--- /dev/null
+From e6c5cf8ed49a045ac9e2bb58184b40c4fdff8c3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Apr 2025 23:56:14 -0400
+Subject: do_umount(): add missing barrier before refcount checks in sync case
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 65781e19dcfcb4aed1167d87a3ffcc2a0c071d47 ]
+
+do_umount() analogue of the race fixed in 119e1ef80ecf "fix
+__legitimize_mnt()/mntput() race". Here we want to make sure that
+if __legitimize_mnt() doesn't notice our lock_mount_hash(), we will
+notice their refcount increment. Harder to hit than mntput_no_expire()
+one, fortunately, and consequences are milder (sync umount acting
+like umount -l on a rare race with RCU pathwalk hitting at just the
+wrong time instead of use-after-free galore mntput_no_expire()
+counterpart used to be hit). Still a bug...
+
+Fixes: 48a066e72d97 ("RCU'd vfsmounts")
+Reviewed-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/namespace.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/namespace.c b/fs/namespace.c
+index bd601ab26e781..c3c1e8c644f2e 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -747,7 +747,7 @@ int __legitimize_mnt(struct vfsmount *bastard, unsigned seq)
+ return 0;
+ mnt = real_mount(bastard);
+ mnt_add_count(mnt, 1);
+- smp_mb(); // see mntput_no_expire()
++ smp_mb(); // see mntput_no_expire() and do_umount()
+ if (likely(!read_seqretry(&mount_lock, seq)))
+ return 0;
+ if (bastard->mnt_flags & MNT_SYNC_UMOUNT) {
+@@ -1916,6 +1916,7 @@ static int do_umount(struct mount *mnt, int flags)
+ umount_tree(mnt, UMOUNT_PROPAGATE);
+ retval = 0;
+ } else {
++ smp_mb(); // paired with __legitimize_mnt()
+ shrink_submounts(mnt);
+ retval = -EBUSY;
+ if (!propagate_mount_busy(mnt, 2)) {
+--
+2.39.5
+
--- /dev/null
+From 8111bb5a032927d21e4b7934291ef2565b349998 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 May 2025 12:02:56 -0500
+Subject: drm/panel: simple: Update timings for AUO G101EVN010
+
+From: Kevin Baker <kevinb@ventureresearch.com>
+
+[ Upstream commit 7c6fa1797a725732981f2d77711c867166737719 ]
+
+Switch to panel timings based on datasheet for the AUO G101EVN01.0
+LVDS panel. Default timings were tested on the panel.
+
+Previous mode-based timings resulted in horizontal display shift.
+
+Signed-off-by: Kevin Baker <kevinb@ventureresearch.com>
+Fixes: 4fb86404a977 ("drm/panel: simple: Add AUO G101EVN010 panel support")
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20250505170256.1385113-1-kevinb@ventureresearch.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20250505170256.1385113-1-kevinb@ventureresearch.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-simple.c | 25 +++++++++++++------------
+ 1 file changed, 13 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index 06381c6282097..d041ff542a4ee 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -1027,27 +1027,28 @@ static const struct panel_desc auo_g070vvn01 = {
+ },
+ };
+
+-static const struct drm_display_mode auo_g101evn010_mode = {
+- .clock = 68930,
+- .hdisplay = 1280,
+- .hsync_start = 1280 + 82,
+- .hsync_end = 1280 + 82 + 2,
+- .htotal = 1280 + 82 + 2 + 84,
+- .vdisplay = 800,
+- .vsync_start = 800 + 8,
+- .vsync_end = 800 + 8 + 2,
+- .vtotal = 800 + 8 + 2 + 6,
++static const struct display_timing auo_g101evn010_timing = {
++ .pixelclock = { 64000000, 68930000, 85000000 },
++ .hactive = { 1280, 1280, 1280 },
++ .hfront_porch = { 8, 64, 256 },
++ .hback_porch = { 8, 64, 256 },
++ .hsync_len = { 40, 168, 767 },
++ .vactive = { 800, 800, 800 },
++ .vfront_porch = { 4, 8, 100 },
++ .vback_porch = { 4, 8, 100 },
++ .vsync_len = { 8, 16, 223 },
+ };
+
+ static const struct panel_desc auo_g101evn010 = {
+- .modes = &auo_g101evn010_mode,
+- .num_modes = 1,
++ .timings = &auo_g101evn010_timing,
++ .num_timings = 1,
+ .bpc = 6,
+ .size = {
+ .width = 216,
+ .height = 135,
+ },
+ .bus_format = MEDIA_BUS_FMT_RGB666_1X7X3_SPWG,
++ .bus_flags = DRM_BUS_FLAG_DE_HIGH,
+ .connector_type = DRM_MODE_CONNECTOR_LVDS,
+ };
+
+--
+2.39.5
+
--- /dev/null
+From 305e252ca4bd8268378fab75c77846ddf75be726 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Apr 2025 13:53:57 +0530
+Subject: drm/xe/tests/mocs: Hold XE_FORCEWAKE_ALL for LNCF regs
+
+From: Tejas Upadhyay <tejas.upadhyay@intel.com>
+
+[ Upstream commit 51c0ee84e4dc339287b2d7335f2b54d747794c83 ]
+
+LNCF registers report wrong values when XE_FORCEWAKE_GT
+only is held. Holding XE_FORCEWAKE_ALL ensures correct
+operations on LNCF regs.
+
+V2(Himal):
+ - Use xe_force_wake_ref_has_domain
+
+Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/1999
+Fixes: a6a4ea6d7d37 ("drm/xe: Add mocs kunit")
+Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250428082357.1730068-1-tejas.upadhyay@intel.com
+Signed-off-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
+(cherry picked from commit 70a2585e582058e94fe4381a337be42dec800337)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/tests/xe_mocs.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/tests/xe_mocs.c b/drivers/gpu/drm/xe/tests/xe_mocs.c
+index 434e7c7e60883..61a7d20ce42bf 100644
+--- a/drivers/gpu/drm/xe/tests/xe_mocs.c
++++ b/drivers/gpu/drm/xe/tests/xe_mocs.c
+@@ -46,8 +46,11 @@ static void read_l3cc_table(struct xe_gt *gt,
+ unsigned int fw_ref, i;
+ u32 reg_val;
+
+- fw_ref = xe_force_wake_get(gt_to_fw(gt), XE_FW_GT);
+- KUNIT_ASSERT_NE_MSG(test, fw_ref, 0, "Forcewake Failed.\n");
++ fw_ref = xe_force_wake_get(gt_to_fw(gt), XE_FORCEWAKE_ALL);
++ if (!xe_force_wake_ref_has_domain(fw_ref, XE_FORCEWAKE_ALL)) {
++ xe_force_wake_put(gt_to_fw(gt), fw_ref);
++ KUNIT_ASSERT_TRUE_MSG(test, true, "Forcewake Failed.\n");
++ }
+
+ for (i = 0; i < info->num_mocs_regs; i++) {
+ if (!(i & 1)) {
+--
+2.39.5
+
--- /dev/null
+From 510df00076d687660106bbf26e62fb06b943c651 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2024 13:25:47 +0530
+Subject: drm/xe/tests/mocs: Update xe_force_wake_get() return handling
+
+From: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
+
+[ Upstream commit 6a966d677d06e96a81d430537abb5db65e2b4fda ]
+
+With xe_force_wake_get() now returning the refcount-incremented domain
+mask, a return value of 0 indicates failure for single domains.
