From 12b281dc196a4cb5ae6ea5832d23918e06c1f11c Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Thu, 1 Feb 2024 11:55:36 -0500
Subject: [PATCH] Fixes for 6.1

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ...initialisation-of-netfs_inode-for-9p.patch |   98 ++
 ...mory-failure-flags-as-mf_action_requ.patch |  144 +++
 ...g-fix-null-pointer-dereference-check.patch |   59 +
 ...e-logic-of-getting-the-fake_pxm-valu.patch |   49 +
 ...uirk-for-the-colorful-x15-at-23-lapt.patch |   51 +
 ...e-of-read_seqbegin_or_lock-in-afs_fi.patch |   89 ++
 ...e-of-read_seqbegin_or_lock-in-afs_lo.patch |   54 +
 ...t-fix-headset-auto-detect-fail-in-cx.patch |  200 +++
 ...hda-intel-add-hda_arl-pci-id-support.patch |   41 +
 ...fer-to-correct-stream-index-at-loops.patch |   70 +
 ...idate-arch_irq_work_raise-prototypes.patch |  130 ++
 .../arm-dts-imx-use-flash-0-0-pattern.patch   |   81 ++
 queue-6.1/arm-dts-imx1-fix-sram-node.patch    |   53 +
 ...-28-fix-the-dma-controller-node-name.patch |   53 +
 ...nsa-use-preferred-i2c-gpios-properti.patch |   61 +
 ...ts-imx25-27-eukrea-fix-rtc-node-name.patch |   52 +
 queue-6.1/arm-dts-imx25-27-pass-timing0.patch |  138 ++
 ...-imx25-fix-the-iim-compatible-string.patch |   40 +
 .../arm-dts-imx27-apf27dev-fix-led-name.patch |   39 +
 queue-6.1/arm-dts-imx27-fix-sram-node.patch   |   37 +
 ...dts-imx7d-fix-coresight-funnel-ports.patch |   60 +
 .../arm-dts-imx7s-fix-lcdif-compatible.patch  |   39 +
 ...imx7s-fix-nand-controller-size-cells.patch |   38 +
 ...-rockchip-fix-rk3036-hdmi-ports-node.patch |   51 +
 ...-amlogic-fix-format-for-s4-uart-node.patch |   66 +
 ...sm8996-fix-in-ports-is-a-required-pr.patch |   63 +
 ...sm8998-fix-out-ports-is-a-required-p.patch |   88 ++
 ...-set-the-correct-node-for-vmap-stack.patch |  100 ++
 ...-sparse-happy-with-odd-sized-put_una.patch |   86 ++
 ...d-new-dmi-entries-for-acp5x-platform.patch |   55 +
 ...undefined-snd_soc_dapm_nopm-argument.patch |   37 +
 ...nk-ack-before-setting-connection-in-.patch |  117 ++
 ...fix-io-hang-from-sbitmap-wakeup-race.patch |   72 ++
 ...-integer-overflow-in-bvec_try_merge_.patch |   36 +
 ...v-check-for-unlikely-string-overflow.patch |   88 ++
 ...tooth-hci_sync-fix-br-edr-wakeup-bug.patch |   47 +
 ...ap-fix-possible-multiple-reject-send.patch |   42 +
 ...t-both-wideband_speech-and-le_states.patch |   35 +
 ...nomem-instead-of-bug-in-alb_upper_de.patch |   69 +
 ...ad_lock_trace_held-before-calling-bp.patch |   95 ++
 ...tch.count-as-zero-before-batched-upd.patch |   51 +
 ...-fix-enum-typo-in-br_cc_ccm_tx_parse.patch |   46 +
 ...eadlock-or-deadcode-of-misusing-dget.patch |   63 +
 ...-pointer-access-if-get_quota_realm-r.patch |  138 ++
 ...e-mds-feature-bit-even-when-session-.patch |   45 +
 queue-6.1/cfi-add-cfi_noseal.patch            |   58 +
 ...x-memory-leak-in-hi3620_mmc_clk_init.patch |   41 +
 ...qxp-fix-lvds-bypass-pixel-and-phy-cl.patch |   77 ++
 ...8-fix-memory-leak-in-pxa168_clk_init.patch |   51 +
 ...o-octeontx2-fix-cptvf-driver-cleanup.patch |   71 +
 ...32-crc32-fix-parsing-list-of-devices.patch |   46 +
 ...p-accessing-objects-after-releasing-.patch |  407 ++++++
 ...v3-don-t-expose-sw_incr-event-in-sys.patch |   55 +
 ...splay-fix-tiled-display-misalignment.patch |   43 +
 ...-fixing-stream-allocation-regression.patch |   42 +
 ...for-prefetch-mode-0-extend-prefetch-.patch |  124 ++
 ...make-flip_timestamp_in_us-a-64-bit-v.patch |   43 +
 ...y-fix-kzalloc-parameter-atom_tonga_p.patch |   47 +
 ...fence-check-in-to_amdgpu_amdkfd_fenc.patch |   45 +
 ...-fix-ecc-irq-enable-disable-unpaired.patch |  124 ++
 ...trace-event-amdgpu_bo_move-always-mo.patch |  114 ++
 ...w-from-request_firmware-not-released.patch |   50 +
 ...ith-right-return-code-eio-in-amdgpu_.patch |   77 ++
 ...m-amdgpu-let-kfd-sync-with-vm-fences.patch |   42 +
 ...se-adev-pm.fw-before-return-in-amdgp.patch |   48 +
 ...terator-used-outside-loop-in-kfd_add.patch |   64 +
 ...ix-lock-dependency-warning-with-srcu.patch |  103 ++
 ...m-amdkfd-fix-lock-dependency-warning.patch |  145 +++
 ...ode-null-check-in-svm_range_get_rang.patch |   67 +
 ...25-fix-set-hpd-irq-detect-window-to-.patch |  119 ++
 ...le-fix-use-of-uninitialized-variable.patch |   43 +
 ...drm_atomic_helper_shutdown-at-shutdo.patch |   86 ++
 queue-6.1/drm-fix-color-lut-rounding.patch    |  100 ++
 ...er-fix-use-of-uninitialized-variable.patch |   42 +
 ...i-dsi-fix-detach-call-without-attach.patch |  138 ++
 ...-writeback-programming-for-yuv-cases.patch |   44 +
 ...dpu-ratelimit-framedone-timeout-msgs.patch |   62 +
 ...d-override_edid_mode-quirk-for-gener.patch |  112 ++
 ...-mul_u32_u32-requires-linux-math64.h.patch |   45 +
 ...tfs-reject-casefold-directory-inodes.patch |   46 +
 ...acking-for-subpage-compressed-blocks.patch |   44 +
 ...e-resizing-failures-due-to-oversized.patch |  133 ++
 ...stent-between-segment-fstrim-and-ful.patch |   66 +
 ...unnecessary-check-from-alloc_flex_gd.patch |   44 +
 ...-type-of-flexbg_size-to-unsigned-int.patch |   89 ++
 ...k-return-value-of-f2fs_reserve_new_b.patch |   69 +
 ...gcing-flag-on-page-during-block-migr.patch |   64 +
 ...ointers-on-zoned-device-after-roll-f.patch |   37 +
 ...st_dput-handle-underflows-gracefully.patch |   78 ++
 ...ray-index-out-of-bounds-in-dbadjtree.patch |   99 ++
 queue-6.1/fs-kernfs-dir-obey-s_isgid.patch    |   58 +
 ...n-make-pfn-accessors-statics-inlines.patch |   68 +
 ...x-fan-speed-set-failure-in-automatic.patch |   42 +
 ...pc87360-bounds-check-data-innr-usage.patch |   60 +
 ...mask-value-offset-for-i2c2-on-rv1126.patch |   46 +
 ...update-maximum-prescaler-value-for-i.patch |   59 +
 ...isable-behavior-to-block-all-traffic.patch |  120 ++
 .../ib-ipoib-fix-mcast-list-locking.patch     |   94 ++
 ...ce_aq_vsi_q_opt_rss_-register-values.patch |  101 ++
 queue-6.1/ice-fix-pre-shifted-bit-usage.patch |  121 ++
 ...ss-firmware-cmds-when-stuck-in-reset.patch |  100 ++
 .../ionic-pass-opcode-to-devcmd_wait.patch    |   63 +
 ...ray-index-out-of-bounds-in-dbadjtree.patch |  239 ++++
 ...rray-index-out-of-bounds-in-dinewext.patch |   78 ++
 ...-slab-out-of-bounds-read-in-dtsearch.patch |   45 +
 .../jfs-fix-uaf-in-jfs_evict_inode.patch      |   50 +
 ...kvm-s390-fix-setting-of-fpc-register.patch |   70 +
 ...ic-don-t-register-panic-notifier-if-.patch |   43 +
 ...pointer-dereference-in-bpf_object__c.patch |   73 ++
 .../libsubcmd-fix-memory-leak-in-uniq.patch   |   62 +
 ...2-fix-a-bug-for-mhuv2_sender_interru.patch |   60 +
 ...the-array-consult-the-superblock-of-.patch |  155 +++
 ...move-mutext-lock-in-condition-of-wai.patch |  160 +++
 ...ix-an-error-code-problem-in-ddb_prob.patch |   34 +
 ...i2c-imx335-fix-hblank-min-max-values.patch |   41 +
 ...as-vsp1-fix-references-to-pad-config.patch | 1137 +++++++++++++++++
 queue-6.1/media-rkisp1-drop-irqf_shared.patch |   44 +
 ...ia-rkisp1-fix-irq-disable-race-issue.patch |   99 ++
 ...rkisp1-fix-irq-handler-return-values.patch |   64 +
 queue-6.1/media-rkisp1-store-irq-lines.patch  |  126 ++
 ...ip-rga-fix-swizzling-for-rgb-formats.patch |   74 ++
 ...xed-high-volume-of-stk1160_dbg-messa.patch |   47 +
 ...m335x_tscadc-fix-ti-soc-dependencies.patch |   35 +
 ...2c-add-missing-setting-of-the-reg_ct.patch |   60 +
 ...minate-double-free-in-error-handling.patch |  288 +++++
 ...x-fix-mv88e6352_serdes_get_stats-err.patch |  102 ++
 ...t-mdio-bus-of-node-on-qca8k_mdio_reg.patch |   96 ++
 ...void-excessive-sleeps-in-polled-mode.patch |  139 ++
 ...ix-passing-the-wrong-reference-for-c.patch |   54 +
 ...seid-on-non-s390-archs-where-virtual.patch |   91 ++
 ...178a-avoid-two-consecutive-device-re.patch |   43 +
 ...-max-npc-mcam-entry-check-while-vali.patch |   54 +
 .../pci-add-intel_hda_arl-to-pci_ids.h.patch  |   41 +
 ...set-quirk-for-nvidia-spectrum-device.patch |   62 +
 ...equester-id-when-no-error-info-found.patch |   69 +
 ...gt-s-effective-data-rate-calculation.patch |   40 +
 ...rride-amd-usb-controller-if-required.patch |   55 +
 ...x-stdev_release-crash-after-surprise.patch |  104 ++
 ...rrow-startup-race-when-creating-the-.patch |   82 ++
 ...-minimum-opencsd-version-to-ensure-a.patch |   59 +
 .../perf-fix-the-nr_addr_filters-fix.patch    |   50 +
 ...chronize-devfreq_monitor_-start-stop.patch |  167 +++
 queue-6.1/pnp-acpi-fix-fortify-warning.patch  |   83 ++
 ...config_numa-n-build-due-to-create_se.patch |   65 +
 ...-build-error-due-to-is_valid_bugaddr.patch |   48 +
 ...-validate-size-for-vector-operations.patch |   71 +
 ...uild-failures-due-to-arch_reserved_k.patch |   68 +
 ...ull-pointer-dereference-in-pgtable_c.patch |   49 +
 ..._must_withdraw-is-only-needed-for-co.patch |   56 +
 ...rash-when-setting-number-of-cpus-to-.patch |   47 +
 ...rror-code-return-in-ipoib_mcast_join.patch |   34 +
 ...nly-increment-use_count-when-enable_.patch |  113 ++
 ...ce_conn_rcu-fix-the-usage-of-read_se.patch |   46 +
 ...le-setting-of-fpc-register-correctly.patch |   71 +
 ...-sysfs-status-attribute-for-ap-queue.patch |   95 ++
 ...ort-new-pci-device-ids-1883-and-1886.patch |   70 +
 ...t-.phy_attached-before-notifing-phyu.patch |   57 +
 ...csi-libfc-don-t-schedule-abort-twice.patch |   68 +
 ...up-timeout-error-in-fc_fcp_rec_error.patch |   37 +
 ...ssible-file-string-name-overflow-whe.patch |   64 +
 ...pci-checks-where-sas5116-diverges-fr.patch |   54 +
 ...x-issues-in-setup_classid_environmen.patch |   85 ++
 ...x-pyperf180-compilation-failure-with.patch |   83 ++
 ...tisfy-compiler-by-having-explicit-re.patch |   35 +
 ...ftests-sgx-fix-linker-script-asserts.patch |   39 +
 queue-6.1/series                              |  192 +++
 ...or-call-trace-due-to-the-usage-of-sm.patch |   70 +
 ...nx-fix-unhandled-sgi-warning-message.patch |   39 +
 ...mi-mediatek-fix-uaf-on-device-remove.patch |   78 ++
 ...c-fix-a-suspicious-rcu-usage-warning.patch |  121 ++
 ...cktrmios-with-cap_checkpoint_restore.patch |   63 +
 ...y-index-out-of-bounds-in-dtsplitroot.patch |   77 ++
 .../um-don-t-use-vfprintf-for-os_info.patch   |   72 ++
 ...ming-clash-between-uml-and-scheduler.patch |   82 ++
 ...ix-return-type-of-uml_net_start_xmit.patch |   53 +
 .../um-time-travel-fix-time-corruption.patch  |   93 ++
 ...k-to-decrease-in-ep-poll-interval-fo.patch |   98 ++
 ...hardcoded-quirk-value-with-bit-macro.patch |   39 +
 ...-directive-writing-between-1-and-11-.patch |   84 ++
 ...t-keep-wdtctrl-bit-3-unmodified-for-.patch |   71 +
 ...race-due-to-setting-ath11k_flag_ext_.patch |   75 ++
 ...otential-array-index-out-of-bounds-r.patch |   61 +
 ...x-rcu-dereference-in-__cfg80211_bss_.patch |   38 +
 ...ee-beacon_ies-when-overridden-from-h.patch |   44 +
 ...ect-wrong-bbp-register-in-rxdcoc-cal.patch |   39 +
 ...art-beacon-queue-when-hardware-reset.patch |   79 ++
 ...d-additional-usb-ids-for-rtl8192eu-d.patch |   48 +
 ...8723-be-ae-using-calculate_bit_shift.patch |   77 ++
 ...sible-null-pointer-dereference-in-wf.patch |   98 ++
 ...t-ignore-nmis-during-very-early-boot.patch |   94 ++
 ...al-mce-s-page-as-poison-to-avoid-pan.patch |   83 ++
 ...he-abuse-of-underlying-struct-page-i.patch |  151 +++
 ...e-null-pointer-deref-during-xhci-urb.patch |   98 ++
 193 files changed, 15689 insertions(+)
 create mode 100644 queue-6.1/9p-fix-initialisation-of-netfs_inode-for-9p.patch
 create mode 100644 queue-6.1/acpi-apei-set-memory-failure-flags-as-mf_action_requ.patch
 create mode 100644 queue-6.1/acpi-extlog-fix-null-pointer-dereference-check.patch
 create mode 100644 queue-6.1/acpi-numa-fix-the-logic-of-getting-the-fake_pxm-valu.patch
 create mode 100644 queue-6.1/acpi-video-add-quirk-for-the-colorful-x15-at-23-lapt.patch
 create mode 100644 queue-6.1/afs-fix-the-usage-of-read_seqbegin_or_lock-in-afs_fi.patch
 create mode 100644 queue-6.1/afs-fix-the-usage-of-read_seqbegin_or_lock-in-afs_lo.patch
 create mode 100644 queue-6.1/alsa-hda-conexant-fix-headset-auto-detect-fail-in-cx.patch
 create mode 100644 queue-6.1/alsa-hda-intel-add-hda_arl-pci-id-support.patch
 create mode 100644 queue-6.1/alsa-hda-refer-to-correct-stream-index-at-loops.patch
 create mode 100644 queue-6.1/arch-consolidate-arch_irq_work_raise-prototypes.patch
 create mode 100644 queue-6.1/arm-dts-imx-use-flash-0-0-pattern.patch
 create mode 100644 queue-6.1/arm-dts-imx1-fix-sram-node.patch
 create mode 100644 queue-6.1/arm-dts-imx23-28-fix-the-dma-controller-node-name.patch
 create mode 100644 queue-6.1/arm-dts-imx23-sansa-use-preferred-i2c-gpios-properti.patch
 create mode 100644 queue-6.1/arm-dts-imx25-27-eukrea-fix-rtc-node-name.patch
 create mode 100644 queue-6.1/arm-dts-imx25-27-pass-timing0.patch
 create mode 100644 queue-6.1/arm-dts-imx25-fix-the-iim-compatible-string.patch
 create mode 100644 queue-6.1/arm-dts-imx27-apf27dev-fix-led-name.patch
 create mode 100644 queue-6.1/arm-dts-imx27-fix-sram-node.patch
 create mode 100644 queue-6.1/arm-dts-imx7d-fix-coresight-funnel-ports.patch
 create mode 100644 queue-6.1/arm-dts-imx7s-fix-lcdif-compatible.patch
 create mode 100644 queue-6.1/arm-dts-imx7s-fix-nand-controller-size-cells.patch
 create mode 100644 queue-6.1/arm-dts-rockchip-fix-rk3036-hdmi-ports-node.patch
 create mode 100644 queue-6.1/arm64-dts-amlogic-fix-format-for-s4-uart-node.patch
 create mode 100644 queue-6.1/arm64-dts-qcom-msm8996-fix-in-ports-is-a-required-pr.patch
 create mode 100644 queue-6.1/arm64-dts-qcom-msm8998-fix-out-ports-is-a-required-p.patch
 create mode 100644 queue-6.1/arm64-irq-set-the-correct-node-for-vmap-stack.patch
 create mode 100644 queue-6.1/asm-generic-make-sparse-happy-with-odd-sized-put_una.patch
 create mode 100644 queue-6.1/asoc-amd-add-new-dmi-entries-for-acp5x-platform.patch
 create mode 100644 queue-6.1/asoc-doc-fix-undefined-snd_soc_dapm_nopm-argument.patch
 create mode 100644 queue-6.1/audit-send-netlink-ack-before-setting-connection-in-.patch
 create mode 100644 queue-6.1/blk-mq-fix-io-hang-from-sbitmap-wakeup-race.patch
 create mode 100644 queue-6.1/block-prevent-an-integer-overflow-in-bvec_try_merge_.patch
 create mode 100644 queue-6.1/block-rnbd-srv-check-for-unlikely-string-overflow.patch
 create mode 100644 queue-6.1/bluetooth-hci_sync-fix-br-edr-wakeup-bug.patch
 create mode 100644 queue-6.1/bluetooth-l2cap-fix-possible-multiple-reject-send.patch
 create mode 100644 queue-6.1/bluetooth-qca-set-both-wideband_speech-and-le_states.patch
 create mode 100644 queue-6.1/bonding-return-enomem-instead-of-bug-in-alb_upper_de.patch
 create mode 100644 queue-6.1/bpf-check-rcu_read_lock_trace_held-before-calling-bp.patch
 create mode 100644 queue-6.1/bpf-set-uattr-batch.count-as-zero-before-batched-upd.patch
 create mode 100644 queue-6.1/bridge-cfm-fix-enum-typo-in-br_cc_ccm_tx_parse.patch
 create mode 100644 queue-6.1/ceph-fix-deadlock-or-deadcode-of-misusing-dget.patch
 create mode 100644 queue-6.1/ceph-fix-invalid-pointer-access-if-get_quota_realm-r.patch
 create mode 100644 queue-6.1/ceph-reinitialize-mds-feature-bit-even-when-session-.patch
 create mode 100644 queue-6.1/cfi-add-cfi_noseal.patch
 create mode 100644 queue-6.1/clk-hi3620-fix-memory-leak-in-hi3620_mmc_clk_init.patch
 create mode 100644 queue-6.1/clk-imx-clk-imx8qxp-fix-lvds-bypass-pixel-and-phy-cl.patch
 create mode 100644 queue-6.1/clk-mmp-pxa168-fix-memory-leak-in-pxa168_clk_init.patch
 create mode 100644 queue-6.1/crypto-octeontx2-fix-cptvf-driver-cleanup.patch
 create mode 100644 queue-6.1/crypto-stm32-crc32-fix-parsing-list-of-devices.patch
 create mode 100644 queue-6.1/debugobjects-stop-accessing-objects-after-releasing-.patch
 create mode 100644 queue-6.1/drivers-perf-pmuv3-don-t-expose-sw_incr-event-in-sys.patch
 create mode 100644 queue-6.1/drm-amd-display-fix-tiled-display-misalignment.patch
 create mode 100644 queue-6.1/drm-amd-display-fixing-stream-allocation-regression.patch
 create mode 100644 queue-6.1/drm-amd-display-for-prefetch-mode-0-extend-prefetch-.patch
 create mode 100644 queue-6.1/drm-amd-display-make-flip_timestamp_in_us-a-64-bit-v.patch
 create mode 100644 queue-6.1/drm-amd-powerplay-fix-kzalloc-parameter-atom_tonga_p.patch
 create mode 100644 queue-6.1/drm-amdgpu-drop-fence-check-in-to_amdgpu_amdkfd_fenc.patch
 create mode 100644 queue-6.1/drm-amdgpu-fix-ecc-irq-enable-disable-unpaired.patch
 create mode 100644 queue-6.1/drm-amdgpu-fix-ftrace-event-amdgpu_bo_move-always-mo.patch
 create mode 100644 queue-6.1/drm-amdgpu-fix-fw-from-request_firmware-not-released.patch
 create mode 100644 queue-6.1/drm-amdgpu-fix-with-right-return-code-eio-in-amdgpu_.patch
 create mode 100644 queue-6.1/drm-amdgpu-let-kfd-sync-with-vm-fences.patch
 create mode 100644 queue-6.1/drm-amdgpu-release-adev-pm.fw-before-return-in-amdgp.patch
 create mode 100644 queue-6.1/drm-amdkfd-fix-iterator-used-outside-loop-in-kfd_add.patch
 create mode 100644 queue-6.1/drm-amdkfd-fix-lock-dependency-warning-with-srcu.patch
 create mode 100644 queue-6.1/drm-amdkfd-fix-lock-dependency-warning.patch
 create mode 100644 queue-6.1/drm-amdkfd-fix-node-null-check-in-svm_range_get_rang.patch
 create mode 100644 queue-6.1/drm-bridge-anx7625-fix-set-hpd-irq-detect-window-to-.patch
 create mode 100644 queue-6.1/drm-drm_file-fix-use-of-uninitialized-variable.patch
 create mode 100644 queue-6.1/drm-exynos-call-drm_atomic_helper_shutdown-at-shutdo.patch
 create mode 100644 queue-6.1/drm-fix-color-lut-rounding.patch
 create mode 100644 queue-6.1/drm-framebuffer-fix-use-of-uninitialized-variable.patch
 create mode 100644 queue-6.1/drm-mipi-dsi-fix-detach-call-without-attach.patch
 create mode 100644 queue-6.1/drm-msm-dpu-fix-writeback-programming-for-yuv-cases.patch
 create mode 100644 queue-6.1/drm-msm-dpu-ratelimit-framedone-timeout-msgs.patch
 create mode 100644 queue-6.1/drm-panel-edp-add-override_edid_mode-quirk-for-gener.patch
 create mode 100644 queue-6.1/drm-using-mul_u32_u32-requires-linux-math64.h.patch
 create mode 100644 queue-6.1/ecryptfs-reject-casefold-directory-inodes.patch
 create mode 100644 queue-6.1/erofs-fix-ztailpacking-for-subpage-compressed-blocks.patch
 create mode 100644 queue-6.1/ext4-avoid-online-resizing-failures-due-to-oversized.patch
 create mode 100644 queue-6.1/ext4-fix-inconsistent-between-segment-fstrim-and-ful.patch
 create mode 100644 queue-6.1/ext4-remove-unnecessary-check-from-alloc_flex_gd.patch
 create mode 100644 queue-6.1/ext4-unify-the-type-of-flexbg_size-to-unsigned-int.patch
 create mode 100644 queue-6.1/f2fs-fix-to-check-return-value-of-f2fs_reserve_new_b.patch
 create mode 100644 queue-6.1/f2fs-fix-to-tag-gcing-flag-on-page-during-block-migr.patch
 create mode 100644 queue-6.1/f2fs-fix-write-pointers-on-zoned-device-after-roll-f.patch
 create mode 100644 queue-6.1/fast_dput-handle-underflows-gracefully.patch
 create mode 100644 queue-6.1/fs-jfs-ubsan-array-index-out-of-bounds-in-dbadjtree.patch
 create mode 100644 queue-6.1/fs-kernfs-dir-obey-s_isgid.patch
 create mode 100644 queue-6.1/hexagon-make-pfn-accessors-statics-inlines.patch
 create mode 100644 queue-6.1/hwmon-nct6775-fix-fan-speed-set-failure-in-automatic.patch
 create mode 100644 queue-6.1/hwmon-pc87360-bounds-check-data-innr-usage.patch
 create mode 100644 queue-6.1/i2c-rk3x-adjust-mask-value-offset-for-i2c2-on-rv1126.patch
 create mode 100644 queue-6.1/i3c-master-cdns-update-maximum-prescaler-value-for-i.patch
 create mode 100644 queue-6.1/i40e-fix-vf-disable-behavior-to-block-all-traffic.patch
 create mode 100644 queue-6.1/ib-ipoib-fix-mcast-list-locking.patch
 create mode 100644 queue-6.1/ice-fix-ice_aq_vsi_q_opt_rss_-register-values.patch
 create mode 100644 queue-6.1/ice-fix-pre-shifted-bit-usage.patch
 create mode 100644 queue-6.1/ionic-bypass-firmware-cmds-when-stuck-in-reset.patch
 create mode 100644 queue-6.1/ionic-pass-opcode-to-devcmd_wait.patch
 create mode 100644 queue-6.1/jfs-fix-array-index-out-of-bounds-in-dbadjtree.patch
 create mode 100644 queue-6.1/jfs-fix-array-index-out-of-bounds-in-dinewext.patch
 create mode 100644 queue-6.1/jfs-fix-slab-out-of-bounds-read-in-dtsearch.patch
 create mode 100644 queue-6.1/jfs-fix-uaf-in-jfs_evict_inode.patch
 create mode 100644 queue-6.1/kvm-s390-fix-setting-of-fpc-register.patch
 create mode 100644 queue-6.1/leds-trigger-panic-don-t-register-panic-notifier-if-.patch
 create mode 100644 queue-6.1/libbpf-fix-null-pointer-dereference-in-bpf_object__c.patch
 create mode 100644 queue-6.1/libsubcmd-fix-memory-leak-in-uniq.patch
 create mode 100644 queue-6.1/mailbox-arm_mhuv2-fix-a-bug-for-mhuv2_sender_interru.patch
 create mode 100644 queue-6.1/md-whenassemble-the-array-consult-the-superblock-of-.patch
 create mode 100644 queue-6.1/media-amphion-remove-mutext-lock-in-condition-of-wai.patch
 create mode 100644 queue-6.1/media-ddbridge-fix-an-error-code-problem-in-ddb_prob.patch
 create mode 100644 queue-6.1/media-i2c-imx335-fix-hblank-min-max-values.patch
 create mode 100644 queue-6.1/media-renesas-vsp1-fix-references-to-pad-config.patch
 create mode 100644 queue-6.1/media-rkisp1-drop-irqf_shared.patch
 create mode 100644 queue-6.1/media-rkisp1-fix-irq-disable-race-issue.patch
 create mode 100644 queue-6.1/media-rkisp1-fix-irq-handler-return-values.patch
 create mode 100644 queue-6.1/media-rkisp1-store-irq-lines.patch
 create mode 100644 queue-6.1/media-rockchip-rga-fix-swizzling-for-rgb-formats.patch
 create mode 100644 queue-6.1/media-stk1160-fixed-high-volume-of-stk1160_dbg-messa.patch
 create mode 100644 queue-6.1/mfd-ti_am335x_tscadc-fix-ti-soc-dependencies.patch
 create mode 100644 queue-6.1/misc-lis3lv02d_i2c-add-missing-setting-of-the-reg_ct.patch
 create mode 100644 queue-6.1/net-atlantic-eliminate-double-free-in-error-handling.patch
 create mode 100644 queue-6.1/net-dsa-mv88e6xxx-fix-mv88e6352_serdes_get_stats-err.patch
 create mode 100644 queue-6.1/net-dsa-qca8k-put-mdio-bus-of-node-on-qca8k_mdio_reg.patch
 create mode 100644 queue-6.1/net-mvmdio-avoid-excessive-sleeps-in-polled-mode.patch
 create mode 100644 queue-6.1/net-phy-at803x-fix-passing-the-wrong-reference-for-c.patch
 create mode 100644 queue-6.1/net-smc-disable-seid-on-non-s390-archs-where-virtual.patch
 create mode 100644 queue-6.1/net-usb-ax88179_178a-avoid-two-consecutive-device-re.patch
 create mode 100644 queue-6.1/octeontx2-af-fix-max-npc-mcam-entry-check-while-vali.patch
 create mode 100644 queue-6.1/pci-add-intel_hda_arl-to-pci_ids.h.patch
 create mode 100644 queue-6.1/pci-add-no-pm-reset-quirk-for-nvidia-spectrum-device.patch
 create mode 100644 queue-6.1/pci-aer-decode-requester-id-when-no-error-info-found.patch
 create mode 100644 queue-6.1/pci-fix-64gt-s-effective-data-rate-calculation.patch
 create mode 100644 queue-6.1/pci-only-override-amd-usb-controller-if-required.patch
 create mode 100644 queue-6.1/pci-switchtec-fix-stdev_release-crash-after-surprise.patch
 create mode 100644 queue-6.1/perf-core-fix-narrow-startup-race-when-creating-the-.patch
 create mode 100644 queue-6.1/perf-cs-etm-bump-minimum-opencsd-version-to-ensure-a.patch
 create mode 100644 queue-6.1/perf-fix-the-nr_addr_filters-fix.patch
 create mode 100644 queue-6.1/pm-devfreq-synchronize-devfreq_monitor_-start-stop.patch
 create mode 100644 queue-6.1/pnp-acpi-fix-fortify-warning.patch
 create mode 100644 queue-6.1/powerpc-64s-fix-config_numa-n-build-due-to-create_se.patch
 create mode 100644 queue-6.1/powerpc-fix-build-error-due-to-is_valid_bugaddr.patch
 create mode 100644 queue-6.1/powerpc-lib-validate-size-for-vector-operations.patch
 create mode 100644 queue-6.1/powerpc-mm-fix-build-failures-due-to-arch_reserved_k.patch
 create mode 100644 queue-6.1/powerpc-mm-fix-null-pointer-dereference-in-pgtable_c.patch
 create mode 100644 queue-6.1/powerpc-pmd_move_must_withdraw-is-only-needed-for-co.patch
 create mode 100644 queue-6.1/pstore-ram-fix-crash-when-setting-number-of-cpus-to-.patch
 create mode 100644 queue-6.1/rdma-ipoib-fix-error-code-return-in-ipoib_mcast_join.patch
 create mode 100644 queue-6.1/regulator-core-only-increment-use_count-when-enable_.patch
 create mode 100644 queue-6.1/rxrpc_find_service_conn_rcu-fix-the-usage-of-read_se.patch
 create mode 100644 queue-6.1/s390-ptrace-handle-setting-of-fpc-register-correctly.patch
 create mode 100644 queue-6.1/s390-vfio-ap-fix-sysfs-status-attribute-for-ap-queue.patch
 create mode 100644 queue-6.1/scsi-arcmsr-support-new-pci-device-ids-1883-and-1886.patch
 create mode 100644 queue-6.1/scsi-hisi_sas-set-.phy_attached-before-notifing-phyu.patch
 create mode 100644 queue-6.1/scsi-libfc-don-t-schedule-abort-twice.patch
 create mode 100644 queue-6.1/scsi-libfc-fix-up-timeout-error-in-fc_fcp_rec_error.patch
 create mode 100644 queue-6.1/scsi-lpfc-fix-possible-file-string-name-overflow-whe.patch
 create mode 100644 queue-6.1/scsi-mpi3mr-add-pci-checks-where-sas5116-diverges-fr.patch
 create mode 100644 queue-6.1/selftests-bpf-fix-issues-in-setup_classid_environmen.patch
 create mode 100644 queue-6.1/selftests-bpf-fix-pyperf180-compilation-failure-with.patch
 create mode 100644 queue-6.1/selftests-bpf-satisfy-compiler-by-having-explicit-re.patch
 create mode 100644 queue-6.1/selftests-sgx-fix-linker-script-asserts.patch
 create mode 100644 queue-6.1/series
 create mode 100644 queue-6.1/soc-xilinx-fix-for-call-trace-due-to-the-usage-of-sm.patch
 create mode 100644 queue-6.1/soc-xilinx-fix-unhandled-sgi-warning-message.patch
 create mode 100644 queue-6.1/spmi-mediatek-fix-uaf-on-device-remove.patch
 create mode 100644 queue-6.1/sunrpc-fix-a-suspicious-rcu-usage-warning.patch
 create mode 100644 queue-6.1/tty-allow-tiocslcktrmios-with-cap_checkpoint_restore.patch
 create mode 100644 queue-6.1/ubsan-array-index-out-of-bounds-in-dtsplitroot.patch
 create mode 100644 queue-6.1/um-don-t-use-vfprintf-for-os_info.patch
 create mode 100644 queue-6.1/um-fix-naming-clash-between-uml-and-scheduler.patch
 create mode 100644 queue-6.1/um-net-fix-return-type-of-uml_net_start_xmit.patch
 create mode 100644 queue-6.1/um-time-travel-fix-time-corruption.patch
 create mode 100644 queue-6.1/usb-hub-add-quirk-to-decrease-in-ep-poll-interval-fo.patch
 create mode 100644 queue-6.1/usb-hub-replace-hardcoded-quirk-value-with-bit-macro.patch
 create mode 100644 queue-6.1/virtio_net-fix-d-directive-writing-between-1-and-11-.patch
 create mode 100644 queue-6.1/watchdog-it87_wdt-keep-wdtctrl-bit-3-unmodified-for-.patch
 create mode 100644 queue-6.1/wifi-ath11k-fix-race-due-to-setting-ath11k_flag_ext_.patch
 create mode 100644 queue-6.1/wifi-ath9k-fix-potential-array-index-out-of-bounds-r.patch
 create mode 100644 queue-6.1/wifi-cfg80211-fix-rcu-dereference-in-__cfg80211_bss_.patch
 create mode 100644 queue-6.1/wifi-cfg80211-free-beacon_ies-when-overridden-from-h.patch
 create mode 100644 queue-6.1/wifi-rt2x00-correct-wrong-bbp-register-in-rxdcoc-cal.patch
 create mode 100644 queue-6.1/wifi-rt2x00-restart-beacon-queue-when-hardware-reset.patch
 create mode 100644 queue-6.1/wifi-rtl8xxxu-add-additional-usb-ids-for-rtl8192eu-d.patch
 create mode 100644 queue-6.1/wifi-rtlwifi-rtl8723-be-ae-using-calculate_bit_shift.patch
 create mode 100644 queue-6.1/wifi-wfx-fix-possible-null-pointer-dereference-in-wf.patch
 create mode 100644 queue-6.1/x86-boot-ignore-nmis-during-very-early-boot.patch
 create mode 100644 queue-6.1/x86-mce-mark-fatal-mce-s-page-as-poison-to-avoid-pan.patch
 create mode 100644 queue-6.1/xen-gntdev-fix-the-abuse-of-underlying-struct-page-i.patch
 create mode 100644 queue-6.1/xhci-fix-possible-null-pointer-deref-during-xhci-urb.patch

diff --git a/queue-6.1/9p-fix-initialisation-of-netfs_inode-for-9p.patch b/queue-6.1/9p-fix-initialisation-of-netfs_inode-for-9p.patch
new file mode 100644
index 00000000000..5e6359abf89
--- /dev/null
+++ b/queue-6.1/9p-fix-initialisation-of-netfs_inode-for-9p.patch
@@ -0,0 +1,98 @@
+From fe661410853317dcc39f1ba78ccc5e47e540bd2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jan 2024 20:33:17 +0000
+Subject: 9p: Fix initialisation of netfs_inode for 9p
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 9546ac78b232bac56ff975072b1965e0e755ebd4 ]
+
+The 9p filesystem is calling netfs_inode_init() in v9fs_init_inode() -
+before the struct inode fields have been initialised from the obtained file
+stats (ie. after v9fs_stat2inode*() has been called), but netfslib wants to
+set a couple of its fields from i_size.
+
+Reported-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Tested-by: Marc Dionne <marc.dionne@auristor.com>
+Tested-by: Dominique Martinet <asmadeus@codewreck.org>
+Acked-by: Dominique Martinet <asmadeus@codewreck.org>
+cc: Eric Van Hensbergen <ericvh@kernel.org>
+cc: Latchesar Ionkov <lucho@ionkov.net>
+cc: Dominique Martinet <asmadeus@codewreck.org>
+cc: Christian Schoenebeck <linux_oss@crudebyte.com>
+cc: v9fs@lists.linux.dev
+cc: linux-cachefs@redhat.com
+cc: linux-fsdevel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/9p/v9fs_vfs.h       | 1 +
+ fs/9p/vfs_inode.c      | 6 +++---
+ fs/9p/vfs_inode_dotl.c | 1 +
+ 3 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/fs/9p/v9fs_vfs.h b/fs/9p/v9fs_vfs.h
+index bc417da7e9c1..633fe4f527b8 100644
+--- a/fs/9p/v9fs_vfs.h
++++ b/fs/9p/v9fs_vfs.h
+@@ -46,6 +46,7 @@ struct inode *v9fs_alloc_inode(struct super_block *sb);
+ void v9fs_free_inode(struct inode *inode);
+ struct inode *v9fs_get_inode(struct super_block *sb, umode_t mode,
+ 			     dev_t rdev);
++void v9fs_set_netfs_context(struct inode *inode);
+ int v9fs_init_inode(struct v9fs_session_info *v9ses,
+ 		    struct inode *inode, umode_t mode, dev_t rdev);
+ void v9fs_evict_inode(struct inode *inode);
+diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
+index 4d1a4a8d9277..5e2657c1dbbe 100644
+--- a/fs/9p/vfs_inode.c
++++ b/fs/9p/vfs_inode.c
+@@ -250,7 +250,7 @@ void v9fs_free_inode(struct inode *inode)
+ /*
+  * Set parameters for the netfs library
+  */
+-static void v9fs_set_netfs_context(struct inode *inode)
++void v9fs_set_netfs_context(struct inode *inode)
+ {
+ 	struct v9fs_inode *v9inode = V9FS_I(inode);
+ 	netfs_inode_init(&v9inode->netfs, &v9fs_req_ops);
+@@ -344,8 +344,6 @@ int v9fs_init_inode(struct v9fs_session_info *v9ses,
+ 		err = -EINVAL;
+ 		goto error;
+ 	}
+-
+-	v9fs_set_netfs_context(inode);
+ error:
+ 	return err;
+ 
+@@ -377,6 +375,7 @@ struct inode *v9fs_get_inode(struct super_block *sb, umode_t mode, dev_t rdev)
+ 		iput(inode);
+ 		return ERR_PTR(err);
+ 	}
++	v9fs_set_netfs_context(inode);
+ 	return inode;
+ }
+ 
+@@ -479,6 +478,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb,
+ 		goto error;
+ 
+ 	v9fs_stat2inode(st, inode, sb, 0);
++	v9fs_set_netfs_context(inode);
+ 	v9fs_cache_inode_get_cookie(inode);
+ 	unlock_new_inode(inode);
+ 	return inode;
+diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
+index 5cfa4b4f070f..e15ad46833e0 100644
+--- a/fs/9p/vfs_inode_dotl.c
++++ b/fs/9p/vfs_inode_dotl.c
+@@ -130,6 +130,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb,
+ 		goto error;
+ 
+ 	v9fs_stat2inode_dotl(st, inode, 0);
++	v9fs_set_netfs_context(inode);
+ 	v9fs_cache_inode_get_cookie(inode);
+ 	retval = v9fs_get_acl(inode, fid);
+ 	if (retval)
+-- 
+2.43.0
+
diff --git a/queue-6.1/acpi-apei-set-memory-failure-flags-as-mf_action_requ.patch b/queue-6.1/acpi-apei-set-memory-failure-flags-as-mf_action_requ.patch
new file mode 100644
index 00000000000..044516906dc
--- /dev/null
+++ b/queue-6.1/acpi-apei-set-memory-failure-flags-as-mf_action_requ.patch
@@ -0,0 +1,144 @@
+From d92e7c45d6c89799fe5d58289fd98d1ced180d4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 14:45:18 +0800
+Subject: ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on
+ synchronous events
+
+From: Shuai Xue <xueshuai@linux.alibaba.com>
+
+[ Upstream commit a70297d2213253853e95f5b49651f924990c6d3b ]
+
+There are two major types of uncorrected recoverable (UCR) errors :
+
+ - Synchronous error: The error is detected and raised at the point of
+   the consumption in the execution flow, e.g. when a CPU tries to
+   access a poisoned cache line. The CPU will take a synchronous error
+   exception such as Synchronous External Abort (SEA) on Arm64 and
+   Machine Check Exception (MCE) on X86. OS requires to take action (for
+   example, offline failure page/kill failure thread) to recover this
+   uncorrectable error.
+
+ - Asynchronous error: The error is detected out of processor execution
+   context, e.g. when an error is detected by a background scrubber.
+   Some data in the memory are corrupted. But the data have not been
+   consumed. OS is optional to take action to recover this uncorrectable
+   error.
+
+When APEI firmware first is enabled, a platform may describe one error
+source for the handling of synchronous errors (e.g. MCE or SEA notification
+), or for handling asynchronous errors (e.g. SCI or External Interrupt
+notification). In other words, we can distinguish synchronous errors by
+APEI notification. For synchronous errors, kernel will kill the current
+process which accessing the poisoned page by sending SIGBUS with
+BUS_MCEERR_AR. In addition, for asynchronous errors, kernel will notify the
+process who owns the poisoned page by sending SIGBUS with BUS_MCEERR_AO in
+early kill mode. However, the GHES driver always sets mf_flags to 0 so that
+all synchronous errors are handled as asynchronous errors in memory failure.
+
+To this end, set memory failure flags as MF_ACTION_REQUIRED on synchronous
+events.
+
+Signed-off-by: Shuai Xue <xueshuai@linux.alibaba.com>
+Tested-by: Ma Wupeng <mawupeng1@huawei.com>
+Reviewed-by: Kefeng Wang <wangkefeng.wang@huawei.com>
+Reviewed-by: Xiaofei Tan <tanxiaofei@huawei.com>
+Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
+Reviewed-by: James Morse <james.morse@arm.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/ghes.c | 29 +++++++++++++++++++++++------
+ 1 file changed, 23 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index 9952f3a792ba..dd808cf65c84 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -99,6 +99,20 @@ static inline bool is_hest_type_generic_v2(struct ghes *ghes)
+ 	return ghes->generic->header.type == ACPI_HEST_TYPE_GENERIC_ERROR_V2;
+ }
+ 
++/*
++ * A platform may describe one error source for the handling of synchronous
++ * errors (e.g. MCE or SEA), or for handling asynchronous errors (e.g. SCI
++ * or External Interrupt). On x86, the HEST notifications are always
++ * asynchronous, so only SEA on ARM is delivered as a synchronous
++ * notification.
++ */
++static inline bool is_hest_sync_notify(struct ghes *ghes)
++{
++	u8 notify_type = ghes->generic->notify.type;
++
++	return notify_type == ACPI_HEST_NOTIFY_SEA;
++}
++
+ /*
+  * This driver isn't really modular, however for the time being,
+  * continuing to use module_param is the easiest way to remain
+@@ -461,7 +475,7 @@ static bool ghes_do_memory_failure(u64 physical_addr, int flags)
+ }
+ 
+ static bool ghes_handle_memory_failure(struct acpi_hest_generic_data *gdata,
+-				       int sev)
++				       int sev, bool sync)
+ {
+ 	int flags = -1;
+ 	int sec_sev = ghes_severity(gdata->error_severity);
+@@ -475,7 +489,7 @@ static bool ghes_handle_memory_failure(struct acpi_hest_generic_data *gdata,
+ 	    (gdata->flags & CPER_SEC_ERROR_THRESHOLD_EXCEEDED))
+ 		flags = MF_SOFT_OFFLINE;
+ 	if (sev == GHES_SEV_RECOVERABLE && sec_sev == GHES_SEV_RECOVERABLE)
+-		flags = 0;
++		flags = sync ? MF_ACTION_REQUIRED : 0;
+ 
+ 	if (flags != -1)
+ 		return ghes_do_memory_failure(mem_err->physical_addr, flags);
+@@ -483,9 +497,11 @@ static bool ghes_handle_memory_failure(struct acpi_hest_generic_data *gdata,
+ 	return false;
+ }
+ 
+-static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, int sev)
++static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata,
++				       int sev, bool sync)
+ {
+ 	struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata);
++	int flags = sync ? MF_ACTION_REQUIRED : 0;
+ 	bool queued = false;
+ 	int sec_sev, i;
+ 	char *p;
+@@ -510,7 +526,7 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, int s
+ 		 * and don't filter out 'corrected' error here.
+ 		 */
+ 		if (is_cache && has_pa) {
+-			queued = ghes_do_memory_failure(err_info->physical_fault_addr, 0);
++			queued = ghes_do_memory_failure(err_info->physical_fault_addr, flags);
+ 			p += err_info->length;
+ 			continue;
+ 		}
+@@ -631,6 +647,7 @@ static bool ghes_do_proc(struct ghes *ghes,
+ 	const guid_t *fru_id = &guid_null;
+ 	char *fru_text = "";
+ 	bool queued = false;
++	bool sync = is_hest_sync_notify(ghes);
+ 
+ 	sev = ghes_severity(estatus->error_severity);
+ 	apei_estatus_for_each_section(estatus, gdata) {
+@@ -648,13 +665,13 @@ static bool ghes_do_proc(struct ghes *ghes,
+ 			ghes_edac_report_mem_error(sev, mem_err);
+ 
+ 			arch_apei_report_mem_error(sev, mem_err);
+-			queued = ghes_handle_memory_failure(gdata, sev);
++			queued = ghes_handle_memory_failure(gdata, sev, sync);
+ 		}
+ 		else if (guid_equal(sec_type, &CPER_SEC_PCIE)) {
+ 			ghes_handle_aer(gdata);
+ 		}
+ 		else if (guid_equal(sec_type, &CPER_SEC_PROC_ARM)) {
+-			queued = ghes_handle_arm_hw_error(gdata, sev);
++			queued = ghes_handle_arm_hw_error(gdata, sev, sync);
+ 		} else {
+ 			void *err = acpi_hest_get_payload(gdata);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/acpi-extlog-fix-null-pointer-dereference-check.patch b/queue-6.1/acpi-extlog-fix-null-pointer-dereference-check.patch
new file mode 100644
index 00000000000..6e929bde566
--- /dev/null
+++ b/queue-6.1/acpi-extlog-fix-null-pointer-dereference-check.patch
@@ -0,0 +1,59 @@
+From 5222e20de10150577a89970634ee5194bac2ebe4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 13:00:37 -0500
+Subject: ACPI: extlog: fix NULL pointer dereference check
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Prarit Bhargava <prarit@redhat.com>
+
+[ Upstream commit 72d9b9747e78979510e9aafdd32eb99c7aa30dd1 ]
+
+The gcc plugin -fanalyzer [1] tries to detect various
+patterns of incorrect behaviour.  The tool reports:
+
+drivers/acpi/acpi_extlog.c: In function ‘extlog_exit’:
+drivers/acpi/acpi_extlog.c:307:12: warning: check of ‘extlog_l1_addr’ for NULL after already dereferencing it [-Wanalyzer-deref-before-check]
+    |
+    |  306 |         ((struct extlog_l1_head *)extlog_l1_addr)->flags &= ~FLAG_OS_OPTIN;
+    |      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~
+    |      |                                                  |
+    |      |                                                  (1) pointer ‘extlog_l1_addr’ is dereferenced here
+    |  307 |         if (extlog_l1_addr)
+    |      |            ~
+    |      |            |
+    |      |            (2) pointer ‘extlog_l1_addr’ is checked for NULL here but it was already dereferenced at (1)
+    |
+
+Fix the NULL pointer dereference check in extlog_exit().
+
+Link: https://gcc.gnu.org/onlinedocs/gcc-10.1.0/gcc/Static-Analyzer-Options.html # [1]
+
+Signed-off-by: Prarit Bhargava <prarit@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_extlog.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/acpi_extlog.c b/drivers/acpi/acpi_extlog.c
+index 088db2356998..0a84d5afd37c 100644
+--- a/drivers/acpi/acpi_extlog.c
++++ b/drivers/acpi/acpi_extlog.c
+@@ -308,9 +308,10 @@ static int __init extlog_init(void)
+ static void __exit extlog_exit(void)
+ {
+ 	mce_unregister_decode_chain(&extlog_mce_dec);
+-	((struct extlog_l1_head *)extlog_l1_addr)->flags &= ~FLAG_OS_OPTIN;
+-	if (extlog_l1_addr)
++	if (extlog_l1_addr) {
++		((struct extlog_l1_head *)extlog_l1_addr)->flags &= ~FLAG_OS_OPTIN;
+ 		acpi_os_unmap_iomem(extlog_l1_addr, l1_size);
++	}
+ 	if (elog_addr)
+ 		acpi_os_unmap_iomem(elog_addr, elog_size);
+ 	release_mem_region(elog_base, elog_size);
+-- 
+2.43.0
+
diff --git a/queue-6.1/acpi-numa-fix-the-logic-of-getting-the-fake_pxm-valu.patch b/queue-6.1/acpi-numa-fix-the-logic-of-getting-the-fake_pxm-valu.patch
new file mode 100644
index 00000000000..62f0801838a
--- /dev/null
+++ b/queue-6.1/acpi-numa-fix-the-logic-of-getting-the-fake_pxm-valu.patch
@@ -0,0 +1,49 @@
+From 9375e512e01c06c602615132734c63ffa94b010a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Dec 2023 18:43:18 +0800
+Subject: ACPI: NUMA: Fix the logic of getting the fake_pxm value
+
+From: Yuntao Wang <ytcoode@gmail.com>
+
+[ Upstream commit e3f577830ce216b0ca21d4750cbbd64cfc21efff ]
+
+The for loop does not iterate over the last element of the node_to_pxm_map
+array. This could lead to a conflict between the final fake_pxm value and
+the existing pxm values. That is, the final fake_pxm value can not be
+guaranteed to be an unused pxm value.
+
+While at it, fix up white space in slit_valid().
+
+Signed-off-by: Yuntao Wang <ytcoode@gmail.com>
+[ rjw: Changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/numa/srat.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/numa/srat.c b/drivers/acpi/numa/srat.c
+index 12f330b0eac0..b57de78fbf14 100644
+--- a/drivers/acpi/numa/srat.c
++++ b/drivers/acpi/numa/srat.c
+@@ -183,7 +183,7 @@ static int __init slit_valid(struct acpi_table_slit *slit)
+ 	int i, j;
+ 	int d = slit->locality_count;
+ 	for (i = 0; i < d; i++) {
+-		for (j = 0; j < d; j++)  {
++		for (j = 0; j < d; j++) {
+ 			u8 val = slit->entry[d*i + j];
+ 			if (i == j) {
+ 				if (val != LOCAL_DISTANCE)
+@@ -532,7 +532,7 @@ int __init acpi_numa_init(void)
+ 	 */
+ 
+ 	/* fake_pxm is the next unused PXM value after SRAT parsing */
+-	for (i = 0, fake_pxm = -1; i < MAX_NUMNODES - 1; i++) {
++	for (i = 0, fake_pxm = -1; i < MAX_NUMNODES; i++) {
+ 		if (node_to_pxm_map[i] > fake_pxm)
+ 			fake_pxm = node_to_pxm_map[i];
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.1/acpi-video-add-quirk-for-the-colorful-x15-at-23-lapt.patch b/queue-6.1/acpi-video-add-quirk-for-the-colorful-x15-at-23-lapt.patch
new file mode 100644
index 00000000000..12ca5bc3d75
--- /dev/null
+++ b/queue-6.1/acpi-video-add-quirk-for-the-colorful-x15-at-23-lapt.patch
@@ -0,0 +1,51 @@
+From ac00e2c64e1b897dd487ca476a396be990c5e53c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Nov 2023 21:59:13 +0800
+Subject: ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
+
+From: Yuluo Qiu <qyl27@outlook.com>
+
+[ Upstream commit 143176a46bdd3bfbe9ba2462bf94458e80d65ebf ]
+
+The Colorful X15 AT 23 ACPI video-bus device report spurious
+ACPI_VIDEO_NOTIFY_CYCLE events resulting in spurious KEY_SWITCHVIDEOMODE
+events being reported to userspace (and causing trouble there) when
+an external screen plugged in.
