrus amp.
+
+While this works if the related _DSD properties are made available, these
+aren't included in the ACPI of these laptops (yet).
+
+Signed-off-by: Luke D. Jones <luke@ljones.dev>
+Link: https://lore.kernel.org/r/20230704044619.19343-3-luke@ljones.dev
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index f36cbf22c29db..2e0c822d1b5d0 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9617,6 +9617,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x13b0, "ASUS Z550SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK),
+ SND_PCI_QUIRK(0x1043, 0x1433, "ASUS GX650P", ALC285_FIXUP_ASUS_I2C_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1043, 0x1463, "Asus GA402X", ALC285_FIXUP_ASUS_I2C_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1473, "ASUS GU604V", ALC285_FIXUP_ASUS_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1483, "ASUS GU603V", ALC285_FIXUP_ASUS_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1493, "ASUS GV601V", ALC285_FIXUP_ASUS_HEADSET_MIC),
+--
+2.40.1
+
--- /dev/null
+From 5e4125b5ac56c405bb0ec73195905e3fd5023d10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jul 2023 16:46:15 +1200
+Subject: ALSA: hda/realtek: Add quirk for ASUS ROG GX650P
+
+From: Luke D. Jones <luke@ljones.dev>
+
+[ Upstream commit 8cc87c055d28320e5fa5457922f43bc07dec58bd ]
+
+Adds the required quirk to enable the Cirrus amp and correct pins
+on the ASUS ROG GV601V series which uses an I2C connected Cirrus amp.
+
+While this works if the related _DSD properties are made available, these
+aren't included in the ACPI of these laptops (yet).
+
+Signed-off-by: Luke D. Jones <luke@ljones.dev>
+Link: https://lore.kernel.org/r/20230704044619.19343-2-luke@ljones.dev
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index d2ed0ede0e9b7..f36cbf22c29db 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7081,6 +7081,8 @@ enum {
+ ALC285_FIXUP_SPEAKER2_TO_DAC1,
+ ALC285_FIXUP_ASUS_SPEAKER2_TO_DAC1,
+ ALC285_FIXUP_ASUS_HEADSET_MIC,
++ ALC285_FIXUP_ASUS_I2C_SPEAKER2_TO_DAC1,
++ ALC285_FIXUP_ASUS_I2C_HEADSET_MIC,
+ ALC280_FIXUP_HP_HEADSET_MIC,
+ ALC221_FIXUP_HP_FRONT_MIC,
+ ALC292_FIXUP_TPT460,
+@@ -8073,6 +8075,22 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC285_FIXUP_ASUS_SPEAKER2_TO_DAC1
+ },
++ [ALC285_FIXUP_ASUS_I2C_SPEAKER2_TO_DAC1] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc285_fixup_speaker2_to_dac1,
++ .chained = true,
++ .chain_id = ALC287_FIXUP_CS35L41_I2C_2
++ },
++ [ALC285_FIXUP_ASUS_I2C_HEADSET_MIC] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x19, 0x03a11050 },
++ { 0x1b, 0x03a11c30 },
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC285_FIXUP_ASUS_I2C_SPEAKER2_TO_DAC1
++ },
+ [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+@@ -9598,6 +9616,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x1313, "Asus K42JZ", ALC269VB_FIXUP_ASUS_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1043, 0x13b0, "ASUS Z550SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK),
++ SND_PCI_QUIRK(0x1043, 0x1433, "ASUS GX650P", ALC285_FIXUP_ASUS_I2C_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1473, "ASUS GU604V", ALC285_FIXUP_ASUS_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1483, "ASUS GU603V", ALC285_FIXUP_ASUS_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1493, "ASUS GV601V", ALC285_FIXUP_ASUS_HEADSET_MIC),
+--
+2.40.1
+
--- /dev/null
+From 5051e2ff091014049b6b29bf73465a3b8a973e59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jul 2023 10:33:23 +1200
+Subject: ALSA: hda/realtek: Add quirk for ASUS ROG GZ301V
+
+From: Luke D. Jones <luke@ljones.dev>
+
+[ Upstream commit 5251605f4d297a0eb5d3b7f39f9dcee9e4d0115a ]
+
+Adds the required quirk to enable the Cirrus amp and correct pins
+on the ASUS ROG GZ301V series which uses an SPI connected Cirrus amp.
+
+While this works if the related _DSD properties are made available, these
+aren't included in the ACPI of these laptops (yet).
+
+Signed-off-by: Luke D. Jones <luke@ljones.dev>
+Link: https://lore.kernel.org/r/20230706223323.30871-2-luke@ljones.dev
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 9278362e4edb2..853d1ed21facd 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9632,6 +9632,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x1483, "ASUS GU603V", ALC285_FIXUP_ASUS_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1493, "ASUS GV601V", ALC285_FIXUP_ASUS_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
++ SND_PCI_QUIRK(0x1043, 0x1573, "ASUS GZ301V", ALC285_FIXUP_ASUS_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1662, "ASUS GV301QH", ALC294_FIXUP_ASUS_DUAL_SPK),
+ SND_PCI_QUIRK(0x1043, 0x1683, "ASUS UM3402YAR", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x1043, 0x16b2, "ASUS GU603", ALC289_FIXUP_ASUS_GA401),
+--
+2.40.1
+
--- /dev/null
+From 9050a1405a182d4079ed3aa5cad2d2cf82bbf26e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Jul 2023 10:17:51 +0800
+Subject: ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760
+
+From: dengxiang <dengxiang@nfschina.com>
+
+[ Upstream commit 73f1c75d5e6bd8ce2a887ef493a66ad1b16ed704 ]
+
+These models use NSIWAY amplifiers for internal speaker, but cannot put
+sound outside from these amplifiers. So eapd verbs are needed to initialize
+the amplifiers. They can be added during boot to get working sound out
+of internal speaker.
+
+Signed-off-by: dengxiang <dengxiang@nfschina.com>
+Link: https://lore.kernel.org/r/20230703021751.2945750-1-dengxiang@nfschina.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index bcd548e247fc8..d2ed0ede0e9b7 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -11316,6 +11316,7 @@ enum {
+ ALC897_FIXUP_HP_HSMIC_VERB,
+ ALC897_FIXUP_LENOVO_HEADSET_MODE,
+ ALC897_FIXUP_HEADSET_MIC_PIN2,
++ ALC897_FIXUP_UNIS_H3C_X500S,
+ };
+
+ static const struct hda_fixup alc662_fixups[] = {
+@@ -11755,6 +11756,13 @@ static const struct hda_fixup alc662_fixups[] = {
+ .chained = true,
+ .chain_id = ALC897_FIXUP_LENOVO_HEADSET_MODE
+ },
++ [ALC897_FIXUP_UNIS_H3C_X500S] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ { 0x14, AC_VERB_SET_EAPD_BTLENABLE, 0 },
++ {}
++ },
++ },
+ };
+
+ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
+@@ -11916,6 +11924,7 @@ static const struct hda_model_fixup alc662_fixup_models[] = {
+ {.id = ALC662_FIXUP_USI_HEADSET_MODE, .name = "usi-headset"},
+ {.id = ALC662_FIXUP_LENOVO_MULTI_CODECS, .name = "dual-codecs"},
+ {.id = ALC669_FIXUP_ACER_ASPIRE_ETHOS, .name = "aspire-ethos"},
++ {.id = ALC897_FIXUP_UNIS_H3C_X500S, .name = "unis-h3c-x500s"},
+ {}
+ };
+
+--
+2.40.1
+
--- /dev/null
+From c7d53d412921d1c12ed82f566fbf498d78b7ecc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jul 2023 16:46:17 +1200
+Subject: ALSA: hda/realtek: Amend G634 quirk to enable rear speakers
+
+From: Luke D. Jones <luke@ljones.dev>
+
+[ Upstream commit b759a5f097cd42c666f1ebca8da50ff507435fbe ]
+
+Amends the last quirk for the G634 with 0x1caf subsys to enable the rear
+speakers via pincfg.
+
+Signed-off-by: Luke D. Jones <luke@ljones.dev>
+Link: https://lore.kernel.org/r/20230704044619.19343-4-luke@ljones.dev
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 2e0c822d1b5d0..1d0f43017f255 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7081,6 +7081,7 @@ enum {
+ ALC285_FIXUP_SPEAKER2_TO_DAC1,
+ ALC285_FIXUP_ASUS_SPEAKER2_TO_DAC1,
+ ALC285_FIXUP_ASUS_HEADSET_MIC,
++ ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS,
+ ALC285_FIXUP_ASUS_I2C_SPEAKER2_TO_DAC1,
+ ALC285_FIXUP_ASUS_I2C_HEADSET_MIC,
+ ALC280_FIXUP_HP_HEADSET_MIC,
+@@ -8075,6 +8076,15 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC285_FIXUP_ASUS_SPEAKER2_TO_DAC1
+ },
++ [ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x14, 0x90170120 },
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC285_FIXUP_ASUS_HEADSET_MIC
++ },
+ [ALC285_FIXUP_ASUS_I2C_SPEAKER2_TO_DAC1] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc285_fixup_speaker2_to_dac1,
+@@ -9647,7 +9657,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x1043, 0x1c62, "ASUS GU603", ALC289_FIXUP_ASUS_GA401),
+ SND_PCI_QUIRK(0x1043, 0x1c92, "ASUS ROG Strix G15", ALC285_FIXUP_ASUS_G533Z_PINS),
+- SND_PCI_QUIRK(0x1043, 0x1caf, "ASUS G634JYR/JZR", ALC285_FIXUP_ASUS_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1043, 0x1caf, "ASUS G634JYR/JZR", ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS),
+ SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1d1f, "ASUS ROG Strix G17 2023 (G713PV)", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x1043, 0x1d42, "ASUS Zephyrus G14 2022", ALC289_FIXUP_ASUS_GA401),
+--
+2.40.1
+
--- /dev/null
+From 711dd4ba0e42156e1a9a2673ac6a40733d19e760 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 20:12:19 +0000
+Subject: apparmor: fix use of strcpy in policy_unpack_test
+
+From: Rae Moar <rmoar@google.com>
+
+[ Upstream commit b54aebd4411134b525a82d663a26b2f135ecb7e8 ]
+
+Replace the use of strcpy() in build_aa_ext_struct() in
+policy_unpack_test.c with strscpy().
+
+strscpy() is the safer method to use to ensure the buffer does not
+overflow. This was found by kernel test robot:
+https://lore.kernel.org/all/202301040348.NbfVsXO0-lkp@intel.com/.
+
+Reported-by: kernel test robot <lkp@intel.com>
+
+Signed-off-by: Rae Moar <rmoar@google.com>
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/apparmor/policy_unpack_test.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/security/apparmor/policy_unpack_test.c b/security/apparmor/policy_unpack_test.c
+index e1bfdab524b79..5c9bde25e56df 100644
+--- a/security/apparmor/policy_unpack_test.c
++++ b/security/apparmor/policy_unpack_test.c
+@@ -69,31 +69,30 @@ static struct aa_ext *build_aa_ext_struct(struct policy_unpack_fixture *puf,
+
+ *buf = AA_NAME;
+ *(buf + 1) = strlen(TEST_STRING_NAME) + 1;
+- strcpy(buf + 3, TEST_STRING_NAME);
++ strscpy(buf + 3, TEST_STRING_NAME, e->end - (void *)(buf + 3));
+
+ buf = e->start + TEST_STRING_BUF_OFFSET;
+ *buf = AA_STRING;
+ *(buf + 1) = strlen(TEST_STRING_DATA) + 1;
+- strcpy(buf + 3, TEST_STRING_DATA);
+-
++ strscpy(buf + 3, TEST_STRING_DATA, e->end - (void *)(buf + 3));
+ buf = e->start + TEST_NAMED_U32_BUF_OFFSET;
+ *buf = AA_NAME;
+ *(buf + 1) = strlen(TEST_U32_NAME) + 1;
+- strcpy(buf + 3, TEST_U32_NAME);
++ strscpy(buf + 3, TEST_U32_NAME, e->end - (void *)(buf + 3));
+ *(buf + 3 + strlen(TEST_U32_NAME) + 1) = AA_U32;
+ *((u32 *)(buf + 3 + strlen(TEST_U32_NAME) + 2)) = TEST_U32_DATA;
+
+ buf = e->start + TEST_NAMED_U64_BUF_OFFSET;
+ *buf = AA_NAME;
+ *(buf + 1) = strlen(TEST_U64_NAME) + 1;
+- strcpy(buf + 3, TEST_U64_NAME);
++ strscpy(buf + 3, TEST_U64_NAME, e->end - (void *)(buf + 3));
+ *(buf + 3 + strlen(TEST_U64_NAME) + 1) = AA_U64;
+ *((u64 *)(buf + 3 + strlen(TEST_U64_NAME) + 2)) = TEST_U64_DATA;
+
+ buf = e->start + TEST_NAMED_BLOB_BUF_OFFSET;
+ *buf = AA_NAME;
+ *(buf + 1) = strlen(TEST_BLOB_NAME) + 1;
+- strcpy(buf + 3, TEST_BLOB_NAME);
++ strscpy(buf + 3, TEST_BLOB_NAME, e->end - (void *)(buf + 3));
+ *(buf + 3 + strlen(TEST_BLOB_NAME) + 1) = AA_BLOB;
+ *(buf + 3 + strlen(TEST_BLOB_NAME) + 2) = TEST_BLOB_DATA_SIZE;
+ memcpy(buf + 3 + strlen(TEST_BLOB_NAME) + 6,
+@@ -102,7 +101,7 @@ static struct aa_ext *build_aa_ext_struct(struct policy_unpack_fixture *puf,
+ buf = e->start + TEST_NAMED_ARRAY_BUF_OFFSET;
+ *buf = AA_NAME;
+ *(buf + 1) = strlen(TEST_ARRAY_NAME) + 1;
+- strcpy(buf + 3, TEST_ARRAY_NAME);
++ strscpy(buf + 3, TEST_ARRAY_NAME, e->end - (void *)(buf + 3));
+ *(buf + 3 + strlen(TEST_ARRAY_NAME) + 1) = AA_ARRAY;
+ *((u16 *)(buf + 3 + strlen(TEST_ARRAY_NAME) + 2)) = TEST_ARRAY_SIZE;
+
+--
+2.40.1
+
--- /dev/null
+From 6952c7dae77a39a5ac38b2809ee4893c726707c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 May 2023 14:03:44 +0200
+Subject: ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related
+ warnings
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 1d14bd943fa2bbdfda1efbcc080b298fed5f1803 ]
+
+Fix USB-related warnings in prtrvt, prtvt7, prti6q and prtwd2 device trees
+by disabling unused usbphynop1 and usbphynop2 USB PHYs and providing proper
+configuration for the over-current detection. This fixes the following
+warnings with the current kernel:
+ usb_phy_generic usbphynop1: dummy supplies not allowed for exclusive requests
+ usb_phy_generic usbphynop2: dummy supplies not allowed for exclusive requests
+ imx_usb 2184200.usb: No over current polarity defined
+
+By the way, fix over-current detection on usbotg port for prtvt7, prti6q
+and prtwd2 boards. Only prtrvt do not have OC on USB OTG port.
+
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6dl-prtrvt.dts | 4 ++++
+ arch/arm/boot/dts/imx6qdl-prti6q.dtsi | 11 ++++++++++-
+ 2 files changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx6dl-prtrvt.dts b/arch/arm/boot/dts/imx6dl-prtrvt.dts
+index 56bb1ca56a2df..36b031236e475 100644
+--- a/arch/arm/boot/dts/imx6dl-prtrvt.dts
++++ b/arch/arm/boot/dts/imx6dl-prtrvt.dts
+@@ -124,6 +124,10 @@ &usbh1 {
+ status = "disabled";
+ };
+
++&usbotg {
++ disable-over-current;
++};
++
+ &vpu {
+ status = "disabled";
+ };
+diff --git a/arch/arm/boot/dts/imx6qdl-prti6q.dtsi b/arch/arm/boot/dts/imx6qdl-prti6q.dtsi
+index f0db0d4471f40..36f84f4da6b0d 100644
+--- a/arch/arm/boot/dts/imx6qdl-prti6q.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-prti6q.dtsi
+@@ -69,6 +69,7 @@ &usbh1 {
+ vbus-supply = <®_usb_h1_vbus>;
+ phy_type = "utmi";
+ dr_mode = "host";
++ disable-over-current;
+ status = "okay";
+ };
+
+@@ -78,10 +79,18 @@ &usbotg {
+ pinctrl-0 = <&pinctrl_usbotg>;
+ phy_type = "utmi";
+ dr_mode = "host";
+- disable-over-current;
++ over-current-active-low;
+ status = "okay";
+ };
+
++&usbphynop1 {
++ status = "disabled";
++};
++
++&usbphynop2 {
++ status = "disabled";
++};
++
+ &usdhc1 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_usdhc1>;
+--
+2.40.1
+
--- /dev/null
+From cdfb221e43250c98aa3470699619403e667f0400 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 May 2023 18:23:03 +0530
+Subject: arm64: dts: qcom: ipq5332: add QFPROM node
+
+From: Kathiravan T <quic_kathirav@quicinc.com>
+
+[ Upstream commit 2f34a2aa4c88f4882e3c5df8c9b78f8bbd3f564f ]
+
+IPQ5332 has efuse region to determine the various HW quirks. Lets
+add the initial support and the individual fuses will be added as they
+are required.
+
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Kathiravan T <quic_kathirav@quicinc.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230526125305.19626-3-quic_kathirav@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/ipq5332.dtsi | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/ipq5332.dtsi b/arch/arm64/boot/dts/qcom/ipq5332.dtsi
+index af4d97143bcf5..c2d6cc65a323a 100644
+--- a/arch/arm64/boot/dts/qcom/ipq5332.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq5332.dtsi
+@@ -135,6 +135,13 @@ soc@0 {
+ #size-cells = <1>;
+ ranges = <0 0 0 0xffffffff>;
+
++ qfprom: efuse@a4000 {
++ compatible = "qcom,ipq5332-qfprom", "qcom,qfprom";
++ reg = <0x000a4000 0x721>;
++ #address-cells = <1>;
++ #size-cells = <1>;
++ };
++
+ rng: rng@e3000 {
+ compatible = "qcom,prng-ee";
+ reg = <0x000e3000 0x1000>;
+--
+2.40.1
+
--- /dev/null
+From 7df2a788c2df4eff1f4452b730089bcda8534bec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 May 2023 16:37:58 +0530
+Subject: ASoC: amd: vangogh: Add check for acp config flags in vangogh
+ platform
+
+From: Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
+
+[ Upstream commit e89f45edb747ed88e97a5771dd6d3dd1eb517873 ]
+
+We have SOF and generic ACP support enabled for Vangogh platform
+on some machines. Since we have same PCI id used for probing,
+add check for machine configuration flag to avoid conflict with
+newer pci drivers. Such machine flag has been initialized via
+dmi match on few Vangogh based machines. If no flag is
+specified probe and register older platform device.
+
+Signed-off-by: Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
+Link: https://lore.kernel.org/r/20230530110802.674939-1-venkataprasad.potturu@amd.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/vangogh/acp5x.h | 2 ++
+ sound/soc/amd/vangogh/pci-acp5x.c | 7 ++++++-
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/amd/vangogh/acp5x.h b/sound/soc/amd/vangogh/acp5x.h
+index bd9f1c5684d17..ac1936a8c43ff 100644
+--- a/sound/soc/amd/vangogh/acp5x.h
++++ b/sound/soc/amd/vangogh/acp5x.h
+@@ -147,6 +147,8 @@ static inline void acp_writel(u32 val, void __iomem *base_addr)
+ writel(val, base_addr - ACP5x_PHY_BASE_ADDRESS);
+ }
+
++int snd_amd_acp_find_config(struct pci_dev *pci);
++
+ static inline u64 acp_get_byte_count(struct i2s_stream_instance *rtd,
+ int direction)
+ {
+diff --git a/sound/soc/amd/vangogh/pci-acp5x.c b/sound/soc/amd/vangogh/pci-acp5x.c
+index e0df17c88e8e0..c4634a8a17cdc 100644
+--- a/sound/soc/amd/vangogh/pci-acp5x.c
++++ b/sound/soc/amd/vangogh/pci-acp5x.c
+@@ -125,10 +125,15 @@ static int snd_acp5x_probe(struct pci_dev *pci,
+ {
+ struct acp5x_dev_data *adata;
+ struct platform_device_info pdevinfo[ACP5x_DEVS];
+- unsigned int irqflags;
++ unsigned int irqflags, flag;
+ int ret, i;
+ u32 addr, val;
+
++ /* Return if acp config flag is defined */
++ flag = snd_amd_acp_find_config(pci);
++ if (flag)
++ return -ENODEV;
++
+ irqflags = IRQF_SHARED;
+ if (pci->revision != 0x50)
+ return -ENODEV;
+--
+2.40.1
+
--- /dev/null
+From 7bdc5a7019094019e6e0a0040d146fb074f4635e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 May 2023 16:02:48 +0100
+Subject: ASoC: cs35l56: Move DSP part string generation so that it is done
+ only once
+
+From: Simon Trimmer <simont@opensource.cirrus.com>
+
+[ Upstream commit 608f1b0dbddec6b2fd766c10bcce2b651995e936 ]
+
+Each time we go through dsp_work() it does a devm_kasprintf() to
+allocate memory to hold the part name string. It's not strictly a memory
+leak because devm will free it all if the driver is removed. But we keep
+allocating more and more memory to hold the same string.
+
+Move the allocation so that it is performed after the version and
+secured state information is gathered and handle allocation errors.
+
+Signed-off-by: Simon Trimmer <simont@opensource.cirrus.com>
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/Message-Id: <20230518150250.1121006-2-rf@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs35l56.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/cs35l56.c b/sound/soc/codecs/cs35l56.c
+index e0d2b9bb23262..f3fee448d759e 100644
+--- a/sound/soc/codecs/cs35l56.c
++++ b/sound/soc/codecs/cs35l56.c
+@@ -834,12 +834,6 @@ static void cs35l56_dsp_work(struct work_struct *work)
+ if (!cs35l56->init_done)
+ return;
+
+- cs35l56->dsp.part = devm_kasprintf(cs35l56->dev, GFP_KERNEL, "cs35l56%s-%02x",
+- cs35l56->secured ? "s" : "", cs35l56->rev);
+-
+- if (!cs35l56->dsp.part)
+- return;
+-
+ pm_runtime_get_sync(cs35l56->dev);
+
+ /*
+@@ -1505,6 +1499,12 @@ int cs35l56_init(struct cs35l56_private *cs35l56)
+ dev_info(cs35l56->dev, "Cirrus Logic CS35L56%s Rev %02X OTP%d\n",
+ cs35l56->secured ? "s" : "", cs35l56->rev, otpid);
+
++ /* Populate the DSP information with the revision and security state */
++ cs35l56->dsp.part = devm_kasprintf(cs35l56->dev, GFP_KERNEL, "cs35l56%s-%02x",
++ cs35l56->secured ? "s" : "", cs35l56->rev);
++ if (!cs35l56->dsp.part)
++ return -ENOMEM;
++
+ /* Wake source and *_BLOCKED interrupts default to unmasked, so mask them */
+ regmap_write(cs35l56->regmap, CS35L56_IRQ1_MASK_20, 0xffffffff);
+ regmap_update_bits(cs35l56->regmap, CS35L56_IRQ1_MASK_1,
+--
+2.40.1
+
--- /dev/null
+From 21bf25280f5b639c6cb24bc515d6d80aee61bf8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jun 2023 15:22:13 -0500
+Subject: ASoC: Intel: sof_sdw: add quick for Dell SKU 0BDA
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 3daf02819ac3fd8d7605804a00213cf123ac880d ]
+
+The SKU numbering isn't quite consistent with the existing RaptorLake
+SKUs but the PCI ID is definitively RaptorLake.
+
+Closes: https://github.com/thesofproject/linux/issues/4380
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20230602202225.249209-17-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_sdw.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index 1a37f4cdc0ea7..b0b6a084837a7 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -367,6 +367,16 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
+ RT711_JD2),
+ },
+ /* RaptorLake devices */
++ {
++ .callback = sof_sdw_quirk_cb,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0BDA")
++ },
++ .driver_data = (void *)(SOF_SDW_TGL_HDMI |
++ RT711_JD2 |
++ SOF_SDW_FOUR_SPK),
++ },
+ {
+ .callback = sof_sdw_quirk_cb,
+ .matches = {
+--
+2.40.1
+
--- /dev/null
+From 8d288389c97c174b313471fd62627bffbe524272 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 May 2023 12:33:05 -0500
+Subject: ASoC: Intel: sof_sdw: add quirk for LNL RVP
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit dfe25fea968dc4884e12d471c8263f0f611b380a ]
+
+We should use RT711_JD2_100K for on board rt711
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com
+Link: https://lore.kernel.org/r/20230512173305.65399-9-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_sdw.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index 159fef20a30c8..1a37f4cdc0ea7 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -423,6 +423,15 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
+ },
+ .driver_data = (void *)(RT711_JD2_100K),
+ },
++ /* LunarLake devices */
++ {
++ .callback = sof_sdw_quirk_cb,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Lunar Lake Client Platform"),
++ },
++ .driver_data = (void *)(RT711_JD2_100K),
++ },
+ {}
+ };
+
+--
+2.40.1
+
--- /dev/null
+From 5d27293200b5b1ae1089d67ae9c30d89e7beb775 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 May 2023 12:33:00 -0500
+Subject: ASoC: Intel: sof_sdw: add quirk for MTL RVP
+
+From: Bard Liao <yung-chuan.liao@linux.intel.com>
+
+[ Upstream commit 289e1df00e49a229a1c924c059242e759a552f01 ]
+
+We should use RT711_JD2_100K for on board rt711.
+
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com
+Link: https://lore.kernel.org/r/20230512173305.65399-4-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_sdw.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index 5fa204897a52b..159fef20a30c8 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -415,6 +415,14 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
+ },
+ .driver_data = (void *)(RT711_JD1),
+ },
++ {
++ .callback = sof_sdw_quirk_cb,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Meteor Lake Client Platform"),
++ },
++ .driver_data = (void *)(RT711_JD2_100K),
++ },
+ {}
+ };
+
+--
+2.40.1
+
--- /dev/null
+From e25946f2bf5bccc467b39b7477b6af187263d78a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jun 2023 15:22:24 -0500
+Subject: ASoC: Intel: sof_sdw: Add support for Rex soundwire
+
+From: Uday M Bhat <uday.m.bhat@intel.com>
+
+[ Upstream commit 164e5dc17525181c05563f0a06796f1a363801d5 ]
+
+Add rex entry in the soundwire quirk table
+
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Signed-off-by: Yong Zhi <yong.zhi@intel.com>
+Signed-off-by: Uday M Bhat <uday.m.bhat@intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20230602202225.249209-28-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_sdw.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index b0b6a084837a7..a6d13aae8f720 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -433,6 +433,14 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
+ },
+ .driver_data = (void *)(RT711_JD2_100K),
+ },
++ {
++ .callback = sof_sdw_quirk_cb,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Google"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Rex"),
++ },
++ .driver_data = (void *)(SOF_SDW_PCH_DMIC),
++ },
+ /* LunarLake devices */
+ {
+ .callback = sof_sdw_quirk_cb,
+--
+2.40.1
+
--- /dev/null
+From 8bc37092b7f3f88be71e9315fccd292dc47ba204 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jun 2023 15:22:04 -0500
+Subject: ASoC: Intel: sof_sdw_rt_sdca_jack_common: test SOF_JACK_JDSRC in
+ _exit
+
+From: Bard Liao <yung-chuan.liao@linux.intel.com>
+
+[ Upstream commit 526a1876fc48e2d0c0ea8ad63b58bdb2cc13047f ]
+
+if (!SOF_RT711_JDSRC(sof_sdw_quirk)) is tested in rt711_sdca_add_codec_
+device_props(), and we don't add software node to the device if jack
+source is not set. We need to do the same test in
+sof_sdw_rt711_sdca_exit(), and avoid removing software node if jack
+source is not set.
+
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20230602202225.249209-8-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_sdw_rt711_sdca.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/intel/boards/sof_sdw_rt711_sdca.c b/sound/soc/intel/boards/sof_sdw_rt711_sdca.c
+index 7f16304d025be..cf8b9793fe0e5 100644
+--- a/sound/soc/intel/boards/sof_sdw_rt711_sdca.c
++++ b/sound/soc/intel/boards/sof_sdw_rt711_sdca.c
+@@ -143,6 +143,9 @@ int sof_sdw_rt711_sdca_exit(struct snd_soc_card *card, struct snd_soc_dai_link *
+ if (!ctx->headset_codec_dev)
+ return 0;
+
++ if (!SOF_RT711_JDSRC(sof_sdw_quirk))
++ return 0;
++
+ device_remove_software_node(ctx->headset_codec_dev);
+ put_device(ctx->headset_codec_dev);
+
+--
+2.40.1
+
--- /dev/null
+From 9cea958ac5e696b4aaf340fdd14f86434d4c80d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 May 2023 12:50:01 +0530
+Subject: ASoC: SOF: amd: Add pci revision id check
+
+From: Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
+
+[ Upstream commit 1d4a84632b90d88316986b05bcdfe715399a33db ]
+
+Add pci revision id check for renoir and rembrandt platforms.
+
+Signed-off-by: Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
+Link: https://lore.kernel.org/r/20230523072009.2379198-1-venkataprasad.potturu@amd.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/amd/acp.h | 3 +++
+ sound/soc/sof/amd/pci-rmb.c | 3 +++
+ sound/soc/sof/amd/pci-rn.c | 3 +++
+ 3 files changed, 9 insertions(+)
+
+diff --git a/sound/soc/sof/amd/acp.h b/sound/soc/sof/amd/acp.h
+index 1c535cc6c3a95..dc624f727aa37 100644
+--- a/sound/soc/sof/amd/acp.h
++++ b/sound/soc/sof/amd/acp.h
+@@ -55,6 +55,9 @@
+
+ #define ACP_DSP_TO_HOST_IRQ 0x04
+
++#define ACP_RN_PCI_ID 0x01
++#define ACP_RMB_PCI_ID 0x6F
++
+ #define HOST_BRIDGE_CZN 0x1630
+ #define HOST_BRIDGE_RMB 0x14B5
+ #define ACP_SHA_STAT 0x8000
+diff --git a/sound/soc/sof/amd/pci-rmb.c b/sound/soc/sof/amd/pci-rmb.c
+index eaf70ea6e556e..58b3092425f1a 100644
+--- a/sound/soc/sof/amd/pci-rmb.c
++++ b/sound/soc/sof/amd/pci-rmb.c
+@@ -65,6 +65,9 @@ static int acp_pci_rmb_probe(struct pci_dev *pci, const struct pci_device_id *pc
+ {
+ unsigned int flag;
+
++ if (pci->revision != ACP_RMB_PCI_ID)
++ return -ENODEV;
++
+ flag = snd_amd_acp_find_config(pci);
+ if (flag != FLAG_AMD_SOF && flag != FLAG_AMD_SOF_ONLY_DMIC)
+ return -ENODEV;
+diff --git a/sound/soc/sof/amd/pci-rn.c b/sound/soc/sof/amd/pci-rn.c
+index 4809cb644152b..7409e21ce5aa7 100644
+--- a/sound/soc/sof/amd/pci-rn.c
++++ b/sound/soc/sof/amd/pci-rn.c
+@@ -65,6 +65,9 @@ static int acp_pci_rn_probe(struct pci_dev *pci, const struct pci_device_id *pci
+ {
+ unsigned int flag;
+
++ if (pci->revision != ACP_RN_PCI_ID)
++ return -ENODEV;
++
+ flag = snd_amd_acp_find_config(pci);
+ if (flag != FLAG_AMD_SOF && flag != FLAG_AMD_SOF_ONLY_DMIC)
+ return -ENODEV;
+--
+2.40.1
+
--- /dev/null
+From 891652fb3423e11ea2cdcdc944268f3084fdcb3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jun 2023 12:00:34 +0200
+Subject: ASoC: SOF: core: Free the firmware trace before calling
+ snd_sof_shutdown()
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit d389dcb3a48cec4f03c16434c0bf98a4c635372a ]
+
+The shutdown is called on reboot/shutdown of the machine.
+At this point the firmware tracing cannot be used anymore but in case of
+IPC3 it is using and keeping a DMA channel active (dtrace).
+
+For Tiger Lake platforms we have a quirk in place to fix rare reboot issues
+when a DMA was active before rebooting the system.
+If the tracing is enabled this quirk will be always used and a print
+appears on the kernel log which might be misleading or not even correct.
+
+Release the fw tracing before executing the shutdown to make sure that this
+known DMA user is cleared away.
+
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Rander Wang <rander.wang@intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20230616100039.378150-4-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/core.c b/sound/soc/sof/core.c
+index 9a9d82220fd0d..30db685cc5f4b 100644
+--- a/sound/soc/sof/core.c
++++ b/sound/soc/sof/core.c
+@@ -504,8 +504,10 @@ int snd_sof_device_shutdown(struct device *dev)
+ if (IS_ENABLED(CONFIG_SND_SOC_SOF_PROBE_WORK_QUEUE))
+ cancel_work_sync(&sdev->probe_work);
+
+- if (sdev->fw_state == SOF_FW_BOOT_COMPLETE)
++ if (sdev->fw_state == SOF_FW_BOOT_COMPLETE) {
++ sof_fw_trace_free(sdev);
+ return snd_sof_shutdown(sdev);
++ }
+
+ return 0;
+ }
+--
+2.40.1
+
--- /dev/null
+From 10ebff264005d4de71dc8334dbb862ab8ab4ecc7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 17:25:28 -0500
+Subject: ASoC: SOF: Intel: fix SoundWire/HDaudio mutual exclusion
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit f751b99255cacd9ffe8c4bbf99767ad670cee1f7 ]
+
+The functionality described in Commit 61bef9e68dca ("ASoC: SOF: Intel: hda: enforce exclusion between HDaudio and SoundWire")
+does not seem to be properly implemented with two issues that need to
+be corrected.
+
+a) The test used is incorrect when DisplayAudio codecs are not supported.
+
+b) Conversely when only Display Audio codecs can be found, we do want
+to start the SoundWire links, if any. That will help add the relevant
+topologies and machine descriptors, and identify cases where the
+SoundWire information in ACPI needs to be modified with a quirk.
+
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Link: https://lore.kernel.org/r/20230606222529.57156-2-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
+index 3153e21f100ab..3853582e32e12 100644
+--- a/sound/soc/sof/intel/hda.c
++++ b/sound/soc/sof/intel/hda.c
+@@ -1343,12 +1343,22 @@ static void hda_generic_machine_select(struct snd_sof_dev *sdev,
+ hda_mach->mach_params.dmic_num = dmic_num;
+ pdata->tplg_filename = tplg_filename;
+
+- if (codec_num == 2) {
++ if (codec_num == 2 ||
++ (codec_num == 1 && !HDA_IDISP_CODEC(bus->codec_mask))) {
+ /*
+ * Prevent SoundWire links from starting when an external
+ * HDaudio codec is used
+ */
+ hda_mach->mach_params.link_mask = 0;
++ } else {
++ /*
++ * Allow SoundWire links to start when no external HDaudio codec
++ * was detected. This will not create a SoundWire card but
++ * will help detect if any SoundWire codec reports as ATTACHED.
++ */
++ struct sof_intel_hda_dev *hdev = sdev->pdata->hw_pdata;
++
++ hda_mach->mach_params.link_mask = hdev->info.link_mask;
+ }
+
+ *mach = hda_mach;
+--
+2.40.1
+
--- /dev/null
+From d809d2811bbba063d7cb24b67c608d30b62ea545 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Jun 2023 12:08:10 -0500
+Subject: Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally
+
+From: Matthew Anderson <ruinairas1992@gmail.com>
+
+[ Upstream commit fa01eba11f0e57c767a5eab5291c7a01407a00be ]
+
+Adding the device ID from the Asus Ally gets the bluetooth working
+on the device.
+
+Signed-off-by: Matthew Anderson <ruinairas1992@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 50e23762ec5e9..025e803ba55c2 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -613,6 +613,9 @@ static const struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x0489, 0xe0d9), .driver_info = BTUSB_MEDIATEK |
+ BTUSB_WIDEBAND_SPEECH |
+ BTUSB_VALID_LE_STATES },
++ { USB_DEVICE(0x0489, 0xe0f5), .driver_info = BTUSB_MEDIATEK |
++ BTUSB_WIDEBAND_SPEECH |
++ BTUSB_VALID_LE_STATES },
+ { USB_DEVICE(0x13d3, 0x3568), .driver_info = BTUSB_MEDIATEK |
+ BTUSB_WIDEBAND_SPEECH |
+ BTUSB_VALID_LE_STATES },
+--
+2.40.1
+
--- /dev/null
+From e9a3a5563e69f456f9f2fa85295f726701cefde2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 May 2023 17:04:15 -0700
+Subject: Bluetooth: L2CAP: Fix use-after-free
+
+From: Zhengping Jiang <jiangzp@google.com>
+
+[ Upstream commit f752a0b334bb95fe9b42ecb511e0864e2768046f ]
+
+Fix potential use-after-free in l2cap_le_command_rej.
+
+Signed-off-by: Zhengping Jiang <jiangzp@google.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/l2cap_core.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index c5e8798e297ca..17ca13e8c044c 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -6374,9 +6374,14 @@ static inline int l2cap_le_command_rej(struct l2cap_conn *conn,
+ if (!chan)
+ goto done;
+
++ chan = l2cap_chan_hold_unless_zero(chan);
++ if (!chan)
++ goto done;
++
+ l2cap_chan_lock(chan);
+ l2cap_chan_del(chan, ECONNREFUSED);
+ l2cap_chan_unlock(chan);
++ l2cap_chan_put(chan);
+
+ done:
+ mutex_unlock(&conn->chan_lock);
+--
+2.40.1
+
--- /dev/null
+From a28f9f27602774acb1e607f11f9fb6b60c1e04aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Jul 2023 12:32:14 +0300
+Subject: Bluetooth: MGMT: Use correct address for memcpy()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit d1f0a9816f5fbc1316355ec1aa4ddfb9b624cca5 ]
+
+In function ‘fortify_memcpy_chk’,
+ inlined from ‘get_conn_info_complete’ at net/bluetooth/mgmt.c:7281:2:
+include/linux/fortify-string.h:592:25: error: call to
+‘__read_overflow2_field’ declared with attribute warning: detected read
+beyond size of field (2nd parameter); maybe use struct_group()?
+[-Werror=attribute-warning]
+ 592 | __read_overflow2_field(q_size_field, size);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+cc1: all warnings being treated as errors
+
+This is due to the wrong member is used for memcpy(). Use correct one.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/mgmt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
+index 1e07d0f289723..d4498037fadc6 100644
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -7285,7 +7285,7 @@ static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err)
+
+ bt_dev_dbg(hdev, "err %d", err);
+
+- memcpy(&rp.addr, &cp->addr.bdaddr, sizeof(rp.addr));
++ memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
+
+ status = mgmt_status(err);
+ if (status == MGMT_STATUS_SUCCESS) {
+--
+2.40.1
+
--- /dev/null
+From c784533ec09f759df66cd89d33eca7ad0bab04ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jun 2023 17:13:37 +0100
+Subject: btrfs: fix use-after-free of new block group that became unused
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit 0657b20c5a76c938612f8409735a8830d257866e ]
+
+If a task creates a new block group and that block group becomes unused
+before we finish its creation, at btrfs_create_pending_block_groups(),
+then when btrfs_mark_bg_unused() is called against the block group, we
+assume that the block group is currently in the list of block groups to
+reclaim, and we move it out of the list of new block groups and into the
+list of unused block groups. This has two consequences:
+
+1) We move it out of the list of new block groups associated to the
+ current transaction. So the block group creation is not finished and
+ if we attempt to delete the bg because it's unused, we will not find
+ the block group item in the extent tree (or the new block group tree),
+ its device extent items in the device tree etc, resulting in the
+ deletion to fail due to the missing items;
+
+2) We don't increment the reference count on the block group when we
+ move it to the list of unused block groups, because we assumed the
+ block group was on the list of block groups to reclaim, and in that
+ case it already has the correct reference count. However the block
+ group was on the list of new block groups, in which case no extra
+ reference was taken because it's local to the current task. This
+ later results in doing an extra reference count decrement when
+ removing the block group from the unused list, eventually leading the
+ reference count to 0.