+Change assert condition to incorporate this change in return and
+pass the return value to xe_force_wake_put()
+
+v3
+- return xe_wakeref_t instead of int in xe_force_wake_get()
+
+v5
+- return unsigned int for xe_force_wake_get()
+
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
+Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
+Reviewed-by: Badal Nilawar <badal.nilawar@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241014075601.2324382-13-himal.prasad.ghimiray@intel.com
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Stable-dep-of: 51c0ee84e4dc ("drm/xe/tests/mocs: Hold XE_FORCEWAKE_ALL for LNCF regs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/tests/xe_mocs.c | 18 ++++++++----------
+ 1 file changed, 8 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/tests/xe_mocs.c b/drivers/gpu/drm/xe/tests/xe_mocs.c
+index 79be73b4a02ba..434e7c7e60883 100644
+--- a/drivers/gpu/drm/xe/tests/xe_mocs.c
++++ b/drivers/gpu/drm/xe/tests/xe_mocs.c
+@@ -43,12 +43,11 @@ static void read_l3cc_table(struct xe_gt *gt,
+ {
+ struct kunit *test = kunit_get_current_test();
+ u32 l3cc, l3cc_expected;
+- unsigned int i;
++ unsigned int fw_ref, i;
+ u32 reg_val;
+- u32 ret;
+
+- ret = xe_force_wake_get(gt_to_fw(gt), XE_FW_GT);
+- KUNIT_ASSERT_EQ_MSG(test, ret, 0, "Forcewake Failed.\n");
++ fw_ref = xe_force_wake_get(gt_to_fw(gt), XE_FW_GT);
++ KUNIT_ASSERT_NE_MSG(test, fw_ref, 0, "Forcewake Failed.\n");
+
+ for (i = 0; i < info->num_mocs_regs; i++) {
+ if (!(i & 1)) {
+@@ -72,7 +71,7 @@ static void read_l3cc_table(struct xe_gt *gt,
+ KUNIT_EXPECT_EQ_MSG(test, l3cc_expected, l3cc,
+ "l3cc idx=%u has incorrect val.\n", i);
+ }
+- xe_force_wake_put(gt_to_fw(gt), XE_FW_GT);
++ xe_force_wake_put(gt_to_fw(gt), fw_ref);
+ }
+
+ static void read_mocs_table(struct xe_gt *gt,
+@@ -80,15 +79,14 @@ static void read_mocs_table(struct xe_gt *gt,
+ {
+ struct kunit *test = kunit_get_current_test();
+ u32 mocs, mocs_expected;
+- unsigned int i;
++ unsigned int fw_ref, i;
+ u32 reg_val;
+- u32 ret;
+
+ KUNIT_EXPECT_TRUE_MSG(test, info->unused_entries_index,
+ "Unused entries index should have been defined\n");
+
+- ret = xe_force_wake_get(gt_to_fw(gt), XE_FW_GT);
+- KUNIT_ASSERT_EQ_MSG(test, ret, 0, "Forcewake Failed.\n");
++ fw_ref = xe_force_wake_get(gt_to_fw(gt), XE_FW_GT);
++ KUNIT_ASSERT_NE_MSG(test, fw_ref, 0, "Forcewake Failed.\n");
+
+ for (i = 0; i < info->num_mocs_regs; i++) {
+ if (regs_are_mcr(gt))
+@@ -106,7 +104,7 @@ static void read_mocs_table(struct xe_gt *gt,
+ "mocs reg 0x%x has incorrect val.\n", i);
+ }
+
+- xe_force_wake_put(gt_to_fw(gt), XE_FW_GT);
++ xe_force_wake_put(gt_to_fw(gt), fw_ref);
+ }
+
+ static int mocs_kernel_test_run_device(struct xe_device *xe)
+--
+2.39.5
+
--- /dev/null
+From 3effa0f8e156329d3e727210eee1622c84ca42e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Apr 2025 11:34:27 +0100
+Subject: iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+[ Upstream commit 1bb942287e05dc4c304a003ea85e6dd9a5e7db39 ]
+
+The IIO ABI requires 64-bit aligned timestamps. In this case insufficient
+padding would have been added on architectures where an s64 is only 32-bit
+aligned. Use aligned_s64 to enforce the correct alignment.
+
+Fixes: 327a0eaf19d5 ("iio: accel: adxl355: Add triggered buffer support")
+Reported-by: David Lechner <dlechner@baylibre.com>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Reviewed-by: David Lechner <dlechner@baylibre.com>
+Link: https://patch.msgid.link/20250413103443.2420727-5-jic23@kernel.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/accel/adxl355_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/accel/adxl355_core.c b/drivers/iio/accel/adxl355_core.c
+index eabaefa92f19d..5e1946828b968 100644
+--- a/drivers/iio/accel/adxl355_core.c
++++ b/drivers/iio/accel/adxl355_core.c
+@@ -231,7 +231,7 @@ struct adxl355_data {
+ u8 transf_buf[3];
+ struct {
+ u8 buf[14];
+- s64 ts;
++ aligned_s64 ts;
+ } buffer;
+ } __aligned(IIO_DMA_MINALIGN);
+ };
+--
+2.39.5
+
--- /dev/null
+From a4c59ef615f53690a42edd498a8c9f80fea84518 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Mar 2025 19:35:15 +0000
+Subject: iio: accel: adxl367: fix setting odr for activity time update
+
+From: Lothar Rubusch <l.rubusch@gmail.com>
+
+[ Upstream commit 38f67d0264929762e54ae5948703a21f841fe706 ]
+
+Fix setting the odr value to update activity time based on frequency
+derrived by recent odr, and not by obsolete odr value.
+
+The [small] bug: When _adxl367_set_odr() is called with a new odr value,
+it first writes the new odr value to the hardware register
+ADXL367_REG_FILTER_CTL.
+Second, it calls _adxl367_set_act_time_ms(), which calls
+adxl367_time_ms_to_samples(). Here st->odr still holds the old odr value.
+This st->odr member is used to derrive a frequency value, which is
+applied to update ADXL367_REG_TIME_ACT. Hence, the idea is to update
+activity time, based on possibilities and power consumption by the
+current ODR rate.
+Finally, when the function calls return, again in _adxl367_set_odr() the
+new ODR is assigned to st->odr.
+
+The fix: When setting a new ODR value is set to ADXL367_REG_FILTER_CTL,
+also ADXL367_REG_TIME_ACT should probably be updated with a frequency
+based on the recent ODR value and not the old one. Changing the location
+of the assignment to st->odr fixes this.
+
+Fixes: cbab791c5e2a5 ("iio: accel: add ADXL367 driver")
+Signed-off-by: Lothar Rubusch <l.rubusch@gmail.com>
+Reviewed-by: Marcelo Schmitt <marcelo.schmitt1@gmail.com>
+Link: https://patch.msgid.link/20250309193515.2974-1-l.rubusch@gmail.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/accel/adxl367.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/iio/accel/adxl367.c b/drivers/iio/accel/adxl367.c
+index e790a66d86c79..d44d52e5a5140 100644
+--- a/drivers/iio/accel/adxl367.c
++++ b/drivers/iio/accel/adxl367.c
+@@ -604,18 +604,14 @@ static int _adxl367_set_odr(struct adxl367_state *st, enum adxl367_odr odr)
+ if (ret)
+ return ret;
+
++ st->odr = odr;
++
+ /* Activity timers depend on ODR */
+ ret = _adxl367_set_act_time_ms(st, st->act_time_ms);
+ if (ret)
+ return ret;
+
+- ret = _adxl367_set_inact_time_ms(st, st->inact_time_ms);
+- if (ret)
+- return ret;
+-
+- st->odr = odr;
+-
+- return 0;
++ return _adxl367_set_inact_time_ms(st, st->inact_time_ms);
+ }
+
+ static int adxl367_set_odr(struct iio_dev *indio_dev, enum adxl367_odr odr)
+--
+2.39.5
+
--- /dev/null
+From ecfae776d054d7c7b3c6d8f2e1a0cc7309b478ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Apr 2025 11:34:26 +0100
+Subject: iio: adc: dln2: Use aligned_s64 for timestamp
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+[ Upstream commit 5097eaae98e53f9ab9d35801c70da819b92ca907 ]
+
+Here the lack of marking allows the overall structure to not be
+sufficiently aligned resulting in misplacement of the timestamp
+in iio_push_to_buffers_with_timestamp(). Use aligned_s64 to
+force the alignment on all architectures.