+
+Add a quirk setting the report_key_events mask to
+REPORT_BRIGHTNESS_KEY_EVENTS so that the ACPI_VIDEO_NOTIFY_CYCLE
+events will be ignored, while still reporting brightness up/down
+hotkey-presses to userspace normally.
+
+Signed-off-by: Yuluo Qiu <qyl27@outlook.com>
+Co-developed-by: Celeste Liu <CoelacanthusHex@gmail.com>
+Signed-off-by: Celeste Liu <CoelacanthusHex@gmail.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_video.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
+index f7852fb75ab3..756ab8edde83 100644
+--- a/drivers/acpi/acpi_video.c
++++ b/drivers/acpi/acpi_video.c
+@@ -513,6 +513,15 @@ static const struct dmi_system_id video_dmi_table[] = {
+ 		DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 3350"),
+ 		},
+ 	},
++	{
++	 .callback = video_set_report_key_events,
++	 .driver_data = (void *)((uintptr_t)REPORT_BRIGHTNESS_KEY_EVENTS),
++	 .ident = "COLORFUL X15 AT 23",
++	 .matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "COLORFUL"),
++		DMI_MATCH(DMI_PRODUCT_NAME, "X15 AT 23"),
++		},
++	},
+ 	/*
+ 	 * Some machines change the brightness themselves when a brightness
+ 	 * hotkey gets pressed, despite us telling them not to. In this case
+-- 
+2.43.0
+
diff --git a/queue-6.1/afs-fix-the-usage-of-read_seqbegin_or_lock-in-afs_fi.patch b/queue-6.1/afs-fix-the-usage-of-read_seqbegin_or_lock-in-afs_fi.patch
new file mode 100644
index 00000000000..d671955eb25
--- /dev/null
+++ b/queue-6.1/afs-fix-the-usage-of-read_seqbegin_or_lock-in-afs_fi.patch
@@ -0,0 +1,89 @@
+From 33eb4e549415777c3529f83d020b3f2814a27d75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 12:56:14 +0100
+Subject: afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+[ Upstream commit 1702e0654ca9a7bcd7c7619c8a5004db58945b71 ]
+
+David Howells says:
+
+ (5) afs_find_server().
+
+     There could be a lot of servers in the list and each server can have
+     multiple addresses, so I think this would be better with an exclusive
+     second pass.
+
+     The server list isn't likely to change all that often, but when it does
+     change, there's a good chance several servers are going to be
+     added/removed one after the other.  Further, this is only going to be
+     used for incoming cache management/callback requests from the server,
+     which hopefully aren't going to happen too often - but it is remotely
+     drivable.
+
+ (6) afs_find_server_by_uuid().
+
+     Similarly to (5), there could be a lot of servers to search through, but
+     they are in a tree not a flat list, so it should be faster to process.
+     Again, it's not likely to change that often and, again, when it does
+     change it's likely to involve multiple changes.  This can be driven
+     remotely by an incoming cache management request but is mostly going to
+     be driven by setting up or reconfiguring a volume's server list -
+     something that also isn't likely to happen often.
+
+Make the "seq" counter odd on the 2nd pass, otherwise read_seqbegin_or_lock()
+never takes the lock.
+
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+Link: https://lore.kernel.org/r/20231130115614.GA21581@redhat.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/server.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/afs/server.c b/fs/afs/server.c
+index b5237206eac3..0bd2f5ba6900 100644
+--- a/fs/afs/server.c
++++ b/fs/afs/server.c
+@@ -27,7 +27,7 @@ struct afs_server *afs_find_server(struct afs_net *net,
+ 	const struct afs_addr_list *alist;
+ 	struct afs_server *server = NULL;
+ 	unsigned int i;
+-	int seq = 0, diff;
++	int seq = 1, diff;
+ 
+ 	rcu_read_lock();
+ 
+@@ -35,6 +35,7 @@ struct afs_server *afs_find_server(struct afs_net *net,
+ 		if (server)
+ 			afs_unuse_server_notime(net, server, afs_server_trace_put_find_rsq);
+ 		server = NULL;
++		seq++; /* 2 on the 1st/lockless path, otherwise odd */
+ 		read_seqbegin_or_lock(&net->fs_addr_lock, &seq);
+ 
+ 		if (srx->transport.family == AF_INET6) {
+@@ -90,7 +91,7 @@ struct afs_server *afs_find_server_by_uuid(struct afs_net *net, const uuid_t *uu
+ {
+ 	struct afs_server *server = NULL;
+ 	struct rb_node *p;
+-	int diff, seq = 0;
++	int diff, seq = 1;
+ 
+ 	_enter("%pU", uuid);
+ 
+@@ -102,7 +103,7 @@ struct afs_server *afs_find_server_by_uuid(struct afs_net *net, const uuid_t *uu
+ 		if (server)
+ 			afs_unuse_server(net, server, afs_server_trace_put_uuid_rsq);
+ 		server = NULL;
+-
++		seq++; /* 2 on the 1st/lockless path, otherwise odd */
+ 		read_seqbegin_or_lock(&net->fs_lock, &seq);
+ 
+ 		p = net->fs_servers.rb_node;
+-- 
+2.43.0
+
diff --git a/queue-6.1/afs-fix-the-usage-of-read_seqbegin_or_lock-in-afs_lo.patch b/queue-6.1/afs-fix-the-usage-of-read_seqbegin_or_lock-in-afs_lo.patch
new file mode 100644
index 00000000000..649e92e07e3
--- /dev/null
+++ b/queue-6.1/afs-fix-the-usage-of-read_seqbegin_or_lock-in-afs_lo.patch
@@ -0,0 +1,54 @@
+From f49e76fda4ab61771c3f6916bb534f34f0fefb60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 12:56:06 +0100
+Subject: afs: fix the usage of read_seqbegin_or_lock() in
+ afs_lookup_volume_rcu()
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+[ Upstream commit 4121b4337146b64560d1e46ebec77196d9287802 ]
+
+David Howells says:
+
+ (2) afs_lookup_volume_rcu().
+
+     There can be a lot of volumes known by a system.  A thousand would
+     require a 10-step walk and this is drivable by remote operation, so I
+     think this should probably take a lock on the second pass too.
+
+Make the "seq" counter odd on the 2nd pass, otherwise read_seqbegin_or_lock()
+never takes the lock.
+
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+Link: https://lore.kernel.org/r/20231130115606.GA21571@redhat.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/callback.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/afs/callback.c b/fs/afs/callback.c
+index a484fa642808..90f9b2a46ff4 100644
+--- a/fs/afs/callback.c
++++ b/fs/afs/callback.c
+@@ -110,13 +110,14 @@ static struct afs_volume *afs_lookup_volume_rcu(struct afs_cell *cell,
+ {
+ 	struct afs_volume *volume = NULL;
+ 	struct rb_node *p;
+-	int seq = 0;
++	int seq = 1;
+ 
+ 	do {
+ 		/* Unfortunately, rbtree walking doesn't give reliable results
+ 		 * under just the RCU read lock, so we have to check for
+ 		 * changes.
+ 		 */
++		seq++; /* 2 on the 1st/lockless path, otherwise odd */
+ 		read_seqbegin_or_lock(&cell->volume_lock, &seq);
+ 
+ 		p = rcu_dereference_raw(cell->volumes.rb_node);
+-- 
+2.43.0
+
diff --git a/queue-6.1/alsa-hda-conexant-fix-headset-auto-detect-fail-in-cx.patch b/queue-6.1/alsa-hda-conexant-fix-headset-auto-detect-fail-in-cx.patch
new file mode 100644
index 00000000000..f4ac868c53b
--- /dev/null
+++ b/queue-6.1/alsa-hda-conexant-fix-headset-auto-detect-fail-in-cx.patch
@@ -0,0 +1,200 @@
+From 70e4c54f3818157159f48574b39ca48bc4d2bdf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jan 2024 19:02:35 +0800
+Subject: ALSA: hda/conexant: Fix headset auto detect fail in cx8070 and SN6140
+
+From: bo liu <bo.liu@senarytech.com>
+
+[ Upstream commit 7aeb259086487417f0fecf66e325bee133e8813a ]
+
+When OMTP headset plugin the headset jack of CX8070 and SN6160 sound cards,
+the headset type detection circuit will recognize the headset type as CTIA.
+At this point, plugout and plugin the headset will get the correct headset
+type as OMTP.
+The reason for the failure of headset type recognition is that the sound
+card creation will enable the VREF voltage of the headset mic, which
+interferes with the headset type automatic detection circuit. Plugout and
+plugin the headset will restart the headset detection and get the correct
+headset type.
+The patch is disable the VREF voltage when the headset is not present, and
+will enable the VREF voltage when the headset is present.
+
+Signed-off-by: bo liu <bo.liu@senarytech.com>
+Link: https://lore.kernel.org/r/20240108110235.3867-1-bo.liu@senarytech.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_conexant.c | 115 ++++++++++++++++++++++++++++++++-
+ 1 file changed, 113 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index a889cccdd607..e8819e8a9876 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -21,6 +21,12 @@
+ #include "hda_jack.h"
+ #include "hda_generic.h"
+ 
++enum {
++	CX_HEADSET_NOPRESENT = 0,
++	CX_HEADSET_PARTPRESENT,
++	CX_HEADSET_ALLPRESENT,
++};
++
+ struct conexant_spec {
+ 	struct hda_gen_spec gen;
+ 
+@@ -42,7 +48,8 @@ struct conexant_spec {
+ 	unsigned int gpio_led;
+ 	unsigned int gpio_mute_led_mask;
+ 	unsigned int gpio_mic_led_mask;
+-
++	unsigned int headset_present_flag;
++	bool is_cx8070_sn6140;
+ };
+ 
+ 
+@@ -164,6 +171,27 @@ static void cxt_init_gpio_led(struct hda_codec *codec)
+ 	}
+ }
+ 
++static void cx_fixup_headset_recog(struct hda_codec *codec)
++{
++	unsigned int mic_persent;
++
++	/* fix some headset type recognize fail issue, such as EDIFIER headset */
++	/* set micbiasd output current comparator threshold from 66% to 55%. */
++	snd_hda_codec_write(codec, 0x1c, 0, 0x320, 0x010);
++	/* set OFF voltage for DFET from -1.2V to -0.8V, set headset micbias registor
++	 * value adjustment trim from 2.2K ohms to 2.0K ohms.
++	 */
++	snd_hda_codec_write(codec, 0x1c, 0, 0x3b0, 0xe10);
++	/* fix reboot headset type recognize fail issue */
++	mic_persent = snd_hda_codec_read(codec, 0x19, 0, AC_VERB_GET_PIN_SENSE, 0x0);
++	if (mic_persent & AC_PINSENSE_PRESENCE)
++		/* enable headset mic VREF */
++		snd_hda_codec_write(codec, 0x19, 0, AC_VERB_SET_PIN_WIDGET_CONTROL, 0x24);
++	else
++		/* disable headset mic VREF */
++		snd_hda_codec_write(codec, 0x19, 0, AC_VERB_SET_PIN_WIDGET_CONTROL, 0x20);
++}
++
+ static int cx_auto_init(struct hda_codec *codec)
+ {
+ 	struct conexant_spec *spec = codec->spec;
+@@ -174,6 +202,9 @@ static int cx_auto_init(struct hda_codec *codec)
+ 	cxt_init_gpio_led(codec);
+ 	snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_INIT);
+ 
++	if (spec->is_cx8070_sn6140)
++		cx_fixup_headset_recog(codec);
++
+ 	return 0;
+ }
+ 
+@@ -192,6 +223,77 @@ static void cx_auto_free(struct hda_codec *codec)
+ 	snd_hda_gen_free(codec);
+ }
+ 
++static void cx_process_headset_plugin(struct hda_codec *codec)
++{
++	unsigned int val;
++	unsigned int count = 0;
++
++	/* Wait headset detect done. */
++	do {
++		val = snd_hda_codec_read(codec, 0x1c, 0, 0xca0, 0x0);
++		if (val & 0x080) {
++			codec_dbg(codec, "headset type detect done!\n");
++			break;
++		}
++		msleep(20);
++		count++;
++	} while (count < 3);
++	val = snd_hda_codec_read(codec, 0x1c, 0, 0xcb0, 0x0);
++	if (val & 0x800) {
++		codec_dbg(codec, "headset plugin, type is CTIA\n");
++		snd_hda_codec_write(codec, 0x19, 0, AC_VERB_SET_PIN_WIDGET_CONTROL, 0x24);
++	} else if (val & 0x400) {
++		codec_dbg(codec, "headset plugin, type is OMTP\n");
++		snd_hda_codec_write(codec, 0x19, 0, AC_VERB_SET_PIN_WIDGET_CONTROL, 0x24);
++	} else {
++		codec_dbg(codec, "headphone plugin\n");
++	}
++}
++
++static void cx_update_headset_mic_vref(struct hda_codec *codec, unsigned int res)
++{
++	unsigned int phone_present, mic_persent, phone_tag, mic_tag;
++	struct conexant_spec *spec = codec->spec;
++
++	/* In cx8070 and sn6140, the node 16 can only be config to headphone or disabled,
++	 * the node 19 can only be config to microphone or disabled.
++	 * Check hp&mic tag to process headset pulgin&plugout.
++	 */
++	phone_tag = snd_hda_codec_read(codec, 0x16, 0, AC_VERB_GET_UNSOLICITED_RESPONSE, 0x0);
++	mic_tag = snd_hda_codec_read(codec, 0x19, 0, AC_VERB_GET_UNSOLICITED_RESPONSE, 0x0);
++	if ((phone_tag & (res >> AC_UNSOL_RES_TAG_SHIFT)) ||
++	    (mic_tag & (res >> AC_UNSOL_RES_TAG_SHIFT))) {
++		phone_present = snd_hda_codec_read(codec, 0x16, 0, AC_VERB_GET_PIN_SENSE, 0x0);
++		if (!(phone_present & AC_PINSENSE_PRESENCE)) {/* headphone plugout */
++			spec->headset_present_flag = CX_HEADSET_NOPRESENT;
++			snd_hda_codec_write(codec, 0x19, 0, AC_VERB_SET_PIN_WIDGET_CONTROL, 0x20);
++			return;
++		}
++		if (spec->headset_present_flag == CX_HEADSET_NOPRESENT) {
++			spec->headset_present_flag = CX_HEADSET_PARTPRESENT;
++		} else if (spec->headset_present_flag == CX_HEADSET_PARTPRESENT) {
++			mic_persent = snd_hda_codec_read(codec, 0x19, 0,
++							 AC_VERB_GET_PIN_SENSE, 0x0);
++			/* headset is present */
++			if ((phone_present & AC_PINSENSE_PRESENCE) &&
++			    (mic_persent & AC_PINSENSE_PRESENCE)) {
++				cx_process_headset_plugin(codec);
++				spec->headset_present_flag = CX_HEADSET_ALLPRESENT;
++			}
++		}
++	}
++}
++
++static void cx_jack_unsol_event(struct hda_codec *codec, unsigned int res)
++{
++	struct conexant_spec *spec = codec->spec;
++
++	if (spec->is_cx8070_sn6140)
++		cx_update_headset_mic_vref(codec, res);
++
++	snd_hda_jack_unsol_event(codec, res);
++}
++
+ #ifdef CONFIG_PM
+ static int cx_auto_suspend(struct hda_codec *codec)
+ {
+@@ -205,7 +307,7 @@ static const struct hda_codec_ops cx_auto_patch_ops = {
+ 	.build_pcms = snd_hda_gen_build_pcms,
+ 	.init = cx_auto_init,
+ 	.free = cx_auto_free,
+-	.unsol_event = snd_hda_jack_unsol_event,
++	.unsol_event = cx_jack_unsol_event,
+ #ifdef CONFIG_PM
+ 	.suspend = cx_auto_suspend,
+ 	.check_power_status = snd_hda_gen_check_power_status,
+@@ -1042,6 +1144,15 @@ static int patch_conexant_auto(struct hda_codec *codec)
+ 	codec->spec = spec;
+ 	codec->patch_ops = cx_auto_patch_ops;
+ 
++	/* init cx8070/sn6140 flag and reset headset_present_flag */
++	switch (codec->core.vendor_id) {
++	case 0x14f11f86:
++	case 0x14f11f87:
++		spec->is_cx8070_sn6140 = true;
++		spec->headset_present_flag = CX_HEADSET_NOPRESENT;
++		break;
++	}
++
+ 	cx_auto_parse_eapd(codec);
+ 	spec->gen.own_eapd_ctl = 1;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/alsa-hda-intel-add-hda_arl-pci-id-support.patch b/queue-6.1/alsa-hda-intel-add-hda_arl-pci-id-support.patch
new file mode 100644
index 00000000000..0005ef93a78
--- /dev/null
+++ b/queue-6.1/alsa-hda-intel-add-hda_arl-pci-id-support.patch
@@ -0,0 +1,41 @@
+From 5567e0b03dd702f9c5d40122e48e14eef7d91917 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 15:27:07 -0600
+Subject: ALSA: hda: Intel: add HDA_ARL PCI ID support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit a31014ebad617868c246d3985ff80d891f03711e ]
+
+Yet another PCI ID.
+
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Acked-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20231204212710.185976-3-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_intel.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 5aaf3dcecf27..a26f2a2d44cf 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2549,6 +2549,8 @@ static const struct pci_device_id azx_ids[] = {
+ 	/* Lunarlake-P */
+ 	{ PCI_DEVICE(0x8086, 0xa828),
+ 	  .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE},
++	/* Arrow Lake */
++	{ PCI_DEVICE_DATA(INTEL, HDA_ARL, AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE) },
+ 	/* Broxton-P(Apollolake) */
+ 	{ PCI_DEVICE(0x8086, 0x5a98),
+ 	  .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_BROXTON },
+-- 
+2.43.0
+
diff --git a/queue-6.1/alsa-hda-refer-to-correct-stream-index-at-loops.patch b/queue-6.1/alsa-hda-refer-to-correct-stream-index-at-loops.patch
new file mode 100644
index 00000000000..f07aacb9d13
--- /dev/null
+++ b/queue-6.1/alsa-hda-refer-to-correct-stream-index-at-loops.patch
@@ -0,0 +1,70 @@
+From c646806d704a4dbdfdbc3007a4662929b596ca53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Nov 2023 16:41:25 +0100
+Subject: ALSA: hda: Refer to correct stream index at loops
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 26257869672fd4a06a60c2da841e15fb2cb47bbe ]
+
+In a couple of loops over the all streams, we check the bitmap against
+the loop counter.  A more correct reference would be, however, the
+index of each stream, instead.
+
+This patch corrects the check of bitmaps to the stream index.
+
+Note that this change doesn't fix anything for now; all existing
+drivers set up the stream indices properly, hence the loop count is
+always equal with the stream index.  That said, this change is only
+for consistency.
+
+Link: https://lore.kernel.org/r/20231121154125.4888-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/hdac_stream.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/sound/hda/hdac_stream.c b/sound/hda/hdac_stream.c
+index 741a5d17ae4c..ecd3aec57c87 100644
+--- a/sound/hda/hdac_stream.c
++++ b/sound/hda/hdac_stream.c
+@@ -629,17 +629,15 @@ void snd_hdac_stream_timecounter_init(struct hdac_stream *azx_dev,
+ 	struct hdac_stream *s;
+ 	bool inited = false;
+ 	u64 cycle_last = 0;
+-	int i = 0;
+ 
+ 	list_for_each_entry(s, &bus->stream_list, list) {
+-		if (streams & (1 << i)) {
++		if ((streams & (1 << s->index))) {
+ 			azx_timecounter_init(s, inited, cycle_last);
+ 			if (!inited) {
+ 				inited = true;
+ 				cycle_last = s->tc.cycle_last;
+ 			}
+ 		}
+-		i++;
+ 	}
+ 
+ 	snd_pcm_gettime(runtime, &runtime->trigger_tstamp);
+@@ -684,14 +682,13 @@ void snd_hdac_stream_sync(struct hdac_stream *azx_dev, bool start,
+ 			  unsigned int streams)
+ {
+ 	struct hdac_bus *bus = azx_dev->bus;
+-	int i, nwait, timeout;
++	int nwait, timeout;
+ 	struct hdac_stream *s;
+ 
+ 	for (timeout = 5000; timeout; timeout--) {
+ 		nwait = 0;
+-		i = 0;
+ 		list_for_each_entry(s, &bus->stream_list, list) {
+-			if (!(streams & (1 << i++)))
++			if (!(streams & (1 << s->index)))
+ 				continue;
+ 
+ 			if (start) {
+-- 
+2.43.0
+
diff --git a/queue-6.1/arch-consolidate-arch_irq_work_raise-prototypes.patch b/queue-6.1/arch-consolidate-arch_irq_work_raise-prototypes.patch
new file mode 100644
index 00000000000..f7f4e73f7d9
--- /dev/null
+++ b/queue-6.1/arch-consolidate-arch_irq_work_raise-prototypes.patch
@@ -0,0 +1,130 @@
+From d3aaa38c1224d6e5deb13c3d7fd387f904cf7f81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Nov 2023 13:58:29 +0100
+Subject: arch: consolidate arch_irq_work_raise prototypes
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 64bac5ea17d527872121adddfee869c7a0618f8f ]
+
+The prototype was hidden in an #ifdef on x86, which causes a warning:
+
+kernel/irq_work.c:72:13: error: no previous prototype for 'arch_irq_work_raise' [-Werror=missing-prototypes]
+
+Some architectures have a working prototype, while others don't.
+Fix this by providing it in only one place that is always visible.
+
+Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Acked-by: Palmer Dabbelt <palmer@rivosinc.com>
+Acked-by: Guo Ren <guoren@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/irq_work.h     | 2 --
+ arch/arm64/include/asm/irq_work.h   | 2 --
+ arch/csky/include/asm/irq_work.h    | 2 +-
+ arch/powerpc/include/asm/irq_work.h | 1 -
+ arch/riscv/include/asm/irq_work.h   | 2 +-
+ arch/s390/include/asm/irq_work.h    | 2 --
+ arch/x86/include/asm/irq_work.h     | 1 -
+ include/linux/irq_work.h            | 3 +++
+ 8 files changed, 5 insertions(+), 10 deletions(-)
+
+diff --git a/arch/arm/include/asm/irq_work.h b/arch/arm/include/asm/irq_work.h
+index 3149e4dc1b54..8895999834cc 100644
+--- a/arch/arm/include/asm/irq_work.h
++++ b/arch/arm/include/asm/irq_work.h
+@@ -9,6 +9,4 @@ static inline bool arch_irq_work_has_interrupt(void)
+ 	return is_smp();
+ }
+ 
+-extern void arch_irq_work_raise(void);
+-
+ #endif /* _ASM_ARM_IRQ_WORK_H */
+diff --git a/arch/arm64/include/asm/irq_work.h b/arch/arm64/include/asm/irq_work.h
+index 81bbfa3a035b..a1020285ea75 100644
+--- a/arch/arm64/include/asm/irq_work.h
++++ b/arch/arm64/include/asm/irq_work.h
+@@ -2,8 +2,6 @@
+ #ifndef __ASM_IRQ_WORK_H
+ #define __ASM_IRQ_WORK_H
+ 
+-extern void arch_irq_work_raise(void);
+-
+ static inline bool arch_irq_work_has_interrupt(void)
+ {
+ 	return true;
+diff --git a/arch/csky/include/asm/irq_work.h b/arch/csky/include/asm/irq_work.h
+index 33aaf39d6f94..d39fcc1f5395 100644
+--- a/arch/csky/include/asm/irq_work.h
++++ b/arch/csky/include/asm/irq_work.h
+@@ -7,5 +7,5 @@ static inline bool arch_irq_work_has_interrupt(void)
+ {
+ 	return true;
+ }
+-extern void arch_irq_work_raise(void);
++
+ #endif /* __ASM_CSKY_IRQ_WORK_H */
+diff --git a/arch/powerpc/include/asm/irq_work.h b/arch/powerpc/include/asm/irq_work.h
+index b8b0be8f1a07..c6d3078bd8c3 100644
+--- a/arch/powerpc/include/asm/irq_work.h
++++ b/arch/powerpc/include/asm/irq_work.h
+@@ -6,6 +6,5 @@ static inline bool arch_irq_work_has_interrupt(void)
+ {
+ 	return true;
+ }
+-extern void arch_irq_work_raise(void);
+ 
+ #endif /* _ASM_POWERPC_IRQ_WORK_H */
+diff --git a/arch/riscv/include/asm/irq_work.h b/arch/riscv/include/asm/irq_work.h
+index b53891964ae0..b27a4d64fc6a 100644
+--- a/arch/riscv/include/asm/irq_work.h
++++ b/arch/riscv/include/asm/irq_work.h
+@@ -6,5 +6,5 @@ static inline bool arch_irq_work_has_interrupt(void)
+ {
+ 	return IS_ENABLED(CONFIG_SMP);
+ }
+-extern void arch_irq_work_raise(void);
++
+ #endif /* _ASM_RISCV_IRQ_WORK_H */
+diff --git a/arch/s390/include/asm/irq_work.h b/arch/s390/include/asm/irq_work.h
+index 603783766d0a..f00c9f610d5a 100644
+--- a/arch/s390/include/asm/irq_work.h
++++ b/arch/s390/include/asm/irq_work.h
+@@ -7,6 +7,4 @@ static inline bool arch_irq_work_has_interrupt(void)
+ 	return true;
+ }
+ 
+-void arch_irq_work_raise(void);
+-
+ #endif /* _ASM_S390_IRQ_WORK_H */
+diff --git a/arch/x86/include/asm/irq_work.h b/arch/x86/include/asm/irq_work.h
+index 800ffce0db29..6b4d36c95165 100644
+--- a/arch/x86/include/asm/irq_work.h
++++ b/arch/x86/include/asm/irq_work.h
+@@ -9,7 +9,6 @@ static inline bool arch_irq_work_has_interrupt(void)
+ {
+ 	return boot_cpu_has(X86_FEATURE_APIC);
+ }
+-extern void arch_irq_work_raise(void);
+ #else
+ static inline bool arch_irq_work_has_interrupt(void)
+ {
+diff --git a/include/linux/irq_work.h b/include/linux/irq_work.h
+index 8cd11a223260..136f2980cba3 100644
+--- a/include/linux/irq_work.h
++++ b/include/linux/irq_work.h
+@@ -66,6 +66,9 @@ void irq_work_sync(struct irq_work *work);
+ void irq_work_run(void);
+ bool irq_work_needs_cpu(void);
+ void irq_work_single(void *arg);
++
++void arch_irq_work_raise(void);
++
+ #else
+ static inline bool irq_work_needs_cpu(void) { return false; }
+ static inline void irq_work_run(void) { }
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm-dts-imx-use-flash-0-0-pattern.patch b/queue-6.1/arm-dts-imx-use-flash-0-0-pattern.patch
new file mode 100644
index 00000000000..255f76cb5a1
--- /dev/null
+++ b/queue-6.1/arm-dts-imx-use-flash-0-0-pattern.patch
@@ -0,0 +1,81 @@
+From 550efb6a9ef83752d85214de2e36e238423c1481 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Dec 2023 09:36:05 -0300
+Subject: ARM: dts: imx: Use flash@0,0 pattern
+
+From: Fabio Estevam <festevam@denx.de>
+
+[ Upstream commit 1e1d7cc478fb16816de09740e3c323c0c188d58f ]
+
+Per mtd-physmap.yaml, 'nor@0,0' is not a valid node pattern.
+
+Change it to 'flash@0,0' to fix the following dt-schema warning:
+
+imx1-ads.dtb: nor@0,0: $nodename:0: 'nor@0,0' does not match '^(flash|.*sram|nand)(@.*)?$'
+	from schema $id: http://devicetree.org/schemas/mtd/mtd-physmap.yaml#
+
+Signed-off-by: Fabio Estevam <festevam@denx.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx1-ads.dts                  | 2 +-
+ arch/arm/boot/dts/imx1-apf9328.dts              | 2 +-
+ arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi    | 2 +-
+ arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx1-ads.dts b/arch/arm/boot/dts/imx1-ads.dts
+index 5833fb6f15d8..2c817c4a4c68 100644
+--- a/arch/arm/boot/dts/imx1-ads.dts
++++ b/arch/arm/boot/dts/imx1-ads.dts
+@@ -65,7 +65,7 @@
+ 	pinctrl-0 = <&pinctrl_weim>;
+ 	status = "okay";
+ 
+-	nor: nor@0,0 {
++	nor: flash@0,0 {
+ 		compatible = "cfi-flash";
+ 		reg = <0 0x00000000 0x02000000>;
+ 		bank-width = <4>;
+diff --git a/arch/arm/boot/dts/imx1-apf9328.dts b/arch/arm/boot/dts/imx1-apf9328.dts
+index 77b21aa7a146..27e72b07b517 100644
+--- a/arch/arm/boot/dts/imx1-apf9328.dts
++++ b/arch/arm/boot/dts/imx1-apf9328.dts
+@@ -45,7 +45,7 @@
+ 	pinctrl-0 = <&pinctrl_weim>;
+ 	status = "okay";
+ 
+-	nor: nor@0,0 {
++	nor: flash@0,0 {
+ 		compatible = "cfi-flash";
+ 		reg = <0 0x00000000 0x02000000>;
+ 		bank-width = <2>;
+diff --git a/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi b/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi
+index 4b83e2918b55..c7e923584878 100644
+--- a/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi
++++ b/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi
+@@ -90,7 +90,7 @@
+ &weim {
+ 	status = "okay";
+ 
+-	nor: nor@0,0 {
++	nor: flash@0,0 {
+ 		#address-cells = <1>;
+ 		#size-cells = <1>;
+ 		compatible = "cfi-flash";
+diff --git a/arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi b/arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi
+index 3d10273177e9..a5fdc2fd4ce5 100644
+--- a/arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi
++++ b/arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi
+@@ -322,7 +322,7 @@
+ &weim {
+ 	status = "okay";
+ 
+-	nor: nor@0,0 {
++	nor: flash@0,0 {
+ 		compatible = "cfi-flash";
+ 		reg = <0 0x00000000 0x02000000>;
+ 		bank-width = <2>;
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm-dts-imx1-fix-sram-node.patch b/queue-6.1/arm-dts-imx1-fix-sram-node.patch
new file mode 100644
index 00000000000..68aea94a23a
--- /dev/null
+++ b/queue-6.1/arm-dts-imx1-fix-sram-node.patch
@@ -0,0 +1,53 @@
+From 20fe3647bd0dffc4fc5af79c4fe75f804d14f65b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Dec 2023 09:39:21 -0300
+Subject: ARM: dts: imx1: Fix sram node
+
+From: Fabio Estevam <festevam@denx.de>
+
+[ Upstream commit c248e535973088ba7071ff6f26ab7951143450af ]
+
+Per sram.yaml, address-cells, size-cells and ranges are mandatory.
+
+The node name should be sram.
+
+Change the node name and pass the required properties to fix the
+following dt-schema warnings:
+
+imx1-apf9328.dtb: esram@300000: $nodename:0: 'esram@300000' does not match '^sram(@.*)?'
+	from schema $id: http://devicetree.org/schemas/sram/sram.yaml#
+imx1-apf9328.dtb: esram@300000: '#address-cells' is a required property
+	from schema $id: http://devicetree.org/schemas/sram/sram.yaml#
+imx1-apf9328.dtb: esram@300000: '#size-cells' is a required property
+	from schema $id: http://devicetree.org/schemas/sram/sram.yaml#
+imx1-apf9328.dtb: esram@300000: 'ranges' is a required property
+	from schema $id: http://devicetree.org/schemas/sram/sram.yaml#
+
+Signed-off-by: Fabio Estevam <festevam@denx.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx1.dtsi | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx1.dtsi b/arch/arm/boot/dts/imx1.dtsi
+index e312f1e74e2f..4aeb74479f44 100644
+--- a/arch/arm/boot/dts/imx1.dtsi
++++ b/arch/arm/boot/dts/imx1.dtsi
+@@ -268,9 +268,12 @@
+ 			status = "disabled";
+ 		};
+ 
+-		esram: esram@300000 {
++		esram: sram@300000 {
+ 			compatible = "mmio-sram";
+ 			reg = <0x00300000 0x20000>;
++			ranges = <0 0x00300000 0x20000>;
++			#address-cells = <1>;
++			#size-cells = <1>;
+ 		};
+ 	};
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm-dts-imx23-28-fix-the-dma-controller-node-name.patch b/queue-6.1/arm-dts-imx23-28-fix-the-dma-controller-node-name.patch
new file mode 100644
index 00000000000..c59263cab69
--- /dev/null
+++ b/queue-6.1/arm-dts-imx23-28-fix-the-dma-controller-node-name.patch
@@ -0,0 +1,53 @@
+From 4ef6895926c75028f89c65d0f01c3fb068f0d987 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Dec 2023 07:26:31 -0300
+Subject: ARM: dts: imx23/28: Fix the DMA controller node name
+
+From: Fabio Estevam <festevam@denx.de>
+
+[ Upstream commit 858d83ca4b50bbc8693d95cc94310e6d791fb2e6 ]
+
+Per fsl,mxs-dma.yaml, the node name should be 'dma-controller'.
+
+Change it to fix the following dt-schema warning.
+
+imx28-apf28.dtb: dma-apbx@80024000: $nodename:0: 'dma-apbx@80024000' does not match '^dma-controller(@.*)?$'
+	from schema $id: http://devicetree.org/schemas/dma/fsl,mxs-dma.yaml#
+
+Signed-off-by: Fabio Estevam <festevam@denx.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx23.dtsi | 2 +-
+ arch/arm/boot/dts/imx28.dtsi | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx23.dtsi b/arch/arm/boot/dts/imx23.dtsi
+index 7f4c602454a5..ec476b159649 100644
+--- a/arch/arm/boot/dts/imx23.dtsi
++++ b/arch/arm/boot/dts/imx23.dtsi
+@@ -414,7 +414,7 @@
+ 				status = "disabled";
+ 			};
+ 
+-			dma_apbx: dma-apbx@80024000 {
++			dma_apbx: dma-controller@80024000 {
+ 				compatible = "fsl,imx23-dma-apbx";
+ 				reg = <0x80024000 0x2000>;
+ 				interrupts = <7 5 9 26
+diff --git a/arch/arm/boot/dts/imx28.dtsi b/arch/arm/boot/dts/imx28.dtsi
+index 130b4145af82..b15df16ecb01 100644
+--- a/arch/arm/boot/dts/imx28.dtsi
++++ b/arch/arm/boot/dts/imx28.dtsi
+@@ -994,7 +994,7 @@
+ 				status = "disabled";
+ 			};
+ 
+-			dma_apbx: dma-apbx@80024000 {
++			dma_apbx: dma-controller@80024000 {
+ 				compatible = "fsl,imx28-dma-apbx";
+ 				reg = <0x80024000 0x2000>;
+ 				interrupts = <78 79 66 0
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm-dts-imx23-sansa-use-preferred-i2c-gpios-properti.patch b/queue-6.1/arm-dts-imx23-sansa-use-preferred-i2c-gpios-properti.patch
new file mode 100644
index 00000000000..ef4eb1c945b
--- /dev/null
+++ b/queue-6.1/arm-dts-imx23-sansa-use-preferred-i2c-gpios-properti.patch
@@ -0,0 +1,61 @@
+From 1b0e8427bd3a8d699f2284d7b46760ac65a000d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Dec 2023 07:12:12 -0300
+Subject: ARM: dts: imx23-sansa: Use preferred i2c-gpios properties
+
+From: Fabio Estevam <festevam@denx.de>
+
+[ Upstream commit e3aa1a82fb20ee97597022f6528823a8ab82bde6 ]
+
+The 'gpios' property to describe the SDA and SCL GPIOs is considered
+deprecated according to i2c-gpio.yaml.
+
+Switch to the preferred 'sda-gpios' and 'scl-gpios' properties.
+
+This fixes the following schema warnings:
+
+imx23-sansa.dtb: i2c-0: 'sda-gpios' is a required property
+	from schema $id: http://devicetree.org/schemas/i2c/i2c-gpio.yaml#
+imx23-sansa.dtb: i2c-0: 'scl-gpios' is a required property
+	from schema $id: http://devicetree.org/schemas/i2c/i2c-gpio.yaml#
+
+Signed-off-by: Fabio Estevam <festevam@denx.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx23-sansa.dts | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx23-sansa.dts b/arch/arm/boot/dts/imx23-sansa.dts
+index 46057d9bf555..c2efcc20ae80 100644
+--- a/arch/arm/boot/dts/imx23-sansa.dts
++++ b/arch/arm/boot/dts/imx23-sansa.dts
+@@ -175,10 +175,8 @@
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		compatible = "i2c-gpio";
+-		gpios = <
+-			&gpio1 24 0		/* SDA */
+-			&gpio1 22 0		/* SCL */
+-		>;
++		sda-gpios = <&gpio1 24 0>;
++		scl-gpios = <&gpio1 22 0>;
+ 		i2c-gpio,delay-us = <2>;	/* ~100 kHz */
+ 	};
+ 
+@@ -186,10 +184,8 @@
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 		compatible = "i2c-gpio";
+-		gpios = <
+-			&gpio0 31 0		/* SDA */
+-			&gpio0 30 0		/* SCL */
+-		>;
++		sda-gpios = <&gpio0 31 0>;
++		scl-gpios = <&gpio0 30 0>;
+ 		i2c-gpio,delay-us = <2>;	/* ~100 kHz */
+ 
+ 		touch: touch@20 {
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm-dts-imx25-27-eukrea-fix-rtc-node-name.patch b/queue-6.1/arm-dts-imx25-27-eukrea-fix-rtc-node-name.patch
new file mode 100644
index 00000000000..97ab873daf2
--- /dev/null
+++ b/queue-6.1/arm-dts-imx25-27-eukrea-fix-rtc-node-name.patch
@@ -0,0 +1,52 @@
+From 1d7806bb63becb079e6ca6b5ba50fa8ddc726d6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Dec 2023 08:58:26 -0300
+Subject: ARM: dts: imx25/27-eukrea: Fix RTC node name
+
+From: Fabio Estevam <festevam@denx.de>
+
+[ Upstream commit 68c711b882c262e36895547cddea2c2d56ce611d ]
+
+Node names should be generic. Use 'rtc' as node name to fix
+the following dt-schema warning:
+
+imx25-eukrea-mbimxsd25-baseboard.dtb: pcf8563@51: $nodename:0: 'pcf8563@51' does not match '^rtc(@.*|-([0-9]|[1-9][0-9]+))?$'
+	from schema $id: http://devicetree.org/schemas/rtc/nxp,pcf8563.yaml#
+
+Signed-off-by: Fabio Estevam <festevam@denx.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi | 2 +-
+ arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi b/arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi
+index 0703f62d10d1..93a6e4e680b4 100644
+--- a/arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi
++++ b/arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi
+@@ -27,7 +27,7 @@
+ 	pinctrl-0 = <&pinctrl_i2c1>;
+ 	status = "okay";
+ 
+-	pcf8563@51 {
++	rtc@51 {
+ 		compatible = "nxp,pcf8563";
+ 		reg = <0x51>;
+ 	};
+diff --git a/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi b/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi
+index 74110bbcd9d4..4b83e2918b55 100644
+--- a/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi
++++ b/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi
+@@ -33,7 +33,7 @@
+ 	pinctrl-0 = <&pinctrl_i2c1>;
+ 	status = "okay";
+ 
+-	pcf8563@51 {
++	rtc@51 {
+ 		compatible = "nxp,pcf8563";
+ 		reg = <0x51>;
+ 	};
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm-dts-imx25-27-pass-timing0.patch b/queue-6.1/arm-dts-imx25-27-pass-timing0.patch
new file mode 100644
index 00000000000..84187899186
--- /dev/null
+++ b/queue-6.1/arm-dts-imx25-27-pass-timing0.patch
@@ -0,0 +1,138 @@
+From d93ca5bbfe2122b3b064c8ea731c1ca125fb6030 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Dec 2023 17:14:05 -0300
+Subject: ARM: dts: imx25/27: Pass timing0
+
+From: Fabio Estevam <festevam@denx.de>
+
+[ Upstream commit 11ab7ad6f795ae23c398a4a5c56505d3dab27c4c ]
+
+Per display-timings.yaml, the 'timing' pattern should be used to
+describe the display timings.
+
+Change it accordingly to fix the following dt-schema warning:
+
+imx27-apf27dev.dtb: display-timings: '800x480' does not match any of the regexes: '^timing', 'pinctrl-[0-9]+'
+	from schema $id: http://devicetree.org/schemas/display/panel/display-timings.yaml#
+
+Signed-off-by: Fabio Estevam <festevam@denx.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx25-eukrea-mbimxsd25-baseboard-cmo-qvga.dts | 2 +-
+ arch/arm/boot/dts/imx25-eukrea-mbimxsd25-baseboard-dvi-svga.dts | 2 +-
+ arch/arm/boot/dts/imx25-eukrea-mbimxsd25-baseboard-dvi-vga.dts  | 2 +-
+ arch/arm/boot/dts/imx25-pdk.dts                                 | 2 +-
+ arch/arm/boot/dts/imx27-apf27dev.dts                            | 2 +-
+ arch/arm/boot/dts/imx27-eukrea-mbimxsd27-baseboard.dts          | 2 +-
+ arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts                | 2 +-
+ arch/arm/boot/dts/imx27-phytec-phycore-rdk.dts                  | 2 +-
+ 8 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx25-eukrea-mbimxsd25-baseboard-cmo-qvga.dts b/arch/arm/boot/dts/imx25-eukrea-mbimxsd25-baseboard-cmo-qvga.dts
+index 7d4301b22b90..1ed3fb7b9ce6 100644
+--- a/arch/arm/boot/dts/imx25-eukrea-mbimxsd25-baseboard-cmo-qvga.dts
++++ b/arch/arm/boot/dts/imx25-eukrea-mbimxsd25-baseboard-cmo-qvga.dts
+@@ -16,7 +16,7 @@
+ 		bus-width = <18>;
+ 		display-timings {
+ 			native-mode = <&qvga_timings>;
+-			qvga_timings: 320x240 {
++			qvga_timings: timing0 {
+ 				clock-frequency = <6500000>;
+ 				hactive = <320>;
+ 				vactive = <240>;
+diff --git a/arch/arm/boot/dts/imx25-eukrea-mbimxsd25-baseboard-dvi-svga.dts b/arch/arm/boot/dts/imx25-eukrea-mbimxsd25-baseboard-dvi-svga.dts
+index 80a7f96de4c6..64b2ffac463b 100644
+--- a/arch/arm/boot/dts/imx25-eukrea-mbimxsd25-baseboard-dvi-svga.dts
++++ b/arch/arm/boot/dts/imx25-eukrea-mbimxsd25-baseboard-dvi-svga.dts
+@@ -16,7 +16,7 @@
+ 		bus-width = <18>;
+ 		display-timings {
+ 			native-mode = <&dvi_svga_timings>;
+-			dvi_svga_timings: 800x600 {
++			dvi_svga_timings: timing0 {
+ 				clock-frequency = <40000000>;
+ 				hactive = <800>;
+ 				vactive = <600>;
+diff --git a/arch/arm/boot/dts/imx25-eukrea-mbimxsd25-baseboard-dvi-vga.dts b/arch/arm/boot/dts/imx25-eukrea-mbimxsd25-baseboard-dvi-vga.dts
+index 24027a1fb46d..fb074bfdaa8d 100644
+--- a/arch/arm/boot/dts/imx25-eukrea-mbimxsd25-baseboard-dvi-vga.dts
++++ b/arch/arm/boot/dts/imx25-eukrea-mbimxsd25-baseboard-dvi-vga.dts
+@@ -16,7 +16,7 @@
+ 		bus-width = <18>;
+ 		display-timings {
+ 			native-mode = <&dvi_vga_timings>;
+-			dvi_vga_timings: 640x480 {
++			dvi_vga_timings: timing0 {
+ 				clock-frequency = <31250000>;
+ 				hactive = <640>;
+ 				vactive = <480>;
+diff --git a/arch/arm/boot/dts/imx25-pdk.dts b/arch/arm/boot/dts/imx25-pdk.dts
+index fb66884d8a2f..59b40d13a640 100644
+--- a/arch/arm/boot/dts/imx25-pdk.dts
++++ b/arch/arm/boot/dts/imx25-pdk.dts
+@@ -78,7 +78,7 @@
+ 		bus-width = <18>;
+ 		display-timings {
+ 			native-mode = <&wvga_timings>;
+-			wvga_timings: 640x480 {
++			wvga_timings: timing0 {
+ 				hactive = <640>;
+ 				vactive = <480>;
+ 				hback-porch = <45>;
+diff --git a/arch/arm/boot/dts/imx27-apf27dev.dts b/arch/arm/boot/dts/imx27-apf27dev.dts
+index 6f1e8ce9e76e..68fcb5ce9a9e 100644
+--- a/arch/arm/boot/dts/imx27-apf27dev.dts
++++ b/arch/arm/boot/dts/imx27-apf27dev.dts
+@@ -16,7 +16,7 @@
+ 		fsl,pcr = <0xfae80083>;	/* non-standard but required */
+ 		display-timings {
+ 			native-mode = <&timing0>;
+-			timing0: 800x480 {
++			timing0: timing0 {
+ 				clock-frequency = <33000033>;
+ 				hactive = <800>;
+ 				vactive = <480>;
+diff --git a/arch/arm/boot/dts/imx27-eukrea-mbimxsd27-baseboard.dts b/arch/arm/boot/dts/imx27-eukrea-mbimxsd27-baseboard.dts
+index 9c3ec82ec7e5..50fa0bd4c8a1 100644
+--- a/arch/arm/boot/dts/imx27-eukrea-mbimxsd27-baseboard.dts
++++ b/arch/arm/boot/dts/imx27-eukrea-mbimxsd27-baseboard.dts
+@@ -16,7 +16,7 @@
+ 
+ 		display-timings {
+ 			native-mode = <&timing0>;
+-			timing0: 320x240 {
++			timing0: timing0 {
+ 				clock-frequency = <6500000>;
+ 				hactive = <320>;
+ 				vactive = <240>;
+diff --git a/arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts b/arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts
+index 188639738dc3..7f36af150a25 100644
+--- a/arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts
++++ b/arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts
+@@ -19,7 +19,7 @@
+ 		fsl,pcr = <0xf0c88080>;	/* non-standard but required */
+ 		display-timings {
+ 			native-mode = <&timing0>;
+-			timing0: 640x480 {
++			timing0: timing0 {
+ 				hactive = <640>;
+ 				vactive = <480>;
+ 				hback-porch = <112>;
+diff --git a/arch/arm/boot/dts/imx27-phytec-phycore-rdk.dts b/arch/arm/boot/dts/imx27-phytec-phycore-rdk.dts
+index 344e77790152..d133b9f08b3a 100644
+--- a/arch/arm/boot/dts/imx27-phytec-phycore-rdk.dts
++++ b/arch/arm/boot/dts/imx27-phytec-phycore-rdk.dts
+@@ -19,7 +19,7 @@
+ 
+ 		display-timings {
+ 			native-mode = <&timing0>;
+-			timing0: 240x320 {
++			timing0: timing0 {
+ 				clock-frequency = <5500000>;
+ 				hactive = <240>;
+ 				vactive = <320>;
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm-dts-imx25-fix-the-iim-compatible-string.patch b/queue-6.1/arm-dts-imx25-fix-the-iim-compatible-string.patch
new file mode 100644
index 00000000000..d683f9845b2
--- /dev/null
+++ b/queue-6.1/arm-dts-imx25-fix-the-iim-compatible-string.patch
@@ -0,0 +1,40 @@
+From 81650f3e971039de13539aa0e666bc6bf5944e2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Dec 2023 17:00:33 -0300
+Subject: ARM: dts: imx25: Fix the iim compatible string
+
+From: Fabio Estevam <festevam@denx.de>
+
+[ Upstream commit f0b929f58719fc57a4926ab4fc972f185453d6a5 ]
+
+Per imx-iim.yaml, the compatible string should only contain a single
+entry.
+
+Use it as "fsl,imx25-iim" to fix the following dt-schema warning:
+
+imx25-karo-tx25.dtb: efuse@53ff0000: compatible: ['fsl,imx25-iim', 'fsl,imx27-iim'] is too long
+	from schema $id: http://devicetree.org/schemas/nvmem/imx-iim.yaml#
+
+Signed-off-by: Fabio Estevam <festevam@denx.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx25.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi
+index 5f90d72b840b..5ac4549286bd 100644
+--- a/arch/arm/boot/dts/imx25.dtsi
++++ b/arch/arm/boot/dts/imx25.dtsi
+@@ -543,7 +543,7 @@
+ 			};
+ 
+ 			iim: efuse@53ff0000 {
+-				compatible = "fsl,imx25-iim", "fsl,imx27-iim";
++				compatible = "fsl,imx25-iim";
+ 				reg = <0x53ff0000 0x4000>;
+ 				interrupts = <19>;
+ 				clocks = <&clks 99>;
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm-dts-imx27-apf27dev-fix-led-name.patch b/queue-6.1/arm-dts-imx27-apf27dev-fix-led-name.patch
new file mode 100644
index 00000000000..7f5d4634da0
--- /dev/null
+++ b/queue-6.1/arm-dts-imx27-apf27dev-fix-led-name.patch
@@ -0,0 +1,39 @@
+From dca2087f4eff66c2bb5a4aa4217d448f02fb389f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Dec 2023 17:19:05 -0300
+Subject: ARM: dts: imx27-apf27dev: Fix LED name
+
+From: Fabio Estevam <festevam@denx.de>
+
+[ Upstream commit dc35e253d032b959d92e12f081db5b00db26ae64 ]
+
+Per leds-gpio.yaml, the led names should start with 'led'.
+
+Change it to fix the following dt-schema warning:
+
+imx27-apf27dev.dtb: leds: 'user' does not match any of the regexes: '(^led-[0-9a-f]$|led)', 'pinctrl-[0-9]+'
+	from schema $id: http://devicetree.org/schemas/leds/leds-gpio.yaml#
+
+Signed-off-by: Fabio Estevam <festevam@denx.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx27-apf27dev.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx27-apf27dev.dts b/arch/arm/boot/dts/imx27-apf27dev.dts
+index 68fcb5ce9a9e..3d9bb7fc3be2 100644
+--- a/arch/arm/boot/dts/imx27-apf27dev.dts
++++ b/arch/arm/boot/dts/imx27-apf27dev.dts
+@@ -47,7 +47,7 @@
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&pinctrl_gpio_leds>;
+ 
+-		user {
++		led-user {
+ 			label = "Heartbeat";
+ 			gpios = <&gpio6 14 GPIO_ACTIVE_HIGH>;
+ 			linux,default-trigger = "heartbeat";
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm-dts-imx27-fix-sram-node.patch b/queue-6.1/arm-dts-imx27-fix-sram-node.patch
new file mode 100644
index 00000000000..04327254e8b
--- /dev/null
+++ b/queue-6.1/arm-dts-imx27-fix-sram-node.patch
@@ -0,0 +1,37 @@
+From 847e057b5c32510b3cb78c520c87b9427964498b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Dec 2023 09:39:20 -0300
+Subject: ARM: dts: imx27: Fix sram node
+
+From: Fabio Estevam <festevam@denx.de>
+
+[ Upstream commit 2fb7b2a2f06bb3f8321cf26c33e4e820c5b238b6 ]
+
+Per sram.yaml, address-cells, size-cells and ranges are mandatory.