+
+This second case was caught when running generic/297 from fstests, which
+produced the following assertion failure and stack trace:
+
+ [589.559] assertion failed: refcount_read(&block_group->refs) == 1, in fs/btrfs/block-group.c:4299
+ [589.559] ------------[ cut here ]------------
+ [589.559] kernel BUG at fs/btrfs/block-group.c:4299!
+ [589.560] invalid opcode: 0000 [#1] PREEMPT SMP PTI
+ [589.560] CPU: 8 PID: 2819134 Comm: umount Tainted: G W 6.4.0-rc6-btrfs-next-134+ #1
+ [589.560] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014
+ [589.560] RIP: 0010:btrfs_free_block_groups+0x449/0x4a0 [btrfs]
+ [589.561] Code: 68 62 da c0 (...)
+ [589.561] RSP: 0018:ffffa55a8c3b3d98 EFLAGS: 00010246
+ [589.561] RAX: 0000000000000058 RBX: ffff8f030d7f2000 RCX: 0000000000000000
+ [589.562] RDX: 0000000000000000 RSI: ffffffff953f0878 RDI: 00000000ffffffff
+ [589.562] RBP: ffff8f030d7f2088 R08: 0000000000000000 R09: ffffa55a8c3b3c50
+ [589.562] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8f05850b4c00
+ [589.562] R13: ffff8f030d7f2090 R14: ffff8f05850b4cd8 R15: dead000000000100
+ [589.563] FS: 00007f497fd2e840(0000) GS:ffff8f09dfc00000(0000) knlGS:0000000000000000
+ [589.563] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ [589.563] CR2: 00007f497ff8ec10 CR3: 0000000271472006 CR4: 0000000000370ee0
+ [589.563] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ [589.564] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ [589.564] Call Trace:
+ [589.564] <TASK>
+ [589.565] ? __die_body+0x1b/0x60
+ [589.565] ? die+0x39/0x60
+ [589.565] ? do_trap+0xeb/0x110
+ [589.565] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs]
+ [589.566] ? do_error_trap+0x6a/0x90
+ [589.566] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs]
+ [589.566] ? exc_invalid_op+0x4e/0x70
+ [589.566] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs]
+ [589.567] ? asm_exc_invalid_op+0x16/0x20
+ [589.567] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs]
+ [589.567] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs]
+ [589.567] close_ctree+0x35d/0x560 [btrfs]
+ [589.568] ? fsnotify_sb_delete+0x13e/0x1d0
+ [589.568] ? dispose_list+0x3a/0x50
+ [589.568] ? evict_inodes+0x151/0x1a0
+ [589.568] generic_shutdown_super+0x73/0x1a0
+ [589.569] kill_anon_super+0x14/0x30
+ [589.569] btrfs_kill_super+0x12/0x20 [btrfs]
+ [589.569] deactivate_locked_super+0x2e/0x70
+ [589.569] cleanup_mnt+0x104/0x160
+ [589.570] task_work_run+0x56/0x90
+ [589.570] exit_to_user_mode_prepare+0x160/0x170
+ [589.570] syscall_exit_to_user_mode+0x22/0x50
+ [589.570] ? __x64_sys_umount+0x12/0x20
+ [589.571] do_syscall_64+0x48/0x90
+ [589.571] entry_SYSCALL_64_after_hwframe+0x72/0xdc
+ [589.571] RIP: 0033:0x7f497ff0a567
+ [589.571] Code: af 98 0e (...)
+ [589.572] RSP: 002b:00007ffc98347358 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
+ [589.572] RAX: 0000000000000000 RBX: 00007f49800b8264 RCX: 00007f497ff0a567
+ [589.572] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000557f558abfa0
+ [589.573] RBP: 0000557f558a6ba0 R08: 0000000000000000 R09: 00007ffc98346100
+ [589.573] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
+ [589.573] R13: 0000557f558abfa0 R14: 0000557f558a6cb0 R15: 0000557f558a6dd0
+ [589.573] </TASK>
+ [589.574] Modules linked in: dm_snapshot dm_thin_pool (...)
+ [589.576] ---[ end trace 0000000000000000 ]---
+
+Fix this by adding a runtime flag to the block group to tell that the
+block group is still in the list of new block groups, and therefore it
+should not be moved to the list of unused block groups, at
+btrfs_mark_bg_unused(), until the flag is cleared, when we finish the
+creation of the block group at btrfs_create_pending_block_groups().
+
+Fixes: a9f189716cf1 ("btrfs: move out now unused BG from the reclaim list")
+CC: stable@vger.kernel.org # 5.15+
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/block-group.c | 13 +++++++++++--
+ fs/btrfs/block-group.h | 5 +++++
+ 2 files changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c
+index 78d57f1efe1d0..a250afa655d5c 100644
+--- a/fs/btrfs/block-group.c
++++ b/fs/btrfs/block-group.c
+@@ -1665,13 +1665,14 @@ void btrfs_mark_bg_unused(struct btrfs_block_group *bg)
+ {
+ struct btrfs_fs_info *fs_info = bg->fs_info;
+
+- trace_btrfs_add_unused_block_group(bg);
+ spin_lock(&fs_info->unused_bgs_lock);
+ if (list_empty(&bg->bg_list)) {
+ btrfs_get_block_group(bg);
++ trace_btrfs_add_unused_block_group(bg);
+ list_add_tail(&bg->bg_list, &fs_info->unused_bgs);
+- } else {
++ } else if (!test_bit(BLOCK_GROUP_FLAG_NEW, &bg->runtime_flags)) {
+ /* Pull out the block group from the reclaim_bgs list. */
++ trace_btrfs_add_unused_block_group(bg);
+ list_move_tail(&bg->bg_list, &fs_info->unused_bgs);
+ }
+ spin_unlock(&fs_info->unused_bgs_lock);
+@@ -2696,6 +2697,7 @@ void btrfs_create_pending_block_groups(struct btrfs_trans_handle *trans)
+ next:
+ btrfs_delayed_refs_rsv_release(fs_info, 1);
+ list_del_init(&block_group->bg_list);
++ clear_bit(BLOCK_GROUP_FLAG_NEW, &block_group->runtime_flags);
+ }
+ btrfs_trans_release_chunk_metadata(trans);
+ }
+@@ -2735,6 +2737,13 @@ struct btrfs_block_group *btrfs_make_block_group(struct btrfs_trans_handle *tran
+ if (!cache)
+ return ERR_PTR(-ENOMEM);
+
++ /*
++ * Mark it as new before adding it to the rbtree of block groups or any
++ * list, so that no other task finds it and calls btrfs_mark_bg_unused()
++ * before the new flag is set.
++ */
++ set_bit(BLOCK_GROUP_FLAG_NEW, &cache->runtime_flags);
++
+ cache->length = size;
+ set_free_space_tree_thresholds(cache);
+ cache->flags = type;
+diff --git a/fs/btrfs/block-group.h b/fs/btrfs/block-group.h
+index 471f591db7c0c..0852f6c101f82 100644
+--- a/fs/btrfs/block-group.h
++++ b/fs/btrfs/block-group.h
+@@ -70,6 +70,11 @@ enum btrfs_block_group_flags {
+ BLOCK_GROUP_FLAG_NEEDS_FREE_SPACE,
+ /* Indicate that the block group is placed on a sequential zone */
+ BLOCK_GROUP_FLAG_SEQUENTIAL_ZONE,
++ /*
++ * Indicate that block group is in the list of new block groups of a
++ * transaction.
++ */
++ BLOCK_GROUP_FLAG_NEW,
+ };
+
+ enum btrfs_caching_type {
+--
+2.40.1
+
--- /dev/null
+From e72c4956eedf6f4788fe79823670603226f55651 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 14:36:34 +0900
+Subject: btrfs: move out now unused BG from the reclaim list
+
+From: Naohiro Aota <naota@elisp.net>
+
+[ Upstream commit a9f189716cf15913c453299d72f69c51a9b0f86b ]
+
+An unused block group is easy to remove to free up space and should be
+reclaimed fast. Such block group can often already be a target of the
+reclaim process. As we check list_empty(&bg->bg_list), we keep it in the
+reclaim list. That block group is never reclaimed until the file system
+is filled e.g. up to 75%.
+
+Instead, we can move unused block group to the unused list and delete it
+fast.
+
+Fixes: 18bb8bbf13c1 ("btrfs: zoned: automatically reclaim zones")
+CC: stable@vger.kernel.org # 5.15+
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/block-group.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c
+index 2a60033d907bf..78d57f1efe1d0 100644
+--- a/fs/btrfs/block-group.c
++++ b/fs/btrfs/block-group.c
+@@ -1665,11 +1665,14 @@ void btrfs_mark_bg_unused(struct btrfs_block_group *bg)
+ {
+ struct btrfs_fs_info *fs_info = bg->fs_info;
+
++ trace_btrfs_add_unused_block_group(bg);
+ spin_lock(&fs_info->unused_bgs_lock);
+ if (list_empty(&bg->bg_list)) {
+ btrfs_get_block_group(bg);
+- trace_btrfs_add_unused_block_group(bg);
+ list_add_tail(&bg->bg_list, &fs_info->unused_bgs);
++ } else {
++ /* Pull out the block group from the reclaim_bgs list. */
++ list_move_tail(&bg->bg_list, &fs_info->unused_bgs);
+ }
+ spin_unlock(&fs_info->unused_bgs_lock);
+ }
+--
+2.40.1
+
--- /dev/null
+From e20eca62d5271222be770e64b7b19c512a2a2d86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jul 2023 11:44:38 +0000
+Subject: can: raw: fix lockdep issue in raw_release()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 11c9027c983e9e4b408ee5613b6504d24ebd85be ]
+
+syzbot complained about a lockdep issue [1]
+
+Since raw_bind() and raw_setsockopt() first get RTNL
+before locking the socket, we must adopt the same order in raw_release()
+
+[1]
+WARNING: possible circular locking dependency detected
+6.5.0-rc1-syzkaller-00192-g78adb4bcf99e #0 Not tainted
+------------------------------------------------------
+syz-executor.0/14110 is trying to acquire lock:
+ffff88804e4b6130 (sk_lock-AF_CAN){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1708 [inline]
+ffff88804e4b6130 (sk_lock-AF_CAN){+.+.}-{0:0}, at: raw_bind+0xb1/0xab0 net/can/raw.c:435
+
+but task is already holding lock:
+ffffffff8e3df368 (rtnl_mutex){+.+.}-{3:3}, at: raw_bind+0xa7/0xab0 net/can/raw.c:434
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #1 (rtnl_mutex){+.+.}-{3:3}:
+__mutex_lock_common kernel/locking/mutex.c:603 [inline]
+__mutex_lock+0x181/0x1340 kernel/locking/mutex.c:747
+raw_release+0x1c6/0x9b0 net/can/raw.c:391
+__sock_release+0xcd/0x290 net/socket.c:654
+sock_close+0x1c/0x20 net/socket.c:1386
+__fput+0x3fd/0xac0 fs/file_table.c:384
+task_work_run+0x14d/0x240 kernel/task_work.c:179
+resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
+exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
+exit_to_user_mode_prepare+0x210/0x240 kernel/entry/common.c:204
+__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
+syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
+do_syscall_64+0x44/0xb0 arch/x86/entry/common.c:86
+entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+-> #0 (sk_lock-AF_CAN){+.+.}-{0:0}:
+check_prev_add kernel/locking/lockdep.c:3142 [inline]
+check_prevs_add kernel/locking/lockdep.c:3261 [inline]
+validate_chain kernel/locking/lockdep.c:3876 [inline]
+__lock_acquire+0x2e3d/0x5de0 kernel/locking/lockdep.c:5144
+lock_acquire kernel/locking/lockdep.c:5761 [inline]
+lock_acquire+0x1ae/0x510 kernel/locking/lockdep.c:5726
+lock_sock_nested+0x3a/0xf0 net/core/sock.c:3492
+lock_sock include/net/sock.h:1708 [inline]
+raw_bind+0xb1/0xab0 net/can/raw.c:435
+__sys_bind+0x1ec/0x220 net/socket.c:1792
+__do_sys_bind net/socket.c:1803 [inline]
+__se_sys_bind net/socket.c:1801 [inline]
+__x64_sys_bind+0x72/0xb0 net/socket.c:1801
+do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
+entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+other info that might help us debug this:
+
+Possible unsafe locking scenario:
+
+CPU0 CPU1
+---- ----
+lock(rtnl_mutex);
+ lock(sk_lock-AF_CAN);
+ lock(rtnl_mutex);
+lock(sk_lock-AF_CAN);
+
+*** DEADLOCK ***
+
+1 lock held by syz-executor.0/14110:
+
+stack backtrace:
+CPU: 0 PID: 14110 Comm: syz-executor.0 Not tainted 6.5.0-rc1-syzkaller-00192-g78adb4bcf99e #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
+Call Trace:
+<TASK>
+__dump_stack lib/dump_stack.c:88 [inline]
+dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
+check_noncircular+0x311/0x3f0 kernel/locking/lockdep.c:2195
+check_prev_add kernel/locking/lockdep.c:3142 [inline]
+check_prevs_add kernel/locking/lockdep.c:3261 [inline]
+validate_chain kernel/locking/lockdep.c:3876 [inline]
+__lock_acquire+0x2e3d/0x5de0 kernel/locking/lockdep.c:5144
+lock_acquire kernel/locking/lockdep.c:5761 [inline]
+lock_acquire+0x1ae/0x510 kernel/locking/lockdep.c:5726
+lock_sock_nested+0x3a/0xf0 net/core/sock.c:3492
+lock_sock include/net/sock.h:1708 [inline]
+raw_bind+0xb1/0xab0 net/can/raw.c:435
+__sys_bind+0x1ec/0x220 net/socket.c:1792
+__do_sys_bind net/socket.c:1803 [inline]
+__se_sys_bind net/socket.c:1801 [inline]
+__x64_sys_bind+0x72/0xb0 net/socket.c:1801
+do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
+entry_SYSCALL_64_after_hwframe+0x63/0xcd
+RIP: 0033:0x7fd89007cb29
+Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
+RSP: 002b:00007fd890d2a0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000031
+RAX: ffffffffffffffda RBX: 00007fd89019bf80 RCX: 00007fd89007cb29
+RDX: 0000000000000010 RSI: 0000000020000040 RDI: 0000000000000003
+RBP: 00007fd8900c847a R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
+R13: 000000000000000b R14: 00007fd89019bf80 R15: 00007ffebf8124f8
+</TASK>
+
+Fixes: ee8b94c8510c ("can: raw: fix receiver memory leak")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Ziyang Xuan <william.xuanziyang@huawei.com>
+Cc: Oliver Hartkopp <socketcan@hartkopp.net>
+Cc: stable@vger.kernel.org
+Cc: Marc Kleine-Budde <mkl@pengutronix.de>
+Link: https://lore.kernel.org/all/20230720114438.172434-1-edumazet@google.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/can/raw.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/net/can/raw.c b/net/can/raw.c
+index 9fdad12d16325..9fbbf6e00287f 100644
+--- a/net/can/raw.c
++++ b/net/can/raw.c
+@@ -386,9 +386,9 @@ static int raw_release(struct socket *sock)
+ list_del(&ro->notifier);
+ spin_unlock(&raw_notifier_lock);
+
++ rtnl_lock();
+ lock_sock(sk);
+
+- rtnl_lock();
+ /* remove current filters & unregister */
+ if (ro->bound) {
+ if (ro->dev)
+@@ -405,12 +405,13 @@ static int raw_release(struct socket *sock)
+ ro->dev = NULL;
+ ro->count = 0;
+ free_percpu(ro->uniq);
+- rtnl_unlock();
+
+ sock_orphan(sk);
+ sock->sk = NULL;
+
+ release_sock(sk);
++ rtnl_unlock();
++
+ sock_put(sk);
+
+ return 0;
+--
+2.40.1
+
--- /dev/null
+From c2456f5b8df8441191e1c596d4933b71425b6ac4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Jul 2023 09:17:37 +0800
+Subject: can: raw: fix receiver memory leak
+
+From: Ziyang Xuan <william.xuanziyang@huawei.com>
+
+[ Upstream commit ee8b94c8510ce64afe0b87ef548d23e00915fb10 ]
+
+Got kmemleak errors with the following ltp can_filter testcase:
+
+for ((i=1; i<=100; i++))
+do
+ ./can_filter &
+ sleep 0.1
+done
+
+==============================================================
+[<00000000db4a4943>] can_rx_register+0x147/0x360 [can]
+[<00000000a289549d>] raw_setsockopt+0x5ef/0x853 [can_raw]
+[<000000006d3d9ebd>] __sys_setsockopt+0x173/0x2c0
+[<00000000407dbfec>] __x64_sys_setsockopt+0x61/0x70
+[<00000000fd468496>] do_syscall_64+0x33/0x40
+[<00000000b7e47d51>] entry_SYSCALL_64_after_hwframe+0x61/0xc6
+
+It's a bug in the concurrent scenario of unregister_netdevice_many()
+and raw_release() as following:
+
+ cpu0 cpu1
+unregister_netdevice_many(can_dev)
+ unlist_netdevice(can_dev) // dev_get_by_index() return NULL after this
+ net_set_todo(can_dev)
+ raw_release(can_socket)
+ dev = dev_get_by_index(, ro->ifindex); // dev == NULL
+ if (dev) { // receivers in dev_rcv_lists not free because dev is NULL
+ raw_disable_allfilters(, dev, );
+ dev_put(dev);
+ }
+ ...
+ ro->bound = 0;
+ ...
+
+call_netdevice_notifiers(NETDEV_UNREGISTER, )
+ raw_notify(, NETDEV_UNREGISTER, )
+ if (ro->bound) // invalid because ro->bound has been set 0
+ raw_disable_allfilters(, dev, ); // receivers in dev_rcv_lists will never be freed
+
+Add a net_device pointer member in struct raw_sock to record bound
+can_dev, and use rtnl_lock to serialize raw_socket members between
+raw_bind(), raw_release(), raw_setsockopt() and raw_notify(). Use
+ro->dev to decide whether to free receivers in dev_rcv_lists.
+
+Fixes: 8d0caedb7596 ("can: bcm/raw/isotp: use per module netdevice notifier")
+Reviewed-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
+Link: https://lore.kernel.org/all/20230711011737.1969582-1-william.xuanziyang@huawei.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/can/raw.c | 57 ++++++++++++++++++++++-----------------------------
+ 1 file changed, 24 insertions(+), 33 deletions(-)
+
+diff --git a/net/can/raw.c b/net/can/raw.c
+index f8e3866157a33..9fdad12d16325 100644
+--- a/net/can/raw.c
++++ b/net/can/raw.c
+@@ -84,6 +84,7 @@ struct raw_sock {
+ struct sock sk;
+ int bound;
+ int ifindex;
++ struct net_device *dev;
+ struct list_head notifier;
+ int loopback;
+ int recv_own_msgs;
+@@ -277,7 +278,7 @@ static void raw_notify(struct raw_sock *ro, unsigned long msg,
+ if (!net_eq(dev_net(dev), sock_net(sk)))
+ return;
+
+- if (ro->ifindex != dev->ifindex)
++ if (ro->dev != dev)
+ return;
+
+ switch (msg) {
+@@ -292,6 +293,7 @@ static void raw_notify(struct raw_sock *ro, unsigned long msg,
+
+ ro->ifindex = 0;
+ ro->bound = 0;
++ ro->dev = NULL;
+ ro->count = 0;
+ release_sock(sk);
+
+@@ -337,6 +339,7 @@ static int raw_init(struct sock *sk)
+
+ ro->bound = 0;
+ ro->ifindex = 0;
++ ro->dev = NULL;
+
+ /* set default filter to single entry dfilter */
+ ro->dfilter.can_id = 0;
+@@ -385,19 +388,13 @@ static int raw_release(struct socket *sock)
+
+ lock_sock(sk);
+
++ rtnl_lock();
+ /* remove current filters & unregister */
+ if (ro->bound) {
+- if (ro->ifindex) {
+- struct net_device *dev;
+-
+- dev = dev_get_by_index(sock_net(sk), ro->ifindex);
+- if (dev) {
+- raw_disable_allfilters(dev_net(dev), dev, sk);
+- dev_put(dev);
+- }
+- } else {
++ if (ro->dev)
++ raw_disable_allfilters(dev_net(ro->dev), ro->dev, sk);
++ else
+ raw_disable_allfilters(sock_net(sk), NULL, sk);
+- }
+ }
+
+ if (ro->count > 1)
+@@ -405,8 +402,10 @@ static int raw_release(struct socket *sock)
+
+ ro->ifindex = 0;
+ ro->bound = 0;
++ ro->dev = NULL;
+ ro->count = 0;
+ free_percpu(ro->uniq);
++ rtnl_unlock();
+
+ sock_orphan(sk);
+ sock->sk = NULL;
+@@ -422,6 +421,7 @@ static int raw_bind(struct socket *sock, struct sockaddr *uaddr, int len)
+ struct sockaddr_can *addr = (struct sockaddr_can *)uaddr;
+ struct sock *sk = sock->sk;
+ struct raw_sock *ro = raw_sk(sk);
++ struct net_device *dev = NULL;
+ int ifindex;
+ int err = 0;
+ int notify_enetdown = 0;
+@@ -431,14 +431,13 @@ static int raw_bind(struct socket *sock, struct sockaddr *uaddr, int len)
+ if (addr->can_family != AF_CAN)
+ return -EINVAL;
+
++ rtnl_lock();
+ lock_sock(sk);
+
+ if (ro->bound && addr->can_ifindex == ro->ifindex)
+ goto out;
+
+ if (addr->can_ifindex) {
+- struct net_device *dev;
+-
+ dev = dev_get_by_index(sock_net(sk), addr->can_ifindex);
+ if (!dev) {
+ err = -ENODEV;
+@@ -467,26 +466,20 @@ static int raw_bind(struct socket *sock, struct sockaddr *uaddr, int len)
+ if (!err) {
+ if (ro->bound) {
+ /* unregister old filters */
+- if (ro->ifindex) {
+- struct net_device *dev;
+-
+- dev = dev_get_by_index(sock_net(sk),
+- ro->ifindex);
+- if (dev) {
+- raw_disable_allfilters(dev_net(dev),
+- dev, sk);
+- dev_put(dev);
+- }
+- } else {
++ if (ro->dev)
++ raw_disable_allfilters(dev_net(ro->dev),
++ ro->dev, sk);
++ else
+ raw_disable_allfilters(sock_net(sk), NULL, sk);
+- }
+ }
+ ro->ifindex = ifindex;
+ ro->bound = 1;
++ ro->dev = dev;
+ }
+
+ out:
+ release_sock(sk);
++ rtnl_unlock();
+
+ if (notify_enetdown) {
+ sk->sk_err = ENETDOWN;
+@@ -553,9 +546,9 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
+ rtnl_lock();
+ lock_sock(sk);
+
+- if (ro->bound && ro->ifindex) {
+- dev = dev_get_by_index(sock_net(sk), ro->ifindex);
+- if (!dev) {
++ dev = ro->dev;
++ if (ro->bound && dev) {
++ if (dev->reg_state != NETREG_REGISTERED) {
+ if (count > 1)
+ kfree(filter);
+ err = -ENODEV;
+@@ -596,7 +589,6 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
+ ro->count = count;
+
+ out_fil:
+- dev_put(dev);
+ release_sock(sk);
+ rtnl_unlock();
+
+@@ -614,9 +606,9 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
+ rtnl_lock();
+ lock_sock(sk);
+
+- if (ro->bound && ro->ifindex) {
+- dev = dev_get_by_index(sock_net(sk), ro->ifindex);
+- if (!dev) {
++ dev = ro->dev;
++ if (ro->bound && dev) {
++ if (dev->reg_state != NETREG_REGISTERED) {
+ err = -ENODEV;
+ goto out_err;
+ }
+@@ -640,7 +632,6 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
+ ro->err_mask = err_mask;
+
+ out_err:
+- dev_put(dev);
+ release_sock(sk);
+ rtnl_unlock();
+
+--
+2.40.1
+
--- /dev/null
+From 41d4ae930fd2b240e822205ba3ad06c9c7d4c6f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 May 2023 09:40:14 +0800
+Subject: ceph: try to dump the msgs when decoding fails
+
+From: Xiubo Li <xiubli@redhat.com>
+
+[ Upstream commit 8b0da5c549ae63ba1debd92a350f90773cb4bfe7 ]
+
+When the msgs are corrupted we need to dump them and then it will
+be easier to dig what has happened and where the issue is.
+
+Signed-off-by: Xiubo Li <xiubli@redhat.com>
+Reviewed-by: Milind Changire <mchangir@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/mds_client.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index 83c4abff496da..5fb367b1d4b06 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -645,6 +645,7 @@ static int parse_reply_info(struct ceph_mds_session *s, struct ceph_msg *msg,
+ err = -EIO;
+ out_bad:
+ pr_err("mds parse_reply err %d\n", err);
++ ceph_msg_dump(msg);
+ return err;
+ }
+
+@@ -3538,6 +3539,7 @@ static void handle_forward(struct ceph_mds_client *mdsc,
+
+ bad:
+ pr_err("mdsc_handle_forward decode error err=%d\n", err);
++ ceph_msg_dump(msg);
+ }
+
+ static int __decode_session_metadata(void **p, void *end,
+@@ -5258,6 +5260,7 @@ void ceph_mdsc_handle_fsmap(struct ceph_mds_client *mdsc, struct ceph_msg *msg)
+ bad:
+ pr_err("error decoding fsmap %d. Shutting down mount.\n", err);
+ ceph_umount_begin(mdsc->fsc->sb);
++ ceph_msg_dump(msg);
+ err_out:
+ mutex_lock(&mdsc->mutex);
+ mdsc->mdsmap_err = err;
+@@ -5326,6 +5329,7 @@ void ceph_mdsc_handle_mdsmap(struct ceph_mds_client *mdsc, struct ceph_msg *msg)
+ bad:
+ pr_err("error decoding mdsmap %d. Shutting down mount.\n", err);
+ ceph_umount_begin(mdsc->fsc->sb);
++ ceph_msg_dump(msg);
+ return;
+ }
+
+--
+2.40.1
+
--- /dev/null
+From b90ab7a1b09367d279343de4a49c698a3b6731e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jun 2023 11:42:56 +0800
+Subject: cifs: fix session state check in reconnect to avoid use-after-free
+ issue
+
+From: Winston Wen <wentao@uniontech.com>
+
+[ Upstream commit 99f280700b4cc02d5f141b8d15f8e9fad0418f65 ]
+
+Don't collect exiting session in smb2_reconnect_server(), because it
+will be released soon.
+
+Note that the exiting session will stay in server->smb_ses_list until
+it complete the cifs_free_ipc() and logoff() and then delete itself
+from the list.
+
+Signed-off-by: Winston Wen <wentao@uniontech.com>
+Reviewed-by: Shyam Prasad N <sprasad@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2pdu.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c
+index 17fe212ab895d..e04766fe6f803 100644
+--- a/fs/smb/client/smb2pdu.c
++++ b/fs/smb/client/smb2pdu.c
+@@ -3797,6 +3797,12 @@ void smb2_reconnect_server(struct work_struct *work)
+
+ spin_lock(&cifs_tcp_ses_lock);
+ list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) {
++ spin_lock(&ses->ses_lock);
++ if (ses->ses_status == SES_EXITING) {
++ spin_unlock(&ses->ses_lock);
++ continue;
++ }
++ spin_unlock(&ses->ses_lock);
+
+ tcon_selected = false;
+
+--
+2.40.1
+
--- /dev/null
+From b48eb5c3aa850047c73270f7bc7cec0165987274 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Jul 2023 11:57:56 +0100
+Subject: crypto, cifs: fix error handling in extract_iter_to_sg()
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit f443fd5af5dbd531f880d3645d5dd36976cf087f ]
+
+Fix error handling in extract_iter_to_sg(). Pages need to be unpinned, not
+put in extract_user_to_sg() when handling IOVEC/UBUF sources.
+
+The bug may result in a warning like the following:
+
+ WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 __lse_atomic_add arch/arm64/include/asm/atomic_lse.h:27 [inline]
+ WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 arch_atomic_add arch/arm64/include/asm/atomic.h:28 [inline]
+ WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 raw_atomic_add include/linux/atomic/atomic-arch-fallback.h:537 [inline]
+ WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 atomic_add include/linux/atomic/atomic-instrumented.h:105 [inline]
+ WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 try_grab_page+0x108/0x160 mm/gup.c:252
+ ...
+ pc : try_grab_page+0x108/0x160 mm/gup.c:229
+ lr : follow_page_pte+0x174/0x3e4 mm/gup.c:651
+ ...
+ Call trace:
+ __lse_atomic_add arch/arm64/include/asm/atomic_lse.h:27 [inline]
+ arch_atomic_add arch/arm64/include/asm/atomic.h:28 [inline]
+ raw_atomic_add include/linux/atomic/atomic-arch-fallback.h:537 [inline]
+ atomic_add include/linux/atomic/atomic-instrumented.h:105 [inline]
+ try_grab_page+0x108/0x160 mm/gup.c:252
+ follow_pmd_mask mm/gup.c:734 [inline]
+ follow_pud_mask mm/gup.c:765 [inline]
+ follow_p4d_mask mm/gup.c:782 [inline]
+ follow_page_mask+0x12c/0x2e4 mm/gup.c:839
+ __get_user_pages+0x174/0x30c mm/gup.c:1217
+ __get_user_pages_locked mm/gup.c:1448 [inline]
+ __gup_longterm_locked+0x94/0x8f4 mm/gup.c:2142
+ internal_get_user_pages_fast+0x970/0xb60 mm/gup.c:3140
+ pin_user_pages_fast+0x4c/0x60 mm/gup.c:3246
+ iov_iter_extract_user_pages lib/iov_iter.c:1768 [inline]
+ iov_iter_extract_pages+0xc8/0x54c lib/iov_iter.c:1831
+ extract_user_to_sg lib/scatterlist.c:1123 [inline]
+ extract_iter_to_sg lib/scatterlist.c:1349 [inline]
+ extract_iter_to_sg+0x26c/0x6fc lib/scatterlist.c:1339
+ hash_sendmsg+0xc0/0x43c crypto/algif_hash.c:117
+ sock_sendmsg_nosec net/socket.c:725 [inline]
+ sock_sendmsg+0x54/0x60 net/socket.c:748
+ ____sys_sendmsg+0x270/0x2ac net/socket.c:2494
+ ___sys_sendmsg+0x80/0xdc net/socket.c:2548
+ __sys_sendmsg+0x68/0xc4 net/socket.c:2577
+ __do_sys_sendmsg net/socket.c:2586 [inline]
+ __se_sys_sendmsg net/socket.c:2584 [inline]
+ __arm64_sys_sendmsg+0x24/0x30 net/socket.c:2584
+ __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
+ invoke_syscall+0x48/0x114 arch/arm64/kernel/syscall.c:52
+ el0_svc_common.constprop.0+0x44/0xe4 arch/arm64/kernel/syscall.c:142
+ do_el0_svc+0x38/0xa4 arch/arm64/kernel/syscall.c:191
+ el0_svc+0x2c/0xb0 arch/arm64/kernel/entry-common.c:647
+ el0t_64_sync_handler+0xc0/0xc4 arch/arm64/kernel/entry-common.c:665
+ el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:591
+
+Link: https://lkml.kernel.org/r/20571.1690369076@warthog.procyon.org.uk
+Fixes: 018584697533 ("netfs: Add a function to extract an iterator into a scatterlist")
+Reported-by: syzbot+9b82859567f2e50c123e@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/linux-mm/000000000000273d0105ff97bf56@google.com/
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Acked-by: Steve French <stfrench@microsoft.com>
+Cc: Sven Schnelle <svens@linux.ibm.com>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: Jeff Layton <jlayton@kernel.org>
+Cc: Shyam Prasad N <nspmangalore@gmail.com>
+Cc: Rohith Surabattula <rohiths.msft@gmail.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/scatterlist.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/scatterlist.c b/lib/scatterlist.c
+index e97d7060329e8..f68efa8448137 100644
+--- a/lib/scatterlist.c
++++ b/lib/scatterlist.c
+@@ -1148,7 +1148,7 @@ static ssize_t extract_user_to_sg(struct iov_iter *iter,
+
+ failed:
+ while (sgtable->nents > sgtable->orig_nents)
+- put_page(sg_page(&sgtable->sgl[--sgtable->nents]));
++ unpin_user_page(sg_page(&sgtable->sgl[--sgtable->nents]));
+ return res;
+ }
+
+--
+2.40.1
+
--- /dev/null
+From decb2dafcadd9d04247aadbb22a3c944b54c4f51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 12:47:37 +0000
+Subject: dma-remap: use kvmalloc_array/kvfree for larger dma memory remap
+
+From: gaoxu <gaoxu2@hihonor.com>
+
+[ Upstream commit 51ff97d54f02b4444dfc42e380ac4c058e12d5dd ]
+
+If dma_direct_alloc() alloc memory in size of 64MB, the inner function
+dma_common_contiguous_remap() will allocate 128KB memory by invoking
+the function kmalloc_array(). and the kmalloc_array seems to fail to try to
+allocate 128KB mem.
+
+Call trace:
+[14977.928623] qcrosvm: page allocation failure: order:5, mode:0x40cc0
+[14977.928638] dump_backtrace.cfi_jt+0x0/0x8
+[14977.928647] dump_stack_lvl+0x80/0xb8
+[14977.928652] warn_alloc+0x164/0x200
+[14977.928657] __alloc_pages_slowpath+0x9f0/0xb4c
+[14977.928660] __alloc_pages+0x21c/0x39c
+[14977.928662] kmalloc_order+0x48/0x108
+[14977.928666] kmalloc_order_trace+0x34/0x154
+[14977.928668] __kmalloc+0x548/0x7e4
+[14977.928673] dma_direct_alloc+0x11c/0x4f8
+[14977.928678] dma_alloc_attrs+0xf4/0x138
+[14977.928680] gh_vm_ioctl_set_fw_name+0x3c4/0x610 [gunyah]
+[14977.928698] gh_vm_ioctl+0x90/0x14c [gunyah]
+[14977.928705] __arm64_sys_ioctl+0x184/0x210
+
+work around by doing kvmalloc_array instead.
+
+Signed-off-by: Gao Xu <gaoxu2@hihonor.com>
+Reviewed-by: Suren Baghdasaryan <surenb@google.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/dma/remap.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/dma/remap.c b/kernel/dma/remap.c
+index b4526668072e7..27596f3b4aef3 100644
+--- a/kernel/dma/remap.c
++++ b/kernel/dma/remap.c
+@@ -43,13 +43,13 @@ void *dma_common_contiguous_remap(struct page *page, size_t size,
+ void *vaddr;
+ int i;
+
+- pages = kmalloc_array(count, sizeof(struct page *), GFP_KERNEL);
++ pages = kvmalloc_array(count, sizeof(struct page *), GFP_KERNEL);
+ if (!pages)
+ return NULL;
+ for (i = 0; i < count; i++)
+ pages[i] = nth_page(page, i);
+ vaddr = vmap(pages, count, VM_DMA_COHERENT, prot);
+- kfree(pages);
++ kvfree(pages);
+
+ return vaddr;
+ }
+--
+2.40.1
+
--- /dev/null
+From c445bc727d07ca4886db80897bbaba2d339e4b57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 May 2023 15:25:01 -0400
+Subject: drm/amd/display: Apply 60us prefetch for DCFCLK <= 300Mhz
+
+From: Alvin Lee <alvin.lee2@amd.com>
+
+[ Upstream commit 7e60ab4eb3e4ba2adac46d737fdbbc5732bebd58 ]
+
+[Description]
+- Previously we wanted to apply extra 60us of prefetch for min DCFCLK
+ (200Mhz), but DCFCLK can be calculated to be 201Mhz which underflows
+ also without the extra prefetch
+- Instead, apply the the extra 60us prefetch for any DCFCLK freq <=
+ 300Mhz
+
+Reviewed-by: Nevenko Stupar <nevenko.stupar@amd.com>
+Reviewed-by: Jun Lei <jun.lei@amd.com>
+Acked-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Alvin Lee <alvin.lee2@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c | 4 ++--
+ .../gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.h | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c
+index d75248b6cae99..9a5150e96017a 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c
+@@ -811,7 +811,7 @@ static void DISPCLKDPPCLKDCFCLKDeepSleepPrefetchParametersWatermarksAndPerforman
+ v->SwathHeightC[k],
+ TWait,
+ (v->DRAMSpeedPerState[mode_lib->vba.VoltageLevel] <= MEM_STROBE_FREQ_MHZ ||
+- v->DCFCLKPerState[mode_lib->vba.VoltageLevel] <= MIN_DCFCLK_FREQ_MHZ) ?
++ v->DCFCLKPerState[mode_lib->vba.VoltageLevel] <= DCFCLK_FREQ_EXTRA_PREFETCH_REQ_MHZ) ?
+ mode_lib->vba.ip.min_prefetch_in_strobe_us : 0,
+ /* Output */
+ &v->DSTXAfterScaler[k],
+@@ -3311,7 +3311,7 @@ void dml32_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l
+ v->swath_width_chroma_ub_this_state[k],
+ v->SwathHeightYThisState[k],
+ v->SwathHeightCThisState[k], v->TWait,
+- (v->DRAMSpeedPerState[i] <= MEM_STROBE_FREQ_MHZ || v->DCFCLKState[i][j] <= MIN_DCFCLK_FREQ_MHZ) ?
++ (v->DRAMSpeedPerState[i] <= MEM_STROBE_FREQ_MHZ || v->DCFCLKState[i][j] <= DCFCLK_FREQ_EXTRA_PREFETCH_REQ_MHZ) ?