+
+Fixes: 7c0299e879dd ("iio: adc: Add support for DLN2 ADC")
+Reported-by: David Lechner <dlechner@baylibre.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Reviewed-by: David Lechner <dlechner@baylibre.com>
+Link: https://patch.msgid.link/20250413103443.2420727-4-jic23@kernel.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/dln2-adc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/adc/dln2-adc.c b/drivers/iio/adc/dln2-adc.c
+index de7252a10047d..84c23d3def597 100644
+--- a/drivers/iio/adc/dln2-adc.c
++++ b/drivers/iio/adc/dln2-adc.c
+@@ -481,7 +481,7 @@ static irqreturn_t dln2_adc_trigger_h(int irq, void *p)
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct {
+ __le16 values[DLN2_ADC_MAX_CHANNELS];
+- int64_t timestamp_space;
++ aligned_s64 timestamp_space;
+ } data;
+ struct dln2_adc_get_all_vals dev_data;
+ struct dln2_adc *dln2 = iio_priv(indio_dev);
+--
+2.39.5
+
--- /dev/null
+From f6e8d49ad0f19f4ddbcb145636b544b91e35cff5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Apr 2025 11:34:36 +0100
+Subject: iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer.
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+[ Upstream commit f79aeb6c631b57395f37acbfbe59727e355a714c ]
+
+The trick of using __aligned(IIO_DMA_MINALIGN) ensures that there is
+no overlap between buffers used for DMA and those used for driver
+state storage that are before the marking. It doesn't ensure
+anything above state variables found after the marking. Hence
+move this particular bit of state earlier in the structure.
+
+Fixes: 10897f34309b ("iio: temp: maxim_thermocouple: Fix alignment for DMA safety")
+Reviewed-by: David Lechner <dlechner@baylibre.com>
+Link: https://patch.msgid.link/20250413103443.2420727-14-jic23@kernel.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/temperature/maxim_thermocouple.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/temperature/maxim_thermocouple.c b/drivers/iio/temperature/maxim_thermocouple.c
+index c28a7a6dea5f1..555a61e2f3fdd 100644
+--- a/drivers/iio/temperature/maxim_thermocouple.c
++++ b/drivers/iio/temperature/maxim_thermocouple.c
+@@ -121,9 +121,9 @@ static const struct maxim_thermocouple_chip maxim_thermocouple_chips[] = {
+ struct maxim_thermocouple_data {
+ struct spi_device *spi;
+ const struct maxim_thermocouple_chip *chip;
++ char tc_type;
+
+ u8 buffer[16] __aligned(IIO_DMA_MINALIGN);
+- char tc_type;
+ };
+
+ static int maxim_thermocouple_read(struct maxim_thermocouple_data *data,
+--
+2.39.5
+
--- /dev/null
+From a546e062ef5e5749e0949dcf1f115393df1c4540 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 May 2025 14:12:03 -0400
+Subject: io_uring/sqpoll: Increase task_work submission batch size
+
+From: Gabriel Krisman Bertazi <krisman@suse.de>
+
+[ Upstream commit 92835cebab120f8a5f023a26a792a2ac3f816c4f ]
+
+Our QA team reported a 10%-23%, throughput reduction on an io_uring
+sqpoll testcase doing IO to a null_blk, that I traced back to a
+reduction of the device submission queue depth utilization. It turns out
+that, after commit af5d68f8892f ("io_uring/sqpoll: manage task_work
+privately"), we capped the number of task_work entries that can be
+completed from a single spin of sqpoll to only 8 entries, before the
+sqpoll goes around to (potentially) sleep. While this cap doesn't drive
+the submission side directly, it impacts the completion behavior, which
+affects the number of IO queued by fio per sqpoll cycle on the
+submission side, and io_uring ends up seeing less ios per sqpoll cycle.
+As a result, block layer plugging is less effective, and we see more
+time spent inside the block layer in profilings charts, and increased
+submission latency measured by fio.
+
+There are other places that have increased overhead once sqpoll sleeps
+more often, such as the sqpoll utilization calculation. But, in this
+microbenchmark, those were not representative enough in perf charts, and
+their removal didn't yield measurable changes in throughput. The major
+overhead comes from the fact we plug less, and less often, when submitting
+to the block layer.
+
+My benchmark is:
+
+fio --ioengine=io_uring --direct=1 --iodepth=128 --runtime=300 --bs=4k \
+ --invalidate=1 --time_based --ramp_time=10 --group_reporting=1 \
+ --filename=/dev/nullb0 --name=RandomReads-direct-nullb-sqpoll-4k-1 \
+ --rw=randread --numjobs=1 --sqthread_poll
+
+In one machine, tested on top of Linux 6.15-rc1, we have the following
+baseline:
+ READ: bw=4994MiB/s (5236MB/s), 4994MiB/s-4994MiB/s (5236MB/s-5236MB/s), io=439GiB (471GB), run=90001-90001msec
+
+With this patch:
+ READ: bw=5762MiB/s (6042MB/s), 5762MiB/s-5762MiB/s (6042MB/s-6042MB/s), io=506GiB (544GB), run=90001-90001msec
+
+which is a 15% improvement in measured bandwidth. The average
+submission latency is noticeably lowered too. As measured by
+fio:
+
+Baseline:
+ lat (usec): min=20, max=241, avg=99.81, stdev=3.38
+Patched:
+ lat (usec): min=26, max=226, avg=86.48, stdev=4.82
+
+If we look at blktrace, we can also see the plugging behavior is
+improved. In the baseline, we end up limited to plugging 8 requests in
+the block layer regardless of the device queue depth size, while after
+patching we can drive more io, and we manage to utilize the full device
+queue.
+
+In the baseline, after a stabilization phase, an ordinary submission
+looks like:
+ 254,0 1 49942 0.016028795 5977 U N [iou-sqp-5976] 7
+
+After patching, I see consistently more requests per unplug.
+ 254,0 1 4996 0.001432872 3145 U N [iou-sqp-3144] 32
+
+Ideally, the cap size would at least be the deep enough to fill the
+device queue, but we can't predict that behavior, or assume all IO goes
+to a single device, and thus can't guess the ideal batch size. We also
+don't want to let the tw run unbounded, though I'm not sure it would
+really be a problem. Instead, let's just give it a more sensible value
+that will allow for more efficient batching. I've tested with different
+cap values, and initially proposed to increase the cap to 1024. Jens
+argued it is too big of a bump and I observed that, with 32, I'm no
+longer able to observe this bottleneck in any of my machines.
+
+Fixes: af5d68f8892f ("io_uring/sqpoll: manage task_work privately")
+Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de>
+Link: https://lore.kernel.org/r/20250508181203.3785544-1-krisman@suse.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/sqpoll.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/io_uring/sqpoll.c b/io_uring/sqpoll.c
+index 5bc54c6df20fd..430922c541681 100644
+--- a/io_uring/sqpoll.c
++++ b/io_uring/sqpoll.c
+@@ -20,7 +20,7 @@
+ #include "sqpoll.h"
+
+ #define IORING_SQPOLL_CAP_ENTRIES_VALUE 8
+-#define IORING_TW_CAP_ENTRIES_VALUE 8
++#define IORING_TW_CAP_ENTRIES_VALUE 32
+
+ enum {
+ IO_SQ_THREAD_SHOULD_STOP = 0,
+--
+2.39.5
+
--- /dev/null
+From 9d9acb03f7295b158a0a0c9194a2e145da0352d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Apr 2025 22:36:26 +0800
+Subject: loop: Add sanity check for read/write_iter
+
+From: Lizhi Xu <lizhi.xu@windriver.com>
+
+[ Upstream commit f5c84eff634ba003326aa034c414e2a9dcb7c6a7 ]
+
+Some file systems do not support read_iter/write_iter, such as selinuxfs
+in this issue.
+So before calling them, first confirm that the interface is supported and
+then call it.
+
+It is releavant in that vfs_iter_read/write have the check, and removal
+of their used caused szybot to be able to hit this issue.