+
+Pass them to fix the following dt-schema warnings:
+
+Signed-off-by: Fabio Estevam <festevam@denx.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx27.dtsi | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm/boot/dts/imx27.dtsi b/arch/arm/boot/dts/imx27.dtsi
+index e140307be2e7..eb6daf22486e 100644
+--- a/arch/arm/boot/dts/imx27.dtsi
++++ b/arch/arm/boot/dts/imx27.dtsi
+@@ -588,6 +588,9 @@
+ 		iram: sram@ffff4c00 {
+ 			compatible = "mmio-sram";
+ 			reg = <0xffff4c00 0xb400>;
++			ranges = <0 0xffff4c00 0xb400>;
++			#address-cells = <1>;
++			#size-cells = <1>;
+ 		};
+ 	};
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm-dts-imx7d-fix-coresight-funnel-ports.patch b/queue-6.1/arm-dts-imx7d-fix-coresight-funnel-ports.patch
new file mode 100644
index 00000000000..642c80315b6
--- /dev/null
+++ b/queue-6.1/arm-dts-imx7d-fix-coresight-funnel-ports.patch
@@ -0,0 +1,60 @@
+From 165ede7547c70a5ce61267984b5ad1b0b0dc042d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Oct 2023 10:15:53 +0200
+Subject: ARM: dts: imx7d: Fix coresight funnel ports
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 0d4ac04fa7c3f6dc263dba6f575a2ec7a2d4eca8 ]
+
+imx7d uses two ports for 'in-ports', so the syntax port@<num> has to
+be used. imx7d has both port and port@1 nodes present, raising these
+error:
+funnel@30041000: in-ports: More than one condition true in oneOf schema
+funnel@30041000: Unevaluated properties are not allowed
+('in-ports' was unexpected)
+
+Fix this by also using port@0 for imx7s as well.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx7d.dtsi | 3 ---
+ arch/arm/boot/dts/imx7s.dtsi | 6 +++++-
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx7d.dtsi b/arch/arm/boot/dts/imx7d.dtsi
+index 7ceb7c09f7ad..7ef685fdda55 100644
+--- a/arch/arm/boot/dts/imx7d.dtsi
++++ b/arch/arm/boot/dts/imx7d.dtsi
+@@ -208,9 +208,6 @@
+ };
+ 
+ &ca_funnel_in_ports {
+-	#address-cells = <1>;
+-	#size-cells = <0>;
+-
+ 	port@1 {
+ 		reg = <1>;
+ 		ca_funnel_in_port1: endpoint {
+diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi
+index 45947707134b..7c153c3e8238 100644
+--- a/arch/arm/boot/dts/imx7s.dtsi
++++ b/arch/arm/boot/dts/imx7s.dtsi
+@@ -190,7 +190,11 @@
+ 			clock-names = "apb_pclk";
+ 
+ 			ca_funnel_in_ports: in-ports {
+-				port {
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				port@0 {
++					reg = <0>;
+ 					ca_funnel_in_port0: endpoint {
+ 						remote-endpoint = <&etm0_out_port>;
+ 					};
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm-dts-imx7s-fix-lcdif-compatible.patch b/queue-6.1/arm-dts-imx7s-fix-lcdif-compatible.patch
new file mode 100644
index 00000000000..756fd7c89a3
--- /dev/null
+++ b/queue-6.1/arm-dts-imx7s-fix-lcdif-compatible.patch
@@ -0,0 +1,39 @@
+From 77f17ad84acbeaf306e17a5bc3319084533a432b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Oct 2023 10:15:54 +0200
+Subject: ARM: dts: imx7s: Fix lcdif compatible
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 5f55da4cc37051cda600ea870ce8cf29f1297715 ]
+
+imx7d-lcdif is compatible to imx6sx-lcdif. MXSFB_V6 supports overlay
+by using LCDC_AS_CTRL register. This registers used by overlay plane:
+* LCDC_AS_CTRL
+* LCDC_AS_BUF
+* LCDC_AS_NEXT_BUF
+are listed in i.MX7D RM as well.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx7s.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi
+index 7c153c3e8238..44085ef27977 100644
+--- a/arch/arm/boot/dts/imx7s.dtsi
++++ b/arch/arm/boot/dts/imx7s.dtsi
+@@ -818,7 +818,7 @@
+ 			};
+ 
+ 			lcdif: lcdif@30730000 {
+-				compatible = "fsl,imx7d-lcdif", "fsl,imx28-lcdif";
++				compatible = "fsl,imx7d-lcdif", "fsl,imx6sx-lcdif";
+ 				reg = <0x30730000 0x10000>;
+ 				interrupts = <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>;
+ 				clocks = <&clks IMX7D_LCDIF_PIXEL_ROOT_CLK>,
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm-dts-imx7s-fix-nand-controller-size-cells.patch b/queue-6.1/arm-dts-imx7s-fix-nand-controller-size-cells.patch
new file mode 100644
index 00000000000..19cd19b1d1d
--- /dev/null
+++ b/queue-6.1/arm-dts-imx7s-fix-nand-controller-size-cells.patch
@@ -0,0 +1,38 @@
+From f2ec4b8c4bcb623f56ebbb05d8aee2a1195f666f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Oct 2023 10:15:55 +0200
+Subject: ARM: dts: imx7s: Fix nand-controller #size-cells
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 4aadb841ed49bada1415c48c44d21f5b69e01299 ]
+
+nand-controller.yaml bindings says #size-cells shall be set to 0.
+Fixes the dtbs_check warning:
+arch/arm/boot/dts/nxp/imx/imx7s-mba7.dtb: nand-controller@33002000:
+ #size-cells:0:0: 0 was expected
+  from schema $id: http://devicetree.org/schemas/mtd/gpmi-nand.yaml#
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx7s.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi
+index 44085ef27977..4b23630fc738 100644
+--- a/arch/arm/boot/dts/imx7s.dtsi
++++ b/arch/arm/boot/dts/imx7s.dtsi
+@@ -1283,7 +1283,7 @@
+ 		gpmi: nand-controller@33002000{
+ 			compatible = "fsl,imx7d-gpmi-nand";
+ 			#address-cells = <1>;
+-			#size-cells = <1>;
++			#size-cells = <0>;
+ 			reg = <0x33002000 0x2000>, <0x33004000 0x4000>;
+ 			reg-names = "gpmi-nand", "bch";
+ 			interrupts = <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>;
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm-dts-rockchip-fix-rk3036-hdmi-ports-node.patch b/queue-6.1/arm-dts-rockchip-fix-rk3036-hdmi-ports-node.patch
new file mode 100644
index 00000000000..9263c7b1fcc
--- /dev/null
+++ b/queue-6.1/arm-dts-rockchip-fix-rk3036-hdmi-ports-node.patch
@@ -0,0 +1,51 @@
+From 55f37576054473d045d0acf6fde9dee0a1214644 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 18:40:27 +0100
+Subject: ARM: dts: rockchip: fix rk3036 hdmi ports node
+
+From: Johan Jonker <jbx6244@gmail.com>
+
+[ Upstream commit 27ded76ef0fcfcf939914532aae575cf23c221b4 ]
+
+Fix hdmi ports node so that it matches the
+rockchip,inno-hdmi.yaml binding.
+
+Signed-off-by: Johan Jonker <jbx6244@gmail.com>
+Link: https://lore.kernel.org/r/9a2afac1-ed5c-382d-02b0-b2f5f1af3abb@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3036.dtsi | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/rk3036.dtsi b/arch/arm/boot/dts/rk3036.dtsi
+index 78686fc72ce6..c420c7c642cb 100644
+--- a/arch/arm/boot/dts/rk3036.dtsi
++++ b/arch/arm/boot/dts/rk3036.dtsi
+@@ -402,12 +402,20 @@
+ 		pinctrl-0 = <&hdmi_ctl>;
+ 		status = "disabled";
+ 
+-		hdmi_in: port {
++		ports {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-			hdmi_in_vop: endpoint@0 {
++
++			hdmi_in: port@0 {
+ 				reg = <0>;
+-				remote-endpoint = <&vop_out_hdmi>;
++
++				hdmi_in_vop: endpoint {
++					remote-endpoint = <&vop_out_hdmi>;
++				};
++			};
++
++			hdmi_out: port@1 {
++				reg = <1>;
+ 			};
+ 		};
+ 	};
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-amlogic-fix-format-for-s4-uart-node.patch b/queue-6.1/arm64-dts-amlogic-fix-format-for-s4-uart-node.patch
new file mode 100644
index 00000000000..8d1d000ff37
--- /dev/null
+++ b/queue-6.1/arm64-dts-amlogic-fix-format-for-s4-uart-node.patch
@@ -0,0 +1,66 @@
+From f6e1d3d447b3cc4bc49df36b451a3d1f2cac3e88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Dec 2023 16:28:00 +0800
+Subject: arm64: dts: amlogic: fix format for s4 uart node
+
+From: Xianwei Zhao <xianwei.zhao@amlogic.com>
+
+[ Upstream commit eb54ef36282f670c704ed5af8593da62bebba80d ]
+
+Aliases use lowercase letters and place status in end.
+
+Signed-off-by: Xianwei Zhao <xianwei.zhao@amlogic.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20231215-s4-dts-v1-1-7831ab6972be@amlogic.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-s4-s805x2-aq222.dts | 4 ++--
+ arch/arm64/boot/dts/amlogic/meson-s4.dtsi             | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-s4-s805x2-aq222.dts b/arch/arm64/boot/dts/amlogic/meson-s4-s805x2-aq222.dts
+index 8ffbcb2b1ac5..bbd3c05cbd90 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-s4-s805x2-aq222.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-s4-s805x2-aq222.dts
+@@ -15,7 +15,7 @@
+ 	#size-cells = <2>;
+ 
+ 	aliases {
+-		serial0 = &uart_B;
++		serial0 = &uart_b;
+ 	};
+ 
+ 	memory@0 {
+@@ -25,6 +25,6 @@
+ 
+ };
+ 
+-&uart_B {
++&uart_b {
+ 	status = "okay";
+ };
+diff --git a/arch/arm64/boot/dts/amlogic/meson-s4.dtsi b/arch/arm64/boot/dts/amlogic/meson-s4.dtsi
+index ad50cba42d19..372a03762d69 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-s4.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-s4.dtsi
+@@ -118,14 +118,14 @@
+ 					<10 11 12 13 14 15 16 17 18 19 20 21>;
+ 			};
+ 
+-			uart_B: serial@7a000 {
++			uart_b: serial@7a000 {
+ 				compatible = "amlogic,meson-s4-uart",
+ 					     "amlogic,meson-ao-uart";
+ 				reg = <0x0 0x7a000 0x0 0x18>;
+ 				interrupts = <GIC_SPI 169 IRQ_TYPE_EDGE_RISING>;
+-				status = "disabled";
+ 				clocks = <&xtal>, <&xtal>, <&xtal>;
+ 				clock-names = "xtal", "pclk", "baud";
++				status = "disabled";
+ 			};
+ 
+ 			reset: reset-controller@2000 {
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-qcom-msm8996-fix-in-ports-is-a-required-pr.patch b/queue-6.1/arm64-dts-qcom-msm8996-fix-in-ports-is-a-required-pr.patch
new file mode 100644
index 00000000000..a0c095c372d
--- /dev/null
+++ b/queue-6.1/arm64-dts-qcom-msm8996-fix-in-ports-is-a-required-pr.patch
@@ -0,0 +1,63 @@
+From 66018fa39d45422d2fd932bd737119f4b65c55dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Dec 2023 23:26:29 -0800
+Subject: arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property
+
+From: Mao Jinlong <quic_jinlmao@quicinc.com>
+
+[ Upstream commit 9a6fc510a6a3ec150cb7450aec1e5f257e6fc77b ]
+
+Add the inport of funnel@3023000 to fix 'in-ports' is a required property
+warning.
+
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Mao Jinlong <quic_jinlmao@quicinc.com>
+Link: https://lore.kernel.org/r/20231210072633.4243-3-quic_jinlmao@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8996.dtsi | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+index 9de2248a385a..789121171a11 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+@@ -390,6 +390,19 @@
+ 		reg = <0x0 0x80000000 0x0 0x0>;
+ 	};
+ 
++	etm {
++		compatible = "qcom,coresight-remote-etm";
++
++		out-ports {
++			port {
++				modem_etm_out_funnel_in2: endpoint {
++					remote-endpoint =
++					  <&funnel_in2_in_modem_etm>;
++				};
++			};
++		};
++	};
++
+ 	psci {
+ 		compatible = "arm,psci-1.0";
+ 		method = "smc";
+@@ -2565,6 +2578,14 @@
+ 			clocks = <&rpmcc RPM_QDSS_CLK>, <&rpmcc RPM_QDSS_A_CLK>;
+ 			clock-names = "apb_pclk", "atclk";
+ 
++			in-ports {
++				port {
++					funnel_in2_in_modem_etm: endpoint {
++						remote-endpoint =
++						  <&modem_etm_out_funnel_in2>;
++					};
++				};
++			};
+ 
+ 			out-ports {
+ 				port {
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-dts-qcom-msm8998-fix-out-ports-is-a-required-p.patch b/queue-6.1/arm64-dts-qcom-msm8998-fix-out-ports-is-a-required-p.patch
new file mode 100644
index 00000000000..e74f7e0b183
--- /dev/null
+++ b/queue-6.1/arm64-dts-qcom-msm8998-fix-out-ports-is-a-required-p.patch
@@ -0,0 +1,88 @@
+From b70411004a604b4b9043724217da72a6a0a52b25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Dec 2023 23:26:30 -0800
+Subject: arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property
+
+From: Mao Jinlong <quic_jinlmao@quicinc.com>
+
+[ Upstream commit ae5ee3562a2519214b12228545e88a203dd68bbd ]
+
+out-ports is a required property for coresight ETM. Add out-ports for
+ETM nodes to fix the warning.
+
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Mao Jinlong <quic_jinlmao@quicinc.com>
+Link: https://lore.kernel.org/r/20231210072633.4243-4-quic_jinlmao@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8998.dtsi | 32 +++++++++++++++++----------
+ 1 file changed, 20 insertions(+), 12 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+index b00b8164c4aa..7a41250539ff 100644
+--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+@@ -1903,9 +1903,11 @@
+ 
+ 			cpu = <&CPU4>;
+ 
+-			port{
+-				etm4_out: endpoint {
+-					remote-endpoint = <&apss_funnel_in4>;
++			out-ports {
++				port{
++					etm4_out: endpoint {
++						remote-endpoint = <&apss_funnel_in4>;
++					};
+ 				};
+ 			};
+ 		};
+@@ -1920,9 +1922,11 @@
+ 
+ 			cpu = <&CPU5>;
+ 
+-			port{
+-				etm5_out: endpoint {
+-					remote-endpoint = <&apss_funnel_in5>;
++			out-ports {
++				port{
++					etm5_out: endpoint {
++						remote-endpoint = <&apss_funnel_in5>;
++					};
+ 				};
+ 			};
+ 		};
+@@ -1937,9 +1941,11 @@
+ 
+ 			cpu = <&CPU6>;
+ 
+-			port{
+-				etm6_out: endpoint {
+-					remote-endpoint = <&apss_funnel_in6>;
++			out-ports {
++				port{
++					etm6_out: endpoint {
++						remote-endpoint = <&apss_funnel_in6>;
++					};
+ 				};
+ 			};
+ 		};
+@@ -1954,9 +1960,11 @@
+ 
+ 			cpu = <&CPU7>;
+ 
+-			port{
+-				etm7_out: endpoint {
+-					remote-endpoint = <&apss_funnel_in7>;
++			out-ports {
++				port{
++					etm7_out: endpoint {
++						remote-endpoint = <&apss_funnel_in7>;
++					};
+ 				};
+ 			};
+ 		};
+-- 
+2.43.0
+
diff --git a/queue-6.1/arm64-irq-set-the-correct-node-for-vmap-stack.patch b/queue-6.1/arm64-irq-set-the-correct-node-for-vmap-stack.patch
new file mode 100644
index 00000000000..1d7f7cf0853
--- /dev/null
+++ b/queue-6.1/arm64-irq-set-the-correct-node-for-vmap-stack.patch
@@ -0,0 +1,100 @@
+From 76e76dbb59c7bf5fbf0cbb080b46051141eaa744 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Nov 2023 11:15:13 +0800
+Subject: arm64: irq: set the correct node for VMAP stack
+
+From: Huang Shijie <shijie@os.amperecomputing.com>
+
+[ Upstream commit 75b5e0bf90bffaca4b1f19114065dc59f5cc161f ]
+
+In current code, init_irq_stacks() will call cpu_to_node().
+The cpu_to_node() depends on percpu "numa_node" which is initialized in:
+     arch_call_rest_init() --> rest_init() -- kernel_init()
+	--> kernel_init_freeable() --> smp_prepare_cpus()
+
+But init_irq_stacks() is called in init_IRQ() which is before
+arch_call_rest_init().
+
+So in init_irq_stacks(), the cpu_to_node() does not work, it
+always return 0. In NUMA, it makes the node 1 cpu accesses the IRQ stack which
+is in the node 0.
+
+This patch fixes it by:
+  1.) export the early_cpu_to_node(), and use it in the init_irq_stacks().
+  2.) change init_irq_stacks() to __init function.
+
+Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Huang Shijie <shijie@os.amperecomputing.com>
+Link: https://lore.kernel.org/r/20231124031513.81548-1-shijie@os.amperecomputing.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/irq.c    | 5 +++--
+ drivers/base/arch_numa.c   | 2 +-
+ include/asm-generic/numa.h | 2 ++
+ 3 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/kernel/irq.c b/arch/arm64/kernel/irq.c
+index 38dbd3828f13..d9db544285c4 100644
+--- a/arch/arm64/kernel/irq.c
++++ b/arch/arm64/kernel/irq.c
+@@ -22,6 +22,7 @@
+ #include <linux/vmalloc.h>
+ #include <asm/daifflags.h>
+ #include <asm/exception.h>
++#include <asm/numa.h>
+ #include <asm/vmap_stack.h>
+ #include <asm/softirq_stack.h>
+ 
+@@ -50,13 +51,13 @@ static void init_irq_scs(void)
+ }
+ 
+ #ifdef CONFIG_VMAP_STACK
+-static void init_irq_stacks(void)
++static void __init init_irq_stacks(void)
+ {
+ 	int cpu;
+ 	unsigned long *p;
+ 
+ 	for_each_possible_cpu(cpu) {
+-		p = arch_alloc_vmap_stack(IRQ_STACK_SIZE, cpu_to_node(cpu));
++		p = arch_alloc_vmap_stack(IRQ_STACK_SIZE, early_cpu_to_node(cpu));
+ 		per_cpu(irq_stack_ptr, cpu) = p;
+ 	}
+ }
+diff --git a/drivers/base/arch_numa.c b/drivers/base/arch_numa.c
+index eaa31e567d1e..5b59d133b6af 100644
+--- a/drivers/base/arch_numa.c
++++ b/drivers/base/arch_numa.c
+@@ -144,7 +144,7 @@ void __init early_map_cpu_to_node(unsigned int cpu, int nid)
+ unsigned long __per_cpu_offset[NR_CPUS] __read_mostly;
+ EXPORT_SYMBOL(__per_cpu_offset);
+ 
+-static int __init early_cpu_to_node(int cpu)
++int __init early_cpu_to_node(int cpu)
+ {
+ 	return cpu_to_node_map[cpu];
+ }
+diff --git a/include/asm-generic/numa.h b/include/asm-generic/numa.h
+index 1a3ad6d29833..c32e0cf23c90 100644
+--- a/include/asm-generic/numa.h
++++ b/include/asm-generic/numa.h
+@@ -35,6 +35,7 @@ int __init numa_add_memblk(int nodeid, u64 start, u64 end);
+ void __init numa_set_distance(int from, int to, int distance);
+ void __init numa_free_distance(void);
+ void __init early_map_cpu_to_node(unsigned int cpu, int nid);
++int __init early_cpu_to_node(int cpu);
+ void numa_store_cpu_info(unsigned int cpu);
+ void numa_add_cpu(unsigned int cpu);
+ void numa_remove_cpu(unsigned int cpu);
+@@ -46,6 +47,7 @@ static inline void numa_add_cpu(unsigned int cpu) { }
+ static inline void numa_remove_cpu(unsigned int cpu) { }
+ static inline void arch_numa_init(void) { }
+ static inline void early_map_cpu_to_node(unsigned int cpu, int nid) { }
++static inline int early_cpu_to_node(int cpu) { return 0; }
+ 
+ #endif	/* CONFIG_NUMA */
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/asm-generic-make-sparse-happy-with-odd-sized-put_una.patch b/queue-6.1/asm-generic-make-sparse-happy-with-odd-sized-put_una.patch
new file mode 100644
index 00000000000..1c2b8894d7d
--- /dev/null
+++ b/queue-6.1/asm-generic-make-sparse-happy-with-odd-sized-put_una.patch
@@ -0,0 +1,86 @@
+From 9ac41899ff743443c374d8faaa9444bd2fd57257 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Jan 2024 22:16:45 -0800
+Subject: asm-generic: make sparse happy with odd-sized put_unaligned_*()
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit 1ab33c03145d0f6c345823fc2da935d9a1a9e9fc ]
+
+__put_unaligned_be24() and friends use implicit casts to convert
+larger-sized data to bytes, which trips sparse truncation warnings when
+the argument is a constant:
+
+    CC [M]  drivers/input/touchscreen/hynitron_cstxxx.o
+    CHECK   drivers/input/touchscreen/hynitron_cstxxx.c
+  drivers/input/touchscreen/hynitron_cstxxx.c: note: in included file (through arch/x86/include/generated/asm/unaligned.h):
+  include/asm-generic/unaligned.h:119:16: warning: cast truncates bits from constant value (aa01a0 becomes a0)
+  include/asm-generic/unaligned.h:120:20: warning: cast truncates bits from constant value (aa01 becomes 1)
+  include/asm-generic/unaligned.h:119:16: warning: cast truncates bits from constant value (ab00d0 becomes d0)
+  include/asm-generic/unaligned.h:120:20: warning: cast truncates bits from constant value (ab00 becomes 0)
+
+To avoid this let's mask off upper bits explicitly, the resulting code
+should be exactly the same, but it will keep sparse happy.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Closes: https://lore.kernel.org/oe-kbuild-all/202401070147.gqwVulOn-lkp@intel.com/
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/unaligned.h | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/include/asm-generic/unaligned.h b/include/asm-generic/unaligned.h
+index 699650f81970..a84c64e5f11e 100644
+--- a/include/asm-generic/unaligned.h
++++ b/include/asm-generic/unaligned.h
+@@ -104,9 +104,9 @@ static inline u32 get_unaligned_le24(const void *p)
+ 
+ static inline void __put_unaligned_be24(const u32 val, u8 *p)
+ {
+-	*p++ = val >> 16;
+-	*p++ = val >> 8;
+-	*p++ = val;
++	*p++ = (val >> 16) & 0xff;
++	*p++ = (val >> 8) & 0xff;
++	*p++ = val & 0xff;
+ }
+ 
+ static inline void put_unaligned_be24(const u32 val, void *p)
+@@ -116,9 +116,9 @@ static inline void put_unaligned_be24(const u32 val, void *p)
+ 
+ static inline void __put_unaligned_le24(const u32 val, u8 *p)
+ {
+-	*p++ = val;
+-	*p++ = val >> 8;
+-	*p++ = val >> 16;
++	*p++ = val & 0xff;
++	*p++ = (val >> 8) & 0xff;
++	*p++ = (val >> 16) & 0xff;
+ }
+ 
+ static inline void put_unaligned_le24(const u32 val, void *p)
+@@ -128,12 +128,12 @@ static inline void put_unaligned_le24(const u32 val, void *p)
+ 
+ static inline void __put_unaligned_be48(const u64 val, u8 *p)
+ {
+-	*p++ = val >> 40;
+-	*p++ = val >> 32;
+-	*p++ = val >> 24;
+-	*p++ = val >> 16;
+-	*p++ = val >> 8;
+-	*p++ = val;
++	*p++ = (val >> 40) & 0xff;
++	*p++ = (val >> 32) & 0xff;
++	*p++ = (val >> 24) & 0xff;
++	*p++ = (val >> 16) & 0xff;
++	*p++ = (val >> 8) & 0xff;
++	*p++ = val & 0xff;
+ }
+ 
+ static inline void put_unaligned_be48(const u64 val, void *p)
+-- 
+2.43.0
+
diff --git a/queue-6.1/asoc-amd-add-new-dmi-entries-for-acp5x-platform.patch b/queue-6.1/asoc-amd-add-new-dmi-entries-for-acp5x-platform.patch
new file mode 100644
index 00000000000..d669b48a773
--- /dev/null
+++ b/queue-6.1/asoc-amd-add-new-dmi-entries-for-acp5x-platform.patch
@@ -0,0 +1,55 @@
+From 855f1013ec03e27338fbff91058a6265530efa5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Dec 2023 16:36:12 +0530
+Subject: ASoC: amd: Add new dmi entries for acp5x platform
+
+From: Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
+
+[ Upstream commit c3ab23a10771bbe06300e5374efa809789c65455 ]
+
+Add sys_vendor and product_name dmi entries for acp5x platform.
+
+Signed-off-by: Venkata Prasad Potturu <venkataprasad.potturu@amd.com>
+Link: https://lore.kernel.org/r/20231206110620.1695591-1-venkataprasad.potturu@amd.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/acp-config.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/amd/acp-config.c b/sound/soc/amd/acp-config.c
+index 0932473b6394..9ee71a99a087 100644
+--- a/sound/soc/amd/acp-config.c
++++ b/sound/soc/amd/acp-config.c
+@@ -3,7 +3,7 @@
+ // This file is provided under a dual BSD/GPLv2 license. When using or
+ // redistributing this file, you may do so under either license.
+ //
+-// Copyright(c) 2021 Advanced Micro Devices, Inc.
++// Copyright(c) 2021, 2023 Advanced Micro Devices, Inc.
+ //
+ // Authors: Ajit Kumar Pandey <AjitKumar.Pandey@amd.com>
+ //
+@@ -35,6 +35,19 @@ static const struct config_entry config_table[] = {
+ 			{}
+ 		},
+ 	},
++	{
++		.flags = FLAG_AMD_LEGACY,
++		.device = ACP_PCI_DEV_ID,
++		.dmi_table = (const struct dmi_system_id []) {
++			{
++				.matches = {
++					DMI_MATCH(DMI_SYS_VENDOR, "Valve"),
++					DMI_MATCH(DMI_PRODUCT_NAME, "Jupiter"),
++				},
++			},
++			{}
++		},
++	},
+ 	{
+ 		.flags = FLAG_AMD_SOF,
+ 		.device = ACP_PCI_DEV_ID,
+-- 
+2.43.0
+
diff --git a/queue-6.1/asoc-doc-fix-undefined-snd_soc_dapm_nopm-argument.patch b/queue-6.1/asoc-doc-fix-undefined-snd_soc_dapm_nopm-argument.patch
new file mode 100644
index 00000000000..b46024b3e16
--- /dev/null
+++ b/queue-6.1/asoc-doc-fix-undefined-snd_soc_dapm_nopm-argument.patch
@@ -0,0 +1,37 @@
+From ac382e14d1ab51bd0eb107be1b72658b7de832f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Nov 2023 14:07:51 +0200
+Subject: ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 67c7666fe808c3a7af3cc6f9d0a3dd3acfd26115 ]
+
+The virtual widget example makes use of an undefined SND_SOC_DAPM_NOPM
+argument passed to SND_SOC_DAPM_MIXER().  Replace with the correct
+SND_SOC_NOPM definition.
+
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Link: https://lore.kernel.org/r/20231121120751.77355-1-cristian.ciocaltea@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/sound/soc/dapm.rst | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/sound/soc/dapm.rst b/Documentation/sound/soc/dapm.rst
+index 8e44107933ab..c3154ce6e1b2 100644
+--- a/Documentation/sound/soc/dapm.rst
++++ b/Documentation/sound/soc/dapm.rst
+@@ -234,7 +234,7 @@ corresponding soft power control. In this case it is necessary to create
+ a virtual widget - a widget with no control bits e.g.
+ ::
+ 
+-  SND_SOC_DAPM_MIXER("AC97 Mixer", SND_SOC_DAPM_NOPM, 0, 0, NULL, 0),
++  SND_SOC_DAPM_MIXER("AC97 Mixer", SND_SOC_NOPM, 0, 0, NULL, 0),
+ 
+ This can be used to merge to signal paths together in software.
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/audit-send-netlink-ack-before-setting-connection-in-.patch b/queue-6.1/audit-send-netlink-ack-before-setting-connection-in-.patch
new file mode 100644
index 00000000000..73d14650ec6
--- /dev/null
+++ b/queue-6.1/audit-send-netlink-ack-before-setting-connection-in-.patch
@@ -0,0 +1,117 @@
+From b9fe1606bb6b2527ff0c58fe62ed03f7039b3575 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Oct 2023 09:23:51 +0000
+Subject: audit: Send netlink ACK before setting connection in auditd_set
+
+From: Chris Riches <chris.riches@nutanix.com>
+
+[ Upstream commit 022732e3d846e197539712e51ecada90ded0572a ]
+
+When auditd_set sets the auditd_conn pointer, audit messages can
+immediately be put on the socket by other kernel threads. If the backlog
+is large or the rate is high, this can immediately fill the socket
+buffer. If the audit daemon requested an ACK for this operation, a full
+socket buffer causes the ACK to get dropped, also setting ENOBUFS on the
+socket.
+
+To avoid this race and ensure ACKs get through, fast-track the ACK in
+this specific case to ensure it is sent before auditd_conn is set.
+
+Signed-off-by: Chris Riches <chris.riches@nutanix.com>
+[PM: fix some tab vs space damage]
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/audit.c | 31 ++++++++++++++++++++++++-------
+ 1 file changed, 24 insertions(+), 7 deletions(-)
+
+diff --git a/kernel/audit.c b/kernel/audit.c
+index 9bc0b0301198..99127521cda8 100644
+--- a/kernel/audit.c
++++ b/kernel/audit.c
+@@ -488,15 +488,19 @@ static void auditd_conn_free(struct rcu_head *rcu)
+  * @pid: auditd PID
+  * @portid: auditd netlink portid
+  * @net: auditd network namespace pointer
++ * @skb: the netlink command from the audit daemon
++ * @ack: netlink ack flag, cleared if ack'd here
+  *
+  * Description:
+  * This function will obtain and drop network namespace references as
+  * necessary.  Returns zero on success, negative values on failure.
+  */
+-static int auditd_set(struct pid *pid, u32 portid, struct net *net)
++static int auditd_set(struct pid *pid, u32 portid, struct net *net,
++		      struct sk_buff *skb, bool *ack)
+ {
+ 	unsigned long flags;
+ 	struct auditd_connection *ac_old, *ac_new;
++	struct nlmsghdr *nlh;
+ 
+ 	if (!pid || !net)
+ 		return -EINVAL;
+@@ -508,6 +512,13 @@ static int auditd_set(struct pid *pid, u32 portid, struct net *net)
+ 	ac_new->portid = portid;
+ 	ac_new->net = get_net(net);
+ 
++	/* send the ack now to avoid a race with the queue backlog */
++	if (*ack) {
++		nlh = nlmsg_hdr(skb);
++		netlink_ack(skb, nlh, 0, NULL);
++		*ack = false;
++	}
++
+ 	spin_lock_irqsave(&auditd_conn_lock, flags);
+ 	ac_old = rcu_dereference_protected(auditd_conn,
+ 					   lockdep_is_held(&auditd_conn_lock));
+@@ -1201,7 +1212,8 @@ static int audit_replace(struct pid *pid)
+ 	return auditd_send_unicast_skb(skb);
+ }
+ 
+-static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
++static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
++			     bool *ack)
+ {
+ 	u32			seq;
+ 	void			*data;
+@@ -1294,7 +1306,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ 				/* register a new auditd connection */
+ 				err = auditd_set(req_pid,
+ 						 NETLINK_CB(skb).portid,
+-						 sock_net(NETLINK_CB(skb).sk));
++						 sock_net(NETLINK_CB(skb).sk),
++						 skb, ack);
+ 				if (audit_enabled != AUDIT_OFF)
+ 					audit_log_config_change("audit_pid",
+ 								new_pid,
+@@ -1539,9 +1552,10 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+  * Parse the provided skb and deal with any messages that may be present,
+  * malformed skbs are discarded.
+  */
+-static void audit_receive(struct sk_buff  *skb)
++static void audit_receive(struct sk_buff *skb)
+ {
+ 	struct nlmsghdr *nlh;
++	bool ack;
+ 	/*
+ 	 * len MUST be signed for nlmsg_next to be able to dec it below 0
+ 	 * if the nlmsg_len was not aligned
+@@ -1554,9 +1568,12 @@ static void audit_receive(struct sk_buff  *skb)
+ 
+ 	audit_ctl_lock();
+ 	while (nlmsg_ok(nlh, len)) {
+-		err = audit_receive_msg(skb, nlh);
+-		/* if err or if this message says it wants a response */
+-		if (err || (nlh->nlmsg_flags & NLM_F_ACK))
++		ack = nlh->nlmsg_flags & NLM_F_ACK;
++		err = audit_receive_msg(skb, nlh, &ack);
++
++		/* send an ack if the user asked for one and audit_receive_msg
++		 * didn't already do it, or if there was an error. */
++		if (ack || err)
+ 			netlink_ack(skb, nlh, err, NULL);
+ 
+ 		nlh = nlmsg_next(nlh, &len);
+-- 
+2.43.0
+
diff --git a/queue-6.1/blk-mq-fix-io-hang-from-sbitmap-wakeup-race.patch b/queue-6.1/blk-mq-fix-io-hang-from-sbitmap-wakeup-race.patch
new file mode 100644
index 00000000000..55e1846df62
--- /dev/null
+++ b/queue-6.1/blk-mq-fix-io-hang-from-sbitmap-wakeup-race.patch
@@ -0,0 +1,72 @@
+From e742838ac51597df353fb229e0c3da909d14da29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jan 2024 20:26:26 +0800
+Subject: blk-mq: fix IO hang from sbitmap wakeup race
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 5266caaf5660529e3da53004b8b7174cab6374ed ]
+
+In blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered
+with the following blk_mq_get_driver_tag() in case of getting driver
+tag failure.
+
+Then in __sbitmap_queue_wake_up(), waitqueue_active() may not observe
+the added waiter in blk_mq_mark_tag_wait() and wake up nothing, meantime
+blk_mq_mark_tag_wait() can't get driver tag successfully.
+
+This issue can be reproduced by running the following test in loop, and
+fio hang can be observed in < 30min when running it on my test VM
+in laptop.
+
+	modprobe -r scsi_debug
+	modprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4
+	dev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename`
+	fio --filename=/dev/"$dev" --direct=1 --rw=randrw --bs=4k --iodepth=1 \
+       		--runtime=100 --numjobs=40 --time_based --name=test \
+        	--ioengine=libaio
+
+Fix the issue by adding one explicit barrier in blk_mq_mark_tag_wait(), which
+is just fine in case of running out of tag.
+
+Cc: Jan Kara <jack@suse.cz>
+Cc: Kemeng Shi <shikemeng@huaweicloud.com>
+Reported-by: Changhui Zhong <czhong@redhat.com>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20240112122626.4181044-1-ming.lei@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index b3f99dda4530..c07e5eebcbd8 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1859,6 +1859,22 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx,
+ 	wait->flags &= ~WQ_FLAG_EXCLUSIVE;
+ 	__add_wait_queue(wq, wait);
+ 
++	/*
++	 * Add one explicit barrier since blk_mq_get_driver_tag() may
++	 * not imply barrier in case of failure.
++	 *
++	 * Order adding us to wait queue and allocating driver tag.
++	 *
++	 * The pair is the one implied in sbitmap_queue_wake_up() which
++	 * orders clearing sbitmap tag bits and waitqueue_active() in
++	 * __sbitmap_queue_wake_up(), since waitqueue_active() is lockless
++	 *
++	 * Otherwise, re-order of adding wait queue and getting driver tag
++	 * may cause __sbitmap_queue_wake_up() to wake up nothing because
++	 * the waitqueue_active() may not observe us in wait queue.
++	 */
++	smp_mb();
++
+ 	/*
+ 	 * It's possible that a tag was freed in the window between the
+ 	 * allocation failure and adding the hardware queue to the wait
+-- 
+2.43.0
+
diff --git a/queue-6.1/block-prevent-an-integer-overflow-in-bvec_try_merge_.patch b/queue-6.1/block-prevent-an-integer-overflow-in-bvec_try_merge_.patch
new file mode 100644
index 00000000000..c267f543e9c
--- /dev/null
+++ b/queue-6.1/block-prevent-an-integer-overflow-in-bvec_try_merge_.patch
@@ -0,0 +1,36 @@
+From 1b2ba104f8e809b11c6b22c2ae49f41ce1cbda23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 18:34:18 +0100
+Subject: block: prevent an integer overflow in bvec_try_merge_hw_page
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 3f034c374ad55773c12dd8f3c1607328e17c0072 ]
+
+Reordered a check to avoid a possible overflow when adding len to bv_len.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Link: https://lore.kernel.org/r/20231204173419.782378-2-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block/bio.c b/block/bio.c
+index 6c22dd7b6f27..74c2818c7ec9 100644
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -927,7 +927,7 @@ static bool bio_try_merge_hw_seg(struct request_queue *q, struct bio *bio,
+ 
+ 	if ((addr1 | mask) != (addr2 | mask))
+ 		return false;
+-	if (bv->bv_len + len > queue_max_segment_size(q))
++	if (len > queue_max_segment_size(q) - bv->bv_len)
+ 		return false;
+ 	return __bio_try_merge_page(bio, page, len, offset, same_page);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/block-rnbd-srv-check-for-unlikely-string-overflow.patch b/queue-6.1/block-rnbd-srv-check-for-unlikely-string-overflow.patch
new file mode 100644
index 00000000000..217676423c1
--- /dev/null
+++ b/queue-6.1/block-rnbd-srv-check-for-unlikely-string-overflow.patch
@@ -0,0 +1,88 @@
+From 372429e6cc6f014834da67bbba19348937046658 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Dec 2023 13:47:42 -0800
+Subject: block/rnbd-srv: Check for unlikely string overflow
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 9e4bf6a08d1e127bcc4bd72557f2dfafc6bc7f41 ]
+
+Since "dev_search_path" can technically be as large as PATH_MAX,
+there was a risk of truncation when copying it and a second string
+into "full_path" since it was also PATH_MAX sized. The W=1 builds were
+reporting this warning:
+
+drivers/block/rnbd/rnbd-srv.c: In function 'process_msg_open.isra':
+drivers/block/rnbd/rnbd-srv.c:616:51: warning: '%s' directive output may be truncated writing up to 254 bytes into a region of size between 0 and 4095 [-Wformat-truncation=]
+  616 |                 snprintf(full_path, PATH_MAX, "%s/%s",
+      |                                                   ^~
+In function 'rnbd_srv_get_full_path',
+    inlined from 'process_msg_open.isra' at drivers/block/rnbd/rnbd-srv.c:721:14: drivers/block/rnbd/rnbd-srv.c:616:17: note: 'snprintf' output between 2 and 4351 bytes into a destination of size 4096
+  616 |                 snprintf(full_path, PATH_MAX, "%s/%s",
+      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+  617 |                          dev_search_path, dev_name);
+      |                          ~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+To fix this, unconditionally check for truncation (as was already done
+for the case where "%SESSNAME%" was present).
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202312100355.lHoJPgKy-lkp@intel.com/
+Cc: Md. Haris Iqbal <haris.iqbal@ionos.com>
+Cc: Jack Wang <jinpu.wang@ionos.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc:  <linux-block@vger.kernel.org>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Acked-by: Guoqing Jiang <guoqing.jiang@linux.dev>
+Acked-by: Jack Wang <jinpu.wang@ionos.com>
+Link: https://lore.kernel.org/r/20231212214738.work.169-kees@kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/rnbd/rnbd-srv.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c
+index 2cfed2e58d64..ad451224e663 100644
+--- a/drivers/block/rnbd/rnbd-srv.c
++++ b/drivers/block/rnbd/rnbd-srv.c
+@@ -587,6 +587,7 @@ static char *rnbd_srv_get_full_path(struct rnbd_srv_session *srv_sess,
+ {
+ 	char *full_path;
+ 	char *a, *b;
++	int len;
+ 
+ 	full_path = kmalloc(PATH_MAX, GFP_KERNEL);
+ 	if (!full_path)
+@@ -598,19 +599,19 @@ static char *rnbd_srv_get_full_path(struct rnbd_srv_session *srv_sess,
+ 	 */
+ 	a = strnstr(dev_search_path, "%SESSNAME%", sizeof(dev_search_path));
+ 	if (a) {
+-		int len = a - dev_search_path;
++		len = a - dev_search_path;
+ 
+ 		len = snprintf(full_path, PATH_MAX, "%.*s/%s/%s", len,
+ 			       dev_search_path, srv_sess->sessname, dev_name);
+-		if (len >= PATH_MAX) {
+-			pr_err("Too long path: %s, %s, %s\n",
+-			       dev_search_path, srv_sess->sessname, dev_name);
+-			kfree(full_path);
+-			return ERR_PTR(-EINVAL);
+-		}
+ 	} else {
+-		snprintf(full_path, PATH_MAX, "%s/%s",
+-			 dev_search_path, dev_name);
++		len = snprintf(full_path, PATH_MAX, "%s/%s",
++			       dev_search_path, dev_name);
++	}
++	if (len >= PATH_MAX) {
++		pr_err("Too long path: %s, %s, %s\n",
++		       dev_search_path, srv_sess->sessname, dev_name);
++		kfree(full_path);
++		return ERR_PTR(-EINVAL);
+ 	}
+ 
+ 	/* eliminitate duplicated slashes */
+-- 
+2.43.0
+
diff --git a/queue-6.1/bluetooth-hci_sync-fix-br-edr-wakeup-bug.patch b/queue-6.1/bluetooth-hci_sync-fix-br-edr-wakeup-bug.patch
new file mode 100644
index 00000000000..9141f62abdf
--- /dev/null
+++ b/queue-6.1/bluetooth-hci_sync-fix-br-edr-wakeup-bug.patch
@@ -0,0 +1,47 @@
+From 9e0768f46d1f5e872052a9f40828cb3aea71fec5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 18:24:17 +0800
+Subject: Bluetooth: hci_sync: fix BR/EDR wakeup bug
+
+From: clancy shang <clancy.shang@quectel.com>
+
+[ Upstream commit d4b70ba1eab450eff9c5ef536f07c01d424b7eda ]
+
+when Bluetooth set the event mask and enter suspend, the controller
+has hci mode change event coming, it cause controller can not enter
+sleep mode. so it should to set the hci mode change event mask before
+enter suspend.
+
+Signed-off-by: clancy shang <clancy.shang@quectel.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_sync.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
+index d74fe13f3dce..45d19294aa77 100644
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -3780,12 +3780,14 @@ static int hci_set_event_mask_sync(struct hci_dev *hdev)
+ 	if (lmp_bredr_capable(hdev)) {
+ 		events[4] |= 0x01; /* Flow Specification Complete */
+ 
+-		/* Don't set Disconnect Complete when suspended as that
+-		 * would wakeup the host when disconnecting due to
+-		 * suspend.
++		/* Don't set Disconnect Complete and mode change when
++		 * suspended as that would wakeup the host when disconnecting
++		 * due to suspend.
+ 		 */
+-		if (hdev->suspended)
++		if (hdev->suspended) {
+ 			events[0] &= 0xef;
++			events[2] &= 0xf7;
++		}
+ 	} else {
+ 		/* Use a different default for LE-only devices */
+ 		memset(events, 0, sizeof(events));
+-- 
+2.43.0
+
diff --git a/queue-6.1/bluetooth-l2cap-fix-possible-multiple-reject-send.patch b/queue-6.1/bluetooth-l2cap-fix-possible-multiple-reject-send.patch
new file mode 100644
index 00000000000..10d43ad4ff0
--- /dev/null
+++ b/queue-6.1/bluetooth-l2cap-fix-possible-multiple-reject-send.patch
@@ -0,0 +1,42 @@
+From 77ade50087055dc3cc9a23b2659fda2fc43d6b0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 09:10:22 +0100
+Subject: Bluetooth: L2CAP: Fix possible multiple reject send
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Frédéric Danis <frederic.danis@collabora.com>
+
+[ Upstream commit 96a3398b467ab8aada3df2f3a79f4b7835d068b8 ]
+
+In case of an incomplete command or a command with a null identifier 2
+reject packets will be sent, one with the identifier and one with 0.
+Consuming the data of the command will prevent it.
+This allows to send a reject packet for each corrupted command in a
+multi-command packet.
+
+Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/l2cap_core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index 4c5793053393..81f5974e5eb5 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -6527,7 +6527,8 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn,
+ 		if (len > skb->len || !cmd->ident) {
+ 			BT_DBG("corrupted command");
+ 			l2cap_sig_send_rej(conn, cmd->ident);
+-			break;
++			skb_pull(skb, len > skb->len ? skb->len : len);
++			continue;
+ 		}
+ 
+ 		err = l2cap_bredr_sig_cmd(conn, cmd, len, skb->data);
+-- 
+2.43.0
+
diff --git a/queue-6.1/bluetooth-qca-set-both-wideband_speech-and-le_states.patch b/queue-6.1/bluetooth-qca-set-both-wideband_speech-and-le_states.patch
new file mode 100644
index 00000000000..fdc948ff9d8
--- /dev/null
+++ b/queue-6.1/bluetooth-qca-set-both-wideband_speech-and-le_states.patch
@@ -0,0 +1,35 @@
+From 55014001d29c9dead5ea15f83e34cf00c54e4222 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 14:02:46 +0800
+Subject: Bluetooth: qca: Set both WIDEBAND_SPEECH and LE_STATES quirks for
+ QCA2066
+
+From: Zijun Hu <quic_zijuhu@quicinc.com>
+
+[ Upstream commit 5d192b697c7417254cdd9edc3d5e9e0364eb9045 ]
+
+Set both WIDEBAND_SPEECH_SUPPORTED and VALID_LE_STATES quirks
+for QCA2066.
+
+Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_qca.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
+index 45dffd2cbc71..76ceb8a0183d 100644
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -1861,6 +1861,7 @@ static const struct qca_device_data qca_soc_data_wcn3998 = {
+ static const struct qca_device_data qca_soc_data_qca6390 = {
+ 	.soc_type = QCA_QCA6390,
+ 	.num_vregs = 0,
++	.capabilities = QCA_CAP_WIDEBAND_SPEECH | QCA_CAP_VALID_LE_STATES,
+ };
+ 
+ static const struct qca_device_data qca_soc_data_wcn6750 = {
+-- 
+2.43.0
+
diff --git a/queue-6.1/bonding-return-enomem-instead-of-bug-in-alb_upper_de.patch b/queue-6.1/bonding-return-enomem-instead-of-bug-in-alb_upper_de.patch
new file mode 100644
index 00000000000..4614781e84a
--- /dev/null
+++ b/queue-6.1/bonding-return-enomem-instead-of-bug-in-alb_upper_de.patch
@@ -0,0 +1,69 @@
+From 1868c13636a3566cd9042c0fc4ec70538f58fcee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Nov 2023 16:16:53 +0800
+Subject: bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
+
+From: Zhengchao Shao <shaozhengchao@huawei.com>
+
+[ Upstream commit d6b83f1e3707c4d60acfa58afd3515e17e5d5384 ]
+
+If failed to allocate "tags" or could not find the final upper device from
+start_dev's upper list in bond_verify_device_path(), only the loopback
+detection of the current upper device should be affected, and the system is
+no need to be panic.
+So return -ENOMEM in alb_upper_dev_walk to stop walking, print some warn
+information when failed to allocate memory for vlan tags in
+bond_verify_device_path.
+
+I also think that the following function calls
+netdev_walk_all_upper_dev_rcu
+---->>>alb_upper_dev_walk
+---------->>>bond_verify_device_path
+From this way, "end device" can eventually be obtained from "start device"
+in bond_verify_device_path, IS_ERR(tags) could be instead of
+IS_ERR_OR_NULL(tags) in alb_upper_dev_walk.
+
+Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
+Acked-by: Jay Vosburgh <jay.vosburgh@canonical.com>
+Link: https://lore.kernel.org/r/20231118081653.1481260-1-shaozhengchao@huawei.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/bonding/bond_alb.c  | 3 ++-
+ drivers/net/bonding/bond_main.c | 5 ++++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
+index fc5da5d7744d..9c4c2c7d90ef 100644
+--- a/drivers/net/bonding/bond_alb.c
++++ b/drivers/net/bonding/bond_alb.c
+@@ -985,7 +985,8 @@ static int alb_upper_dev_walk(struct net_device *upper,
+ 	if (netif_is_macvlan(upper) && !strict_match) {
+ 		tags = bond_verify_device_path(bond->dev, upper, 0);
+ 		if (IS_ERR_OR_NULL(tags))
+-			BUG();
++			return -ENOMEM;
++
+ 		alb_send_lp_vid(slave, upper->dev_addr,
+ 				tags[0].vlan_proto, tags[0].vlan_id);
+ 		kfree(tags);
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 710734a5af9b..2b333a62ba81 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -2943,8 +2943,11 @@ struct bond_vlan_tag *bond_verify_device_path(struct net_device *start_dev,
+ 
+ 	if (start_dev == end_dev) {
+ 		tags = kcalloc(level + 1, sizeof(*tags), GFP_ATOMIC);
+-		if (!tags)
++		if (!tags) {
++			net_err_ratelimited("%s: %s: Failed to allocate tags\n",
++					    __func__, start_dev->name);
+ 			return ERR_PTR(-ENOMEM);
++		}
+ 		tags[level].vlan_proto = VLAN_N_VID;
+ 		return tags;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.1/bpf-check-rcu_read_lock_trace_held-before-calling-bp.patch b/queue-6.1/bpf-check-rcu_read_lock_trace_held-before-calling-bp.patch
new file mode 100644
index 00000000000..9accb357741
--- /dev/null
+++ b/queue-6.1/bpf-check-rcu_read_lock_trace_held-before-calling-bp.patch
@@ -0,0 +1,95 @@
+From 47cf9f0314dabf112a0d291a8e40ab4ed731eac8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 22:04:19 +0800
+Subject: bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit 169410eba271afc9f0fb476d996795aa26770c6d ]
+
+These three bpf_map_{lookup,update,delete}_elem() helpers are also
+available for sleepable bpf program, so add the corresponding lock
+assertion for sleepable bpf program, otherwise the following warning
+will be reported when a sleepable bpf program manipulates bpf map under
+interpreter mode (aka bpf_jit_enable=0):
+
+  WARNING: CPU: 3 PID: 4985 at kernel/bpf/helpers.c:40 ......
+  CPU: 3 PID: 4985 Comm: test_progs Not tainted 6.6.0+ #2
+  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ......
+  RIP: 0010:bpf_map_lookup_elem+0x54/0x60
+  ......
+  Call Trace:
+   <TASK>
+   ? __warn+0xa5/0x240
+   ? bpf_map_lookup_elem+0x54/0x60
+   ? report_bug+0x1ba/0x1f0
+   ? handle_bug+0x40/0x80
+   ? exc_invalid_op+0x18/0x50
+   ? asm_exc_invalid_op+0x1b/0x20
+   ? __pfx_bpf_map_lookup_elem+0x10/0x10
+   ? rcu_lockdep_current_cpu_online+0x65/0xb0
+   ? rcu_is_watching+0x23/0x50
+   ? bpf_map_lookup_elem+0x54/0x60
+   ? __pfx_bpf_map_lookup_elem+0x10/0x10
+   ___bpf_prog_run+0x513/0x3b70
+   __bpf_prog_run32+0x9d/0xd0
+   ? __bpf_prog_enter_sleepable_recur+0xad/0x120
+   ? __bpf_prog_enter_sleepable_recur+0x3e/0x120
+   bpf_trampoline_6442580665+0x4d/0x1000
+   __x64_sys_getpgid+0x5/0x30
+   ? do_syscall_64+0x36/0xb0
+   entry_SYSCALL_64_after_hwframe+0x6e/0x76
+   </TASK>
+
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Link: https://lore.kernel.org/r/20231204140425.1480317-2-houtao@huaweicloud.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/helpers.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
+index 6212e4ae084b..34135fbd6097 100644
+--- a/kernel/bpf/helpers.c
++++ b/kernel/bpf/helpers.c
+@@ -28,12 +28,13 @@
+  *
+  * Different map implementations will rely on rcu in map methods
+  * lookup/update/delete, therefore eBPF programs must run under rcu lock
+- * if program is allowed to access maps, so check rcu_read_lock_held in
+- * all three functions.