+ mode_lib->vba.ip.min_prefetch_in_strobe_us : 0,
+
+ /* Output */
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.h b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.h
+index d98e36a9a09cc..c4745d63039bb 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.h
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.h
+@@ -53,7 +53,7 @@
+ #define BPP_BLENDED_PIPE 0xffffffff
+
+ #define MEM_STROBE_FREQ_MHZ 1600
+-#define MIN_DCFCLK_FREQ_MHZ 200
++#define DCFCLK_FREQ_EXTRA_PREFETCH_REQ_MHZ 300
+ #define MEM_STROBE_MAX_DELIVERY_TIME_US 60.0
+
+ struct display_mode_lib;
+--
+2.40.1
+
--- /dev/null
+From 33f6d20cc7c50cec1d40121728d6b0bb0f4d0190 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 May 2023 13:02:01 -0400
+Subject: drm/amd/display: Enable dcn314 DPP RCO
+
+From: Daniel Miess <daniel.miess@amd.com>
+
+[ Upstream commit 17fbdbda9cc87ff5a013898de506212d25323ed7 ]
+
+[Why and How]
+Add back debug bits enabling RCO for dcn314 as underflow
+associated with this change has been resolved
+
+Acked-by: Stylon Wang <stylon.wang@amd.com>
+Signed-off-by: Daniel Miess <daniel.miess@amd.com>
+Reviewed-by: Jun Lei <jun.lei@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/dcn314/dcn314_resource.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c
+index abeeede38fb39..049fafd3d908c 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c
+@@ -921,6 +921,22 @@ static const struct dc_debug_options debug_defaults_drv = {
+ .afmt = true,
+ }
+ },
++
++ .root_clock_optimization = {
++ .bits = {
++ .dpp = true,
++ .dsc = false,
++ .hdmistream = false,
++ .hdmichar = false,
++ .dpstream = false,
++ .symclk32_se = false,
++ .symclk32_le = false,
++ .symclk_fe = false,
++ .physymclk = false,
++ .dpiasymclk = false,
++ }
++ },
++
+ .seamless_boot_odm_combine = true
+ };
+
+--
+2.40.1
+
--- /dev/null
+From 8c82ae4bed8f9d6fa189f513e6ecb2aa3f43a4dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Apr 2023 14:02:02 -0400
+Subject: drm/amd/display: Remove v_startup workaround for dcn3+
+
+From: Daniel Miess <daniel.miess@amd.com>
+
+[ Upstream commit 3a31e8b89b7240d9a17ace8a1ed050bdcb560f9e ]
+
+[Why]
+Calls to dcn20_adjust_freesync_v_startup are no longer
+needed as of dcn3+ and can cause underflow in some cases
+
+[How]
+Move calls to dcn20_adjust_freesync_v_startup up into
+validate_bandwidth for dcn2.x
+
+Reviewed-by: Jun Lei <jun.lei@amd.com>
+Acked-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Daniel Miess <daniel.miess@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/dml/dcn20/dcn20_fpu.c | 24 +++++++++++++++----
+ 1 file changed, 20 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c
+index 7661f8946aa31..9ec767ebf5d16 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c
+@@ -1097,10 +1097,6 @@ void dcn20_calculate_dlg_params(struct dc *dc,
+ context->res_ctx.pipe_ctx[i].plane_res.bw.dppclk_khz =
+ pipes[pipe_idx].clks_cfg.dppclk_mhz * 1000;
+ context->res_ctx.pipe_ctx[i].pipe_dlg_param = pipes[pipe_idx].pipe.dest;
+- if (context->res_ctx.pipe_ctx[i].stream->adaptive_sync_infopacket.valid)
+- dcn20_adjust_freesync_v_startup(
+- &context->res_ctx.pipe_ctx[i].stream->timing,
+- &context->res_ctx.pipe_ctx[i].pipe_dlg_param.vstartup_start);
+
+ pipe_idx++;
+ }
+@@ -1914,6 +1910,7 @@ static bool dcn20_validate_bandwidth_internal(struct dc *dc, struct dc_state *co
+ int vlevel = 0;
+ int pipe_split_from[MAX_PIPES];
+ int pipe_cnt = 0;
++ int i = 0;
+ display_e2e_pipe_params_st *pipes = kzalloc(dc->res_pool->pipe_count * sizeof(display_e2e_pipe_params_st), GFP_ATOMIC);
+ DC_LOGGER_INIT(dc->ctx->logger);
+
+@@ -1937,6 +1934,15 @@ static bool dcn20_validate_bandwidth_internal(struct dc *dc, struct dc_state *co
+ dcn20_calculate_wm(dc, context, pipes, &pipe_cnt, pipe_split_from, vlevel, fast_validate);
+ dcn20_calculate_dlg_params(dc, context, pipes, pipe_cnt, vlevel);
+
++ for (i = 0; i < dc->res_pool->pipe_count; i++) {
++ if (!context->res_ctx.pipe_ctx[i].stream)
++ continue;
++ if (context->res_ctx.pipe_ctx[i].stream->adaptive_sync_infopacket.valid)
++ dcn20_adjust_freesync_v_startup(
++ &context->res_ctx.pipe_ctx[i].stream->timing,
++ &context->res_ctx.pipe_ctx[i].pipe_dlg_param.vstartup_start);
++ }
++
+ BW_VAL_TRACE_END_WATERMARKS();
+
+ goto validate_out;
+@@ -2209,6 +2215,7 @@ bool dcn21_validate_bandwidth_fp(struct dc *dc,
+ int vlevel = 0;
+ int pipe_split_from[MAX_PIPES];
+ int pipe_cnt = 0;
++ int i = 0;
+ display_e2e_pipe_params_st *pipes = kzalloc(dc->res_pool->pipe_count * sizeof(display_e2e_pipe_params_st), GFP_ATOMIC);
+ DC_LOGGER_INIT(dc->ctx->logger);
+
+@@ -2237,6 +2244,15 @@ bool dcn21_validate_bandwidth_fp(struct dc *dc,
+ dcn21_calculate_wm(dc, context, pipes, &pipe_cnt, pipe_split_from, vlevel, fast_validate);
+ dcn20_calculate_dlg_params(dc, context, pipes, pipe_cnt, vlevel);
+
++ for (i = 0; i < dc->res_pool->pipe_count; i++) {
++ if (!context->res_ctx.pipe_ctx[i].stream)
++ continue;
++ if (context->res_ctx.pipe_ctx[i].stream->adaptive_sync_infopacket.valid)
++ dcn20_adjust_freesync_v_startup(
++ &context->res_ctx.pipe_ctx[i].stream->timing,
++ &context->res_ctx.pipe_ctx[i].pipe_dlg_param.vstartup_start);
++ }
++
+ BW_VAL_TRACE_END_WATERMARKS();
+
+ goto validate_out;
+--
+2.40.1
+
--- /dev/null
+From 75c703a42deab228c90780b5a91c999e82e6d3d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Apr 2023 11:23:50 -0400
+Subject: drm/amd/display: Skip DPP DTO update if root clock is gated
+
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+
+[ Upstream commit 30f90f3c1c2c63c2fa44f61233737d27b72637c2 ]
+
+[Why]
+Hardware implements root clock gating by utilizing the DPP DTO registers
+with a special case of DTO enabled, phase = 0, modulo = 1. This
+conflicts with our policy to always update the DPPDTO for cases where
+it's expected to be disabled.
+
+The pipes unexpectedly enter a higher power state than expected because
+of this programming flow.
+
+[How]
+Guard the upper layers of HWSS against this hardware quirk with
+programming the register with an internal state flag in DCCG.
+
+While technically acting as global state for the DCCG, HWSS shouldn't be
+expected to understand the hardware quirk for having DTO disabled
+causing more power than DTO enabled with this specific setting.
+
+This also prevents sequencing errors from occuring in the future if
+we have to program DPP DTO in multiple locations.
+
+Acked-by: Stylon Wang <stylon.wang@amd.com>
+Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Reviewed-by: Jun Lei <jun.lei@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c | 8 ++++++++
+ drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c | 5 +++++
+ drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h | 1 +
+ 3 files changed, 14 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c
+index 4c2fdfea162f5..65c1d754e2d6b 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c
+@@ -47,6 +47,14 @@ void dccg31_update_dpp_dto(struct dccg *dccg, int dpp_inst, int req_dppclk)
+ {
+ struct dcn_dccg *dccg_dcn = TO_DCN_DCCG(dccg);
+
++ if (dccg->dpp_clock_gated[dpp_inst]) {
++ /*
++ * Do not update the DPPCLK DTO if the clock is stopped.
++ * It is treated the same as if the pipe itself were in PG.
++ */
++ return;
++ }
++
+ if (dccg->ref_dppclk && req_dppclk) {
+ int ref_dppclk = dccg->ref_dppclk;
+ int modulo, phase;
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c
+index de7bfba2c1798..6ba24d5848b20 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c
+@@ -322,6 +322,9 @@ static void dccg314_dpp_root_clock_control(
+ {
+ struct dcn_dccg *dccg_dcn = TO_DCN_DCCG(dccg);
+
++ if (dccg->dpp_clock_gated[dpp_inst] == clock_on)
++ return;
++
+ if (clock_on) {
+ /* turn off the DTO and leave phase/modulo at max */
+ REG_UPDATE(DPPCLK_DTO_CTRL, DPPCLK_DTO_ENABLE[dpp_inst], 0);
+@@ -335,6 +338,8 @@ static void dccg314_dpp_root_clock_control(
+ DPPCLK0_DTO_PHASE, 0,
+ DPPCLK0_DTO_MODULO, 1);
+ }
++
++ dccg->dpp_clock_gated[dpp_inst] = !clock_on;
+ }
+
+ static const struct dccg_funcs dccg314_funcs = {
+diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h b/drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h
+index ad6acd1b34e1d..9651cccb084a3 100644
+--- a/drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h
++++ b/drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h
+@@ -68,6 +68,7 @@ struct dccg {
+ const struct dccg_funcs *funcs;
+ int pipe_dppclk_khz[MAX_PIPES];
+ int ref_dppclk;
++ bool dpp_clock_gated[MAX_PIPES];
+ //int dtbclk_khz[MAX_PIPES];/* TODO needs to be removed */
+ //int audio_dtbclk_khz;/* TODO needs to be removed */
+ //int ref_dtbclk_khz;/* TODO needs to be removed */
+--
+2.40.1
+
--- /dev/null
+From d60be246ebed42933a39a3984519b42eabd54963 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Apr 2022 20:41:10 -0400
+Subject: drm/amd/display: Update DTBCLK for DCN32
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alvin Lee <Alvin.Lee2@amd.com>
+
+[ Upstream commit 128c1ca0303fe764a4cde5f761e72810d9e40b6e ]
+
+[Why&How]
+- Implement interface to program DTBCLK DTO’s
+ according to reference DTBCLK returned by PMFW
+- This is required because DTO programming
+ requires exact DTBCLK reference freq or it could
+ result in underflow
+
+Acked-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Alvin Lee <Alvin.Lee2@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 27 +++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c
+index 8d9444db092ab..eea103908b09f 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c
+@@ -233,6 +233,32 @@ void dcn32_init_clocks(struct clk_mgr *clk_mgr_base)
+ DC_FP_END();
+ }
+
++static void dcn32_update_clocks_update_dtb_dto(struct clk_mgr_internal *clk_mgr,
++ struct dc_state *context,
++ int ref_dtbclk_khz)
++{
++ struct dccg *dccg = clk_mgr->dccg;
++ uint32_t tg_mask = 0;
++ int i;
++
++ for (i = 0; i < clk_mgr->base.ctx->dc->res_pool->pipe_count; i++) {
++ struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[i];
++ struct dtbclk_dto_params dto_params = {0};
++
++ /* use mask to program DTO once per tg */
++ if (pipe_ctx->stream_res.tg &&
++ !(tg_mask & (1 << pipe_ctx->stream_res.tg->inst))) {
++ tg_mask |= (1 << pipe_ctx->stream_res.tg->inst);
++
++ dto_params.otg_inst = pipe_ctx->stream_res.tg->inst;
++ dto_params.ref_dtbclk_khz = ref_dtbclk_khz;
++
++ dccg->funcs->set_dtbclk_dto(clk_mgr->dccg, &dto_params);
++ //dccg->funcs->set_audio_dtbclk_dto(clk_mgr->dccg, &dto_params);
++ }
++ }
++}
++
+ /* Since DPPCLK request to PMFW needs to be exact (due to DPP DTO programming),
+ * update DPPCLK to be the exact frequency that will be set after the DPPCLK
+ * divider is updated. This will prevent rounding issues that could cause DPP
+@@ -570,6 +596,7 @@ static void dcn32_update_clocks(struct clk_mgr *clk_mgr_base,
+ /* DCCG requires KHz precision for DTBCLK */
+ clk_mgr_base->clks.ref_dtbclk_khz =
+ dcn32_smu_set_hard_min_by_freq(clk_mgr, PPCLK_DTBCLK, khz_to_mhz_ceil(new_clocks->ref_dtbclk_khz));
++ dcn32_update_clocks_update_dtb_dto(clk_mgr, context, clk_mgr_base->clks.ref_dtbclk_khz);
+ }
+
+ if (dc->config.forced_clocks == false || (force_reset && safe_to_lower)) {
+--
+2.40.1
+
--- /dev/null
+From 98b901cb31b9fd4c8a2be30781f0e76f6c20386c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 13:21:45 +0800
+Subject: drm/amdgpu: fix calltrace warning in amddrm_buddy_fini
+
+From: Longlong Yao <Longlong.Yao@amd.com>
+
+[ Upstream commit 01382501509871d0799bab6bd412c228486af5bf ]
+
+The following call trace is observed when removing the amdgpu driver, which
+is caused by that BOs allocated for psp are not freed until removing.
+
+[61811.450562] RIP: 0010:amddrm_buddy_fini.cold+0x29/0x47 [amddrm_buddy]
+[61811.450577] Call Trace:
+[61811.450577] <TASK>
+[61811.450579] amdgpu_vram_mgr_fini+0x135/0x1c0 [amdgpu]
+[61811.450728] amdgpu_ttm_fini+0x207/0x290 [amdgpu]
+[61811.450870] amdgpu_bo_fini+0x27/0xa0 [amdgpu]
+[61811.451012] gmc_v9_0_sw_fini+0x4a/0x60 [amdgpu]
+[61811.451166] amdgpu_device_fini_sw+0x117/0x520 [amdgpu]
+[61811.451306] amdgpu_driver_release_kms+0x16/0x30 [amdgpu]
+[61811.451447] devm_drm_dev_init_release+0x4d/0x80 [drm]
+[61811.451466] devm_action_release+0x15/0x20
+[61811.451469] release_nodes+0x40/0xb0
+[61811.451471] devres_release_all+0x9b/0xd0
+[61811.451473] __device_release_driver+0x1bb/0x2a0
+[61811.451476] driver_detach+0xf3/0x140
+[61811.451479] bus_remove_driver+0x6c/0xf0
+[61811.451481] driver_unregister+0x31/0x60
+[61811.451483] pci_unregister_driver+0x40/0x90
+[61811.451486] amdgpu_exit+0x15/0x447 [amdgpu]
+
+For smu v13_0_2, if the GPU supports xgmi, refer to
+
+commit f5c7e7797060 ("drm/amdgpu: Adjust removal control flow for smu v13_0_2"),
+
+it will run gpu recover in AMDGPU_RESET_FOR_DEVICE_REMOVE mode when removing,
+which makes all devices in hive list have hw reset but no resume except the
+basic ip blocks, then other ip blocks will not call .hw_fini according to
+ip_block.status.hw.
+
+Since psp_free_shared_bufs just includes some software operations, so move
+it to psp_sw_fini.
+
+Reviewed-by: Guchun Chen <guchun.chen@amd.com>
+Reviewed-by: Feifei Xu <Feifei.Xu@amd.com>
+Signed-off-by: Longlong Yao <Longlong.Yao@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index db820331f2c61..39e54685653cc 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -520,6 +520,8 @@ static int psp_sw_fini(void *handle)
+ kfree(cmd);
+ cmd = NULL;
+
++ psp_free_shared_bufs(psp);
++
+ if (psp->km_ring.ring_mem)
+ amdgpu_bo_free_kernel(&adev->firmware.rbuf,
+ &psp->km_ring.ring_mem_mc_addr,
+@@ -2657,8 +2659,6 @@ static int psp_hw_fini(void *handle)
+
+ psp_ring_destroy(psp, PSP_RING_TYPE__KM);
+
+- psp_free_shared_bufs(psp);
+-
+ return 0;
+ }
+
+--
+2.40.1
+
--- /dev/null
+From 12080783038f5e24a33070f555f47c65c0df1f17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 20:22:33 +0800
+Subject: drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: hackyzh002 <hackyzh002@gmail.com>
+
+[ Upstream commit 87c2213e85bd81e4a9a4d0880c256568794ae388 ]
+
+The type of size is unsigned int, if size is 0x40000000, there will
+be an integer overflow, size will be zero after size *= sizeof(uint32_t),
+will cause uninitialized memory to be referenced later.
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: hackyzh002 <hackyzh002@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index a989ae72a58a9..feb48bb0b4494 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -189,7 +189,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p,
+ uint64_t *chunk_array_user;
+ uint64_t *chunk_array;
+ uint32_t uf_offset = 0;
+- unsigned int size;
++ size_t size;
+ int ret;
+ int i;
+
+--
+2.40.1
+
--- /dev/null
+From 952761b2211a80407f34c198c8a6bd44c78515b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Apr 2023 14:20:38 +0800
+Subject: drm/amdgpu: fix memory leak in mes self test
+
+From: Jack Xiao <Jack.Xiao@amd.com>
+
+[ Upstream commit 31d7c3a4fc3d312a0646990767647925d5bde540 ]
+
+The fences associated with mes queue have to be freed
+up during amdgpu_ring_fini.
+
+Signed-off-by: Jack Xiao <Jack.Xiao@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
+index 49de3a3eebc78..de04606c2061e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
+@@ -361,6 +361,8 @@ void amdgpu_ring_fini(struct amdgpu_ring *ring)
+ amdgpu_bo_free_kernel(&ring->ring_obj,
+ &ring->gpu_addr,
+ (void **)&ring->ring);
++ } else {
++ kfree(ring->fence_drv.fences);
+ }
+
+ dma_fence_put(ring->vmid_wait);
+--
+2.40.1
+
--- /dev/null
+From c40edde3756deade9ab970be698727d90fd79f27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jun 2023 18:10:47 -0700
+Subject: drm/amdgpu: Fix potential fence use-after-free v2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: shanzhulig <shanzhulig@gmail.com>
+
+[ Upstream commit 2e54154b9f27262efd0cb4f903cc7d5ad1fe9628 ]
+
+fence Decrements the reference count before exiting.
+Avoid Race Vulnerabilities for fence use-after-free.
+
+v2 (chk): actually fix the use after free and not just move it.
+
+Signed-off-by: shanzhulig <shanzhulig@gmail.com>
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index feb48bb0b4494..0c023269aadaa 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -1625,15 +1625,15 @@ static int amdgpu_cs_wait_all_fences(struct amdgpu_device *adev,
+ continue;
+
+ r = dma_fence_wait_timeout(fence, true, timeout);
++ if (r > 0 && fence->error)
++ r = fence->error;
++
+ dma_fence_put(fence);
+ if (r < 0)
+ return r;
+
+ if (r == 0)
+ break;
+-
+- if (fence->error)
+- return fence->error;
+ }
+
+ memset(wait, 0, sizeof(*wait));
+--
+2.40.1
+
--- /dev/null
+From b09cf57499781ce8c1e6970b4e5dea84113d5c07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 May 2023 20:14:15 +0800
+Subject: drm/amdgpu: install stub fence into potential unused fence pointers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lang Yu <Lang.Yu@amd.com>
+
+[ Upstream commit 187916e6ed9d0c3b3abc27429f7a5f8c936bd1f0 ]
+
+When using cpu to update page tables, vm update fences are unused.
+Install stub fence into these fence pointers instead of NULL
+to avoid NULL dereference when calling dma_fence_wait() on them.
+
+Suggested-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Lang Yu <Lang.Yu@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+index 23f52150ebef4..fd029d91a3402 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+@@ -1367,6 +1367,7 @@ struct amdgpu_bo_va *amdgpu_vm_bo_add(struct amdgpu_device *adev,
+ amdgpu_vm_bo_base_init(&bo_va->base, vm, bo);
+
+ bo_va->ref_count = 1;
++ bo_va->last_pt_update = dma_fence_get_stub();
+ INIT_LIST_HEAD(&bo_va->valids);
+ INIT_LIST_HEAD(&bo_va->invalids);
+
+@@ -2088,7 +2089,8 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm)
+ vm->update_funcs = &amdgpu_vm_cpu_funcs;
+ else
+ vm->update_funcs = &amdgpu_vm_sdma_funcs;
+- vm->last_update = NULL;
++
++ vm->last_update = dma_fence_get_stub();
+ vm->last_unlocked = dma_fence_get_stub();
+ vm->last_tlb_flush = dma_fence_get_stub();
+
+@@ -2213,7 +2215,7 @@ int amdgpu_vm_make_compute(struct amdgpu_device *adev, struct amdgpu_vm *vm)
+ goto unreserve_bo;
+
+ dma_fence_put(vm->last_update);
+- vm->last_update = NULL;
++ vm->last_update = dma_fence_get_stub();
+ vm->is_compute_context = true;
+
+ /* Free the shadow bo for compute VM */
+--
+2.40.1
+
--- /dev/null
+From 9cb33a59bca3b55e198ef4caa4de23f30a07ed9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 May 2023 12:01:33 +0800
+Subject: drm/amdgpu: unmap and remove csa_va properly
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lang Yu <Lang.Yu@amd.com>
+
+[ Upstream commit 5daff15cd013422bc6d1efcfe82b586800025384 ]
+
+Root PD BO should be reserved before unmap and remove
+a bo_va from VM otherwise lockdep will complain.
+
+v2: check fpriv->csa_va is not NULL instead of amdgpu_mcbp (christian)
+
+[14616.936827] WARNING: CPU: 6 PID: 1711 at drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c:1762 amdgpu_vm_bo_del+0x399/0x3f0 [amdgpu]
+[14616.937096] Call Trace:
+[14616.937097] <TASK>
+[14616.937102] amdgpu_driver_postclose_kms+0x249/0x2f0 [amdgpu]
+[14616.937187] drm_file_free+0x1d6/0x300 [drm]
+[14616.937207] drm_close_helper.isra.0+0x62/0x70 [drm]
+[14616.937220] drm_release+0x5e/0x100 [drm]
+[14616.937234] __fput+0x9f/0x280
+[14616.937239] ____fput+0xe/0x20
+[14616.937241] task_work_run+0x61/0x90
+[14616.937246] exit_to_user_mode_prepare+0x215/0x220
+[14616.937251] syscall_exit_to_user_mode+0x2a/0x60
+[14616.937254] do_syscall_64+0x48/0x90
+[14616.937257] entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Signed-off-by: Lang Yu <Lang.Yu@amd.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 38 +++++++++++++++++++++++++
+ drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h | 3 ++
+ drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 10 +++----
+ 3 files changed, 46 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
+index c6d4d41c4393e..23d054526e7c7 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
+@@ -106,3 +106,41 @@ int amdgpu_map_static_csa(struct amdgpu_device *adev, struct amdgpu_vm *vm,
+ ttm_eu_backoff_reservation(&ticket, &list);
+ return 0;
+ }
++
++int amdgpu_unmap_static_csa(struct amdgpu_device *adev, struct amdgpu_vm *vm,
++ struct amdgpu_bo *bo, struct amdgpu_bo_va *bo_va,
++ uint64_t csa_addr)
++{
++ struct ww_acquire_ctx ticket;
++ struct list_head list;
++ struct amdgpu_bo_list_entry pd;
++ struct ttm_validate_buffer csa_tv;
++ int r;
++
++ INIT_LIST_HEAD(&list);
++ INIT_LIST_HEAD(&csa_tv.head);
++ csa_tv.bo = &bo->tbo;
++ csa_tv.num_shared = 1;
++
++ list_add(&csa_tv.head, &list);
++ amdgpu_vm_get_pd_bo(vm, &list, &pd);
++
++ r = ttm_eu_reserve_buffers(&ticket, &list, true, NULL);
++ if (r) {
++ DRM_ERROR("failed to reserve CSA,PD BOs: err=%d\n", r);
++ return r;
++ }
++
++ r = amdgpu_vm_bo_unmap(adev, bo_va, csa_addr);
++ if (r) {
++ DRM_ERROR("failed to do bo_unmap on static CSA, err=%d\n", r);
++ ttm_eu_backoff_reservation(&ticket, &list);
++ return r;
++ }
++
++ amdgpu_vm_bo_del(adev, bo_va);
++
++ ttm_eu_backoff_reservation(&ticket, &list);
++
++ return 0;
++}
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h
+index 524b4437a0217..7dfc1f2012ebf 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h
+@@ -34,6 +34,9 @@ int amdgpu_allocate_static_csa(struct amdgpu_device *adev, struct amdgpu_bo **bo
+ int amdgpu_map_static_csa(struct amdgpu_device *adev, struct amdgpu_vm *vm,
+ struct amdgpu_bo *bo, struct amdgpu_bo_va **bo_va,
+ uint64_t csa_addr, uint32_t size);
++int amdgpu_unmap_static_csa(struct amdgpu_device *adev, struct amdgpu_vm *vm,
++ struct amdgpu_bo *bo, struct amdgpu_bo_va *bo_va,
++ uint64_t csa_addr);
+ void amdgpu_free_static_csa(struct amdgpu_bo **bo);
+
+ #endif
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+index 0efb38539d70c..724e80c192973 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -1284,12 +1284,12 @@ void amdgpu_driver_postclose_kms(struct drm_device *dev,
+ if (amdgpu_device_ip_get_ip_block(adev, AMD_IP_BLOCK_TYPE_VCE) != NULL)
+ amdgpu_vce_free_handles(adev, file_priv);
+
+- if (amdgpu_mcbp) {
+- /* TODO: how to handle reserve failure */
+- BUG_ON(amdgpu_bo_reserve(adev->virt.csa_obj, true));
+- amdgpu_vm_bo_del(adev, fpriv->csa_va);
++ if (fpriv->csa_va) {
++ uint64_t csa_addr = amdgpu_csa_vaddr(adev) & AMDGPU_GMC_HOLE_MASK;
++
++ WARN_ON(amdgpu_unmap_static_csa(adev, &fpriv->vm, adev->virt.csa_obj,
++ fpriv->csa_va, csa_addr));
+ fpriv->csa_va = NULL;
+- amdgpu_bo_unreserve(adev->virt.csa_obj);
+ }
+
+ pasid = fpriv->vm.pasid;
+--
+2.40.1
+
--- /dev/null
+From d73d296d920fd936fc9b986b8785ffcc03028385 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 May 2023 09:48:17 +0200
+Subject: drm: rcar-du: remove R-Car H3 ES1.* workarounds
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 2da4b728f994a1f9189a8066b0be90b615768764 ]
+
+R-Car H3 ES1.* was only available to an internal development group and
+needed a lot of quirks and workarounds. These become a maintenance
+burden now, so our development group decided to remove upstream support
+for this SoC and prevent booting it. Public users only have ES2 onwards.
+
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 37 ++------------------
+ drivers/gpu/drm/rcar-du/rcar_du_drv.c | 48 --------------------------
+ drivers/gpu/drm/rcar-du/rcar_du_drv.h | 2 --
+ drivers/gpu/drm/rcar-du/rcar_du_regs.h | 3 +-
+ 4 files changed, 4 insertions(+), 86 deletions(-)
+
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
+index d6d29be6b4f48..7e175dbfd8924 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
+@@ -223,20 +223,6 @@ static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc)
+ * DU channels that have a display PLL can't use the internal
+ * system clock, and have no internal clock divider.
+ */
+-
+- /*
+- * The H3 ES1.x exhibits dot clock duty cycle stability issues.
+- * We can work around them by configuring the DPLL to twice the
+- * desired frequency, coupled with a /2 post-divider. Restrict
+- * the workaround to H3 ES1.x as ES2.0 and all other SoCs have
+- * no post-divider when a display PLL is present (as shown by
+- * the workaround breaking HDMI output on M3-W during testing).
+- */
+- if (rcdu->info->quirks & RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY) {
+- target *= 2;
+- div = 1;
+- }
+-
+ extclk = clk_get_rate(rcrtc->extclock);
+ rcar_du_dpll_divider(rcrtc, &dpll, extclk, target);
+
+@@ -245,30 +231,13 @@ static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc)
+ | DPLLCR_N(dpll.n) | DPLLCR_M(dpll.m)
+ | DPLLCR_STBY;
+
+- if (rcrtc->index == 1) {
++ if (rcrtc->index == 1)
+ dpllcr |= DPLLCR_PLCS1
+ | DPLLCR_INCS_DOTCLKIN1;
+- } else {
+- dpllcr |= DPLLCR_PLCS0_PLL
++ else
++ dpllcr |= DPLLCR_PLCS0
+ | DPLLCR_INCS_DOTCLKIN0;
+
+- /*
+- * On ES2.x we have a single mux controlled via bit 21,
+- * which selects between DCLKIN source (bit 21 = 0) and
+- * a PLL source (bit 21 = 1), where the PLL is always
+- * PLL1.
+- *
+- * On ES1.x we have an additional mux, controlled
+- * via bit 20, for choosing between PLL0 (bit 20 = 0)
+- * and PLL1 (bit 20 = 1). We always want to use PLL1,
+- * so on ES1.x, in addition to setting bit 21, we need
+- * to set the bit 20.
+- */
+-
+- if (rcdu->info->quirks & RCAR_DU_QUIRK_H3_ES1_PLL)
+- dpllcr |= DPLLCR_PLCS0_H3ES1X_PLL1;
+- }
+-
+ rcar_du_group_write(rcrtc->group, DPLLCR, dpllcr);
+
+ escr = ESCR_DCLKSEL_DCLKIN | div;
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.c b/drivers/gpu/drm/rcar-du/rcar_du_drv.c
+index b9a94c5260e9d..1ffde19cb87fe 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_drv.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.c
+@@ -16,7 +16,6 @@
+ #include <linux/platform_device.h>
+ #include <linux/pm.h>
+ #include <linux/slab.h>
+-#include <linux/sys_soc.h>
+ #include <linux/wait.h>
+
+ #include <drm/drm_atomic_helper.h>
+@@ -387,43 +386,6 @@ static const struct rcar_du_device_info rcar_du_r8a7795_info = {
+ .dpll_mask = BIT(2) | BIT(1),
+ };
+
+-static const struct rcar_du_device_info rcar_du_r8a7795_es1_info = {
+- .gen = 3,
+- .features = RCAR_DU_FEATURE_CRTC_IRQ
+- | RCAR_DU_FEATURE_CRTC_CLOCK
+- | RCAR_DU_FEATURE_VSP1_SOURCE
+- | RCAR_DU_FEATURE_INTERLACED
+- | RCAR_DU_FEATURE_TVM_SYNC,
+- .quirks = RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY
+- | RCAR_DU_QUIRK_H3_ES1_PLL,
+- .channels_mask = BIT(3) | BIT(2) | BIT(1) | BIT(0),
+- .routes = {
+- /*
+- * R8A7795 has one RGB output, two HDMI outputs and one
+- * LVDS output.
+- */
+- [RCAR_DU_OUTPUT_DPAD0] = {
+- .possible_crtcs = BIT(3),
+- .port = 0,
+- },
+- [RCAR_DU_OUTPUT_HDMI0] = {
+- .possible_crtcs = BIT(1),
+- .port = 1,
+- },
+- [RCAR_DU_OUTPUT_HDMI1] = {
+- .possible_crtcs = BIT(2),
+- .port = 2,
+- },
+- [RCAR_DU_OUTPUT_LVDS0] = {
+- .possible_crtcs = BIT(0),
+- .port = 3,
+- },
+- },
+- .num_lvds = 1,
+- .num_rpf = 5,
+- .dpll_mask = BIT(2) | BIT(1),
+-};
+-
+ static const struct rcar_du_device_info rcar_du_r8a7796_info = {
+ .gen = 3,
+ .features = RCAR_DU_FEATURE_CRTC_IRQ
+@@ -614,11 +576,6 @@ static const struct of_device_id rcar_du_of_table[] = {
+
+ MODULE_DEVICE_TABLE(of, rcar_du_of_table);
+
+-static const struct soc_device_attribute rcar_du_soc_table[] = {
+- { .soc_id = "r8a7795", .revision = "ES1.*", .data = &rcar_du_r8a7795_es1_info },
+- { /* sentinel */ }
+-};
+-
+ const char *rcar_du_output_name(enum rcar_du_output output)
+ {
+ static const char * const names[] = {
+@@ -707,7 +664,6 @@ static void rcar_du_shutdown(struct platform_device *pdev)
+
+ static int rcar_du_probe(struct platform_device *pdev)
+ {
+- const struct soc_device_attribute *soc_attr;
+ struct rcar_du_device *rcdu;
+ unsigned int mask;
+ int ret;
+@@ -725,10 +681,6 @@ static int rcar_du_probe(struct platform_device *pdev)
+
+ rcdu->info = of_device_get_match_data(rcdu->dev);
+
+- soc_attr = soc_device_match(rcar_du_soc_table);
+- if (soc_attr)
+- rcdu->info = soc_attr->data;
+-
+ platform_set_drvdata(pdev, rcdu);
+
+ /* I/O resources */
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.h b/drivers/gpu/drm/rcar-du/rcar_du_drv.h
+index acc3673fefe18..5cfa2bb7ad93d 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_drv.h
++++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.h
+@@ -34,8 +34,6 @@ struct rcar_du_device;
+ #define RCAR_DU_FEATURE_NO_BLENDING BIT(5) /* PnMR.SPIM does not have ALP nor EOR bits */
+
+ #define RCAR_DU_QUIRK_ALIGN_128B BIT(0) /* Align pitches to 128 bytes */
+-#define RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY BIT(1) /* H3 ES1 has pclk stability issue */
+-#define RCAR_DU_QUIRK_H3_ES1_PLL BIT(2) /* H3 ES1 PLL setup differs from non-ES1 */
+
+ enum rcar_du_output {
+ RCAR_DU_OUTPUT_DPAD0,
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_regs.h b/drivers/gpu/drm/rcar-du/rcar_du_regs.h
+index 6c750fab6ebb7..391de6661d8bc 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_regs.h
++++ b/drivers/gpu/drm/rcar-du/rcar_du_regs.h
+@@ -283,8 +283,7 @@
+ #define DPLLCR 0x20044
+ #define DPLLCR_CODE (0x95 << 24)
+ #define DPLLCR_PLCS1 (1 << 23)
+-#define DPLLCR_PLCS0_PLL (1 << 21)
+-#define DPLLCR_PLCS0_H3ES1X_PLL1 (1 << 20)
++#define DPLLCR_PLCS0 (1 << 21)
+ #define DPLLCR_CLKE (1 << 18)
+ #define DPLLCR_FDPLL(n) ((n) << 12)
+ #define DPLLCR_N(n) ((n) << 5)
+--
+2.40.1
+
--- /dev/null
+From 6bd22f112f8bf0974ff616f6f14c13179d9117d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 12:04:53 +0200
+Subject: drm/scheduler: set entity to NULL in drm_sched_entity_pop_job()
+
+From: Danilo Krummrich <dakr@redhat.com>
+
+[ Upstream commit 96c7c2f4d5bd94b15fe63448c087f01607b56f4a ]
+
+It already happend a few times that patches slipped through which
+implemented access to an entity through a job that was already removed
+from the entities queue. Since jobs and entities might have different
+lifecycles, this can potentially cause UAF bugs.
+
+In order to make it obvious that a jobs entity pointer shouldn't be
+accessed after drm_sched_entity_pop_job() was called successfully, set
+the jobs entity pointer to NULL once the job is removed from the entity
+queue.
+
+Moreover, debugging a potential NULL pointer dereference is way easier
+than potentially corrupted memory through a UAF.
+
+Signed-off-by: Danilo Krummrich <dakr@redhat.com>
+Link: https://lore.kernel.org/r/20230418100453.4433-1-dakr@redhat.com
+Reviewed-by: Luben Tuikov <luben.tuikov@amd.com>
+Signed-off-by: Luben Tuikov <luben.tuikov@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/scheduler/sched_entity.c | 6 ++++++
+ drivers/gpu/drm/scheduler/sched_main.c | 4 ++++
+ 2 files changed, 10 insertions(+)
+
+diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c
+index e0a8890a62e23..3e2a31d8190eb 100644
+--- a/drivers/gpu/drm/scheduler/sched_entity.c
++++ b/drivers/gpu/drm/scheduler/sched_entity.c
+@@ -448,6 +448,12 @@ struct drm_sched_job *drm_sched_entity_pop_job(struct drm_sched_entity *entity)
+ drm_sched_rq_update_fifo(entity, next->submit_ts);
+ }
+
++ /* Jobs and entities might have different lifecycles. Since we're
++ * removing the job from the entities queue, set the jobs entity pointer
++ * to NULL to prevent any future access of the entity through this job.
++ */
++ sched_job->entity = NULL;
++
+ return sched_job;
+ }
+
+diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
+index aea5a90ff98b9..cdd67676c3d1b 100644
+--- a/drivers/gpu/drm/scheduler/sched_main.c
++++ b/drivers/gpu/drm/scheduler/sched_main.c
+@@ -42,6 +42,10 @@
+ * the hardware.
+ *
+ * The jobs in a entity are always scheduled in the order that they were pushed.
++ *
++ * Note that once a job was taken from the entities queue and pushed to the
++ * hardware, i.e. the pending queue, the entity must not be referenced anymore
++ * through the jobs entity pointer.
+ */
+
+ #include <linux/kthread.h>
+--
+2.40.1
+
--- /dev/null
+From 54a4bda96e94823c86ff9366a41aceb1a2ed9f40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 May 2023 14:38:18 +0200
+Subject: drm/stm: ltdc: fix late dereference check
+
+From: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com>
+
+[ Upstream commit 898a9e3f56db9860ab091d4bf41b6caa99aafc3d ]
+
+In ltdc_crtc_set_crc_source(), struct drm_crtc was dereferenced in a
+container_of() before the pointer check. This could cause a kernel panic.
+
+Fix this smatch warning:
+drivers/gpu/drm/stm/ltdc.c:1124 ltdc_crtc_set_crc_source() warn: variable dereferenced before check 'crtc' (see line 1119)
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/lkml/202212241802.zeLFZCXB-lkp@intel.com/
+Reported-by: Dan Carpenter <error27@gmail.com>
+Closes: https://lore.kernel.org/lkml/202212241802.zeLFZCXB-lkp@intel.com/
+Signed-off-by: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com>
+Acked-by: Philippe Cornu <philippe.cornu@foss.st.com>
+Signed-off-by: Philippe Cornu <philippe.cornu@foss.st.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230515123818.93971-1-raphael.gallais-pou@foss.st.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/stm/ltdc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/stm/ltdc.c b/drivers/gpu/drm/stm/ltdc.c
+index 03c6becda795c..b8be4c1db4235 100644
+--- a/drivers/gpu/drm/stm/ltdc.c
++++ b/drivers/gpu/drm/stm/ltdc.c
+@@ -1145,7 +1145,7 @@ static void ltdc_crtc_disable_vblank(struct drm_crtc *crtc)
+
+ static int ltdc_crtc_set_crc_source(struct drm_crtc *crtc, const char *source)
+ {
+- struct ltdc_device *ldev = crtc_to_ltdc(crtc);
++ struct ltdc_device *ldev;
+ int ret;
+
+ DRM_DEBUG_DRIVER("\n");
+@@ -1153,6 +1153,8 @@ static int ltdc_crtc_set_crc_source(struct drm_crtc *crtc, const char *source)
+ if (!crtc)
+ return -ENODEV;
+
++ ldev = crtc_to_ltdc(crtc);
++
+ if (source && strcmp(source, "auto") == 0) {
+ ldev->crc_active = true;
+ ret = regmap_set_bits(ldev->regmap, LTDC_GCR, GCR_CRCEN);
+--
+2.40.1
+
--- /dev/null
+From 5c8403d27896c1124612b4db8fd0438771d5b6c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 14:08:47 +0100
+Subject: Drop the netfs_ prefix from netfs_extract_iter_to_sg()
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 0d7aeb68700ff87b4d2acafb789408a065225e1e ]
+
+Rename netfs_extract_iter_to_sg() and its auxiliary functions to drop the
+netfs_ prefix.
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Jeff Layton <jlayton@kernel.org>
+cc: Steve French <sfrench@samba.org>
+cc: Shyam Prasad N <nspmangalore@gmail.com>
+cc: Rohith Surabattula <rohiths.msft@gmail.com>
+cc: Jens Axboe <axboe@kernel.dk>
+cc: Herbert Xu <herbert@gondor.apana.org.au>
+cc: "Matthew Wilcox (Oracle)" <willy@infradead.org>
+cc: "David S. Miller" <davem@davemloft.net>
+cc: Eric Dumazet <edumazet@google.com>
+cc: Jakub Kicinski <kuba@kernel.org>
+cc: Paolo Abeni <pabeni@redhat.com>
+cc: linux-crypto@vger.kernel.org
+cc: linux-cachefs@redhat.com
+cc: linux-cifs@vger.kernel.org
+cc: linux-fsdevel@vger.kernel.org
+cc: netdev@vger.kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Stable-dep-of: f443fd5af5db ("crypto, cifs: fix error handling in extract_iter_to_sg()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/netfs/iterator.c | 66 +++++++++++++++++++--------------------
+ fs/smb/client/smb2ops.c | 4 +--
+ fs/smb/client/smbdirect.c | 2 +-
+ include/linux/netfs.h | 6 ++--
+ 4 files changed, 39 insertions(+), 39 deletions(-)
+
+diff --git a/fs/netfs/iterator.c b/fs/netfs/iterator.c
+index 8a4c866874297..f8eba3de1a975 100644
+--- a/fs/netfs/iterator.c
++++ b/fs/netfs/iterator.c
+@@ -106,11 +106,11 @@ EXPORT_SYMBOL_GPL(netfs_extract_user_iter);
+ * Extract and pin a list of up to sg_max pages from UBUF- or IOVEC-class
+ * iterators, and add them to the scatterlist.