+
+Fixes: f2fed441c69b ("loop: stop using vfs_iter__{read,write} for buffered I/O")
+Reported-by: syzbot+6af973a3b8dfd2faefdc@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=6af973a3b8dfd2faefdc
+Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20250428143626.3318717-1-lizhi.xu@windriver.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/loop.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index e083099a01e29..6bd44ec2c9b1a 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -501,6 +501,17 @@ static void loop_assign_backing_file(struct loop_device *lo, struct file *file)
+ lo->old_gfp_mask & ~(__GFP_IO | __GFP_FS));
+ }
+
++static int loop_check_backing_file(struct file *file)
++{
++ if (!file->f_op->read_iter)
++ return -EINVAL;
++
++ if ((file->f_mode & FMODE_WRITE) && !file->f_op->write_iter)
++ return -EINVAL;
++
++ return 0;
++}
++
+ /*
+ * loop_change_fd switched the backing store of a loopback device to
+ * a new file. This is useful for operating system installers to free up
+@@ -521,6 +532,10 @@ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev,
+ if (!file)
+ return -EBADF;
+
++ error = loop_check_backing_file(file);
++ if (error)
++ return error;
++
+ /* suppress uevents while reconfiguring the device */
+ dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 1);
+
+@@ -953,6 +968,14 @@ static int loop_configure(struct loop_device *lo, blk_mode_t mode,
+
+ if (!file)
+ return -EBADF;
++
++ if ((mode & BLK_OPEN_WRITE) && !file->f_op->write_iter)
++ return -EINVAL;
++
++ error = loop_check_backing_file(file);
++ if (error)
++ return error;
++
+ is_loop = is_loop_device(file);
+
+ /* This is safe, since we have a reference from open(). */
+--
+2.39.5
+
--- /dev/null
+From de8f59326d477c5602f3d0aac0c13fe88790c056 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Jan 2025 13:00:38 +0100
+Subject: loop: factor out a loop_assign_backing_file helper
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit d278164832618bf2775c6a89e6434e2633de1eed ]
+
+Split the code for setting up a backing file into a helper in preparation
+of adding more code to this path.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Link: https://lore.kernel.org/r/20250131120120.1315125-2-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: f5c84eff634b ("loop: Add sanity check for read/write_iter")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/loop.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 81995ebefc962..e083099a01e29 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -493,6 +493,14 @@ static int loop_validate_file(struct file *file, struct block_device *bdev)
+ return 0;
+ }
+
++static void loop_assign_backing_file(struct loop_device *lo, struct file *file)
++{
++ lo->lo_backing_file = file;
++ lo->old_gfp_mask = mapping_gfp_mask(file->f_mapping);
++ mapping_set_gfp_mask(file->f_mapping,
++ lo->old_gfp_mask & ~(__GFP_IO | __GFP_FS));
++}
++
+ /*
+ * loop_change_fd switched the backing store of a loopback device to
+ * a new file. This is useful for operating system installers to free up
+@@ -545,10 +553,7 @@ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev,
+ disk_force_media_change(lo->lo_disk);
+ blk_mq_freeze_queue(lo->lo_queue);
+ mapping_set_gfp_mask(old_file->f_mapping, lo->old_gfp_mask);
+- lo->lo_backing_file = file;
+- lo->old_gfp_mask = mapping_gfp_mask(file->f_mapping);
+- mapping_set_gfp_mask(file->f_mapping,
+- lo->old_gfp_mask & ~(__GFP_IO|__GFP_FS));
++ loop_assign_backing_file(lo, file);
+ loop_update_dio(lo);
+ blk_mq_unfreeze_queue(lo->lo_queue);
+ partscan = lo->lo_flags & LO_FLAGS_PARTSCAN;
+@@ -940,7 +945,6 @@ static int loop_configure(struct loop_device *lo, blk_mode_t mode,
+ const struct loop_config *config)
+ {
+ struct file *file = fget(config->fd);
+- struct address_space *mapping;
+ struct queue_limits lim;
+ int error;
+ loff_t size;
+@@ -976,8 +980,6 @@ static int loop_configure(struct loop_device *lo, blk_mode_t mode,
+ if (error)
+ goto out_unlock;
+
+- mapping = file->f_mapping;
+-
+ if ((config->info.lo_flags & ~LOOP_CONFIGURE_SETTABLE_FLAGS) != 0) {
+ error = -EINVAL;
+ goto out_unlock;
+@@ -1009,9 +1011,7 @@ static int loop_configure(struct loop_device *lo, blk_mode_t mode,
+
+ lo->use_dio = lo->lo_flags & LO_FLAGS_DIRECT_IO;
+ lo->lo_device = bdev;
+- lo->lo_backing_file = file;
+- lo->old_gfp_mask = mapping_gfp_mask(mapping);
+- mapping_set_gfp_mask(mapping, lo->old_gfp_mask & ~(__GFP_IO|__GFP_FS));
++ loop_assign_backing_file(lo, file);
+
+ lim = queue_limits_start_update(lo->lo_queue);
+ loop_update_limits(lo, &lim, config->block_size);
+--
+2.39.5
+
--- /dev/null
+From febbb649b724ce905624769d46f8efda123b41a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Nov 2024 23:42:23 +0900
+Subject: loop: Fix ABBA locking race
+
+From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+
+[ Upstream commit b49125574cae26458d4aa02ce8f4523ba9a2a328 ]
+
+Current loop calls vfs_statfs() while holding the q->limits_lock. If
+FS takes some locking in vfs_statfs callback, this may lead to ABBA
+locking bug (at least, FAT fs has this issue actually).
+
+So this patch calls vfs_statfs() outside q->limits_locks instead,
+because looks like no reason to hold q->limits_locks while getting
+discord configs.
+
+Chain exists of:
+ &sbi->fat_lock --> &q->q_usage_counter(io)#17 --> &q->limits_lock
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(&q->limits_lock);
+ lock(&q->q_usage_counter(io)#17);
+ lock(&q->limits_lock);
+ lock(&sbi->fat_lock);
+
+ *** DEADLOCK ***
+
+Reported-by: syzbot+a5d8c609c02f508672cc@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=a5d8c609c02f508672cc
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: f5c84eff634b ("loop: Add sanity check for read/write_iter")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/loop.c | 30 +++++++++++++++---------------
+ 1 file changed, 15 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 1f55ddef53f3d..27e4bd8ee9dc9 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -694,12 +694,11 @@ static void loop_sysfs_exit(struct loop_device *lo)
+ &loop_attribute_group);
+ }
+
+-static void loop_config_discard(struct loop_device *lo,
+- struct queue_limits *lim)
++static void loop_get_discard_config(struct loop_device *lo,
++ u32 *granularity, u32 *max_discard_sectors)
+ {
+ struct file *file = lo->lo_backing_file;
+ struct inode *inode = file->f_mapping->host;
+- u32 granularity = 0, max_discard_sectors = 0;
+ struct kstatfs sbuf;
+
+ /*
+@@ -712,24 +711,17 @@ static void loop_config_discard(struct loop_device *lo,
+ if (S_ISBLK(inode->i_mode)) {
+ struct block_device *bdev = I_BDEV(inode);
+
+- max_discard_sectors = bdev_write_zeroes_sectors(bdev);
+- granularity = bdev_discard_granularity(bdev);
++ *max_discard_sectors = bdev_write_zeroes_sectors(bdev);
++ *granularity = bdev_discard_granularity(bdev);
+
+ /*
+ * We use punch hole to reclaim the free space used by the
+ * image a.k.a. discard.