++ * if program is allowed to access maps, so check rcu_read_lock_held() or
++ * rcu_read_lock_trace_held() in all three functions.
+  */
+ BPF_CALL_2(bpf_map_lookup_elem, struct bpf_map *, map, void *, key)
+ {
+-	WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_bh_held());
++	WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_trace_held() &&
++		     !rcu_read_lock_bh_held());
+ 	return (unsigned long) map->ops->map_lookup_elem(map, key);
+ }
+ 
+@@ -49,7 +50,8 @@ const struct bpf_func_proto bpf_map_lookup_elem_proto = {
+ BPF_CALL_4(bpf_map_update_elem, struct bpf_map *, map, void *, key,
+ 	   void *, value, u64, flags)
+ {
+-	WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_bh_held());
++	WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_trace_held() &&
++		     !rcu_read_lock_bh_held());
+ 	return map->ops->map_update_elem(map, key, value, flags);
+ }
+ 
+@@ -66,7 +68,8 @@ const struct bpf_func_proto bpf_map_update_elem_proto = {
+ 
+ BPF_CALL_2(bpf_map_delete_elem, struct bpf_map *, map, void *, key)
+ {
+-	WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_bh_held());
++	WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_trace_held() &&
++		     !rcu_read_lock_bh_held());
+ 	return map->ops->map_delete_elem(map, key);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/bpf-set-uattr-batch.count-as-zero-before-batched-upd.patch b/queue-6.1/bpf-set-uattr-batch.count-as-zero-before-batched-upd.patch
new file mode 100644
index 00000000000..644dd773ab9
--- /dev/null
+++ b/queue-6.1/bpf-set-uattr-batch.count-as-zero-before-batched-upd.patch
@@ -0,0 +1,51 @@
+From d7ccf12aab62dd0cc9c785cf1148b45329adabf7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Dec 2023 18:23:53 +0800
+Subject: bpf: Set uattr->batch.count as zero before batched update or deletion
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit 06e5c999f10269a532304e89a6adb2fbfeb0593c ]
+
+generic_map_{delete,update}_batch() doesn't set uattr->batch.count as
+zero before it tries to allocate memory for key. If the memory
+allocation fails, the value of uattr->batch.count will be incorrect.
+
+Fix it by setting uattr->batch.count as zero beore batched update or
+deletion.
+
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Link: https://lore.kernel.org/r/20231208102355.2628918-6-houtao@huaweicloud.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/syscall.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 8d0c38a8dcf2..1e46a84694b8 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -1598,6 +1598,9 @@ int generic_map_delete_batch(struct bpf_map *map,
+ 	if (!max_count)
+ 		return 0;
+ 
++	if (put_user(0, &uattr->batch.count))
++		return -EFAULT;
++
+ 	key = kvmalloc(map->key_size, GFP_USER | __GFP_NOWARN);
+ 	if (!key)
+ 		return -ENOMEM;
+@@ -1657,6 +1660,9 @@ int generic_map_update_batch(struct bpf_map *map,
+ 	if (!max_count)
+ 		return 0;
+ 
++	if (put_user(0, &uattr->batch.count))
++		return -EFAULT;
++
+ 	key = kvmalloc(map->key_size, GFP_USER | __GFP_NOWARN);
+ 	if (!key)
+ 		return -ENOMEM;
+-- 
+2.43.0
+
diff --git a/queue-6.1/bridge-cfm-fix-enum-typo-in-br_cc_ccm_tx_parse.patch b/queue-6.1/bridge-cfm-fix-enum-typo-in-br_cc_ccm_tx_parse.patch
new file mode 100644
index 00000000000..0b8ca05339a
--- /dev/null
+++ b/queue-6.1/bridge-cfm-fix-enum-typo-in-br_cc_ccm_tx_parse.patch
@@ -0,0 +1,46 @@
+From 8ae5e2670cbfd5bee28f95f606c69426851e354f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Dec 2023 00:34:51 +0800
+Subject: bridge: cfm: fix enum typo in br_cc_ccm_tx_parse
+
+From: Lin Ma <linma@zju.edu.cn>
+
+[ Upstream commit c2b2ee36250d967c21890cb801e24af4b6a9eaa5 ]
+
+It appears that there is a typo in the code where the nlattr array is
+being parsed with policy br_cfm_cc_ccm_tx_policy, but the instance is
+being accessed via IFLA_BRIDGE_CFM_CC_RDI_INSTANCE, which is associated
+with the policy br_cfm_cc_rdi_policy.
+
+This problem was introduced by commit 2be665c3940d ("bridge: cfm: Netlink
+SET configuration Interface.").
+
+Though it seems like a harmless typo since these two enum owns the exact
+same value (1 here), it is quite misleading hence fix it by using the
+correct enum IFLA_BRIDGE_CFM_CC_CCM_TX_INSTANCE here.
+
+Signed-off-by: Lin Ma <linma@zju.edu.cn>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_cfm_netlink.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bridge/br_cfm_netlink.c b/net/bridge/br_cfm_netlink.c
+index 5c4c369f8536..2faab44652e7 100644
+--- a/net/bridge/br_cfm_netlink.c
++++ b/net/bridge/br_cfm_netlink.c
+@@ -362,7 +362,7 @@ static int br_cc_ccm_tx_parse(struct net_bridge *br, struct nlattr *attr,
+ 
+ 	memset(&tx_info, 0, sizeof(tx_info));
+ 
+-	instance = nla_get_u32(tb[IFLA_BRIDGE_CFM_CC_RDI_INSTANCE]);
++	instance = nla_get_u32(tb[IFLA_BRIDGE_CFM_CC_CCM_TX_INSTANCE]);
+ 	nla_memcpy(&tx_info.dmac.addr,
+ 		   tb[IFLA_BRIDGE_CFM_CC_CCM_TX_DMAC],
+ 		   sizeof(tx_info.dmac.addr));
+-- 
+2.43.0
+
diff --git a/queue-6.1/ceph-fix-deadlock-or-deadcode-of-misusing-dget.patch b/queue-6.1/ceph-fix-deadlock-or-deadcode-of-misusing-dget.patch
new file mode 100644
index 00000000000..9a0aadc22de
--- /dev/null
+++ b/queue-6.1/ceph-fix-deadlock-or-deadcode-of-misusing-dget.patch
@@ -0,0 +1,63 @@
+From 5ebe6fc731d0572cee302706028a953c2304a03c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Nov 2023 13:26:18 +0800
+Subject: ceph: fix deadlock or deadcode of misusing dget()
+
+From: Xiubo Li <xiubli@redhat.com>
+
+[ Upstream commit b493ad718b1f0357394d2cdecbf00a44a36fa085 ]
+
+The lock order is incorrect between denty and its parent, we should
+always make sure that the parent get the lock first.
+
+But since this deadcode is never used and the parent dir will always
+be set from the callers, let's just remove it.
+
+Link: https://lore.kernel.org/r/20231116081919.GZ1957730@ZenIV
+Reported-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Xiubo Li <xiubli@redhat.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/caps.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
+index 36052a362683..111938a6307e 100644
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -4597,12 +4597,14 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry,
+ 			       struct inode *dir,
+ 			       int mds, int drop, int unless)
+ {
+-	struct dentry *parent = NULL;
+ 	struct ceph_mds_request_release *rel = *p;
+ 	struct ceph_dentry_info *di = ceph_dentry(dentry);
+ 	int force = 0;
+ 	int ret;
+ 
++	/* This shouldn't happen */
++	BUG_ON(!dir);
++
+ 	/*
+ 	 * force an record for the directory caps if we have a dentry lease.
+ 	 * this is racy (can't take i_ceph_lock and d_lock together), but it
+@@ -4612,14 +4614,9 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry,
+ 	spin_lock(&dentry->d_lock);
+ 	if (di->lease_session && di->lease_session->s_mds == mds)
+ 		force = 1;
+-	if (!dir) {
+-		parent = dget(dentry->d_parent);
+-		dir = d_inode(parent);
+-	}
+ 	spin_unlock(&dentry->d_lock);
+ 
+ 	ret = ceph_encode_inode_release(p, dir, mds, drop, unless, force);
+-	dput(parent);
+ 
+ 	spin_lock(&dentry->d_lock);
+ 	if (ret && di->lease_session && di->lease_session->s_mds == mds) {
+-- 
+2.43.0
+
diff --git a/queue-6.1/ceph-fix-invalid-pointer-access-if-get_quota_realm-r.patch b/queue-6.1/ceph-fix-invalid-pointer-access-if-get_quota_realm-r.patch
new file mode 100644
index 00000000000..a223fc1646d
--- /dev/null
+++ b/queue-6.1/ceph-fix-invalid-pointer-access-if-get_quota_realm-r.patch
@@ -0,0 +1,138 @@
+From c070c7783e4dd17fe589e394c69cf01188eddb8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Nov 2023 09:53:40 +0800
+Subject: ceph: fix invalid pointer access if get_quota_realm return ERR_PTR
+
+From: Wenchao Hao <haowenchao2@huawei.com>
+
+[ Upstream commit 0f4cf64eabc6e16cfc2704f1960e82dc79d91c8d ]
+
+This issue is reported by smatch that get_quota_realm() might return
+ERR_PTR but we did not handle it. It's not a immediate bug, while we
+still should address it to avoid potential bugs if get_quota_realm()
+is changed to return other ERR_PTR in future.
+
+Set ceph_snap_realm's pointer in get_quota_realm()'s to address this
+issue, the pointer would be set to NULL if get_quota_realm() failed
+to get struct ceph_snap_realm, so no ERR_PTR would happen any more.
+
+[ xiubli: minor code style clean up ]
+
+Signed-off-by: Wenchao Hao <haowenchao2@huawei.com>
+Reviewed-by: Xiubo Li <xiubli@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/quota.c | 39 ++++++++++++++++++++++-----------------
+ 1 file changed, 22 insertions(+), 17 deletions(-)
+
+diff --git a/fs/ceph/quota.c b/fs/ceph/quota.c
+index f7fcf7f08ec6..ca4932e6f71b 100644
+--- a/fs/ceph/quota.c
++++ b/fs/ceph/quota.c
+@@ -194,10 +194,10 @@ void ceph_cleanup_quotarealms_inodes(struct ceph_mds_client *mdsc)
+ }
+ 
+ /*
+- * This function walks through the snaprealm for an inode and returns the
+- * ceph_snap_realm for the first snaprealm that has quotas set (max_files,
++ * This function walks through the snaprealm for an inode and set the
++ * realmp with the first snaprealm that has quotas set (max_files,
+  * max_bytes, or any, depending on the 'which_quota' argument).  If the root is
+- * reached, return the root ceph_snap_realm instead.
++ * reached, set the realmp with the root ceph_snap_realm instead.
+  *
+  * Note that the caller is responsible for calling ceph_put_snap_realm() on the
+  * returned realm.
+@@ -208,18 +208,19 @@ void ceph_cleanup_quotarealms_inodes(struct ceph_mds_client *mdsc)
+  * this function will return -EAGAIN; otherwise, the snaprealms walk-through
+  * will be restarted.
+  */
+-static struct ceph_snap_realm *get_quota_realm(struct ceph_mds_client *mdsc,
+-					       struct inode *inode,
+-					       enum quota_get_realm which_quota,
+-					       bool retry)
++static int get_quota_realm(struct ceph_mds_client *mdsc, struct inode *inode,
++			   enum quota_get_realm which_quota,
++			   struct ceph_snap_realm **realmp, bool retry)
+ {
+ 	struct ceph_inode_info *ci = NULL;
+ 	struct ceph_snap_realm *realm, *next;
+ 	struct inode *in;
+ 	bool has_quota;
+ 
++	if (realmp)
++		*realmp = NULL;
+ 	if (ceph_snap(inode) != CEPH_NOSNAP)
+-		return NULL;
++		return 0;
+ 
+ restart:
+ 	realm = ceph_inode(inode)->i_snap_realm;
+@@ -245,7 +246,7 @@ static struct ceph_snap_realm *get_quota_realm(struct ceph_mds_client *mdsc,
+ 				break;
+ 			ceph_put_snap_realm(mdsc, realm);
+ 			if (!retry)
+-				return ERR_PTR(-EAGAIN);
++				return -EAGAIN;
+ 			goto restart;
+ 		}
+ 
+@@ -254,8 +255,11 @@ static struct ceph_snap_realm *get_quota_realm(struct ceph_mds_client *mdsc,
+ 		iput(in);
+ 
+ 		next = realm->parent;
+-		if (has_quota || !next)
+-		       return realm;
++		if (has_quota || !next) {
++			if (realmp)
++				*realmp = realm;
++			return 0;
++		}
+ 
+ 		ceph_get_snap_realm(mdsc, next);
+ 		ceph_put_snap_realm(mdsc, realm);
+@@ -264,7 +268,7 @@ static struct ceph_snap_realm *get_quota_realm(struct ceph_mds_client *mdsc,
+ 	if (realm)
+ 		ceph_put_snap_realm(mdsc, realm);
+ 
+-	return NULL;
++	return 0;
+ }
+ 
+ bool ceph_quota_is_same_realm(struct inode *old, struct inode *new)
+@@ -272,6 +276,7 @@ bool ceph_quota_is_same_realm(struct inode *old, struct inode *new)
+ 	struct ceph_mds_client *mdsc = ceph_sb_to_mdsc(old->i_sb);
+ 	struct ceph_snap_realm *old_realm, *new_realm;
+ 	bool is_same;
++	int ret;
+ 
+ restart:
+ 	/*
+@@ -281,9 +286,9 @@ bool ceph_quota_is_same_realm(struct inode *old, struct inode *new)
+ 	 * dropped and we can then restart the whole operation.
+ 	 */
+ 	down_read(&mdsc->snap_rwsem);
+-	old_realm = get_quota_realm(mdsc, old, QUOTA_GET_ANY, true);
+-	new_realm = get_quota_realm(mdsc, new, QUOTA_GET_ANY, false);
+-	if (PTR_ERR(new_realm) == -EAGAIN) {
++	get_quota_realm(mdsc, old, QUOTA_GET_ANY, &old_realm, true);
++	ret = get_quota_realm(mdsc, new, QUOTA_GET_ANY, &new_realm, false);
++	if (ret == -EAGAIN) {
+ 		up_read(&mdsc->snap_rwsem);
+ 		if (old_realm)
+ 			ceph_put_snap_realm(mdsc, old_realm);
+@@ -485,8 +490,8 @@ bool ceph_quota_update_statfs(struct ceph_fs_client *fsc, struct kstatfs *buf)
+ 	bool is_updated = false;
+ 
+ 	down_read(&mdsc->snap_rwsem);
+-	realm = get_quota_realm(mdsc, d_inode(fsc->sb->s_root),
+-				QUOTA_GET_MAX_BYTES, true);
++	get_quota_realm(mdsc, d_inode(fsc->sb->s_root), QUOTA_GET_MAX_BYTES,
++			&realm, true);
+ 	up_read(&mdsc->snap_rwsem);
+ 	if (!realm)
+ 		return false;
+-- 
+2.43.0
+
diff --git a/queue-6.1/ceph-reinitialize-mds-feature-bit-even-when-session-.patch b/queue-6.1/ceph-reinitialize-mds-feature-bit-even-when-session-.patch
new file mode 100644
index 00000000000..67c75989d31
--- /dev/null
+++ b/queue-6.1/ceph-reinitialize-mds-feature-bit-even-when-session-.patch
@@ -0,0 +1,45 @@
+From f0e57381349d3950734192abe952071c48d93159 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 10:02:32 +0530
+Subject: ceph: reinitialize mds feature bit even when session in open
+
+From: Venky Shankar <vshankar@redhat.com>
+
+[ Upstream commit f48e0342a74d7770cdf1d11894bdc3b6d989b29e ]
+
+Following along the same lines as per the user-space fix. Right
+now this isn't really an issue with the ceph kernel driver because
+of the feature bit laginess, however, that can change over time
+(when the new snaprealm info type is ported to the kernel driver)
+and depending on the MDS version that's being upgraded can cause
+message decoding issues - so, fix that early on.
+
+Link: http://tracker.ceph.com/issues/63188
+Signed-off-by: Venky Shankar <vshankar@redhat.com>
+Reviewed-by: Xiubo Li <xiubli@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/mds_client.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index 82874be94524..da9fcf48ab6c 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -3650,11 +3650,11 @@ static void handle_session(struct ceph_mds_session *session,
+ 		if (session->s_state == CEPH_MDS_SESSION_RECONNECTING)
+ 			pr_info("mds%d reconnect success\n", session->s_mds);
+ 
++		session->s_features = features;
+ 		if (session->s_state == CEPH_MDS_SESSION_OPEN) {
+ 			pr_notice("mds%d is already opened\n", session->s_mds);
+ 		} else {
+ 			session->s_state = CEPH_MDS_SESSION_OPEN;
+-			session->s_features = features;
+ 			renewed_caps(mdsc, session, 0);
+ 			if (test_bit(CEPHFS_FEATURE_METRIC_COLLECT,
+ 				     &session->s_features))
+-- 
+2.43.0
+
diff --git a/queue-6.1/cfi-add-cfi_noseal.patch b/queue-6.1/cfi-add-cfi_noseal.patch
new file mode 100644
index 00000000000..ec91e1c4da0
--- /dev/null
+++ b/queue-6.1/cfi-add-cfi_noseal.patch
@@ -0,0 +1,58 @@
+From bfe2ec28ec2b6bdd08895cac43c9ec27104096ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Dec 2023 10:12:21 +0100
+Subject: cfi: Add CFI_NOSEAL()
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit e9d13b9d2f99ccf7afeab490d97eaa5ac9846598 ]
+
+Add a CFI_NOSEAL() helper to mark functions that need to retain their
+CFI information, despite not otherwise leaking their address.
+
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20231215092707.669401084@infradead.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/cfi.h | 5 +++++
+ include/linux/cfi.h        | 4 ++++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/arch/x86/include/asm/cfi.h b/arch/x86/include/asm/cfi.h
+index 58dacd90daef..67b010c224e4 100644
+--- a/arch/x86/include/asm/cfi.h
++++ b/arch/x86/include/asm/cfi.h
+@@ -9,6 +9,7 @@
+  */
+ 
+ #include <linux/cfi.h>
++#include <asm/ibt.h>
+ 
+ #ifdef CONFIG_CFI_CLANG
+ enum bug_trap_type handle_cfi_failure(struct pt_regs *regs);
+@@ -19,4 +20,8 @@ static inline enum bug_trap_type handle_cfi_failure(struct pt_regs *regs)
+ }
+ #endif /* CONFIG_CFI_CLANG */
+ 
++#if HAS_KERNEL_IBT == 1
++#define CFI_NOSEAL(x)	asm(IBT_NOSEAL(__stringify(x)))
++#endif
++
+ #endif /* _ASM_X86_CFI_H */
+diff --git a/include/linux/cfi.h b/include/linux/cfi.h
+index 5e134f4ce8b7..f2f722c5aedd 100644
+--- a/include/linux/cfi.h
++++ b/include/linux/cfi.h
+@@ -36,4 +36,8 @@ static inline void module_cfi_finalize(const Elf_Ehdr *hdr,
+ #endif /* CONFIG_ARCH_USES_CFI_TRAPS */
+ #endif /* CONFIG_MODULES */
+ 
++#ifndef CFI_NOSEAL
++#define CFI_NOSEAL(x)
++#endif
++
+ #endif /* _LINUX_CFI_H */
+-- 
+2.43.0
+
diff --git a/queue-6.1/clk-hi3620-fix-memory-leak-in-hi3620_mmc_clk_init.patch b/queue-6.1/clk-hi3620-fix-memory-leak-in-hi3620_mmc_clk_init.patch
new file mode 100644
index 00000000000..3900b9efb30
--- /dev/null
+++ b/queue-6.1/clk-hi3620-fix-memory-leak-in-hi3620_mmc_clk_init.patch
@@ -0,0 +1,41 @@
+From 811086ebcbb02a7e2a447062e35dcea63ddb37d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Dec 2023 00:50:40 +0800
+Subject: clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()
+
+From: Kuan-Wei Chiu <visitorckw@gmail.com>
+
+[ Upstream commit bfbea9e5667cfa9552c3d88f023386f017f6c308 ]
+
+In cases where kcalloc() fails for the 'clk_data->clks' allocation, the
+code path does not handle the failure gracefully, potentially leading
+to a memory leak. This fix ensures proper cleanup by freeing the
+allocated memory for 'clk_data' before returning.
+
+Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
+Link: https://lore.kernel.org/r/20231210165040.3407545-1-visitorckw@gmail.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/hisilicon/clk-hi3620.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/hisilicon/clk-hi3620.c b/drivers/clk/hisilicon/clk-hi3620.c
+index a3d04c7c3da8..eb9c139babc3 100644
+--- a/drivers/clk/hisilicon/clk-hi3620.c
++++ b/drivers/clk/hisilicon/clk-hi3620.c
+@@ -467,8 +467,10 @@ static void __init hi3620_mmc_clk_init(struct device_node *node)
+ 		return;
+ 
+ 	clk_data->clks = kcalloc(num, sizeof(*clk_data->clks), GFP_KERNEL);
+-	if (!clk_data->clks)
++	if (!clk_data->clks) {
++		kfree(clk_data);
+ 		return;
++	}
+ 
+ 	for (i = 0; i < num; i++) {
+ 		struct hisi_mmc_clock *mmc_clk = &hi3620_mmc_clks[i];
+-- 
+2.43.0
+
diff --git a/queue-6.1/clk-imx-clk-imx8qxp-fix-lvds-bypass-pixel-and-phy-cl.patch b/queue-6.1/clk-imx-clk-imx8qxp-fix-lvds-bypass-pixel-and-phy-cl.patch
new file mode 100644
index 00000000000..a758dfac56f
--- /dev/null
+++ b/queue-6.1/clk-imx-clk-imx8qxp-fix-lvds-bypass-pixel-and-phy-cl.patch
@@ -0,0 +1,77 @@
+From 22de35ca556040a12176847a732e2980aeee90ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 13:24:07 +0100
+Subject: clk: imx: clk-imx8qxp: fix LVDS bypass, pixel and phy clocks
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 3f5f63adeea7e7aa715e101ffe4b4ac9705f9664 ]
+
+To be compatible with SCU firmware based on 1.15 a different clock
+routing for LVDS is needed.
+
+Signed-off-by: Oliver F. Brown <oliver.brown@oss.nxp.com>
+Signed-off-by: Ranjani Vaidyanathan <ranjani.vaidyanathan@nxp.com>
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20231218122407.2757175-1-alexander.stein@ew.tq-group.com/
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx8qxp.c | 24 ++++++++++++++++++++----
+ 1 file changed, 20 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clk/imx/clk-imx8qxp.c b/drivers/clk/imx/clk-imx8qxp.c
+index 273de1f29307..1066ea16de62 100644
+--- a/drivers/clk/imx/clk-imx8qxp.c
++++ b/drivers/clk/imx/clk-imx8qxp.c
+@@ -67,6 +67,22 @@ static const char * const lcd_pxl_sels[] = {
+ 	"lcd_pxl_bypass_div_clk",
+ };
+ 
++static const char *const lvds0_sels[] = {
++	"clk_dummy",
++	"clk_dummy",
++	"clk_dummy",
++	"clk_dummy",
++	"mipi0_lvds_bypass_clk",
++};
++
++static const char *const lvds1_sels[] = {
++	"clk_dummy",
++	"clk_dummy",
++	"clk_dummy",
++	"clk_dummy",
++	"mipi1_lvds_bypass_clk",
++};
++
+ static const char * const mipi_sels[] = {
+ 	"clk_dummy",
+ 	"clk_dummy",
+@@ -201,9 +217,9 @@ static int imx8qxp_clk_probe(struct platform_device *pdev)
+ 	/* MIPI-LVDS SS */
+ 	imx_clk_scu("mipi0_bypass_clk", IMX_SC_R_MIPI_0, IMX_SC_PM_CLK_BYPASS);
+ 	imx_clk_scu("mipi0_pixel_clk", IMX_SC_R_MIPI_0, IMX_SC_PM_CLK_PER);
+-	imx_clk_scu("mipi0_lvds_pixel_clk", IMX_SC_R_LVDS_0, IMX_SC_PM_CLK_MISC2);
+ 	imx_clk_scu("mipi0_lvds_bypass_clk", IMX_SC_R_LVDS_0, IMX_SC_PM_CLK_BYPASS);
+-	imx_clk_scu("mipi0_lvds_phy_clk", IMX_SC_R_LVDS_0, IMX_SC_PM_CLK_MISC3);
++	imx_clk_scu2("mipi0_lvds_pixel_clk", lvds0_sels, ARRAY_SIZE(lvds0_sels), IMX_SC_R_LVDS_0, IMX_SC_PM_CLK_MISC2);
++	imx_clk_scu2("mipi0_lvds_phy_clk", lvds0_sels, ARRAY_SIZE(lvds0_sels), IMX_SC_R_LVDS_0, IMX_SC_PM_CLK_MISC3);
+ 	imx_clk_scu2("mipi0_dsi_tx_esc_clk", mipi_sels, ARRAY_SIZE(mipi_sels), IMX_SC_R_MIPI_0, IMX_SC_PM_CLK_MST_BUS);
+ 	imx_clk_scu2("mipi0_dsi_rx_esc_clk", mipi_sels, ARRAY_SIZE(mipi_sels), IMX_SC_R_MIPI_0, IMX_SC_PM_CLK_SLV_BUS);
+ 	imx_clk_scu2("mipi0_dsi_phy_clk", mipi_sels, ARRAY_SIZE(mipi_sels), IMX_SC_R_MIPI_0, IMX_SC_PM_CLK_PHY);
+@@ -213,9 +229,9 @@ static int imx8qxp_clk_probe(struct platform_device *pdev)
+ 
+ 	imx_clk_scu("mipi1_bypass_clk", IMX_SC_R_MIPI_1, IMX_SC_PM_CLK_BYPASS);
+ 	imx_clk_scu("mipi1_pixel_clk", IMX_SC_R_MIPI_1, IMX_SC_PM_CLK_PER);
+-	imx_clk_scu("mipi1_lvds_pixel_clk", IMX_SC_R_LVDS_1, IMX_SC_PM_CLK_MISC2);
+ 	imx_clk_scu("mipi1_lvds_bypass_clk", IMX_SC_R_LVDS_1, IMX_SC_PM_CLK_BYPASS);
+-	imx_clk_scu("mipi1_lvds_phy_clk", IMX_SC_R_LVDS_1, IMX_SC_PM_CLK_MISC3);
++	imx_clk_scu2("mipi1_lvds_pixel_clk", lvds1_sels, ARRAY_SIZE(lvds1_sels), IMX_SC_R_LVDS_1, IMX_SC_PM_CLK_MISC2);
++	imx_clk_scu2("mipi1_lvds_phy_clk", lvds1_sels, ARRAY_SIZE(lvds1_sels), IMX_SC_R_LVDS_1, IMX_SC_PM_CLK_MISC3);
+ 
+ 	imx_clk_scu2("mipi1_dsi_tx_esc_clk", mipi_sels, ARRAY_SIZE(mipi_sels), IMX_SC_R_MIPI_1, IMX_SC_PM_CLK_MST_BUS);
+ 	imx_clk_scu2("mipi1_dsi_rx_esc_clk", mipi_sels, ARRAY_SIZE(mipi_sels), IMX_SC_R_MIPI_1, IMX_SC_PM_CLK_SLV_BUS);
+-- 
+2.43.0
+
diff --git a/queue-6.1/clk-mmp-pxa168-fix-memory-leak-in-pxa168_clk_init.patch b/queue-6.1/clk-mmp-pxa168-fix-memory-leak-in-pxa168_clk_init.patch
new file mode 100644
index 00000000000..d04090812c9
--- /dev/null
+++ b/queue-6.1/clk-mmp-pxa168-fix-memory-leak-in-pxa168_clk_init.patch
@@ -0,0 +1,51 @@
+From f0e58a7c65d09c698911db1e811354e99e9891d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Dec 2023 01:52:32 +0800
+Subject: clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()
+
+From: Kuan-Wei Chiu <visitorckw@gmail.com>
+
+[ Upstream commit 2fbabea626b6467eb4e6c4cb7a16523da12e43b4 ]
+
+In cases where mapping of mpmu/apmu/apbc registers fails, the code path
+does not handle the failure gracefully, potentially leading to a memory
+leak. This fix ensures proper cleanup by freeing the allocated memory
+for 'pxa_unit' before returning.
+
+Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
+Link: https://lore.kernel.org/r/20231210175232.3414584-1-visitorckw@gmail.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mmp/clk-of-pxa168.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/clk/mmp/clk-of-pxa168.c b/drivers/clk/mmp/clk-of-pxa168.c
+index 130d1a723879..cb0ebbd82038 100644
+--- a/drivers/clk/mmp/clk-of-pxa168.c
++++ b/drivers/clk/mmp/clk-of-pxa168.c
+@@ -306,18 +306,21 @@ static void __init pxa168_clk_init(struct device_node *np)
+ 	pxa_unit->mpmu_base = of_iomap(np, 0);
+ 	if (!pxa_unit->mpmu_base) {
+ 		pr_err("failed to map mpmu registers\n");
++		kfree(pxa_unit);
+ 		return;
+ 	}
+ 
+ 	pxa_unit->apmu_base = of_iomap(np, 1);
+ 	if (!pxa_unit->apmu_base) {
+ 		pr_err("failed to map apmu registers\n");
++		kfree(pxa_unit);
+ 		return;
+ 	}
+ 
+ 	pxa_unit->apbc_base = of_iomap(np, 2);
+ 	if (!pxa_unit->apbc_base) {
+ 		pr_err("failed to map apbc registers\n");
++		kfree(pxa_unit);
+ 		return;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-octeontx2-fix-cptvf-driver-cleanup.patch b/queue-6.1/crypto-octeontx2-fix-cptvf-driver-cleanup.patch
new file mode 100644
index 00000000000..3d0400d25cb
--- /dev/null
+++ b/queue-6.1/crypto-octeontx2-fix-cptvf-driver-cleanup.patch
@@ -0,0 +1,71 @@
+From e26d413ebd89689250a9ccd0b39c86092c6b02ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Dec 2023 15:59:11 +0530
+Subject: crypto: octeontx2 - Fix cptvf driver cleanup
+
+From: Bharat Bhushan <bbhushan2@marvell.com>
+
+[ Upstream commit c480a421a4faf693c38e60b0fe6e554c9a3fee02 ]
+
+This patch fixes following cleanup issues:
+ - Missing instruction queue free on cleanup. This
+   will lead to memory leak.
+ - lfs->lfs_num is set to zero before cleanup, which
+   will lead to improper cleanup.
+
+Signed-off-by: Bharat Bhushan <bbhushan2@marvell.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/marvell/octeontx2/otx2_cptlf.c      | 6 ++++--
+ drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c | 3 +++
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptlf.c b/drivers/crypto/marvell/octeontx2/otx2_cptlf.c
+index 71e5f79431af..6e4a78e1f3ce 100644
+--- a/drivers/crypto/marvell/octeontx2/otx2_cptlf.c
++++ b/drivers/crypto/marvell/octeontx2/otx2_cptlf.c
+@@ -419,8 +419,8 @@ int otx2_cptlf_init(struct otx2_cptlfs_info *lfs, u8 eng_grp_mask, int pri,
+ 	return 0;
+ 
+ free_iq:
+-	otx2_cpt_free_instruction_queues(lfs);
+ 	cptlf_hw_cleanup(lfs);
++	otx2_cpt_free_instruction_queues(lfs);
+ detach_rsrcs:
+ 	otx2_cpt_detach_rsrcs_msg(lfs);
+ clear_lfs_num:
+@@ -431,11 +431,13 @@ EXPORT_SYMBOL_NS_GPL(otx2_cptlf_init, CRYPTO_DEV_OCTEONTX2_CPT);
+ 
+ void otx2_cptlf_shutdown(struct otx2_cptlfs_info *lfs)
+ {
+-	lfs->lfs_num = 0;
+ 	/* Cleanup LFs hardware side */
+ 	cptlf_hw_cleanup(lfs);
++	/* Free instruction queues */
++	otx2_cpt_free_instruction_queues(lfs);
+ 	/* Send request to detach LFs */
+ 	otx2_cpt_detach_rsrcs_msg(lfs);
++	lfs->lfs_num = 0;
+ }
+ EXPORT_SYMBOL_NS_GPL(otx2_cptlf_shutdown, CRYPTO_DEV_OCTEONTX2_CPT);
+ 
+diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c b/drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c
+index 392e9fee05e8..6f3373f9928c 100644
+--- a/drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c
++++ b/drivers/crypto/marvell/octeontx2/otx2_cptvf_main.c
+@@ -249,8 +249,11 @@ static void cptvf_lf_shutdown(struct otx2_cptlfs_info *lfs)
+ 	otx2_cptlf_unregister_interrupts(lfs);
+ 	/* Cleanup LFs software side */
+ 	lf_sw_cleanup(lfs);
++	/* Free instruction queues */
++	otx2_cpt_free_instruction_queues(lfs);
+ 	/* Send request to detach LFs */
+ 	otx2_cpt_detach_rsrcs_msg(lfs);
++	lfs->lfs_num = 0;
+ }
+ 
+ static int cptvf_lf_init(struct otx2_cptvf_dev *cptvf)
+-- 
+2.43.0
+
diff --git a/queue-6.1/crypto-stm32-crc32-fix-parsing-list-of-devices.patch b/queue-6.1/crypto-stm32-crc32-fix-parsing-list-of-devices.patch
new file mode 100644
index 00000000000..9b3fa465305
--- /dev/null
+++ b/queue-6.1/crypto-stm32-crc32-fix-parsing-list-of-devices.patch
@@ -0,0 +1,46 @@
+From ffcaaee4da4d7d26526878c3a197fcbfb9e9f40a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Dec 2023 12:17:24 +0100
+Subject: crypto: stm32/crc32 - fix parsing list of devices
+
+From: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
+
+[ Upstream commit 0eaef675b94c746900dcea7f6c41b9a103ed5d53 ]
+
+smatch warnings:
+drivers/crypto/stm32/stm32-crc32.c:108 stm32_crc_get_next_crc() warn:
+can 'crc' even be NULL?
+
+Use list_first_entry_or_null instead of list_first_entry to retrieve
+the first device registered.
+The function list_first_entry always return a non NULL pointer even if
+the list is empty. Hence checking if the pointer returned is NULL does
+not tell if the list is empty or not.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/r/202311281111.ou2oUL2i-lkp@intel.com/
+Reported-by: Dan Carpenter <error27@gmail.com>
+Closes: https://lore.kernel.org/r/202311281111.ou2oUL2i-lkp@intel.com/
+Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/stm32/stm32-crc32.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/stm32/stm32-crc32.c b/drivers/crypto/stm32/stm32-crc32.c
+index 90a920e7f664..c439be1650c8 100644
+--- a/drivers/crypto/stm32/stm32-crc32.c
++++ b/drivers/crypto/stm32/stm32-crc32.c
+@@ -104,7 +104,7 @@ static struct stm32_crc *stm32_crc_get_next_crc(void)
+ 	struct stm32_crc *crc;
+ 
+ 	spin_lock_bh(&crc_list.lock);
+-	crc = list_first_entry(&crc_list.dev_list, struct stm32_crc, list);
++	crc = list_first_entry_or_null(&crc_list.dev_list, struct stm32_crc, list);
+ 	if (crc)
+ 		list_move_tail(&crc->list, &crc_list.dev_list);
+ 	spin_unlock_bh(&crc_list.lock);
+-- 
+2.43.0
+
diff --git a/queue-6.1/debugobjects-stop-accessing-objects-after-releasing-.patch b/queue-6.1/debugobjects-stop-accessing-objects-after-releasing-.patch
new file mode 100644
index 00000000000..18dd7adef10
--- /dev/null
+++ b/queue-6.1/debugobjects-stop-accessing-objects-after-releasing-.patch
@@ -0,0 +1,407 @@
+From 4f0e8984e740cb955945301b72cbc7cf5c10cc14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Oct 2023 23:39:07 +0200
+Subject: debugobjects: Stop accessing objects after releasing hash bucket lock
+
+From: Andrzej Hajda <andrzej.hajda@intel.com>
+
+[ Upstream commit 9bb6362652f3f4d74a87d572a91ee1b38e673ef6 ]
+
+After release of the hashbucket lock the tracking object can be modified or
+freed by a concurrent thread.  Using it in such a case is error prone, even
+for printing the object state:
+
+    1. T1 tries to deactivate destroyed object, debugobjects detects it,
+       hash bucket lock is released.
+
+    2. T2 preempts T1 and frees the tracking object.
+
+    3. The freed tracking object is allocated and initialized for a
+       different to be tracked kernel object.
+
+    4. T1 resumes and reports error for wrong kernel object.
+
+Create a local copy of the tracking object before releasing the hash bucket
+lock and use the local copy for reporting and fixups to prevent this.
+
+Signed-off-by: Andrzej Hajda <andrzej.hajda@intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20231025-debugobjects_fix-v3-1-2bc3bf7084c2@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/debugobjects.c | 200 ++++++++++++++++++---------------------------
+ 1 file changed, 78 insertions(+), 122 deletions(-)
+
+diff --git a/lib/debugobjects.c b/lib/debugobjects.c
+index dacb80c22c4f..5dfa582dbadd 100644
+--- a/lib/debugobjects.c
++++ b/lib/debugobjects.c
+@@ -609,9 +609,8 @@ static void debug_objects_fill_pool(void)
+ static void
+ __debug_object_init(void *addr, const struct debug_obj_descr *descr, int onstack)
+ {
+-	enum debug_obj_state state;
++	struct debug_obj *obj, o;
+ 	struct debug_bucket *db;
+-	struct debug_obj *obj;
+ 	unsigned long flags;
+ 
+ 	debug_objects_fill_pool();
+@@ -632,24 +631,18 @@ __debug_object_init(void *addr, const struct debug_obj_descr *descr, int onstack
+ 	case ODEBUG_STATE_INIT:
+ 	case ODEBUG_STATE_INACTIVE:
+ 		obj->state = ODEBUG_STATE_INIT;
+-		break;
+-
+-	case ODEBUG_STATE_ACTIVE:
+-		state = obj->state;
+-		raw_spin_unlock_irqrestore(&db->lock, flags);
+-		debug_print_object(obj, "init");
+-		debug_object_fixup(descr->fixup_init, addr, state);
+-		return;
+-
+-	case ODEBUG_STATE_DESTROYED:
+ 		raw_spin_unlock_irqrestore(&db->lock, flags);
+-		debug_print_object(obj, "init");
+ 		return;
+ 	default:
+ 		break;
+ 	}
+ 
++	o = *obj;
+ 	raw_spin_unlock_irqrestore(&db->lock, flags);
++	debug_print_object(&o, "init");
++
++	if (o.state == ODEBUG_STATE_ACTIVE)
++		debug_object_fixup(descr->fixup_init, addr, o.state);
+ }
+ 
+ /**
+@@ -690,11 +683,9 @@ EXPORT_SYMBOL_GPL(debug_object_init_on_stack);
+ int debug_object_activate(void *addr, const struct debug_obj_descr *descr)
+ {
+ 	struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr };
+-	enum debug_obj_state state;
+ 	struct debug_bucket *db;
+ 	struct debug_obj *obj;
+ 	unsigned long flags;
+-	int ret;
+ 
+ 	if (!debug_objects_enabled)
+ 		return 0;
+@@ -706,49 +697,38 @@ int debug_object_activate(void *addr, const struct debug_obj_descr *descr)
+ 	raw_spin_lock_irqsave(&db->lock, flags);
+ 
+ 	obj = lookup_object_or_alloc(addr, db, descr, false, true);
+-	if (likely(!IS_ERR_OR_NULL(obj))) {
+-		bool print_object = false;
+-
++	if (unlikely(!obj)) {
++		raw_spin_unlock_irqrestore(&db->lock, flags);
++		debug_objects_oom();
++		return 0;
++	} else if (likely(!IS_ERR(obj))) {
+ 		switch (obj->state) {
+-		case ODEBUG_STATE_INIT:
+-		case ODEBUG_STATE_INACTIVE:
+-			obj->state = ODEBUG_STATE_ACTIVE;
+-			ret = 0;
+-			break;
+-
+ 		case ODEBUG_STATE_ACTIVE:
+-			state = obj->state;
+-			raw_spin_unlock_irqrestore(&db->lock, flags);
+-			debug_print_object(obj, "activate");
+-			ret = debug_object_fixup(descr->fixup_activate, addr, state);
+-			return ret ? 0 : -EINVAL;
+-
+ 		case ODEBUG_STATE_DESTROYED:
+-			print_object = true;
+-			ret = -EINVAL;
++			o = *obj;
+ 			break;
++		case ODEBUG_STATE_INIT:
++		case ODEBUG_STATE_INACTIVE:
++			obj->state = ODEBUG_STATE_ACTIVE;
++			fallthrough;
+ 		default:
+-			ret = 0;
+-			break;
++			raw_spin_unlock_irqrestore(&db->lock, flags);
++			return 0;
+ 		}
+-		raw_spin_unlock_irqrestore(&db->lock, flags);
+-		if (print_object)
+-			debug_print_object(obj, "activate");
+-		return ret;
+ 	}
+ 
+ 	raw_spin_unlock_irqrestore(&db->lock, flags);
++	debug_print_object(&o, "activate");
+ 
+-	/* If NULL the allocation has hit OOM */
+-	if (!obj) {
+-		debug_objects_oom();
+-		return 0;
++	switch (o.state) {
++	case ODEBUG_STATE_ACTIVE:
++	case ODEBUG_STATE_NOTAVAILABLE:
++		if (debug_object_fixup(descr->fixup_activate, addr, o.state))
++			return 0;
++		fallthrough;
++	default:
++		return -EINVAL;
+ 	}
+-
+-	/* Object is neither static nor tracked. It's not initialized */
+-	debug_print_object(&o, "activate");
+-	ret = debug_object_fixup(descr->fixup_activate, addr, ODEBUG_STATE_NOTAVAILABLE);
+-	return ret ? 0 : -EINVAL;
+ }
+ EXPORT_SYMBOL_GPL(debug_object_activate);
+ 
+@@ -759,10 +739,10 @@ EXPORT_SYMBOL_GPL(debug_object_activate);
+  */
+ void debug_object_deactivate(void *addr, const struct debug_obj_descr *descr)
+ {
++	struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr };
+ 	struct debug_bucket *db;
+ 	struct debug_obj *obj;
+ 	unsigned long flags;
+-	bool print_object = false;
+ 
+ 	if (!debug_objects_enabled)
+ 		return;
+@@ -774,33 +754,24 @@ void debug_object_deactivate(void *addr, const struct debug_obj_descr *descr)
+ 	obj = lookup_object(addr, db);
+ 	if (obj) {
+ 		switch (obj->state) {
++		case ODEBUG_STATE_DESTROYED:
++			break;
+ 		case ODEBUG_STATE_INIT:
+ 		case ODEBUG_STATE_INACTIVE:
+ 		case ODEBUG_STATE_ACTIVE:
+-			if (!obj->astate)
+-				obj->state = ODEBUG_STATE_INACTIVE;
+-			else
+-				print_object = true;
+-			break;
+-
+-		case ODEBUG_STATE_DESTROYED:
+-			print_object = true;
+-			break;
++			if (obj->astate)
++				break;
++			obj->state = ODEBUG_STATE_INACTIVE;
++			fallthrough;
+ 		default:
+-			break;
++			raw_spin_unlock_irqrestore(&db->lock, flags);
++			return;
+ 		}
++		o = *obj;
+ 	}
+ 
+ 	raw_spin_unlock_irqrestore(&db->lock, flags);
+-	if (!obj) {
+-		struct debug_obj o = { .object = addr,
+-				       .state = ODEBUG_STATE_NOTAVAILABLE,
+-				       .descr = descr };
+-
+-		debug_print_object(&o, "deactivate");
+-	} else if (print_object) {
+-		debug_print_object(obj, "deactivate");
+-	}
++	debug_print_object(&o, "deactivate");
+ }
+ EXPORT_SYMBOL_GPL(debug_object_deactivate);
+ 
+@@ -811,11 +782,9 @@ EXPORT_SYMBOL_GPL(debug_object_deactivate);
+  */
+ void debug_object_destroy(void *addr, const struct debug_obj_descr *descr)
+ {
+-	enum debug_obj_state state;
++	struct debug_obj *obj, o;
+ 	struct debug_bucket *db;
+-	struct debug_obj *obj;
+ 	unsigned long flags;
+-	bool print_object = false;
+ 
+ 	if (!debug_objects_enabled)
+ 		return;
+@@ -825,32 +794,31 @@ void debug_object_destroy(void *addr, const struct debug_obj_descr *descr)
+ 	raw_spin_lock_irqsave(&db->lock, flags);
+ 
+ 	obj = lookup_object(addr, db);
+-	if (!obj)
+-		goto out_unlock;
++	if (!obj) {
++		raw_spin_unlock_irqrestore(&db->lock, flags);
++		return;
++	}
+ 
+ 	switch (obj->state) {
++	case ODEBUG_STATE_ACTIVE:
++	case ODEBUG_STATE_DESTROYED:
++		break;
+ 	case ODEBUG_STATE_NONE:
+ 	case ODEBUG_STATE_INIT:
+ 	case ODEBUG_STATE_INACTIVE:
+ 		obj->state = ODEBUG_STATE_DESTROYED;
+-		break;
+-	case ODEBUG_STATE_ACTIVE:
+-		state = obj->state;
++		fallthrough;
++	default:
+ 		raw_spin_unlock_irqrestore(&db->lock, flags);
+-		debug_print_object(obj, "destroy");
+-		debug_object_fixup(descr->fixup_destroy, addr, state);
+ 		return;
+-
+-	case ODEBUG_STATE_DESTROYED:
+-		print_object = true;
+-		break;
+-	default:
+-		break;
+ 	}
+-out_unlock:
++
++	o = *obj;
+ 	raw_spin_unlock_irqrestore(&db->lock, flags);
+-	if (print_object)
+-		debug_print_object(obj, "destroy");
++	debug_print_object(&o, "destroy");
++
++	if (o.state == ODEBUG_STATE_ACTIVE)
++		debug_object_fixup(descr->fixup_destroy, addr, o.state);
+ }
+ EXPORT_SYMBOL_GPL(debug_object_destroy);
+ 
+@@ -861,9 +829,8 @@ EXPORT_SYMBOL_GPL(debug_object_destroy);
+  */
+ void debug_object_free(void *addr, const struct debug_obj_descr *descr)
+ {
+-	enum debug_obj_state state;
++	struct debug_obj *obj, o;
+ 	struct debug_bucket *db;
+-	struct debug_obj *obj;
+ 	unsigned long flags;
+ 
+ 	if (!debug_objects_enabled)
+@@ -874,24 +841,26 @@ void debug_object_free(void *addr, const struct debug_obj_descr *descr)
+ 	raw_spin_lock_irqsave(&db->lock, flags);
+ 
+ 	obj = lookup_object(addr, db);
+-	if (!obj)
+-		goto out_unlock;
++	if (!obj) {
++		raw_spin_unlock_irqrestore(&db->lock, flags);
++		return;
++	}
+ 
+ 	switch (obj->state) {
+ 	case ODEBUG_STATE_ACTIVE:
+-		state = obj->state;
+-		raw_spin_unlock_irqrestore(&db->lock, flags);
+-		debug_print_object(obj, "free");
+-		debug_object_fixup(descr->fixup_free, addr, state);
+-		return;
++		break;
+ 	default:
+ 		hlist_del(&obj->node);
+ 		raw_spin_unlock_irqrestore(&db->lock, flags);
+ 		free_object(obj);
+ 		return;
+ 	}
+-out_unlock:
++
++	o = *obj;
+ 	raw_spin_unlock_irqrestore(&db->lock, flags);
++	debug_print_object(&o, "free");
++
++	debug_object_fixup(descr->fixup_free, addr, o.state);
+ }
+ EXPORT_SYMBOL_GPL(debug_object_free);
+ 
+@@ -943,10 +912,10 @@ void
+ debug_object_active_state(void *addr, const struct debug_obj_descr *descr,
+ 			  unsigned int expect, unsigned int next)
+ {
++	struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr };
+ 	struct debug_bucket *db;
+ 	struct debug_obj *obj;
+ 	unsigned long flags;
+-	bool print_object = false;
+ 
+ 	if (!debug_objects_enabled)
+ 		return;
+@@ -959,28 +928,19 @@ debug_object_active_state(void *addr, const struct debug_obj_descr *descr,
+ 	if (obj) {
+ 		switch (obj->state) {
+ 		case ODEBUG_STATE_ACTIVE:
+-			if (obj->astate == expect)
+-				obj->astate = next;
+-			else
+-				print_object = true;
+-			break;
+-
++			if (obj->astate != expect)
++				break;
++			obj->astate = next;
++			raw_spin_unlock_irqrestore(&db->lock, flags);
++			return;
+ 		default:
+-			print_object = true;
+ 			break;
+ 		}
++		o = *obj;
+ 	}
+ 
+ 	raw_spin_unlock_irqrestore(&db->lock, flags);
+-	if (!obj) {
+-		struct debug_obj o = { .object = addr,
+-				       .state = ODEBUG_STATE_NOTAVAILABLE,
+-				       .descr = descr };
+-
+-		debug_print_object(&o, "active_state");
+-	} else if (print_object) {
+-		debug_print_object(obj, "active_state");
+-	}
++	debug_print_object(&o, "active_state");
+ }
+ EXPORT_SYMBOL_GPL(debug_object_active_state);
+ 
+@@ -988,12 +948,10 @@ EXPORT_SYMBOL_GPL(debug_object_active_state);
+ static void __debug_check_no_obj_freed(const void *address, unsigned long size)
+ {
+ 	unsigned long flags, oaddr, saddr, eaddr, paddr, chunks;
+-	const struct debug_obj_descr *descr;
+-	enum debug_obj_state state;
++	int cnt, objs_checked = 0;
++	struct debug_obj *obj, o;
+ 	struct debug_bucket *db;
+ 	struct hlist_node *tmp;
+-	struct debug_obj *obj;
+-	int cnt, objs_checked = 0;
+ 
+ 	saddr = (unsigned long) address;
+ 	eaddr = saddr + size;
+@@ -1015,12 +973,10 @@ static void __debug_check_no_obj_freed(const void *address, unsigned long size)
+ 
+ 			switch (obj->state) {
+ 			case ODEBUG_STATE_ACTIVE:
+-				descr = obj->descr;
+-				state = obj->state;
++				o = *obj;
+ 				raw_spin_unlock_irqrestore(&db->lock, flags);
+-				debug_print_object(obj, "free");
+-				debug_object_fixup(descr->fixup_free,
+-						   (void *) oaddr, state);
++				debug_print_object(&o, "free");
++				debug_object_fixup(o.descr->fixup_free, (void *)oaddr, o.state);
+ 				goto repeat;
+ 			default:
+ 				hlist_del(&obj->node);
+-- 
+2.43.0
+
diff --git a/queue-6.1/drivers-perf-pmuv3-don-t-expose-sw_incr-event-in-sys.patch b/queue-6.1/drivers-perf-pmuv3-don-t-expose-sw_incr-event-in-sys.patch
new file mode 100644
index 00000000000..c83528bf7cc
--- /dev/null
+++ b/queue-6.1/drivers-perf-pmuv3-don-t-expose-sw_incr-event-in-sys.patch
@@ -0,0 +1,55 @@
+From a31f15e6b3778c5fdc4e65f7054b514b810b06b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 11:58:47 +0000
+Subject: drivers/perf: pmuv3: don't expose SW_INCR event in sysfs
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+[ Upstream commit ca6f537e459e2da4b331fe8928d1a0b0f9301f42 ]
+
+The SW_INCR event is somewhat unusual, and depends on the specific HW
+counter that it is programmed into. When programmed into PMEVCNTR<n>,
+SW_INCR will count any writes to PMSWINC_EL0 with bit n set, ignoring
+writes to SW_INCR with bit n clear.
+
+Event rotation means that there's no fixed relationship between
+perf_events and HW counters, so this isn't all that useful.
+
+Further, we program PMUSERENR.{SW,EN}=={0,0}, which causes EL0 writes to
+PMSWINC_EL0 to be trapped and handled as UNDEFINED, resulting in a
+SIGILL to userspace.