+ */
+-static ssize_t netfs_extract_user_to_sg(struct iov_iter *iter,
+- ssize_t maxsize,
+- struct sg_table *sgtable,
+- unsigned int sg_max,
+- iov_iter_extraction_t extraction_flags)
++static ssize_t extract_user_to_sg(struct iov_iter *iter,
++ ssize_t maxsize,
++ struct sg_table *sgtable,
++ unsigned int sg_max,
++ iov_iter_extraction_t extraction_flags)
+ {
+ struct scatterlist *sg = sgtable->sgl + sgtable->nents;
+ struct page **pages;
+@@ -159,11 +159,11 @@ static ssize_t netfs_extract_user_to_sg(struct iov_iter *iter,
+ * Extract up to sg_max pages from a BVEC-type iterator and add them to the
+ * scatterlist. The pages are not pinned.
+ */
+-static ssize_t netfs_extract_bvec_to_sg(struct iov_iter *iter,
+- ssize_t maxsize,
+- struct sg_table *sgtable,
+- unsigned int sg_max,
+- iov_iter_extraction_t extraction_flags)
++static ssize_t extract_bvec_to_sg(struct iov_iter *iter,
++ ssize_t maxsize,
++ struct sg_table *sgtable,
++ unsigned int sg_max,
++ iov_iter_extraction_t extraction_flags)
+ {
+ const struct bio_vec *bv = iter->bvec;
+ struct scatterlist *sg = sgtable->sgl + sgtable->nents;
+@@ -205,11 +205,11 @@ static ssize_t netfs_extract_bvec_to_sg(struct iov_iter *iter,
+ * scatterlist. This can deal with vmalloc'd buffers as well as kmalloc'd or
+ * static buffers. The pages are not pinned.
+ */
+-static ssize_t netfs_extract_kvec_to_sg(struct iov_iter *iter,
+- ssize_t maxsize,
+- struct sg_table *sgtable,
+- unsigned int sg_max,
+- iov_iter_extraction_t extraction_flags)
++static ssize_t extract_kvec_to_sg(struct iov_iter *iter,
++ ssize_t maxsize,
++ struct sg_table *sgtable,
++ unsigned int sg_max,
++ iov_iter_extraction_t extraction_flags)
+ {
+ const struct kvec *kv = iter->kvec;
+ struct scatterlist *sg = sgtable->sgl + sgtable->nents;
+@@ -266,11 +266,11 @@ static ssize_t netfs_extract_kvec_to_sg(struct iov_iter *iter,
+ * Extract up to sg_max folios from an XARRAY-type iterator and add them to
+ * the scatterlist. The pages are not pinned.
+ */
+-static ssize_t netfs_extract_xarray_to_sg(struct iov_iter *iter,
+- ssize_t maxsize,
+- struct sg_table *sgtable,
+- unsigned int sg_max,
+- iov_iter_extraction_t extraction_flags)
++static ssize_t extract_xarray_to_sg(struct iov_iter *iter,
++ ssize_t maxsize,
++ struct sg_table *sgtable,
++ unsigned int sg_max,
++ iov_iter_extraction_t extraction_flags)
+ {
+ struct scatterlist *sg = sgtable->sgl + sgtable->nents;
+ struct xarray *xa = iter->xarray;
+@@ -312,7 +312,7 @@ static ssize_t netfs_extract_xarray_to_sg(struct iov_iter *iter,
+ }
+
+ /**
+- * netfs_extract_iter_to_sg - Extract pages from an iterator and add ot an sglist
++ * extract_iter_to_sg - Extract pages from an iterator and add ot an sglist
+ * @iter: The iterator to extract from
+ * @maxsize: The amount of iterator to copy
+ * @sgtable: The scatterlist table to fill in
+@@ -339,9 +339,9 @@ static ssize_t netfs_extract_xarray_to_sg(struct iov_iter *iter,
+ * The iov_iter_extract_mode() function should be used to query how cleanup
+ * should be performed.
+ */
+-ssize_t netfs_extract_iter_to_sg(struct iov_iter *iter, size_t maxsize,
+- struct sg_table *sgtable, unsigned int sg_max,
+- iov_iter_extraction_t extraction_flags)
++ssize_t extract_iter_to_sg(struct iov_iter *iter, size_t maxsize,
++ struct sg_table *sgtable, unsigned int sg_max,
++ iov_iter_extraction_t extraction_flags)
+ {
+ if (maxsize == 0)
+ return 0;
+@@ -349,21 +349,21 @@ ssize_t netfs_extract_iter_to_sg(struct iov_iter *iter, size_t maxsize,
+ switch (iov_iter_type(iter)) {
+ case ITER_UBUF:
+ case ITER_IOVEC:
+- return netfs_extract_user_to_sg(iter, maxsize, sgtable, sg_max,
+- extraction_flags);
++ return extract_user_to_sg(iter, maxsize, sgtable, sg_max,
++ extraction_flags);
+ case ITER_BVEC:
+- return netfs_extract_bvec_to_sg(iter, maxsize, sgtable, sg_max,
+- extraction_flags);
++ return extract_bvec_to_sg(iter, maxsize, sgtable, sg_max,
++ extraction_flags);
+ case ITER_KVEC:
+- return netfs_extract_kvec_to_sg(iter, maxsize, sgtable, sg_max,
+- extraction_flags);
++ return extract_kvec_to_sg(iter, maxsize, sgtable, sg_max,
++ extraction_flags);
+ case ITER_XARRAY:
+- return netfs_extract_xarray_to_sg(iter, maxsize, sgtable, sg_max,
+- extraction_flags);
++ return extract_xarray_to_sg(iter, maxsize, sgtable, sg_max,
++ extraction_flags);
+ default:
+ pr_err("%s(%u) unsupported\n", __func__, iov_iter_type(iter));
+ WARN_ON_ONCE(1);
+ return -EIO;
+ }
+ }
+-EXPORT_SYMBOL_GPL(netfs_extract_iter_to_sg);
++EXPORT_SYMBOL_GPL(extract_iter_to_sg);
+diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
+index 3bac586e8a8eb..5dec02361b69d 100644
+--- a/fs/smb/client/smb2ops.c
++++ b/fs/smb/client/smb2ops.c
+@@ -4374,8 +4374,8 @@ static void *smb2_get_aead_req(struct crypto_aead *tfm, struct smb_rqst *rqst,
+ }
+ sgtable.orig_nents = sgtable.nents;
+
+- rc = netfs_extract_iter_to_sg(iter, count, &sgtable,
+- num_sgs - sgtable.nents, 0);
++ rc = extract_iter_to_sg(iter, count, &sgtable,
++ num_sgs - sgtable.nents, 0);
+ iov_iter_revert(iter, rc);
+ sgtable.orig_nents = sgtable.nents;
+ }
+diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c
+index 0362ebd4fa0fc..223e17c16b602 100644
+--- a/fs/smb/client/smbdirect.c
++++ b/fs/smb/client/smbdirect.c
+@@ -2227,7 +2227,7 @@ static int smbd_iter_to_mr(struct smbd_connection *info,
+
+ memset(sgt->sgl, 0, max_sg * sizeof(struct scatterlist));
+
+- ret = netfs_extract_iter_to_sg(iter, iov_iter_count(iter), sgt, max_sg, 0);
++ ret = extract_iter_to_sg(iter, iov_iter_count(iter), sgt, max_sg, 0);
+ WARN_ON(ret < 0);
+ if (sgt->nents > 0)
+ sg_mark_end(&sgt->sgl[sgt->nents - 1]);
+diff --git a/include/linux/netfs.h b/include/linux/netfs.h
+index a1f3522daa698..55e201c3a8416 100644
+--- a/include/linux/netfs.h
++++ b/include/linux/netfs.h
+@@ -301,9 +301,9 @@ ssize_t netfs_extract_user_iter(struct iov_iter *orig, size_t orig_len,
+ struct iov_iter *new,
+ iov_iter_extraction_t extraction_flags);
+ struct sg_table;
+-ssize_t netfs_extract_iter_to_sg(struct iov_iter *iter, size_t len,
+- struct sg_table *sgtable, unsigned int sg_max,
+- iov_iter_extraction_t extraction_flags);
++ssize_t extract_iter_to_sg(struct iov_iter *iter, size_t len,
++ struct sg_table *sgtable, unsigned int sg_max,
++ iov_iter_extraction_t extraction_flags);
+
+ /**
+ * netfs_inode - Get the netfs inode context from the inode
+--
+2.40.1
+
--- /dev/null
+From 41f5760d0ecf573670ba0bbef8d2183835f767d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 May 2023 11:42:36 +0800
+Subject: dt-bindings: input: goodix: Add "goodix,no-reset-during-suspend"
+ property
+
+From: Fei Shao <fshao@chromium.org>
+
+[ Upstream commit 359ed24a0dd3802e703ec8071dc3b6ed446de5f0 ]
+
+We observed that on Chromebook device Steelix, if Goodix GT7375P
+touchscreen is powered in suspend (because, for example, it connects to
+an always-on regulator) and with the reset GPIO asserted, it will
+introduce about 14mW power leakage.
+
+To address that, we add this property to skip reset during suspend.
+If it's set, the driver will stop asserting the reset GPIO during
+power-down. Refer to the comments in the driver for details.
+
+Signed-off-by: Fei Shao <fshao@chromium.org>
+Suggested-by: Jeff LaBundy <jeff@labundy.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Reviewed-by: Jeff LaBundy <jeff@labundy.com>
+Acked-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/input/goodix,gt7375p.yaml | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/Documentation/devicetree/bindings/input/goodix,gt7375p.yaml b/Documentation/devicetree/bindings/input/goodix,gt7375p.yaml
+index ce18d7dadae23..1edad1da1196d 100644
+--- a/Documentation/devicetree/bindings/input/goodix,gt7375p.yaml
++++ b/Documentation/devicetree/bindings/input/goodix,gt7375p.yaml
+@@ -43,6 +43,15 @@ properties:
+ itself as long as it allows the main board to make signals compatible
+ with what the touchscreen is expecting for its IO rails.
+
++ goodix,no-reset-during-suspend:
++ description:
++ Set this to true to enforce the driver to not assert the reset GPIO
++ during suspend.
++ Due to potential touchscreen hardware flaw, back-powering could happen in
++ suspend if the power supply is on and with active-low reset GPIO asserted.
++ This property is used to avoid the back-powering issue.
++ type: boolean
++
+ required:
+ - compatible
+ - reg
+--
+2.40.1
+
--- /dev/null
+From ed566c2be37495268f13acf2e1d1f8e33564fdde Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jun 2023 13:39:35 +0800
+Subject: firewire: net: fix use after free in fwnet_finish_incoming_packet()
+
+From: Zhang Shurong <zhang_shurong@foxmail.com>
+
+[ Upstream commit 3ff256751a2853e1ffaa36958ff933ccc98c6cb5 ]
+
+The netif_rx() function frees the skb so we can't dereference it to
+save the skb->len.
+
+Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
+Link: https://lore.kernel.org/r/tencent_3B3D24B66ED66A6BB73CC0E63C6A14E45109@qq.com
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firewire/net.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
+index 538bd677c254a..7a4d1a478e33e 100644
+--- a/drivers/firewire/net.c
++++ b/drivers/firewire/net.c
+@@ -479,7 +479,7 @@ static int fwnet_finish_incoming_packet(struct net_device *net,
+ struct sk_buff *skb, u16 source_node_id,
+ bool is_broadcast, u16 ether_type)
+ {
+- int status;
++ int status, len;
+
+ switch (ether_type) {
+ case ETH_P_ARP:
+@@ -533,13 +533,15 @@ static int fwnet_finish_incoming_packet(struct net_device *net,
+ }
+ skb->protocol = protocol;
+ }
++
++ len = skb->len;
+ status = netif_rx(skb);
+ if (status == NET_RX_DROP) {
+ net->stats.rx_errors++;
+ net->stats.rx_dropped++;
+ } else {
+ net->stats.rx_packets++;
+- net->stats.rx_bytes += skb->len;
++ net->stats.rx_bytes += len;
+ }
+
+ return 0;
+--
+2.40.1
+
--- /dev/null
+From 36848ca44a59cd8fb1deb8201e01dd7bda4940dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 14:08:48 +0100
+Subject: Fix a couple of spelling mistakes
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 3b9e9f72badfbb03415459126498d524bcb25225 ]
+
+Fix a couple of spelling mistakes in a comment.
+
+Suggested-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/r/ZHH2mSRqeL4Gs1ft@corigine.com/
+Link: https://lore.kernel.org/r/ZHH1nqZWOGzxlidT@corigine.com/
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+cc: Jeff Layton <jlayton@kernel.org>
+cc: Steve French <sfrench@samba.org>
+cc: Shyam Prasad N <nspmangalore@gmail.com>
+cc: Rohith Surabattula <rohiths.msft@gmail.com>
+cc: Jens Axboe <axboe@kernel.dk>
+cc: Herbert Xu <herbert@gondor.apana.org.au>
+cc: "David S. Miller" <davem@davemloft.net>
+cc: Eric Dumazet <edumazet@google.com>
+cc: Jakub Kicinski <kuba@kernel.org>
+cc: Paolo Abeni <pabeni@redhat.com>
+cc: Matthew Wilcox <willy@infradead.org>
+cc: linux-crypto@vger.kernel.org
+cc: linux-cachefs@redhat.com
+cc: linux-cifs@vger.kernel.org
+cc: linux-fsdevel@vger.kernel.org
+cc: netdev@vger.kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Stable-dep-of: f443fd5af5db ("crypto, cifs: fix error handling in extract_iter_to_sg()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/netfs/iterator.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/netfs/iterator.c b/fs/netfs/iterator.c
+index f8eba3de1a975..f41a37bca1e8b 100644
+--- a/fs/netfs/iterator.c
++++ b/fs/netfs/iterator.c
+@@ -312,7 +312,7 @@ static ssize_t extract_xarray_to_sg(struct iov_iter *iter,
+ }
+
+ /**
+- * extract_iter_to_sg - Extract pages from an iterator and add ot an sglist
++ * extract_iter_to_sg - Extract pages from an iterator and add to an sglist
+ * @iter: The iterator to extract from
+ * @maxsize: The amount of iterator to copy
+ * @sgtable: The scatterlist table to fill in
+@@ -332,7 +332,7 @@ static ssize_t extract_xarray_to_sg(struct iov_iter *iter,
+ * @extraction_flags can have ITER_ALLOW_P2PDMA set to request peer-to-peer DMA
+ * be allowed on the pages extracted.
+ *
+- * If successul, @sgtable->nents is updated to include the number of elements
++ * If successful, @sgtable->nents is updated to include the number of elements
+ * added and the number of bytes added is returned. @sgtable->orig_nents is
+ * left unaltered.
+ *
+--
+2.40.1
+
--- /dev/null
+From b8b1660dbdd430c2c614fa548491003193a5bb67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 May 2023 11:56:13 +0400
+Subject: fs/ntfs3: Alternative boot if primary boot is corrupted
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit 6a4cd3ea7d771be17177d95ff67d22cfa2a38b50 ]
+
+Some code refactoring added also.
+
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/super.c | 98 +++++++++++++++++++++++++++++++++++-------------
+ 1 file changed, 71 insertions(+), 27 deletions(-)
+
+diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c
+index 5158dd31fd97f..ecf899d571d83 100644
+--- a/fs/ntfs3/super.c
++++ b/fs/ntfs3/super.c
+@@ -724,6 +724,8 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
+ struct MFT_REC *rec;
+ u16 fn, ao;
+ u8 cluster_bits;
++ u32 boot_off = 0;
++ const char *hint = "Primary boot";
+
+ sbi->volume.blocks = dev_size >> PAGE_SHIFT;
+
+@@ -731,11 +733,12 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
+ if (!bh)
+ return -EIO;
+
++check_boot:
+ err = -EINVAL;
+- boot = (struct NTFS_BOOT *)bh->b_data;
++ boot = (struct NTFS_BOOT *)Add2Ptr(bh->b_data, boot_off);
+
+ if (memcmp(boot->system_id, "NTFS ", sizeof("NTFS ") - 1)) {
+- ntfs_err(sb, "Boot's signature is not NTFS.");
++ ntfs_err(sb, "%s signature is not NTFS.", hint);
+ goto out;
+ }
+
+@@ -748,14 +751,16 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
+ boot->bytes_per_sector[0];
+ if (boot_sector_size < SECTOR_SIZE ||
+ !is_power_of_2(boot_sector_size)) {
+- ntfs_err(sb, "Invalid bytes per sector %u.", boot_sector_size);
++ ntfs_err(sb, "%s: invalid bytes per sector %u.", hint,
++ boot_sector_size);
+ goto out;
+ }
+
+ /* cluster size: 512, 1K, 2K, 4K, ... 2M */
+ sct_per_clst = true_sectors_per_clst(boot);
+ if ((int)sct_per_clst < 0 || !is_power_of_2(sct_per_clst)) {
+- ntfs_err(sb, "Invalid sectors per cluster %u.", sct_per_clst);
++ ntfs_err(sb, "%s: invalid sectors per cluster %u.", hint,
++ sct_per_clst);
+ goto out;
+ }
+
+@@ -771,8 +776,8 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
+ if (mlcn * sct_per_clst >= sectors || mlcn2 * sct_per_clst >= sectors) {
+ ntfs_err(
+ sb,
+- "Start of MFT 0x%llx (0x%llx) is out of volume 0x%llx.",
+- mlcn, mlcn2, sectors);
++ "%s: start of MFT 0x%llx (0x%llx) is out of volume 0x%llx.",
++ hint, mlcn, mlcn2, sectors);
+ goto out;
+ }
+
+@@ -784,7 +789,7 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
+
+ /* Check MFT record size. */
+ if (record_size < SECTOR_SIZE || !is_power_of_2(record_size)) {
+- ntfs_err(sb, "Invalid bytes per MFT record %u (%d).",
++ ntfs_err(sb, "%s: invalid bytes per MFT record %u (%d).", hint,
+ record_size, boot->record_size);
+ goto out;
+ }
+@@ -801,13 +806,13 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
+
+ /* Check index record size. */
+ if (sbi->index_size < SECTOR_SIZE || !is_power_of_2(sbi->index_size)) {
+- ntfs_err(sb, "Invalid bytes per index %u(%d).", sbi->index_size,
+- boot->index_size);
++ ntfs_err(sb, "%s: invalid bytes per index %u(%d).", hint,
++ sbi->index_size, boot->index_size);
+ goto out;
+ }
+
+ if (sbi->index_size > MAXIMUM_BYTES_PER_INDEX) {
+- ntfs_err(sb, "Unsupported bytes per index %u.",
++ ntfs_err(sb, "%s: unsupported bytes per index %u.", hint,
+ sbi->index_size);
+ goto out;
+ }
+@@ -834,7 +839,7 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
+
+ /* Compare boot's cluster and sector. */
+ if (sbi->cluster_size < boot_sector_size) {
+- ntfs_err(sb, "Invalid bytes per cluster (%u).",
++ ntfs_err(sb, "%s: invalid bytes per cluster (%u).", hint,
+ sbi->cluster_size);
+ goto out;
+ }
+@@ -930,7 +935,46 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
+
+ err = 0;
+
++ if (bh->b_blocknr && !sb_rdonly(sb)) {
++ /*
++ * Alternative boot is ok but primary is not ok.
++ * Update primary boot.
++ */
++ struct buffer_head *bh0 = sb_getblk(sb, 0);
++ if (bh0) {
++ if (buffer_locked(bh0))
++ __wait_on_buffer(bh0);
++
++ lock_buffer(bh0);
++ memcpy(bh0->b_data, boot, sizeof(*boot));
++ set_buffer_uptodate(bh0);
++ mark_buffer_dirty(bh0);
++ unlock_buffer(bh0);
++ if (!sync_dirty_buffer(bh0))
++ ntfs_warn(sb, "primary boot is updated");
++ put_bh(bh0);
++ }
++ }
++
+ out:
++ if (err == -EINVAL && !bh->b_blocknr && dev_size > PAGE_SHIFT) {
++ u32 block_size = min_t(u32, sector_size, PAGE_SIZE);
++ u64 lbo = dev_size - sizeof(*boot);
++
++ /*
++ * Try alternative boot (last sector)
++ */
++ brelse(bh);
++
++ sb_set_blocksize(sb, block_size);
++ bh = ntfs_bread(sb, lbo >> blksize_bits(block_size));
++ if (!bh)
++ return -EINVAL;
++
++ boot_off = lbo & (block_size - 1);
++ hint = "Alternative boot";
++ goto check_boot;
++ }
+ brelse(bh);
+
+ return err;
+@@ -955,6 +999,7 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)
+ struct ATTR_DEF_ENTRY *t;
+ u16 *shared;
+ struct MFT_REF ref;
++ bool ro = sb_rdonly(sb);
+
+ ref.high = 0;
+
+@@ -1035,6 +1080,10 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)
+ sbi->volume.minor_ver = info->minor_ver;
+ sbi->volume.flags = info->flags;
+ sbi->volume.ni = ni;
++ if (info->flags & VOLUME_FLAG_DIRTY) {
++ sbi->volume.real_dirty = true;
++ ntfs_info(sb, "It is recommened to use chkdsk.");
++ }
+
+ /* Load $MFTMirr to estimate recs_mirr. */
+ ref.low = cpu_to_le32(MFT_REC_MIRR);
+@@ -1069,21 +1118,16 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)
+
+ iput(inode);
+
+- if (sbi->flags & NTFS_FLAGS_NEED_REPLAY) {
+- if (!sb_rdonly(sb)) {
+- ntfs_warn(sb,
+- "failed to replay log file. Can't mount rw!");
+- err = -EINVAL;
+- goto out;
+- }
+- } else if (sbi->volume.flags & VOLUME_FLAG_DIRTY) {
+- if (!sb_rdonly(sb) && !options->force) {
+- ntfs_warn(
+- sb,
+- "volume is dirty and \"force\" flag is not set!");
+- err = -EINVAL;
+- goto out;
+- }
++ if ((sbi->flags & NTFS_FLAGS_NEED_REPLAY) && !ro) {
++ ntfs_warn(sb, "failed to replay log file. Can't mount rw!");
++ err = -EINVAL;
++ goto out;
++ }
++
++ if ((sbi->volume.flags & VOLUME_FLAG_DIRTY) && !ro && !options->force) {
++ ntfs_warn(sb, "volume is dirty and \"force\" flag is not set!");
++ err = -EINVAL;
++ goto out;
+ }
+
+ /* Load $MFT. */
+@@ -1173,7 +1217,7 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)
+
+ bad_len += len;
+ bad_frags += 1;
+- if (sb_rdonly(sb))
++ if (ro)
+ continue;
+
+ if (wnd_set_used_safe(&sbi->used.bitmap, lcn, len, &tt) || tt) {
+--
+2.40.1
+
--- /dev/null
+From 35e92aecbed5d1fc40e311a7e9743d9a9ec1876a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 10:56:55 +0800
+Subject: fs/ntfs3: Enhance sanity check while generating attr_list
+
+From: Edward Lo <loyuantsung@gmail.com>
+
+[ Upstream commit fdec309c7672cbee4dc0229ee4cbb33c948a1bdd ]
+
+ni_create_attr_list uses WARN_ON to catch error cases while generating
+attribute list, which only prints out stack trace and may not be enough.
+This repalces them with more proper error handling flow.
+
+[ 59.666332] BUG: kernel NULL pointer dereference, address: 000000000000000e
+[ 59.673268] #PF: supervisor read access in kernel mode
+[ 59.678354] #PF: error_code(0x0000) - not-present page
+[ 59.682831] PGD 8000000005ff1067 P4D 8000000005ff1067 PUD 7dee067 PMD 0
+[ 59.688556] Oops: 0000 [#1] PREEMPT SMP KASAN PTI
+[ 59.692642] CPU: 0 PID: 198 Comm: poc Tainted: G B W 6.2.0-rc1+ #4
+[ 59.698868] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
+[ 59.708795] RIP: 0010:ni_create_attr_list+0x505/0x860
+[ 59.713657] Code: 7e 10 e8 5e d0 d0 ff 45 0f b7 76 10 48 8d 7b 16 e8 00 d1 d0 ff 66 44 89 73 16 4d 8d 75 0e 4c 89 f7 e8 3f d0 d0 ff 4c 8d8
+[ 59.731559] RSP: 0018:ffff88800a56f1e0 EFLAGS: 00010282
+[ 59.735691] RAX: 0000000000000001 RBX: ffff88800b7b5088 RCX: ffffffffb83079fe
+[ 59.741792] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffffbb7f9fc0
+[ 59.748423] RBP: ffff88800a56f3a8 R08: ffff88800b7b50a0 R09: fffffbfff76ff3f9
+[ 59.754654] R10: ffffffffbb7f9fc7 R11: fffffbfff76ff3f8 R12: ffff88800b756180
+[ 59.761552] R13: 0000000000000000 R14: 000000000000000e R15: 0000000000000050
+[ 59.768323] FS: 00007feaa8c96440(0000) GS:ffff88806d400000(0000) knlGS:0000000000000000
+[ 59.776027] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 59.781395] CR2: 00007f3a2e0b1000 CR3: 000000000a5bc000 CR4: 00000000000006f0
+[ 59.787607] Call Trace:
+[ 59.790271] <TASK>
+[ 59.792488] ? __pfx_ni_create_attr_list+0x10/0x10
+[ 59.797235] ? kernel_text_address+0xd3/0xe0
+[ 59.800856] ? unwind_get_return_address+0x3e/0x60
+[ 59.805101] ? __kasan_check_write+0x18/0x20
+[ 59.809296] ? preempt_count_sub+0x1c/0xd0
+[ 59.813421] ni_ins_attr_ext+0x52c/0x5c0
+[ 59.817034] ? __pfx_ni_ins_attr_ext+0x10/0x10
+[ 59.821926] ? __vfs_setxattr+0x121/0x170
+[ 59.825718] ? __vfs_setxattr_noperm+0x97/0x300
+[ 59.829562] ? __vfs_setxattr_locked+0x145/0x170
+[ 59.833987] ? vfs_setxattr+0x137/0x2a0
+[ 59.836732] ? do_setxattr+0xce/0x150
+[ 59.839807] ? setxattr+0x126/0x140
+[ 59.842353] ? path_setxattr+0x164/0x180
+[ 59.845275] ? __x64_sys_setxattr+0x71/0x90
+[ 59.848838] ? do_syscall_64+0x3f/0x90
+[ 59.851898] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc
+[ 59.857046] ? stack_depot_save+0x17/0x20
+[ 59.860299] ni_insert_attr+0x1ba/0x420
+[ 59.863104] ? __pfx_ni_insert_attr+0x10/0x10
+[ 59.867069] ? preempt_count_sub+0x1c/0xd0
+[ 59.869897] ? _raw_spin_unlock_irqrestore+0x2b/0x50
+[ 59.874088] ? __create_object+0x3ae/0x5d0
+[ 59.877865] ni_insert_resident+0xc4/0x1c0
+[ 59.881430] ? __pfx_ni_insert_resident+0x10/0x10
+[ 59.886355] ? kasan_save_alloc_info+0x1f/0x30
+[ 59.891117] ? __kasan_kmalloc+0x8b/0xa0
+[ 59.894383] ntfs_set_ea+0x90d/0xbf0
+[ 59.897703] ? __pfx_ntfs_set_ea+0x10/0x10
+[ 59.901011] ? kernel_text_address+0xd3/0xe0
+[ 59.905308] ? __kernel_text_address+0x16/0x50
+[ 59.909811] ? unwind_get_return_address+0x3e/0x60
+[ 59.914898] ? __pfx_stack_trace_consume_entry+0x10/0x10
+[ 59.920250] ? arch_stack_walk+0xa2/0x100
+[ 59.924560] ? filter_irq_stacks+0x27/0x80
+[ 59.928722] ntfs_setxattr+0x405/0x440
+[ 59.932512] ? __pfx_ntfs_setxattr+0x10/0x10
+[ 59.936634] ? kvmalloc_node+0x2d/0x120
+[ 59.940378] ? kasan_save_stack+0x41/0x60
+[ 59.943870] ? kasan_save_stack+0x2a/0x60
+[ 59.947719] ? kasan_set_track+0x29/0x40
+[ 59.951417] ? kasan_save_alloc_info+0x1f/0x30
+[ 59.955733] ? __kasan_kmalloc+0x8b/0xa0
+[ 59.959598] ? __kmalloc_node+0x68/0x150
+[ 59.963163] ? kvmalloc_node+0x2d/0x120
+[ 59.966490] ? vmemdup_user+0x2b/0xa0
+[ 59.969060] __vfs_setxattr+0x121/0x170
+[ 59.972456] ? __pfx___vfs_setxattr+0x10/0x10
+[ 59.976008] __vfs_setxattr_noperm+0x97/0x300
+[ 59.981562] __vfs_setxattr_locked+0x145/0x170
+[ 59.986100] vfs_setxattr+0x137/0x2a0
+[ 59.989964] ? __pfx_vfs_setxattr+0x10/0x10
+[ 59.993616] ? __kasan_check_write+0x18/0x20
+[ 59.997425] do_setxattr+0xce/0x150
+[ 60.000304] setxattr+0x126/0x140
+[ 60.002967] ? __pfx_setxattr+0x10/0x10
+[ 60.006471] ? __virt_addr_valid+0xcb/0x140
+[ 60.010461] ? __call_rcu_common.constprop.0+0x1c7/0x330
+[ 60.016037] ? debug_smp_processor_id+0x1b/0x30
+[ 60.021008] ? kasan_quarantine_put+0x5b/0x190
+[ 60.025545] ? putname+0x84/0xa0
+[ 60.027910] ? __kasan_slab_free+0x11e/0x1b0
+[ 60.031483] ? putname+0x84/0xa0
+[ 60.033986] ? preempt_count_sub+0x1c/0xd0
+[ 60.036876] ? __mnt_want_write+0xae/0x100
+[ 60.040738] ? mnt_want_write+0x8f/0x150
+[ 60.044317] path_setxattr+0x164/0x180
+[ 60.048096] ? __pfx_path_setxattr+0x10/0x10
+[ 60.052096] ? strncpy_from_user+0x175/0x1c0
+[ 60.056482] ? debug_smp_processor_id+0x1b/0x30
+[ 60.059848] ? fpregs_assert_state_consistent+0x6b/0x80
+[ 60.064557] __x64_sys_setxattr+0x71/0x90
+[ 60.068892] do_syscall_64+0x3f/0x90
+[ 60.072868] entry_SYSCALL_64_after_hwframe+0x72/0xdc
+[ 60.077523] RIP: 0033:0x7feaa86e4469
+[ 60.080915] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 088
+[ 60.097353] RSP: 002b:00007ffdbd8311e8 EFLAGS: 00000286 ORIG_RAX: 00000000000000bc
+[ 60.103386] RAX: ffffffffffffffda RBX: 9461c5e290baac00 RCX: 00007feaa86e4469
+[ 60.110322] RDX: 00007ffdbd831fe0 RSI: 00007ffdbd831305 RDI: 00007ffdbd831263
+[ 60.116808] RBP: 00007ffdbd836180 R08: 0000000000000001 R09: 00007ffdbd836268
+[ 60.123879] R10: 000000000000007d R11: 0000000000000286 R12: 0000000000400500
+[ 60.130540] R13: 00007ffdbd836260 R14: 0000000000000000 R15: 0000000000000000
+[ 60.136553] </TASK>
+[ 60.138818] Modules linked in:
+[ 60.141839] CR2: 000000000000000e
+[ 60.144831] ---[ end trace 0000000000000000 ]---
+[ 60.149058] RIP: 0010:ni_create_attr_list+0x505/0x860
+[ 60.153975] Code: 7e 10 e8 5e d0 d0 ff 45 0f b7 76 10 48 8d 7b 16 e8 00 d1 d0 ff 66 44 89 73 16 4d 8d 75 0e 4c 89 f7 e8 3f d0 d0 ff 4c 8d8
+[ 60.172443] RSP: 0018:ffff88800a56f1e0 EFLAGS: 00010282
+[ 60.176246] RAX: 0000000000000001 RBX: ffff88800b7b5088 RCX: ffffffffb83079fe
+[ 60.182752] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffffbb7f9fc0
+[ 60.189949] RBP: ffff88800a56f3a8 R08: ffff88800b7b50a0 R09: fffffbfff76ff3f9
+[ 60.196950] R10: ffffffffbb7f9fc7 R11: fffffbfff76ff3f8 R12: ffff88800b756180
+[ 60.203671] R13: 0000000000000000 R14: 000000000000000e R15: 0000000000000050
+[ 60.209595] FS: 00007feaa8c96440(0000) GS:ffff88806d400000(0000) knlGS:0000000000000000
+[ 60.216299] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 60.222276] CR2: 00007f3a2e0b1000 CR3: 000000000a5bc000 CR4: 00000000000006f0
+
+Signed-off-by: Edward Lo <loyuantsung@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/frecord.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
+index 2bfcf1a989c95..50214b77c6a35 100644
+--- a/fs/ntfs3/frecord.c
++++ b/fs/ntfs3/frecord.c
+@@ -874,6 +874,7 @@ int ni_create_attr_list(struct ntfs_inode *ni)
+ if (err)
+ goto out1;
+
++ err = -EINVAL;
+ /* Call mi_remove_attr() in reverse order to keep pointers 'arr_move' valid. */
+ while (to_free > 0) {
+ struct ATTRIB *b = arr_move[--nb];
+@@ -882,7 +883,8 @@ int ni_create_attr_list(struct ntfs_inode *ni)
+
+ attr = mi_insert_attr(mi, b->type, Add2Ptr(b, name_off),
+ b->name_len, asize, name_off);
+- WARN_ON(!attr);
++ if (!attr)
++ goto out1;
+
+ mi_get_ref(mi, &le_b[nb]->ref);
+ le_b[nb]->id = attr->id;
+@@ -892,17 +894,20 @@ int ni_create_attr_list(struct ntfs_inode *ni)
+ attr->id = le_b[nb]->id;
+
+ /* Remove from primary record. */
+- WARN_ON(!mi_remove_attr(NULL, &ni->mi, b));
++ if (!mi_remove_attr(NULL, &ni->mi, b))
++ goto out1;
+
+ if (to_free <= asize)
+ break;
+ to_free -= asize;
+- WARN_ON(!nb);
++ if (!nb)
++ goto out1;
+ }
+
+ attr = mi_insert_attr(&ni->mi, ATTR_LIST, NULL, 0,
+ lsize + SIZEOF_RESIDENT, SIZEOF_RESIDENT);
+- WARN_ON(!attr);
++ if (!attr)
++ goto out1;
+
+ attr->non_res = 0;
+ attr->flags = 0;
+@@ -922,9 +927,10 @@ int ni_create_attr_list(struct ntfs_inode *ni)
+ kfree(ni->attr_list.le);
+ ni->attr_list.le = NULL;
+ ni->attr_list.size = 0;
++ return err;
+
+ out:
+- return err;
++ return 0;
+ }
+
+ /*
+--
+2.40.1
+
--- /dev/null
+From d3124c15130ec06d9295613b4933220bc83ffab7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Mar 2023 21:22:11 +0800
+Subject: fs: ntfs3: Fix possible null-pointer dereferences in mi_read()
+
+From: Jia-Ju Bai <baijiaju@buaa.edu.cn>
+
+[ Upstream commit 97498cd610c0d030a7bd49a7efad974790661162 ]
+
+In a previous commit 2681631c2973 ("fs/ntfs3: Add null pointer check to
+attr_load_runs_vcn"), ni can be NULL in attr_load_runs_vcn(), and thus it
+should be checked before being used.
+
+However, in the call stack of this commit, mft_ni in mi_read() is
+aliased with ni in attr_load_runs_vcn(), and it is also used in
+mi_read() at two places:
+
+mi_read()
+ rw_lock = &mft_ni->file.run_lock -> No check
+ attr_load_runs_vcn(mft_ni, ...)
+ ni (namely mft_ni) is checked in the previous commit
+ attr_load_runs_vcn(..., &mft_ni->file.run) -> No check
+
+Thus, to avoid possible null-pointer dereferences, the related checks
+should be added.
+
+These bugs are reported by a static analysis tool implemented by myself,
+and they are found by extending a known bug fixed in the previous commit.
+Thus, they could be theoretical bugs.
+
+Signed-off-by: Jia-Ju Bai <baijiaju@buaa.edu.cn>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/record.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
+index 2a281cead2bcc..7060f784c2d72 100644
+--- a/fs/ntfs3/record.c
++++ b/fs/ntfs3/record.c
+@@ -124,7 +124,7 @@ int mi_read(struct mft_inode *mi, bool is_mft)
+ struct rw_semaphore *rw_lock = NULL;
+
+ if (is_mounted(sbi)) {
+- if (!is_mft) {
++ if (!is_mft && mft_ni) {
+ rw_lock = &mft_ni->file.run_lock;
+ down_read(rw_lock);
+ }
+@@ -148,7 +148,7 @@ int mi_read(struct mft_inode *mi, bool is_mft)
+ ni_lock(mft_ni);
+ down_write(rw_lock);
+ }
+- err = attr_load_runs_vcn(mft_ni, ATTR_DATA, NULL, 0, &mft_ni->file.run,
++ err = attr_load_runs_vcn(mft_ni, ATTR_DATA, NULL, 0, run,
+ vbo >> sbi->cluster_bits);
+ if (rw_lock) {
+ up_write(rw_lock);
+--
+2.40.1
+
--- /dev/null
+From 5cf79e0661746899c2ff4720d1f64ad18af61110 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 May 2023 11:36:28 +0400
+Subject: fs/ntfs3: Mark ntfs dirty when on-disk struct is corrupted
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit e0f363a98830e8d7d70fbaf91c07ae0b7c57aafe ]
+
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/fsntfs.c | 2 +-
+ fs/ntfs3/index.c | 6 ++++++
+ fs/ntfs3/ntfs_fs.h | 2 ++
+ fs/ntfs3/record.c | 6 ++++++
+ 4 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c
+index 28cc421102e59..21567e58265c4 100644
+--- a/fs/ntfs3/fsntfs.c
++++ b/fs/ntfs3/fsntfs.c
+@@ -178,7 +178,7 @@ int ntfs_fix_post_read(struct NTFS_RECORD_HEADER *rhdr, size_t bytes,
+ /* Check errors. */
+ if ((fo & 1) || fo + fn * sizeof(short) > SECTOR_SIZE || !fn-- ||
+ fn * SECTOR_SIZE > bytes) {
+- return -EINVAL; /* Native chkntfs returns ok! */
++ return -E_NTFS_CORRUPT;
+ }
+
+ /* Get fixup pointer. */
+diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
+index 0a48d2d672198..b40da258e6848 100644
+--- a/fs/ntfs3/index.c
++++ b/fs/ntfs3/index.c
+@@ -1113,6 +1113,12 @@ int indx_read(struct ntfs_index *indx, struct ntfs_inode *ni, CLST vbn,
+ *node = in;
+
+ out:
++ if (err == -E_NTFS_CORRUPT) {
++ ntfs_inode_err(&ni->vfs_inode, "directory corrupted");
++ ntfs_set_state(ni->mi.sbi, NTFS_DIRTY_ERROR);
++ err = -EINVAL;
++ }
++
+ if (ib != in->index)
+ kfree(ib);
+
+diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h
+index eb01f7e76479a..2e4be773728df 100644
+--- a/fs/ntfs3/ntfs_fs.h
++++ b/fs/ntfs3/ntfs_fs.h
+@@ -53,6 +53,8 @@ enum utf16_endian;
+ #define E_NTFS_NONRESIDENT 556
+ /* NTFS specific error code about punch hole. */
+ #define E_NTFS_NOTALIGNED 557
++/* NTFS specific error code when on-disk struct is corrupted. */
++#define E_NTFS_CORRUPT 558
+
+
+ /* sbi->flags */
+diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
+index 7060f784c2d72..7974ca35a15c6 100644
+--- a/fs/ntfs3/record.c
++++ b/fs/ntfs3/record.c
+@@ -180,6 +180,12 @@ int mi_read(struct mft_inode *mi, bool is_mft)
+ return 0;
+
+ out:
++ if (err == -E_NTFS_CORRUPT) {
++ ntfs_err(sbi->sb, "mft corrupted");
++ ntfs_set_state(sbi, NTFS_DIRTY_ERROR);
++ err = -EINVAL;
++ }
++
+ return err;
+ }
+
+--
+2.40.1
+
--- /dev/null
+From 6b2e0ad191522458d156449c5eefa5b5178b74ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Mar 2023 18:23:03 +0800
+Subject: fs/ntfs3: Return error for inconsistent extended attributes
+
+From: Edward Lo <loyuantsung@gmail.com>
+
+[ Upstream commit c9db0ff04649aa0b45f497183c957fe260f229f6 ]
+
+ntfs_read_ea is called when we want to read extended attributes. There
+are some sanity checks for the validity of the EAs. However, it fails to
+return a proper error code for the inconsistent attributes, which might
+lead to unpredicted memory accesses after return.