+ */
+ } else if (file->f_op->fallocate && !vfs_statfs(&file->f_path, &sbuf)) {
+- max_discard_sectors = UINT_MAX >> 9;
+- granularity = sbuf.f_bsize;
++ *max_discard_sectors = UINT_MAX >> 9;
++ *granularity = sbuf.f_bsize;
+ }
+-
+- lim->max_hw_discard_sectors = max_discard_sectors;
+- lim->max_write_zeroes_sectors = max_discard_sectors;
+- if (max_discard_sectors)
+- lim->discard_granularity = granularity;
+- else
+- lim->discard_granularity = 0;
+ }
+
+ struct loop_worker {
+@@ -915,6 +907,7 @@ static int loop_reconfigure_limits(struct loop_device *lo, unsigned int bsize)
+ struct inode *inode = file->f_mapping->host;
+ struct block_device *backing_bdev = NULL;
+ struct queue_limits lim;
++ u32 granularity = 0, max_discard_sectors = 0;
+
+ if (S_ISBLK(inode->i_mode))
+ backing_bdev = I_BDEV(inode);
+@@ -924,6 +917,8 @@ static int loop_reconfigure_limits(struct loop_device *lo, unsigned int bsize)
+ if (!bsize)
+ bsize = loop_default_blocksize(lo, backing_bdev);
+
++ loop_get_discard_config(lo, &granularity, &max_discard_sectors);
++
+ lim = queue_limits_start_update(lo->lo_queue);
+ lim.logical_block_size = bsize;
+ lim.physical_block_size = bsize;
+@@ -933,7 +928,12 @@ static int loop_reconfigure_limits(struct loop_device *lo, unsigned int bsize)
+ lim.features |= BLK_FEAT_WRITE_CACHE;
+ if (backing_bdev && !bdev_nonrot(backing_bdev))
+ lim.features |= BLK_FEAT_ROTATIONAL;
+- loop_config_discard(lo, &lim);
++ lim.max_hw_discard_sectors = max_discard_sectors;
++ lim.max_write_zeroes_sectors = max_discard_sectors;
++ if (max_discard_sectors)
++ lim.discard_granularity = granularity;
++ else
++ lim.discard_granularity = 0;
+ return queue_limits_commit_update(lo->lo_queue, &lim);
+ }
+
+--
+2.39.5
+
--- /dev/null
+From fef70f75ce3c889767eaba972fd1709f1e9fa7fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2025 06:47:18 +0100
+Subject: loop: refactor queue limits updates
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit b38c8be255e89ffcdeb817407222d2de0b573a41 ]
+
+Replace loop_reconfigure_limits with a slightly less encompassing
+loop_update_limits that expects the caller to acquire and commit the
+queue limits to prepare for sorting out the freeze vs limits lock
+ordering.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Link: https://lore.kernel.org/r/20250110054726.1499538-11-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: f5c84eff634b ("loop: Add sanity check for read/write_iter")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/loop.c | 36 ++++++++++++++++++++----------------
+ 1 file changed, 20 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 27e4bd8ee9dc9..81995ebefc962 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -901,12 +901,12 @@ static unsigned int loop_default_blocksize(struct loop_device *lo,
+ return SECTOR_SIZE;
+ }
+
+-static int loop_reconfigure_limits(struct loop_device *lo, unsigned int bsize)
++static void loop_update_limits(struct loop_device *lo, struct queue_limits *lim,
++ unsigned int bsize)
+ {
+ struct file *file = lo->lo_backing_file;
+ struct inode *inode = file->f_mapping->host;
+ struct block_device *backing_bdev = NULL;
+- struct queue_limits lim;
+ u32 granularity = 0, max_discard_sectors = 0;
+
+ if (S_ISBLK(inode->i_mode))
+@@ -919,22 +919,20 @@ static int loop_reconfigure_limits(struct loop_device *lo, unsigned int bsize)
+
+ loop_get_discard_config(lo, &granularity, &max_discard_sectors);
+
+- lim = queue_limits_start_update(lo->lo_queue);
+- lim.logical_block_size = bsize;
+- lim.physical_block_size = bsize;
+- lim.io_min = bsize;
+- lim.features &= ~(BLK_FEAT_WRITE_CACHE | BLK_FEAT_ROTATIONAL);
++ lim->logical_block_size = bsize;
++ lim->physical_block_size = bsize;
++ lim->io_min = bsize;
++ lim->features &= ~(BLK_FEAT_WRITE_CACHE | BLK_FEAT_ROTATIONAL);
+ if (file->f_op->fsync && !(lo->lo_flags & LO_FLAGS_READ_ONLY))
+- lim.features |= BLK_FEAT_WRITE_CACHE;
++ lim->features |= BLK_FEAT_WRITE_CACHE;
+ if (backing_bdev && !bdev_nonrot(backing_bdev))
+- lim.features |= BLK_FEAT_ROTATIONAL;
+- lim.max_hw_discard_sectors = max_discard_sectors;
+- lim.max_write_zeroes_sectors = max_discard_sectors;
++ lim->features |= BLK_FEAT_ROTATIONAL;
++ lim->max_hw_discard_sectors = max_discard_sectors;
++ lim->max_write_zeroes_sectors = max_discard_sectors;
+ if (max_discard_sectors)
+- lim.discard_granularity = granularity;
++ lim->discard_granularity = granularity;
+ else
+- lim.discard_granularity = 0;
+- return queue_limits_commit_update(lo->lo_queue, &lim);
++ lim->discard_granularity = 0;
+ }
+
+ static int loop_configure(struct loop_device *lo, blk_mode_t mode,
+@@ -943,6 +941,7 @@ static int loop_configure(struct loop_device *lo, blk_mode_t mode,
+ {
+ struct file *file = fget(config->fd);
+ struct address_space *mapping;
++ struct queue_limits lim;
+ int error;
+ loff_t size;
+ bool partscan;
+@@ -1014,7 +1013,9 @@ static int loop_configure(struct loop_device *lo, blk_mode_t mode,
+ lo->old_gfp_mask = mapping_gfp_mask(mapping);
+ mapping_set_gfp_mask(mapping, lo->old_gfp_mask & ~(__GFP_IO|__GFP_FS));
+
+- error = loop_reconfigure_limits(lo, config->block_size);
++ lim = queue_limits_start_update(lo->lo_queue);
++ loop_update_limits(lo, &lim, config->block_size);
++ error = queue_limits_commit_update(lo->lo_queue, &lim);
+ if (error)
+ goto out_unlock;
+
+@@ -1382,6 +1383,7 @@ static int loop_set_dio(struct loop_device *lo, unsigned long arg)
+
+ static int loop_set_block_size(struct loop_device *lo, unsigned long arg)
+ {
++ struct queue_limits lim;
+ int err = 0;
+
+ if (lo->lo_state != Lo_bound)
+@@ -1394,7 +1396,9 @@ static int loop_set_block_size(struct loop_device *lo, unsigned long arg)
+ invalidate_bdev(lo->lo_device);
+
+ blk_mq_freeze_queue(lo->lo_queue);
+- err = loop_reconfigure_limits(lo, arg);
++ lim = queue_limits_start_update(lo->lo_queue);
++ loop_update_limits(lo, &lim, arg);
++ err = queue_limits_commit_update(lo->lo_queue, &lim);
+ loop_update_dio(lo);
+ blk_mq_unfreeze_queue(lo->lo_queue);
+
+--
+2.39.5
+
--- /dev/null
+From 493c31018a5da9863d4fc6cc99c0fa1f11bf3895 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2024 09:22:15 +0000
+Subject: loop: Simplify discard granularity calc
+
+From: John Garry <john.g.garry@oracle.com>
+
+[ Upstream commit d47de6ac8842327ae1c782670283450159c55d5b ]
+
+A bdev discard granularity is always at least SECTOR_SIZE, so don't check
+for a zero value.
+
+Suggested-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: John Garry <john.g.garry@oracle.com>
+Link: https://lore.kernel.org/r/20241101092215.422428-1-john.g.garry@oracle.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: f5c84eff634b ("loop: Add sanity check for read/write_iter")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/loop.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index b3355a8d78965..1f55ddef53f3d 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -713,8 +713,7 @@ static void loop_config_discard(struct loop_device *lo,
+ struct block_device *bdev = I_BDEV(inode);
+
+ max_discard_sectors = bdev_write_zeroes_sectors(bdev);
+- granularity = bdev_discard_granularity(bdev) ?:
+- bdev_physical_block_size(bdev);
++ granularity = bdev_discard_granularity(bdev);
+
+ /*
+ * We use punch hole to reclaim the free space used by the
+--
+2.39.5
+
--- /dev/null
+From 9a037fd6ee7eef335564e8aa7ebc1caf28e745e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Oct 2024 11:19:00 +0000
+Subject: loop: Use bdev limit helpers for configuring discard
+
+From: John Garry <john.g.garry@oracle.com>
+
+[ Upstream commit 8d3fd059dd289e6c322e5741ad56794bcce699a2 ]
+
+Instead of directly looking at the request_queue limits, use the bdev
+limits helpers, which is preferable.
+
+Signed-off-by: John Garry <john.g.garry@oracle.com>
+Link: https://lore.kernel.org/r/20241030111900.3981223-1-john.g.garry@oracle.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: f5c84eff634b ("loop: Add sanity check for read/write_iter")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/loop.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 8827a768284ac..b3355a8d78965 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -710,11 +710,11 @@ static void loop_config_discard(struct loop_device *lo,
+ * file-backed loop devices: discarded regions read back as zero.