+
+Given that, it's not a good idea to expose SW_INCR in sysfs. Hide it as
+we did for CHAIN back in commit:
+
+  4ba2578fa7b55701 ("arm64: perf: don't expose CHAIN event in sysfs")
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Link: https://lore.kernel.org/r/20231204115847.2993026-1-mark.rutland@arm.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/perf_event.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c
+index 7b0643fe2f13..214b1805e536 100644
+--- a/arch/arm64/kernel/perf_event.c
++++ b/arch/arm64/kernel/perf_event.c
+@@ -168,7 +168,11 @@ armv8pmu_events_sysfs_show(struct device *dev,
+ 	PMU_EVENT_ATTR_ID(name, armv8pmu_events_sysfs_show, config)
+ 
+ static struct attribute *armv8_pmuv3_event_attrs[] = {
+-	ARMV8_EVENT_ATTR(sw_incr, ARMV8_PMUV3_PERFCTR_SW_INCR),
++	/*
++	 * Don't expose the sw_incr event in /sys. It's not usable as writes to
++	 * PMSWINC_EL0 will trap as PMUSERENR.{SW,EN}=={0,0} and event rotation
++	 * means we don't have a fixed event<->counter relationship regardless.
++	 */
+ 	ARMV8_EVENT_ATTR(l1i_cache_refill, ARMV8_PMUV3_PERFCTR_L1I_CACHE_REFILL),
+ 	ARMV8_EVENT_ATTR(l1i_tlb_refill, ARMV8_PMUV3_PERFCTR_L1I_TLB_REFILL),
+ 	ARMV8_EVENT_ATTR(l1d_cache_refill, ARMV8_PMUV3_PERFCTR_L1D_CACHE_REFILL),
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amd-display-fix-tiled-display-misalignment.patch b/queue-6.1/drm-amd-display-fix-tiled-display-misalignment.patch
new file mode 100644
index 00000000000..2856076e1cf
--- /dev/null
+++ b/queue-6.1/drm-amd-display-fix-tiled-display-misalignment.patch
@@ -0,0 +1,43 @@
+From 0463f9fb62132755ea8ed4191ae8fe4c8dc92d99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Nov 2023 00:04:36 -0500
+Subject: drm/amd/display: Fix tiled display misalignment
+
+From: Meenakshikumar Somasundaram <meenakshikumar.somasundaram@amd.com>
+
+[ Upstream commit c4b8394e76adba4f50a3c2696c75b214a291e24a ]
+
+[Why]
+When otg workaround is applied during clock update, otgs of
+tiled display went out of sync.
+
+[How]
+To call dc_trigger_sync() after clock update to sync otgs again.
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Acked-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
+Signed-off-by: Meenakshikumar Somasundaram <meenakshikumar.somasundaram@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index 7a309547c2b3..f415733f1a97 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -1903,6 +1903,10 @@ static enum dc_status dc_commit_state_no_check(struct dc *dc, struct dc_state *c
+ 		wait_for_no_pipes_pending(dc, context);
+ 		/* pplib is notified if disp_num changed */
+ 		dc->hwss.optimize_bandwidth(dc, context);
++		/* Need to do otg sync again as otg could be out of sync due to otg
++		 * workaround applied during clock update
++		 */
++		dc_trigger_sync(dc, context);
+ 	}
+ 
+ 	if (dc->hwss.update_dsc_pg)
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amd-display-fixing-stream-allocation-regression.patch b/queue-6.1/drm-amd-display-fixing-stream-allocation-regression.patch
new file mode 100644
index 00000000000..26826d6613c
--- /dev/null
+++ b/queue-6.1/drm-amd-display-fixing-stream-allocation-regression.patch
@@ -0,0 +1,42 @@
+From 0ef95ac2f8768cc7c5e056c86f3aaf3b94b262e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Dec 2023 18:15:16 -0500
+Subject: drm/amd/display: Fixing stream allocation regression
+
+From: Relja Vojvodic <relja.vojvodic@amd.com>
+
+[ Upstream commit 292c2116b2ae84c7e799ae340981e60551b18f5e ]
+
+For certain dual display configs that had one display using a 1080p
+mode, the DPM level used to drive the configs regressed from DPM 0 to
+DPM 3. This was caused by a missing check that should have only limited
+the pipe segments on non-phantom pipes. This caused issues with detile
+buffer allocation, which dissallow subvp from being used
+
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Reviewed-by: Dillon Varone <dillon.varone@amd.com>
+Reviewed-by: Martin Leung <martin.leung@amd.com>
+Acked-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com>
+Signed-off-by: Relja Vojvodic <relja.vojvodic@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c
+index fa3778849db1..5e0fcb80bf36 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c
+@@ -216,7 +216,7 @@ bool dcn32_subvp_in_use(struct dc *dc,
+ 	for (i = 0; i < dc->res_pool->pipe_count; i++) {
+ 		struct pipe_ctx *pipe = &context->res_ctx.pipe_ctx[i];
+ 
+-		if (pipe->stream && pipe->stream->mall_stream_config.type != SUBVP_NONE)
++		if (pipe->stream && pipe->stream->mall_stream_config.type != SUBVP_PHANTOM != SUBVP_NONE)
+ 			return true;
+ 	}
+ 	return false;
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amd-display-for-prefetch-mode-0-extend-prefetch-.patch b/queue-6.1/drm-amd-display-for-prefetch-mode-0-extend-prefetch-.patch
new file mode 100644
index 00000000000..fe4854a1796
--- /dev/null
+++ b/queue-6.1/drm-amd-display-for-prefetch-mode-0-extend-prefetch-.patch
@@ -0,0 +1,124 @@
+From ffc91cfa2ed9336107ddcecd9f5c38d5f3a1f0d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Dec 2023 14:52:31 -0500
+Subject: drm/amd/display: For prefetch mode > 0, extend prefetch if possible
+
+From: Alvin Lee <alvin.lee2@amd.com>
+
+[ Upstream commit dd4e4bb28843393065eed279e869fac248d03f0f ]
+
+[Description]
+For mode programming we want to extend the prefetch as much as possible
+(up to oto, or as long as we can for equ) if we're not already applying
+the 60us prefetch requirement. This is to avoid intermittent underflow
+issues during prefetch.
+
+The prefetch extension is applied under the following scenarios:
+1. We're in prefetch mode 1 (i.e. we don't support MCLK switch in blank)
+2. We're using subvp or drr methods of p-state switch, in which case we
+   we don't care if prefetch takes up more of the blanking time
+
+Mode programming typically chooses the smallest prefetch time possible
+(i.e. highest bandwidth during prefetch) presumably to create margin between
+p-states / c-states that happen in vblank and prefetch. Therefore we only
+apply this prefetch extension when p-state in vblank is not required (UCLK
+p-states take up the most vblank time).
+
+Reviewed-by: Jun Lei <jun.lei@amd.com>
+Acked-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Alvin Lee <alvin.lee2@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dc/dml/dcn32/display_mode_vba_32.c        |  3 ++
+ .../dc/dml/dcn32/display_mode_vba_util_32.c   | 33 +++++++++++++++----
+ .../dc/dml/dcn32/display_mode_vba_util_32.h   |  1 +
+ 3 files changed, 31 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c
+index 19f55657272e..cc8c1a48c5c4 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c
+@@ -810,6 +810,8 @@ static void DISPCLKDPPCLKDCFCLKDeepSleepPrefetchParametersWatermarksAndPerforman
+ 					(v->DRAMSpeedPerState[mode_lib->vba.VoltageLevel] <= MEM_STROBE_FREQ_MHZ ||
+ 						v->DCFCLKPerState[mode_lib->vba.VoltageLevel] <= DCFCLK_FREQ_EXTRA_PREFETCH_REQ_MHZ) ?
+ 							mode_lib->vba.ip.min_prefetch_in_strobe_us : 0,
++					mode_lib->vba.PrefetchModePerState[mode_lib->vba.VoltageLevel][mode_lib->vba.maxMpcComb] > 0 || mode_lib->vba.DRAMClockChangeRequirementFinal == false,
++
+ 					/* Output */
+ 					&v->DSTXAfterScaler[k],
+ 					&v->DSTYAfterScaler[k],
+@@ -3291,6 +3293,7 @@ void dml32_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l
+ 							v->SwathHeightCThisState[k], v->TWait,
+ 							(v->DRAMSpeedPerState[i] <= MEM_STROBE_FREQ_MHZ || v->DCFCLKState[i][j] <= DCFCLK_FREQ_EXTRA_PREFETCH_REQ_MHZ) ?
+ 									mode_lib->vba.ip.min_prefetch_in_strobe_us : 0,
++							mode_lib->vba.PrefetchModePerState[i][j] > 0 || mode_lib->vba.DRAMClockChangeRequirementFinal == false,
+ 
+ 							/* Output */
+ 							&v->dummy_vars.dml32_ModeSupportAndSystemConfigurationFull.DSTXAfterScaler[k],
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c
+index 23e4be2ad63f..7f4fc49be35c 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c
+@@ -3418,6 +3418,7 @@ bool dml32_CalculatePrefetchSchedule(
+ 		unsigned int SwathHeightC,
+ 		double TWait,
+ 		double TPreReq,
++		bool ExtendPrefetchIfPossible,
+ 		/* Output */
+ 		double   *DSTXAfterScaler,
+ 		double   *DSTYAfterScaler,
+@@ -3887,12 +3888,32 @@ bool dml32_CalculatePrefetchSchedule(
+ 			/* Clamp to oto for bandwidth calculation */
+ 			LinesForPrefetchBandwidth = dst_y_prefetch_oto;
+ 		} else {
+-			*DestinationLinesForPrefetch = dst_y_prefetch_equ;
+-			TimeForFetchingMetaPTE = Tvm_equ;
+-			TimeForFetchingRowInVBlank = Tr0_equ;
+-			*PrefetchBandwidth = prefetch_bw_equ;
+-			/* Clamp to equ for bandwidth calculation */
+-			LinesForPrefetchBandwidth = dst_y_prefetch_equ;
++			/* For mode programming we want to extend the prefetch as much as possible
++			 * (up to oto, or as long as we can for equ) if we're not already applying
++			 * the 60us prefetch requirement. This is to avoid intermittent underflow
++			 * issues during prefetch.
++			 *
++			 * The prefetch extension is applied under the following scenarios:
++			 * 1. We're in prefetch mode > 0 (i.e. we don't support MCLK switch in blank)
++			 * 2. We're using subvp or drr methods of p-state switch, in which case we
++			 *    we don't care if prefetch takes up more of the blanking time
++			 *
++			 * Mode programming typically chooses the smallest prefetch time possible
++			 * (i.e. highest bandwidth during prefetch) presumably to create margin between
++			 * p-states / c-states that happen in vblank and prefetch. Therefore we only
++			 * apply this prefetch extension when p-state in vblank is not required (UCLK
++			 * p-states take up the most vblank time).
++			 */
++			if (ExtendPrefetchIfPossible && TPreReq == 0 && VStartup < MaxVStartup) {
++				MyError = true;
++			} else {
++				*DestinationLinesForPrefetch = dst_y_prefetch_equ;
++				TimeForFetchingMetaPTE = Tvm_equ;
++				TimeForFetchingRowInVBlank = Tr0_equ;
++				*PrefetchBandwidth = prefetch_bw_equ;
++				/* Clamp to equ for bandwidth calculation */
++				LinesForPrefetchBandwidth = dst_y_prefetch_equ;
++			}
+ 		}
+ 
+ 		*DestinationLinesToRequestVMInVBlank = dml_ceil(4.0 * TimeForFetchingMetaPTE / LineTime, 1.0) / 4.0;
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.h b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.h
+index 779c6805f599..1823434d8ede 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.h
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.h
+@@ -744,6 +744,7 @@ bool dml32_CalculatePrefetchSchedule(
+ 		unsigned int SwathHeightC,
+ 		double TWait,
+ 		double TPreReq,
++		bool ExtendPrefetchIfPossible,
+ 		/* Output */
+ 		double   *DSTXAfterScaler,
+ 		double   *DSTYAfterScaler,
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amd-display-make-flip_timestamp_in_us-a-64-bit-v.patch b/queue-6.1/drm-amd-display-make-flip_timestamp_in_us-a-64-bit-v.patch
new file mode 100644
index 00000000000..5827a879255
--- /dev/null
+++ b/queue-6.1/drm-amd-display-make-flip_timestamp_in_us-a-64-bit-v.patch
@@ -0,0 +1,43 @@
+From 421922f8e8c65d5650c7a96c6b4acd035954818a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Dec 2023 12:01:05 -0500
+Subject: drm/amd/display: make flip_timestamp_in_us a 64-bit variable
+
+From: Josip Pavic <josip.pavic@amd.com>
+
+[ Upstream commit 6fb12518ca58412dc51054e2a7400afb41328d85 ]
+
+[Why]
+This variable currently overflows after about 71 minutes. This doesn't
+cause any known functional issues but it does make debugging more
+difficult.
+
+[How]
+Make it a 64-bit variable.
+
+Reviewed-by: Aric Cyr <aric.cyr@amd.com>
+Acked-by: Wayne Lin <wayne.lin@amd.com>
+Signed-off-by: Josip Pavic <josip.pavic@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dc_hw_types.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dc_hw_types.h b/drivers/gpu/drm/amd/display/dc/dc_hw_types.h
+index 46c2b991aa10..811c117665e7 100644
+--- a/drivers/gpu/drm/amd/display/dc/dc_hw_types.h
++++ b/drivers/gpu/drm/amd/display/dc/dc_hw_types.h
+@@ -244,7 +244,7 @@ enum pixel_format {
+ #define DC_MAX_DIRTY_RECTS 3
+ struct dc_flip_addrs {
+ 	struct dc_plane_address address;
+-	unsigned int flip_timestamp_in_us;
++	unsigned long long flip_timestamp_in_us;
+ 	bool flip_immediate;
+ 	/* TODO: add flip duration for FreeSync */
+ 	bool triplebuffer_flips;
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amd-powerplay-fix-kzalloc-parameter-atom_tonga_p.patch b/queue-6.1/drm-amd-powerplay-fix-kzalloc-parameter-atom_tonga_p.patch
new file mode 100644
index 00000000000..a2a6af9131f
--- /dev/null
+++ b/queue-6.1/drm-amd-powerplay-fix-kzalloc-parameter-atom_tonga_p.patch
@@ -0,0 +1,47 @@
+From c3eaa5fea828ede0727862d3e6554ad079d06ac5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jan 2024 12:05:09 +0530
+Subject: drm/amd/powerplay: Fix kzalloc parameter 'ATOM_Tonga_PPM_Table' in
+ 'get_platform_power_management_table()'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit 6616b5e1999146b1304abe78232af810080c67e3 ]
+
+In 'struct phm_ppm_table *ptr' allocation using kzalloc, an incorrect
+structure type is passed to sizeof() in kzalloc, larger structure types
+were used, thus using correct type 'struct phm_ppm_table' fixes the
+below:
+
+drivers/gpu/drm/amd/amdgpu/../pm/powerplay/hwmgr/process_pptables_v1_0.c:203 get_platform_power_management_table() warn: struct type mismatch 'phm_ppm_table vs _ATOM_Tonga_PPM_Table'
+
+Cc: Eric Huang <JinHuiEric.Huang@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c
+index f2a55c1413f5..17882f8dfdd3 100644
+--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c
++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/process_pptables_v1_0.c
+@@ -200,7 +200,7 @@ static int get_platform_power_management_table(
+ 		struct pp_hwmgr *hwmgr,
+ 		ATOM_Tonga_PPM_Table *atom_ppm_table)
+ {
+-	struct phm_ppm_table *ptr = kzalloc(sizeof(ATOM_Tonga_PPM_Table), GFP_KERNEL);
++	struct phm_ppm_table *ptr = kzalloc(sizeof(*ptr), GFP_KERNEL);
+ 	struct phm_ppt_v1_information *pp_table_information =
+ 		(struct phm_ppt_v1_information *)(hwmgr->pptable);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amdgpu-drop-fence-check-in-to_amdgpu_amdkfd_fenc.patch b/queue-6.1/drm-amdgpu-drop-fence-check-in-to_amdgpu_amdkfd_fenc.patch
new file mode 100644
index 00000000000..6af519e258d
--- /dev/null
+++ b/queue-6.1/drm-amdgpu-drop-fence-check-in-to_amdgpu_amdkfd_fenc.patch
@@ -0,0 +1,45 @@
+From 538575594f1c04f9eff6a6ab6acafacb8422f46b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Dec 2023 12:54:44 +0530
+Subject: drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit bf2ad4fb8adca89374b54b225d494e0b1956dbea ]
+
+Return value of container_of(...) can't be null, so null check is not
+required for 'fence'. Hence drop its NULL check.
+
+Fixes the below:
+drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_fence.c:93 to_amdgpu_amdkfd_fence() warn: can 'fence' even be NULL?
+
+Cc: Felix Kuehling <Felix.Kuehling@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_fence.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_fence.c
+index 469785d33791..1ef758ac5076 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_fence.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_fence.c
+@@ -90,7 +90,7 @@ struct amdgpu_amdkfd_fence *to_amdgpu_amdkfd_fence(struct dma_fence *f)
+ 		return NULL;
+ 
+ 	fence = container_of(f, struct amdgpu_amdkfd_fence, base);
+-	if (fence && f->ops == &amdkfd_fence_ops)
++	if (f->ops == &amdkfd_fence_ops)
+ 		return fence;
+ 
+ 	return NULL;
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amdgpu-fix-ecc-irq-enable-disable-unpaired.patch b/queue-6.1/drm-amdgpu-fix-ecc-irq-enable-disable-unpaired.patch
new file mode 100644
index 00000000000..f91b2351bd3
--- /dev/null
+++ b/queue-6.1/drm-amdgpu-fix-ecc-irq-enable-disable-unpaired.patch
@@ -0,0 +1,124 @@
+From 00f6074514a6099b948d96ad1eb93f5bab11f41b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Dec 2023 16:13:23 +0800
+Subject: drm/amdgpu: Fix ecc irq enable/disable unpaired
+
+From: Stanley.Yang <Stanley.Yang@amd.com>
+
+[ Upstream commit a32c6f7f5737cc7e31cd7ad5133f0d96fca12ea6 ]
+
+The ecc_irq is disabled while GPU mode2 reset suspending process,
+but not be enabled during GPU mode2 reset resume process.
+
+Changed from V1:
+	only do sdma/gfx ras_late_init in aldebaran_mode2_restore_ip
+	delete amdgpu_ras_late_resume function
+
+Changed from V2:
+	check umc ras supported before put ecc_irq
+
+Signed-off-by: Stanley.Yang <Stanley.Yang@amd.com>
+Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/aldebaran.c | 26 +++++++++++++++++++++++++-
+ drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c |  4 ++++
+ drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c |  5 +++++
+ drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c  |  4 ++++
+ 4 files changed, 38 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/aldebaran.c b/drivers/gpu/drm/amd/amdgpu/aldebaran.c
+index 2b97b8a96fb4..fa6193535d48 100644
+--- a/drivers/gpu/drm/amd/amdgpu/aldebaran.c
++++ b/drivers/gpu/drm/amd/amdgpu/aldebaran.c
+@@ -333,6 +333,7 @@ aldebaran_mode2_restore_hwcontext(struct amdgpu_reset_control *reset_ctl,
+ {
+ 	struct list_head *reset_device_list = reset_context->reset_device_list;
+ 	struct amdgpu_device *tmp_adev = NULL;
++	struct amdgpu_ras *con;
+ 	int r;
+ 
+ 	if (reset_device_list == NULL)
+@@ -358,7 +359,30 @@ aldebaran_mode2_restore_hwcontext(struct amdgpu_reset_control *reset_ctl,
+ 		 */
+ 		amdgpu_register_gpu_instance(tmp_adev);
+ 
+-		/* Resume RAS */
++		/* Resume RAS, ecc_irq */
++		con = amdgpu_ras_get_context(tmp_adev);
++		if (!amdgpu_sriov_vf(tmp_adev) && con) {
++			if (tmp_adev->sdma.ras &&
++				tmp_adev->sdma.ras->ras_block.ras_late_init) {
++				r = tmp_adev->sdma.ras->ras_block.ras_late_init(tmp_adev,
++						&tmp_adev->sdma.ras->ras_block.ras_comm);
++				if (r) {
++					dev_err(tmp_adev->dev, "SDMA failed to execute ras_late_init! ret:%d\n", r);
++					goto end;
++				}
++			}
++
++			if (tmp_adev->gfx.ras &&
++				tmp_adev->gfx.ras->ras_block.ras_late_init) {
++				r = tmp_adev->gfx.ras->ras_block.ras_late_init(tmp_adev,
++						&tmp_adev->gfx.ras->ras_block.ras_comm);
++				if (r) {
++					dev_err(tmp_adev->dev, "GFX failed to execute ras_late_init! ret:%d\n", r);
++					goto end;
++				}
++			}
++		}
++
+ 		amdgpu_ras_resume(tmp_adev);
+ 
+ 		/* Update PSP FW topology after reset */
+diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c
+index d96ee48e1706..35921b41fc27 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c
+@@ -1144,6 +1144,10 @@ static int gmc_v10_0_hw_fini(void *handle)
+ 
+ 	amdgpu_irq_put(adev, &adev->gmc.vm_fault, 0);
+ 
++	if (adev->gmc.ecc_irq.funcs &&
++		amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__UMC))
++		amdgpu_irq_put(adev, &adev->gmc.ecc_irq, 0);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c
+index 7124347d2b6c..310a5607d83b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c
+@@ -951,6 +951,11 @@ static int gmc_v11_0_hw_fini(void *handle)
+ 	}
+ 
+ 	amdgpu_irq_put(adev, &adev->gmc.vm_fault, 0);
++
++	if (adev->gmc.ecc_irq.funcs &&
++		amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__UMC))
++		amdgpu_irq_put(adev, &adev->gmc.ecc_irq, 0);
++
+ 	gmc_v11_0_gart_disable(adev);
+ 
+ 	return 0;
+diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+index 0d9e9d9dd4a1..409e3aa018f2 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+@@ -1900,6 +1900,10 @@ static int gmc_v9_0_hw_fini(void *handle)
+ 
+ 	amdgpu_irq_put(adev, &adev->gmc.vm_fault, 0);
+ 
++	if (adev->gmc.ecc_irq.funcs &&
++		amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__UMC))
++		amdgpu_irq_put(adev, &adev->gmc.ecc_irq, 0);
++
+ 	return 0;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amdgpu-fix-ftrace-event-amdgpu_bo_move-always-mo.patch b/queue-6.1/drm-amdgpu-fix-ftrace-event-amdgpu_bo_move-always-mo.patch
new file mode 100644
index 00000000000..462a65a58e9
--- /dev/null
+++ b/queue-6.1/drm-amdgpu-fix-ftrace-event-amdgpu_bo_move-always-mo.patch
@@ -0,0 +1,114 @@
+From d8afd3f3a355913dd5174988d36c882eb17aa966 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Dec 2023 21:03:04 +0800
+Subject: drm/amdgpu: fix ftrace event amdgpu_bo_move always move on same heap
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Wang, Beyond <Wang.Beyond@amd.com>
+
+[ Upstream commit 94aeb4117343d072e3a35b9595bcbfc0058ee724 ]
+
+Issue: during evict or validate happened on amdgpu_bo, the 'from' and
+'to' is always same in ftrace event of amdgpu_bo_move
+
+where calling the 'trace_amdgpu_bo_move', the comment says move_notify
+is called before move happens, but actually it is called after move
+happens, here the new_mem is same as bo->resource
+
+Fix: move trace_amdgpu_bo_move from move_notify to amdgpu_bo_move
+
+Signed-off-by: Wang, Beyond <Wang.Beyond@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 13 +------------
+ drivers/gpu/drm/amd/amdgpu/amdgpu_object.h |  4 +---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c    |  5 +++--
+ 3 files changed, 5 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+index 0ee7c935fba1..cde2fd2f7117 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+@@ -1222,19 +1222,15 @@ int amdgpu_bo_get_metadata(struct amdgpu_bo *bo, void *buffer,
+  * amdgpu_bo_move_notify - notification about a memory move
+  * @bo: pointer to a buffer object
+  * @evict: if this move is evicting the buffer from the graphics address space
+- * @new_mem: new information of the bufer object
+  *
+  * Marks the corresponding &amdgpu_bo buffer object as invalid, also performs
+  * bookkeeping.
+  * TTM driver callback which is called when ttm moves a buffer.
+  */
+-void amdgpu_bo_move_notify(struct ttm_buffer_object *bo,
+-			   bool evict,
+-			   struct ttm_resource *new_mem)
++void amdgpu_bo_move_notify(struct ttm_buffer_object *bo, bool evict)
+ {
+ 	struct amdgpu_device *adev = amdgpu_ttm_adev(bo->bdev);
+ 	struct amdgpu_bo *abo;
+-	struct ttm_resource *old_mem = bo->resource;
+ 
+ 	if (!amdgpu_bo_is_amdgpu_bo(bo))
+ 		return;
+@@ -1251,13 +1247,6 @@ void amdgpu_bo_move_notify(struct ttm_buffer_object *bo,
+ 	/* remember the eviction */
+ 	if (evict)
+ 		atomic64_inc(&adev->num_evictions);
+-
+-	/* update statistics */
+-	if (!new_mem)
+-		return;
+-
+-	/* move_notify is called before move happens */
+-	trace_amdgpu_bo_move(abo, new_mem->mem_type, old_mem->mem_type);
+ }
+ 
+ void amdgpu_bo_get_memory(struct amdgpu_bo *bo, uint64_t *vram_mem,
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h
+index 6dcd7bab42fb..2ada421e79e4 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.h
+@@ -312,9 +312,7 @@ int amdgpu_bo_set_metadata (struct amdgpu_bo *bo, void *metadata,
+ int amdgpu_bo_get_metadata(struct amdgpu_bo *bo, void *buffer,
+ 			   size_t buffer_size, uint32_t *metadata_size,
+ 			   uint64_t *flags);
+-void amdgpu_bo_move_notify(struct ttm_buffer_object *bo,
+-			   bool evict,
+-			   struct ttm_resource *new_mem);
++void amdgpu_bo_move_notify(struct ttm_buffer_object *bo, bool evict);
+ void amdgpu_bo_release_notify(struct ttm_buffer_object *bo);
+ vm_fault_t amdgpu_bo_fault_reserve_notify(struct ttm_buffer_object *bo);
+ void amdgpu_bo_fence(struct amdgpu_bo *bo, struct dma_fence *fence,
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+index 10469f20a10c..158b791883f0 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+@@ -555,10 +555,11 @@ static int amdgpu_bo_move(struct ttm_buffer_object *bo, bool evict,
+ 			return r;
+ 	}
+ 
++	trace_amdgpu_bo_move(abo, new_mem->mem_type, old_mem->mem_type);
+ out:
+ 	/* update statistics */
+ 	atomic64_add(bo->base.size, &adev->num_bytes_moved);
+-	amdgpu_bo_move_notify(bo, evict, new_mem);
++	amdgpu_bo_move_notify(bo, evict);
+ 	return 0;
+ }
+ 
+@@ -1503,7 +1504,7 @@ static int amdgpu_ttm_access_memory(struct ttm_buffer_object *bo,
+ static void
+ amdgpu_bo_delete_mem_notify(struct ttm_buffer_object *bo)
+ {
+-	amdgpu_bo_move_notify(bo, false, NULL);
++	amdgpu_bo_move_notify(bo, false);
+ }
+ 
+ static struct ttm_device_funcs amdgpu_bo_driver = {
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amdgpu-fix-fw-from-request_firmware-not-released.patch b/queue-6.1/drm-amdgpu-fix-fw-from-request_firmware-not-released.patch
new file mode 100644
index 00000000000..fd8f6366d53
--- /dev/null
+++ b/queue-6.1/drm-amdgpu-fix-fw-from-request_firmware-not-released.patch
@@ -0,0 +1,50 @@
+From 28606ff2f328a90c654f38a8d7f242535886f688 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jan 2024 22:22:44 +0530
+Subject: drm/amdgpu: Fix '*fw' from request_firmware() not released in
+ 'amdgpu_ucode_request()'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit 13a1851f923d9a7a78a477497295c2dfd16ad4a4 ]
+
+Fixes the below:
+drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c:1404 amdgpu_ucode_request() warn: '*fw' from request_firmware() not released on lines: 1404.
+
+Cc: Mario Limonciello <mario.limonciello@amd.com>
+Cc: Lijo Lazar <lijo.lazar@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c
+index 6e7058a2d1c8..779707f19c88 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c
+@@ -1110,9 +1110,13 @@ int amdgpu_ucode_request(struct amdgpu_device *adev, const struct firmware **fw,
+ 
+ 	if (err)
+ 		return -ENODEV;
++
+ 	err = amdgpu_ucode_validate(*fw);
+-	if (err)
++	if (err) {
+ 		dev_dbg(adev->dev, "\"%s\" failed to validate\n", fw_name);
++		release_firmware(*fw);
++		*fw = NULL;
++	}
+ 
+ 	return err;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amdgpu-fix-with-right-return-code-eio-in-amdgpu_.patch b/queue-6.1/drm-amdgpu-fix-with-right-return-code-eio-in-amdgpu_.patch
new file mode 100644
index 00000000000..f55a64207e7
--- /dev/null
+++ b/queue-6.1/drm-amdgpu-fix-with-right-return-code-eio-in-amdgpu_.patch
@@ -0,0 +1,77 @@
+From 8c633af940ef847eeb0a201a42b70df8af05e660 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jan 2024 15:26:42 +0530
+Subject: drm/amdgpu: Fix with right return code '-EIO' in
+ 'amdgpu_gmc_vram_checking()'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit fac4ebd79fed60e79cccafdad45a2bb8d3795044 ]
+
+The amdgpu_gmc_vram_checking() function in emulation checks whether
+all of the memory range of shared system memory could be accessed by
+GPU, from this aspect, -EIO is returned for error scenarios.
+
+Fixes the below:
+drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c:919 gmc_v6_0_hw_init() warn: missing error code? 'r'
+drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c:1103 gmc_v7_0_hw_init() warn: missing error code? 'r'
+drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c:1223 gmc_v8_0_hw_init() warn: missing error code? 'r'
+drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c:2344 gmc_v9_0_hw_init() warn: missing error code? 'r'
+
+Cc: Xiaojian Du <Xiaojian.Du@amd.com>
+Cc: Lijo Lazar <lijo.lazar@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Suggested-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
+index 2bc791ed8830..ea0fb079f942 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
+@@ -808,19 +808,26 @@ int amdgpu_gmc_vram_checking(struct amdgpu_device *adev)
+ 	 * seconds, so here, we just pick up three parts for emulation.
+ 	 */
+ 	ret = memcmp(vram_ptr, cptr, 10);
+-	if (ret)
+-		return ret;
++	if (ret) {
++		ret = -EIO;
++		goto release_buffer;
++	}
+ 
+ 	ret = memcmp(vram_ptr + (size / 2), cptr, 10);
+-	if (ret)
+-		return ret;
++	if (ret) {
++		ret = -EIO;
++		goto release_buffer;
++	}
+ 
+ 	ret = memcmp(vram_ptr + size - 10, cptr, 10);
+-	if (ret)
+-		return ret;
++	if (ret) {
++		ret = -EIO;
++		goto release_buffer;
++	}
+ 
++release_buffer:
+ 	amdgpu_bo_free_kernel(&vram_bo, &vram_gpu,
+ 			&vram_ptr);
+ 
+-	return 0;
++	return ret;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amdgpu-let-kfd-sync-with-vm-fences.patch b/queue-6.1/drm-amdgpu-let-kfd-sync-with-vm-fences.patch
new file mode 100644
index 00000000000..75cb37c7013
--- /dev/null
+++ b/queue-6.1/drm-amdgpu-let-kfd-sync-with-vm-fences.patch
@@ -0,0 +1,42 @@
+From 7d85fa854107b979075f4c938039495a5c9cee2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 16:17:23 -0500
+Subject: drm/amdgpu: Let KFD sync with VM fences
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Felix Kuehling <Felix.Kuehling@amd.com>
+
+[ Upstream commit ec9ba4821fa52b5efdbc4cdf0a77497990655231 ]
+
+Change the rules for amdgpu_sync_resv to let KFD synchronize with VM
+fences on page table reservations. This fixes intermittent memory
+corruption after evictions when using amdgpu_vm_handle_moved to update
+page tables for VM mappings managed through render nodes.
+
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
+index 090e66a1b284..54bdbd83a8cc 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sync.c
+@@ -191,7 +191,8 @@ static bool amdgpu_sync_test_fence(struct amdgpu_device *adev,
+ 
+ 	/* Never sync to VM updates either. */
+ 	if (fence_owner == AMDGPU_FENCE_OWNER_VM &&
+-	    owner != AMDGPU_FENCE_OWNER_UNDEFINED)
++	    owner != AMDGPU_FENCE_OWNER_UNDEFINED &&
++	    owner != AMDGPU_FENCE_OWNER_KFD)
+ 		return false;
+ 
+ 	/* Ignore fences depending on the sync mode */
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amdgpu-release-adev-pm.fw-before-return-in-amdgp.patch b/queue-6.1/drm-amdgpu-release-adev-pm.fw-before-return-in-amdgp.patch
new file mode 100644
index 00000000000..38a6e7559e3
--- /dev/null
+++ b/queue-6.1/drm-amdgpu-release-adev-pm.fw-before-return-in-amdgp.patch
@@ -0,0 +1,48 @@
+From 38306d3847c3503016da152800545625a9246411 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Dec 2023 18:13:11 +0530
+Subject: drm/amdgpu: Release 'adev->pm.fw' before return in
+ 'amdgpu_device_need_post()'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit 8a44fdd3cf91debbd09b43bd2519ad2b2486ccf4 ]
+
+In function 'amdgpu_device_need_post(struct amdgpu_device *adev)' -
+'adev->pm.fw' may not be released before return.
+
+Using the function release_firmware() to release adev->pm.fw.
+
+Thus fixing the below:
+drivers/gpu/drm/amd/amdgpu/amdgpu_device.c:1571 amdgpu_device_need_post() warn: 'adev->pm.fw' from request_firmware() not released on lines: 1554.
+
+Cc: Monk Liu <Monk.Liu@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Suggested-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index a5352e5e2bd4..4b91f95066ec 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -1310,6 +1310,7 @@ bool amdgpu_device_need_post(struct amdgpu_device *adev)
+ 				return true;
+ 
+ 			fw_ver = *((uint32_t *)adev->pm.fw->data + 69);
++			release_firmware(adev->pm.fw);
+ 			if (fw_ver < 0x00160e00)
+ 				return true;
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amdkfd-fix-iterator-used-outside-loop-in-kfd_add.patch b/queue-6.1/drm-amdkfd-fix-iterator-used-outside-loop-in-kfd_add.patch
new file mode 100644
index 00000000000..20e882494b7
--- /dev/null
+++ b/queue-6.1/drm-amdkfd-fix-iterator-used-outside-loop-in-kfd_add.patch
@@ -0,0 +1,64 @@
+From 19b27b9dd186c758175e372aa269239ac58e6e8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Dec 2023 15:07:09 +0530
+Subject: drm/amdkfd: Fix iterator used outside loop in 'kfd_add_peer_prop()'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit b1a428b45dc7e47c7acc2ad0d08d8a6dda910c4c ]
+
+Fix the following about iterator use:
+drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1456 kfd_add_peer_prop() warn: iterator used outside loop: 'iolink3'
+
+Cc: Felix Kuehling <Felix.Kuehling@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 24 ++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+index 705d9e91b5aa..029916971bf6 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+@@ -1513,17 +1513,19 @@ static int kfd_add_peer_prop(struct kfd_topology_device *kdev,
+ 		/* CPU->CPU  link*/
+ 		cpu_dev = kfd_topology_device_by_proximity_domain(iolink1->node_to);
+ 		if (cpu_dev) {
+-			list_for_each_entry(iolink3, &cpu_dev->io_link_props, list)
+-				if (iolink3->node_to == iolink2->node_to)
+-					break;
+-
+-			props->weight += iolink3->weight;
+-			props->min_latency += iolink3->min_latency;
+-			props->max_latency += iolink3->max_latency;
+-			props->min_bandwidth = min(props->min_bandwidth,
+-							iolink3->min_bandwidth);
+-			props->max_bandwidth = min(props->max_bandwidth,
+-							iolink3->max_bandwidth);
++			list_for_each_entry(iolink3, &cpu_dev->io_link_props, list) {
++				if (iolink3->node_to != iolink2->node_to)
++					continue;
++
++				props->weight += iolink3->weight;
++				props->min_latency += iolink3->min_latency;
++				props->max_latency += iolink3->max_latency;
++				props->min_bandwidth = min(props->min_bandwidth,
++							   iolink3->min_bandwidth);
++				props->max_bandwidth = min(props->max_bandwidth,
++							   iolink3->max_bandwidth);
++				break;
++			}
+ 		} else {
+ 			WARN(1, "CPU node not found");
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amdkfd-fix-lock-dependency-warning-with-srcu.patch b/queue-6.1/drm-amdkfd-fix-lock-dependency-warning-with-srcu.patch
new file mode 100644
index 00000000000..7b8a3e15ef6
--- /dev/null
+++ b/queue-6.1/drm-amdkfd-fix-lock-dependency-warning-with-srcu.patch
@@ -0,0 +1,103 @@
+From 2fda6a3ea5a59c5cd063d2be988247d5f346bed0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Dec 2023 15:19:25 -0500
+Subject: drm/amdkfd: Fix lock dependency warning with srcu
+
+From: Philip Yang <Philip.Yang@amd.com>
+
+[ Upstream commit 2a9de42e8d3c82c6990d226198602be44f43f340 ]
+
+======================================================
+WARNING: possible circular locking dependency detected
+6.5.0-kfd-yangp #2289 Not tainted
+------------------------------------------------------
+kworker/0:2/996 is trying to acquire lock:
+        (srcu){.+.+}-{0:0}, at: __synchronize_srcu+0x5/0x1a0
+
+but task is already holding lock:
+        ((work_completion)(&svms->deferred_list_work)){+.+.}-{0:0}, at:
+	process_one_work+0x211/0x560
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #3 ((work_completion)(&svms->deferred_list_work)){+.+.}-{0:0}:
+        __flush_work+0x88/0x4f0
+        svm_range_list_lock_and_flush_work+0x3d/0x110 [amdgpu]
+        svm_range_set_attr+0xd6/0x14c0 [amdgpu]
+        kfd_ioctl+0x1d1/0x630 [amdgpu]
+        __x64_sys_ioctl+0x88/0xc0
+
+-> #2 (&info->lock#2){+.+.}-{3:3}:
+        __mutex_lock+0x99/0xc70
+        amdgpu_amdkfd_gpuvm_restore_process_bos+0x54/0x740 [amdgpu]
+        restore_process_helper+0x22/0x80 [amdgpu]
+        restore_process_worker+0x2d/0xa0 [amdgpu]
+        process_one_work+0x29b/0x560
+        worker_thread+0x3d/0x3d0
+
+-> #1 ((work_completion)(&(&process->restore_work)->work)){+.+.}-{0:0}:
+        __flush_work+0x88/0x4f0
+        __cancel_work_timer+0x12c/0x1c0
+        kfd_process_notifier_release_internal+0x37/0x1f0 [amdgpu]
+        __mmu_notifier_release+0xad/0x240
+        exit_mmap+0x6a/0x3a0
+        mmput+0x6a/0x120
+        do_exit+0x322/0xb90
+        do_group_exit+0x37/0xa0
+        __x64_sys_exit_group+0x18/0x20
+        do_syscall_64+0x38/0x80
+
+-> #0 (srcu){.+.+}-{0:0}:
+        __lock_acquire+0x1521/0x2510
+        lock_sync+0x5f/0x90
+        __synchronize_srcu+0x4f/0x1a0
+        __mmu_notifier_release+0x128/0x240
+        exit_mmap+0x6a/0x3a0
+        mmput+0x6a/0x120
+        svm_range_deferred_list_work+0x19f/0x350 [amdgpu]
+        process_one_work+0x29b/0x560
+        worker_thread+0x3d/0x3d0
+
+other info that might help us debug this:
+Chain exists of:
+  srcu --> &info->lock#2 --> (work_completion)(&svms->deferred_list_work)
+
+Possible unsafe locking scenario:
+
+        CPU0                    CPU1
+        ----                    ----
+        lock((work_completion)(&svms->deferred_list_work));
+                        lock(&info->lock#2);
+			lock((work_completion)(&svms->deferred_list_work));
+        sync(srcu);
+
+Signed-off-by: Philip Yang <Philip.Yang@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+index 4ecc4be1a910..5188c4d2e7c0 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+@@ -2241,8 +2241,10 @@ static void svm_range_deferred_list_work(struct work_struct *work)
+ 		mutex_unlock(&svms->lock);
+ 		mmap_write_unlock(mm);
+ 
+-		/* Pairs with mmget in svm_range_add_list_work */
+-		mmput(mm);
++		/* Pairs with mmget in svm_range_add_list_work. If dropping the
++		 * last mm refcount, schedule release work to avoid circular locking
++		 */
++		mmput_async(mm);
+ 
+ 		spin_lock(&svms->deferred_list_lock);
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amdkfd-fix-lock-dependency-warning.patch b/queue-6.1/drm-amdkfd-fix-lock-dependency-warning.patch
new file mode 100644
index 00000000000..9505adff053
--- /dev/null
+++ b/queue-6.1/drm-amdkfd-fix-lock-dependency-warning.patch
@@ -0,0 +1,145 @@
+From bb3e7dab44a4a205af9de03d255b2a82847d267a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jan 2024 15:07:44 -0500
+Subject: drm/amdkfd: Fix lock dependency warning
+
+From: Felix Kuehling <felix.kuehling@amd.com>
+
+[ Upstream commit 47bf0f83fc86df1bf42b385a91aadb910137c5c9 ]
+
+======================================================
+WARNING: possible circular locking dependency detected
+6.5.0-kfd-fkuehlin #276 Not tainted
+------------------------------------------------------
+kworker/8:2/2676 is trying to acquire lock:
+ffff9435aae95c88 ((work_completion)(&svm_bo->eviction_work)){+.+.}-{0:0}, at: __flush_work+0x52/0x550
+
+but task is already holding lock:
+ffff9435cd8e1720 (&svms->lock){+.+.}-{3:3}, at: svm_range_deferred_list_work+0xe8/0x340 [amdgpu]
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #2 (&svms->lock){+.+.}-{3:3}:
+       __mutex_lock+0x97/0xd30
+       kfd_ioctl_alloc_memory_of_gpu+0x6d/0x3c0 [amdgpu]
+       kfd_ioctl+0x1b2/0x5d0 [amdgpu]
+       __x64_sys_ioctl+0x86/0xc0
+       do_syscall_64+0x39/0x80
+       entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+-> #1 (&mm->mmap_lock){++++}-{3:3}:
+       down_read+0x42/0x160
+       svm_range_evict_svm_bo_worker+0x8b/0x340 [amdgpu]
+       process_one_work+0x27a/0x540
+       worker_thread+0x53/0x3e0
+       kthread+0xeb/0x120
+       ret_from_fork+0x31/0x50
+       ret_from_fork_asm+0x11/0x20
+
+-> #0 ((work_completion)(&svm_bo->eviction_work)){+.+.}-{0:0}:
+       __lock_acquire+0x1426/0x2200
+       lock_acquire+0xc1/0x2b0
+       __flush_work+0x80/0x550
+       __cancel_work_timer+0x109/0x190
+       svm_range_bo_release+0xdc/0x1c0 [amdgpu]
+       svm_range_free+0x175/0x180 [amdgpu]
+       svm_range_deferred_list_work+0x15d/0x340 [amdgpu]
+       process_one_work+0x27a/0x540
+       worker_thread+0x53/0x3e0
+       kthread+0xeb/0x120
+       ret_from_fork+0x31/0x50
+       ret_from_fork_asm+0x11/0x20
+
+other info that might help us debug this:
+
+Chain exists of:
+  (work_completion)(&svm_bo->eviction_work) --> &mm->mmap_lock --> &svms->lock
+
+ Possible unsafe locking scenario:
+
+       CPU0                    CPU1
+       ----                    ----
+  lock(&svms->lock);
+                               lock(&mm->mmap_lock);
+                               lock(&svms->lock);
+  lock((work_completion)(&svm_bo->eviction_work));
+
+I believe this cannot really lead to a deadlock in practice, because
+svm_range_evict_svm_bo_worker only takes the mmap_read_lock if the BO
+refcount is non-0. That means it's impossible that svm_range_bo_release
+is running concurrently. However, there is no good way to annotate this.
+
+To avoid the problem, take a BO reference in
+svm_range_schedule_evict_svm_bo instead of in the worker. That way it's
+impossible for a BO to get freed while eviction work is pending and the
+cancel_work_sync call in svm_range_bo_release can be eliminated.
+
+v2: Use svm_bo_ref_unless_zero and explained why that's safe. Also
+removed redundant checks that are already done in
+amdkfd_fence_enable_signaling.
+
+Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
+Reviewed-by: Philip Yang <philip.yang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 26 ++++++++++----------------
+ 1 file changed, 10 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+index 208812512d8a..4ecc4be1a910 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+@@ -380,14 +380,9 @@ static void svm_range_bo_release(struct kref *kref)
+ 		spin_lock(&svm_bo->list_lock);
+ 	}
+ 	spin_unlock(&svm_bo->list_lock);
+-	if (!dma_fence_is_signaled(&svm_bo->eviction_fence->base)) {
+-		/* We're not in the eviction worker.
+-		 * Signal the fence and synchronize with any
+-		 * pending eviction work.
+-		 */
++	if (!dma_fence_is_signaled(&svm_bo->eviction_fence->base))
++		/* We're not in the eviction worker. Signal the fence. */
+ 		dma_fence_signal(&svm_bo->eviction_fence->base);
+-		cancel_work_sync(&svm_bo->eviction_work);
+-	}
+ 	dma_fence_put(&svm_bo->eviction_fence->base);
+ 	amdgpu_bo_unref(&svm_bo->bo);
+ 	kfree(svm_bo);
+@@ -3310,13 +3305,14 @@ svm_range_trigger_migration(struct mm_struct *mm, struct svm_range *prange,
+ 
+ int svm_range_schedule_evict_svm_bo(struct amdgpu_amdkfd_fence *fence)
+ {
+-	if (!fence)
+-		return -EINVAL;
+-
+-	if (dma_fence_is_signaled(&fence->base))
+-		return 0;
+-
+-	if (fence->svm_bo) {
++	/* Dereferencing fence->svm_bo is safe here because the fence hasn't
++	 * signaled yet and we're under the protection of the fence->lock.
++	 * After the fence is signaled in svm_range_bo_release, we cannot get
++	 * here any more.
++	 *
++	 * Reference is dropped in svm_range_evict_svm_bo_worker.
++	 */
++	if (svm_bo_ref_unless_zero(fence->svm_bo)) {
+ 		WRITE_ONCE(fence->svm_bo->evicting, 1);
+ 		schedule_work(&fence->svm_bo->eviction_work);
+ 	}
+@@ -3331,8 +3327,6 @@ static void svm_range_evict_svm_bo_worker(struct work_struct *work)
+ 	int r = 0;
+ 
+ 	svm_bo = container_of(work, struct svm_range_bo, eviction_work);
+-	if (!svm_bo_ref_unless_zero(svm_bo))
+-		return; /* svm_bo was freed while eviction was pending */
+ 
+ 	if (mmget_not_zero(svm_bo->eviction_fence->mm)) {
+ 		mm = svm_bo->eviction_fence->mm;
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-amdkfd-fix-node-null-check-in-svm_range_get_rang.patch b/queue-6.1/drm-amdkfd-fix-node-null-check-in-svm_range_get_rang.patch
new file mode 100644
index 00000000000..bed60f4ab92
--- /dev/null
+++ b/queue-6.1/drm-amdkfd-fix-node-null-check-in-svm_range_get_rang.patch
@@ -0,0 +1,67 @@
+From 8f564da6a56db9a4123594e70c6b8171deb703b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jan 2024 16:57:26 +0530
+Subject: drm/amdkfd: Fix 'node' NULL check in
+ 'svm_range_get_range_boundaries()'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit d7a254fad873775ce6c32b77796c81e81e6b7f2e ]
+
+Range interval [start, last] is ordered by rb_tree, rb_prev, rb_next
+return value still needs NULL check, thus modified from "node" to "rb_node".
+
+Fixes the below:
+drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_svm.c:2691 svm_range_get_range_boundaries() warn: can 'node' even be NULL?