+
+[ 138.916927] BUG: KASAN: use-after-free in ntfs_set_ea+0x453/0xbf0
+[ 138.923876] Write of size 4 at addr ffff88800205cfac by task poc/199
+[ 138.931132]
+[ 138.933016] CPU: 0 PID: 199 Comm: poc Not tainted 6.2.0-rc1+ #4
+[ 138.938070] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
+[ 138.947327] Call Trace:
+[ 138.949557] <TASK>
+[ 138.951539] dump_stack_lvl+0x4d/0x67
+[ 138.956834] print_report+0x16f/0x4a6
+[ 138.960798] ? ntfs_set_ea+0x453/0xbf0
+[ 138.964437] ? kasan_complete_mode_report_info+0x7d/0x200
+[ 138.969793] ? ntfs_set_ea+0x453/0xbf0
+[ 138.973523] kasan_report+0xb8/0x140
+[ 138.976740] ? ntfs_set_ea+0x453/0xbf0
+[ 138.980578] __asan_store4+0x76/0xa0
+[ 138.984669] ntfs_set_ea+0x453/0xbf0
+[ 138.988115] ? __pfx_ntfs_set_ea+0x10/0x10
+[ 138.993390] ? kernel_text_address+0xd3/0xe0
+[ 138.998270] ? __kernel_text_address+0x16/0x50
+[ 139.002121] ? unwind_get_return_address+0x3e/0x60
+[ 139.005659] ? __pfx_stack_trace_consume_entry+0x10/0x10
+[ 139.010177] ? arch_stack_walk+0xa2/0x100
+[ 139.013657] ? filter_irq_stacks+0x27/0x80
+[ 139.017018] ntfs_setxattr+0x405/0x440
+[ 139.022151] ? __pfx_ntfs_setxattr+0x10/0x10
+[ 139.026569] ? kvmalloc_node+0x2d/0x120
+[ 139.030329] ? kasan_save_stack+0x41/0x60
+[ 139.033883] ? kasan_save_stack+0x2a/0x60
+[ 139.037338] ? kasan_set_track+0x29/0x40
+[ 139.040163] ? kasan_save_alloc_info+0x1f/0x30
+[ 139.043588] ? __kasan_kmalloc+0x8b/0xa0
+[ 139.047255] ? __kmalloc_node+0x68/0x150
+[ 139.051264] ? kvmalloc_node+0x2d/0x120
+[ 139.055301] ? vmemdup_user+0x2b/0xa0
+[ 139.058584] __vfs_setxattr+0x121/0x170
+[ 139.062617] ? __pfx___vfs_setxattr+0x10/0x10
+[ 139.066282] __vfs_setxattr_noperm+0x97/0x300
+[ 139.070061] __vfs_setxattr_locked+0x145/0x170
+[ 139.073580] vfs_setxattr+0x137/0x2a0
+[ 139.076641] ? __pfx_vfs_setxattr+0x10/0x10
+[ 139.080223] ? __kasan_check_write+0x18/0x20
+[ 139.084234] do_setxattr+0xce/0x150
+[ 139.087768] setxattr+0x126/0x140
+[ 139.091250] ? __pfx_setxattr+0x10/0x10
+[ 139.094948] ? __virt_addr_valid+0xcb/0x140
+[ 139.097838] ? __call_rcu_common.constprop.0+0x1c7/0x330
+[ 139.102688] ? debug_smp_processor_id+0x1b/0x30
+[ 139.105985] ? kasan_quarantine_put+0x5b/0x190
+[ 139.109980] ? putname+0x84/0xa0
+[ 139.113886] ? __kasan_slab_free+0x11e/0x1b0
+[ 139.117961] ? putname+0x84/0xa0
+[ 139.121316] ? preempt_count_sub+0x1c/0xd0
+[ 139.124427] ? __mnt_want_write+0xae/0x100
+[ 139.127836] ? mnt_want_write+0x8f/0x150
+[ 139.130954] path_setxattr+0x164/0x180
+[ 139.133998] ? __pfx_path_setxattr+0x10/0x10
+[ 139.137853] ? __pfx_ksys_pwrite64+0x10/0x10
+[ 139.141299] ? debug_smp_processor_id+0x1b/0x30
+[ 139.145714] ? fpregs_assert_state_consistent+0x6b/0x80
+[ 139.150796] __x64_sys_setxattr+0x71/0x90
+[ 139.155407] do_syscall_64+0x3f/0x90
+[ 139.159035] entry_SYSCALL_64_after_hwframe+0x72/0xdc
+[ 139.163843] RIP: 0033:0x7f108cae4469
+[ 139.166481] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 088
+[ 139.183764] RSP: 002b:00007fff87588388 EFLAGS: 00000286 ORIG_RAX: 00000000000000bc
+[ 139.190657] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f108cae4469
+[ 139.196586] RDX: 00007fff875883b0 RSI: 00007fff875883d1 RDI: 00007fff875883b6
+[ 139.201716] RBP: 00007fff8758c530 R08: 0000000000000001 R09: 00007fff8758c618
+[ 139.207940] R10: 0000000000000006 R11: 0000000000000286 R12: 00000000004004c0
+[ 139.214007] R13: 00007fff8758c610 R14: 0000000000000000 R15: 0000000000000000
+
+Signed-off-by: Edward Lo <loyuantsung@gmail.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/xattr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c
+index fd02fcf4d4091..26787c2bbf758 100644
+--- a/fs/ntfs3/xattr.c
++++ b/fs/ntfs3/xattr.c
+@@ -141,6 +141,7 @@ static int ntfs_read_ea(struct ntfs_inode *ni, struct EA_FULL **ea,
+
+ memset(Add2Ptr(ea_p, size), 0, add_bytes);
+
++ err = -EINVAL;
+ /* Check all attributes for consistency. */
+ for (off = 0; off < size; off += ea_size) {
+ const struct EA_FULL *ef = Add2Ptr(ea_p, off);
+--
+2.40.1
+
--- /dev/null
+From e11852e64c887cd15947de90f0b56fe48c5f86ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jun 2023 11:06:37 +0800
+Subject: gfs2: Fix possible data races in gfs2_show_options()
+
+From: Tuo Li <islituo@gmail.com>
+
+[ Upstream commit 6fa0a72cbbe45db4ed967a51f9e6f4e3afe61d20 ]
+
+Some fields such as gt_logd_secs of the struct gfs2_tune are accessed
+without holding the lock gt_spin in gfs2_show_options():
+
+ val = sdp->sd_tune.gt_logd_secs;
+ if (val != 30)
+ seq_printf(s, ",commit=%d", val);
+
+And thus can cause data races when gfs2_show_options() and other functions
+such as gfs2_reconfigure() are concurrently executed:
+
+ spin_lock(>->gt_spin);
+ gt->gt_logd_secs = newargs->ar_commit;
+
+To fix these possible data races, the lock sdp->sd_tune.gt_spin is
+acquired before accessing the fields of gfs2_tune and released after these
+accesses.
+
+Further changes by Andreas:
+
+- Don't hold the spin lock over the seq_printf operations.
+
+Reported-by: BassCheck <bass@buaa.edu.cn>
+Signed-off-by: Tuo Li <islituo@gmail.com>
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/super.c | 26 +++++++++++++++-----------
+ 1 file changed, 15 insertions(+), 11 deletions(-)
+
+diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
+index a84bf6444bba9..204ba7f8417e6 100644
+--- a/fs/gfs2/super.c
++++ b/fs/gfs2/super.c
+@@ -1004,7 +1004,14 @@ static int gfs2_show_options(struct seq_file *s, struct dentry *root)
+ {
+ struct gfs2_sbd *sdp = root->d_sb->s_fs_info;
+ struct gfs2_args *args = &sdp->sd_args;
+- int val;
++ unsigned int logd_secs, statfs_slow, statfs_quantum, quota_quantum;
++
++ spin_lock(&sdp->sd_tune.gt_spin);
++ logd_secs = sdp->sd_tune.gt_logd_secs;
++ quota_quantum = sdp->sd_tune.gt_quota_quantum;
++ statfs_quantum = sdp->sd_tune.gt_statfs_quantum;
++ statfs_slow = sdp->sd_tune.gt_statfs_slow;
++ spin_unlock(&sdp->sd_tune.gt_spin);
+
+ if (is_ancestor(root, sdp->sd_master_dir))
+ seq_puts(s, ",meta");
+@@ -1059,17 +1066,14 @@ static int gfs2_show_options(struct seq_file *s, struct dentry *root)
+ }
+ if (args->ar_discard)
+ seq_puts(s, ",discard");
+- val = sdp->sd_tune.gt_logd_secs;
+- if (val != 30)
+- seq_printf(s, ",commit=%d", val);
+- val = sdp->sd_tune.gt_statfs_quantum;
+- if (val != 30)
+- seq_printf(s, ",statfs_quantum=%d", val);
+- else if (sdp->sd_tune.gt_statfs_slow)
++ if (logd_secs != 30)
++ seq_printf(s, ",commit=%d", logd_secs);
++ if (statfs_quantum != 30)
++ seq_printf(s, ",statfs_quantum=%d", statfs_quantum);
++ else if (statfs_slow)
+ seq_puts(s, ",statfs_quantum=0");
+- val = sdp->sd_tune.gt_quota_quantum;
+- if (val != 60)
+- seq_printf(s, ",quota_quantum=%d", val);
++ if (quota_quantum != 60)
++ seq_printf(s, ",quota_quantum=%d", quota_quantum);
+ if (args->ar_statfs_percent)
+ seq_printf(s, ",statfs_percent=%d", args->ar_statfs_percent);
+ if (args->ar_errors != GFS2_ERRORS_DEFAULT) {
+--
+2.40.1
+
--- /dev/null
+From c493df85647fd95d2d5d31be82ca778295e42832 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 May 2023 11:42:37 +0800
+Subject: HID: i2c-hid: goodix: Add support for
+ "goodix,no-reset-during-suspend" property
+
+From: Fei Shao <fshao@chromium.org>
+
+[ Upstream commit 7607f12ba735f04e0ef8718dabadf3a765c9a477 ]
+
+In the beginning, commit 18eeef46d359 ("HID: i2c-hid: goodix: Tie the
+reset line to true state of the regulator") introduced a change to tie
+the reset line of the Goodix touchscreen to the state of the regulator
+to fix a power leakage issue in suspend.
+
+After some time, the change was deemed unnecessary and was reverted in
+commit 557e05fa9fdd ("HID: i2c-hid: goodix: Stop tying the reset line to
+the regulator") due to difficulties in managing regulator notifiers for
+designs like Evoker, which provides a second power rail to touchscreen.
+
+However, the revert caused a power regression on another Chromebook
+device Steelix in the field, which has a dedicated always-on regulator
+for touchscreen and was covered by the workaround in the first commit.
+
+To address both cases, this patch adds the support for the new
+"goodix,no-reset-during-suspend" property in the driver:
+- When set to true, the driver does not assert the reset GPIO during
+ power-down.
+ Instead, the GPIO will be asserted during power-up to ensure the
+ touchscreen always has a clean start and consistent behavior after
+ resuming.
+ This is for designs with a dedicated always-on regulator.
+- When set to false or unset, the driver uses the original control flow
+ and asserts GPIO and disables regulators normally.
+ This is for the two-regulator and shared-regulator designs.
+
+Signed-off-by: Fei Shao <fshao@chromium.org>
+Suggested-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Jeff LaBundy <jeff@labundy.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/i2c-hid/i2c-hid-of-goodix.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/i2c-hid/i2c-hid-of-goodix.c b/drivers/hid/i2c-hid/i2c-hid-of-goodix.c
+index 0060e3dcd775d..db4639db98407 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-of-goodix.c
++++ b/drivers/hid/i2c-hid/i2c-hid-of-goodix.c
+@@ -28,6 +28,7 @@ struct i2c_hid_of_goodix {
+ struct regulator *vdd;
+ struct regulator *vddio;
+ struct gpio_desc *reset_gpio;
++ bool no_reset_during_suspend;
+ const struct goodix_i2c_hid_timing_data *timings;
+ };
+
+@@ -37,6 +38,14 @@ static int goodix_i2c_hid_power_up(struct i2chid_ops *ops)
+ container_of(ops, struct i2c_hid_of_goodix, ops);
+ int ret;
+
++ /*
++ * We assert reset GPIO here (instead of during power-down) to ensure
++ * the device will have a clean state after powering up, just like the
++ * normal scenarios will have.
++ */
++ if (ihid_goodix->no_reset_during_suspend)
++ gpiod_set_value_cansleep(ihid_goodix->reset_gpio, 1);
++
+ ret = regulator_enable(ihid_goodix->vdd);
+ if (ret)
+ return ret;
+@@ -60,7 +69,9 @@ static void goodix_i2c_hid_power_down(struct i2chid_ops *ops)
+ struct i2c_hid_of_goodix *ihid_goodix =
+ container_of(ops, struct i2c_hid_of_goodix, ops);
+
+- gpiod_set_value_cansleep(ihid_goodix->reset_gpio, 1);
++ if (!ihid_goodix->no_reset_during_suspend)
++ gpiod_set_value_cansleep(ihid_goodix->reset_gpio, 1);
++
+ regulator_disable(ihid_goodix->vddio);
+ regulator_disable(ihid_goodix->vdd);
+ }
+@@ -91,6 +102,9 @@ static int i2c_hid_of_goodix_probe(struct i2c_client *client)
+ if (IS_ERR(ihid_goodix->vddio))
+ return PTR_ERR(ihid_goodix->vddio);
+
++ ihid_goodix->no_reset_during_suspend =
++ of_property_read_bool(client->dev.of_node, "goodix,no-reset-during-suspend");
++
+ ihid_goodix->timings = device_get_match_data(&client->dev);
+
+ return i2c_hid_core_probe(client, &ihid_goodix->ops, 0x0001, 0);
+--
+2.40.1
+
--- /dev/null
+From 697bb700360c41b691082cd5a7048e7c325cb746 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jun 2023 08:26:41 +0800
+Subject: HID: intel-ish-hid: ipc: Add Arrow Lake PCI device ID
+
+From: Even Xu <even.xu@intel.com>
+
+[ Upstream commit 4982126e3029cd59fbd1da0d9cc0365a0585fe64 ]
+
+Add device ID of Arrow Lake-H into ishtp support list.
+
+Signed-off-by: Even Xu <even.xu@intel.com>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/intel-ish-hid/ipc/hw-ish.h | 1 +
+ drivers/hid/intel-ish-hid/ipc/pci-ish.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/hid/intel-ish-hid/ipc/hw-ish.h b/drivers/hid/intel-ish-hid/ipc/hw-ish.h
+index fc108f19a64c3..e99f3a3c65e15 100644
+--- a/drivers/hid/intel-ish-hid/ipc/hw-ish.h
++++ b/drivers/hid/intel-ish-hid/ipc/hw-ish.h
+@@ -33,6 +33,7 @@
+ #define ADL_N_DEVICE_ID 0x54FC
+ #define RPL_S_DEVICE_ID 0x7A78
+ #define MTL_P_DEVICE_ID 0x7E45
++#define ARL_H_DEVICE_ID 0x7745
+
+ #define REVISION_ID_CHT_A0 0x6
+ #define REVISION_ID_CHT_Ax_SI 0x0
+diff --git a/drivers/hid/intel-ish-hid/ipc/pci-ish.c b/drivers/hid/intel-ish-hid/ipc/pci-ish.c
+index 7120b30ac51d0..55cb25038e632 100644
+--- a/drivers/hid/intel-ish-hid/ipc/pci-ish.c
++++ b/drivers/hid/intel-ish-hid/ipc/pci-ish.c
+@@ -44,6 +44,7 @@ static const struct pci_device_id ish_pci_tbl[] = {
+ {PCI_DEVICE(PCI_VENDOR_ID_INTEL, ADL_N_DEVICE_ID)},
+ {PCI_DEVICE(PCI_VENDOR_ID_INTEL, RPL_S_DEVICE_ID)},
+ {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MTL_P_DEVICE_ID)},
++ {PCI_DEVICE(PCI_VENDOR_ID_INTEL, ARL_H_DEVICE_ID)},
+ {0, }
+ };
+ MODULE_DEVICE_TABLE(pci, ish_pci_tbl);
+--
+2.40.1
+
--- /dev/null
+From daa523917c9a6301641253c38c08c00354276258 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 May 2023 15:44:28 +0100
+Subject: HID: logitech-hidpp: Add USB and Bluetooth IDs for the Logitech G915
+ TKL Keyboard
+
+From: stuarthayhurst <stuart.a.hayhurst@gmail.com>
+
+[ Upstream commit 48aea8b445c422a372cf15915101035a47105421 ]
+
+Adds the USB and Bluetooth IDs for the Logitech G915 TKL keyboard, for device detection
+For this device, this provides battery reporting on top of hid-generic
+
+Reviewed-by: Bastien Nocera <hadess@hadess.net>
+Signed-off-by: Stuart Hayhurst <stuart.a.hayhurst@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-logitech-hidpp.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index f7e06d433a915..dfe8e09a18de0 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -4608,6 +4608,8 @@ static const struct hid_device_id hidpp_devices[] = {
+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC086) },
+ { /* Logitech G903 Hero Gaming Mouse over USB */
+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC091) },
++ { /* Logitech G915 TKL Keyboard over USB */
++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC343) },
+ { /* Logitech G920 Wheel over USB */
+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G920_WHEEL),
+ .driver_data = HIDPP_QUIRK_CLASS_G920 | HIDPP_QUIRK_FORCE_OUTPUT_REPORTS},
+@@ -4630,6 +4632,8 @@ static const struct hid_device_id hidpp_devices[] = {
+ { /* MX5500 keyboard over Bluetooth */
+ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb30b),
+ .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS },
++ { /* Logitech G915 TKL keyboard over Bluetooth */
++ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb35f) },
+ { /* M-RCQ142 V470 Cordless Laser Mouse over Bluetooth */
+ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb008) },
+ { /* MX Master mouse over Bluetooth */
+--
+2.40.1
+
--- /dev/null
+From bba94e8fb748e2333fbf61ebc97a4fc43f319992 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 May 2023 10:11:35 -0400
+Subject: iommu/amd: Introduce Disable IRTE Caching Support
+
+From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+
+[ Upstream commit 66419036f68a838c00cbccacd6cb2e99da6e5710 ]
+
+An Interrupt Remapping Table (IRT) stores interrupt remapping configuration
+for each device. In a normal operation, the AMD IOMMU caches the table
+to optimize subsequent data accesses. This requires the IOMMU driver to
+invalidate IRT whenever it updates the table. The invalidation process
+includes issuing an INVALIDATE_INTERRUPT_TABLE command following by
+a COMPLETION_WAIT command.
+
+However, there are cases in which the IRT is updated at a high rate.
+For example, for IOMMU AVIC, the IRTE[IsRun] bit is updated on every
+vcpu scheduling (i.e. amd_iommu_update_ga()). On system with large
+amount of vcpus and VFIO PCI pass-through devices, the invalidation
+process could potentially become a performance bottleneck.
+
+Introducing a new kernel boot option:
+
+ amd_iommu=irtcachedis
+
+which disables IRTE caching by setting the IRTCachedis bit in each IOMMU
+Control register, and bypass the IRT invalidation process.
+
+Reviewed-by: Jerry Snitselaar <jsnitsel@redhat.com>
+Co-developed-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
+Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
+Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Link: https://lore.kernel.org/r/20230530141137.14376-4-suravee.suthikulpanit@amd.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../admin-guide/kernel-parameters.txt | 1 +
+ drivers/iommu/amd/amd_iommu_types.h | 4 +++
+ drivers/iommu/amd/init.c | 36 +++++++++++++++++++
+ 3 files changed, 41 insertions(+)
+
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index a8fc0eb6fb1d6..7323911931828 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -323,6 +323,7 @@
+ option with care.
+ pgtbl_v1 - Use v1 page table for DMA-API (Default).
+ pgtbl_v2 - Use v2 page table for DMA-API.
++ irtcachedis - Disable Interrupt Remapping Table (IRT) caching.
+
+ amd_iommu_dump= [HW,X86-64]
+ Enable AMD IOMMU driver option to dump the ACPI table
+diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h
+index 2ddbda3a43746..5a224e244be8a 100644
+--- a/drivers/iommu/amd/amd_iommu_types.h
++++ b/drivers/iommu/amd/amd_iommu_types.h
+@@ -174,6 +174,7 @@
+ #define CONTROL_GAINT_EN 29
+ #define CONTROL_XT_EN 50
+ #define CONTROL_INTCAPXT_EN 51
++#define CONTROL_IRTCACHEDIS 59
+ #define CONTROL_SNPAVIC_EN 61
+
+ #define CTRL_INV_TO_MASK (7 << CONTROL_INV_TIMEOUT)
+@@ -716,6 +717,9 @@ struct amd_iommu {
+ /* if one, we need to send a completion wait command */
+ bool need_sync;
+
++ /* true if disable irte caching */
++ bool irtcachedis_enabled;
++
+ /* Handle for IOMMU core code */
+ struct iommu_device iommu;
+
+diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
+index c2d80a4e5fb06..02846299af0ef 100644
+--- a/drivers/iommu/amd/init.c
++++ b/drivers/iommu/amd/init.c
+@@ -162,6 +162,7 @@ static int amd_iommu_xt_mode = IRQ_REMAP_XAPIC_MODE;
+ static bool amd_iommu_detected;
+ static bool amd_iommu_disabled __initdata;
+ static bool amd_iommu_force_enable __initdata;
++static bool amd_iommu_irtcachedis;
+ static int amd_iommu_target_ivhd_type;
+
+ /* Global EFR and EFR2 registers */
+@@ -484,6 +485,9 @@ static void iommu_disable(struct amd_iommu *iommu)
+
+ /* Disable IOMMU hardware itself */
+ iommu_feature_disable(iommu, CONTROL_IOMMU_EN);
++
++ /* Clear IRTE cache disabling bit */
++ iommu_feature_disable(iommu, CONTROL_IRTCACHEDIS);
+ }
+
+ /*
+@@ -2710,6 +2714,33 @@ static void iommu_enable_ga(struct amd_iommu *iommu)
+ #endif
+ }
+
++static void iommu_disable_irtcachedis(struct amd_iommu *iommu)
++{
++ iommu_feature_disable(iommu, CONTROL_IRTCACHEDIS);
++}
++
++static void iommu_enable_irtcachedis(struct amd_iommu *iommu)
++{
++ u64 ctrl;
++
++ if (!amd_iommu_irtcachedis)
++ return;
++
++ /*
++ * Note:
++ * The support for IRTCacheDis feature is dertermined by
++ * checking if the bit is writable.
++ */
++ iommu_feature_enable(iommu, CONTROL_IRTCACHEDIS);
++ ctrl = readq(iommu->mmio_base + MMIO_CONTROL_OFFSET);
++ ctrl &= (1ULL << CONTROL_IRTCACHEDIS);
++ if (ctrl)
++ iommu->irtcachedis_enabled = true;
++ pr_info("iommu%d (%#06x) : IRT cache is %s\n",
++ iommu->index, iommu->devid,
++ iommu->irtcachedis_enabled ? "disabled" : "enabled");
++}
++
+ static void early_enable_iommu(struct amd_iommu *iommu)
+ {
+ iommu_disable(iommu);
+@@ -2720,6 +2751,7 @@ static void early_enable_iommu(struct amd_iommu *iommu)
+ iommu_set_exclusion_range(iommu);
+ iommu_enable_ga(iommu);
+ iommu_enable_xt(iommu);
++ iommu_enable_irtcachedis(iommu);
+ iommu_enable(iommu);
+ iommu_flush_all_caches(iommu);
+ }
+@@ -2770,10 +2802,12 @@ static void early_enable_iommus(void)
+ for_each_iommu(iommu) {
+ iommu_disable_command_buffer(iommu);
+ iommu_disable_event_buffer(iommu);
++ iommu_disable_irtcachedis(iommu);
+ iommu_enable_command_buffer(iommu);
+ iommu_enable_event_buffer(iommu);
+ iommu_enable_ga(iommu);
+ iommu_enable_xt(iommu);
++ iommu_enable_irtcachedis(iommu);
+ iommu_set_device_table(iommu);
+ iommu_flush_all_caches(iommu);
+ }
+@@ -3426,6 +3460,8 @@ static int __init parse_amd_iommu_options(char *str)
+ amd_iommu_pgtable = AMD_IOMMU_V1;
+ } else if (strncmp(str, "pgtbl_v2", 8) == 0) {
+ amd_iommu_pgtable = AMD_IOMMU_V2;
++ } else if (strncmp(str, "irtcachedis", 11) == 0) {
++ amd_iommu_irtcachedis = true;
+ } else {
+ pr_notice("Unknown option - '%s'\n", str);
+ }
+--
+2.40.1
+
--- /dev/null
+From 13b1c6f4d115c70fb1aab11c7b7969712c60208a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jun 2023 10:50:36 +0200
+Subject: iopoll: Call cpu_relax() in busy loops
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit b407460ee99033503993ac7437d593451fcdfe44 ]
+
+It is considered good practice to call cpu_relax() in busy loops, see
+Documentation/process/volatile-considered-harmful.rst. This can not
+only lower CPU power consumption or yield to a hyperthreaded twin
+processor, but also allows an architecture to mitigate hardware issues
+(e.g. ARM Erratum 754327 for Cortex-A9 prior to r2p0) in the
+architecture-specific cpu_relax() implementation.
+
+In addition, cpu_relax() is also a compiler barrier. It is not
+immediately obvious that the @op argument "function" will result in an
+actual function call (e.g. in case of inlining).
+
+Where a function call is a C sequence point, this is lost on inlining.
+Therefore, with agressive enough optimization it might be possible for
+the compiler to hoist the:
+
+ (val) = op(args);
+
+"load" out of the loop because it doesn't see the value changing. The
+addition of cpu_relax() would inhibit this.
+
+As the iopoll helpers lack calls to cpu_relax(), people are sometimes
+reluctant to use them, and may fall back to open-coded polling loops
+(including cpu_relax() calls) instead.
+
+Fix this by adding calls to cpu_relax() to the iopoll helpers:
+ - For the non-atomic case, it is sufficient to call cpu_relax() in
+ case of a zero sleep-between-reads value, as a call to
+ usleep_range() is a safe barrier otherwise. However, it doesn't
+ hurt to add the call regardless, for simplicity, and for similarity
+ with the atomic case below.
+ - For the atomic case, cpu_relax() must be called regardless of the
+ sleep-between-reads value, as there is no guarantee all
+ architecture-specific implementations of udelay() handle this.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Tony Lindgren <tony@atomide.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Link: https://lore.kernel.org/r/45c87bec3397fdd704376807f0eec5cc71be440f.1685692810.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/iopoll.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/include/linux/iopoll.h b/include/linux/iopoll.h
+index 2c8860e406bd8..0417360a6db9b 100644
+--- a/include/linux/iopoll.h
++++ b/include/linux/iopoll.h
+@@ -53,6 +53,7 @@
+ } \
+ if (__sleep_us) \
+ usleep_range((__sleep_us >> 2) + 1, __sleep_us); \
++ cpu_relax(); \
+ } \
+ (cond) ? 0 : -ETIMEDOUT; \
+ })
+@@ -95,6 +96,7 @@
+ } \
+ if (__delay_us) \
+ udelay(__delay_us); \
++ cpu_relax(); \
+ } \
+ (cond) ? 0 : -ETIMEDOUT; \
+ })
+--
+2.40.1
+
--- /dev/null
+From a7a91ea8559a73d1d26794baa5fae34eea5a97a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 May 2023 19:17:03 +0800
+Subject: led: qcom-lpg: Fix resource leaks in
+ for_each_available_child_of_node() loops
+
+From: Lu Hongfei <luhongfei@vivo.com>
+
+[ Upstream commit 8f38f8fa7261819eb7d4fb369dc3bfab72259033 ]
+
+Ensure child node references are decremented properly in the error path.
+
+Signed-off-by: Lu Hongfei <luhongfei@vivo.com>
+Link: https://lore.kernel.org/r/20230525111705.3055-1-luhongfei@vivo.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/rgb/leds-qcom-lpg.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/leds/rgb/leds-qcom-lpg.c b/drivers/leds/rgb/leds-qcom-lpg.c
+index 1c849814a4917..212df2e3d3502 100644
+--- a/drivers/leds/rgb/leds-qcom-lpg.c
++++ b/drivers/leds/rgb/leds-qcom-lpg.c
+@@ -1173,8 +1173,10 @@ static int lpg_add_led(struct lpg *lpg, struct device_node *np)
+ i = 0;
+ for_each_available_child_of_node(np, child) {
+ ret = lpg_parse_channel(lpg, child, &led->channels[i]);
+- if (ret < 0)
++ if (ret < 0) {
++ of_node_put(child);
+ return ret;
++ }
+
+ info[i].color_index = led->channels[i]->color;
+ info[i].intensity = 0;
+@@ -1352,8 +1354,10 @@ static int lpg_probe(struct platform_device *pdev)
+
+ for_each_available_child_of_node(pdev->dev.of_node, np) {
+ ret = lpg_add_led(lpg, np);
+- if (ret)
++ if (ret) {
++ of_node_put(np);
+ return ret;
++ }
+ }
+
+ for (i = 0; i < lpg->num_channels; i++)
+--
+2.40.1
+
--- /dev/null
+From 1309fa0d6619537a8ca48545fdac191efe8515ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 May 2023 00:52:35 +0300
+Subject: media: camss: set VFE bpl_alignment to 16 for sdm845 and sm8250
+
+From: Andrey Konovalov <andrey.konovalov@linaro.org>
+
+[ Upstream commit d5b7eb477c286f6ceccbb38704136eea0e6b09ca ]
+
+From the experiments with camera sensors using SGRBG10_1X10/3280x2464 and
+SRGGB10_1X10/3280x2464 formats, it becomes clear that on sdm845 and sm8250
+VFE outputs the lines padded to a length multiple of 16 bytes. As in the
+current driver the value of the bpl_alignment is set to 8 bytes, the frames
+captured in formats with the bytes-per-line value being not a multiple of
+16 get corrupted.
+
+Set the bpl_alignment of the camss video output device to 16 for sdm845 and
+sm8250 to fix that.
+
+Signed-off-by: Andrey Konovalov <andrey.konovalov@linaro.org>
+Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Acked-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/camss/camss-vfe.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/qcom/camss/camss-vfe.c b/drivers/media/platform/qcom/camss/camss-vfe.c
+index e0832f3f4f25c..06c95568e5af4 100644
+--- a/drivers/media/platform/qcom/camss/camss-vfe.c
++++ b/drivers/media/platform/qcom/camss/camss-vfe.c
+@@ -1541,7 +1541,11 @@ int msm_vfe_register_entities(struct vfe_device *vfe,
+ }
+
+ video_out->ops = &vfe->video_ops;
+- video_out->bpl_alignment = 8;
++ if (vfe->camss->version == CAMSS_845 ||
++ vfe->camss->version == CAMSS_8250)
++ video_out->bpl_alignment = 16;
++ else
++ video_out->bpl_alignment = 8;
+ video_out->line_based = 0;
+ if (i == VFE_LINE_PIX) {
+ video_out->bpl_alignment = 16;
+--
+2.40.1
+
--- /dev/null
+From 83b3e1633736a58278a0ae35d984f1df7b44c908 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 May 2023 13:11:47 +0100
+Subject: media: platform: mediatek: vpu: fix NULL ptr dereference
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 3df55cd773e8603b623425cc97b05e542854ad27 ]
+
+If pdev is NULL, then it is still dereferenced.
+
+This fixes this smatch warning:
+
+drivers/media/platform/mediatek/vpu/mtk_vpu.c:570 vpu_load_firmware() warn: address of NULL pointer 'pdev'
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Cc: Yunfei Dong <yunfei.dong@mediatek.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mediatek/vpu/mtk_vpu.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/mediatek/vpu/mtk_vpu.c b/drivers/media/platform/mediatek/vpu/mtk_vpu.c
+index 5e2bc286f168e..1a95958a1f908 100644
+--- a/drivers/media/platform/mediatek/vpu/mtk_vpu.c
++++ b/drivers/media/platform/mediatek/vpu/mtk_vpu.c
+@@ -562,15 +562,17 @@ static int load_requested_vpu(struct mtk_vpu *vpu,
+ int vpu_load_firmware(struct platform_device *pdev)
+ {
+ struct mtk_vpu *vpu;
+- struct device *dev = &pdev->dev;
++ struct device *dev;
+ struct vpu_run *run;
+ int ret;
+
+ if (!pdev) {
+- dev_err(dev, "VPU platform device is invalid\n");
++ pr_err("VPU platform device is invalid\n");
+ return -EINVAL;
+ }
+
++ dev = &pdev->dev;
++
+ vpu = platform_get_drvdata(pdev);
+ run = &vpu->run;
+
+--
+2.40.1
+
--- /dev/null
+From 59b5bb08c117810d28ee6acff5f1c0afd9e8cbec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Apr 2023 16:17:40 +0800
+Subject: media: v4l2-mem2mem: add lock to protect parameter num_rdy
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yunfei Dong <yunfei.dong@mediatek.com>
+
+[ Upstream commit 56b5c3e67b0f9af3f45cf393be048ee8d8a92694 ]
+
+Getting below error when using KCSAN to check the driver. Adding lock to
+protect parameter num_rdy when getting the value with function:
+v4l2_m2m_num_src_bufs_ready/v4l2_m2m_num_dst_bufs_ready.
+
+kworker/u16:3: [name:report&]BUG: KCSAN: data-race in v4l2_m2m_buf_queue
+kworker/u16:3: [name:report&]
+
+kworker/u16:3: [name:report&]read-write to 0xffffff8105f35b94 of 1 bytes by task 20865 on cpu 7:
+kworker/u16:3: v4l2_m2m_buf_queue+0xd8/0x10c
+
+Signed-off-by: Pina Chen <pina.chen@mediatek.com>
+Signed-off-by: Yunfei Dong <yunfei.dong@mediatek.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/media/v4l2-mem2mem.h | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/include/media/v4l2-mem2mem.h b/include/media/v4l2-mem2mem.h
+index bb9de6a899e07..d6c8eb2b52019 100644
+--- a/include/media/v4l2-mem2mem.h
++++ b/include/media/v4l2-mem2mem.h
+@@ -593,7 +593,14 @@ void v4l2_m2m_buf_queue(struct v4l2_m2m_ctx *m2m_ctx,
+ static inline
+ unsigned int v4l2_m2m_num_src_bufs_ready(struct v4l2_m2m_ctx *m2m_ctx)
+ {
+- return m2m_ctx->out_q_ctx.num_rdy;
++ unsigned int num_buf_rdy;
++ unsigned long flags;
++
++ spin_lock_irqsave(&m2m_ctx->out_q_ctx.rdy_spinlock, flags);
++ num_buf_rdy = m2m_ctx->out_q_ctx.num_rdy;
++ spin_unlock_irqrestore(&m2m_ctx->out_q_ctx.rdy_spinlock, flags);
++
++ return num_buf_rdy;
+ }
+
+ /**
+@@ -605,7 +612,14 @@ unsigned int v4l2_m2m_num_src_bufs_ready(struct v4l2_m2m_ctx *m2m_ctx)
+ static inline
+ unsigned int v4l2_m2m_num_dst_bufs_ready(struct v4l2_m2m_ctx *m2m_ctx)
+ {
+- return m2m_ctx->cap_q_ctx.num_rdy;
++ unsigned int num_buf_rdy;
++ unsigned long flags;
++
++ spin_lock_irqsave(&m2m_ctx->cap_q_ctx.rdy_spinlock, flags);
++ num_buf_rdy = m2m_ctx->cap_q_ctx.num_rdy;
++ spin_unlock_irqrestore(&m2m_ctx->cap_q_ctx.rdy_spinlock, flags);
++
++ return num_buf_rdy;
+ }
+
+ /**
+--
+2.40.1
+
--- /dev/null
+From 6ed957095c5beea5dcc0534b994220930e55723d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 14:08:50 +0100
+Subject: Move netfs_extract_iter_to_sg() to lib/scatterlist.c
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit f5f82cd18732d828bcd1ec308c4e8c55012e84b0 ]
+
+Move netfs_extract_iter_to_sg() to lib/scatterlist.c as it's going to be
+used by more than just network filesystems (AF_ALG, for example).
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Jeff Layton <jlayton@kernel.org>
+cc: Steve French <sfrench@samba.org>
+cc: Shyam Prasad N <nspmangalore@gmail.com>
+cc: Rohith Surabattula <rohiths.msft@gmail.com>
+cc: Jens Axboe <axboe@kernel.dk>
+cc: Herbert Xu <herbert@gondor.apana.org.au>
+cc: "David S. Miller" <davem@davemloft.net>
+cc: Eric Dumazet <edumazet@google.com>
+cc: Jakub Kicinski <kuba@kernel.org>
+cc: Paolo Abeni <pabeni@redhat.com>
+cc: Matthew Wilcox <willy@infradead.org>
+cc: linux-crypto@vger.kernel.org
+cc: linux-cachefs@redhat.com
+cc: linux-cifs@vger.kernel.org
+cc: linux-fsdevel@vger.kernel.org
+cc: netdev@vger.kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Stable-dep-of: f443fd5af5db ("crypto, cifs: fix error handling in extract_iter_to_sg()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/netfs/iterator.c | 267 -----------------------------------------
+ include/linux/netfs.h | 4 -
+ include/linux/uio.h | 5 +
+ lib/scatterlist.c | 269 ++++++++++++++++++++++++++++++++++++++++++
+ 4 files changed, 274 insertions(+), 271 deletions(-)
+
+diff --git a/fs/netfs/iterator.c b/fs/netfs/iterator.c
+index 9f09dc30ceb65..2ff07ba655a07 100644
+--- a/fs/netfs/iterator.c
++++ b/fs/netfs/iterator.c
+@@ -101,270 +101,3 @@ ssize_t netfs_extract_user_iter(struct iov_iter *orig, size_t orig_len,
+ return npages;
+ }
+ EXPORT_SYMBOL_GPL(netfs_extract_user_iter);
+-
+-/*
+- * Extract and pin a list of up to sg_max pages from UBUF- or IOVEC-class
+- * iterators, and add them to the scatterlist.