+ */
+ if (S_ISBLK(inode->i_mode)) {
+- struct request_queue *backingq = bdev_get_queue(I_BDEV(inode));
++ struct block_device *bdev = I_BDEV(inode);
+
+- max_discard_sectors = backingq->limits.max_write_zeroes_sectors;
+- granularity = bdev_discard_granularity(I_BDEV(inode)) ?:
+- queue_physical_block_size(backingq);
++ max_discard_sectors = bdev_write_zeroes_sectors(bdev);
++ granularity = bdev_discard_granularity(bdev) ?:
++ bdev_physical_block_size(bdev);
+
+ /*
+ * We use punch hole to reclaim the free space used by the
+--
+2.39.5
+
--- /dev/null
+From b72bdfd2103fcf1bb11b49a99fc09830f5e8ae67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Apr 2025 18:11:42 +0200
+Subject: MIPS: Fix idle VS timer enqueue
+
+From: Marco Crivellari <marco.crivellari@suse.com>
+
+[ Upstream commit 56651128e2fbad80f632f388d6bf1f39c928267a ]
+
+MIPS re-enables interrupts on its idle routine and performs
+a TIF_NEED_RESCHED check afterwards before putting the CPU to sleep.
+
+The IRQs firing between the check and the 'wait' instruction may set the
+TIF_NEED_RESCHED flag. In order to deal with this possible race, IRQs
+interrupting __r4k_wait() rollback their return address to the
+beginning of __r4k_wait() so that TIF_NEED_RESCHED is checked
+again before going back to sleep.
+
+However idle IRQs can also queue timers that may require a tick
+reprogramming through a new generic idle loop iteration but those timers
+would go unnoticed here because __r4k_wait() only checks
+TIF_NEED_RESCHED. It doesn't check for pending timers.
+
+Fix this with fast-forwarding idle IRQs return address to the end of the
+idle routine instead of the beginning, so that the generic idle loop
+handles both TIF_NEED_RESCHED and pending timers.
+
+CONFIG_CPU_MICROMIPS has been removed along with the nop instructions.
+There, NOPs are 2 byte in size, so change the code with 3 _ssnop which are
+always 4 byte and remove the ifdef. Added ehb to make sure the hazard
+is always cleared.
+
+Fixes: c65a5480ff29 ("[MIPS] Fix potential latency problem due to non-atomic cpu_wait.")
+Signed-off-by: Marco Crivellari <marco.crivellari@suse.com>
+Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
+Acked-by: Frederic Weisbecker <frederic@kernel.org>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/idle.h | 3 +-
+ arch/mips/kernel/genex.S | 62 +++++++++++++++++++++---------------
+ arch/mips/kernel/idle.c | 7 ----
+ 3 files changed, 37 insertions(+), 35 deletions(-)
+
+diff --git a/arch/mips/include/asm/idle.h b/arch/mips/include/asm/idle.h
+index 0992cad9c632e..2bc3678455ed0 100644
+--- a/arch/mips/include/asm/idle.h
++++ b/arch/mips/include/asm/idle.h
+@@ -6,8 +6,7 @@
+ #include <linux/linkage.h>
+
+ extern void (*cpu_wait)(void);
+-extern void r4k_wait(void);
+-extern asmlinkage void __r4k_wait(void);
++extern asmlinkage void r4k_wait(void);
+ extern void r4k_wait_irqoff(void);
+
+ static inline int using_rollback_handler(void)
+diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
+index a572ce36a24f2..46d975d00298d 100644
+--- a/arch/mips/kernel/genex.S
++++ b/arch/mips/kernel/genex.S
+@@ -104,42 +104,52 @@ handle_vcei:
+
+ __FINIT
+
+- .align 5 /* 32 byte rollback region */
+-LEAF(__r4k_wait)
+- .set push
+- .set noreorder
+- /* start of rollback region */
+- LONG_L t0, TI_FLAGS($28)
+- nop
+- andi t0, _TIF_NEED_RESCHED
+- bnez t0, 1f
+- nop
+- nop
+- nop
+-#ifdef CONFIG_CPU_MICROMIPS
+- nop
+- nop
+- nop
+- nop
+-#endif
++ /* Align to 32 bytes for the maximum idle interrupt region size. */
++ .align 5
++LEAF(r4k_wait)
++ /* Keep the ISA bit clear for calculations on local labels here. */
++0: .fill 0
++ /* Start of idle interrupt region. */
++ local_irq_enable
++ /*
++ * If an interrupt lands here, before going idle on the next
++ * instruction, we must *NOT* go idle since the interrupt could
++ * have set TIF_NEED_RESCHED or caused a timer to need resched.
++ * Fall through -- see rollback_handler below -- and have the
++ * idle loop take care of things.
++ */
++1: .fill 0
++ /* The R2 EI/EHB sequence takes 8 bytes, otherwise pad up. */
++ .if 1b - 0b > 32
++ .error "overlong idle interrupt region"
++ .elseif 1b - 0b > 8
++ .align 4
++ .endif
++2: .fill 0
++ .equ r4k_wait_idle_size, 2b - 0b
++ /* End of idle interrupt region; size has to be a power of 2. */
+ .set MIPS_ISA_ARCH_LEVEL_RAW
++r4k_wait_insn:
+ wait
+- /* end of rollback region (the region size must be power of two) */
+-1:
++r4k_wait_exit:
++ .set mips0
++ local_irq_disable
+ jr ra
+- nop
+- .set pop
+- END(__r4k_wait)
++ END(r4k_wait)
++ .previous
+
+ .macro BUILD_ROLLBACK_PROLOGUE handler
+ FEXPORT(rollback_\handler)
+ .set push
+ .set noat
+ MFC0 k0, CP0_EPC
+- PTR_LA k1, __r4k_wait
+- ori k0, 0x1f /* 32 byte rollback region */
+- xori k0, 0x1f
++ /* Subtract/add 2 to let the ISA bit propagate through the mask. */
++ PTR_LA k1, r4k_wait_insn - 2
++ ori k0, r4k_wait_idle_size - 2
++ .set noreorder
+ bne k0, k1, \handler
++ PTR_ADDIU k0, r4k_wait_exit - r4k_wait_insn + 2
++ .set reorder
+ MTC0 k0, CP0_EPC
+ .set pop
+ .endm
+diff --git a/arch/mips/kernel/idle.c b/arch/mips/kernel/idle.c
+index 5abc8b7340f88..80e8a04a642e0 100644
+--- a/arch/mips/kernel/idle.c
++++ b/arch/mips/kernel/idle.c
+@@ -35,13 +35,6 @@ static void __cpuidle r3081_wait(void)
+ write_c0_conf(cfg | R30XX_CONF_HALT);
+ }
+
+-void __cpuidle r4k_wait(void)
+-{
+- raw_local_irq_enable();
+- __r4k_wait();
+- raw_local_irq_disable();
+-}
+-
+ /*
+ * This variant is preferable as it allows testing need_resched and going to
+ * sleep depending on the outcome atomically. Unfortunately the "It is
+--
+2.39.5
+
--- /dev/null
+From ddde164d3abc0201db0d316d6838ef9d62d4fe29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Apr 2025 13:34:24 +0200
+Subject: MIPS: Fix MAX_REG_OFFSET
+
+From: Thorsten Blum <thorsten.blum@linux.dev>
+
+[ Upstream commit c44572e0cc13c9afff83fd333135a0aa9b27ba26 ]
+
+Fix MAX_REG_OFFSET to point to the last register in 'pt_regs' and not to
+the marker itself, which could allow regs_get_register() to return an
+invalid offset.
+
+Fixes: 40e084a506eb ("MIPS: Add uprobes support.")
+Suggested-by: Maciej W. Rozycki <macro@orcam.me.uk>
+Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/ptrace.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/mips/include/asm/ptrace.h b/arch/mips/include/asm/ptrace.h
+index 4a2b40ce39e09..841612913f0d1 100644
+--- a/arch/mips/include/asm/ptrace.h
++++ b/arch/mips/include/asm/ptrace.h
+@@ -65,7 +65,8 @@ static inline void instruction_pointer_set(struct pt_regs *regs,
+
+ /* Query offset/name of register from its name/offset */
+ extern int regs_query_register_offset(const char *name);
+-#define MAX_REG_OFFSET (offsetof(struct pt_regs, __last))
++#define MAX_REG_OFFSET \
++ (offsetof(struct pt_regs, __last) - sizeof(unsigned long))
+
+ /**
+ * regs_get_register() - get register value from its offset
+--
+2.39.5
+
--- /dev/null
+From 3cc13bb5384ff273d8a133de891b2ebbb20c31c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Apr 2025 18:11:43 +0200
+Subject: MIPS: Move r4k_wait() to .cpuidle.text section
+
+From: Marco Crivellari <marco.crivellari@suse.com>
+
+[ Upstream commit b713f27e32d87c35737ec942dd6f5ed6b7475f48 ]
+
+Fix missing .cpuidle.text section assignment for r4k_wait() to correct
+backtracing with nmi_backtrace().