+
+Suggested-by: Philip Yang <Philip.Yang@amd.com>
+Cc: Felix Kuehling <Felix.Kuehling@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+index 5188c4d2e7c0..7fa5e70f1aac 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+@@ -2553,6 +2553,7 @@ svm_range_get_range_boundaries(struct kfd_process *p, int64_t addr,
+ {
+ 	struct vm_area_struct *vma;
+ 	struct interval_tree_node *node;
++	struct rb_node *rb_node;
+ 	unsigned long start_limit, end_limit;
+ 
+ 	vma = find_vma(p->mm, addr << PAGE_SHIFT);
+@@ -2575,16 +2576,15 @@ svm_range_get_range_boundaries(struct kfd_process *p, int64_t addr,
+ 	if (node) {
+ 		end_limit = min(end_limit, node->start);
+ 		/* Last range that ends before the fault address */
+-		node = container_of(rb_prev(&node->rb),
+-				    struct interval_tree_node, rb);
++		rb_node = rb_prev(&node->rb);
+ 	} else {
+ 		/* Last range must end before addr because
+ 		 * there was no range after addr
+ 		 */
+-		node = container_of(rb_last(&p->svms.objects.rb_root),
+-				    struct interval_tree_node, rb);
++		rb_node = rb_last(&p->svms.objects.rb_root);
+ 	}
+-	if (node) {
++	if (rb_node) {
++		node = container_of(rb_node, struct interval_tree_node, rb);
+ 		if (node->last >= addr) {
+ 			WARN(1, "Overlap with prev node and page fault addr\n");
+ 			return -EFAULT;
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-bridge-anx7625-fix-set-hpd-irq-detect-window-to-.patch b/queue-6.1/drm-bridge-anx7625-fix-set-hpd-irq-detect-window-to-.patch
new file mode 100644
index 00000000000..aa868dc3ef9
--- /dev/null
+++ b/queue-6.1/drm-bridge-anx7625-fix-set-hpd-irq-detect-window-to-.patch
@@ -0,0 +1,119 @@
+From f9d51f738774a4358e35254d17fe01b075dfcd9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Nov 2023 17:10:37 +0800
+Subject: drm/bridge: anx7625: Fix Set HPD irq detect window to 2ms
+
+From: Xin Ji <xji@analogixsemi.com>
+
+[ Upstream commit e3af7053de3f685c96158373bc234b2feca1f160 ]
+
+Polling firmware HPD GPIO status, set HPD irq detect window to 2ms
+after firmware HPD GPIO initial done
+
+Signed-off-by: Xin Ji <xji@analogixsemi.com>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231120091038.284825-2-xji@analogixsemi.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/analogix/anx7625.c | 51 ++++++++++++++++-------
+ drivers/gpu/drm/bridge/analogix/anx7625.h |  4 ++
+ 2 files changed, 40 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c
+index 5f8137e9cfd7..77a304ac4d75 100644
+--- a/drivers/gpu/drm/bridge/analogix/anx7625.c
++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c
+@@ -1300,10 +1300,32 @@ static void anx7625_config(struct anx7625_data *ctx)
+ 			  XTAL_FRQ_SEL, XTAL_FRQ_27M);
+ }
+ 
++static int anx7625_hpd_timer_config(struct anx7625_data *ctx)
++{
++	int ret;
++
++	/* Set irq detect window to 2ms */
++	ret = anx7625_reg_write(ctx, ctx->i2c.tx_p2_client,
++				HPD_DET_TIMER_BIT0_7, HPD_TIME & 0xFF);
++	ret |= anx7625_reg_write(ctx, ctx->i2c.tx_p2_client,
++				 HPD_DET_TIMER_BIT8_15,
++				 (HPD_TIME >> 8) & 0xFF);
++	ret |= anx7625_reg_write(ctx, ctx->i2c.tx_p2_client,
++				 HPD_DET_TIMER_BIT16_23,
++				 (HPD_TIME >> 16) & 0xFF);
++
++	return ret;
++}
++
++static int anx7625_read_hpd_gpio_config_status(struct anx7625_data *ctx)
++{
++	return anx7625_reg_read(ctx, ctx->i2c.rx_p0_client, GPIO_CTRL_2);
++}
++
+ static void anx7625_disable_pd_protocol(struct anx7625_data *ctx)
+ {
+ 	struct device *dev = &ctx->client->dev;
+-	int ret;
++	int ret, val;
+ 
+ 	/* Reset main ocm */
+ 	ret = anx7625_reg_write(ctx, ctx->i2c.rx_p0_client, 0x88, 0x40);
+@@ -1317,6 +1339,19 @@ static void anx7625_disable_pd_protocol(struct anx7625_data *ctx)
+ 		DRM_DEV_DEBUG_DRIVER(dev, "disable PD feature fail.\n");
+ 	else
+ 		DRM_DEV_DEBUG_DRIVER(dev, "disable PD feature succeeded.\n");
++
++	/*
++	 * Make sure the HPD GPIO already be configured after OCM release before
++	 * setting HPD detect window register. Here we poll the status register
++	 * at maximum 40ms, then config HPD irq detect window register
++	 */
++	readx_poll_timeout(anx7625_read_hpd_gpio_config_status,
++			   ctx, val,
++			   ((val & HPD_SOURCE) || (val < 0)),
++			   2000, 2000 * 20);
++
++	/* Set HPD irq detect window to 2ms */
++	anx7625_hpd_timer_config(ctx);
+ }
+ 
+ static int anx7625_ocm_loading_check(struct anx7625_data *ctx)
+@@ -1440,20 +1475,6 @@ static void anx7625_start_dp_work(struct anx7625_data *ctx)
+ 
+ static int anx7625_read_hpd_status_p0(struct anx7625_data *ctx)
+ {
+-	int ret;
+-
+-	/* Set irq detect window to 2ms */
+-	ret = anx7625_reg_write(ctx, ctx->i2c.tx_p2_client,
+-				HPD_DET_TIMER_BIT0_7, HPD_TIME & 0xFF);
+-	ret |= anx7625_reg_write(ctx, ctx->i2c.tx_p2_client,
+-				 HPD_DET_TIMER_BIT8_15,
+-				 (HPD_TIME >> 8) & 0xFF);
+-	ret |= anx7625_reg_write(ctx, ctx->i2c.tx_p2_client,
+-				 HPD_DET_TIMER_BIT16_23,
+-				 (HPD_TIME >> 16) & 0xFF);
+-	if (ret < 0)
+-		return ret;
+-
+ 	return anx7625_reg_read(ctx, ctx->i2c.rx_p0_client, SYSTEM_STSTUS);
+ }
+ 
+diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.h b/drivers/gpu/drm/bridge/analogix/anx7625.h
+index 239956199e1b..164250c8c8b6 100644
+--- a/drivers/gpu/drm/bridge/analogix/anx7625.h
++++ b/drivers/gpu/drm/bridge/analogix/anx7625.h
+@@ -259,6 +259,10 @@
+ #define AP_MIPI_RX_EN BIT(5) /* 1: MIPI RX input in  0: no RX in */
+ #define AP_DISABLE_PD BIT(6)
+ #define AP_DISABLE_DISPLAY BIT(7)
++
++#define GPIO_CTRL_2   0x49
++#define HPD_SOURCE    BIT(6)
++
+ /***************************************************************/
+ /* Register definition of device address 0x84 */
+ #define  MIPI_PHY_CONTROL_3            0x03
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-drm_file-fix-use-of-uninitialized-variable.patch b/queue-6.1/drm-drm_file-fix-use-of-uninitialized-variable.patch
new file mode 100644
index 00000000000..77ab2d276d4
--- /dev/null
+++ b/queue-6.1/drm-drm_file-fix-use-of-uninitialized-variable.patch
@@ -0,0 +1,43 @@
+From 4b84e1cb640c2157d9f8e9c6628783776e2bda01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Nov 2023 15:14:03 +0200
+Subject: drm/drm_file: fix use of uninitialized variable
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 1d3062fad9c7313fff9970a88e0538a24480ffb8 ]
+
+smatch reports:
+
+drivers/gpu/drm/drm_file.c:967 drm_show_memory_stats() error: uninitialized symbol 'supported_status'.
+
+'supported_status' is only set in one code path. I'm not familiar with
+the code to say if that path will always be ran in real life, but
+whether that is the case or not, I think it is good to initialize
+'supported_status' to 0 to silence the warning (and possibly fix a bug).
+
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231103-uninit-fixes-v2-1-c22b2444f5f5@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
+index a8b4d918e9a3..d6a0572984b5 100644
+--- a/drivers/gpu/drm/drm_file.c
++++ b/drivers/gpu/drm/drm_file.c
+@@ -406,7 +406,7 @@ int drm_open(struct inode *inode, struct file *filp)
+ {
+ 	struct drm_device *dev;
+ 	struct drm_minor *minor;
+-	int retcode;
++	int retcode = 0;
+ 	int need_setup = 0;
+ 
+ 	minor = drm_minor_acquire(iminor(inode));
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-exynos-call-drm_atomic_helper_shutdown-at-shutdo.patch b/queue-6.1/drm-exynos-call-drm_atomic_helper_shutdown-at-shutdo.patch
new file mode 100644
index 00000000000..50dc598f69a
--- /dev/null
+++ b/queue-6.1/drm-exynos-call-drm_atomic_helper_shutdown-at-shutdo.patch
@@ -0,0 +1,86 @@
+From 6d649232a6df4d3f82c1f3b2115ab1aff4986f28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Sep 2023 12:26:52 -0700
+Subject: drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 16ac5b21b31b439f03cdf44c153c5f5af94fb3eb ]
+
+Based on grepping through the source code this driver appears to be
+missing a call to drm_atomic_helper_shutdown() at system shutdown time
+and at driver unbind time. Among other things, this means that if a
+panel is in use that it won't be cleanly powered off at system
+shutdown time.
+
+The fact that we should call drm_atomic_helper_shutdown() in the case
+of OS shutdown/restart and at driver remove (or unbind) time comes
+straight out of the kernel doc "driver instance overview" in
+drm_drv.c.
+
+A few notes about this fix:
+- When adding drm_atomic_helper_shutdown() to the unbind path, I added
+  it after drm_kms_helper_poll_fini() since that's when other drivers
+  seemed to have it.
+- Technically with a previous patch, ("drm/atomic-helper:
+  drm_atomic_helper_shutdown(NULL) should be a noop"), we don't
+  actually need to check to see if our "drm" pointer is NULL before
+  calling drm_atomic_helper_shutdown(). We'll leave the "if" test in,
+  though, so that this patch can land without any dependencies. It
+  could potentially be removed later.
+- This patch also makes sure to set the drvdata to NULL in the case of
+  bind errors to make sure that shutdown can't access freed data.
+
+Suggested-by: Maxime Ripard <mripard@kernel.org>
+Reviewed-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Reviewed-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Inki Dae <inki.dae@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/exynos/exynos_drm_drv.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
+index 16c539657f73..4095b0d3ac2e 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
+@@ -309,6 +309,7 @@ static int exynos_drm_bind(struct device *dev)
+ 	drm_mode_config_cleanup(drm);
+ 	exynos_drm_cleanup_dma(drm);
+ 	kfree(private);
++	dev_set_drvdata(dev, NULL);
+ err_free_drm:
+ 	drm_dev_put(drm);
+ 
+@@ -323,6 +324,7 @@ static void exynos_drm_unbind(struct device *dev)
+ 
+ 	exynos_drm_fbdev_fini(drm);
+ 	drm_kms_helper_poll_fini(drm);
++	drm_atomic_helper_shutdown(drm);
+ 
+ 	component_unbind_all(drm->dev, drm);
+ 	drm_mode_config_cleanup(drm);
+@@ -360,9 +362,18 @@ static int exynos_drm_platform_remove(struct platform_device *pdev)
+ 	return 0;
+ }
+ 
++static void exynos_drm_platform_shutdown(struct platform_device *pdev)
++{
++	struct drm_device *drm = platform_get_drvdata(pdev);
++
++	if (drm)
++		drm_atomic_helper_shutdown(drm);
++}
++
+ static struct platform_driver exynos_drm_platform_driver = {
+ 	.probe	= exynos_drm_platform_probe,
+ 	.remove	= exynos_drm_platform_remove,
++	.shutdown = exynos_drm_platform_shutdown,
+ 	.driver	= {
+ 		.name	= "exynos-drm",
+ 		.pm	= &exynos_drm_pm_ops,
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-fix-color-lut-rounding.patch b/queue-6.1/drm-fix-color-lut-rounding.patch
new file mode 100644
index 00000000000..fcb67ec5214
--- /dev/null
+++ b/queue-6.1/drm-fix-color-lut-rounding.patch
@@ -0,0 +1,100 @@
+From e8a78b7c4cfbdfec5fb226370530228335b1f1ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Oct 2023 16:13:59 +0300
+Subject: drm: Fix color LUT rounding
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+[ Upstream commit c6fbb6bca10838485b820e8a26c23996f77ce580 ]
+
+The current implementation of drm_color_lut_extract()
+generates weird results. Eg. if we go through all the
+values for 16->8bpc conversion we see the following pattern:
+
+in            out (count)
+   0 -   7f ->  0 (128)
+  80 -  17f ->  1 (256)
+ 180 -  27f ->  2 (256)
+ 280 -  37f ->  3 (256)
+...
+fb80 - fc7f -> fc (256)
+fc80 - fd7f -> fd (256)
+fd80 - fe7f -> fe (256)
+fe80 - ffff -> ff (384)
+
+So less values map to 0 and more values map 0xff, which
+doesn't seem particularly great.
+
+To get just the same number of input values to map to
+the same output values we'd just need to drop the rounding
+entrirely. But perhaps a better idea would be to follow the
+OpenGL int<->float conversion rules, in which case we get
+the following results:
+
+in            out (count)
+   0 -   80 ->  0 (129)
+  81 -  181 ->  1 (257)
+ 182 -  282 ->  2 (257)
+ 283 -  383 ->  3 (257)
+...
+fc7c - fd7c -> fc (257)
+fd7d - fe7d -> fd (257)
+fe7e - ff7e -> fe (257)
+ff7f - ffff -> ff (129)
+
+Note that since the divisor is constant the compiler
+is able to optimize away the integer division in most
+cases. The only exception is the _ULL() case on 32bit
+architectures since that gets emitted as inline asm
+via do_div() and thus the compiler doesn't get to
+optimize it.
+
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231013131402.24072-2-ville.syrjala@linux.intel.com
+Reviewed-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
+Reviewed-by: Jani Nikula <jani.nikula@intel.com>
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/drm/drm_color_mgmt.h | 19 ++++++++-----------
+ 1 file changed, 8 insertions(+), 11 deletions(-)
+
+diff --git a/include/drm/drm_color_mgmt.h b/include/drm/drm_color_mgmt.h
+index 81c298488b0c..54b2b2467bfd 100644
+--- a/include/drm/drm_color_mgmt.h
++++ b/include/drm/drm_color_mgmt.h
+@@ -36,20 +36,17 @@ struct drm_plane;
+  *
+  * Extract a degamma/gamma LUT value provided by user (in the form of
+  * &drm_color_lut entries) and round it to the precision supported by the
+- * hardware.
++ * hardware, following OpenGL int<->float conversion rules
++ * (see eg. OpenGL 4.6 specification - 2.3.5 Fixed-Point Data Conversions).
+  */
+ static inline u32 drm_color_lut_extract(u32 user_input, int bit_precision)
+ {
+-	u32 val = user_input;
+-	u32 max = 0xffff >> (16 - bit_precision);
+-
+-	/* Round only if we're not using full precision. */
+-	if (bit_precision < 16) {
+-		val += 1UL << (16 - bit_precision - 1);
+-		val >>= 16 - bit_precision;
+-	}
+-
+-	return clamp_val(val, 0, max);
++	if (bit_precision > 16)
++		return DIV_ROUND_CLOSEST_ULL(mul_u32_u32(user_input, (1 << bit_precision) - 1),
++					     (1 << 16) - 1);
++	else
++		return DIV_ROUND_CLOSEST(user_input * ((1 << bit_precision) - 1),
++					 (1 << 16) - 1);
+ }
+ 
+ u64 drm_color_ctm_s31_32_to_qm_n(u64 user_input, u32 m, u32 n);
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-framebuffer-fix-use-of-uninitialized-variable.patch b/queue-6.1/drm-framebuffer-fix-use-of-uninitialized-variable.patch
new file mode 100644
index 00000000000..9f6da120cd0
--- /dev/null
+++ b/queue-6.1/drm-framebuffer-fix-use-of-uninitialized-variable.patch
@@ -0,0 +1,42 @@
+From ece4bb866ee40b5f760af6c9205d1bd5db30fcde Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Nov 2023 15:14:04 +0200
+Subject: drm/framebuffer: Fix use of uninitialized variable
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit f9af8f0c1dc567a5a6a6318ff324c45d80d4a60f ]
+
+smatch reports:
+
+drivers/gpu/drm/drm_framebuffer.c:654 drm_mode_getfb2_ioctl() error: uninitialized symbol 'ret'.
+
+'ret' is possibly not set when there are no errors, causing the error
+above. I can't say if that ever happens in real-life, but in any case I
+think it is good to initialize 'ret' to 0.
+
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231103-uninit-fixes-v2-2-c22b2444f5f5@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_framebuffer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c
+index 2dd97473ca10..72ad1715f8e7 100644
+--- a/drivers/gpu/drm/drm_framebuffer.c
++++ b/drivers/gpu/drm/drm_framebuffer.c
+@@ -570,7 +570,7 @@ int drm_mode_getfb2_ioctl(struct drm_device *dev,
+ 	struct drm_mode_fb_cmd2 *r = data;
+ 	struct drm_framebuffer *fb;
+ 	unsigned int i;
+-	int ret;
++	int ret = 0;
+ 
+ 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ 		return -EINVAL;
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-mipi-dsi-fix-detach-call-without-attach.patch b/queue-6.1/drm-mipi-dsi-fix-detach-call-without-attach.patch
new file mode 100644
index 00000000000..258efbf077c
--- /dev/null
+++ b/queue-6.1/drm-mipi-dsi-fix-detach-call-without-attach.patch
@@ -0,0 +1,138 @@
+From d30ba6dc6567de8488c4a20b3bae38f1fe676009 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Sep 2023 13:50:32 +0300
+Subject: drm/mipi-dsi: Fix detach call without attach
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 90d50b8d85834e73536fdccd5aa913b30494fef0 ]
+
+It's been reported that DSI host driver's detach can be called without
+the attach ever happening:
+
+https://lore.kernel.org/all/20230412073954.20601-1-tony@atomide.com/
+
+After reading the code, I think this is what happens:
+
+We have a DSI host defined in the device tree and a DSI peripheral under
+that host (i.e. an i2c device using the DSI as data bus doesn't exhibit
+this behavior).
+
+The host driver calls mipi_dsi_host_register(), which causes (via a few
+functions) mipi_dsi_device_add() to be called for the DSI peripheral. So
+now we have a DSI device under the host, but attach hasn't been called.
+
+Normally the probing of the devices continues, and eventually the DSI
+peripheral's driver will call mipi_dsi_attach(), attaching the
+peripheral.
+
+However, if the host driver's probe encounters an error after calling
+mipi_dsi_host_register(), and before the peripheral has called
+mipi_dsi_attach(), the host driver will do cleanups and return an error
+from its probe function. The cleanups include calling
+mipi_dsi_host_unregister().
+
+mipi_dsi_host_unregister() will call two functions for all its DSI
+peripheral devices: mipi_dsi_detach() and mipi_dsi_device_unregister().
+The latter makes sense, as the device exists, but the former may be
+wrong as attach has not necessarily been done.
+
+To fix this, track the attached state of the peripheral, and only detach
+from mipi_dsi_host_unregister() if the peripheral was attached.
+
+Note that I have only tested this with a board with an i2c DSI
+peripheral, not with a "pure" DSI peripheral.
+
+However, slightly related, the unregister machinery still seems broken.
+E.g. if the DSI host driver is unbound, it'll detach and unregister the
+DSI peripherals. After that, when the DSI peripheral driver unbound
+it'll call detach either directly or using the devm variant, leading to
+a crash. And probably the driver will crash if it happens, for some
+reason, to try to send a message via the DSI bus.
+
+But that's another topic.
+
+Tested-by: H. Nikolaus Schaller <hns@goldelico.com>
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Tested-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230921-dsi-detach-fix-v1-1-d0de2d1621d9@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_mipi_dsi.c | 17 +++++++++++++++--
+ include/drm/drm_mipi_dsi.h     |  2 ++
+ 2 files changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c
+index 853208e8dd73..ef7ec68867df 100644
+--- a/drivers/gpu/drm/drm_mipi_dsi.c
++++ b/drivers/gpu/drm/drm_mipi_dsi.c
+@@ -346,7 +346,8 @@ static int mipi_dsi_remove_device_fn(struct device *dev, void *priv)
+ {
+ 	struct mipi_dsi_device *dsi = to_mipi_dsi_device(dev);
+ 
+-	mipi_dsi_detach(dsi);
++	if (dsi->attached)
++		mipi_dsi_detach(dsi);
+ 	mipi_dsi_device_unregister(dsi);
+ 
+ 	return 0;
+@@ -369,11 +370,18 @@ EXPORT_SYMBOL(mipi_dsi_host_unregister);
+ int mipi_dsi_attach(struct mipi_dsi_device *dsi)
+ {
+ 	const struct mipi_dsi_host_ops *ops = dsi->host->ops;
++	int ret;
+ 
+ 	if (!ops || !ops->attach)
+ 		return -ENOSYS;
+ 
+-	return ops->attach(dsi->host, dsi);
++	ret = ops->attach(dsi->host, dsi);
++	if (ret)
++		return ret;
++
++	dsi->attached = true;
++
++	return 0;
+ }
+ EXPORT_SYMBOL(mipi_dsi_attach);
+ 
+@@ -385,9 +393,14 @@ int mipi_dsi_detach(struct mipi_dsi_device *dsi)
+ {
+ 	const struct mipi_dsi_host_ops *ops = dsi->host->ops;
+ 
++	if (WARN_ON(!dsi->attached))
++		return -EINVAL;
++
+ 	if (!ops || !ops->detach)
+ 		return -ENOSYS;
+ 
++	dsi->attached = false;
++
+ 	return ops->detach(dsi->host, dsi);
+ }
+ EXPORT_SYMBOL(mipi_dsi_detach);
+diff --git a/include/drm/drm_mipi_dsi.h b/include/drm/drm_mipi_dsi.h
+index 9054a5185e1a..31171914990a 100644
+--- a/include/drm/drm_mipi_dsi.h
++++ b/include/drm/drm_mipi_dsi.h
+@@ -168,6 +168,7 @@ struct mipi_dsi_device_info {
+  * struct mipi_dsi_device - DSI peripheral device
+  * @host: DSI host for this peripheral
+  * @dev: driver model device node for this peripheral
++ * @attached: the DSI device has been successfully attached
+  * @name: DSI peripheral chip type
+  * @channel: virtual channel assigned to the peripheral
+  * @format: pixel format for video mode
+@@ -184,6 +185,7 @@ struct mipi_dsi_device_info {
+ struct mipi_dsi_device {
+ 	struct mipi_dsi_host *host;
+ 	struct device dev;
++	bool attached;
+ 
+ 	char name[DSI_DEV_NAME_SIZE];
+ 	unsigned int channel;
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-msm-dpu-fix-writeback-programming-for-yuv-cases.patch b/queue-6.1/drm-msm-dpu-fix-writeback-programming-for-yuv-cases.patch
new file mode 100644
index 00000000000..8c104eea78f
--- /dev/null
+++ b/queue-6.1/drm-msm-dpu-fix-writeback-programming-for-yuv-cases.patch
@@ -0,0 +1,44 @@
+From 42df75657e0d6152a4c88ab74f7118e1e5817763 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Dec 2023 12:52:41 -0800
+Subject: drm/msm/dpu: fix writeback programming for YUV cases
+
+From: Abhinav Kumar <quic_abhinavk@quicinc.com>
+
+[ Upstream commit 79caf2f2202b9eaad3a5a726e4b33807f67d0f1b ]
+
+For YUV cases, setting the required format bits was missed
+out in the register programming. Lets fix it now in preparation
+of adding YUV formats support for writeback.
+
+changes in v2:
+    - dropped the fixes tag as its not a fix but adding
+      new functionality
+
+Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/571814/
+Link: https://lore.kernel.org/r/20231212205254.12422-4-quic_abhinavk@quicinc.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c
+index a3e413d27717..63dc2ee446d4 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_wb.c
+@@ -105,6 +105,9 @@ static void dpu_hw_wb_setup_format(struct dpu_hw_wb *ctx,
+ 			dst_format |= BIT(14); /* DST_ALPHA_X */
+ 	}
+ 
++	if (DPU_FORMAT_IS_YUV(fmt))
++		dst_format |= BIT(15);
++
+ 	pattern = (fmt->element[3] << 24) |
+ 		(fmt->element[2] << 16) |
+ 		(fmt->element[1] << 8)  |
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-msm-dpu-ratelimit-framedone-timeout-msgs.patch b/queue-6.1/drm-msm-dpu-ratelimit-framedone-timeout-msgs.patch
new file mode 100644
index 00000000000..66cbfd5248e
--- /dev/null
+++ b/queue-6.1/drm-msm-dpu-ratelimit-framedone-timeout-msgs.patch
@@ -0,0 +1,62 @@
+From efc023c74d9654788ce3d7ac59904b72ff018e78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Dec 2023 10:19:55 -0800
+Subject: drm/msm/dpu: Ratelimit framedone timeout msgs
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit 2b72e50c62de60ad2d6bcd86aa38d4ccbdd633f2 ]
+
+When we start getting these, we get a *lot*.  So ratelimit it to not
+flood dmesg.
+
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Reviewed-by: Marijn Suijten <marijn.suijten@somainline.org>
+Patchwork: https://patchwork.freedesktop.org/patch/571584/
+Link: https://lore.kernel.org/r/20231211182000.218088-1-robdclark@gmail.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 5 ++++-
+ drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h     | 1 +
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+index b0eb881f8af1..38d38f923df6 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+@@ -38,6 +38,9 @@
+ #define DPU_ERROR_ENC(e, fmt, ...) DPU_ERROR("enc%d " fmt,\
+ 		(e) ? (e)->base.base.id : -1, ##__VA_ARGS__)
+ 
++#define DPU_ERROR_ENC_RATELIMITED(e, fmt, ...) DPU_ERROR_RATELIMITED("enc%d " fmt,\
++		(e) ? (e)->base.base.id : -1, ##__VA_ARGS__)
++
+ /*
+  * Two to anticipate panels that can do cmd/vid dynamic switching
+  * plan is to create all possible physical encoder types, and switch between
+@@ -2385,7 +2388,7 @@ static void dpu_encoder_frame_done_timeout(struct timer_list *t)
+ 		return;
+ 	}
+ 
+-	DPU_ERROR_ENC(dpu_enc, "frame done timeout\n");
++	DPU_ERROR_ENC_RATELIMITED(dpu_enc, "frame done timeout\n");
+ 
+ 	event = DPU_ENCODER_FRAME_EVENT_ERROR;
+ 	trace_dpu_enc_frame_done_timeout(DRMID(drm_enc), event);
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h
+index ed80ed6784ee..bb35aa5f5709 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.h
+@@ -51,6 +51,7 @@
+ 	} while (0)
+ 
+ #define DPU_ERROR(fmt, ...) pr_err("[dpu error]" fmt, ##__VA_ARGS__)
++#define DPU_ERROR_RATELIMITED(fmt, ...) pr_err_ratelimited("[dpu error]" fmt, ##__VA_ARGS__)
+ 
+ /**
+  * ktime_compare_safe - compare two ktime structures
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-panel-edp-add-override_edid_mode-quirk-for-gener.patch b/queue-6.1/drm-panel-edp-add-override_edid_mode-quirk-for-gener.patch
new file mode 100644
index 00000000000..e2bbf6c18ae
--- /dev/null
+++ b/queue-6.1/drm-panel-edp-add-override_edid_mode-quirk-for-gener.patch
@@ -0,0 +1,112 @@
+From 75e064f4f1be5f1ca48bb56d329c489e79e821d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Nov 2023 13:46:32 -0800
+Subject: drm/panel-edp: Add override_edid_mode quirk for generic edp
+
+From: Hsin-Yi Wang <hsinyi@chromium.org>
+
+[ Upstream commit 9f7843b515811aea6c56527eb195b622e9c01f12 ]
+
+Generic edp gets mode from edid. However, some panels report incorrect
+mode in this way, resulting in glitches on panel. Introduce a new quirk
+additional_mode to the generic edid to pick a correct hardcoded mode.
+
+Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231117215056.1883314-2-hsinyi@chromium.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-edp.c | 48 +++++++++++++++++++++++++++++--
+ 1 file changed, 45 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
+index ecd6238749f7..42584d8a9aeb 100644
+--- a/drivers/gpu/drm/panel/panel-edp.c
++++ b/drivers/gpu/drm/panel/panel-edp.c
+@@ -203,6 +203,9 @@ struct edp_panel_entry {
+ 
+ 	/** @name: Name of this panel (for printing to logs). */
+ 	const char *name;
++
++	/** @override_edid_mode: Override the mode obtained by edid. */
++	const struct drm_display_mode *override_edid_mode;
+ };
+ 
+ struct panel_edp {
+@@ -301,6 +304,24 @@ static unsigned int panel_edp_get_display_modes(struct panel_edp *panel,
+ 	return num;
+ }
+ 
++static int panel_edp_override_edid_mode(struct panel_edp *panel,
++					struct drm_connector *connector,
++					const struct drm_display_mode *override_mode)
++{
++	struct drm_display_mode *mode;
++
++	mode = drm_mode_duplicate(connector->dev, override_mode);
++	if (!mode) {
++		dev_err(panel->base.dev, "failed to add additional mode\n");
++		return 0;
++	}
++
++	mode->type |= DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
++	drm_mode_set_name(mode);
++	drm_mode_probed_add(connector, mode);
++	return 1;
++}
++
+ static int panel_edp_get_non_edid_modes(struct panel_edp *panel,
+ 					struct drm_connector *connector)
+ {
+@@ -568,6 +589,9 @@ static int panel_edp_get_modes(struct drm_panel *panel,
+ {
+ 	struct panel_edp *p = to_panel_edp(panel);
+ 	int num = 0;
++	bool has_override_edid_mode = p->detected_panel &&
++				      p->detected_panel != ERR_PTR(-EINVAL) &&
++				      p->detected_panel->override_edid_mode;
+ 
+ 	/* probe EDID if a DDC bus is available */
+ 	if (p->ddc) {
+@@ -575,9 +599,18 @@ static int panel_edp_get_modes(struct drm_panel *panel,
+ 
+ 		if (!p->edid)
+ 			p->edid = drm_get_edid(connector, p->ddc);
+-
+-		if (p->edid)
+-			num += drm_add_edid_modes(connector, p->edid);
++		if (p->edid) {
++			if (has_override_edid_mode) {
++				/*
++				 * override_edid_mode is specified. Use
++				 * override_edid_mode instead of from edid.
++				 */
++				num += panel_edp_override_edid_mode(p, connector,
++						p->detected_panel->override_edid_mode);
++			} else {
++				num += drm_add_edid_modes(connector, p->edid);
++			}
++		}
+ 
+ 		pm_runtime_mark_last_busy(panel->dev);
+ 		pm_runtime_put_autosuspend(panel->dev);
+@@ -1861,6 +1894,15 @@ static const struct panel_delay delay_200_500_e200 = {
+ 	.delay = _delay \
+ }
+ 
++#define EDP_PANEL_ENTRY2(vend_chr_0, vend_chr_1, vend_chr_2, product_id, _delay, _name, _mode) \
++{ \
++	.name = _name, \
++	.panel_id = drm_edid_encode_panel_id(vend_chr_0, vend_chr_1, vend_chr_2, \
++					     product_id), \
++	.delay = _delay, \
++	.override_edid_mode = _mode \
++}
++
+ /*
+  * This table is used to figure out power sequencing delays for panels that
+  * are detected by EDID. Entries here may point to entries in the
+-- 
+2.43.0
+
diff --git a/queue-6.1/drm-using-mul_u32_u32-requires-linux-math64.h.patch b/queue-6.1/drm-using-mul_u32_u32-requires-linux-math64.h.patch
new file mode 100644
index 00000000000..75b233df3e3
--- /dev/null
+++ b/queue-6.1/drm-using-mul_u32_u32-requires-linux-math64.h.patch
@@ -0,0 +1,45 @@
+From 46040ab342ce25fde1cba982d55987c092896695 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 14:57:34 +1100
+Subject: drm: using mul_u32_u32() requires linux/math64.h
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stephen Rothwell <sfr@canb.auug.org.au>
+
+[ Upstream commit 933a2a376fb3f22ba4774f74233571504ac56b02 ]
+
+Some pending include file cleanups produced this error:
+
+In file included from include/linux/kernel.h:27,
+                 from drivers/gpu/ipu-v3/ipu-dp.c:7:
+include/drm/drm_color_mgmt.h: In function 'drm_color_lut_extract':
+include/drm/drm_color_mgmt.h:45:46: error: implicit declaration of function 'mul_u32_u32' [-Werror=implicit-function-declaration]
+   45 |                 return DIV_ROUND_CLOSEST_ULL(mul_u32_u32(user_input, (1 << bit_precision) - 1),
+      |                                              ^~~~~~~~~~~
+
+Fixes: c6fbb6bca108 ("drm: Fix color LUT rounding")
+Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231219145734.13e40e1e@canb.auug.org.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/drm/drm_color_mgmt.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/drm/drm_color_mgmt.h b/include/drm/drm_color_mgmt.h
+index 54b2b2467bfd..ed81741036d7 100644
+--- a/include/drm/drm_color_mgmt.h
++++ b/include/drm/drm_color_mgmt.h
+@@ -24,6 +24,7 @@
+ #define __DRM_COLOR_MGMT_H__
+ 
+ #include <linux/ctype.h>
++#include <linux/math64.h>
+ #include <drm/drm_property.h>
+ 
+ struct drm_crtc;
+-- 
+2.43.0
+
diff --git a/queue-6.1/ecryptfs-reject-casefold-directory-inodes.patch b/queue-6.1/ecryptfs-reject-casefold-directory-inodes.patch
new file mode 100644
index 00000000000..857007d104a
--- /dev/null
+++ b/queue-6.1/ecryptfs-reject-casefold-directory-inodes.patch
@@ -0,0 +1,46 @@
+From eb49c06ed17caba5082882cadceafd50313c2ed1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Aug 2023 14:38:12 -0400
+Subject: ecryptfs: Reject casefold directory inodes
+
+From: Gabriel Krisman Bertazi <krisman@suse.de>
+
+[ Upstream commit cd72c7ef5fed44272272a105b1da22810c91be69 ]
+
+Even though it seems to be able to resolve some names of
+case-insensitive directories, the lack of d_hash and d_compare means we
+end up with a broken state in the d_cache.  Considering it was never a
+goal to support these two together, and we are preparing to use
+d_revalidate in case-insensitive filesystems, which would make the
+combination even more broken, reject any attempt to get a casefolded
+inode from ecryptfs.
+
+Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de>
+Reviewed-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ecryptfs/inode.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
+index c214fe0981bd..55340ac61456 100644
+--- a/fs/ecryptfs/inode.c
++++ b/fs/ecryptfs/inode.c
+@@ -76,6 +76,14 @@ static struct inode *__ecryptfs_get_inode(struct inode *lower_inode,
+ 
+ 	if (lower_inode->i_sb != ecryptfs_superblock_to_lower(sb))
+ 		return ERR_PTR(-EXDEV);
++
++	/* Reject dealing with casefold directories. */
++	if (IS_CASEFOLDED(lower_inode)) {
++		pr_err_ratelimited("%s: Can't handle casefolded directory.\n",
++				   __func__);
++		return ERR_PTR(-EREMOTE);
++	}
++
+ 	if (!igrab(lower_inode))
+ 		return ERR_PTR(-ESTALE);
+ 	inode = iget5_locked(sb, (unsigned long)lower_inode,
+-- 
+2.43.0
+
diff --git a/queue-6.1/erofs-fix-ztailpacking-for-subpage-compressed-blocks.patch b/queue-6.1/erofs-fix-ztailpacking-for-subpage-compressed-blocks.patch
new file mode 100644
index 00000000000..51168ac4856
--- /dev/null
+++ b/queue-6.1/erofs-fix-ztailpacking-for-subpage-compressed-blocks.patch
@@ -0,0 +1,44 @@
+From 090a3e4bbf79ff565581365f93f900258f36c13f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Dec 2023 00:13:37 +0800
+Subject: erofs: fix ztailpacking for subpage compressed blocks
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+[ Upstream commit e5aba911dee5e20fa82efbe13e0af8f38ea459e7 ]
+
+`pageofs_in` should be the compressed data offset of the page rather
+than of the block.
+
+Acked-by: Chao Yu <chao@kernel.org>
+Reviewed-by: Yue Hu <huyue2@coolpad.com>
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Link: https://lore.kernel.org/r/20231214161337.753049-1-hsiangkao@linux.alibaba.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/zdata.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
+index cf9a2fa7f55d..47e71964eeff 100644
+--- a/fs/erofs/zdata.c
++++ b/fs/erofs/zdata.c
+@@ -652,7 +652,6 @@ static int z_erofs_register_pcluster(struct z_erofs_decompress_frontend *fe)
+ 
+ 	if (ztailpacking) {
+ 		pcl->obj.index = 0;	/* which indicates ztailpacking */
+-		pcl->pageofs_in = erofs_blkoff(map->m_pa);
+ 		pcl->tailpacking_size = map->m_plen;
+ 	} else {
+ 		pcl->obj.index = map->m_pa >> PAGE_SHIFT;
+@@ -852,6 +851,7 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe,
+ 		get_page(fe->map.buf.page);
+ 		WRITE_ONCE(fe->pcl->compressed_bvecs[0].page,
+ 			   fe->map.buf.page);
++		fe->pcl->pageofs_in = map->m_pa & ~PAGE_MASK;
+ 		fe->mode = Z_EROFS_PCLUSTER_FOLLOWED_NOINPLACE;
+ 	} else {
+ 		/* bind cache first when cached decompression is preferred */
+-- 
+2.43.0
+
diff --git a/queue-6.1/ext4-avoid-online-resizing-failures-due-to-oversized.patch b/queue-6.1/ext4-avoid-online-resizing-failures-due-to-oversized.patch
new file mode 100644
index 00000000000..d6f3b427111
--- /dev/null
+++ b/queue-6.1/ext4-avoid-online-resizing-failures-due-to-oversized.patch
@@ -0,0 +1,133 @@
+From c48ef83e30e5c906e55b8d9dc88f95c8d2303006 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Oct 2023 09:30:56 +0800
+Subject: ext4: avoid online resizing failures due to oversized flex bg
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Baokun Li <libaokun1@huawei.com>
+
+[ Upstream commit 5d1935ac02ca5aee364a449a35e2977ea84509b0 ]
+
+When we online resize an ext4 filesystem with a oversized flexbg_size,
+
+     mkfs.ext4 -F -G 67108864 $dev -b 4096 100M
+     mount $dev $dir
+     resize2fs $dev 16G
+
+the following WARN_ON is triggered:
+==================================================================
+WARNING: CPU: 0 PID: 427 at mm/page_alloc.c:4402 __alloc_pages+0x411/0x550
+Modules linked in: sg(E)
+CPU: 0 PID: 427 Comm: resize2fs Tainted: G  E  6.6.0-rc5+ #314
+RIP: 0010:__alloc_pages+0x411/0x550
+Call Trace:
+ <TASK>
+ __kmalloc_large_node+0xa2/0x200
+ __kmalloc+0x16e/0x290
+ ext4_resize_fs+0x481/0xd80
+ __ext4_ioctl+0x1616/0x1d90
+ ext4_ioctl+0x12/0x20
+ __x64_sys_ioctl+0xf0/0x150
+ do_syscall_64+0x3b/0x90
+==================================================================
+
+This is because flexbg_size is too large and the size of the new_group_data
+array to be allocated exceeds MAX_ORDER. Currently, the minimum value of
+MAX_ORDER is 8, the minimum value of PAGE_SIZE is 4096, the corresponding
+maximum number of groups that can be allocated is:
+
+ (PAGE_SIZE << MAX_ORDER) / sizeof(struct ext4_new_group_data) ≈ 21845
+
+And the value that is down-aligned to the power of 2 is 16384. Therefore,
+this value is defined as MAX_RESIZE_BG, and the number of groups added
+each time does not exceed this value during resizing, and is added multiple
+times to complete the online resizing. The difference is that the metadata
+in a flex_bg may be more dispersed.
+
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20231023013057.2117948-4-libaokun1@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/resize.c | 25 +++++++++++++++++--------
+ 1 file changed, 17 insertions(+), 8 deletions(-)
+
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index e76270ee7fe5..f2ed15af703a 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -231,10 +231,17 @@ struct ext4_new_flex_group_data {
+ 						   in the flex group */
+ 	__u16 *bg_flags;			/* block group flags of groups
+ 						   in @groups */
++	ext4_group_t resize_bg;			/* number of allocated
++						   new_group_data */
+ 	ext4_group_t count;			/* number of groups in @groups
+ 						 */
+ };
+ 
++/*
++ * Avoiding memory allocation failures due to too many groups added each time.
++ */
++#define MAX_RESIZE_BG				16384
++
+ /*
+  * alloc_flex_gd() allocates a ext4_new_flex_group_data with size of
+  * @flexbg_size.
+@@ -249,14 +256,18 @@ static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned int flexbg_size)
+ 	if (flex_gd == NULL)
+ 		goto out3;
+ 
+-	flex_gd->count = flexbg_size;
+-	flex_gd->groups = kmalloc_array(flexbg_size,
++	if (unlikely(flexbg_size > MAX_RESIZE_BG))
++		flex_gd->resize_bg = MAX_RESIZE_BG;
++	else
++		flex_gd->resize_bg = flexbg_size;
++
++	flex_gd->groups = kmalloc_array(flex_gd->resize_bg,
+ 					sizeof(struct ext4_new_group_data),
+ 					GFP_NOFS);
+ 	if (flex_gd->groups == NULL)
+ 		goto out2;
+ 
+-	flex_gd->bg_flags = kmalloc_array(flexbg_size, sizeof(__u16),
++	flex_gd->bg_flags = kmalloc_array(flex_gd->resize_bg, sizeof(__u16),
+ 					  GFP_NOFS);
+ 	if (flex_gd->bg_flags == NULL)
+ 		goto out1;
+@@ -1620,8 +1631,7 @@ static int ext4_flex_group_add(struct super_block *sb,
+ 
+ static int ext4_setup_next_flex_gd(struct super_block *sb,
+ 				    struct ext4_new_flex_group_data *flex_gd,
+-				    ext4_fsblk_t n_blocks_count,
+-				    unsigned int flexbg_size)
++				    ext4_fsblk_t n_blocks_count)
+ {
+ 	struct ext4_sb_info *sbi = EXT4_SB(sb);
+ 	struct ext4_super_block *es = sbi->s_es;
+@@ -1645,7 +1655,7 @@ static int ext4_setup_next_flex_gd(struct super_block *sb,
+ 	BUG_ON(last);
+ 	ext4_get_group_no_and_offset(sb, n_blocks_count - 1, &n_group, &last);
+ 
+-	last_group = group | (flexbg_size - 1);
++	last_group = group | (flex_gd->resize_bg - 1);
+ 	if (last_group > n_group)
+ 		last_group = n_group;
+ 
+@@ -2150,8 +2160,7 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count)
+ 	/* Add flex groups. Note that a regular group is a
+ 	 * flex group with 1 group.
+ 	 */
+-	while (ext4_setup_next_flex_gd(sb, flex_gd, n_blocks_count,
+-					      flexbg_size)) {
++	while (ext4_setup_next_flex_gd(sb, flex_gd, n_blocks_count)) {
+ 		if (time_is_before_jiffies(last_update_time + HZ * 10)) {
+ 			if (last_update_time)
+ 				ext4_msg(sb, KERN_INFO,
+-- 
+2.43.0
+
diff --git a/queue-6.1/ext4-fix-inconsistent-between-segment-fstrim-and-ful.patch b/queue-6.1/ext4-fix-inconsistent-between-segment-fstrim-and-ful.patch
new file mode 100644
index 00000000000..0a4cafb7302
--- /dev/null
+++ b/queue-6.1/ext4-fix-inconsistent-between-segment-fstrim-and-ful.patch
@@ -0,0 +1,66 @@
+From e97d10588956a9d5d6ac27b4a16ffc8d6bfa6365 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Dec 2023 09:09:19 +0800
+Subject: ext4: fix inconsistent between segment fstrim and full fstrim
+
+From: Ye Bin <yebin10@huawei.com>
+
+[ Upstream commit 68da4c44b994aea797eb9821acb3a4a36015293e ]
+
+Suppose we issue two FITRIM ioctls for ranges [0,15] and [16,31] with
+mininum length of trimmed range set to 8 blocks. If we have say a range of
+blocks 10-22 free, this range will not be trimmed because it straddles the
+boundary of the two FITRIM ranges and neither part is big enough. This is a
+bit surprising to some users that call FITRIM on smaller ranges of blocks
+to limit impact on the system. Also XFS trims all free space extents that
+overlap with the specified range so we are inconsistent among filesystems.
+Let's change ext4_try_to_trim_range() to consider for trimming the whole
+free space extent that straddles the end of specified range, not just the
+part of it within the range.
+
+Signed-off-by: Ye Bin <yebin10@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20231216010919.1995851-1-yebin10@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/mballoc.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 33be702d6e38..c1515daf1def 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -6444,13 +6444,15 @@ static int ext4_try_to_trim_range(struct super_block *sb,
+ __acquires(ext4_group_lock_ptr(sb, e4b->bd_group))
+ __releases(ext4_group_lock_ptr(sb, e4b->bd_group))
+ {
+-	ext4_grpblk_t next, count, free_count;
++	ext4_grpblk_t next, count, free_count, last, origin_start;
+ 	bool set_trimmed = false;
+ 	void *bitmap;
+ 
++	last = ext4_last_grp_cluster(sb, e4b->bd_group);
+ 	bitmap = e4b->bd_bitmap;
+-	if (start == 0 && max >= ext4_last_grp_cluster(sb, e4b->bd_group))
++	if (start == 0 && max >= last)
+ 		set_trimmed = true;
++	origin_start = start;
+ 	start = max(e4b->bd_info->bb_first_free, start);
+ 	count = 0;
+ 	free_count = 0;
+@@ -6459,7 +6461,10 @@ __releases(ext4_group_lock_ptr(sb, e4b->bd_group))
+ 		start = mb_find_next_zero_bit(bitmap, max + 1, start);
+ 		if (start > max)
+ 			break;
+-		next = mb_find_next_bit(bitmap, max + 1, start);
++
++		next = mb_find_next_bit(bitmap, last + 1, start);
++		if (origin_start == 0 && next >= last)
++			set_trimmed = true;
+ 
+ 		if ((next - start) >= minblocks) {
+ 			int ret = ext4_trim_extent(sb, start, next - start, e4b);
+-- 
+2.43.0
+
diff --git a/queue-6.1/ext4-remove-unnecessary-check-from-alloc_flex_gd.patch b/queue-6.1/ext4-remove-unnecessary-check-from-alloc_flex_gd.patch
new file mode 100644
index 00000000000..327e8e440e7
--- /dev/null
+++ b/queue-6.1/ext4-remove-unnecessary-check-from-alloc_flex_gd.patch
@@ -0,0 +1,44 @@
+From 6f7f81eba74fbaf781f299145c4bd5559a911569 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Oct 2023 09:30:55 +0800
+Subject: ext4: remove unnecessary check from alloc_flex_gd()
+
+From: Baokun Li <libaokun1@huawei.com>
+
+[ Upstream commit b099eb87de105cf07cad731ded6fb40b2675108b ]
+
+In commit 967ac8af4475 ("ext4: fix potential integer overflow in
+alloc_flex_gd()"), an overflow check is added to alloc_flex_gd() to
+prevent the allocated memory from being smaller than expected due to
+the overflow. However, after kmalloc() is replaced with kmalloc_array()
+in commit 6da2ec56059c ("treewide: kmalloc() -> kmalloc_array()"), the
+kmalloc_array() function has an overflow check, so the above problem
+will not occur. Therefore, the extra check is removed.
+
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20231023013057.2117948-3-libaokun1@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/resize.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index 31f5da7f9f6c..e76270ee7fe5 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -249,10 +249,7 @@ static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned int flexbg_size)
+ 	if (flex_gd == NULL)
+ 		goto out3;
+ 
+-	if (flexbg_size >= UINT_MAX / sizeof(struct ext4_new_group_data))
+-		goto out2;
+ 	flex_gd->count = flexbg_size;
+-
+ 	flex_gd->groups = kmalloc_array(flexbg_size,
+ 					sizeof(struct ext4_new_group_data),
+ 					GFP_NOFS);
+-- 
+2.43.0
+
diff --git a/queue-6.1/ext4-unify-the-type-of-flexbg_size-to-unsigned-int.patch b/queue-6.1/ext4-unify-the-type-of-flexbg_size-to-unsigned-int.patch
new file mode 100644
index 00000000000..6c8ef5ea51f
--- /dev/null
+++ b/queue-6.1/ext4-unify-the-type-of-flexbg_size-to-unsigned-int.patch
@@ -0,0 +1,89 @@
+From 3d78c454409b7d6ab69397e24d9387971706c866 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Oct 2023 09:30:54 +0800
+Subject: ext4: unify the type of flexbg_size to unsigned int
+
+From: Baokun Li <libaokun1@huawei.com>
+
+[ Upstream commit 658a52344fb139f9531e7543a6e0015b630feb38 ]
+
+The maximum value of flexbg_size is 2^31, but the maximum value of int
+is (2^31 - 1), so overflow may occur when the type of flexbg_size is
+declared as int.
+
+For example, when uninit_mask is initialized in ext4_alloc_group_tables(),
+if flexbg_size == 2^31, the initialized uninit_mask is incorrect, and this
+may causes set_flexbg_block_bitmap() to trigger a BUG_ON().
+
+Therefore, the flexbg_size type is declared as unsigned int to avoid
+overflow and memory waste.
+
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20231023013057.2117948-2-libaokun1@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/resize.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index 9833ab6db117..31f5da7f9f6c 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -241,7 +241,7 @@ struct ext4_new_flex_group_data {
+  *
+  * Returns NULL on failure otherwise address of the allocated structure.
+  */
+-static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned long flexbg_size)
++static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned int flexbg_size)
+ {
+ 	struct ext4_new_flex_group_data *flex_gd;
+ 
+@@ -296,7 +296,7 @@ static void free_flex_gd(struct ext4_new_flex_group_data *flex_gd)
+  */
+ static int ext4_alloc_group_tables(struct super_block *sb,
+ 				struct ext4_new_flex_group_data *flex_gd,
+-				int flexbg_size)
++				unsigned int flexbg_size)
+ {
+ 	struct ext4_new_group_data *group_data = flex_gd->groups;
+ 	ext4_fsblk_t start_blk;
+@@ -397,12 +397,12 @@ static int ext4_alloc_group_tables(struct super_block *sb,
+ 		group = group_data[0].group;
+ 
+ 		printk(KERN_DEBUG "EXT4-fs: adding a flex group with "
+-		       "%d groups, flexbg size is %d:\n", flex_gd->count,
++		       "%u groups, flexbg size is %u:\n", flex_gd->count,
+ 		       flexbg_size);
+ 
+ 		for (i = 0; i < flex_gd->count; i++) {
+ 			ext4_debug(
+-			       "adding %s group %u: %u blocks (%d free, %d mdata blocks)\n",
++			       "adding %s group %u: %u blocks (%u free, %u mdata blocks)\n",
+ 			       ext4_bg_has_super(sb, group + i) ? "normal" :
+ 			       "no-super", group + i,
+ 			       group_data[i].blocks_count,
+@@ -1624,7 +1624,7 @@ static int ext4_flex_group_add(struct super_block *sb,
+ static int ext4_setup_next_flex_gd(struct super_block *sb,
+ 				    struct ext4_new_flex_group_data *flex_gd,
+ 				    ext4_fsblk_t n_blocks_count,
+-				    unsigned long flexbg_size)
++				    unsigned int flexbg_size)
+ {
+ 	struct ext4_sb_info *sbi = EXT4_SB(sb);
+ 	struct ext4_super_block *es = sbi->s_es;
+@@ -2010,8 +2010,9 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count)
+ 	ext4_fsblk_t o_blocks_count;
+ 	ext4_fsblk_t n_blocks_count_retry = 0;
+ 	unsigned long last_update_time = 0;
+-	int err = 0, flexbg_size = 1 << sbi->s_log_groups_per_flex;
++	int err = 0;
+ 	int meta_bg;
++	unsigned int flexbg_size = ext4_flex_bg_size(sbi);
+ 
+ 	/* See if the device is actually as big as what was requested */
+ 	bh = ext4_sb_bread(sb, n_blocks_count - 1, 0);
+-- 
+2.43.0
+
diff --git a/queue-6.1/f2fs-fix-to-check-return-value-of-f2fs_reserve_new_b.patch b/queue-6.1/f2fs-fix-to-check-return-value-of-f2fs_reserve_new_b.patch
new file mode 100644
index 00000000000..176b09b955a
--- /dev/null
+++ b/queue-6.1/f2fs-fix-to-check-return-value-of-f2fs_reserve_new_b.patch
@@ -0,0 +1,69 @@
+From 203c1a527922b5653dec9b4b883f24726c744f65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Nov 2023 14:25:56 +0800
+Subject: f2fs: fix to check return value of f2fs_reserve_new_block()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 956fa1ddc132e028f3b7d4cf17e6bfc8cb36c7fd ]
+
+Let's check return value of f2fs_reserve_new_block() in do_recover_data()
+rather than letting it fails silently.
+
+Also refactoring check condition on return value of f2fs_reserve_new_block()
+as below:
+- trigger f2fs_bug_on() only for ENOSPC case;
+- use do-while statement to avoid redundant codes;
+
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/recovery.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
+index dea95b48b647..4f4db465220f 100644
+--- a/fs/f2fs/recovery.c
++++ b/fs/f2fs/recovery.c
+@@ -683,7 +683,16 @@ static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode,
+ 		 */
+ 		if (dest == NEW_ADDR) {
+ 			f2fs_truncate_data_blocks_range(&dn, 1);
+-			f2fs_reserve_new_block(&dn);
++			do {
++				err = f2fs_reserve_new_block(&dn);
++				if (err == -ENOSPC) {
++					f2fs_bug_on(sbi, 1);
++					break;
++				}
++			} while (err &&
++				IS_ENABLED(CONFIG_F2FS_FAULT_INJECTION));
++			if (err)
++				goto err;
+ 			continue;
+ 		}
+ 
+@@ -691,12 +700,14 @@ static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode,
+ 		if (f2fs_is_valid_blkaddr(sbi, dest, META_POR)) {
+ 
+ 			if (src == NULL_ADDR) {
+-				err = f2fs_reserve_new_block(&dn);
+-				while (err &&
+-				       IS_ENABLED(CONFIG_F2FS_FAULT_INJECTION))
++				do {
+ 					err = f2fs_reserve_new_block(&dn);
+-				/* We should not get -ENOSPC */
+-				f2fs_bug_on(sbi, err);
++					if (err == -ENOSPC) {
++						f2fs_bug_on(sbi, 1);
++						break;
++					}
++				} while (err &&
++					IS_ENABLED(CONFIG_F2FS_FAULT_INJECTION));
+ 				if (err)
+ 					goto err;
+ 			}
+-- 
+2.43.0
+
diff --git a/queue-6.1/f2fs-fix-to-tag-gcing-flag-on-page-during-block-migr.patch b/queue-6.1/f2fs-fix-to-tag-gcing-flag-on-page-during-block-migr.patch
new file mode 100644
index 00000000000..04aa1dc7762
--- /dev/null
+++ b/queue-6.1/f2fs-fix-to-tag-gcing-flag-on-page-during-block-migr.patch
@@ -0,0 +1,64 @@
+From 7bbc774f4c99bc3f9347cf49cc8db1b5bfe48f0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Dec 2023 19:35:42 +0800
+Subject: f2fs: fix to tag gcing flag on page during block migration
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 4961acdd65c956e97c1a000c82d91a8c1cdbe44b ]
+
+It needs to add missing gcing flag on page during block migration,
+in order to garantee migrated data be persisted during checkpoint,
+otherwise out-of-order persistency between data and node may cause
+data corruption after SPOR.