+- */
+-static ssize_t extract_user_to_sg(struct iov_iter *iter,
+- ssize_t maxsize,
+- struct sg_table *sgtable,
+- unsigned int sg_max,
+- iov_iter_extraction_t extraction_flags)
+-{
+- struct scatterlist *sg = sgtable->sgl + sgtable->nents;
+- struct page **pages;
+- unsigned int npages;
+- ssize_t ret = 0, res;
+- size_t len, off;
+-
+- /* We decant the page list into the tail of the scatterlist */
+- pages = (void *)sgtable->sgl +
+- array_size(sg_max, sizeof(struct scatterlist));
+- pages -= sg_max;
+-
+- do {
+- res = iov_iter_extract_pages(iter, &pages, maxsize, sg_max,
+- extraction_flags, &off);
+- if (res < 0)
+- goto failed;
+-
+- len = res;
+- maxsize -= len;
+- ret += len;
+- npages = DIV_ROUND_UP(off + len, PAGE_SIZE);
+- sg_max -= npages;
+-
+- for (; npages > 0; npages--) {
+- struct page *page = *pages;
+- size_t seg = min_t(size_t, PAGE_SIZE - off, len);
+-
+- *pages++ = NULL;
+- sg_set_page(sg, page, seg, off);
+- sgtable->nents++;
+- sg++;
+- len -= seg;
+- off = 0;
+- }
+- } while (maxsize > 0 && sg_max > 0);
+-
+- return ret;
+-
+-failed:
+- while (sgtable->nents > sgtable->orig_nents)
+- put_page(sg_page(&sgtable->sgl[--sgtable->nents]));
+- return res;
+-}
+-
+-/*
+- * Extract up to sg_max pages from a BVEC-type iterator and add them to the
+- * scatterlist. The pages are not pinned.
+- */
+-static ssize_t extract_bvec_to_sg(struct iov_iter *iter,
+- ssize_t maxsize,
+- struct sg_table *sgtable,
+- unsigned int sg_max,
+- iov_iter_extraction_t extraction_flags)
+-{
+- const struct bio_vec *bv = iter->bvec;
+- struct scatterlist *sg = sgtable->sgl + sgtable->nents;
+- unsigned long start = iter->iov_offset;
+- unsigned int i;
+- ssize_t ret = 0;
+-
+- for (i = 0; i < iter->nr_segs; i++) {
+- size_t off, len;
+-
+- len = bv[i].bv_len;
+- if (start >= len) {
+- start -= len;
+- continue;
+- }
+-
+- len = min_t(size_t, maxsize, len - start);
+- off = bv[i].bv_offset + start;
+-
+- sg_set_page(sg, bv[i].bv_page, len, off);
+- sgtable->nents++;
+- sg++;
+- sg_max--;
+-
+- ret += len;
+- maxsize -= len;
+- if (maxsize <= 0 || sg_max == 0)
+- break;
+- start = 0;
+- }
+-
+- if (ret > 0)
+- iov_iter_advance(iter, ret);
+- return ret;
+-}
+-
+-/*
+- * Extract up to sg_max pages from a KVEC-type iterator and add them to the
+- * scatterlist. This can deal with vmalloc'd buffers as well as kmalloc'd or
+- * static buffers. The pages are not pinned.
+- */
+-static ssize_t extract_kvec_to_sg(struct iov_iter *iter,
+- ssize_t maxsize,
+- struct sg_table *sgtable,
+- unsigned int sg_max,
+- iov_iter_extraction_t extraction_flags)
+-{
+- const struct kvec *kv = iter->kvec;
+- struct scatterlist *sg = sgtable->sgl + sgtable->nents;
+- unsigned long start = iter->iov_offset;
+- unsigned int i;
+- ssize_t ret = 0;
+-
+- for (i = 0; i < iter->nr_segs; i++) {
+- struct page *page;
+- unsigned long kaddr;
+- size_t off, len, seg;
+-
+- len = kv[i].iov_len;
+- if (start >= len) {
+- start -= len;
+- continue;
+- }
+-
+- kaddr = (unsigned long)kv[i].iov_base + start;
+- off = kaddr & ~PAGE_MASK;
+- len = min_t(size_t, maxsize, len - start);
+- kaddr &= PAGE_MASK;
+-
+- maxsize -= len;
+- ret += len;
+- do {
+- seg = min_t(size_t, len, PAGE_SIZE - off);
+- if (is_vmalloc_or_module_addr((void *)kaddr))
+- page = vmalloc_to_page((void *)kaddr);
+- else
+- page = virt_to_page(kaddr);
+-
+- sg_set_page(sg, page, len, off);
+- sgtable->nents++;
+- sg++;
+- sg_max--;
+-
+- len -= seg;
+- kaddr += PAGE_SIZE;
+- off = 0;
+- } while (len > 0 && sg_max > 0);
+-
+- if (maxsize <= 0 || sg_max == 0)
+- break;
+- start = 0;
+- }
+-
+- if (ret > 0)
+- iov_iter_advance(iter, ret);
+- return ret;
+-}
+-
+-/*
+- * Extract up to sg_max folios from an XARRAY-type iterator and add them to
+- * the scatterlist. The pages are not pinned.
+- */
+-static ssize_t extract_xarray_to_sg(struct iov_iter *iter,
+- ssize_t maxsize,
+- struct sg_table *sgtable,
+- unsigned int sg_max,
+- iov_iter_extraction_t extraction_flags)
+-{
+- struct scatterlist *sg = sgtable->sgl + sgtable->nents;
+- struct xarray *xa = iter->xarray;
+- struct folio *folio;
+- loff_t start = iter->xarray_start + iter->iov_offset;
+- pgoff_t index = start / PAGE_SIZE;
+- ssize_t ret = 0;
+- size_t offset, len;
+- XA_STATE(xas, xa, index);
+-
+- rcu_read_lock();
+-
+- xas_for_each(&xas, folio, ULONG_MAX) {
+- if (xas_retry(&xas, folio))
+- continue;
+- if (WARN_ON(xa_is_value(folio)))
+- break;
+- if (WARN_ON(folio_test_hugetlb(folio)))
+- break;
+-
+- offset = offset_in_folio(folio, start);
+- len = min_t(size_t, maxsize, folio_size(folio) - offset);
+-
+- sg_set_page(sg, folio_page(folio, 0), len, offset);
+- sgtable->nents++;
+- sg++;
+- sg_max--;
+-
+- maxsize -= len;
+- ret += len;
+- if (maxsize <= 0 || sg_max == 0)
+- break;
+- }
+-
+- rcu_read_unlock();
+- if (ret > 0)
+- iov_iter_advance(iter, ret);
+- return ret;
+-}
+-
+-/**
+- * extract_iter_to_sg - Extract pages from an iterator and add to an sglist
+- * @iter: The iterator to extract from
+- * @maxsize: The amount of iterator to copy
+- * @sgtable: The scatterlist table to fill in
+- * @sg_max: Maximum number of elements in @sgtable that may be filled
+- * @extraction_flags: Flags to qualify the request
+- *
+- * Extract the page fragments from the given amount of the source iterator and
+- * add them to a scatterlist that refers to all of those bits, to a maximum
+- * addition of @sg_max elements.
+- *
+- * The pages referred to by UBUF- and IOVEC-type iterators are extracted and
+- * pinned; BVEC-, KVEC- and XARRAY-type are extracted but aren't pinned; PIPE-
+- * and DISCARD-type are not supported.
+- *
+- * No end mark is placed on the scatterlist; that's left to the caller.
+- *
+- * @extraction_flags can have ITER_ALLOW_P2PDMA set to request peer-to-peer DMA
+- * be allowed on the pages extracted.
+- *
+- * If successful, @sgtable->nents is updated to include the number of elements
+- * added and the number of bytes added is returned. @sgtable->orig_nents is
+- * left unaltered.
+- *
+- * The iov_iter_extract_mode() function should be used to query how cleanup
+- * should be performed.
+- */
+-ssize_t extract_iter_to_sg(struct iov_iter *iter, size_t maxsize,
+- struct sg_table *sgtable, unsigned int sg_max,
+- iov_iter_extraction_t extraction_flags)
+-{
+- if (maxsize == 0)
+- return 0;
+-
+- switch (iov_iter_type(iter)) {
+- case ITER_UBUF:
+- case ITER_IOVEC:
+- return extract_user_to_sg(iter, maxsize, sgtable, sg_max,
+- extraction_flags);
+- case ITER_BVEC:
+- return extract_bvec_to_sg(iter, maxsize, sgtable, sg_max,
+- extraction_flags);
+- case ITER_KVEC:
+- return extract_kvec_to_sg(iter, maxsize, sgtable, sg_max,
+- extraction_flags);
+- case ITER_XARRAY:
+- return extract_xarray_to_sg(iter, maxsize, sgtable, sg_max,
+- extraction_flags);
+- default:
+- pr_err("%s(%u) unsupported\n", __func__, iov_iter_type(iter));
+- WARN_ON_ONCE(1);
+- return -EIO;
+- }
+-}
+-EXPORT_SYMBOL_GPL(extract_iter_to_sg);
+diff --git a/include/linux/netfs.h b/include/linux/netfs.h
+index 55e201c3a8416..b11a84f6c32b7 100644
+--- a/include/linux/netfs.h
++++ b/include/linux/netfs.h
+@@ -300,10 +300,6 @@ void netfs_stats_show(struct seq_file *);
+ ssize_t netfs_extract_user_iter(struct iov_iter *orig, size_t orig_len,
+ struct iov_iter *new,
+ iov_iter_extraction_t extraction_flags);
+-struct sg_table;
+-ssize_t extract_iter_to_sg(struct iov_iter *iter, size_t len,
+- struct sg_table *sgtable, unsigned int sg_max,
+- iov_iter_extraction_t extraction_flags);
+
+ /**
+ * netfs_inode - Get the netfs inode context from the inode
+diff --git a/include/linux/uio.h b/include/linux/uio.h
+index 044c1d8c230cf..0ccb983cf645a 100644
+--- a/include/linux/uio.h
++++ b/include/linux/uio.h
+@@ -433,4 +433,9 @@ static inline bool iov_iter_extract_will_pin(const struct iov_iter *iter)
+ return user_backed_iter(iter);
+ }
+
++struct sg_table;
++ssize_t extract_iter_to_sg(struct iov_iter *iter, size_t len,
++ struct sg_table *sgtable, unsigned int sg_max,
++ iov_iter_extraction_t extraction_flags);
++
+ #endif
+diff --git a/lib/scatterlist.c b/lib/scatterlist.c
+index 8d7519a8f308d..e97d7060329e8 100644
+--- a/lib/scatterlist.c
++++ b/lib/scatterlist.c
+@@ -9,6 +9,8 @@
+ #include <linux/scatterlist.h>
+ #include <linux/highmem.h>
+ #include <linux/kmemleak.h>
++#include <linux/bvec.h>
++#include <linux/uio.h>
+
+ /**
+ * sg_next - return the next scatterlist entry in a list
+@@ -1095,3 +1097,270 @@ size_t sg_zero_buffer(struct scatterlist *sgl, unsigned int nents,
+ return offset;
+ }
+ EXPORT_SYMBOL(sg_zero_buffer);
++
++/*
++ * Extract and pin a list of up to sg_max pages from UBUF- or IOVEC-class
++ * iterators, and add them to the scatterlist.
++ */
++static ssize_t extract_user_to_sg(struct iov_iter *iter,
++ ssize_t maxsize,
++ struct sg_table *sgtable,
++ unsigned int sg_max,
++ iov_iter_extraction_t extraction_flags)
++{
++ struct scatterlist *sg = sgtable->sgl + sgtable->nents;
++ struct page **pages;
++ unsigned int npages;
++ ssize_t ret = 0, res;
++ size_t len, off;
++
++ /* We decant the page list into the tail of the scatterlist */
++ pages = (void *)sgtable->sgl +
++ array_size(sg_max, sizeof(struct scatterlist));
++ pages -= sg_max;
++
++ do {
++ res = iov_iter_extract_pages(iter, &pages, maxsize, sg_max,
++ extraction_flags, &off);
++ if (res < 0)
++ goto failed;
++
++ len = res;
++ maxsize -= len;
++ ret += len;
++ npages = DIV_ROUND_UP(off + len, PAGE_SIZE);
++ sg_max -= npages;
++
++ for (; npages > 0; npages--) {
++ struct page *page = *pages;
++ size_t seg = min_t(size_t, PAGE_SIZE - off, len);
++
++ *pages++ = NULL;
++ sg_set_page(sg, page, seg, off);
++ sgtable->nents++;
++ sg++;
++ len -= seg;
++ off = 0;
++ }
++ } while (maxsize > 0 && sg_max > 0);
++
++ return ret;
++
++failed:
++ while (sgtable->nents > sgtable->orig_nents)
++ put_page(sg_page(&sgtable->sgl[--sgtable->nents]));
++ return res;
++}
++
++/*
++ * Extract up to sg_max pages from a BVEC-type iterator and add them to the
++ * scatterlist. The pages are not pinned.
++ */
++static ssize_t extract_bvec_to_sg(struct iov_iter *iter,
++ ssize_t maxsize,
++ struct sg_table *sgtable,
++ unsigned int sg_max,
++ iov_iter_extraction_t extraction_flags)
++{
++ const struct bio_vec *bv = iter->bvec;
++ struct scatterlist *sg = sgtable->sgl + sgtable->nents;
++ unsigned long start = iter->iov_offset;
++ unsigned int i;
++ ssize_t ret = 0;
++
++ for (i = 0; i < iter->nr_segs; i++) {
++ size_t off, len;
++
++ len = bv[i].bv_len;
++ if (start >= len) {
++ start -= len;
++ continue;
++ }
++
++ len = min_t(size_t, maxsize, len - start);
++ off = bv[i].bv_offset + start;
++
++ sg_set_page(sg, bv[i].bv_page, len, off);
++ sgtable->nents++;
++ sg++;
++ sg_max--;
++
++ ret += len;
++ maxsize -= len;
++ if (maxsize <= 0 || sg_max == 0)
++ break;
++ start = 0;
++ }
++
++ if (ret > 0)
++ iov_iter_advance(iter, ret);
++ return ret;
++}
++
++/*
++ * Extract up to sg_max pages from a KVEC-type iterator and add them to the
++ * scatterlist. This can deal with vmalloc'd buffers as well as kmalloc'd or
++ * static buffers. The pages are not pinned.
++ */
++static ssize_t extract_kvec_to_sg(struct iov_iter *iter,
++ ssize_t maxsize,
++ struct sg_table *sgtable,
++ unsigned int sg_max,
++ iov_iter_extraction_t extraction_flags)
++{
++ const struct kvec *kv = iter->kvec;
++ struct scatterlist *sg = sgtable->sgl + sgtable->nents;
++ unsigned long start = iter->iov_offset;
++ unsigned int i;
++ ssize_t ret = 0;
++
++ for (i = 0; i < iter->nr_segs; i++) {
++ struct page *page;
++ unsigned long kaddr;
++ size_t off, len, seg;
++
++ len = kv[i].iov_len;
++ if (start >= len) {
++ start -= len;
++ continue;
++ }
++
++ kaddr = (unsigned long)kv[i].iov_base + start;
++ off = kaddr & ~PAGE_MASK;
++ len = min_t(size_t, maxsize, len - start);
++ kaddr &= PAGE_MASK;
++
++ maxsize -= len;
++ ret += len;
++ do {
++ seg = min_t(size_t, len, PAGE_SIZE - off);
++ if (is_vmalloc_or_module_addr((void *)kaddr))
++ page = vmalloc_to_page((void *)kaddr);
++ else
++ page = virt_to_page(kaddr);
++
++ sg_set_page(sg, page, len, off);
++ sgtable->nents++;
++ sg++;
++ sg_max--;
++
++ len -= seg;
++ kaddr += PAGE_SIZE;
++ off = 0;
++ } while (len > 0 && sg_max > 0);
++
++ if (maxsize <= 0 || sg_max == 0)
++ break;
++ start = 0;
++ }
++
++ if (ret > 0)
++ iov_iter_advance(iter, ret);
++ return ret;
++}
++
++/*
++ * Extract up to sg_max folios from an XARRAY-type iterator and add them to
++ * the scatterlist. The pages are not pinned.
++ */
++static ssize_t extract_xarray_to_sg(struct iov_iter *iter,
++ ssize_t maxsize,
++ struct sg_table *sgtable,
++ unsigned int sg_max,
++ iov_iter_extraction_t extraction_flags)
++{
++ struct scatterlist *sg = sgtable->sgl + sgtable->nents;
++ struct xarray *xa = iter->xarray;
++ struct folio *folio;
++ loff_t start = iter->xarray_start + iter->iov_offset;
++ pgoff_t index = start / PAGE_SIZE;
++ ssize_t ret = 0;
++ size_t offset, len;
++ XA_STATE(xas, xa, index);
++
++ rcu_read_lock();
++
++ xas_for_each(&xas, folio, ULONG_MAX) {
++ if (xas_retry(&xas, folio))
++ continue;
++ if (WARN_ON(xa_is_value(folio)))
++ break;
++ if (WARN_ON(folio_test_hugetlb(folio)))
++ break;
++
++ offset = offset_in_folio(folio, start);
++ len = min_t(size_t, maxsize, folio_size(folio) - offset);
++
++ sg_set_page(sg, folio_page(folio, 0), len, offset);
++ sgtable->nents++;
++ sg++;
++ sg_max--;
++
++ maxsize -= len;
++ ret += len;
++ if (maxsize <= 0 || sg_max == 0)
++ break;
++ }
++
++ rcu_read_unlock();
++ if (ret > 0)
++ iov_iter_advance(iter, ret);
++ return ret;
++}
++
++/**
++ * extract_iter_to_sg - Extract pages from an iterator and add to an sglist
++ * @iter: The iterator to extract from
++ * @maxsize: The amount of iterator to copy
++ * @sgtable: The scatterlist table to fill in
++ * @sg_max: Maximum number of elements in @sgtable that may be filled
++ * @extraction_flags: Flags to qualify the request
++ *
++ * Extract the page fragments from the given amount of the source iterator and
++ * add them to a scatterlist that refers to all of those bits, to a maximum
++ * addition of @sg_max elements.
++ *
++ * The pages referred to by UBUF- and IOVEC-type iterators are extracted and
++ * pinned; BVEC-, KVEC- and XARRAY-type are extracted but aren't pinned; PIPE-
++ * and DISCARD-type are not supported.
++ *
++ * No end mark is placed on the scatterlist; that's left to the caller.
++ *
++ * @extraction_flags can have ITER_ALLOW_P2PDMA set to request peer-to-peer DMA
++ * be allowed on the pages extracted.
++ *
++ * If successful, @sgtable->nents is updated to include the number of elements
++ * added and the number of bytes added is returned. @sgtable->orig_nents is
++ * left unaltered.
++ *
++ * The iov_iter_extract_mode() function should be used to query how cleanup
++ * should be performed.
++ */
++ssize_t extract_iter_to_sg(struct iov_iter *iter, size_t maxsize,
++ struct sg_table *sgtable, unsigned int sg_max,
++ iov_iter_extraction_t extraction_flags)
++{
++ if (maxsize == 0)
++ return 0;
++
++ switch (iov_iter_type(iter)) {
++ case ITER_UBUF:
++ case ITER_IOVEC:
++ return extract_user_to_sg(iter, maxsize, sgtable, sg_max,
++ extraction_flags);
++ case ITER_BVEC:
++ return extract_bvec_to_sg(iter, maxsize, sgtable, sg_max,
++ extraction_flags);
++ case ITER_KVEC:
++ return extract_kvec_to_sg(iter, maxsize, sgtable, sg_max,
++ extraction_flags);
++ case ITER_XARRAY:
++ return extract_xarray_to_sg(iter, maxsize, sgtable, sg_max,
++ extraction_flags);
++ default:
++ pr_err("%s(%u) unsupported\n", __func__, iov_iter_type(iter));
++ WARN_ON_ONCE(1);
++ return -EIO;
++ }
++}
++EXPORT_SYMBOL_GPL(extract_iter_to_sg);
+--
+2.40.1
+
--- /dev/null
+From 150a606d3cbb3da1f2e1a8cd290726fc3250e977 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Aug 2023 14:13:46 -0500
+Subject: net: phy: at803x: fix the wol setting functions
+
+From: Li Yang <leoyang.li@nxp.com>
+
+[ Upstream commit e58f30246c35c126c7571065b33bee4b3b1d2ef8 ]
+
+In commit 7beecaf7d507 ("net: phy: at803x: improve the WOL feature"), it
+seems not correct to use a wol_en bit in a 1588 Control Register which is
+only available on AR8031/AR8033(share the same phy_id) to determine if WoL
+is enabled. Change it back to use AT803X_INTR_ENABLE_WOL for determining
+the WoL status which is applicable on all chips supporting wol. Also update
+the at803x_set_wol() function to only update the 1588 register on chips
+having it. After this change, disabling wol at probe from commit
+d7cd5e06c9dd ("net: phy: at803x: disable WOL at probe") is no longer
+needed. Change it to just disable the WoL bit in 1588 register for
+AR8031/AR8033 to be aligned with AT803X_INTR_ENABLE_WOL in probe.
+
+Fixes: 7beecaf7d507 ("net: phy: at803x: improve the WOL feature")
+Signed-off-by: Li Yang <leoyang.li@nxp.com>
+Reviewed-by: Viorel Suman <viorel.suman@nxp.com>
+Reviewed-by: Wei Fang <wei.fang@nxp.com>
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/at803x.c | 45 ++++++++++++++++++++++------------------
+ 1 file changed, 25 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c
+index b2e1c0655f628..8a77ec33b4172 100644
+--- a/drivers/net/phy/at803x.c
++++ b/drivers/net/phy/at803x.c
+@@ -459,21 +459,27 @@ static int at803x_set_wol(struct phy_device *phydev,
+ phy_write_mmd(phydev, MDIO_MMD_PCS, offsets[i],
+ mac[(i * 2) + 1] | (mac[(i * 2)] << 8));
+
+- /* Enable WOL function */
+- ret = phy_modify_mmd(phydev, MDIO_MMD_PCS, AT803X_PHY_MMD3_WOL_CTRL,
+- 0, AT803X_WOL_EN);
+- if (ret)
+- return ret;
++ /* Enable WOL function for 1588 */
++ if (phydev->drv->phy_id == ATH8031_PHY_ID) {
++ ret = phy_modify_mmd(phydev, MDIO_MMD_PCS,
++ AT803X_PHY_MMD3_WOL_CTRL,
++ 0, AT803X_WOL_EN);
++ if (ret)
++ return ret;
++ }
+ /* Enable WOL interrupt */
+ ret = phy_modify(phydev, AT803X_INTR_ENABLE, 0, AT803X_INTR_ENABLE_WOL);
+ if (ret)
+ return ret;
+ } else {
+- /* Disable WoL function */
+- ret = phy_modify_mmd(phydev, MDIO_MMD_PCS, AT803X_PHY_MMD3_WOL_CTRL,
+- AT803X_WOL_EN, 0);
+- if (ret)
+- return ret;
++ /* Disable WoL function for 1588 */
++ if (phydev->drv->phy_id == ATH8031_PHY_ID) {
++ ret = phy_modify_mmd(phydev, MDIO_MMD_PCS,
++ AT803X_PHY_MMD3_WOL_CTRL,
++ AT803X_WOL_EN, 0);
++ if (ret)
++ return ret;
++ }
+ /* Disable WOL interrupt */
+ ret = phy_modify(phydev, AT803X_INTR_ENABLE, AT803X_INTR_ENABLE_WOL, 0);
+ if (ret)
+@@ -508,11 +514,11 @@ static void at803x_get_wol(struct phy_device *phydev,
+ wol->supported = WAKE_MAGIC;
+ wol->wolopts = 0;
+
+- value = phy_read_mmd(phydev, MDIO_MMD_PCS, AT803X_PHY_MMD3_WOL_CTRL);
++ value = phy_read(phydev, AT803X_INTR_ENABLE);
+ if (value < 0)
+ return;
+
+- if (value & AT803X_WOL_EN)
++ if (value & AT803X_INTR_ENABLE_WOL)
+ wol->wolopts |= WAKE_MAGIC;
+ }
+
+@@ -858,9 +864,6 @@ static int at803x_probe(struct phy_device *phydev)
+ if (phydev->drv->phy_id == ATH8031_PHY_ID) {
+ int ccr = phy_read(phydev, AT803X_REG_CHIP_CONFIG);
+ int mode_cfg;
+- struct ethtool_wolinfo wol = {
+- .wolopts = 0,
+- };
+
+ if (ccr < 0)
+ return ccr;
+@@ -877,12 +880,14 @@ static int at803x_probe(struct phy_device *phydev)
+ break;
+ }
+
+- /* Disable WOL by default */
+- ret = at803x_set_wol(phydev, &wol);
+- if (ret < 0) {
+- phydev_err(phydev, "failed to disable WOL on probe: %d\n", ret);
++ /* Disable WoL in 1588 register which is enabled
++ * by default
++ */
++ ret = phy_modify_mmd(phydev, MDIO_MMD_PCS,
++ AT803X_PHY_MMD3_WOL_CTRL,
++ AT803X_WOL_EN, 0);
++ if (ret)
+ return ret;
+- }
+ }
+
+ return 0;
+--
+2.40.1
+
--- /dev/null
+From 7b36946a1ac5bed0a0225ca8311b7720a4736479 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Jun 2023 16:24:37 +0200
+Subject: net: phy: at803x: Use devm_regulator_get_enable_optional()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 988e8d90b3dc482637532e61bc2d58bfc4af5167 ]
+
+Use devm_regulator_get_enable_optional() instead of hand writing it. It
+saves some line of code.
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Stable-dep-of: e58f30246c35 ("net: phy: at803x: fix the wol setting functions")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/at803x.c | 44 +++++++---------------------------------
+ 1 file changed, 7 insertions(+), 37 deletions(-)
+
+diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c
+index ef6dc008e4c50..b2e1c0655f628 100644
+--- a/drivers/net/phy/at803x.c
++++ b/drivers/net/phy/at803x.c
+@@ -304,7 +304,6 @@ struct at803x_priv {
+ bool is_1000basex;
+ struct regulator_dev *vddio_rdev;
+ struct regulator_dev *vddh_rdev;
+- struct regulator *vddio;
+ u64 stats[ARRAY_SIZE(at803x_hw_stats)];
+ };
+
+@@ -824,11 +823,11 @@ static int at803x_parse_dt(struct phy_device *phydev)
+ if (ret < 0)
+ return ret;
+
+- priv->vddio = devm_regulator_get_optional(&phydev->mdio.dev,
+- "vddio");
+- if (IS_ERR(priv->vddio)) {
++ ret = devm_regulator_get_enable_optional(&phydev->mdio.dev,
++ "vddio");
++ if (ret) {
+ phydev_err(phydev, "failed to get VDDIO regulator\n");
+- return PTR_ERR(priv->vddio);
++ return ret;
+ }
+
+ /* Only AR8031/8033 support 1000Base-X for SFP modules */
+@@ -856,12 +855,6 @@ static int at803x_probe(struct phy_device *phydev)
+ if (ret)
+ return ret;
+
+- if (priv->vddio) {
+- ret = regulator_enable(priv->vddio);
+- if (ret < 0)
+- return ret;
+- }
+-
+ if (phydev->drv->phy_id == ATH8031_PHY_ID) {
+ int ccr = phy_read(phydev, AT803X_REG_CHIP_CONFIG);
+ int mode_cfg;
+@@ -869,10 +862,8 @@ static int at803x_probe(struct phy_device *phydev)
+ .wolopts = 0,
+ };
+
+- if (ccr < 0) {
+- ret = ccr;
+- goto err;
+- }
++ if (ccr < 0)
++ return ccr;
+ mode_cfg = ccr & AT803X_MODE_CFG_MASK;
+
+ switch (mode_cfg) {
+@@ -890,25 +881,11 @@ static int at803x_probe(struct phy_device *phydev)
+ ret = at803x_set_wol(phydev, &wol);
+ if (ret < 0) {
+ phydev_err(phydev, "failed to disable WOL on probe: %d\n", ret);
+- goto err;
++ return ret;
+ }
+ }
+
+ return 0;
+-
+-err:
+- if (priv->vddio)
+- regulator_disable(priv->vddio);
+-
+- return ret;
+-}
+-
+-static void at803x_remove(struct phy_device *phydev)
+-{
+- struct at803x_priv *priv = phydev->priv;
+-
+- if (priv->vddio)
+- regulator_disable(priv->vddio);
+ }
+
+ static int at803x_get_features(struct phy_device *phydev)
+@@ -2021,7 +1998,6 @@ static struct phy_driver at803x_driver[] = {
+ .name = "Qualcomm Atheros AR8035",
+ .flags = PHY_POLL_CABLE_TEST,
+ .probe = at803x_probe,
+- .remove = at803x_remove,
+ .config_aneg = at803x_config_aneg,
+ .config_init = at803x_config_init,
+ .soft_reset = genphy_soft_reset,
+@@ -2043,7 +2019,6 @@ static struct phy_driver at803x_driver[] = {
+ .name = "Qualcomm Atheros AR8030",
+ .phy_id_mask = AT8030_PHY_ID_MASK,
+ .probe = at803x_probe,
+- .remove = at803x_remove,
+ .config_init = at803x_config_init,
+ .link_change_notify = at803x_link_change_notify,
+ .set_wol = at803x_set_wol,
+@@ -2059,7 +2034,6 @@ static struct phy_driver at803x_driver[] = {
+ .name = "Qualcomm Atheros AR8031/AR8033",
+ .flags = PHY_POLL_CABLE_TEST,
+ .probe = at803x_probe,
+- .remove = at803x_remove,
+ .config_init = at803x_config_init,
+ .config_aneg = at803x_config_aneg,
+ .soft_reset = genphy_soft_reset,
+@@ -2082,7 +2056,6 @@ static struct phy_driver at803x_driver[] = {
+ PHY_ID_MATCH_EXACT(ATH8032_PHY_ID),
+ .name = "Qualcomm Atheros AR8032",
+ .probe = at803x_probe,
+- .remove = at803x_remove,
+ .flags = PHY_POLL_CABLE_TEST,
+ .config_init = at803x_config_init,
+ .link_change_notify = at803x_link_change_notify,
+@@ -2098,7 +2071,6 @@ static struct phy_driver at803x_driver[] = {
+ PHY_ID_MATCH_EXACT(ATH9331_PHY_ID),
+ .name = "Qualcomm Atheros AR9331 built-in PHY",
+ .probe = at803x_probe,
+- .remove = at803x_remove,
+ .suspend = at803x_suspend,
+ .resume = at803x_resume,
+ .flags = PHY_POLL_CABLE_TEST,
+@@ -2115,7 +2087,6 @@ static struct phy_driver at803x_driver[] = {
+ PHY_ID_MATCH_EXACT(QCA9561_PHY_ID),
+ .name = "Qualcomm Atheros QCA9561 built-in PHY",
+ .probe = at803x_probe,
+- .remove = at803x_remove,
+ .suspend = at803x_suspend,
+ .resume = at803x_resume,
+ .flags = PHY_POLL_CABLE_TEST,
+@@ -2181,7 +2152,6 @@ static struct phy_driver at803x_driver[] = {
+ .name = "Qualcomm QCA8081",
+ .flags = PHY_POLL_CABLE_TEST,
+ .probe = at803x_probe,
+- .remove = at803x_remove,
+ .config_intr = at803x_config_intr,
+ .handle_interrupt = at803x_handle_interrupt,
+ .get_tunable = at803x_get_tunable,
+--
+2.40.1
+
--- /dev/null
+From f577575976f4800ac8750de557748de91d328e78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Aug 2023 10:04:40 +0800
+Subject: nvme: core: don't hold rcu read lock in nvme_ns_chr_uring_cmd_iopoll
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit a7a7dabb5dd72d2875bc3ce56f94ea5ceb259d5b ]
+
+Now nvme_ns_chr_uring_cmd_iopoll() has switched to request based io
+polling, and the associated NS is guaranteed to be live in case of
+io polling, so request is guaranteed to be valid because blk-mq uses
+pre-allocated request pool.
+
+Remove the rcu read lock in nvme_ns_chr_uring_cmd_iopoll(), which
+isn't needed any more after switching to request based io polling.
+
+Fix "BUG: sleeping function called from invalid context" because
+set_page_dirty_lock() from blk_rq_unmap_user() may sleep.
+
+Fixes: 585079b6e425 ("nvme: wire up async polling for io passthrough commands")
+Reported-by: Guangwu Zhang <guazhang@redhat.com>
+Cc: Kanchan Joshi <joshi.k@samsung.com>
+Cc: Anuj Gupta <anuj20.g@samsung.com>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Tested-by: Guangwu Zhang <guazhang@redhat.com>
+Link: https://lore.kernel.org/r/20230809020440.174682-1-ming.lei@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/ioctl.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c
+index f15e7330b75ac..642f0310da278 100644
+--- a/drivers/nvme/host/ioctl.c
++++ b/drivers/nvme/host/ioctl.c
+@@ -787,14 +787,12 @@ int nvme_ns_chr_uring_cmd_iopoll(struct io_uring_cmd *ioucmd,
+ struct nvme_ns *ns;
+ struct request_queue *q;
+
+- rcu_read_lock();
+ bio = READ_ONCE(ioucmd->cookie);
+ ns = container_of(file_inode(ioucmd->file)->i_cdev,
+ struct nvme_ns, cdev);
+ q = ns->queue;
+ if (test_bit(QUEUE_FLAG_POLL, &q->queue_flags) && bio && bio->bi_bdev)
+ ret = bio_poll(bio, iob, poll_flags);
+- rcu_read_unlock();
+ return ret;
+ }
+ #ifdef CONFIG_NVME_MULTIPATH
+--
+2.40.1
+
--- /dev/null
+From 7b98ebe5132eb14a1740ec9e095015c76159f987 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 May 2023 23:02:09 +0530
+Subject: PCI: tegra194: Fix possible array out of bounds access
+
+From: Sumit Gupta <sumitg@nvidia.com>
+
+[ Upstream commit 205b3d02d57ce6dce96f6d2b9c230f56a9bf9817 ]
+
+Add check to fix the possible array out of bounds violation by
+making speed equal to GEN1_CORE_CLK_FREQ when its value is more
+than the size of "pcie_gen_freq" array. This array has size of
+four but possible speed (CLS) values are from "0 to 0xF". So,
+"speed - 1" values are "-1 to 0xE".
+
+Suggested-by: Bjorn Helgaas <helgaas@kernel.org>
+Signed-off-by: Sumit Gupta <sumitg@nvidia.com>
+Link: https://lore.kernel.org/lkml/72b9168b-d4d6-4312-32ea-69358df2f2d0@nvidia.com/
+Acked-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-tegra194.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c
+index 09825b4a075e5..e6eec85480ca9 100644
+--- a/drivers/pci/controller/dwc/pcie-tegra194.c
++++ b/drivers/pci/controller/dwc/pcie-tegra194.c
+@@ -223,6 +223,7 @@
+ #define EP_STATE_ENABLED 1
+
+ static const unsigned int pcie_gen_freq[] = {
++ GEN1_CORE_CLK_FREQ, /* PCI_EXP_LNKSTA_CLS == 0; undefined */
+ GEN1_CORE_CLK_FREQ,
+ GEN2_CORE_CLK_FREQ,
+ GEN3_CORE_CLK_FREQ,
+@@ -459,7 +460,11 @@ static irqreturn_t tegra_pcie_ep_irq_thread(int irq, void *arg)
+
+ speed = dw_pcie_readw_dbi(pci, pcie->pcie_cap_base + PCI_EXP_LNKSTA) &
+ PCI_EXP_LNKSTA_CLS;
+- clk_set_rate(pcie->core_clk, pcie_gen_freq[speed - 1]);
++
++ if (speed >= ARRAY_SIZE(pcie_gen_freq))
++ speed = 0;
++
++ clk_set_rate(pcie->core_clk, pcie_gen_freq[speed]);
+
+ if (pcie->of_data->has_ltr_req_fix)
+ return IRQ_HANDLED;
+@@ -1020,7 +1025,11 @@ static int tegra_pcie_dw_start_link(struct dw_pcie *pci)
+
+ speed = dw_pcie_readw_dbi(pci, pcie->pcie_cap_base + PCI_EXP_LNKSTA) &
+ PCI_EXP_LNKSTA_CLS;
+- clk_set_rate(pcie->core_clk, pcie_gen_freq[speed - 1]);
++
++ if (speed >= ARRAY_SIZE(pcie_gen_freq))
++ speed = 0;
++
++ clk_set_rate(pcie->core_clk, pcie_gen_freq[speed]);
+
+ tegra_pcie_enable_interrupts(pp);
+
+--
+2.40.1
+
--- /dev/null
+From cf7283d8179d4fedd4683b12325975ccf00f0422 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 May 2023 20:45:29 +0200
+Subject: pcmcia: rsrc_nonstatic: Fix memory leak in
+ nonstatic_release_resource_db()
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit c85fd9422fe0f5d667305efb27f56d09eab120b0 ]
+
+When nonstatic_release_resource_db() frees all resources associated
+with an PCMCIA socket, it forgets to free socket_data too, causing
+a memory leak observable with kmemleak:
+
+unreferenced object 0xc28d1000 (size 64):
+ comm "systemd-udevd", pid 297, jiffies 4294898478 (age 194.484s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 f0 85 0e c3 00 00 00 00 ................
+ 00 00 00 00 0c 10 8d c2 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<ffda4245>] __kmem_cache_alloc_node+0x2d7/0x4a0
+ [<7e51f0c8>] kmalloc_trace+0x31/0xa4
+ [<d52b4ca0>] nonstatic_init+0x24/0x1a4 [pcmcia_rsrc]
+ [<a2f13e08>] pcmcia_register_socket+0x200/0x35c [pcmcia_core]
+ [<a728be1b>] yenta_probe+0x4d8/0xa70 [yenta_socket]
+ [<c48fac39>] pci_device_probe+0x99/0x194
+ [<84b7c690>] really_probe+0x181/0x45c
+ [<8060fe6e>] __driver_probe_device+0x75/0x1f4
+ [<b9b76f43>] driver_probe_device+0x28/0xac
+ [<648b766f>] __driver_attach+0xeb/0x1e4
+ [<6e9659eb>] bus_for_each_dev+0x61/0xb4
+ [<25a669f3>] driver_attach+0x1e/0x28
+ [<d8671d6b>] bus_add_driver+0x102/0x20c
+ [<df0d323c>] driver_register+0x5b/0x120
+ [<942cd8a4>] __pci_register_driver+0x44/0x4c
+ [<e536027e>] __UNIQUE_ID___addressable_cleanup_module188+0x1c/0xfffff000 [iTCO_vendor_support]
+
+Fix this by freeing socket_data too.
+
+Tested on a Acer Travelmate 4002WLMi by manually binding/unbinding
+the yenta_cardbus driver (yenta_socket).
+
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Message-ID: <20230512184529.5094-1-W_Armin@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pcmcia/rsrc_nonstatic.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c
+index 471e0c5815f39..bf9d070a44966 100644
+--- a/drivers/pcmcia/rsrc_nonstatic.c
++++ b/drivers/pcmcia/rsrc_nonstatic.c
+@@ -1053,6 +1053,8 @@ static void nonstatic_release_resource_db(struct pcmcia_socket *s)
+ q = p->next;
+ kfree(p);
+ }
++
++ kfree(data);
+ }
+
+
+--
+2.40.1
+
--- /dev/null
+From 02214200a85d6628a8b521d4459e972a96c1c834 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jul 2023 14:41:43 +1000
+Subject: powerpc/kasan: Disable KCOV in KASAN code
+
+From: Benjamin Gray <bgray@linux.ibm.com>
+
+[ Upstream commit ccb381e1af1ace292153c88eb1fffa5683d16a20 ]
+
+As per the generic KASAN code in mm/kasan, disable KCOV with
+KCOV_INSTRUMENT := n in the makefile.
+
+This fixes a ppc64 boot hang when KCOV and KASAN are enabled.
+kasan_early_init() gets called before a PACA is initialised, but the
+KCOV hook expects a valid PACA.
+
+Suggested-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Benjamin Gray <bgray@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230710044143.146840-1-bgray@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/kasan/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/mm/kasan/Makefile b/arch/powerpc/mm/kasan/Makefile
+index 699eeffd9f551..f9522fd70b2f3 100644
+--- a/arch/powerpc/mm/kasan/Makefile
++++ b/arch/powerpc/mm/kasan/Makefile
+@@ -1,6 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+
+ KASAN_SANITIZE := n
++KCOV_INSTRUMENT := n
+
+ obj-$(CONFIG_PPC32) += init_32.o
+ obj-$(CONFIG_PPC_8xx) += 8xx.o
+--
+2.40.1
+
--- /dev/null
+From 8dacd9698026095743f1bfb89ce7fc2e2748bb99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jun 2023 04:01:50 -0700
+Subject: RDMA/bnxt_re: consider timeout of destroy ah as success.