+
+Fixes: 97c8580e85cf ("MIPS: Annotate cpu_wait implementations with __cpuidle")
+Signed-off-by: Marco Crivellari <marco.crivellari@suse.com>
+Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
+Acked-by: Frederic Weisbecker <frederic@kernel.org>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/kernel/genex.S | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
+index 46d975d00298d..2cf312d9a3b09 100644
+--- a/arch/mips/kernel/genex.S
++++ b/arch/mips/kernel/genex.S
+@@ -104,6 +104,7 @@ handle_vcei:
+
+ __FINIT
+
++ .section .cpuidle.text,"ax"
+ /* Align to 32 bytes for the maximum idle interrupt region size. */
+ .align 5
+ LEAF(r4k_wait)
+--
+2.39.5
+
--- /dev/null
+From 2e9e57dc750cbab1cacbf7fc161fdae8ea5aa655 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 May 2025 10:58:00 +0200
+Subject: nvme: unblock ctrl state transition for firmware update
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit 650415fca0a97472fdd79725e35152614d1aad76 ]
+
+The original nvme subsystem design didn't have a CONNECTING state; the
+state machine allowed transitions from RESETTING to LIVE directly.
+
+With the introduction of nvme fabrics the CONNECTING state was
+introduce. Over time the nvme-pci started to use the CONNECTING state as
+well.
+
+Eventually, a bug fix for the nvme-fc started to depend that the only
+valid transition to LIVE was from CONNECTING. Though this change didn't
+update the firmware update handler which was still depending on
+RESETTING to LIVE transition.
+
+The simplest way to address it for the time being is to switch into
+CONNECTING state before going to LIVE state.
+
+Fixes: d2fe192348f9 ("nvme: only allow entering LIVE from CONNECTING state")
+Reported-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Closes: https://lore.kernel.org/all/0134ea15-8d5f-41f7-9e9a-d7e6d82accaa@roeck-us.net
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index f19410723b179..98dad1bdff440 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -4473,7 +4473,8 @@ static void nvme_fw_act_work(struct work_struct *work)
+ msleep(100);
+ }
+
+- if (!nvme_change_ctrl_state(ctrl, NVME_CTRL_LIVE))
++ if (!nvme_change_ctrl_state(ctrl, NVME_CTRL_CONNECTING) ||
++ !nvme_change_ctrl_state(ctrl, NVME_CTRL_LIVE))
+ return;
+
+ nvme_unquiesce_io_queues(ctrl);
+--
+2.39.5
+
--- /dev/null
+From d9d8257104cd5f903a36cc6ba3920ec4a96c6eb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Apr 2025 15:38:49 +0800
+Subject: riscv: misaligned: Add handling for ZCB instructions
+
+From: Nylon Chen <nylon.chen@sifive.com>
+
+[ Upstream commit eb16b3727c05ed36420c90eca1e8f0e279514c1c ]
+
+Add support for the Zcb extension's compressed half-word instructions
+(C.LHU, C.LH, and C.SH) in the RISC-V misaligned access trap handler.
+
+Signed-off-by: Zong Li <zong.li@sifive.com>
+Signed-off-by: Nylon Chen <nylon.chen@sifive.com>
+Fixes: 956d705dd279 ("riscv: Unaligned load/store handling for M_MODE")
+Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Link: https://lore.kernel.org/r/20250411073850.3699180-2-nylon.chen@sifive.com
+Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/traps_misaligned.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/arch/riscv/kernel/traps_misaligned.c b/arch/riscv/kernel/traps_misaligned.c
+index 9a80a12f6b48f..d14bfc23e315b 100644
+--- a/arch/riscv/kernel/traps_misaligned.c
++++ b/arch/riscv/kernel/traps_misaligned.c
+@@ -87,6 +87,13 @@
+ #define INSN_MATCH_C_FSWSP 0xe002
+ #define INSN_MASK_C_FSWSP 0xe003
+
++#define INSN_MATCH_C_LHU 0x8400
++#define INSN_MASK_C_LHU 0xfc43
++#define INSN_MATCH_C_LH 0x8440
++#define INSN_MASK_C_LH 0xfc43
++#define INSN_MATCH_C_SH 0x8c00
++#define INSN_MASK_C_SH 0xfc43
++
+ #define INSN_LEN(insn) ((((insn) & 0x3) < 0x3) ? 2 : 4)
+
+ #if defined(CONFIG_64BIT)
+@@ -405,6 +412,13 @@ int handle_misaligned_load(struct pt_regs *regs)
+ fp = 1;
+ len = 4;
+ #endif
++ } else if ((insn & INSN_MASK_C_LHU) == INSN_MATCH_C_LHU) {
++ len = 2;
++ insn = RVC_RS2S(insn) << SH_RD;
++ } else if ((insn & INSN_MASK_C_LH) == INSN_MATCH_C_LH) {
++ len = 2;
++ shift = 8 * (sizeof(ulong) - len);
++ insn = RVC_RS2S(insn) << SH_RD;
+ } else {
+ regs->epc = epc;
+ return -1;
+@@ -504,6 +518,9 @@ int handle_misaligned_store(struct pt_regs *regs)
+ len = 4;
+ val.data_ulong = GET_F32_RS2C(insn, regs);
+ #endif
++ } else if ((insn & INSN_MASK_C_SH) == INSN_MATCH_C_SH) {
++ len = 2;
++ val.data_ulong = GET_RS2S(insn, regs);
+ } else {
+ regs->epc = epc;
+ return -1;
+--
+2.39.5
+
--- /dev/null
+From 002736da139611b3b509e3121ab3f162dcfdc2cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Apr 2025 18:23:09 +0200
+Subject: riscv: misaligned: enable IRQs while handling misaligned accesses
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Léger <cleger@rivosinc.com>
+
+[ Upstream commit 453805f0a28fc5091e46145e6560c776f7c7a611 ]
+
+We can safely reenable IRQs if coming from userspace. This allows to
+access user memory that could potentially trigger a page fault.
+
+Fixes: b686ecdeacf6 ("riscv: misaligned: Restrict user access to kernel memory")
+Signed-off-by: Clément Léger <cleger@rivosinc.com>
+Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Link: https://lore.kernel.org/r/20250422162324.956065-3-cleger@rivosinc.com
+Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/traps.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c
+index b1d991c78a233..9c83848797a78 100644
+--- a/arch/riscv/kernel/traps.c
++++ b/arch/riscv/kernel/traps.c
+@@ -220,19 +220,23 @@ static void do_trap_misaligned(struct pt_regs *regs, enum misaligned_access_type
+ {
+ irqentry_state_t state;
+
+- if (user_mode(regs))
++ if (user_mode(regs)) {
+ irqentry_enter_from_user_mode(regs);
+- else
++ local_irq_enable();
++ } else {
+ state = irqentry_nmi_enter(regs);
++ }
+
+ if (misaligned_handler[type].handler(regs))
+ do_trap_error(regs, SIGBUS, BUS_ADRALN, regs->epc,
+ misaligned_handler[type].type_str);
+
+- if (user_mode(regs))
++ if (user_mode(regs)) {
++ local_irq_disable();
+ irqentry_exit_to_user_mode(regs);
+- else
++ } else {
+ irqentry_nmi_exit(regs, state);
++ }
+ }
+
+ asmlinkage __visible __trap_section void do_trap_load_misaligned(struct pt_regs *regs)
+--
+2.39.5
+
--- /dev/null
+From dd6bd7395e6f2163660fd78a0a55a72c6db87867 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Apr 2025 18:23:08 +0200
+Subject: riscv: misaligned: factorize trap handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Léger <cleger@rivosinc.com>
+
+[ Upstream commit fd94de9f9e7aac11ec659e386b9db1203d502023 ]
+
+Since both load/store and user/kernel should use almost the same path and
+that we are going to add some code around that, factorize it.