+
+Similar issue was fixed by commit 2d1fe8a86bf5 ("f2fs: fix to tag
+gcing flag on page during file defragment").
+
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 4 +++-
+ fs/f2fs/file.c     | 2 ++
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index 4cb58e8d699e..3d9f6495a4db 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -1026,8 +1026,10 @@ static void set_cluster_dirty(struct compress_ctx *cc)
+ 	int i;
+ 
+ 	for (i = 0; i < cc->cluster_size; i++)
+-		if (cc->rpages[i])
++		if (cc->rpages[i]) {
+ 			set_page_dirty(cc->rpages[i]);
++			set_page_private_gcing(cc->rpages[i]);
++		}
+ }
+ 
+ static int prepare_compress_overwrite(struct compress_ctx *cc,
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index fd22854dbeae..46e4960a9dcf 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -1326,6 +1326,7 @@ static int __clone_blkaddrs(struct inode *src_inode, struct inode *dst_inode,
+ 			}
+ 			memcpy_page(pdst, 0, psrc, 0, PAGE_SIZE);
+ 			set_page_dirty(pdst);
++			set_page_private_gcing(pdst);
+ 			f2fs_put_page(pdst, 1);
+ 			f2fs_put_page(psrc, 1);
+ 
+@@ -4037,6 +4038,7 @@ static int redirty_blocks(struct inode *inode, pgoff_t page_idx, int len)
+ 		f2fs_bug_on(F2FS_I_SB(inode), !page);
+ 
+ 		set_page_dirty(page);
++		set_page_private_gcing(page);
+ 		f2fs_put_page(page, 1);
+ 		f2fs_put_page(page, 0);
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.1/f2fs-fix-write-pointers-on-zoned-device-after-roll-f.patch b/queue-6.1/f2fs-fix-write-pointers-on-zoned-device-after-roll-f.patch
new file mode 100644
index 00000000000..429fc81e46f
--- /dev/null
+++ b/queue-6.1/f2fs-fix-write-pointers-on-zoned-device-after-roll-f.patch
@@ -0,0 +1,37 @@
+From 95c5851f33dafed7698da25cad2c29e39286de0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Dec 2023 00:08:57 -0800
+Subject: f2fs: fix write pointers on zoned device after roll forward
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 9dad4d964291295ef48243d4e03972b85138bc9f ]
+
+1. do roll forward recovery
+2. update current segments pointers
+3. fix the entire zones' write pointers
+4. do checkpoint
+
+Reviewed-by: Daeho Jeong <daehojeong@google.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/recovery.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
+index 4f4db465220f..53a6487f91e4 100644
+--- a/fs/f2fs/recovery.c
++++ b/fs/f2fs/recovery.c
+@@ -898,6 +898,8 @@ int f2fs_recover_fsync_data(struct f2fs_sb_info *sbi, bool check_only)
+ 	if (!err && fix_curseg_write_pointer && !f2fs_readonly(sbi->sb) &&
+ 			f2fs_sb_has_blkzoned(sbi)) {
+ 		err = f2fs_fix_curseg_write_pointer(sbi);
++		if (!err)
++			err = f2fs_check_write_pointer(sbi);
+ 		ret = err;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/fast_dput-handle-underflows-gracefully.patch b/queue-6.1/fast_dput-handle-underflows-gracefully.patch
new file mode 100644
index 00000000000..885e93f95dd
--- /dev/null
+++ b/queue-6.1/fast_dput-handle-underflows-gracefully.patch
@@ -0,0 +1,78 @@
+From cbeb4d565172ab7774b04f820bc4a5e0acfe17af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Nov 2023 01:08:54 -0400
+Subject: fast_dput(): handle underflows gracefully
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 504e08cebe1d4e1efe25f915234f646e74a364a8 ]
+
+If refcount is less than 1, we should just warn, unlock dentry and
+return true, so that the caller doesn't try to do anything else.
+
+Taking care of that leaves the rest of "lockref_put_return() has
+failed" case equivalent to "decrement refcount and rejoin the
+normal slow path after the point where we grab ->d_lock".
+
+NOTE: lockref_put_return() is strictly a fastpath thing - unlike
+the rest of lockref primitives, it does not contain a fallback.
+Caller (and it looks like fast_dput() is the only legitimate one
+in the entire kernel) has to do that itself.  Reasons for
+lockref_put_return() failures:
+	* ->d_lock held by somebody
+	* refcount <= 0
+	* ... or an architecture not supporting lockref use of
+cmpxchg - sparc, anything non-SMP, config with spinlock debugging...
+
+We could add a fallback, but it would be a clumsy API - we'd have
+to distinguish between:
+	(1) refcount > 1 - decremented, lock not held on return
+	(2) refcount < 1 - left alone, probably no sense to hold the lock
+	(3) refcount is 1, no cmphxcg - decremented, lock held on return
+	(4) refcount is 1, cmphxcg supported - decremented, lock *NOT* held
+	    on return.
+We want to return with no lock held in case (4); that's the whole point of that
+thing.  We very much do not want to have the fallback in case (3) return without
+a lock, since the caller might have to retake it in that case.
+So it wouldn't be more convenient than doing the fallback in the caller and
+it would be very easy to screw up, especially since the test coverage would
+suck - no way to test (3) and (4) on the same kernel build.
+
+Reviewed-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dcache.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 52e6d5fdab6b..b09bc88dbbec 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -787,12 +787,12 @@ static inline bool fast_dput(struct dentry *dentry)
+ 	 */
+ 	if (unlikely(ret < 0)) {
+ 		spin_lock(&dentry->d_lock);
+-		if (dentry->d_lockref.count > 1) {
+-			dentry->d_lockref.count--;
++		if (WARN_ON_ONCE(dentry->d_lockref.count <= 0)) {
+ 			spin_unlock(&dentry->d_lock);
+ 			return true;
+ 		}
+-		return false;
++		dentry->d_lockref.count--;
++		goto locked;
+ 	}
+ 
+ 	/*
+@@ -850,6 +850,7 @@ static inline bool fast_dput(struct dentry *dentry)
+ 	 * else could have killed it and marked it dead. Either way, we
+ 	 * don't need to do anything else.
+ 	 */
++locked:
+ 	if (dentry->d_lockref.count) {
+ 		spin_unlock(&dentry->d_lock);
+ 		return true;
+-- 
+2.43.0
+
diff --git a/queue-6.1/fs-jfs-ubsan-array-index-out-of-bounds-in-dbadjtree.patch b/queue-6.1/fs-jfs-ubsan-array-index-out-of-bounds-in-dbadjtree.patch
new file mode 100644
index 00000000000..3a53a5409c5
--- /dev/null
+++ b/queue-6.1/fs-jfs-ubsan-array-index-out-of-bounds-in-dbadjtree.patch
@@ -0,0 +1,99 @@
+From fcb3b1d00664870d9dd31a1d24f360d83f9e3368 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Oct 2023 23:46:37 +0500
+Subject: FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
+
+From: Osama Muhammad <osmtendev@gmail.com>
+
+[ Upstream commit 9862ec7ac1cbc6eb5ee4a045b5d5b8edbb2f7e68 ]
+
+Syzkaller reported the following issue:
+
+UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6
+index 196694 is out of range for type 's8[1365]' (aka 'signed char[1365]')
+CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
+ ubsan_epilogue lib/ubsan.c:217 [inline]
+ __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348
+ dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867
+ dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834
+ dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331
+ dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline]
+ dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402
+ txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534
+ txUpdateMap+0x342/0x9e0
+ txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline]
+ jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732
+ kthread+0x2d3/0x370 kernel/kthread.c:388
+ ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
+ ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
+ </TASK>
+================================================================================
+Kernel panic - not syncing: UBSAN: panic_on_warn set ...
+CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
+ panic+0x30f/0x770 kernel/panic.c:340
+ check_panic_on_warn+0x82/0xa0 kernel/panic.c:236
+ ubsan_epilogue lib/ubsan.c:223 [inline]
+ __ubsan_handle_out_of_bounds+0x13c/0x150 lib/ubsan.c:348
+ dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867
+ dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834
+ dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331
+ dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline]
+ dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402
+ txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534
+ txUpdateMap+0x342/0x9e0
+ txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline]
+ jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732
+ kthread+0x2d3/0x370 kernel/kthread.c:388
+ ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
+ ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
+ </TASK>
+Kernel Offset: disabled
+Rebooting in 86400 seconds..
+
+The issue is caused when the value of lp becomes greater than
+CTLTREESIZE which is the max size of stree. Adding a simple check
+solves this issue.
+
+Dave:
+As the function returns a void, good error handling
+would require a more intrusive code reorganization, so I modified
+Osama's patch at use WARN_ON_ONCE for lack of a cleaner option.
+
+The patch is tested via syzbot.
+
+Reported-by: syzbot+39ba34a099ac2e9bd3cb@syzkaller.appspotmail.com
+Link: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb
+Signed-off-by: Osama Muhammad <osmtendev@gmail.com>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_dmap.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
+index 4d56f6081a5d..34e230b2110b 100644
+--- a/fs/jfs/jfs_dmap.c
++++ b/fs/jfs/jfs_dmap.c
+@@ -2871,6 +2871,9 @@ static void dbAdjTree(dmtree_t * tp, int leafno, int newval)
+ 	/* is the current value the same as the old value ?  if so,
+ 	 * there is nothing to do.
+ 	 */
++	if (WARN_ON_ONCE(lp >= CTLTREESIZE))
++		return;
++
+ 	if (tp->dmt_stree[lp] == newval)
+ 		return;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/fs-kernfs-dir-obey-s_isgid.patch b/queue-6.1/fs-kernfs-dir-obey-s_isgid.patch
new file mode 100644
index 00000000000..8fdcf8a06e9
--- /dev/null
+++ b/queue-6.1/fs-kernfs-dir-obey-s_isgid.patch
@@ -0,0 +1,58 @@
+From 202d5beb3cac5db88e5930c9c3b01e7f9b293caf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Dec 2023 10:33:10 +0100
+Subject: fs/kernfs/dir: obey S_ISGID
+
+From: Max Kellermann <max.kellermann@ionos.com>
+
+[ Upstream commit 5133bee62f0ea5d4c316d503cc0040cac5637601 ]
+
+Handling of S_ISGID is usually done by inode_init_owner() in all other
+filesystems, but kernfs doesn't use that function.  In kernfs, struct
+kernfs_node is the primary data structure, and struct inode is only
+created from it on demand.  Therefore, inode_init_owner() can't be
+used and we need to imitate its behavior.
+
+S_ISGID support is useful for the cgroup filesystem; it allows
+subtrees managed by an unprivileged process to retain a certain owner
+gid, which then enables sharing access to the subtree with another
+unprivileged process.
+
+--
+v1 -> v2: minor coding style fix (comment)
+
+Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20231208093310.297233-2-max.kellermann@ionos.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/kernfs/dir.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
+index 44842e6cf0a9..a00e11ebfa77 100644
+--- a/fs/kernfs/dir.c
++++ b/fs/kernfs/dir.c
+@@ -669,6 +669,18 @@ struct kernfs_node *kernfs_new_node(struct kernfs_node *parent,
+ {
+ 	struct kernfs_node *kn;
+ 
++	if (parent->mode & S_ISGID) {
++		/* this code block imitates inode_init_owner() for
++		 * kernfs
++		 */
++
++		if (parent->iattr)
++			gid = parent->iattr->ia_gid;
++
++		if (flags & KERNFS_DIR)
++			mode |= S_ISGID;
++	}
++
+ 	kn = __kernfs_new_node(kernfs_root(parent), parent,
+ 			       name, mode, uid, gid, flags);
+ 	if (kn) {
+-- 
+2.43.0
+
diff --git a/queue-6.1/hexagon-make-pfn-accessors-statics-inlines.patch b/queue-6.1/hexagon-make-pfn-accessors-statics-inlines.patch
new file mode 100644
index 00000000000..cfcfa08b34c
--- /dev/null
+++ b/queue-6.1/hexagon-make-pfn-accessors-statics-inlines.patch
@@ -0,0 +1,68 @@
+From 02b196c50da8e9de024532d4d7ddf53a73060a41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Nov 2023 14:28:15 +0100
+Subject: Hexagon: Make pfn accessors statics inlines
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit d6e81532b10d8deb2bc30f7b44f09534876893e3 ]
+
+Making virt_to_pfn() a static inline taking a strongly typed
+(const void *) makes the contract of a passing a pointer of that
+type to the function explicit and exposes any misuse of the
+macro virt_to_pfn() acting polymorphic and accepting many types
+such as (void *), (unitptr_t) or (unsigned long) as arguments
+without warnings.
+
+For symmetry do the same with pfn_to_virt().
+
+For compiletime resolution of __pa() we need PAGE_OFFSET which
+was not available to __pa() and resolved by the preprocessor
+wherever __pa() was used. Fix this by explicitly including
+<asm/mem-layout.h> where required, following the pattern of the
+architectures page.h file.
+
+Acked-by: Brian Cain <bcain@quicinc.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/hexagon/include/asm/page.h | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/arch/hexagon/include/asm/page.h b/arch/hexagon/include/asm/page.h
+index 7cbf719c578e..2d8c681c3469 100644
+--- a/arch/hexagon/include/asm/page.h
++++ b/arch/hexagon/include/asm/page.h
+@@ -78,6 +78,9 @@ typedef struct page *pgtable_t;
+ #define __pgd(x)       ((pgd_t) { (x) })
+ #define __pgprot(x)    ((pgprot_t) { (x) })
+ 
++/* Needed for PAGE_OFFSET used in the macro right below */
++#include <asm/mem-layout.h>
++
+ /*
+  * We need a __pa and a __va routine for kernel space.
+  * MIPS says they're only used during mem_init.
+@@ -126,8 +129,16 @@ static inline void clear_page(void *page)
+  */
+ #define page_to_phys(page)      (page_to_pfn(page) << PAGE_SHIFT)
+ 
+-#define virt_to_pfn(kaddr)      (__pa(kaddr) >> PAGE_SHIFT)
+-#define pfn_to_virt(pfn)        __va((pfn) << PAGE_SHIFT)
++static inline unsigned long virt_to_pfn(const void *kaddr)
++{
++	return __pa(kaddr) >> PAGE_SHIFT;
++}
++
++static inline void *pfn_to_virt(unsigned long pfn)
++{
++	return (void *)((unsigned long)__va(pfn) << PAGE_SHIFT);
++}
++
+ 
+ #define page_to_virt(page)	__va(page_to_phys(page))
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/hwmon-nct6775-fix-fan-speed-set-failure-in-automatic.patch b/queue-6.1/hwmon-nct6775-fix-fan-speed-set-failure-in-automatic.patch
new file mode 100644
index 00000000000..589498f32aa
--- /dev/null
+++ b/queue-6.1/hwmon-nct6775-fix-fan-speed-set-failure-in-automatic.patch
@@ -0,0 +1,42 @@
+From ea4c03ce6cbf520ca91e8b6ce4d9958f54283a3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Nov 2023 16:16:04 +0800
+Subject: hwmon: (nct6775) Fix fan speed set failure in automatic mode
+
+From: Xing Tong Wu <xingtong.wu@siemens.com>
+
+[ Upstream commit 8b3800256abad20e91c2698607f9b28591407b19 ]
+
+Setting the fan speed is only valid in manual mode; it is not possible
+to set the fan's speed in automatic mode.
+Return error when attempting to set the fan speed in automatic mode.
+
+Signed-off-by: Xing Tong Wu <xingtong.wu@siemens.com>
+Link: https://lore.kernel.org/r/20231121081604.2499-3-xingtong_wu@163.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/nct6775-core.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c
+index 80310845fb99..9720ad214c20 100644
+--- a/drivers/hwmon/nct6775-core.c
++++ b/drivers/hwmon/nct6775-core.c
+@@ -2462,6 +2462,13 @@ store_pwm(struct device *dev, struct device_attribute *attr, const char *buf,
+ 	int err;
+ 	u16 reg;
+ 
++	/*
++	 * The fan control mode should be set to manual if the user wants to adjust
++	 * the fan speed. Otherwise, it will fail to set.
++	 */
++	if (index == 0 && data->pwm_enable[nr] > manual)
++		return -EBUSY;
++
+ 	err = kstrtoul(buf, 10, &val);
+ 	if (err < 0)
+ 		return err;
+-- 
+2.43.0
+
diff --git a/queue-6.1/hwmon-pc87360-bounds-check-data-innr-usage.patch b/queue-6.1/hwmon-pc87360-bounds-check-data-innr-usage.patch
new file mode 100644
index 00000000000..0ad75a35ff7
--- /dev/null
+++ b/queue-6.1/hwmon-pc87360-bounds-check-data-innr-usage.patch
@@ -0,0 +1,60 @@
+From c1a102dbd47b6b5009605d0357a1314b95c3d9f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 12:02:07 -0800
+Subject: hwmon: (pc87360) Bounds check data->innr usage
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 4265eb062a7303e537ab3792ade31f424c3c5189 ]
+
+Without visibility into the initializers for data->innr, GCC suspects
+using it as an index could walk off the end of the various 14-element
+arrays in data. Perform an explicit clamp to the array size. Silences
+the following warning with GCC 12+:
+
+../drivers/hwmon/pc87360.c: In function 'pc87360_update_device':
+../drivers/hwmon/pc87360.c:341:49: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=]
+  341 |                                 data->in_max[i] = pc87360_read_value(data,
+      |                                 ~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~
+  342 |                                                   LD_IN, i,
+      |                                                   ~~~~~~~~~
+  343 |                                                   PC87365_REG_IN_MAX);
+      |                                                   ~~~~~~~~~~~~~~~~~~~
+../drivers/hwmon/pc87360.c:209:12: note: at offset 255 into destination object 'in_max' of size 14
+  209 |         u8 in_max[14];          /* Register value */
+      |            ^~~~~~
+
+Cc: Jim Cromie <jim.cromie@gmail.com>
+Cc: Jean Delvare <jdelvare@suse.com>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Cc: linux-hwmon@vger.kernel.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Link: https://lore.kernel.org/r/20231130200207.work.679-kees@kernel.org
+[groeck: Added comment into code clarifying context]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pc87360.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/pc87360.c b/drivers/hwmon/pc87360.c
+index a4adc8bd531f..534a6072036c 100644
+--- a/drivers/hwmon/pc87360.c
++++ b/drivers/hwmon/pc87360.c
+@@ -323,7 +323,11 @@ static struct pc87360_data *pc87360_update_device(struct device *dev)
+ 		}
+ 
+ 		/* Voltages */
+-		for (i = 0; i < data->innr; i++) {
++		/*
++		 * The min() below does not have any practical meaning and is
++		 * only needed to silence a warning observed with gcc 12+.
++		 */
++		for (i = 0; i < min(data->innr, ARRAY_SIZE(data->in)); i++) {
+ 			data->in_status[i] = pc87360_read_value(data, LD_IN, i,
+ 					     PC87365_REG_IN_STATUS);
+ 			/* Clear bits */
+-- 
+2.43.0
+
diff --git a/queue-6.1/i2c-rk3x-adjust-mask-value-offset-for-i2c2-on-rv1126.patch b/queue-6.1/i2c-rk3x-adjust-mask-value-offset-for-i2c2-on-rv1126.patch
new file mode 100644
index 00000000000..a80b6698c7e
--- /dev/null
+++ b/queue-6.1/i2c-rk3x-adjust-mask-value-offset-for-i2c2-on-rv1126.patch
@@ -0,0 +1,46 @@
+From 415eb64a74fe97dc85bcad99deaecfe57dce6b6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Dec 2023 23:39:59 +1100
+Subject: i2c: rk3x: Adjust mask/value offset for i2c2 on rv1126
+
+From: Tim Lunn <tim@feathertop.org>
+
+[ Upstream commit 92a85b7c6262f19c65a1c115cf15f411ba65a57c ]
+
+Rockchip RV1126 is using old style i2c controller, the i2c2
+bus uses a non-sequential offset in the grf register for the
+mask/value bits for this bus.
+
+This patch fixes i2c2 bus on rv1126 SoCs.
+
+Signed-off-by: Tim Lunn <tim@feathertop.org>
+Acked-by: Heiko Stuebner <heiko@sntech.de>
+Reviewed-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-rk3x.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c
+index 6aa4f1f06240..c8cd5cadcf56 100644
+--- a/drivers/i2c/busses/i2c-rk3x.c
++++ b/drivers/i2c/busses/i2c-rk3x.c
+@@ -1295,8 +1295,12 @@ static int rk3x_i2c_probe(struct platform_device *pdev)
+ 			return -EINVAL;
+ 		}
+ 
+-		/* 27+i: write mask, 11+i: value */
+-		value = BIT(27 + bus_nr) | BIT(11 + bus_nr);
++		/* rv1126 i2c2 uses non-sequential write mask 20, value 4 */
++		if (i2c->soc_data == &rv1126_soc_data && bus_nr == 2)
++			value = BIT(20) | BIT(4);
++		else
++			/* 27+i: write mask, 11+i: value */
++			value = BIT(27 + bus_nr) | BIT(11 + bus_nr);
+ 
+ 		ret = regmap_write(grf, i2c->soc_data->grf_offset, value);
+ 		if (ret != 0) {
+-- 
+2.43.0
+
diff --git a/queue-6.1/i3c-master-cdns-update-maximum-prescaler-value-for-i.patch b/queue-6.1/i3c-master-cdns-update-maximum-prescaler-value-for-i.patch
new file mode 100644
index 00000000000..04e1785f3c5
--- /dev/null
+++ b/queue-6.1/i3c-master-cdns-update-maximum-prescaler-value-for-i.patch
@@ -0,0 +1,59 @@
+From feb9a5f2c6a71d63226dd4f557bd1bc57ad4ed88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Dec 2023 14:41:23 +0530
+Subject: i3c: master: cdns: Update maximum prescaler value for i2c clock
+
+From: Harshit Shah <harshitshah.opendev@gmail.com>
+
+[ Upstream commit 374c13f9080a1b9835a5ed3e7bea93cf8e2dc262 ]
+
+As per the Cadence IP document fixed the I2C clock divider value limit from
+16 bits instead of 10 bits. Without this change setting up the I2C clock to
+low frequencies will not work as the prescaler value might be greater than
+10 bit number.
+
+I3C clock divider value is 10 bits only. Updating the macro names for both.
+
+Signed-off-by: Harshit Shah <harshitshah.opendev@gmail.com>
+Link: https://lore.kernel.org/r/1703927483-28682-1-git-send-email-harshitshah.opendev@gmail.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/i3c-master-cdns.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/i3c/master/i3c-master-cdns.c b/drivers/i3c/master/i3c-master-cdns.c
+index 4a49c75a9408..b9cfda6ae9ae 100644
+--- a/drivers/i3c/master/i3c-master-cdns.c
++++ b/drivers/i3c/master/i3c-master-cdns.c
+@@ -77,7 +77,8 @@
+ #define PRESCL_CTRL0			0x14
+ #define PRESCL_CTRL0_I2C(x)		((x) << 16)
+ #define PRESCL_CTRL0_I3C(x)		(x)
+-#define PRESCL_CTRL0_MAX		GENMASK(9, 0)
++#define PRESCL_CTRL0_I3C_MAX		GENMASK(9, 0)
++#define PRESCL_CTRL0_I2C_MAX		GENMASK(15, 0)
+ 
+ #define PRESCL_CTRL1			0x18
+ #define PRESCL_CTRL1_PP_LOW_MASK	GENMASK(15, 8)
+@@ -1234,7 +1235,7 @@ static int cdns_i3c_master_bus_init(struct i3c_master_controller *m)
+ 		return -EINVAL;
+ 
+ 	pres = DIV_ROUND_UP(sysclk_rate, (bus->scl_rate.i3c * 4)) - 1;
+-	if (pres > PRESCL_CTRL0_MAX)
++	if (pres > PRESCL_CTRL0_I3C_MAX)
+ 		return -ERANGE;
+ 
+ 	bus->scl_rate.i3c = sysclk_rate / ((pres + 1) * 4);
+@@ -1247,7 +1248,7 @@ static int cdns_i3c_master_bus_init(struct i3c_master_controller *m)
+ 	max_i2cfreq = bus->scl_rate.i2c;
+ 
+ 	pres = (sysclk_rate / (max_i2cfreq * 5)) - 1;
+-	if (pres > PRESCL_CTRL0_MAX)
++	if (pres > PRESCL_CTRL0_I2C_MAX)
+ 		return -ERANGE;
+ 
+ 	bus->scl_rate.i2c = sysclk_rate / ((pres + 1) * 5);
+-- 
+2.43.0
+
diff --git a/queue-6.1/i40e-fix-vf-disable-behavior-to-block-all-traffic.patch b/queue-6.1/i40e-fix-vf-disable-behavior-to-block-all-traffic.patch
new file mode 100644
index 00000000000..495151a3b77
--- /dev/null
+++ b/queue-6.1/i40e-fix-vf-disable-behavior-to-block-all-traffic.patch
@@ -0,0 +1,120 @@
+From 1ec3cec013c3f04facc0ee925702a4e4e2933805 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 15:24:12 +0100
+Subject: i40e: Fix VF disable behavior to block all traffic
+
+From: Andrii Staikov <andrii.staikov@intel.com>
+
+[ Upstream commit 31deb12e85c35ddd2c037f0107d05d8674cab2c0 ]
+
+Currently, if a VF is disabled using the
+'ip link set dev $ETHX vf $VF_NUM state disable' command, the VF is still
+able to receive traffic.
+
+Fix the behavior of the 'ip link set dev $ETHX vf $VF_NUM state disable'
+to completely shutdown the VF's queues making it entirely disabled and
+not able to receive or send any traffic.
+
+Modify the behavior of the 'ip link set $ETHX vf $VF_NUM state enable'
+command to make a VF do reinitialization bringing the queues back up.
+
+Co-developed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Jan Sokolowski <jan.sokolowski@intel.com>
+Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
+Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Signed-off-by: Andrii Staikov <andrii.staikov@intel.com>
+Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/intel/i40e/i40e_virtchnl_pf.c    | 32 +++++++++++++++++++
+ .../ethernet/intel/i40e/i40e_virtchnl_pf.h    |  1 +
+ 2 files changed, 33 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index c7d761426d6c..3d3db58090ed 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -2603,6 +2603,14 @@ static int i40e_vc_enable_queues_msg(struct i40e_vf *vf, u8 *msg)
+ 	int aq_ret = 0;
+ 	int i;
+ 
++	if (vf->is_disabled_from_host) {
++		aq_ret = -EPERM;
++		dev_info(&pf->pdev->dev,
++			 "Admin has disabled VF %d, will not enable queues\n",
++			 vf->vf_id);
++		goto error_param;
++	}
++
+ 	if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) {
+ 		aq_ret = I40E_ERR_PARAM;
+ 		goto error_param;
+@@ -4656,9 +4664,12 @@ int i40e_ndo_set_vf_link_state(struct net_device *netdev, int vf_id, int link)
+ 	struct i40e_link_status *ls = &pf->hw.phy.link_info;
+ 	struct virtchnl_pf_event pfe;
+ 	struct i40e_hw *hw = &pf->hw;
++	struct i40e_vsi *vsi;
++	unsigned long q_map;
+ 	struct i40e_vf *vf;
+ 	int abs_vf_id;
+ 	int ret = 0;
++	int tmp;
+ 
+ 	if (test_and_set_bit(__I40E_VIRTCHNL_OP_PENDING, pf->state)) {
+ 		dev_warn(&pf->pdev->dev, "Unable to configure VFs, other operation is pending.\n");
+@@ -4681,17 +4692,38 @@ int i40e_ndo_set_vf_link_state(struct net_device *netdev, int vf_id, int link)
+ 	switch (link) {
+ 	case IFLA_VF_LINK_STATE_AUTO:
+ 		vf->link_forced = false;
++		vf->is_disabled_from_host = false;
++		/* reset needed to reinit VF resources */
++		i40e_vc_reset_vf(vf, true);
+ 		i40e_set_vf_link_state(vf, &pfe, ls);
+ 		break;
+ 	case IFLA_VF_LINK_STATE_ENABLE:
+ 		vf->link_forced = true;
+ 		vf->link_up = true;
++		vf->is_disabled_from_host = false;
++		/* reset needed to reinit VF resources */
++		i40e_vc_reset_vf(vf, true);
+ 		i40e_set_vf_link_state(vf, &pfe, ls);
+ 		break;
+ 	case IFLA_VF_LINK_STATE_DISABLE:
+ 		vf->link_forced = true;
+ 		vf->link_up = false;
+ 		i40e_set_vf_link_state(vf, &pfe, ls);
++
++		vsi = pf->vsi[vf->lan_vsi_idx];
++		q_map = BIT(vsi->num_queue_pairs) - 1;
++
++		vf->is_disabled_from_host = true;
++
++		/* Try to stop both Tx&Rx rings even if one of the calls fails
++		 * to ensure we stop the rings even in case of errors.
++		 * If any of them returns with an error then the first
++		 * error that occurred will be returned.
++		 */
++		tmp = i40e_ctrl_vf_tx_rings(vsi, q_map, false);
++		ret = i40e_ctrl_vf_rx_rings(vsi, q_map, false);
++
++		ret = tmp ? tmp : ret;
+ 		break;
+ 	default:
+ 		ret = -EINVAL;
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h
+index bd497cc5303a..97e9c34d7c6c 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h
+@@ -98,6 +98,7 @@ struct i40e_vf {
+ 	bool link_forced;
+ 	bool link_up;		/* only valid if VF link is forced */
+ 	bool spoofchk;
++	bool is_disabled_from_host; /* PF ctrl of VF enable/disable */
+ 	u16 num_vlan;
+ 
+ 	/* ADq related variables */
+-- 
+2.43.0
+
diff --git a/queue-6.1/ib-ipoib-fix-mcast-list-locking.patch b/queue-6.1/ib-ipoib-fix-mcast-list-locking.patch
new file mode 100644
index 00000000000..5256b6beb40
--- /dev/null
+++ b/queue-6.1/ib-ipoib-fix-mcast-list-locking.patch
@@ -0,0 +1,94 @@
+From 394cd6384306e9d8a6a82b6474d1d3bb8588c727 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Dec 2023 09:07:45 +0100
+Subject: IB/ipoib: Fix mcast list locking
+
+From: Daniel Vacek <neelx@redhat.com>
+
+[ Upstream commit 4f973e211b3b1c6d36f7c6a19239d258856749f9 ]
+
+Releasing the `priv->lock` while iterating the `priv->multicast_list` in
+`ipoib_mcast_join_task()` opens a window for `ipoib_mcast_dev_flush()` to
+remove the items while in the middle of iteration. If the mcast is removed
+while the lock was dropped, the for loop spins forever resulting in a hard
+lockup (as was reported on RHEL 4.18.0-372.75.1.el8_6 kernel):
+
+    Task A (kworker/u72:2 below)       | Task B (kworker/u72:0 below)
+    -----------------------------------+-----------------------------------
+    ipoib_mcast_join_task(work)        | ipoib_ib_dev_flush_light(work)
+      spin_lock_irq(&priv->lock)       | __ipoib_ib_dev_flush(priv, ...)
+      list_for_each_entry(mcast,       | ipoib_mcast_dev_flush(dev = priv->dev)
+          &priv->multicast_list, list) |
+        ipoib_mcast_join(dev, mcast)   |
+          spin_unlock_irq(&priv->lock) |
+                                       |   spin_lock_irqsave(&priv->lock, flags)
+                                       |   list_for_each_entry_safe(mcast, tmcast,
+                                       |                  &priv->multicast_list, list)
+                                       |     list_del(&mcast->list);
+                                       |     list_add_tail(&mcast->list, &remove_list)
+                                       |   spin_unlock_irqrestore(&priv->lock, flags)
+          spin_lock_irq(&priv->lock)   |
+                                       |   ipoib_mcast_remove_list(&remove_list)
+   (Here, `mcast` is no longer on the  |     list_for_each_entry_safe(mcast, tmcast,
+    `priv->multicast_list` and we keep |                            remove_list, list)
+    spinning on the `remove_list` of   |  >>>  wait_for_completion(&mcast->done)
+    the other thread which is blocked  |
+    and the list is still valid on     |
+    it's stack.)
+
+Fix this by keeping the lock held and changing to GFP_ATOMIC to prevent
+eventual sleeps.
+Unfortunately we could not reproduce the lockup and confirm this fix but
+based on the code review I think this fix should address such lockups.
+
+crash> bc 31
+PID: 747      TASK: ff1c6a1a007e8000  CPU: 31   COMMAND: "kworker/u72:2"
+--
+    [exception RIP: ipoib_mcast_join_task+0x1b1]
+    RIP: ffffffffc0944ac1  RSP: ff646f199a8c7e00  RFLAGS: 00000002
+    RAX: 0000000000000000  RBX: ff1c6a1a04dc82f8  RCX: 0000000000000000
+                                  work (&priv->mcast_task{,.work})
+    RDX: ff1c6a192d60ac68  RSI: 0000000000000286  RDI: ff1c6a1a04dc8000
+           &mcast->list
+    RBP: ff646f199a8c7e90   R8: ff1c699980019420   R9: ff1c6a1920c9a000
+    R10: ff646f199a8c7e00  R11: ff1c6a191a7d9800  R12: ff1c6a192d60ac00
+                                                         mcast
+    R13: ff1c6a1d82200000  R14: ff1c6a1a04dc8000  R15: ff1c6a1a04dc82d8
+           dev                    priv (&priv->lock)     &priv->multicast_list (aka head)
+    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+index 9e6967a40042..319d4288eddd 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+@@ -531,21 +531,17 @@ static int ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast)
+ 		if (test_bit(IPOIB_MCAST_FLAG_SENDONLY, &mcast->flags))
+ 			rec.join_state = SENDONLY_FULLMEMBER_JOIN;
+ 	}
+-	spin_unlock_irq(&priv->lock);
+ 
+ 	multicast = ib_sa_join_multicast(&ipoib_sa_client, priv->ca, priv->port,
+-					 &rec, comp_mask, GFP_KERNEL,
++					 &rec, comp_mask, GFP_ATOMIC,
+ 					 ipoib_mcast_join_complete, mcast);
+-	spin_lock_irq(&priv->lock);
+ 	if (IS_ERR(multicast)) {
+ 		ret = PTR_ERR(multicast);
+ 		ipoib_warn(priv, "ib_sa_join_multicast failed, status %d\n", ret);
+ 		/* Requeue this join task with a backoff delay */
+ 		__ipoib_mcast_schedule_join_thread(priv, mcast, 1);
+ 		clear_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
+-		spin_unlock_irq(&priv->lock);
+ 		complete(&mcast->done);
+-		spin_lock_irq(&priv->lock);
+ 		return ret;
+ 	}
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.1/ice-fix-ice_aq_vsi_q_opt_rss_-register-values.patch b/queue-6.1/ice-fix-ice_aq_vsi_q_opt_rss_-register-values.patch
new file mode 100644
index 00000000000..362eec9afb3
--- /dev/null
+++ b/queue-6.1/ice-fix-ice_aq_vsi_q_opt_rss_-register-values.patch
@@ -0,0 +1,101 @@
+From a89d6fce98ebd85a4d0cd889407cb2229aac3c3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Dec 2023 17:33:17 -0700
+Subject: ice: fix ICE_AQ_VSI_Q_OPT_RSS_* register values
+
+From: Ahmed Zaki <ahmed.zaki@intel.com>
+
+[ Upstream commit 20f73b60bb5c276cee9b1a530f100c677bc74af8 ]
+
+Fix the values of the ICE_AQ_VSI_Q_OPT_RSS_* registers. Shifting is
+already done when the values are used, no need to double shift. Bug was
+not discovered earlier since only ICE_AQ_VSI_Q_OPT_RSS_TPLZ (Zero) is
+currently used.
+
+Also, rename ICE_AQ_VSI_Q_OPT_RSS_XXX to ICE_AQ_VSI_Q_OPT_RSS_HASH_XXX
+for consistency.
+
+Co-developed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
+Signed-off-by: Ahmed Zaki <ahmed.zaki@intel.com>
+Link: https://lore.kernel.org/r/20231213003321.605376-5-ahmed.zaki@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_adminq_cmd.h |  8 ++++----
+ drivers/net/ethernet/intel/ice/ice_lib.c        |  4 ++--
+ drivers/net/ethernet/intel/ice/ice_virtchnl.c   | 12 +++++-------
+ 3 files changed, 11 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
+index 1bdc70aa979d..a141680f3c1c 100644
+--- a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
++++ b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
+@@ -483,10 +483,10 @@ struct ice_aqc_vsi_props {
+ #define ICE_AQ_VSI_Q_OPT_RSS_GBL_LUT_M		(0xF << ICE_AQ_VSI_Q_OPT_RSS_GBL_LUT_S)
+ #define ICE_AQ_VSI_Q_OPT_RSS_HASH_S		6
+ #define ICE_AQ_VSI_Q_OPT_RSS_HASH_M		(0x3 << ICE_AQ_VSI_Q_OPT_RSS_HASH_S)
+-#define ICE_AQ_VSI_Q_OPT_RSS_TPLZ		(0x0 << ICE_AQ_VSI_Q_OPT_RSS_HASH_S)
+-#define ICE_AQ_VSI_Q_OPT_RSS_SYM_TPLZ		(0x1 << ICE_AQ_VSI_Q_OPT_RSS_HASH_S)
+-#define ICE_AQ_VSI_Q_OPT_RSS_XOR		(0x2 << ICE_AQ_VSI_Q_OPT_RSS_HASH_S)
+-#define ICE_AQ_VSI_Q_OPT_RSS_JHASH		(0x3 << ICE_AQ_VSI_Q_OPT_RSS_HASH_S)
++#define ICE_AQ_VSI_Q_OPT_RSS_HASH_TPLZ		0x0U
++#define ICE_AQ_VSI_Q_OPT_RSS_HASH_SYM_TPLZ	0x1U
++#define ICE_AQ_VSI_Q_OPT_RSS_HASH_XOR		0x2U
++#define ICE_AQ_VSI_Q_OPT_RSS_HASH_JHASH		0x3U
+ 	u8 q_opt_tc;
+ #define ICE_AQ_VSI_Q_OPT_TC_OVR_S		0
+ #define ICE_AQ_VSI_Q_OPT_TC_OVR_M		(0x1F << ICE_AQ_VSI_Q_OPT_TC_OVR_S)
+diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c
+index c051503c3a89..f074a1cf7166 100644
+--- a/drivers/net/ethernet/intel/ice/ice_lib.c
++++ b/drivers/net/ethernet/intel/ice/ice_lib.c
+@@ -1085,12 +1085,12 @@ static void ice_set_rss_vsi_ctx(struct ice_vsi_ctx *ctxt, struct ice_vsi *vsi)
+ 	case ICE_VSI_PF:
+ 		/* PF VSI will inherit RSS instance of PF */
+ 		lut_type = ICE_AQ_VSI_Q_OPT_RSS_LUT_PF;
+-		hash_type = ICE_AQ_VSI_Q_OPT_RSS_TPLZ;
++		hash_type = ICE_AQ_VSI_Q_OPT_RSS_HASH_TPLZ;
+ 		break;
+ 	case ICE_VSI_VF:
+ 		/* VF VSI will gets a small RSS table which is a VSI LUT type */
+ 		lut_type = ICE_AQ_VSI_Q_OPT_RSS_LUT_VSI;
+-		hash_type = ICE_AQ_VSI_Q_OPT_RSS_TPLZ;
++		hash_type = ICE_AQ_VSI_Q_OPT_RSS_HASH_TPLZ;
+ 		break;
+ 	default:
+ 		dev_dbg(dev, "Unsupported VSI type %s\n",
+diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl.c b/drivers/net/ethernet/intel/ice/ice_virtchnl.c
+index 2b4c791b6cba..6c03ebf81ffd 100644
+--- a/drivers/net/ethernet/intel/ice/ice_virtchnl.c
++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl.c
+@@ -817,8 +817,8 @@ static int ice_vc_handle_rss_cfg(struct ice_vf *vf, u8 *msg, bool add)
+ 		int status;
+ 
+ 		lut_type = ICE_AQ_VSI_Q_OPT_RSS_LUT_VSI;
+-		hash_type = add ? ICE_AQ_VSI_Q_OPT_RSS_XOR :
+-				ICE_AQ_VSI_Q_OPT_RSS_TPLZ;
++		hash_type = add ? ICE_AQ_VSI_Q_OPT_RSS_HASH_XOR :
++				ICE_AQ_VSI_Q_OPT_RSS_HASH_TPLZ;
+ 
+ 		ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
+ 		if (!ctx) {
+@@ -826,11 +826,9 @@ static int ice_vc_handle_rss_cfg(struct ice_vf *vf, u8 *msg, bool add)
+ 			goto error_param;
+ 		}
+ 
+-		ctx->info.q_opt_rss = ((lut_type <<
+-					ICE_AQ_VSI_Q_OPT_RSS_LUT_S) &
+-				       ICE_AQ_VSI_Q_OPT_RSS_LUT_M) |
+-				       (hash_type &
+-					ICE_AQ_VSI_Q_OPT_RSS_HASH_M);
++		ctx->info.q_opt_rss =
++			FIELD_PREP(ICE_AQ_VSI_Q_OPT_RSS_LUT_M, lut_type) |
++			FIELD_PREP(ICE_AQ_VSI_Q_OPT_RSS_HASH_M, hash_type);
+ 
+ 		/* Preserve existing queueing option setting */
+ 		ctx->info.q_opt_rss |= (vsi->info.q_opt_rss &
+-- 
+2.43.0
+
diff --git a/queue-6.1/ice-fix-pre-shifted-bit-usage.patch b/queue-6.1/ice-fix-pre-shifted-bit-usage.patch
new file mode 100644
index 00000000000..784f6b5e119
--- /dev/null
+++ b/queue-6.1/ice-fix-pre-shifted-bit-usage.patch
@@ -0,0 +1,121 @@
+From 9d024417157d10ebaed62db9fd3f152999f4b042 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Dec 2023 17:01:06 -0800
+Subject: ice: fix pre-shifted bit usage
+
+From: Jesse Brandeburg <jesse.brandeburg@intel.com>
+
+[ Upstream commit 7173be21ae29ef50ada42fd4464056a9d3f55bb3 ]
+
+While converting to FIELD_PREP() and FIELD_GET(), it was noticed that
+some of the RSS defines had *included* the shift in their definitions.
+This is completely outside of normal, such that a developer could easily
+make a mistake and shift at the usage site (like when using
+FIELD_PREP()).
+
+Rename the defines and set them to the "pre-shifted values" so they
+match the template the driver normally uses for masks and the member
+bits of the mask, which also allows the driver to use FIELD_PREP
+correctly with these values. Use GENMASK() for this changed MASK value.
+
+Do the same for the VLAN EMODE defines as well.
+
+Reviewed-by: Marcin Szycik <marcin.szycik@linux.intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_adminq_cmd.h  | 10 +++++-----
+ drivers/net/ethernet/intel/ice/ice_lib.c         |  3 ++-
+ .../net/ethernet/intel/ice/ice_vsi_vlan_lib.c    | 16 +++++++++++-----
+ 3 files changed, 18 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
+index a141680f3c1c..fe48164dce1e 100644
+--- a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
++++ b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
+@@ -413,10 +413,10 @@ struct ice_aqc_vsi_props {
+ #define ICE_AQ_VSI_INNER_VLAN_INSERT_PVID	BIT(2)
+ #define ICE_AQ_VSI_INNER_VLAN_EMODE_S		3
+ #define ICE_AQ_VSI_INNER_VLAN_EMODE_M		(0x3 << ICE_AQ_VSI_INNER_VLAN_EMODE_S)
+-#define ICE_AQ_VSI_INNER_VLAN_EMODE_STR_BOTH	(0x0 << ICE_AQ_VSI_INNER_VLAN_EMODE_S)
+-#define ICE_AQ_VSI_INNER_VLAN_EMODE_STR_UP	(0x1 << ICE_AQ_VSI_INNER_VLAN_EMODE_S)
+-#define ICE_AQ_VSI_INNER_VLAN_EMODE_STR		(0x2 << ICE_AQ_VSI_INNER_VLAN_EMODE_S)
+-#define ICE_AQ_VSI_INNER_VLAN_EMODE_NOTHING	(0x3 << ICE_AQ_VSI_INNER_VLAN_EMODE_S)
++#define ICE_AQ_VSI_INNER_VLAN_EMODE_STR_BOTH	0x0U
++#define ICE_AQ_VSI_INNER_VLAN_EMODE_STR_UP	0x1U
++#define ICE_AQ_VSI_INNER_VLAN_EMODE_STR		0x2U
++#define ICE_AQ_VSI_INNER_VLAN_EMODE_NOTHING	0x3U
+ 	u8 inner_vlan_reserved2[3];
+ 	/* ingress egress up sections */
+ 	__le32 ingress_table; /* bitmap, 3 bits per up */
+@@ -482,7 +482,7 @@ struct ice_aqc_vsi_props {
+ #define ICE_AQ_VSI_Q_OPT_RSS_GBL_LUT_S		2
+ #define ICE_AQ_VSI_Q_OPT_RSS_GBL_LUT_M		(0xF << ICE_AQ_VSI_Q_OPT_RSS_GBL_LUT_S)
+ #define ICE_AQ_VSI_Q_OPT_RSS_HASH_S		6
+-#define ICE_AQ_VSI_Q_OPT_RSS_HASH_M		(0x3 << ICE_AQ_VSI_Q_OPT_RSS_HASH_S)
++#define ICE_AQ_VSI_Q_OPT_RSS_HASH_M		GENMASK(7, 6)
+ #define ICE_AQ_VSI_Q_OPT_RSS_HASH_TPLZ		0x0U
+ #define ICE_AQ_VSI_Q_OPT_RSS_HASH_SYM_TPLZ	0x1U
+ #define ICE_AQ_VSI_Q_OPT_RSS_HASH_XOR		0x2U
+diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c
+index f074a1cf7166..cc6c04a69b28 100644
+--- a/drivers/net/ethernet/intel/ice/ice_lib.c
++++ b/drivers/net/ethernet/intel/ice/ice_lib.c
+@@ -878,7 +878,8 @@ static void ice_set_dflt_vsi_ctx(struct ice_hw *hw, struct ice_vsi_ctx *ctxt)
+ 	 */
+ 	if (ice_is_dvm_ena(hw)) {
+ 		ctxt->info.inner_vlan_flags |=
+-			ICE_AQ_VSI_INNER_VLAN_EMODE_NOTHING;
++			FIELD_PREP(ICE_AQ_VSI_INNER_VLAN_EMODE_M,
++				   ICE_AQ_VSI_INNER_VLAN_EMODE_NOTHING);
+ 		ctxt->info.outer_vlan_flags =
+ 			(ICE_AQ_VSI_OUTER_VLAN_TX_MODE_ALL <<
+ 			 ICE_AQ_VSI_OUTER_VLAN_TX_MODE_S) &
+diff --git a/drivers/net/ethernet/intel/ice/ice_vsi_vlan_lib.c b/drivers/net/ethernet/intel/ice/ice_vsi_vlan_lib.c
+index 5b4a0abb4607..239266e9d5f1 100644
+--- a/drivers/net/ethernet/intel/ice/ice_vsi_vlan_lib.c
++++ b/drivers/net/ethernet/intel/ice/ice_vsi_vlan_lib.c
+@@ -131,6 +131,7 @@ static int ice_vsi_manage_vlan_stripping(struct ice_vsi *vsi, bool ena)
+ {
+ 	struct ice_hw *hw = &vsi->back->hw;
+ 	struct ice_vsi_ctx *ctxt;
++	u8 *ivf;
+ 	int err;
+ 
+ 	/* do not allow modifying VLAN stripping when a port VLAN is configured
+@@ -143,19 +144,24 @@ static int ice_vsi_manage_vlan_stripping(struct ice_vsi *vsi, bool ena)
+ 	if (!ctxt)
+ 		return -ENOMEM;
+ 
++	ivf = &ctxt->info.inner_vlan_flags;
++
+ 	/* Here we are configuring what the VSI should do with the VLAN tag in
+ 	 * the Rx packet. We can either leave the tag in the packet or put it in
+ 	 * the Rx descriptor.
+ 	 */
+-	if (ena)
++	if (ena) {
+ 		/* Strip VLAN tag from Rx packet and put it in the desc */
+-		ctxt->info.inner_vlan_flags = ICE_AQ_VSI_INNER_VLAN_EMODE_STR_BOTH;
+-	else
++		*ivf = FIELD_PREP(ICE_AQ_VSI_INNER_VLAN_EMODE_M,
++				  ICE_AQ_VSI_INNER_VLAN_EMODE_STR_BOTH);
++	} else {
+ 		/* Disable stripping. Leave tag in packet */
+-		ctxt->info.inner_vlan_flags = ICE_AQ_VSI_INNER_VLAN_EMODE_NOTHING;
++		*ivf = FIELD_PREP(ICE_AQ_VSI_INNER_VLAN_EMODE_M,
++				  ICE_AQ_VSI_INNER_VLAN_EMODE_NOTHING);
++	}
+ 
+ 	/* Allow all packets untagged/tagged */
+-	ctxt->info.inner_vlan_flags |= ICE_AQ_VSI_INNER_VLAN_TX_MODE_ALL;
++	*ivf |= ICE_AQ_VSI_INNER_VLAN_TX_MODE_ALL;
+ 
+ 	ctxt->info.valid_sections = cpu_to_le16(ICE_AQ_VSI_PROP_VLAN_VALID);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/ionic-bypass-firmware-cmds-when-stuck-in-reset.patch b/queue-6.1/ionic-bypass-firmware-cmds-when-stuck-in-reset.patch
new file mode 100644
index 00000000000..923b4d0d28c
--- /dev/null
+++ b/queue-6.1/ionic-bypass-firmware-cmds-when-stuck-in-reset.patch
@@ -0,0 +1,100 @@
+From 4064030071d943ed053d81cb9448b4e04745e56d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Dec 2023 10:57:59 -0800
+Subject: ionic: bypass firmware cmds when stuck in reset
+
+From: Shannon Nelson <shannon.nelson@amd.com>
+
+[ Upstream commit ca5fdf9a7c5b65968c718f2be159cda4c13556a1 ]
+
+If the driver or firmware is stuck in reset state, don't bother
+trying to use adminq commands.  This speeds up shutdown and
+prevents unnecessary timeouts and error messages.
+
+This includes a bit of rework on ionic_adminq_post_wait()
+and ionic_adminq_post_wait_nomsg() to both use
+__ionic_adminq_post_wait() which can do the checks needed in
+both cases.