+
+From: Kashyap Desai <kashyap.desai@broadcom.com>
+
+[ Upstream commit bb8c93618fb0b8567d309f1aebc6df0cd31da1a2 ]
+
+If destroy_ah is timed out, it is likely to be destroyed by firmware
+but it is taking longer time due to temporary slowness
+in processing the rcfw command. In worst case, there might be
+AH resource leak in firmware.
+
+Sending timeout return value can dump warning message from ib_core
+which can be avoided if we map timeout of destroy_ah as success.
+
+Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Link: https://lore.kernel.org/r/1686308514-11996-14-git-send-email-selvin.xavier@broadcom.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/bnxt_re.h | 2 ++
+ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 16 ++++++++++++----
+ drivers/infiniband/hw/bnxt_re/qplib_sp.c | 8 +++++---
+ drivers/infiniband/hw/bnxt_re/qplib_sp.h | 4 ++--
+ 4 files changed, 21 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/bnxt_re.h b/drivers/infiniband/hw/bnxt_re/bnxt_re.h
+index 2c95e6f3d47ac..eef3ef3fabb42 100644
+--- a/drivers/infiniband/hw/bnxt_re/bnxt_re.h
++++ b/drivers/infiniband/hw/bnxt_re/bnxt_re.h
+@@ -179,6 +179,8 @@ struct bnxt_re_dev {
+ #define BNXT_RE_ROCEV2_IPV4_PACKET 2
+ #define BNXT_RE_ROCEV2_IPV6_PACKET 3
+
++#define BNXT_RE_CHECK_RC(x) ((x) && ((x) != -ETIMEDOUT))
++
+ static inline struct device *rdev_to_dev(struct bnxt_re_dev *rdev)
+ {
+ if (rdev)
+diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+index ebe6852c40e8c..e7f153ee27541 100644
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+@@ -614,12 +614,20 @@ int bnxt_re_destroy_ah(struct ib_ah *ib_ah, u32 flags)
+ {
+ struct bnxt_re_ah *ah = container_of(ib_ah, struct bnxt_re_ah, ib_ah);
+ struct bnxt_re_dev *rdev = ah->rdev;
++ bool block = true;
++ int rc = 0;
+
+- bnxt_qplib_destroy_ah(&rdev->qplib_res, &ah->qplib_ah,
+- !(flags & RDMA_DESTROY_AH_SLEEPABLE));
++ block = !(flags & RDMA_DESTROY_AH_SLEEPABLE);
++ rc = bnxt_qplib_destroy_ah(&rdev->qplib_res, &ah->qplib_ah, block);
++ if (BNXT_RE_CHECK_RC(rc)) {
++ if (rc == -ETIMEDOUT)
++ rc = 0;
++ else
++ goto fail;
++ }
+ atomic_dec(&rdev->ah_count);
+-
+- return 0;
++fail:
++ return rc;
+ }
+
+ static u8 bnxt_re_stack_to_dev_nw_type(enum rdma_network_type ntype)
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+index b967a17a44beb..10919532bca29 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+@@ -468,13 +468,14 @@ int bnxt_qplib_create_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah,
+ return 0;
+ }
+
+-void bnxt_qplib_destroy_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah,
+- bool block)
++int bnxt_qplib_destroy_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah,
++ bool block)
+ {
+ struct bnxt_qplib_rcfw *rcfw = res->rcfw;
+ struct creq_destroy_ah_resp resp = {};
+ struct bnxt_qplib_cmdqmsg msg = {};
+ struct cmdq_destroy_ah req = {};
++ int rc;
+
+ /* Clean up the AH table in the device */
+ bnxt_qplib_rcfw_cmd_prep((struct cmdq_base *)&req,
+@@ -485,7 +486,8 @@ void bnxt_qplib_destroy_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah,
+
+ bnxt_qplib_fill_cmdqmsg(&msg, &req, &resp, NULL, sizeof(req),
+ sizeof(resp), block);
+- bnxt_qplib_rcfw_send_message(rcfw, &msg);
++ rc = bnxt_qplib_rcfw_send_message(rcfw, &msg);
++ return rc;
+ }
+
+ /* MRW */
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.h b/drivers/infiniband/hw/bnxt_re/qplib_sp.h
+index 5de874659cdfa..4061616048e85 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.h
++++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.h
+@@ -327,8 +327,8 @@ int bnxt_qplib_set_func_resources(struct bnxt_qplib_res *res,
+ struct bnxt_qplib_ctx *ctx);
+ int bnxt_qplib_create_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah,
+ bool block);
+-void bnxt_qplib_destroy_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah,
+- bool block);
++int bnxt_qplib_destroy_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah,
++ bool block);
+ int bnxt_qplib_alloc_mrw(struct bnxt_qplib_res *res,
+ struct bnxt_qplib_mrw *mrw);
+ int bnxt_qplib_dereg_mrw(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mrw,
+--
+2.40.1
+
--- /dev/null
+From e444d3b6dfa3c502e8693f4a2dcf48d382e0f98d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 May 2023 23:18:15 -0700
+Subject: RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX
+ coalescing
+
+From: Long Li <longli@microsoft.com>
+
+[ Upstream commit 2145328515c8fa9b8a9f7889250bc6c032f2a0e6 ]
+
+With RX coalescing, one CQE entry can be used to indicate multiple packets
+on the receive queue. This saves processing time and PCI bandwidth over
+the CQ.
+
+The MANA Ethernet driver also uses the v2 version of the protocol. It
+doesn't use RX coalescing and its behavior is not changed.
+
+Link: https://lore.kernel.org/r/1684045095-31228-1-git-send-email-longli@linuxonhyperv.com
+Signed-off-by: Long Li <longli@microsoft.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mana/qp.c | 5 ++++-
+ drivers/net/ethernet/microsoft/mana/mana_en.c | 5 ++++-
+ include/net/mana/mana.h | 4 +++-
+ 3 files changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mana/qp.c b/drivers/infiniband/hw/mana/qp.c
+index 54b61930a7fdb..4b3b5b274e849 100644
+--- a/drivers/infiniband/hw/mana/qp.c
++++ b/drivers/infiniband/hw/mana/qp.c
+@@ -13,7 +13,7 @@ static int mana_ib_cfg_vport_steering(struct mana_ib_dev *dev,
+ u8 *rx_hash_key)
+ {
+ struct mana_port_context *mpc = netdev_priv(ndev);
+- struct mana_cfg_rx_steer_req *req = NULL;
++ struct mana_cfg_rx_steer_req_v2 *req;
+ struct mana_cfg_rx_steer_resp resp = {};
+ mana_handle_t *req_indir_tab;
+ struct gdma_context *gc;
+@@ -33,6 +33,8 @@ static int mana_ib_cfg_vport_steering(struct mana_ib_dev *dev,
+ mana_gd_init_req_hdr(&req->hdr, MANA_CONFIG_VPORT_RX, req_buf_size,
+ sizeof(resp));
+
++ req->hdr.req.msg_version = GDMA_MESSAGE_V2;
++
+ req->vport = mpc->port_handle;
+ req->rx_enable = 1;
+ req->update_default_rxobj = 1;
+@@ -46,6 +48,7 @@ static int mana_ib_cfg_vport_steering(struct mana_ib_dev *dev,
+ req->num_indir_entries = MANA_INDIRECT_TABLE_SIZE;
+ req->indir_tab_offset = sizeof(*req);
+ req->update_indir_tab = true;
++ req->cqe_coalescing_enable = 1;
+
+ req_indir_tab = (mana_handle_t *)(req + 1);
+ /* The ind table passed to the hardware must have
+diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c
+index 96c78f7db2543..7441577294bad 100644
+--- a/drivers/net/ethernet/microsoft/mana/mana_en.c
++++ b/drivers/net/ethernet/microsoft/mana/mana_en.c
+@@ -973,7 +973,7 @@ static int mana_cfg_vport_steering(struct mana_port_context *apc,
+ bool update_tab)
+ {
+ u16 num_entries = MANA_INDIRECT_TABLE_SIZE;
+- struct mana_cfg_rx_steer_req *req = NULL;
++ struct mana_cfg_rx_steer_req_v2 *req;
+ struct mana_cfg_rx_steer_resp resp = {};
+ struct net_device *ndev = apc->ndev;
+ mana_handle_t *req_indir_tab;
+@@ -988,6 +988,8 @@ static int mana_cfg_vport_steering(struct mana_port_context *apc,
+ mana_gd_init_req_hdr(&req->hdr, MANA_CONFIG_VPORT_RX, req_buf_size,
+ sizeof(resp));
+
++ req->hdr.req.msg_version = GDMA_MESSAGE_V2;
++
+ req->vport = apc->port_handle;
+ req->num_indir_entries = num_entries;
+ req->indir_tab_offset = sizeof(*req);
+@@ -997,6 +999,7 @@ static int mana_cfg_vport_steering(struct mana_port_context *apc,
+ req->update_hashkey = update_key;
+ req->update_indir_tab = update_tab;
+ req->default_rxobj = apc->default_rxobj;
++ req->cqe_coalescing_enable = 0;
+
+ if (update_key)
+ memcpy(&req->hashkey, apc->hashkey, MANA_HASH_KEY_SIZE);
+diff --git a/include/net/mana/mana.h b/include/net/mana/mana.h
+index 9eef199728454..024ad8ddb27e5 100644
+--- a/include/net/mana/mana.h
++++ b/include/net/mana/mana.h
+@@ -579,7 +579,7 @@ struct mana_fence_rq_resp {
+ }; /* HW DATA */
+
+ /* Configure vPort Rx Steering */
+-struct mana_cfg_rx_steer_req {
++struct mana_cfg_rx_steer_req_v2 {
+ struct gdma_req_hdr hdr;
+ mana_handle_t vport;
+ u16 num_indir_entries;
+@@ -592,6 +592,8 @@ struct mana_cfg_rx_steer_req {
+ u8 reserved;
+ mana_handle_t default_rxobj;
+ u8 hashkey[MANA_HASH_KEY_SIZE];
++ u8 cqe_coalescing_enable;
++ u8 reserved2[7];
+ }; /* HW DATA */
+
+ struct mana_cfg_rx_steer_resp {
+--
+2.40.1
+
--- /dev/null
+From 82d8ea5645c2a454db3f3cf14713e08ab1d14f2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jun 2023 13:14:07 +0300
+Subject: RDMA/mlx5: Return the firmware result upon destroying QP/RQ
+
+From: Patrisious Haddad <phaddad@nvidia.com>
+
+[ Upstream commit 22664c06e997087fe37f9ba208008c948571214a ]
+
+Previously when destroying a QP/RQ, the result of the firmware
+destruction function was ignored and upper layers weren't informed
+about the failure.
+Which in turn could lead to various problems since when upper layer
+isn't aware of the failure it continues its operation thinking that the
+related QP/RQ was successfully destroyed while it actually wasn't,
+which could lead to the below kernel WARN.
+
+Currently, we return the correct firmware destruction status to upper
+layers which in case of the RQ would be mlx5_ib_destroy_wq() which
+was already capable of handling RQ destruction failure or in case of
+a QP to destroy_qp_common(), which now would actually warn upon qp
+destruction failure.
+
+WARNING: CPU: 3 PID: 995 at drivers/infiniband/core/rdma_core.c:940 uverbs_destroy_ufile_hw+0xcb/0xe0 [ib_uverbs]
+Modules linked in: xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi rdma_cm ib_umad ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core overlay mlx5_core fuse
+CPU: 3 PID: 995 Comm: python3 Not tainted 5.16.0-rc5+ #1
+Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+RIP: 0010:uverbs_destroy_ufile_hw+0xcb/0xe0 [ib_uverbs]
+Code: 41 5c 41 5d 41 5e e9 44 34 f0 e0 48 89 df e8 4c 77 ff ff 49 8b 86 10 01 00 00 48 85 c0 74 a1 4c 89 e7 ff d0 eb 9a 0f 0b eb c1 <0f> 0b be 04 00 00 00 48 89 df e8 b6 f6 ff ff e9 75 ff ff ff 90 0f
+RSP: 0018:ffff8881533e3e78 EFLAGS: 00010287
+RAX: ffff88811b2cf3e0 RBX: ffff888106209700 RCX: 0000000000000000
+RDX: ffff888106209780 RSI: ffff8881533e3d30 RDI: ffff888109b101a0
+RBP: 0000000000000001 R08: ffff888127cb381c R09: 0de9890000000009
+R10: ffff888127cb3800 R11: 0000000000000000 R12: ffff888106209780
+R13: ffff888106209750 R14: ffff888100f20660 R15: 0000000000000000
+FS: 00007f8be353b740(0000) GS:ffff88852c980000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007f8bd5b117c0 CR3: 000000012cd8a004 CR4: 0000000000370ea0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ <TASK>
+ ib_uverbs_close+0x1a/0x90 [ib_uverbs]
+ __fput+0x82/0x230
+ task_work_run+0x59/0x90
+ exit_to_user_mode_prepare+0x138/0x140
+ syscall_exit_to_user_mode+0x1d/0x50
+ ? __x64_sys_close+0xe/0x40
+ do_syscall_64+0x4a/0x90
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+RIP: 0033:0x7f8be3ae0abb
+Code: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 83 43 f9 ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 c1 43 f9 ff 8b 44
+RSP: 002b:00007ffdb51909c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
+RAX: 0000000000000000 RBX: 0000557bb7f7c020 RCX: 00007f8be3ae0abb
+RDX: 0000557bb7c74010 RSI: 0000557bb7f14ca0 RDI: 0000000000000005
+RBP: 0000557bb7fbd598 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000293 R12: 0000557bb7fbd5b8
+R13: 0000557bb7fbd5a8 R14: 0000000000001000 R15: 0000557bb7f7c020
+ </TASK>
+
+Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
+Link: https://lore.kernel.org/r/c6df677f931d18090bafbe7f7dbb9524047b7d9b.1685953497.git.leon@kernel.org
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/qpc.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/qpc.c b/drivers/infiniband/hw/mlx5/qpc.c
+index bae0334d6e7f1..aec011557b4a7 100644
+--- a/drivers/infiniband/hw/mlx5/qpc.c
++++ b/drivers/infiniband/hw/mlx5/qpc.c
+@@ -298,8 +298,7 @@ int mlx5_core_destroy_qp(struct mlx5_ib_dev *dev, struct mlx5_core_qp *qp)
+ MLX5_SET(destroy_qp_in, in, opcode, MLX5_CMD_OP_DESTROY_QP);
+ MLX5_SET(destroy_qp_in, in, qpn, qp->qpn);
+ MLX5_SET(destroy_qp_in, in, uid, qp->uid);
+- mlx5_cmd_exec_in(dev->mdev, destroy_qp, in);
+- return 0;
++ return mlx5_cmd_exec_in(dev->mdev, destroy_qp, in);
+ }
+
+ int mlx5_core_set_delay_drop(struct mlx5_ib_dev *dev,
+@@ -551,14 +550,14 @@ int mlx5_core_xrcd_dealloc(struct mlx5_ib_dev *dev, u32 xrcdn)
+ return mlx5_cmd_exec_in(dev->mdev, dealloc_xrcd, in);
+ }
+
+-static void destroy_rq_tracked(struct mlx5_ib_dev *dev, u32 rqn, u16 uid)
++static int destroy_rq_tracked(struct mlx5_ib_dev *dev, u32 rqn, u16 uid)
+ {
+ u32 in[MLX5_ST_SZ_DW(destroy_rq_in)] = {};
+
+ MLX5_SET(destroy_rq_in, in, opcode, MLX5_CMD_OP_DESTROY_RQ);
+ MLX5_SET(destroy_rq_in, in, rqn, rqn);
+ MLX5_SET(destroy_rq_in, in, uid, uid);
+- mlx5_cmd_exec_in(dev->mdev, destroy_rq, in);
++ return mlx5_cmd_exec_in(dev->mdev, destroy_rq, in);
+ }
+
+ int mlx5_core_create_rq_tracked(struct mlx5_ib_dev *dev, u32 *in, int inlen,
+@@ -589,8 +588,7 @@ int mlx5_core_destroy_rq_tracked(struct mlx5_ib_dev *dev,
+ struct mlx5_core_qp *rq)
+ {
+ destroy_resource_common(dev, rq);
+- destroy_rq_tracked(dev, rq->qpn, rq->uid);
+- return 0;
++ return destroy_rq_tracked(dev, rq->qpn, rq->uid);
+ }
+
+ static void destroy_sq_tracked(struct mlx5_ib_dev *dev, u32 sqn, u16 uid)
+--
+2.40.1
+
--- /dev/null
+From 50678a628e86023c579ff53c5da3e9fe65d0aea2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Mar 2023 10:25:04 -0400
+Subject: Revert "drm/amd/display: disable SubVP + DRR to prevent underflow"
+
+From: Aurabindo Pillai <aurabindo.pillai@amd.com>
+
+[ Upstream commit f38129bb081758176dd78304faaee95007fb8838 ]
+
+This reverts commit 80c6d6804f31451848a3956a70c2bcb1f07cfcb0.
+The orignal commit was intended as a workaround to prevent underflow and
+flickering when using one normal monitor and the other high refresh rate
+monitor (> 120Hz).
+
+This patch is being reverted in favour of a software solution to enable
+SubVP+DRR
+
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 -----
+ drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 4 ----
+ drivers/gpu/drm/amd/include/amd_shared.h | 1 -
+ 3 files changed, 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index bdce367544368..4dd9a85f5c724 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1653,11 +1653,6 @@ static int amdgpu_dm_init(struct amdgpu_device *adev)
+ if (amdgpu_dc_feature_mask & DC_DISABLE_LTTPR_DP2_0)
+ init_data.flags.allow_lttpr_non_transparent_mode.bits.DP2_0 = true;
+
+- /* Disable SubVP + DRR config by default */
+- init_data.flags.disable_subvp_drr = true;
+- if (amdgpu_dc_feature_mask & DC_ENABLE_SUBVP_DRR)
+- init_data.flags.disable_subvp_drr = false;
+-
+ init_data.flags.seamless_boot_edp_requested = false;
+
+ if (check_seamless_boot_capability(adev)) {
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
+index d8b4119820bfc..1bfda6e2b3070 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
+@@ -880,10 +880,6 @@ static bool subvp_drr_schedulable(struct dc *dc, struct dc_state *context, struc
+ int16_t stretched_drr_us = 0;
+ int16_t drr_stretched_vblank_us = 0;
+ int16_t max_vblank_mallregion = 0;
+- const struct dc_config *config = &dc->config;
+-
+- if (config->disable_subvp_drr)
+- return false;
+
+ // Find SubVP pipe
+ for (i = 0; i < dc->res_pool->pipe_count; i++) {
+diff --git a/drivers/gpu/drm/amd/include/amd_shared.h b/drivers/gpu/drm/amd/include/amd_shared.h
+index e4a22c68517d1..f175e65b853a0 100644
+--- a/drivers/gpu/drm/amd/include/amd_shared.h
++++ b/drivers/gpu/drm/amd/include/amd_shared.h
+@@ -240,7 +240,6 @@ enum DC_FEATURE_MASK {
+ DC_DISABLE_LTTPR_DP2_0 = (1 << 6), //0x40, disabled by default
+ DC_PSR_ALLOW_SMU_OPT = (1 << 7), //0x80, disabled by default
+ DC_PSR_ALLOW_MULTI_DISP_OPT = (1 << 8), //0x100, disabled by default
+- DC_ENABLE_SUBVP_DRR = (1 << 9), // 0x200, disabled by default
+ };
+
+ enum DC_DEBUG_MASK {
+--
+2.40.1
+
--- /dev/null
+From 7b08a23d1f94e80f90fecea0dd7f1611b17113ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Jun 2023 18:13:10 +0900
+Subject: Revert "[PATCH] uml: export symbols added by GCC hardened"
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 8635e8df477bc77837886da206f4915576f88fec ]
+
+This reverts commit cead61a6717a9873426b08d73a34a325e3546f5d.
+
+It exported __stack_smash_handler and __guard, while they may not be
+defined by anyone.
+
+The code *declares* __stack_smash_handler and __guard. It does not
+create weak symbols. If no external library is linked, they are left
+undefined, but yet exported.
+
+If a loadable module tries to access non-existing symbols, bad things
+(a page fault, NULL pointer dereference, etc.) will happen. So, the
+current code is wrong and dangerous.
+
+If the code were written as follows, it would *define* them as weak
+symbols so modules would be able to get access to them.
+
+ void (*__stack_smash_handler)(void *) __attribute__((weak));
+ EXPORT_SYMBOL(__stack_smash_handler);
+
+ long __guard __attribute__((weak));
+ EXPORT_SYMBOL(__guard);
+
+In fact, modpost forbids exporting undefined symbols. It shows an error
+message if it detects such a mistake.
+
+ ERROR: modpost: "..." [...] was exported without definition
+
+Unfortunately, it is checked only when the code is built as modular.
+The problem described above has been unnoticed for a long time because
+arch/um/os-Linux/user_syms.c is always built-in.
+
+With a planned change in Kbuild, exporting undefined symbols will always
+result in a build error instead of a run-time error. It is a good thing,
+but we need to fix the breakage in advance.
+
+One fix is to define weak symbols as shown above. An alternative is to
+export them conditionally as follows:
+
+ #ifdef CONFIG_STACKPROTECTOR
+ extern void __stack_smash_handler(void *);
+ EXPORT_SYMBOL(__stack_smash_handler);
+
+ external long __guard;
+ EXPORT_SYMBOL(__guard);
+ #endif
+
+This is what other architectures do; EXPORT_SYMBOL(__stack_chk_guard)
+is guarded by #ifdef CONFIG_STACKPROTECTOR.
+
+However, adding the #ifdef guard is not sensible because UML cannot
+enable the stack-protector in the first place! (Please note UML does
+not select HAVE_STACKPROTECTOR in Kconfig.)
+
+So, the code is already broken (and unused) in multiple ways.
+
+Just remove.
+
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/os-Linux/user_syms.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+diff --git a/arch/um/os-Linux/user_syms.c b/arch/um/os-Linux/user_syms.c
+index 9b62a9d352b3a..a310ae27b479a 100644
+--- a/arch/um/os-Linux/user_syms.c
++++ b/arch/um/os-Linux/user_syms.c
+@@ -37,13 +37,6 @@ EXPORT_SYMBOL(vsyscall_ehdr);
+ EXPORT_SYMBOL(vsyscall_end);
+ #endif
+
+-/* Export symbols used by GCC for the stack protector. */
+-extern void __stack_smash_handler(void *) __attribute__((weak));
+-EXPORT_SYMBOL(__stack_smash_handler);
+-
+-extern long __guard __attribute__((weak));
+-EXPORT_SYMBOL(__guard);
+-
+ #ifdef _FORTIFY_SOURCE
+ extern int __sprintf_chk(char *str, int flag, size_t len, const char *format);
+ EXPORT_SYMBOL(__sprintf_chk);
+--
+2.40.1
+
--- /dev/null
+From 25bdf945bbc210945c03cf4b4d950699798ad3fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jul 2023 15:58:47 +0800
+Subject: ring-buffer: Do not swap cpu_buffer during resize process
+
+From: Chen Lin <chen.lin5@zte.com.cn>
+
+[ Upstream commit 8a96c0288d0737ad77882024974c075345c72011 ]
+
+When ring_buffer_swap_cpu was called during resize process,
+the cpu buffer was swapped in the middle, resulting in incorrect state.
+Continuing to run in the wrong state will result in oops.
+
+This issue can be easily reproduced using the following two scripts:
+/tmp # cat test1.sh
+//#! /bin/sh
+for i in `seq 0 100000`
+do
+ echo 2000 > /sys/kernel/debug/tracing/buffer_size_kb
+ sleep 0.5
+ echo 5000 > /sys/kernel/debug/tracing/buffer_size_kb
+ sleep 0.5
+done
+/tmp # cat test2.sh
+//#! /bin/sh
+for i in `seq 0 100000`
+do
+ echo irqsoff > /sys/kernel/debug/tracing/current_tracer
+ sleep 1
+ echo nop > /sys/kernel/debug/tracing/current_tracer
+ sleep 1
+done
+/tmp # ./test1.sh &
+/tmp # ./test2.sh &
+
+A typical oops log is as follows, sometimes with other different oops logs.
+
+[ 231.711293] WARNING: CPU: 0 PID: 9 at kernel/trace/ring_buffer.c:2026 rb_update_pages+0x378/0x3f8
+[ 231.713375] Modules linked in:
+[ 231.714735] CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.5.0-rc1-00276-g20edcec23f92 #15
+[ 231.716750] Hardware name: linux,dummy-virt (DT)
+[ 231.718152] Workqueue: events update_pages_handler
+[ 231.719714] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[ 231.721171] pc : rb_update_pages+0x378/0x3f8
+[ 231.722212] lr : rb_update_pages+0x25c/0x3f8
+[ 231.723248] sp : ffff800082b9bd50
+[ 231.724169] x29: ffff800082b9bd50 x28: ffff8000825f7000 x27: 0000000000000000
+[ 231.726102] x26: 0000000000000001 x25: fffffffffffff010 x24: 0000000000000ff0
+[ 231.728122] x23: ffff0000c3a0b600 x22: ffff0000c3a0b5c0 x21: fffffffffffffe0a
+[ 231.730203] x20: ffff0000c3a0b600 x19: ffff0000c0102400 x18: 0000000000000000
+[ 231.732329] x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffe7aa8510
+[ 231.734212] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000002
+[ 231.736291] x11: ffff8000826998a8 x10: ffff800082b9baf0 x9 : ffff800081137558
+[ 231.738195] x8 : fffffc00030e82c8 x7 : 0000000000000000 x6 : 0000000000000001
+[ 231.740192] x5 : ffff0000ffbafe00 x4 : 0000000000000000 x3 : 0000000000000000
+[ 231.742118] x2 : 00000000000006aa x1 : 0000000000000001 x0 : ffff0000c0007208
+[ 231.744196] Call trace:
+[ 231.744892] rb_update_pages+0x378/0x3f8
+[ 231.745893] update_pages_handler+0x1c/0x38
+[ 231.746893] process_one_work+0x1f0/0x468
+[ 231.747852] worker_thread+0x54/0x410
+[ 231.748737] kthread+0x124/0x138
+[ 231.749549] ret_from_fork+0x10/0x20
+[ 231.750434] ---[ end trace 0000000000000000 ]---
+[ 233.720486] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
+[ 233.721696] Mem abort info:
+[ 233.721935] ESR = 0x0000000096000004
+[ 233.722283] EC = 0x25: DABT (current EL), IL = 32 bits
+[ 233.722596] SET = 0, FnV = 0
+[ 233.722805] EA = 0, S1PTW = 0
+[ 233.723026] FSC = 0x04: level 0 translation fault
+[ 233.723458] Data abort info:
+[ 233.723734] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
+[ 233.724176] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
+[ 233.724589] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
+[ 233.725075] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000104943000
+[ 233.725592] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000
+[ 233.726231] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
+[ 233.726720] Modules linked in:
+[ 233.727007] CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.5.0-rc1-00276-g20edcec23f92 #15
+[ 233.727777] Hardware name: linux,dummy-virt (DT)
+[ 233.728225] Workqueue: events update_pages_handler
+[ 233.728655] pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[ 233.729054] pc : rb_update_pages+0x1a8/0x3f8
+[ 233.729334] lr : rb_update_pages+0x154/0x3f8
+[ 233.729592] sp : ffff800082b9bd50
+[ 233.729792] x29: ffff800082b9bd50 x28: ffff8000825f7000 x27: 0000000000000000
+[ 233.730220] x26: 0000000000000000 x25: ffff800082a8b840 x24: ffff0000c0102418
+[ 233.730653] x23: 0000000000000000 x22: fffffc000304c880 x21: 0000000000000003
+[ 233.731105] x20: 00000000000001f4 x19: ffff0000c0102400 x18: ffff800082fcbc58
+[ 233.731727] x17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000001
+[ 233.732282] x14: ffff8000825fe0c8 x13: 0000000000000001 x12: 0000000000000000
+[ 233.732709] x11: ffff8000826998a8 x10: 0000000000000ae0 x9 : ffff8000801b760c
+[ 233.733148] x8 : fefefefefefefeff x7 : 0000000000000018 x6 : ffff0000c03298c0
+[ 233.733553] x5 : 0000000000000002 x4 : 0000000000000000 x3 : 0000000000000000
+[ 233.733972] x2 : ffff0000c3a0b600 x1 : 0000000000000000 x0 : 0000000000000000
+[ 233.734418] Call trace:
+[ 233.734593] rb_update_pages+0x1a8/0x3f8
+[ 233.734853] update_pages_handler+0x1c/0x38
+[ 233.735148] process_one_work+0x1f0/0x468
+[ 233.735525] worker_thread+0x54/0x410
+[ 233.735852] kthread+0x124/0x138
+[ 233.736064] ret_from_fork+0x10/0x20
+[ 233.736387] Code: 92400000 910006b5 aa000021 aa0303f7 (f9400060)
+[ 233.736959] ---[ end trace 0000000000000000 ]---
+
+After analysis, the seq of the error is as follows [1-5]:
+
+int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size,
+ int cpu_id)
+{
+ for_each_buffer_cpu(buffer, cpu) {
+ cpu_buffer = buffer->buffers[cpu];
+ //1. get cpu_buffer, aka cpu_buffer(A)
+ ...
+ ...
+ schedule_work_on(cpu,
+ &cpu_buffer->update_pages_work);
+ //2. 'update_pages_work' is queue on 'cpu', cpu_buffer(A) is passed to
+ // update_pages_handler, do the update process, set 'update_done' in
+ // complete(&cpu_buffer->update_done) and to wakeup resize process.
+ //---->
+ //3. Just at this moment, ring_buffer_swap_cpu is triggered,
+ //cpu_buffer(A) be swaped to cpu_buffer(B), the max_buffer.
+ //ring_buffer_swap_cpu is called as the 'Call trace' below.
+
+ Call trace:
+ dump_backtrace+0x0/0x2f8
+ show_stack+0x18/0x28
+ dump_stack+0x12c/0x188
+ ring_buffer_swap_cpu+0x2f8/0x328
+ update_max_tr_single+0x180/0x210
+ check_critical_timing+0x2b4/0x2c8
+ tracer_hardirqs_on+0x1c0/0x200
+ trace_hardirqs_on+0xec/0x378
+ el0_svc_common+0x64/0x260
+ do_el0_svc+0x90/0xf8
+ el0_svc+0x20/0x30
+ el0_sync_handler+0xb0/0xb8
+ el0_sync+0x180/0x1c0
+ //<----
+
+ /* wait for all the updates to complete */
+ for_each_buffer_cpu(buffer, cpu) {
+ cpu_buffer = buffer->buffers[cpu];
+ //4. get cpu_buffer, cpu_buffer(B) is used in the following process,
+ //the state of cpu_buffer(A) and cpu_buffer(B) is totally wrong.
+ //for example, cpu_buffer(A)->update_done will leave be set 1, and will
+ //not 'wait_for_completion' at the next resize round.
+ if (!cpu_buffer->nr_pages_to_update)
+ continue;
+
+ if (cpu_online(cpu))
+ wait_for_completion(&cpu_buffer->update_done);
+ cpu_buffer->nr_pages_to_update = 0;
+ }
+ ...
+}
+ //5. the state of cpu_buffer(A) and cpu_buffer(B) is totally wrong,
+ //Continuing to run in the wrong state, then oops occurs.
+
+Link: https://lore.kernel.org/linux-trace-kernel/202307191558478409990@zte.com.cn
+
+Signed-off-by: Chen Lin <chen.lin5@zte.com.cn>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/ring_buffer.c | 14 +++++++++++++-
+ kernel/trace/trace.c | 3 ++-
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index 99634b29a8b82..46b4a3c7c3bf5 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -538,6 +538,7 @@ struct trace_buffer {
+ unsigned flags;
+ int cpus;
+ atomic_t record_disabled;
++ atomic_t resizing;
+ cpumask_var_t cpumask;
+
+ struct lock_class_key *reader_lock_key;
+@@ -2166,7 +2167,7 @@ int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size,
+
+ /* prevent another thread from changing buffer sizes */
+ mutex_lock(&buffer->mutex);
+-
++ atomic_inc(&buffer->resizing);
+
+ if (cpu_id == RING_BUFFER_ALL_CPUS) {
+ /*
+@@ -2321,6 +2322,7 @@ int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size,
+ atomic_dec(&buffer->record_disabled);
+ }
+
++ atomic_dec(&buffer->resizing);
+ mutex_unlock(&buffer->mutex);
+ return 0;
+
+@@ -2341,6 +2343,7 @@ int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size,
+ }
+ }
+ out_err_unlock:
++ atomic_dec(&buffer->resizing);
+ mutex_unlock(&buffer->mutex);
+ return err;
+ }
+@@ -5543,6 +5546,15 @@ int ring_buffer_swap_cpu(struct trace_buffer *buffer_a,
+ if (local_read(&cpu_buffer_b->committing))
+ goto out_dec;
+
++ /*
++ * When resize is in progress, we cannot swap it because
++ * it will mess the state of the cpu buffer.
++ */
++ if (atomic_read(&buffer_a->resizing))
++ goto out_dec;
++ if (atomic_read(&buffer_b->resizing))
++ goto out_dec;
++
+ buffer_a->buffers[cpu] = cpu_buffer_b;
+ buffer_b->buffers[cpu] = cpu_buffer_a;
+
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index c80ff6f5b2cc1..fd051f85efd4b 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -1928,9 +1928,10 @@ update_max_tr_single(struct trace_array *tr, struct task_struct *tsk, int cpu)
+ * place on this CPU. We fail to record, but we reset
+ * the max trace buffer (no one writes directly to it)
+ * and flag that it failed.
++ * Another reason is resize is in progress.
+ */
+ trace_array_printk_buf(tr->max_buffer.buffer, _THIS_IP_,
+- "Failed to swap buffers due to commit in progress\n");
++ "Failed to swap buffers due to commit or resize in progress\n");
+ }
+
+ WARN_ON_ONCE(ret && ret != -EAGAIN && ret != -EBUSY);
+--
+2.40.1
+
--- /dev/null
+From 5ecfef76f0ffab029edea0a3fea8ab80c189fc75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 May 2023 19:38:09 +0200
+Subject: serial: stm32: Ignore return value of uart_remove_one_port() in
+ .remove()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 6bd6cd29c92401a101993290051fa55078238a52 ]
+
+Returning early from stm32_usart_serial_remove() results in a resource
+leak as several cleanup functions are not called. The driver core ignores
+the return value and there is no possibility to clean up later.
+
+uart_remove_one_port() only returns non-zero if there is some
+inconsistency (i.e. stm32_usart_driver.state[port->line].uart_port == NULL).
+This should never happen, and even if it does it's a bad idea to exit
+early in the remove callback without cleaning up.