+
+Signed-off-by: Clément Léger <cleger@rivosinc.com>
+Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Link: https://lore.kernel.org/r/20250422162324.956065-2-cleger@rivosinc.com
+Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Stable-dep-of: 453805f0a28f ("riscv: misaligned: enable IRQs while handling misaligned accesses")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/traps.c | 66 +++++++++++++++++++++------------------
+ 1 file changed, 36 insertions(+), 30 deletions(-)
+
+diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c
+index 8ff8e8b36524b..b1d991c78a233 100644
+--- a/arch/riscv/kernel/traps.c
++++ b/arch/riscv/kernel/traps.c
+@@ -198,47 +198,53 @@ asmlinkage __visible __trap_section void do_trap_insn_illegal(struct pt_regs *re
+ DO_ERROR_INFO(do_trap_load_fault,
+ SIGSEGV, SEGV_ACCERR, "load access fault");
+
+-asmlinkage __visible __trap_section void do_trap_load_misaligned(struct pt_regs *regs)
++enum misaligned_access_type {
++ MISALIGNED_STORE,
++ MISALIGNED_LOAD,
++};
++static const struct {
++ const char *type_str;
++ int (*handler)(struct pt_regs *regs);
++} misaligned_handler[] = {
++ [MISALIGNED_STORE] = {
++ .type_str = "Oops - store (or AMO) address misaligned",
++ .handler = handle_misaligned_store,
++ },
++ [MISALIGNED_LOAD] = {
++ .type_str = "Oops - load address misaligned",
++ .handler = handle_misaligned_load,
++ },
++};
++
++static void do_trap_misaligned(struct pt_regs *regs, enum misaligned_access_type type)
+ {
+- if (user_mode(regs)) {
++ irqentry_state_t state;
++
++ if (user_mode(regs))
+ irqentry_enter_from_user_mode(regs);
++ else
++ state = irqentry_nmi_enter(regs);
+
+- if (handle_misaligned_load(regs))
+- do_trap_error(regs, SIGBUS, BUS_ADRALN, regs->epc,
+- "Oops - load address misaligned");
++ if (misaligned_handler[type].handler(regs))
++ do_trap_error(regs, SIGBUS, BUS_ADRALN, regs->epc,
++ misaligned_handler[type].type_str);
+
++ if (user_mode(regs))
+ irqentry_exit_to_user_mode(regs);
+- } else {
+- irqentry_state_t state = irqentry_nmi_enter(regs);
+-
+- if (handle_misaligned_load(regs))
+- do_trap_error(regs, SIGBUS, BUS_ADRALN, regs->epc,
+- "Oops - load address misaligned");
+-
++ else
+ irqentry_nmi_exit(regs, state);
+- }
+ }
+
+-asmlinkage __visible __trap_section void do_trap_store_misaligned(struct pt_regs *regs)
++asmlinkage __visible __trap_section void do_trap_load_misaligned(struct pt_regs *regs)
+ {
+- if (user_mode(regs)) {
+- irqentry_enter_from_user_mode(regs);
+-
+- if (handle_misaligned_store(regs))
+- do_trap_error(regs, SIGBUS, BUS_ADRALN, regs->epc,
+- "Oops - store (or AMO) address misaligned");
+-
+- irqentry_exit_to_user_mode(regs);
+- } else {
+- irqentry_state_t state = irqentry_nmi_enter(regs);
+-
+- if (handle_misaligned_store(regs))
+- do_trap_error(regs, SIGBUS, BUS_ADRALN, regs->epc,
+- "Oops - store (or AMO) address misaligned");
++ do_trap_misaligned(regs, MISALIGNED_LOAD);
++}
+
+- irqentry_nmi_exit(regs, state);
+- }
++asmlinkage __visible __trap_section void do_trap_store_misaligned(struct pt_regs *regs)
++{
++ do_trap_misaligned(regs, MISALIGNED_STORE);
+ }
++
+ DO_ERROR_INFO(do_trap_store_fault,
+ SIGSEGV, SEGV_ACCERR, "store (or AMO) access fault");
+ DO_ERROR_INFO(do_trap_ecall_s,
+--
+2.39.5
+
usb-usbtmc-fix-erroneous-get_stb-ioctl-error-returns.patch
usb-usbtmc-fix-erroneous-wait_srq-ioctl-return.patch
usb-usbtmc-fix-erroneous-generic_read-ioctl-return.patch
+iio-accel-adxl367-fix-setting-odr-for-activity-time-.patch
+iio-temp-maxim-thermocouple-fix-potential-lack-of-dm.patch
+types-complement-the-aligned-types-with-signed-64-bi.patch
+iio-accel-adxl355-make-timestamp-64-bit-aligned-usin.patch
+iio-adc-dln2-use-aligned_s64-for-timestamp.patch
+mips-fix-idle-vs-timer-enqueue.patch
+mips-move-r4k_wait-to-.cpuidle.text-section.patch
+mips-fix-max_reg_offset.patch
+riscv-misaligned-add-handling-for-zcb-instructions.patch
+loop-use-bdev-limit-helpers-for-configuring-discard.patch
+loop-simplify-discard-granularity-calc.patch
+loop-fix-abba-locking-race.patch
+loop-refactor-queue-limits-updates.patch
+loop-factor-out-a-loop_assign_backing_file-helper.patch
+loop-add-sanity-check-for-read-write_iter.patch
+drm-panel-simple-update-timings-for-auo-g101evn010.patch
+nvme-unblock-ctrl-state-transition-for-firmware-upda.patch
+riscv-misaligned-factorize-trap-handling.patch
+riscv-misaligned-enable-irqs-while-handling-misalign.patch
+drm-xe-tests-mocs-update-xe_force_wake_get-return-ha.patch
+drm-xe-tests-mocs-hold-xe_forcewake_all-for-lncf-reg.patch
+io_uring-sqpoll-increase-task_work-submission-batch-.patch
+do_umount-add-missing-barrier-before-refcount-checks.patch
--- /dev/null
+From 9fe1f1eebd105b72fa5da221106ad2632e9e43c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2024 20:59:04 +0300
+Subject: types: Complement the aligned types with signed 64-bit one
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit e4ca0e59c39442546866f3dd514a3a5956577daf ]
+
+Some user may want to use aligned signed 64-bit type.
+Provide it for them.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://patch.msgid.link/20240903180218.3640501-2-andriy.shevchenko@linux.intel.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Stable-dep-of: 1bb942287e05 ("iio: accel: adxl355: Make timestamp 64-bit aligned using aligned_s64")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/types.h | 3 ++-
+ include/uapi/linux/types.h | 1 +
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/types.h b/include/linux/types.h
+index 2bc8766ba20ca..2d7b9ae8714ce 100644
+--- a/include/linux/types.h
++++ b/include/linux/types.h
+@@ -115,8 +115,9 @@ typedef u64 u_int64_t;
+ typedef s64 int64_t;
+ #endif
+
+-/* this is a special 64bit data type that is 8-byte aligned */
++/* These are the special 64-bit data types that are 8-byte aligned */
+ #define aligned_u64 __aligned_u64
++#define aligned_s64 __aligned_s64
+ #define aligned_be64 __aligned_be64
+ #define aligned_le64 __aligned_le64
+
+diff --git a/include/uapi/linux/types.h b/include/uapi/linux/types.h
+index 6375a06840520..48b933938877d 100644
+--- a/include/uapi/linux/types.h
++++ b/include/uapi/linux/types.h
+@@ -53,6 +53,7 @@ typedef __u32 __bitwise __wsum;
+ * No conversions are necessary between 32-bit user-space and a 64-bit kernel.
+ */
+ #define __aligned_u64 __u64 __attribute__((aligned(8)))
++#define __aligned_s64 __s64 __attribute__((aligned(8)))
+ #define __aligned_be64 __be64 __attribute__((aligned(8)))
+ #define __aligned_le64 __le64 __attribute__((aligned(8)))
+
+--
+2.39.5
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