+
+This prepares changing the prototype of struct platform_driver::remove to
+return void. See commit 5c5a7680e67b ("platform: Provide a remove callback
+that returns no value") for further details about this quest.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Link: https://lore.kernel.org/r/20230512173810.131447-2-u.kleine-koenig@pengutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index 1e38fc9b10c11..e9e11a2596211 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -1755,13 +1755,10 @@ static int stm32_usart_serial_remove(struct platform_device *pdev)
+ struct uart_port *port = platform_get_drvdata(pdev);
+ struct stm32_port *stm32_port = to_stm32_port(port);
+ const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
+- int err;
+ u32 cr3;
+
+ pm_runtime_get_sync(&pdev->dev);
+- err = uart_remove_one_port(&stm32_usart_driver, port);
+- if (err)
+- return(err);
++ uart_remove_one_port(&stm32_usart_driver, port);
+
+ pm_runtime_disable(&pdev->dev);
+ pm_runtime_set_suspended(&pdev->dev);
+--
+2.40.1
+
--- /dev/null
+drop-the-netfs_-prefix-from-netfs_extract_iter_to_sg.patch
+fix-a-couple-of-spelling-mistakes.patch
+wrap-lines-at-80.patch
+move-netfs_extract_iter_to_sg-to-lib-scatterlist.c.patch
+crypto-cifs-fix-error-handling-in-extract_iter_to_sg.patch
+nvme-core-don-t-hold-rcu-read-lock-in-nvme_ns_chr_ur.patch
+net-phy-at803x-use-devm_regulator_get_enable_optiona.patch
+net-phy-at803x-fix-the-wol-setting-functions.patch
+drm-amd-display-update-dtbclk-for-dcn32.patch
+drm-scheduler-set-entity-to-null-in-drm_sched_entity.patch
+drm-amdgpu-fix-calltrace-warning-in-amddrm_buddy_fin.patch
+drm-amdgpu-fix-integer-overflow-in-amdgpu_cs_pass1.patch
+drm-amdgpu-fix-memory-leak-in-mes-self-test.patch
+revert-drm-amd-display-disable-subvp-drr-to-prevent-.patch
+asoc-intel-sof_sdw-add-quirk-for-mtl-rvp.patch
+asoc-intel-sof_sdw-add-quirk-for-lnl-rvp.patch
+pci-tegra194-fix-possible-array-out-of-bounds-access.patch
+asoc-cs35l56-move-dsp-part-string-generation-so-that.patch
+asoc-sof-amd-add-pci-revision-id-check.patch
+drm-stm-ltdc-fix-late-dereference-check.patch
+arm64-dts-qcom-ipq5332-add-qfprom-node.patch
+drm-rcar-du-remove-r-car-h3-es1.-workarounds.patch
+asoc-amd-vangogh-add-check-for-acp-config-flags-in-v.patch
+rdma-mana_ib-use-v2-version-of-cfg_rx_steer_req-to-e.patch
+arm-dts-imx6dl-prtrvt-prtvt7-prti6q-prtwd2-fix-usb-r.patch
+asoc-intel-sof_sdw_rt_sdca_jack_common-test-sof_jack.patch
+asoc-intel-sof_sdw-add-quick-for-dell-sku-0bda.patch
+asoc-intel-sof_sdw-add-support-for-rex-soundwire.patch
+iopoll-call-cpu_relax-in-busy-loops.patch
+asoc-sof-intel-fix-soundwire-hdaudio-mutual-exclusio.patch
+dma-remap-use-kvmalloc_array-kvfree-for-larger-dma-m.patch
+accel-habanalabs-add-pci-health-check-during-heartbe.patch
+accel-habanalabs-fix-mem-leak-in-capture-user-mappin.patch
+dt-bindings-input-goodix-add-goodix-no-reset-during-.patch
+hid-i2c-hid-goodix-add-support-for-goodix-no-reset-d.patch
+hid-logitech-hidpp-add-usb-and-bluetooth-ids-for-the.patch
+iommu-amd-introduce-disable-irte-caching-support.patch
+drm-amdgpu-install-stub-fence-into-potential-unused-.patch
+drm-amd-display-remove-v_startup-workaround-for-dcn3.patch
+drm-amd-display-apply-60us-prefetch-for-dcfclk-300mh.patch
+drm-amdgpu-unmap-and-remove-csa_va-properly.patch
+rdma-mlx5-return-the-firmware-result-upon-destroying.patch
+rdma-bnxt_re-consider-timeout-of-destroy-ah-as-succe.patch
+drm-amd-display-skip-dpp-dto-update-if-root-clock-is.patch
+drm-amd-display-enable-dcn314-dpp-rco.patch
+asoc-sof-core-free-the-firmware-trace-before-calling.patch
+hid-intel-ish-hid-ipc-add-arrow-lake-pci-device-id.patch
+revert-patch-uml-export-symbols-added-by-gcc-hardene.patch
+smb-client-fix-warning-in-cifs_smb3_do_mount.patch
+cifs-fix-session-state-check-in-reconnect-to-avoid-u.patch
+serial-stm32-ignore-return-value-of-uart_remove_one_.patch
+led-qcom-lpg-fix-resource-leaks-in-for_each_availabl.patch
+media-v4l2-mem2mem-add-lock-to-protect-parameter-num.patch
+media-camss-set-vfe-bpl_alignment-to-16-for-sdm845-a.patch
+usb-gadget-u_serial-avoid-spinlock-recursion-in-__gs.patch
+usb-gadget-uvc-queue-empty-isoc-requests-if-no-video.patch
+media-platform-mediatek-vpu-fix-null-ptr-dereference.patch
+thunderbolt-read-retimer-nvm-authentication-status-p.patch
+xhci-get-rid-of-xhci_plat-quirk-that-used-to-prevent.patch
+usb-chipidea-imx-don-t-request-qos-for-imx8ulp.patch
+usb-chipidea-imx-turn-off-vbus-comparator-when-suspe.patch
+usb-chipidea-imx-add-missing-usb-phy-dpdm-wakeup-set.patch
+gfs2-fix-possible-data-races-in-gfs2_show_options.patch
+pcmcia-rsrc_nonstatic-fix-memory-leak-in-nonstatic_r.patch
+thunderbolt-add-intel-barlow-ridge-pci-id.patch
+thunderbolt-limit-intel-barlow-ridge-usb3-bandwidth.patch
+firewire-net-fix-use-after-free-in-fwnet_finish_inco.patch
+watchdog-sp5100_tco-support-hygon-fch-sch-server-con.patch
+bluetooth-l2cap-fix-use-after-free.patch
+bluetooth-btusb-add-mt7922-bluetooth-id-for-the-asus.patch
+ceph-try-to-dump-the-msgs-when-decoding-fails.patch
+drm-amdgpu-fix-potential-fence-use-after-free-v2.patch
+fs-ntfs3-enhance-sanity-check-while-generating-attr_.patch
+fs-ntfs3-return-error-for-inconsistent-extended-attr.patch
+fs-ntfs3-fix-possible-null-pointer-dereferences-in-m.patch
+fs-ntfs3-mark-ntfs-dirty-when-on-disk-struct-is-corr.patch
+fs-ntfs3-alternative-boot-if-primary-boot-is-corrupt.patch
+alsa-hda-realtek-add-quirks-for-unis-h3c-desktop-b76.patch
+alsa-hda-fix-a-possible-null-pointer-dereference-due.patch
+alsa-hda-realtek-add-quirk-for-asus-rog-gx650p.patch
+alsa-hda-realtek-add-quirk-for-asus-rog-ga402x.patch
+alsa-hda-realtek-amend-g634-quirk-to-enable-rear-spe.patch
+alsa-hda-realtek-add-quirk-for-asus-rog-g614jx.patch
+apparmor-fix-use-of-strcpy-in-policy_unpack_test.patch
+alsa-hda-realtek-add-quirk-for-asus-rog-gz301v.patch
+powerpc-kasan-disable-kcov-in-kasan-code.patch
+bluetooth-mgmt-use-correct-address-for-memcpy.patch
+ring-buffer-do-not-swap-cpu_buffer-during-resize-pro.patch
+btrfs-move-out-now-unused-bg-from-the-reclaim-list.patch
+btrfs-fix-use-after-free-of-new-block-group-that-bec.patch
+can-raw-fix-receiver-memory-leak.patch
+can-raw-fix-lockdep-issue-in-raw_release.patch
--- /dev/null
+From a3a868b8573f4a4bb9b940b8f3dc1fd668e8a38d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jun 2023 16:24:37 -0300
+Subject: smb: client: fix warning in cifs_smb3_do_mount()
+
+From: Paulo Alcantara <pc@manguebit.com>
+
+[ Upstream commit 12c30f33cc6769bf411088a2872843c4f9ea32f9 ]
+
+This fixes the following warning reported by kernel test robot
+
+ fs/smb/client/cifsfs.c:982 cifs_smb3_do_mount() warn: possible
+ memory leak of 'cifs_sb'
+
+Link: https://lore.kernel.org/all/202306170124.CtQqzf0I-lkp@intel.com/
+Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/cifsfs.c | 28 ++++++++++------------------
+ 1 file changed, 10 insertions(+), 18 deletions(-)
+
+diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c
+index 43a4d8603db34..30b03938f6d1d 100644
+--- a/fs/smb/client/cifsfs.c
++++ b/fs/smb/client/cifsfs.c
+@@ -884,11 +884,11 @@ struct dentry *
+ cifs_smb3_do_mount(struct file_system_type *fs_type,
+ int flags, struct smb3_fs_context *old_ctx)
+ {
+- int rc;
+- struct super_block *sb = NULL;
+- struct cifs_sb_info *cifs_sb = NULL;
+ struct cifs_mnt_data mnt_data;
++ struct cifs_sb_info *cifs_sb;
++ struct super_block *sb;
+ struct dentry *root;
++ int rc;
+
+ if (cifsFYI) {
+ cifs_dbg(FYI, "%s: devname=%s flags=0x%x\n", __func__,
+@@ -897,11 +897,9 @@ cifs_smb3_do_mount(struct file_system_type *fs_type,
+ cifs_info("Attempting to mount %s\n", old_ctx->source);
+ }
+
+- cifs_sb = kzalloc(sizeof(struct cifs_sb_info), GFP_KERNEL);
+- if (cifs_sb == NULL) {
+- root = ERR_PTR(-ENOMEM);
+- goto out;
+- }
++ cifs_sb = kzalloc(sizeof(*cifs_sb), GFP_KERNEL);
++ if (!cifs_sb)
++ return ERR_PTR(-ENOMEM);
+
+ cifs_sb->ctx = kzalloc(sizeof(struct smb3_fs_context), GFP_KERNEL);
+ if (!cifs_sb->ctx) {
+@@ -938,10 +936,8 @@ cifs_smb3_do_mount(struct file_system_type *fs_type,
+
+ sb = sget(fs_type, cifs_match_super, cifs_set_super, flags, &mnt_data);
+ if (IS_ERR(sb)) {
+- root = ERR_CAST(sb);
+ cifs_umount(cifs_sb);
+- cifs_sb = NULL;
+- goto out;
++ return ERR_CAST(sb);
+ }
+
+ if (sb->s_root) {
+@@ -972,13 +968,9 @@ cifs_smb3_do_mount(struct file_system_type *fs_type,
+ deactivate_locked_super(sb);
+ return root;
+ out:
+- if (cifs_sb) {
+- if (!sb || IS_ERR(sb)) { /* otherwise kill_sb will handle */
+- kfree(cifs_sb->prepath);
+- smb3_cleanup_fs_context(cifs_sb->ctx);
+- kfree(cifs_sb);
+- }
+- }
++ kfree(cifs_sb->prepath);
++ smb3_cleanup_fs_context(cifs_sb->ctx);
++ kfree(cifs_sb);
+ return root;
+ }
+
+--
+2.40.1
+
--- /dev/null
+From 0d3a81913b107a8c23cd26971ef5d6c9ab0c5c6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Dec 2022 08:35:04 +0200
+Subject: thunderbolt: Add Intel Barlow Ridge PCI ID
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+[ Upstream commit 6f14a210661ce03988ef4ed3c8402037c8e06539 ]
+
+Intel Barlow Ridge is the first USB4 v2 controller from Intel. The
+controller exposes standard USB4 PCI class ID in typical configurations,
+however there is a way to configure it so that it uses a special class
+ID to allow using s different driver than the Windows inbox one. For
+this reason add the Barlow Ridge PCI ID to the Linux driver too so that
+the driver can attach regardless of the class ID.
+
+Tested-by: Pengfei Xu <pengfei.xu@intel.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thunderbolt/nhi.c | 2 ++
+ drivers/thunderbolt/nhi.h | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/thunderbolt/nhi.c b/drivers/thunderbolt/nhi.c
+index e58beac442958..1257d1c41f8e5 100644
+--- a/drivers/thunderbolt/nhi.c
++++ b/drivers/thunderbolt/nhi.c
+@@ -1480,6 +1480,8 @@ static struct pci_device_id nhi_ids[] = {
+ .driver_data = (kernel_ulong_t)&icl_nhi_ops },
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTL_P_NHI1),
+ .driver_data = (kernel_ulong_t)&icl_nhi_ops },
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI) },
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI) },
+
+ /* Any USB4 compliant host */
+ { PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_USB4, ~0) },
+diff --git a/drivers/thunderbolt/nhi.h b/drivers/thunderbolt/nhi.h
+index b0718020c6f59..c15a0c46c9cff 100644
+--- a/drivers/thunderbolt/nhi.h
++++ b/drivers/thunderbolt/nhi.h
+@@ -75,6 +75,8 @@ extern const struct tb_nhi_ops icl_nhi_ops;
+ #define PCI_DEVICE_ID_INTEL_TITAN_RIDGE_DD_BRIDGE 0x15ef
+ #define PCI_DEVICE_ID_INTEL_ADL_NHI0 0x463e
+ #define PCI_DEVICE_ID_INTEL_ADL_NHI1 0x466d
++#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI 0x5781
++#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI 0x5784
+ #define PCI_DEVICE_ID_INTEL_MTL_M_NHI0 0x7eb2
+ #define PCI_DEVICE_ID_INTEL_MTL_P_NHI0 0x7ec2
+ #define PCI_DEVICE_ID_INTEL_MTL_P_NHI1 0x7ec3
+--
+2.40.1
+
--- /dev/null
+From 432051c95f8b72aa8d852eb95359949c49c15da0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 May 2023 10:45:53 +0300
+Subject: thunderbolt: Limit Intel Barlow Ridge USB3 bandwidth
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+[ Upstream commit f2bfa944080dcbb8eb56259dfd2c07204cbee17e ]
+
+Intel Barlow Ridge discrete USB4 host router has the same limitation as
+the previous generations so make sure the USB3 bandwidth limitation
+quirk is applied to Barlow Ridge too.
+
+Signed-off-by: Gil Fine <gil.fine@linux.intel.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thunderbolt/nhi.h | 2 ++
+ drivers/thunderbolt/quirks.c | 8 ++++++++
+ 2 files changed, 10 insertions(+)
+
+diff --git a/drivers/thunderbolt/nhi.h b/drivers/thunderbolt/nhi.h
+index c15a0c46c9cff..0f029ce758825 100644
+--- a/drivers/thunderbolt/nhi.h
++++ b/drivers/thunderbolt/nhi.h
+@@ -77,6 +77,8 @@ extern const struct tb_nhi_ops icl_nhi_ops;
+ #define PCI_DEVICE_ID_INTEL_ADL_NHI1 0x466d
+ #define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI 0x5781
+ #define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI 0x5784
++#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HUB_80G_BRIDGE 0x5786
++#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HUB_40G_BRIDGE 0x57a4
+ #define PCI_DEVICE_ID_INTEL_MTL_M_NHI0 0x7eb2
+ #define PCI_DEVICE_ID_INTEL_MTL_P_NHI0 0x7ec2
+ #define PCI_DEVICE_ID_INTEL_MTL_P_NHI1 0x7ec3
+diff --git a/drivers/thunderbolt/quirks.c b/drivers/thunderbolt/quirks.c
+index 1157b8869bcca..8c2ee431fcde8 100644
+--- a/drivers/thunderbolt/quirks.c
++++ b/drivers/thunderbolt/quirks.c
+@@ -74,6 +74,14 @@ static const struct tb_quirk tb_quirks[] = {
+ quirk_usb3_maximum_bandwidth },
+ { 0x8087, PCI_DEVICE_ID_INTEL_MTL_P_NHI1, 0x0000, 0x0000,
+ quirk_usb3_maximum_bandwidth },
++ { 0x8087, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI, 0x0000, 0x0000,
++ quirk_usb3_maximum_bandwidth },
++ { 0x8087, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI, 0x0000, 0x0000,
++ quirk_usb3_maximum_bandwidth },
++ { 0x8087, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HUB_80G_BRIDGE, 0x0000, 0x0000,
++ quirk_usb3_maximum_bandwidth },
++ { 0x8087, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HUB_40G_BRIDGE, 0x0000, 0x0000,
++ quirk_usb3_maximum_bandwidth },
+ /*
+ * CLx is not supported on AMD USB4 Yellow Carp and Pink Sardine platforms.
+ */
+--
+2.40.1
+
--- /dev/null
+From 6cf97c06d9a7463c67e619a044b444e0dde64304 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 May 2023 14:46:44 +0300
+Subject: thunderbolt: Read retimer NVM authentication status prior
+ tb_retimer_set_inbound_sbtx()
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+[ Upstream commit 1402ba08abae5cfa583ff1a40b99c098a0532d41 ]
+
+According to the USB4 retimer guide the correct order is immediately
+after sending ENUMERATE_RETIMERS so update the code to follow this.
+
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thunderbolt/retimer.c | 29 +++++++++++++++++++++--------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/thunderbolt/retimer.c b/drivers/thunderbolt/retimer.c
+index 9cc28197dbc45..edbd92435b41a 100644
+--- a/drivers/thunderbolt/retimer.c
++++ b/drivers/thunderbolt/retimer.c
+@@ -187,6 +187,21 @@ static ssize_t nvm_authenticate_show(struct device *dev,
+ return ret;
+ }
+
++static void tb_retimer_nvm_authenticate_status(struct tb_port *port, u32 *status)
++{
++ int i;
++
++ tb_port_dbg(port, "reading NVM authentication status of retimers\n");
++
++ /*
++ * Before doing anything else, read the authentication status.
++ * If the retimer has it set, store it for the new retimer
++ * device instance.
++ */
++ for (i = 1; i <= TB_MAX_RETIMER_INDEX; i++)
++ usb4_port_retimer_nvm_authenticate_status(port, i, &status[i]);
++}
++
+ static void tb_retimer_set_inbound_sbtx(struct tb_port *port)
+ {
+ int i;
+@@ -455,18 +470,16 @@ int tb_retimer_scan(struct tb_port *port, bool add)
+ return ret;
+
+ /*
+- * Enable sideband channel for each retimer. We can do this
+- * regardless whether there is device connected or not.
++ * Immediately after sending enumerate retimers read the
++ * authentication status of each retimer.
+ */
+- tb_retimer_set_inbound_sbtx(port);
++ tb_retimer_nvm_authenticate_status(port, status);
+
+ /*
+- * Before doing anything else, read the authentication status.
+- * If the retimer has it set, store it for the new retimer
+- * device instance.
++ * Enable sideband channel for each retimer. We can do this
++ * regardless whether there is device connected or not.
+ */
+- for (i = 1; i <= TB_MAX_RETIMER_INDEX; i++)
+- usb4_port_retimer_nvm_authenticate_status(port, i, &status[i]);
++ tb_retimer_set_inbound_sbtx(port);
+
+ for (i = 1; i <= TB_MAX_RETIMER_INDEX; i++) {
+ /*
+--
+2.40.1
+
--- /dev/null
+From 744908cc6f56b7fbbef6b7f5aa622267175e7f33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 May 2023 16:19:07 +0800
+Subject: usb: chipidea: imx: add missing USB PHY DPDM wakeup setting
+
+From: Xu Yang <xu.yang_2@nxp.com>
+
+[ Upstream commit 53d061c19dc4cb68409df6dc11c40389c8c42a75 ]
+
+USB PHY DPDM wakeup bit is enabled by default, when USB wakeup
+is not required(/sys/.../wakeup is disabled), this bit should be
+disabled, otherwise we will have unexpected wakeup if do USB device
+connect/disconnect while system sleep.
+This bit can be enabled for both host and device mode.
+
+Signed-off-by: Li Jun <jun.li@nxp.com>
+Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
+Acked-by: Peter Chen <peter.chen@kernel.org>
+Message-ID: <20230517081907.3410465-3-xu.yang_2@nxp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/usbmisc_imx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/chipidea/usbmisc_imx.c b/drivers/usb/chipidea/usbmisc_imx.c
+index 0938e274ba3a8..681c2ddc83fa5 100644
+--- a/drivers/usb/chipidea/usbmisc_imx.c
++++ b/drivers/usb/chipidea/usbmisc_imx.c
+@@ -135,7 +135,7 @@
+ #define TXVREFTUNE0_MASK (0xf << 20)
+
+ #define MX6_USB_OTG_WAKEUP_BITS (MX6_BM_WAKEUP_ENABLE | MX6_BM_VBUS_WAKEUP | \
+- MX6_BM_ID_WAKEUP)
++ MX6_BM_ID_WAKEUP | MX6SX_BM_DPDM_WAKEUP_EN)
+
+ struct usbmisc_ops {
+ /* It's called once when probe a usb device */
+--
+2.40.1
+
--- /dev/null
+From 63b0a10e6eeba98e371a4d06681034431751e42c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 May 2023 18:40:07 +0800
+Subject: usb: chipidea: imx: don't request QoS for imx8ulp
+
+From: Xu Yang <xu.yang_2@nxp.com>
+
+[ Upstream commit 9a070e8e208995a9d638b538ed7abf28bd6ea6f0 ]
+
+Use dedicated imx8ulp usb compatible to remove QoS request
+since imx8ulp has no such limitation of imx7ulp: DMA will
+not work if system enters idle.
+
+Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
+Signed-off-by: Li Jun <jun.li@nxp.com>
+Acked-by: Peter Chen <peter.chen@kernel.org>
+Message-ID: <20230530104007.1294702-2-xu.yang_2@nxp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/ci_hdrc_imx.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
+index 2855ac3030014..f7577f2bd2c5d 100644
+--- a/drivers/usb/chipidea/ci_hdrc_imx.c
++++ b/drivers/usb/chipidea/ci_hdrc_imx.c
+@@ -70,6 +70,10 @@ static const struct ci_hdrc_imx_platform_flag imx7ulp_usb_data = {
+ CI_HDRC_PMQOS,
+ };
+
++static const struct ci_hdrc_imx_platform_flag imx8ulp_usb_data = {
++ .flags = CI_HDRC_SUPPORTS_RUNTIME_PM,
++};
++
+ static const struct of_device_id ci_hdrc_imx_dt_ids[] = {
+ { .compatible = "fsl,imx23-usb", .data = &imx23_usb_data},
+ { .compatible = "fsl,imx28-usb", .data = &imx28_usb_data},
+@@ -80,6 +84,7 @@ static const struct of_device_id ci_hdrc_imx_dt_ids[] = {
+ { .compatible = "fsl,imx6ul-usb", .data = &imx6ul_usb_data},
+ { .compatible = "fsl,imx7d-usb", .data = &imx7d_usb_data},
+ { .compatible = "fsl,imx7ulp-usb", .data = &imx7ulp_usb_data},
++ { .compatible = "fsl,imx8ulp-usb", .data = &imx8ulp_usb_data},
+ { /* sentinel */ }
+ };
+ MODULE_DEVICE_TABLE(of, ci_hdrc_imx_dt_ids);
+--
+2.40.1
+
--- /dev/null
+From 26003f615a5c698cf3398aa5cd82a0fcc648a4ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 May 2023 16:19:06 +0800
+Subject: usb: chipidea: imx: turn off vbus comparator when suspend
+
+From: Xu Yang <xu.yang_2@nxp.com>
+
+[ Upstream commit 0ac37fbdad7087bbcbbe246a602c248ccfd954ea ]
+
+As we use bvalid for vbus wakeup source, to save power when
+suspend, turn off the vbus comparator for imx7d and imx8mm.
+
+Below is this bit description from RM of iMX8MM
+"VBUS Valid Comparator Enable:
+
+This signal controls the USB OTG PHY VBUS Valid comparator which
+indicates whether the voltage on the USB_OTG*_VBUS pin is below
+the VBUS Valid threshold. The VBUS Valid threshold is nominally
+4.75V on this USB PHY. The VBUS Valid threshold can be adjusted
+using the USBNC_OTGn_PHY_CFG1[OTGTUNE0] bit field. Status of the
+VBUS Valid comparator, when it is enabled, is reported on the
+USBNC_OTGn_PHY_STATUS[VBUS_VLD] bit.
+When OTGDISABLE0 (USBNC_USB_OTGx_PHY_CFG2[10])is set to 1'b0 and
+DRVVBUS0 is set to 1'b1, the Bandgap circuitry and VBUS Valid
+comparator are powered, even in Suspend or Sleep mode.
+DRVVBUS0 should be reset to 1'b0 when the internal VBUS Valid comparator
+is not required, to reduce quiescent current in Suspend or Sleep mode.
+ - 0 The VBUS Valid comparator is disabled
+ - 1 The VBUS Valid comparator is enabled"
+
+Signed-off-by: Li Jun <jun.li@nxp.com>
+Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
+Acked-by: Peter Chen <peter.chen@kernel.org>
+Message-ID: <20230517081907.3410465-2-xu.yang_2@nxp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/usbmisc_imx.c | 35 ++++++++++++++++++++++++++++++
+ 1 file changed, 35 insertions(+)
+
+diff --git a/drivers/usb/chipidea/usbmisc_imx.c b/drivers/usb/chipidea/usbmisc_imx.c
+index c57c1a71a5132..0938e274ba3a8 100644
+--- a/drivers/usb/chipidea/usbmisc_imx.c
++++ b/drivers/usb/chipidea/usbmisc_imx.c
+@@ -152,6 +152,7 @@ struct usbmisc_ops {
+ int (*charger_detection)(struct imx_usbmisc_data *data);
+ /* It's called when system resume from usb power lost */
+ int (*power_lost_check)(struct imx_usbmisc_data *data);
++ void (*vbus_comparator_on)(struct imx_usbmisc_data *data, bool on);
+ };
+
+ struct imx_usbmisc {
+@@ -875,6 +876,33 @@ static int imx7d_charger_detection(struct imx_usbmisc_data *data)
+ return ret;
+ }
+
++static void usbmisc_imx7d_vbus_comparator_on(struct imx_usbmisc_data *data,
++ bool on)
++{
++ unsigned long flags;
++ struct imx_usbmisc *usbmisc = dev_get_drvdata(data->dev);
++ u32 val;
++
++ if (data->hsic)
++ return;
++
++ spin_lock_irqsave(&usbmisc->lock, flags);
++ /*
++ * Disable VBUS valid comparator when in suspend mode,
++ * when OTG is disabled and DRVVBUS0 is asserted case
++ * the Bandgap circuitry and VBUS Valid comparator are
++ * still powered, even in Suspend or Sleep mode.
++ */
++ val = readl(usbmisc->base + MX7D_USB_OTG_PHY_CFG2);
++ if (on)
++ val |= MX7D_USB_OTG_PHY_CFG2_DRVVBUS0;
++ else
++ val &= ~MX7D_USB_OTG_PHY_CFG2_DRVVBUS0;
++
++ writel(val, usbmisc->base + MX7D_USB_OTG_PHY_CFG2);
++ spin_unlock_irqrestore(&usbmisc->lock, flags);
++}
++
+ static int usbmisc_imx7ulp_init(struct imx_usbmisc_data *data)
+ {
+ struct imx_usbmisc *usbmisc = dev_get_drvdata(data->dev);
+@@ -1018,6 +1046,7 @@ static const struct usbmisc_ops imx7d_usbmisc_ops = {
+ .set_wakeup = usbmisc_imx7d_set_wakeup,
+ .charger_detection = imx7d_charger_detection,
+ .power_lost_check = usbmisc_imx7d_power_lost_check,
++ .vbus_comparator_on = usbmisc_imx7d_vbus_comparator_on,
+ };
+
+ static const struct usbmisc_ops imx7ulp_usbmisc_ops = {
+@@ -1132,6 +1161,9 @@ int imx_usbmisc_suspend(struct imx_usbmisc_data *data, bool wakeup)
+
+ usbmisc = dev_get_drvdata(data->dev);
+
++ if (usbmisc->ops->vbus_comparator_on)
++ usbmisc->ops->vbus_comparator_on(data, false);
++
+ if (wakeup && usbmisc->ops->set_wakeup)
+ ret = usbmisc->ops->set_wakeup(data, true);
+ if (ret) {
+@@ -1185,6 +1217,9 @@ int imx_usbmisc_resume(struct imx_usbmisc_data *data, bool wakeup)
+ goto hsic_set_clk_fail;
+ }
+
++ if (usbmisc->ops->vbus_comparator_on)
++ usbmisc->ops->vbus_comparator_on(data, true);
++
+ return 0;
+
+ hsic_set_clk_fail:
+--
+2.40.1
+
--- /dev/null
+From 7f4b427005396ebc272ac84d68a25e4dc965837b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 May 2023 18:57:52 +0530
+Subject: usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push
+
+From: Prashanth K <quic_prashk@quicinc.com>
+
+[ Upstream commit e5990469943c711cb00bfde6338d2add6c6d0bfe ]
+
+When serial console over USB is enabled, gs_console_connect
+queues gs_console_work, where it acquires the spinlock and
+queues the usb request, and this request goes to gadget layer.
+Now consider a situation where gadget layer prints something
+to dmesg, this will eventually call gs_console_write() which
+requires cons->lock. And this causes spinlock recursion. Avoid
+this by excluding usb_ep_queue from the spinlock.
+
+ spin_lock_irqsave //needs cons->lock
+ gs_console_write
+ .
+ .
+ _printk
+ __warn_printk
+ dev_warn/pr_err
+ .
+ .
+ [USB Gadget Layer]
+ .
+ .
+ usb_ep_queue
+ gs_console_work
+ __gs_console_push // acquires cons->lock
+ process_one_work
+
+Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
+Link: https://lore.kernel.org/r/1683638872-6885-1-git-send-email-quic_prashk@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/u_serial.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
+index e5d522d54f6a3..97f07757d19e3 100644
+--- a/drivers/usb/gadget/function/u_serial.c
++++ b/drivers/usb/gadget/function/u_serial.c
+@@ -916,8 +916,11 @@ static void __gs_console_push(struct gs_console *cons)
+ }
+
+ req->length = size;
++
++ spin_unlock_irq(&cons->lock);
+ if (usb_ep_queue(ep, req, GFP_ATOMIC))
+ req->length = 0;
++ spin_lock_irq(&cons->lock);
+ }
+
+ static void gs_console_work(struct work_struct *work)
+--
+2.40.1
+
--- /dev/null
+From b621cbe2564146446e358fb0bb15188c01b02b90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 May 2023 16:11:03 -0700
+Subject: usb: gadget: uvc: queue empty isoc requests if no video buffer is
+ available
+
+From: Avichal Rakesh <arakesh@google.com>
+
+[ Upstream commit c3ff12a92bd7072170978b8b41c2fa41b038139a ]
+
+ISOC transfers expect a certain cadence of requests being queued. Not
+keeping up with the expected rate of requests results in missed ISOC
+transfers (EXDEV). The application layer may or may not produce video
+frames to match this expectation, so uvc gadget driver must handle cases
+where the application is not queuing up buffers fast enough to fulfill
+ISOC requirements.
+
+Currently, uvc gadget driver waits for new video buffer to become available
+before queuing up usb requests. With this patch the gadget driver queues up
+0 length usb requests whenever there are no video buffers available. The
+USB controller's complete callback is used as the limiter for how quickly
+the 0 length packets will be queued. Video buffers are still queued as
+soon as they become available.
+
+Link: https://lore.kernel.org/CAMHf4WKbi6KBPQztj9FA4kPvESc1fVKrC8G73-cs6tTeQby9=w@mail.gmail.com/
+Signed-off-by: Avichal Rakesh <arakesh@google.com>
+Link: https://lore.kernel.org/r/20230508231103.1621375-1-arakesh@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/uvc_video.c | 32 ++++++++++++++++++-------
+ 1 file changed, 24 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
+index dd1c6b2ca7c6f..e81865978299c 100644
+--- a/drivers/usb/gadget/function/uvc_video.c
++++ b/drivers/usb/gadget/function/uvc_video.c
+@@ -386,6 +386,9 @@ static void uvcg_video_pump(struct work_struct *work)
+ struct uvc_buffer *buf;
+ unsigned long flags;
+ int ret;
++ bool buf_int;
++ /* video->max_payload_size is only set when using bulk transfer */
++ bool is_bulk = video->max_payload_size;
+
+ while (video->ep->enabled) {
+ /*
+@@ -408,20 +411,35 @@ static void uvcg_video_pump(struct work_struct *work)
+ */
+ spin_lock_irqsave(&queue->irqlock, flags);
+ buf = uvcg_queue_head(queue);
+- if (buf == NULL) {
++
++ if (buf != NULL) {
++ video->encode(req, video, buf);
++ /* Always interrupt for the last request of a video buffer */
++ buf_int = buf->state == UVC_BUF_STATE_DONE;
++ } else if (!(queue->flags & UVC_QUEUE_DISCONNECTED) && !is_bulk) {
++ /*
++ * No video buffer available; the queue is still connected and
++ * we're traferring over ISOC. Queue a 0 length request to
++ * prevent missed ISOC transfers.
++ */
++ req->length = 0;
++ buf_int = false;
++ } else {
++ /*
++ * Either queue has been disconnected or no video buffer
++ * available to bulk transfer. Either way, stop processing
++ * further.
++ */
+ spin_unlock_irqrestore(&queue->irqlock, flags);
+ break;
+ }
+
+- video->encode(req, video, buf);
+-
+ /*
+ * With usb3 we have more requests. This will decrease the
+ * interrupt load to a quarter but also catches the corner
+ * cases, which needs to be handled.
+ */
+- if (list_empty(&video->req_free) ||
+- buf->state == UVC_BUF_STATE_DONE ||
++ if (list_empty(&video->req_free) || buf_int ||
+ !(video->req_int_count %
+ DIV_ROUND_UP(video->uvc_num_requests, 4))) {
+ video->req_int_count = 0;
+@@ -441,8 +459,7 @@ static void uvcg_video_pump(struct work_struct *work)
+
+ /* Endpoint now owns the request */
+ req = NULL;
+- if (buf->state != UVC_BUF_STATE_DONE)
+- video->req_int_count++;
++ video->req_int_count++;
+ }
+
+ if (!req)
+@@ -527,4 +544,3 @@ int uvcg_video_init(struct uvc_video *video, struct uvc_device *uvc)
+ V4L2_BUF_TYPE_VIDEO_OUTPUT, &video->mutex);
+ return 0;
+ }
+-
+--
+2.40.1
+
--- /dev/null
+From 9ede6a1f64c60f34386e807ae3b3b6118eaf0e3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jun 2023 11:19:07 +0800
+Subject: watchdog: sp5100_tco: support Hygon FCH/SCH (Server Controller Hub)
+
+From: Yuechao Zhao <yuechao.zhao@advantech.com.cn>
+
+[ Upstream commit 009637de1f65cff452ad49554d1e8ef9fda99e43 ]
+
+Add PCI_VENDOR_ID_HYGON(Hygon vendor id [0x1d94]) in this driver
+
+Signed-off-by: Yuechao Zhao <yuechao.zhao@advantech.com.cn>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lkml.kernel.org/r/20230612031907.796461-1-a345351830@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/sp5100_tco.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/watchdog/sp5100_tco.c b/drivers/watchdog/sp5100_tco.c
+index 14f8d8d90920f..2bd3dc25cb030 100644
+--- a/drivers/watchdog/sp5100_tco.c
++++ b/drivers/watchdog/sp5100_tco.c
+@@ -96,7 +96,7 @@ static enum tco_reg_layout tco_reg_layout(struct pci_dev *dev)
+ sp5100_tco_pci->device == PCI_DEVICE_ID_AMD_KERNCZ_SMBUS &&
+ sp5100_tco_pci->revision >= AMD_ZEN_SMBUS_PCI_REV) {
+ return efch_mmio;
+- } else if (dev->vendor == PCI_VENDOR_ID_AMD &&
++ } else if ((dev->vendor == PCI_VENDOR_ID_AMD || dev->vendor == PCI_VENDOR_ID_HYGON) &&
+ ((dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS &&
+ dev->revision >= 0x41) ||
+ (dev->device == PCI_DEVICE_ID_AMD_KERNCZ_SMBUS &&
+@@ -579,6 +579,8 @@ static const struct pci_device_id sp5100_tco_pci_tbl[] = {
+ PCI_ANY_ID, },
+ { PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_KERNCZ_SMBUS, PCI_ANY_ID,
+ PCI_ANY_ID, },
++ { PCI_VENDOR_ID_HYGON, PCI_DEVICE_ID_AMD_KERNCZ_SMBUS, PCI_ANY_ID,
++ PCI_ANY_ID, },
+ { 0, }, /* End of list */
+ };
+ MODULE_DEVICE_TABLE(pci, sp5100_tco_pci_tbl);
+--
+2.40.1
+
--- /dev/null
+From 8e2a5d5f7d646129c3182cc7f930a6369a7793e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 14:08:49 +0100
+Subject: Wrap lines at 80
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 936dc763c52e05cb2e7302af30a69c826916d89e ]
+
+Wrap a line at 80 to stop checkpatch complaining.
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Jeff Layton <jlayton@kernel.org>
+cc: Steve French <sfrench@samba.org>
+cc: Shyam Prasad N <nspmangalore@gmail.com>
+cc: Rohith Surabattula <rohiths.msft@gmail.com>
+cc: Jens Axboe <axboe@kernel.dk>
+cc: Herbert Xu <herbert@gondor.apana.org.au>
+cc: "David S. Miller" <davem@davemloft.net>
+cc: Eric Dumazet <edumazet@google.com>
+cc: Jakub Kicinski <kuba@kernel.org>
+cc: Paolo Abeni <pabeni@redhat.com>
+cc: Matthew Wilcox <willy@infradead.org>
+cc: Simon Horman <simon.horman@corigine.com>
+cc: linux-crypto@vger.kernel.org
+cc: linux-cachefs@redhat.com
+cc: linux-cifs@vger.kernel.org
+cc: linux-fsdevel@vger.kernel.org
+cc: netdev@vger.kernel.org
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Stable-dep-of: f443fd5af5db ("crypto, cifs: fix error handling in extract_iter_to_sg()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/netfs/iterator.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/netfs/iterator.c b/fs/netfs/iterator.c
+index f41a37bca1e8b..9f09dc30ceb65 100644
+--- a/fs/netfs/iterator.c
++++ b/fs/netfs/iterator.c
+@@ -119,7 +119,8 @@ static ssize_t extract_user_to_sg(struct iov_iter *iter,
+ size_t len, off;
+
+ /* We decant the page list into the tail of the scatterlist */
+- pages = (void *)sgtable->sgl + array_size(sg_max, sizeof(struct scatterlist));
++ pages = (void *)sgtable->sgl +
++ array_size(sg_max, sizeof(struct scatterlist));
+ pages -= sg_max;
+
+ do {
+--
+2.40.1
+
--- /dev/null
+From ba4565679887d8004edc62700fd69bda586bb974 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jun 2023 17:40:02 +0300
+Subject: xhci: get rid of XHCI_PLAT quirk that used to prevent MSI setup
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+[ Upstream commit 0a4776205b16d038ec6fedef2094951fcb6f441b ]
+
+The XHCI_PLAT quirk was only needed to ensure non-PCI xHC host avoided
+setting up MSI interrupts in generic xhci codepaths.
+
+The MSI setup code is now moved to PCI specific xhci-pci.c file so
+the quirk is no longer needed.
+
+Remove setting the XHCI_PLAT quirk for HiSilocon SoC xHC, NVIDIA Tegra xHC,
+MediaTek xHC, the generic xhci-plat driver, and the checks for XHCI_PLAT
+in xhci-pci.c MSI setup code.
+
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Message-ID: <20230602144009.1225632-5-mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-histb.c | 12 +-----------
+ drivers/usb/host/xhci-mtk.c | 6 ------
+ drivers/usb/host/xhci-pci.c | 7 -------
+ drivers/usb/host/xhci-plat.c | 7 +------
+ drivers/usb/host/xhci-tegra.c | 1 -
+ drivers/usb/host/xhci.h | 2 +-
+ 6 files changed, 3 insertions(+), 32 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-histb.c b/drivers/usb/host/xhci-histb.c
+index 91ce97821de51..7c20477550830 100644
+--- a/drivers/usb/host/xhci-histb.c
++++ b/drivers/usb/host/xhci-histb.c
+@@ -164,16 +164,6 @@ static void xhci_histb_host_disable(struct xhci_hcd_histb *histb)
+ clk_disable_unprepare(histb->bus_clk);
+ }
+
+-static void xhci_histb_quirks(struct device *dev, struct xhci_hcd *xhci)
+-{
+- /*
+- * As of now platform drivers don't provide MSI support so we ensure
+- * here that the generic code does not try to make a pci_dev from our
+- * dev struct in order to setup MSI
+- */
+- xhci->quirks |= XHCI_PLAT;
+-}
+-
+ /* called during probe() after chip reset completes */
+ static int xhci_histb_setup(struct usb_hcd *hcd)
+ {
+@@ -186,7 +176,7 @@ static int xhci_histb_setup(struct usb_hcd *hcd)
+ return ret;
+ }
+
+- return xhci_gen_setup(hcd, xhci_histb_quirks);
++ return xhci_gen_setup(hcd, NULL);
+ }
+
+ static const struct xhci_driver_overrides xhci_histb_overrides __initconst = {
+diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c
+index b60521e1a9a63..9a40da3b0064b 100644
+--- a/drivers/usb/host/xhci-mtk.c
++++ b/drivers/usb/host/xhci-mtk.c
+@@ -418,12 +418,6 @@ static void xhci_mtk_quirks(struct device *dev, struct xhci_hcd *xhci)
+ struct usb_hcd *hcd = xhci_to_hcd(xhci);
+ struct xhci_hcd_mtk *mtk = hcd_to_mtk(hcd);
+
+- /*
+- * As of now platform drivers don't provide MSI support so we ensure
+- * here that the generic code does not try to make a pci_dev from our
+- * dev struct in order to setup MSI
+- */
+- xhci->quirks |= XHCI_PLAT;
+ xhci->quirks |= XHCI_MTK_HOST;
+ /*
+ * MTK host controller gives a spurious successful event after a
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index db9826c38b20b..9540f0e48c215 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -108,9 +108,6 @@ static void xhci_cleanup_msix(struct xhci_hcd *xhci)
+ struct usb_hcd *hcd = xhci_to_hcd(xhci);
+ struct pci_dev *pdev = to_pci_dev(hcd->self.controller);
+
+- if (xhci->quirks & XHCI_PLAT)
+- return;
+-
+ /* return if using legacy interrupt */
+ if (hcd->irq > 0)
+ return;
+@@ -208,10 +205,6 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
+ struct pci_dev *pdev;
+ int ret;
+
+- /* The xhci platform device has set up IRQs through usb_add_hcd. */
+- if (xhci->quirks & XHCI_PLAT)
+- return 0;
+-
+ pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
+ /*
+ * Some Fresco Logic host controllers advertise MSI, but fail to
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index f36633fa83624..80da67a6c3bf2 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -78,12 +78,7 @@ static void xhci_plat_quirks(struct device *dev, struct xhci_hcd *xhci)
+ {
+ struct xhci_plat_priv *priv = xhci_to_priv(xhci);
+
+- /*
+- * As of now platform drivers don't provide MSI support so we ensure
+- * here that the generic code does not try to make a pci_dev from our
+- * dev struct in order to setup MSI
+- */
+- xhci->quirks |= XHCI_PLAT | priv->quirks;
++ xhci->quirks |= priv->quirks;
+ }
+
+ /* called during probe() after chip reset completes */
+diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c
+index d28fa892c2866..07a319db58034 100644
+--- a/drivers/usb/host/xhci-tegra.c
++++ b/drivers/usb/host/xhci-tegra.c
+@@ -2662,7 +2662,6 @@ static void tegra_xhci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ {
+ struct tegra_xusb *tegra = dev_get_drvdata(dev);
+
+- xhci->quirks |= XHCI_PLAT;
+ if (tegra && tegra->soc->lpm_support)
+ xhci->quirks |= XHCI_LPM_SUPPORT;
+ }
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 4474d540f6b49..0b1928851a2a9 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1874,7 +1874,7 @@ struct xhci_hcd {
+ #define XHCI_SPURIOUS_REBOOT BIT_ULL(13)
+ #define XHCI_COMP_MODE_QUIRK BIT_ULL(14)
+ #define XHCI_AVOID_BEI BIT_ULL(15)
+-#define XHCI_PLAT BIT_ULL(16)
++#define XHCI_PLAT BIT_ULL(16) /* Deprecated */
+ #define XHCI_SLOW_SUSPEND BIT_ULL(17)
+ #define XHCI_SPURIOUS_WAKEUP BIT_ULL(18)
+ /* For controllers with a broken beyond repair streams implementation */
+--
+2.40.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