+
+Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
+Reviewed-by: Brett Creeley <brett.creeley@amd.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/pensando/ionic/ionic_bus_pci.c   |  4 ++++
+ .../net/ethernet/pensando/ionic/ionic_lif.c   |  3 +++
+ .../net/ethernet/pensando/ionic/ionic_main.c  | 20 ++++++++++++-------
+ 3 files changed, 20 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c b/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c
+index ce436e97324a..4b9caec6eb9b 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c
+@@ -380,6 +380,10 @@ static void ionic_remove(struct pci_dev *pdev)
+ 	del_timer_sync(&ionic->watchdog_timer);
+ 
+ 	if (ionic->lif) {
++		/* prevent adminq cmds if already known as down */
++		if (test_and_clear_bit(IONIC_LIF_F_FW_RESET, ionic->lif->state))
++			set_bit(IONIC_LIF_F_FW_STOPPING, ionic->lif->state);
++
+ 		ionic_lif_unregister(ionic->lif);
+ 		ionic_devlink_unregister(ionic);
+ 		ionic_lif_deinit(ionic->lif);
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+index f7634884c750..fcc3faecb060 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+@@ -3008,6 +3008,9 @@ static void ionic_lif_reset(struct ionic_lif *lif)
+ {
+ 	struct ionic_dev *idev = &lif->ionic->idev;
+ 
++	if (!ionic_is_fw_running(idev))
++		return;
++
+ 	mutex_lock(&lif->ionic->dev_cmd_lock);
+ 	ionic_dev_cmd_lif_reset(idev, lif->index);
+ 	ionic_dev_cmd_wait(lif->ionic, DEVCMD_TIMEOUT);
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_main.c b/drivers/net/ethernet/pensando/ionic/ionic_main.c
+index 9ecbbe7a02ec..d2038ff316ca 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_main.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_main.c
+@@ -410,22 +410,28 @@ int ionic_adminq_wait(struct ionic_lif *lif, struct ionic_admin_ctx *ctx,
+ 				      do_msg);
+ }
+ 
+-int ionic_adminq_post_wait(struct ionic_lif *lif, struct ionic_admin_ctx *ctx)
++static int __ionic_adminq_post_wait(struct ionic_lif *lif,
++				    struct ionic_admin_ctx *ctx,
++				    const bool do_msg)
+ {
+ 	int err;
+ 
++	if (!ionic_is_fw_running(&lif->ionic->idev))
++		return 0;
++
+ 	err = ionic_adminq_post(lif, ctx);
+ 
+-	return ionic_adminq_wait(lif, ctx, err, true);
++	return ionic_adminq_wait(lif, ctx, err, do_msg);
+ }
+ 
+-int ionic_adminq_post_wait_nomsg(struct ionic_lif *lif, struct ionic_admin_ctx *ctx)
++int ionic_adminq_post_wait(struct ionic_lif *lif, struct ionic_admin_ctx *ctx)
+ {
+-	int err;
+-
+-	err = ionic_adminq_post(lif, ctx);
++	return __ionic_adminq_post_wait(lif, ctx, true);
++}
+ 
+-	return ionic_adminq_wait(lif, ctx, err, false);
++int ionic_adminq_post_wait_nomsg(struct ionic_lif *lif, struct ionic_admin_ctx *ctx)
++{
++	return __ionic_adminq_post_wait(lif, ctx, false);
+ }
+ 
+ static void ionic_dev_cmd_clean(struct ionic *ionic)
+-- 
+2.43.0
+
diff --git a/queue-6.1/ionic-pass-opcode-to-devcmd_wait.patch b/queue-6.1/ionic-pass-opcode-to-devcmd_wait.patch
new file mode 100644
index 00000000000..300ff9ef8cc
--- /dev/null
+++ b/queue-6.1/ionic-pass-opcode-to-devcmd_wait.patch
@@ -0,0 +1,63 @@
+From cbc226751ac137696e9e7a9e26b1e07d987ba279 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Dec 2023 10:57:57 -0800
+Subject: ionic: pass opcode to devcmd_wait
+
+From: Shannon Nelson <shannon.nelson@amd.com>
+
+[ Upstream commit 24f110240c03c6b5368f1203bac72883d511e606 ]
+
+Don't rely on the PCI memory for the devcmd opcode because we
+read a 0xff value if the PCI bus is broken, which can cause us
+to report a bogus dev_cmd opcode later.
+
+Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
+Reviewed-by: Brett Creeley <brett.creeley@amd.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pensando/ionic/ionic_dev.c  | 1 +
+ drivers/net/ethernet/pensando/ionic/ionic_dev.h  | 1 +
+ drivers/net/ethernet/pensando/ionic/ionic_main.c | 2 +-
+ 3 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_dev.c b/drivers/net/ethernet/pensando/ionic/ionic_dev.c
+index 344a3924627d..7adfcd7c2f3a 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_dev.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_dev.c
+@@ -293,6 +293,7 @@ void ionic_dev_cmd_comp(struct ionic_dev *idev, union ionic_dev_cmd_comp *comp)
+ 
+ void ionic_dev_cmd_go(struct ionic_dev *idev, union ionic_dev_cmd *cmd)
+ {
++	idev->opcode = cmd->cmd.opcode;
+ 	memcpy_toio(&idev->dev_cmd_regs->cmd, cmd, sizeof(*cmd));
+ 	iowrite32(0, &idev->dev_cmd_regs->done);
+ 	iowrite32(1, &idev->dev_cmd_regs->doorbell);
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_dev.h b/drivers/net/ethernet/pensando/ionic/ionic_dev.h
+index 13dfcf9f75da..c10da629ef6e 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_dev.h
++++ b/drivers/net/ethernet/pensando/ionic/ionic_dev.h
+@@ -150,6 +150,7 @@ struct ionic_dev {
+ 	bool fw_hb_ready;
+ 	bool fw_status_ready;
+ 	u8 fw_generation;
++	u8 opcode;
+ 
+ 	u64 __iomem *db_pages;
+ 	dma_addr_t phy_db_pages;
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_main.c b/drivers/net/ethernet/pensando/ionic/ionic_main.c
+index 79272f5f380c..9ecbbe7a02ec 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_main.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_main.c
+@@ -465,7 +465,7 @@ static int __ionic_dev_cmd_wait(struct ionic *ionic, unsigned long max_seconds,
+ 	 */
+ 	max_wait = jiffies + (max_seconds * HZ);
+ try_again:
+-	opcode = readb(&idev->dev_cmd_regs->cmd.cmd.opcode);
++	opcode = idev->opcode;
+ 	start_time = jiffies;
+ 	for (fw_up = ionic_is_fw_running(idev);
+ 	     !done && fw_up && time_before(jiffies, max_wait);
+-- 
+2.43.0
+
diff --git a/queue-6.1/jfs-fix-array-index-out-of-bounds-in-dbadjtree.patch b/queue-6.1/jfs-fix-array-index-out-of-bounds-in-dbadjtree.patch
new file mode 100644
index 00000000000..75aba4bd6bb
--- /dev/null
+++ b/queue-6.1/jfs-fix-array-index-out-of-bounds-in-dbadjtree.patch
@@ -0,0 +1,239 @@
+From 504c27bad477c8b00e39e55482f7aad0763e787a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Oct 2023 17:33:56 +0530
+Subject: jfs: fix array-index-out-of-bounds in dbAdjTree
+
+From: Manas Ghandat <ghandatmanas@gmail.com>
+
+[ Upstream commit 74ecdda68242b174920fe7c6133a856fb7d8559b ]
+
+Currently there is a bound check missing in the dbAdjTree while
+accessing the dmt_stree. To add the required check added the bool is_ctl
+which is required to determine the size as suggest in the following
+commit.
+https://lore.kernel.org/linux-kernel-mentees/f9475918-2186-49b8-b801-6f0f9e75f4fa@oracle.com/
+
+Reported-by: syzbot+39ba34a099ac2e9bd3cb@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb
+Signed-off-by: Manas Ghandat <ghandatmanas@gmail.com>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_dmap.c | 60 ++++++++++++++++++++++++-----------------------
+ 1 file changed, 31 insertions(+), 29 deletions(-)
+
+diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
+index 34e230b2110b..4462274e325a 100644
+--- a/fs/jfs/jfs_dmap.c
++++ b/fs/jfs/jfs_dmap.c
+@@ -63,10 +63,10 @@
+  */
+ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno,
+ 			int nblocks);
+-static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval);
+-static int dbBackSplit(dmtree_t * tp, int leafno);
+-static int dbJoin(dmtree_t * tp, int leafno, int newval);
+-static void dbAdjTree(dmtree_t * tp, int leafno, int newval);
++static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl);
++static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl);
++static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl);
++static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl);
+ static int dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc,
+ 		    int level);
+ static int dbAllocAny(struct bmap * bmp, s64 nblocks, int l2nb, s64 * results);
+@@ -2103,7 +2103,7 @@ static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno,
+ 		 * system.
+ 		 */
+ 		if (dp->tree.stree[word] == NOFREE)
+-			dbBackSplit((dmtree_t *) & dp->tree, word);
++			dbBackSplit((dmtree_t *)&dp->tree, word, false);
+ 
+ 		dbAllocBits(bmp, dp, blkno, nblocks);
+ 	}
+@@ -2189,7 +2189,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno,
+ 			 * the binary system of the leaves if need be.
+ 			 */
+ 			dbSplit(tp, word, BUDMIN,
+-				dbMaxBud((u8 *) & dp->wmap[word]));
++				dbMaxBud((u8 *)&dp->wmap[word]), false);
+ 
+ 			word += 1;
+ 		} else {
+@@ -2229,7 +2229,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno,
+ 				 * system of the leaves to reflect the current
+ 				 * allocation (size).
+ 				 */
+-				dbSplit(tp, word, size, NOFREE);
++				dbSplit(tp, word, size, NOFREE, false);
+ 
+ 				/* get the number of dmap words handled */
+ 				nw = BUDSIZE(size, BUDMIN);
+@@ -2336,7 +2336,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno,
+ 			/* update the leaf for this dmap word.
+ 			 */
+ 			rc = dbJoin(tp, word,
+-				    dbMaxBud((u8 *) & dp->wmap[word]));
++				    dbMaxBud((u8 *)&dp->wmap[word]), false);
+ 			if (rc)
+ 				return rc;
+ 
+@@ -2369,7 +2369,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno,
+ 
+ 				/* update the leaf.
+ 				 */
+-				rc = dbJoin(tp, word, size);
++				rc = dbJoin(tp, word, size, false);
+ 				if (rc)
+ 					return rc;
+ 
+@@ -2521,16 +2521,16 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)
+ 		 * that it is at the front of a binary buddy system.
+ 		 */
+ 		if (oldval == NOFREE) {
+-			rc = dbBackSplit((dmtree_t *) dcp, leafno);
++			rc = dbBackSplit((dmtree_t *)dcp, leafno, true);
+ 			if (rc) {
+ 				release_metapage(mp);
+ 				return rc;
+ 			}
+ 			oldval = dcp->stree[ti];
+ 		}
+-		dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval);
++		dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval, true);
+ 	} else {
+-		rc = dbJoin((dmtree_t *) dcp, leafno, newval);
++		rc = dbJoin((dmtree_t *) dcp, leafno, newval, true);
+ 		if (rc) {
+ 			release_metapage(mp);
+ 			return rc;
+@@ -2561,7 +2561,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)
+ 				 */
+ 				if (alloc) {
+ 					dbJoin((dmtree_t *) dcp, leafno,
+-					       oldval);
++					       oldval, true);
+ 				} else {
+ 					/* the dbJoin() above might have
+ 					 * caused a larger binary buddy system
+@@ -2571,9 +2571,9 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)
+ 					 */
+ 					if (dcp->stree[ti] == NOFREE)
+ 						dbBackSplit((dmtree_t *)
+-							    dcp, leafno);
++							    dcp, leafno, true);
+ 					dbSplit((dmtree_t *) dcp, leafno,
+-						dcp->budmin, oldval);
++						dcp->budmin, oldval, true);
+ 				}
+ 
+ 				/* release the buffer and return the error.
+@@ -2621,7 +2621,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)
+  *
+  * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit;
+  */
+-static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval)
++static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl)
+ {
+ 	int budsz;
+ 	int cursz;
+@@ -2643,7 +2643,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval)
+ 		while (cursz >= splitsz) {
+ 			/* update the buddy's leaf with its new value.
+ 			 */
+-			dbAdjTree(tp, leafno ^ budsz, cursz);
++			dbAdjTree(tp, leafno ^ budsz, cursz, is_ctl);
+ 
+ 			/* on to the next size and buddy.
+ 			 */
+@@ -2655,7 +2655,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval)
+ 	/* adjust the dmap tree to reflect the specified leaf's new
+ 	 * value.
+ 	 */
+-	dbAdjTree(tp, leafno, newval);
++	dbAdjTree(tp, leafno, newval, is_ctl);
+ }
+ 
+ 
+@@ -2686,7 +2686,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval)
+  *
+  * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit;
+  */
+-static int dbBackSplit(dmtree_t * tp, int leafno)
++static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl)
+ {
+ 	int budsz, bud, w, bsz, size;
+ 	int cursz;
+@@ -2737,7 +2737,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno)
+ 				 * system in two.
+ 				 */
+ 				cursz = leaf[bud] - 1;
+-				dbSplit(tp, bud, cursz, cursz);
++				dbSplit(tp, bud, cursz, cursz, is_ctl);
+ 				break;
+ 			}
+ 		}
+@@ -2765,7 +2765,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno)
+  *
+  * RETURN VALUES: none
+  */
+-static int dbJoin(dmtree_t * tp, int leafno, int newval)
++static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl)
+ {
+ 	int budsz, buddy;
+ 	s8 *leaf;
+@@ -2820,12 +2820,12 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval)
+ 			if (leafno < buddy) {
+ 				/* leafno is the left buddy.
+ 				 */
+-				dbAdjTree(tp, buddy, NOFREE);
++				dbAdjTree(tp, buddy, NOFREE, is_ctl);
+ 			} else {
+ 				/* buddy is the left buddy and becomes
+ 				 * leafno.
+ 				 */
+-				dbAdjTree(tp, leafno, NOFREE);
++				dbAdjTree(tp, leafno, NOFREE, is_ctl);
+ 				leafno = buddy;
+ 			}
+ 
+@@ -2838,7 +2838,7 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval)
+ 
+ 	/* update the leaf value.
+ 	 */
+-	dbAdjTree(tp, leafno, newval);
++	dbAdjTree(tp, leafno, newval, is_ctl);
+ 
+ 	return 0;
+ }
+@@ -2859,21 +2859,23 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval)
+  *
+  * RETURN VALUES: none
+  */
+-static void dbAdjTree(dmtree_t * tp, int leafno, int newval)
++static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl)
+ {
+ 	int lp, pp, k;
+-	int max;
++	int max, size;
++
++	size = is_ctl ? CTLTREESIZE : TREESIZE;
+ 
+ 	/* pick up the index of the leaf for this leafno.
+ 	 */
+ 	lp = leafno + le32_to_cpu(tp->dmt_leafidx);
+ 
++	if (WARN_ON_ONCE(lp >= size || lp < 0))
++		return;
++
+ 	/* is the current value the same as the old value ?  if so,
+ 	 * there is nothing to do.
+ 	 */
+-	if (WARN_ON_ONCE(lp >= CTLTREESIZE))
+-		return;
+-
+ 	if (tp->dmt_stree[lp] == newval)
+ 		return;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/jfs-fix-array-index-out-of-bounds-in-dinewext.patch b/queue-6.1/jfs-fix-array-index-out-of-bounds-in-dinewext.patch
new file mode 100644
index 00000000000..e4185d3ac23
--- /dev/null
+++ b/queue-6.1/jfs-fix-array-index-out-of-bounds-in-dinewext.patch
@@ -0,0 +1,78 @@
+From 99a5b24b7034855bd61e2d5cad4d9f214cf1a810 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Dec 2023 09:36:22 +0800
+Subject: jfs: fix array-index-out-of-bounds in diNewExt
+
+From: Edward Adam Davis <eadavis@qq.com>
+
+[ Upstream commit 49f9637aafa6e63ba686c13cb8549bf5e6920402 ]
+
+[Syz report]
+UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:2360:2
+index -878706688 is out of range for type 'struct iagctl[128]'
+CPU: 1 PID: 5065 Comm: syz-executor282 Not tainted 6.7.0-rc4-syzkaller-00009-gbee0e7762ad2 #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
+ ubsan_epilogue lib/ubsan.c:217 [inline]
+ __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348
+ diNewExt+0x3cf3/0x4000 fs/jfs/jfs_imap.c:2360
+ diAllocExt fs/jfs/jfs_imap.c:1949 [inline]
+ diAllocAG+0xbe8/0x1e50 fs/jfs/jfs_imap.c:1666
+ diAlloc+0x1d3/0x1760 fs/jfs/jfs_imap.c:1587
+ ialloc+0x8f/0x900 fs/jfs/jfs_inode.c:56
+ jfs_mkdir+0x1c5/0xb90 fs/jfs/namei.c:225
+ vfs_mkdir+0x2f1/0x4b0 fs/namei.c:4106
+ do_mkdirat+0x264/0x3a0 fs/namei.c:4129
+ __do_sys_mkdir fs/namei.c:4149 [inline]
+ __se_sys_mkdir fs/namei.c:4147 [inline]
+ __x64_sys_mkdir+0x6e/0x80 fs/namei.c:4147
+ do_syscall_x64 arch/x86/entry/common.c:51 [inline]
+ do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82
+ entry_SYSCALL_64_after_hwframe+0x63/0x6b
+RIP: 0033:0x7fcb7e6a0b57
+Code: ff ff 77 07 31 c0 c3 0f 1f 40 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
+RSP: 002b:00007ffd83023038 EFLAGS: 00000286 ORIG_RAX: 0000000000000053
+RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007fcb7e6a0b57
+RDX: 00000000000a1020 RSI: 00000000000001ff RDI: 0000000020000140
+RBP: 0000000020000140 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000286 R12: 00007ffd830230d0
+R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
+
+[Analysis]
+When the agstart is too large, it can cause agno overflow.
+
+[Fix]
+After obtaining agno, if the value is invalid, exit the subsequent process.
+
+Reported-and-tested-by: syzbot+553d90297e6d2f50dbc7@syzkaller.appspotmail.com
+Signed-off-by: Edward Adam Davis <eadavis@qq.com>
+
+Modified the test from agno > MAXAG to agno >= MAXAG based on linux-next
+report by kernel test robot (Dan Carpenter).
+
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_imap.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
+index 6ed2e1d4c894..ac42f8ee553f 100644
+--- a/fs/jfs/jfs_imap.c
++++ b/fs/jfs/jfs_imap.c
+@@ -2179,6 +2179,9 @@ static int diNewExt(struct inomap * imap, struct iag * iagp, int extno)
+ 	/* get the ag and iag numbers for this iag.
+ 	 */
+ 	agno = BLKTOAG(le64_to_cpu(iagp->agstart), sbi);
++	if (agno >= MAXAG || agno < 0)
++		return -EIO;
++
+ 	iagno = le32_to_cpu(iagp->iagnum);
+ 
+ 	/* check if this is the last free extent within the
+-- 
+2.43.0
+
diff --git a/queue-6.1/jfs-fix-slab-out-of-bounds-read-in-dtsearch.patch b/queue-6.1/jfs-fix-slab-out-of-bounds-read-in-dtsearch.patch
new file mode 100644
index 00000000000..ffab05642ab
--- /dev/null
+++ b/queue-6.1/jfs-fix-slab-out-of-bounds-read-in-dtsearch.patch
@@ -0,0 +1,45 @@
+From 489316e95a3d6fd98bfadeab5a89489ddffc88ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Oct 2023 11:39:07 +0530
+Subject: jfs: fix slab-out-of-bounds Read in dtSearch
+
+From: Manas Ghandat <ghandatmanas@gmail.com>
+
+[ Upstream commit fa5492ee89463a7590a1449358002ff7ef63529f ]
+
+Currently while searching for current page in the sorted entry table
+of the page there is a out of bound access. Added a bound check to fix
+the error.
+
+Dave:
+Set return code to -EIO
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/202310241724.Ed02yUz9-lkp@intel.com/
+Signed-off-by: Manas Ghandat <ghandatmanas@gmail.com>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_dtree.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
+index f3d3e8b3f50c..031d8f570f58 100644
+--- a/fs/jfs/jfs_dtree.c
++++ b/fs/jfs/jfs_dtree.c
+@@ -633,6 +633,11 @@ int dtSearch(struct inode *ip, struct component_name * key, ino_t * data,
+ 		for (base = 0, lim = p->header.nextindex; lim; lim >>= 1) {
+ 			index = base + (lim >> 1);
+ 
++			if (stbl[index] < 0) {
++				rc = -EIO;
++				goto out;
++			}
++
+ 			if (p->header.flag & BT_LEAF) {
+ 				/* uppercase leaf name to compare */
+ 				cmp =
+-- 
+2.43.0
+
diff --git a/queue-6.1/jfs-fix-uaf-in-jfs_evict_inode.patch b/queue-6.1/jfs-fix-uaf-in-jfs_evict_inode.patch
new file mode 100644
index 00000000000..08b51381bbe
--- /dev/null
+++ b/queue-6.1/jfs-fix-uaf-in-jfs_evict_inode.patch
@@ -0,0 +1,50 @@
+From d6d875c1d03b4e19027440e8dca52dabf64766e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Oct 2023 13:39:04 +0800
+Subject: jfs: fix uaf in jfs_evict_inode
+
+From: Edward Adam Davis <eadavis@qq.com>
+
+[ Upstream commit e0e1958f4c365e380b17ccb35617345b31ef7bf3 ]
+
+When the execution of diMount(ipimap) fails, the object ipimap that has been
+released may be accessed in diFreeSpecial(). Asynchronous ipimap release occurs
+when rcu_core() calls jfs_free_node().
+
+Therefore, when diMount(ipimap) fails, sbi->ipimap should not be initialized as
+ipimap.
+
+Reported-and-tested-by: syzbot+01cf2dbcbe2022454388@syzkaller.appspotmail.com
+Signed-off-by: Edward Adam Davis <eadavis@qq.com>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_mount.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/jfs/jfs_mount.c b/fs/jfs/jfs_mount.c
+index 48d1f70f786c..21d8d4a5c67a 100644
+--- a/fs/jfs/jfs_mount.c
++++ b/fs/jfs/jfs_mount.c
+@@ -172,15 +172,15 @@ int jfs_mount(struct super_block *sb)
+ 	}
+ 	jfs_info("jfs_mount: ipimap:0x%p", ipimap);
+ 
+-	/* map further access of per fileset inodes by the fileset inode */
+-	sbi->ipimap = ipimap;
+-
+ 	/* initialize fileset inode allocation map */
+ 	if ((rc = diMount(ipimap))) {
+ 		jfs_err("jfs_mount: diMount failed w/rc = %d", rc);
+ 		goto err_ipimap;
+ 	}
+ 
++	/* map further access of per fileset inodes by the fileset inode */
++	sbi->ipimap = ipimap;
++
+ 	return rc;
+ 
+ 	/*
+-- 
+2.43.0
+
diff --git a/queue-6.1/kvm-s390-fix-setting-of-fpc-register.patch b/queue-6.1/kvm-s390-fix-setting-of-fpc-register.patch
new file mode 100644
index 00000000000..37b70f3404e
--- /dev/null
+++ b/queue-6.1/kvm-s390-fix-setting-of-fpc-register.patch
@@ -0,0 +1,70 @@
+From 1371cd9fec2edf491e2de4fac72455738fd6db91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 18:56:00 +0100
+Subject: KVM: s390: fix setting of fpc register
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+[ Upstream commit b988b1bb0053c0dcd26187d29ef07566a565cf55 ]
+
+kvm_arch_vcpu_ioctl_set_fpu() allows to set the floating point control
+(fpc) register of a guest cpu. The new value is tested for validity by
+temporarily loading it into the fpc register.
+
+This may lead to corruption of the fpc register of the host process:
+if an interrupt happens while the value is temporarily loaded into the fpc
+register, and within interrupt context floating point or vector registers
+are used, the current fp/vx registers are saved with save_fpu_regs()
+assuming they belong to user space and will be loaded into fp/vx registers
+when returning to user space.
+
+test_fp_ctl() restores the original user space / host process fpc register
+value, however it will be discarded, when returning to user space.
+
+In result the host process will incorrectly continue to run with the value
+that was supposed to be used for a guest cpu.
+
+Fix this by simply removing the test. There is another test right before
+the SIE context is entered which will handles invalid values.
+
+This results in a change of behaviour: invalid values will now be accepted
+instead of that the ioctl fails with -EINVAL. This seems to be acceptable,
+given that this interface is most likely not used anymore, and this is in
+addition the same behaviour implemented with the memory mapped interface
+(replace invalid values with zero) - see sync_regs() in kvm-s390.c.
+
+Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kvm/kvm-s390.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index 3775363471f0..f604946ab2c8 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -4138,10 +4138,6 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
+ 
+ 	vcpu_load(vcpu);
+ 
+-	if (test_fp_ctl(fpu->fpc)) {
+-		ret = -EINVAL;
+-		goto out;
+-	}
+ 	vcpu->run->s.regs.fpc = fpu->fpc;
+ 	if (MACHINE_HAS_VX)
+ 		convert_fp_to_vx((__vector128 *) vcpu->run->s.regs.vrs,
+@@ -4149,7 +4145,6 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
+ 	else
+ 		memcpy(vcpu->run->s.regs.fprs, &fpu->fprs, sizeof(fpu->fprs));
+ 
+-out:
+ 	vcpu_put(vcpu);
+ 	return ret;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/leds-trigger-panic-don-t-register-panic-notifier-if-.patch b/queue-6.1/leds-trigger-panic-don-t-register-panic-notifier-if-.patch
new file mode 100644
index 00000000000..58a8eb92aaa
--- /dev/null
+++ b/queue-6.1/leds-trigger-panic-don-t-register-panic-notifier-if-.patch
@@ -0,0 +1,43 @@
+From 0004035b22c23c57647535ab736d8b3db0976b86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Dec 2023 21:05:33 +0100
+Subject: leds: trigger: panic: Don't register panic notifier if creating the
+ trigger failed
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit afacb21834bb02785ddb0c3ec197208803b74faa ]
+
+It doesn't make sense to register the panic notifier if creating the
+panic trigger failed.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://lore.kernel.org/r/8a61e229-5388-46c7-919a-4d18cc7362b2@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/trigger/ledtrig-panic.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/leds/trigger/ledtrig-panic.c b/drivers/leds/trigger/ledtrig-panic.c
+index 64abf2e91608..5a6b21bfeb9a 100644
+--- a/drivers/leds/trigger/ledtrig-panic.c
++++ b/drivers/leds/trigger/ledtrig-panic.c
+@@ -64,10 +64,13 @@ static long led_panic_blink(int state)
+ 
+ static int __init ledtrig_panic_init(void)
+ {
++	led_trigger_register_simple("panic", &trigger);
++	if (!trigger)
++		return -ENOMEM;
++
+ 	atomic_notifier_chain_register(&panic_notifier_list,
+ 				       &led_trigger_panic_nb);
+ 
+-	led_trigger_register_simple("panic", &trigger);
+ 	panic_blink = led_panic_blink;
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/libbpf-fix-null-pointer-dereference-in-bpf_object__c.patch b/queue-6.1/libbpf-fix-null-pointer-dereference-in-bpf_object__c.patch
new file mode 100644
index 00000000000..7d2bd7690db
--- /dev/null
+++ b/queue-6.1/libbpf-fix-null-pointer-dereference-in-bpf_object__c.patch
@@ -0,0 +1,73 @@
+From 5c9ad8ed6ffd45491881a11433a91d8baa0febce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Dec 2023 11:39:47 +0800
+Subject: libbpf: Fix NULL pointer dereference in
+ bpf_object__collect_prog_relos
+
+From: Mingyi Zhang <zhangmingyi5@huawei.com>
+
+[ Upstream commit fc3a5534e2a8855427403113cbeb54af5837bbe0 ]
+
+An issue occurred while reading an ELF file in libbpf.c during fuzzing:
+
+	Program received signal SIGSEGV, Segmentation fault.
+	0x0000000000958e97 in bpf_object.collect_prog_relos () at libbpf.c:4206
+	4206 in libbpf.c
+	(gdb) bt
+	#0 0x0000000000958e97 in bpf_object.collect_prog_relos () at libbpf.c:4206
+	#1 0x000000000094f9d6 in bpf_object.collect_relos () at libbpf.c:6706
+	#2 0x000000000092bef3 in bpf_object_open () at libbpf.c:7437
+	#3 0x000000000092c046 in bpf_object.open_mem () at libbpf.c:7497
+	#4 0x0000000000924afa in LLVMFuzzerTestOneInput () at fuzz/bpf-object-fuzzer.c:16
+	#5 0x000000000060be11 in testblitz_engine::fuzzer::Fuzzer::run_one ()
+	#6 0x000000000087ad92 in tracing::span::Span::in_scope ()
+	#7 0x00000000006078aa in testblitz_engine::fuzzer::util::walkdir ()
+	#8 0x00000000005f3217 in testblitz_engine::entrypoint::main::{{closure}} ()
+	#9 0x00000000005f2601 in main ()
+	(gdb)
+
+scn_data was null at this code(tools/lib/bpf/src/libbpf.c):
+
+	if (rel->r_offset % BPF_INSN_SZ || rel->r_offset >= scn_data->d_size) {
+
+The scn_data is derived from the code above:
+
+	scn = elf_sec_by_idx(obj, sec_idx);
+	scn_data = elf_sec_data(obj, scn);
+
+	relo_sec_name = elf_sec_str(obj, shdr->sh_name);
+	sec_name = elf_sec_name(obj, scn);
+	if (!relo_sec_name || !sec_name)// don't check whether scn_data is NULL
+		return -EINVAL;
+
+In certain special scenarios, such as reading a malformed ELF file,
+it is possible that scn_data may be a null pointer
+
+Signed-off-by: Mingyi Zhang <zhangmingyi5@huawei.com>
+Signed-off-by: Xin Liu <liuxin350@huawei.com>
+Signed-off-by: Changye Wu <wuchangye@huawei.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20231221033947.154564-1-liuxin350@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index 10f15a3e3a95..e2014b1250ea 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -4157,6 +4157,8 @@ bpf_object__collect_prog_relos(struct bpf_object *obj, Elf64_Shdr *shdr, Elf_Dat
+ 
+ 	scn = elf_sec_by_idx(obj, sec_idx);
+ 	scn_data = elf_sec_data(obj, scn);
++	if (!scn_data)
++		return -LIBBPF_ERRNO__FORMAT;
+ 
+ 	relo_sec_name = elf_sec_str(obj, shdr->sh_name);
+ 	sec_name = elf_sec_name(obj, scn);
+-- 
+2.43.0
+
diff --git a/queue-6.1/libsubcmd-fix-memory-leak-in-uniq.patch b/queue-6.1/libsubcmd-fix-memory-leak-in-uniq.patch
new file mode 100644
index 00000000000..01b86c96fae
--- /dev/null
+++ b/queue-6.1/libsubcmd-fix-memory-leak-in-uniq.patch
@@ -0,0 +1,62 @@
+From 160a9a0f1fed588661e0f00e22706402960fca30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Dec 2023 16:05:13 -0800
+Subject: libsubcmd: Fix memory leak in uniq()
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit ad30469a841b50dbb541df4d6971d891f703c297 ]
+
+uniq() will write one command name over another causing the overwritten
+string to be leaked. Fix by doing a pass that removes duplicates and a
+second that removes the holes.
+
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Chenyuan Mi <cymi20@fudan.edu.cn>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20231208000515.1693746-1-irogers@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/subcmd/help.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c
+index bf02d62a3b2b..42f57b640f11 100644
+--- a/tools/lib/subcmd/help.c
++++ b/tools/lib/subcmd/help.c
+@@ -50,11 +50,21 @@ void uniq(struct cmdnames *cmds)
+ 	if (!cmds->cnt)
+ 		return;
+ 
+-	for (i = j = 1; i < cmds->cnt; i++)
+-		if (strcmp(cmds->names[i]->name, cmds->names[i-1]->name))
+-			cmds->names[j++] = cmds->names[i];
+-
++	for (i = 1; i < cmds->cnt; i++) {
++		if (!strcmp(cmds->names[i]->name, cmds->names[i-1]->name))
++			zfree(&cmds->names[i - 1]);
++	}
++	for (i = 0, j = 0; i < cmds->cnt; i++) {
++		if (cmds->names[i]) {
++			if (i == j)
++				j++;
++			else
++				cmds->names[j++] = cmds->names[i];
++		}
++	}
+ 	cmds->cnt = j;
++	while (j < i)
++		cmds->names[j++] = NULL;
+ }
+ 
+ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes)
+-- 
+2.43.0
+
diff --git a/queue-6.1/mailbox-arm_mhuv2-fix-a-bug-for-mhuv2_sender_interru.patch b/queue-6.1/mailbox-arm_mhuv2-fix-a-bug-for-mhuv2_sender_interru.patch
new file mode 100644
index 00000000000..f3c39ec70bb
--- /dev/null
+++ b/queue-6.1/mailbox-arm_mhuv2-fix-a-bug-for-mhuv2_sender_interru.patch
@@ -0,0 +1,60 @@
+From 3a87b5e567495a2d0b86a3a5d905ad7e57753298 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Dec 2023 19:37:22 +0800
+Subject: mailbox: arm_mhuv2: Fix a bug for mhuv2_sender_interrupt
+
+From: Xiaowu.ding <xiaowu.ding@jaguarmicro.com>
+
+[ Upstream commit ee01c0b4384d19ecc5dfa7db3fd4303f965c3eba ]
+
+Message Handling Unit version is v2.1.
+
+When arm_mhuv2 working with the data protocol transfer mode.
+We have split one mhu into two channels, and every channel
+include four channel windows, the two channels share
+one gic spi interrupt.
+
+There is a problem with the sending scenario.
+
+The first channel will take up 0-3 channel windows, and the second
+channel take up 4-7 channel windows. When the first channel send the
+data, and the receiver will clear all the four channels status.
+Although we only enabled the interrupt on the last channel window with
+register CH_INT_EN,the register CHCOMB_INT_ST0 will be 0xf, not be 0x8.
+Currently we just clear the last channel windows int status with the
+data proctol mode.So after that,the CHCOMB_INT_ST0 status will be 0x7,
+not be the 0x0.
+
+Then the second channel send the data, the receiver read the
+data, clear all the four channel windows status, trigger the sender
+interrupt. But currently the CHCOMB_INT_ST0 register will be 0xf7,
+get_irq_chan_comb function will always return the first channel.
+
+So this patch clear all channel windows int status to avoid this interrupt
+confusion.
+
+Signed-off-by: Xiaowu.ding <xiaowu.ding@jaguarmicro.com>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/arm_mhuv2.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mailbox/arm_mhuv2.c b/drivers/mailbox/arm_mhuv2.c
+index c6d4957c4da8..0ec21dcdbde7 100644
+--- a/drivers/mailbox/arm_mhuv2.c
++++ b/drivers/mailbox/arm_mhuv2.c
+@@ -553,7 +553,8 @@ static irqreturn_t mhuv2_sender_interrupt(int irq, void *data)
+ 	priv = chan->con_priv;
+ 
+ 	if (!IS_PROTOCOL_DOORBELL(priv)) {
+-		writel_relaxed(1, &mhu->send->ch_wn[priv->ch_wn_idx + priv->windows - 1].int_clr);
++		for (i = 0; i < priv->windows; i++)
++			writel_relaxed(1, &mhu->send->ch_wn[priv->ch_wn_idx + i].int_clr);
+ 
+ 		if (chan->cl) {
+ 			mbox_chan_txdone(chan, 0);
+-- 
+2.43.0
+
diff --git a/queue-6.1/md-whenassemble-the-array-consult-the-superblock-of-.patch b/queue-6.1/md-whenassemble-the-array-consult-the-superblock-of-.patch
new file mode 100644
index 00000000000..273e5756bad
--- /dev/null
+++ b/queue-6.1/md-whenassemble-the-array-consult-the-superblock-of-.patch
@@ -0,0 +1,155 @@
+From 2431529c66b9112927b9d02570858aa5b9e92ee7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Dec 2023 14:24:31 +0200
+Subject: md: Whenassemble the array, consult the superblock of the freshest
+ device
+
+From: Alex Lyakas <alex.lyakas@zadara.com>
+
+[ Upstream commit dc1cc22ed58f11d58d8553c5ec5f11cbfc3e3039 ]
+
+Upon assembling the array, both kernel and mdadm allow the devices to have event
+counter difference of 1, and still consider them as up-to-date.
+However, a device whose event count is behind by 1, may in fact not be up-to-date,
+and array resync with such a device may cause data corruption.
+To avoid this, consult the superblock of the freshest device about the status
+of a device, whose event counter is behind by 1.
+
+Signed-off-by: Alex Lyakas <alex.lyakas@zadara.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/1702470271-16073-1-git-send-email-alex.lyakas@zadara.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md.c | 54 ++++++++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 44 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 6120f26a7969..3ccf1920682c 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -1145,6 +1145,7 @@ struct super_type  {
+ 					  struct md_rdev *refdev,
+ 					  int minor_version);
+ 	int		    (*validate_super)(struct mddev *mddev,
++					      struct md_rdev *freshest,
+ 					      struct md_rdev *rdev);
+ 	void		    (*sync_super)(struct mddev *mddev,
+ 					  struct md_rdev *rdev);
+@@ -1282,8 +1283,9 @@ static int super_90_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor
+ 
+ /*
+  * validate_super for 0.90.0
++ * note: we are not using "freshest" for 0.9 superblock
+  */
+-static int super_90_validate(struct mddev *mddev, struct md_rdev *rdev)
++static int super_90_validate(struct mddev *mddev, struct md_rdev *freshest, struct md_rdev *rdev)
+ {
+ 	mdp_disk_t *desc;
+ 	mdp_super_t *sb = page_address(rdev->sb_page);
+@@ -1795,7 +1797,7 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_
+ 	return ret;
+ }
+ 
+-static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev)
++static int super_1_validate(struct mddev *mddev, struct md_rdev *freshest, struct md_rdev *rdev)
+ {
+ 	struct mdp_superblock_1 *sb = page_address(rdev->sb_page);
+ 	__u64 ev1 = le64_to_cpu(sb->events);
+@@ -1891,13 +1893,15 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev)
+ 		}
+ 	} else if (mddev->pers == NULL) {
+ 		/* Insist of good event counter while assembling, except for
+-		 * spares (which don't need an event count) */
+-		++ev1;
++		 * spares (which don't need an event count).
++		 * Similar to mdadm, we allow event counter difference of 1
++		 * from the freshest device.
++		 */
+ 		if (rdev->desc_nr >= 0 &&
+ 		    rdev->desc_nr < le32_to_cpu(sb->max_dev) &&
+ 		    (le16_to_cpu(sb->dev_roles[rdev->desc_nr]) < MD_DISK_ROLE_MAX ||
+ 		     le16_to_cpu(sb->dev_roles[rdev->desc_nr]) == MD_DISK_ROLE_JOURNAL))
+-			if (ev1 < mddev->events)
++			if (ev1 + 1 < mddev->events)
+ 				return -EINVAL;
+ 	} else if (mddev->bitmap) {
+ 		/* If adding to array with a bitmap, then we can accept an
+@@ -1918,8 +1922,38 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev)
+ 		    rdev->desc_nr >= le32_to_cpu(sb->max_dev)) {
+ 			role = MD_DISK_ROLE_SPARE;
+ 			rdev->desc_nr = -1;
+-		} else
++		} else if (mddev->pers == NULL && freshest && ev1 < mddev->events) {
++			/*
++			 * If we are assembling, and our event counter is smaller than the
++			 * highest event counter, we cannot trust our superblock about the role.
++			 * It could happen that our rdev was marked as Faulty, and all other
++			 * superblocks were updated with +1 event counter.
++			 * Then, before the next superblock update, which typically happens when
++			 * remove_and_add_spares() removes the device from the array, there was
++			 * a crash or reboot.
++			 * If we allow current rdev without consulting the freshest superblock,
++			 * we could cause data corruption.
++			 * Note that in this case our event counter is smaller by 1 than the
++			 * highest, otherwise, this rdev would not be allowed into array;
++			 * both kernel and mdadm allow event counter difference of 1.
++			 */
++			struct mdp_superblock_1 *freshest_sb = page_address(freshest->sb_page);
++			u32 freshest_max_dev = le32_to_cpu(freshest_sb->max_dev);
++
++			if (rdev->desc_nr >= freshest_max_dev) {
++				/* this is unexpected, better not proceed */
++				pr_warn("md: %s: rdev[%pg]: desc_nr(%d) >= freshest(%pg)->sb->max_dev(%u)\n",
++						mdname(mddev), rdev->bdev, rdev->desc_nr,
++						freshest->bdev, freshest_max_dev);
++				return -EUCLEAN;
++			}
++
++			role = le16_to_cpu(freshest_sb->dev_roles[rdev->desc_nr]);
++			pr_debug("md: %s: rdev[%pg]: role=%d(0x%x) according to freshest %pg\n",
++				     mdname(mddev), rdev->bdev, role, role, freshest->bdev);
++		} else {
+ 			role = le16_to_cpu(sb->dev_roles[rdev->desc_nr]);
++		}
+ 		switch(role) {
+ 		case MD_DISK_ROLE_SPARE: /* spare */
+ 			break;
+@@ -2861,7 +2895,7 @@ static int add_bound_rdev(struct md_rdev *rdev)
+ 		 * and should be added immediately.
+ 		 */
+ 		super_types[mddev->major_version].
+-			validate_super(mddev, rdev);
++			validate_super(mddev, NULL/*freshest*/, rdev);
+ 		if (add_journal)
+ 			mddev_suspend(mddev);
+ 		err = mddev->pers->hot_add_disk(mddev, rdev);
+@@ -3775,7 +3809,7 @@ static int analyze_sbs(struct mddev *mddev)
+ 	}
+ 
+ 	super_types[mddev->major_version].
+-		validate_super(mddev, freshest);
++		validate_super(mddev, NULL/*freshest*/, freshest);
+ 
+ 	i = 0;
+ 	rdev_for_each_safe(rdev, tmp, mddev) {
+@@ -3790,7 +3824,7 @@ static int analyze_sbs(struct mddev *mddev)
+ 		}
+ 		if (rdev != freshest) {
+ 			if (super_types[mddev->major_version].
+-			    validate_super(mddev, rdev)) {
++			    validate_super(mddev, freshest, rdev)) {
+ 				pr_warn("md: kicking non-fresh %pg from array!\n",
+ 					rdev->bdev);
+ 				md_kick_rdev_from_array(rdev);
+@@ -6804,7 +6838,7 @@ int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info)
+ 			rdev->saved_raid_disk = rdev->raid_disk;
+ 		} else
+ 			super_types[mddev->major_version].
+-				validate_super(mddev, rdev);
++				validate_super(mddev, NULL/*freshest*/, rdev);
+ 		if ((info->state & (1<<MD_DISK_SYNC)) &&
+ 		     rdev->raid_disk != info->raid_disk) {
+ 			/* This was a hot-add request, but events doesn't
+-- 
+2.43.0
+
diff --git a/queue-6.1/media-amphion-remove-mutext-lock-in-condition-of-wai.patch b/queue-6.1/media-amphion-remove-mutext-lock-in-condition-of-wai.patch
new file mode 100644
index 00000000000..67b6c37b322
--- /dev/null
+++ b/queue-6.1/media-amphion-remove-mutext-lock-in-condition-of-wai.patch
@@ -0,0 +1,160 @@
+From 96b426d762efbe64e3fbe9a3b28c43bd1d452e55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Dec 2023 15:33:42 +0800
+Subject: media: amphion: remove mutext lock in condition of wait_event
+
+From: Ming Qian <ming.qian@nxp.com>
+
+[ Upstream commit f9c8ddce2fe3b767582f299d03fc8fb85943568c ]
+
+mutext_lock should not be called in condition of wait_event, otherwise,
+when CONFIG_DEBUG_ATOMIC_SLEEP is enabled, we may meet the following
+warning:
+do not call blocking ops when !TASK_RUNNING; state=2
+WARNING: CPU: 5 PID: 741 at kernel/sched/core.c:9859
+__might_sleep+0x80/0xa4
+Hardware name: Freescale i.MX8QM MEK (DT)
+pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)  pc :
+__might_sleep+0x80/0xa4  lr : __might_sleep+0x80/0xa4  sp : ffffffc0123738a0
+x29: ffffffc0123738a0 x28: ffffffc009194c48 x27: ffffffc00bbc1050
+x26: ffffff8814b282f0 x25: ffffff8814b280d0 x24: ffffff8814b28080
+x23: 0000000000000001 x22: 0000000000000032 x21: ffffffc00bbc1000
+x20: 000000000000011b x19: ffffffc009324670 x18: 00000000fffffffd
+x17: 30303c5b20746120 x16: 74657320323d6574 x15: 617473203b474e49
+x14: 00058b5b8b9aa1f1 x13: ffffffc00903cda0 x12: 00000000d744fcc9
+x11: 000000000000001c x10: 00000000000009a0 x9 : ffffffc0090201f4
+x8 : ffffff8828245000 x7 : 0000000000000001 x6 : 0000000000000001
+x5 : 00000000410fd080 x4 : 0000000000000002 x3 : ffffff8815aab4c8
+x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffff8828244600
+Call trace:
+ __might_sleep+0x80/0xa4
+ mutex_lock+0x2c/0x80
+ sync_session_response+0x110/0x310
+ vpu_session_send_cmd+0x18c/0x244
+ vpu_session_start+0x38/0x70
+ vdec_start_session+0x1b4/0x3e0
+ vpu_vb2_start_streaming+0xa0/0x1c4
+ vb2_start_streaming+0x74/0x160
+ vb2_core_qbuf+0x488/0x650
+ vb2_qbuf+0x9c/0x100
+ v4l2_m2m_qbuf+0x7c/0x224
+ v4l2_m2m_ioctl_qbuf+0x20/0x2c
+ v4l_qbuf+0x50/0x6c
+ __video_do_ioctl+0x174/0x3f0
+ video_usercopy+0x210/0x7cc
+ video_ioctl2+0x20/0x30
+ v4l2_ioctl+0x48/0x6c
+
+we need to refine check_is_responsed() to remove the mutext_lock, each
+cmd has a monotonically increasing id, and cmds are executed
+sequentially, so we can check the id of the last reponsed cmd, then
+determine whether a command has been responded or not.
+
+Signed-off-by: Ming Qian <ming.qian@nxp.com>
+CC: Xiaolei Wang <xiaolei.wang@windriver.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/amphion/vpu.h      |  3 ++-
+ drivers/media/platform/amphion/vpu_cmds.c | 28 ++++++++---------------
+ drivers/media/platform/amphion/vpu_v4l2.c |  1 +
+ 3 files changed, 12 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/media/platform/amphion/vpu.h b/drivers/media/platform/amphion/vpu.h
+index deb2288d4290..4f3d23b55b6d 100644
+--- a/drivers/media/platform/amphion/vpu.h
++++ b/drivers/media/platform/amphion/vpu.h
+@@ -152,7 +152,6 @@ struct vpu_core {
+ 	struct vpu_mbox tx_type;
+ 	struct vpu_mbox tx_data;
+ 	struct vpu_mbox rx;
+-	unsigned long cmd_seq;
+ 
+ 	wait_queue_head_t ack_wq;
+ 	struct completion cmp;
+@@ -251,6 +250,8 @@ struct vpu_inst {
+ 
+ 	struct list_head cmd_q;
+ 	void *pending;
++	unsigned long cmd_seq;
++	atomic_long_t last_response_cmd;
+ 
+ 	struct vpu_inst_ops *ops;
+ 	const struct vpu_format *formats;
+diff --git a/drivers/media/platform/amphion/vpu_cmds.c b/drivers/media/platform/amphion/vpu_cmds.c
+index 235b71398d40..c68163af29dc 100644
+--- a/drivers/media/platform/amphion/vpu_cmds.c
++++ b/drivers/media/platform/amphion/vpu_cmds.c
+@@ -34,6 +34,7 @@ struct vpu_cmd_t {
+ 	struct vpu_cmd_request *request;
+ 	struct vpu_rpc_event *pkt;
+ 	unsigned long key;
++	atomic_long_t *last_response_cmd;
+ };
+ 
+ static struct vpu_cmd_request vpu_cmd_requests[] = {
+@@ -117,6 +118,8 @@ static void vpu_free_cmd(struct vpu_cmd_t *cmd)
+ {
+ 	if (!cmd)
+ 		return;
++	if (cmd->last_response_cmd)
++		atomic_long_set(cmd->last_response_cmd, cmd->key);
+ 	vfree(cmd->pkt);
+ 	vfree(cmd);
+ }
+@@ -174,7 +177,8 @@ static int vpu_request_cmd(struct vpu_inst *inst, u32 id, void *data,
+ 		return -ENOMEM;
+ 
+ 	mutex_lock(&core->cmd_lock);
+-	cmd->key = core->cmd_seq++;
++	cmd->key = ++inst->cmd_seq;
++	cmd->last_response_cmd = &inst->last_response_cmd;
+ 	if (key)
+ 		*key = cmd->key;
+ 	if (sync)
+@@ -248,26 +252,12 @@ void vpu_clear_request(struct vpu_inst *inst)
+ 
+ static bool check_is_responsed(struct vpu_inst *inst, unsigned long key)
+ {
+-	struct vpu_core *core = inst->core;
+-	struct vpu_cmd_t *cmd;
+-	bool flag = true;
++	unsigned long last_response = atomic_long_read(&inst->last_response_cmd);
+ 
+-	mutex_lock(&core->cmd_lock);
+-	cmd = inst->pending;
+-	if (cmd && key == cmd->key) {
+-		flag = false;
+-		goto exit;
+-	}
+-	list_for_each_entry(cmd, &inst->cmd_q, list) {
+-		if (key == cmd->key) {
+-			flag = false;
+-			break;
+-		}
+-	}
+-exit:
+-	mutex_unlock(&core->cmd_lock);
++	if (key <= last_response && (last_response - key) < (ULONG_MAX >> 1))
++		return true;
+ 
+-	return flag;
++	return false;
+ }
+ 
+ static int sync_session_response(struct vpu_inst *inst, unsigned long key, long timeout, int try)
+diff --git a/drivers/media/platform/amphion/vpu_v4l2.c b/drivers/media/platform/amphion/vpu_v4l2.c
+index e5c8e1a753cc..e7a18948c4ab 100644
+--- a/drivers/media/platform/amphion/vpu_v4l2.c
++++ b/drivers/media/platform/amphion/vpu_v4l2.c
+@@ -631,6 +631,7 @@ int vpu_v4l2_open(struct file *file, struct vpu_inst *inst)
+ 		func = &vpu->decoder;
+ 
+ 	atomic_set(&inst->ref_count, 0);
++	atomic_long_set(&inst->last_response_cmd, 0);
+ 	vpu_inst_get(inst);
+ 	inst->vpu = vpu;
+ 	inst->core = vpu_request_core(vpu, inst->type);
+-- 
+2.43.0
+
diff --git a/queue-6.1/media-ddbridge-fix-an-error-code-problem-in-ddb_prob.patch b/queue-6.1/media-ddbridge-fix-an-error-code-problem-in-ddb_prob.patch
new file mode 100644
index 00000000000..5ab6f4d0df5
--- /dev/null
+++ b/queue-6.1/media-ddbridge-fix-an-error-code-problem-in-ddb_prob.patch
@@ -0,0 +1,34 @@
+From ec4a32e05d96d2871dc7b1203812a43a65abe097 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Oct 2023 17:17:23 +0800
+Subject: media: ddbridge: fix an error code problem in ddb_probe
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit 09b4195021be69af1e1936cca995712a6d0f2562 ]
+
+Error code is assigned to 'stat', return 'stat' rather than '-1'.
+
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/ddbridge/ddbridge-main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/ddbridge/ddbridge-main.c b/drivers/media/pci/ddbridge/ddbridge-main.c
+index 91733ab9f58c..363badab7cf0 100644
+--- a/drivers/media/pci/ddbridge/ddbridge-main.c
++++ b/drivers/media/pci/ddbridge/ddbridge-main.c
+@@ -238,7 +238,7 @@ static int ddb_probe(struct pci_dev *pdev,
+ 	ddb_unmap(dev);
+ 	pci_set_drvdata(pdev, NULL);
+ 	pci_disable_device(pdev);
+-	return -1;
++	return stat;
+ }
+ 
+ /****************************************************************************/
+-- 
+2.43.0
+
diff --git a/queue-6.1/media-i2c-imx335-fix-hblank-min-max-values.patch b/queue-6.1/media-i2c-imx335-fix-hblank-min-max-values.patch
new file mode 100644
index 00000000000..407e94b2959
--- /dev/null
+++ b/queue-6.1/media-i2c-imx335-fix-hblank-min-max-values.patch
@@ -0,0 +1,41 @@
+From 90fccfeed0f44782fa057568768a25ccbd65551f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Dec 2023 18:29:48 +0530
+Subject: media: i2c: imx335: Fix hblank min/max values
+
+From: Kieran Bingham <kieran.bingham@ideasonboard.com>
+
+[ Upstream commit d7b95ad7a8d56248dfc34f861e445fad7a4004f4 ]
+
+The V4L2_CID_HBLANK control is marked as readonly and can only be a
+single value.
+
+Set the minimum and maximum value to match the mode value.
+
+Reviewed-by: Umang Jain <umang.jain@ideasonboard.com>
+Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/imx335.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/i2c/imx335.c b/drivers/media/i2c/imx335.c
+index 078ede2b7a00..8e91767d6130 100644
+--- a/drivers/media/i2c/imx335.c
++++ b/drivers/media/i2c/imx335.c
+@@ -971,8 +971,8 @@ static int imx335_init_controls(struct imx335 *imx335)
+ 	imx335->hblank_ctrl = v4l2_ctrl_new_std(ctrl_hdlr,
+ 						&imx335_ctrl_ops,
+ 						V4L2_CID_HBLANK,
+-						IMX335_REG_MIN,
+-						IMX335_REG_MAX,
++						mode->hblank,
++						mode->hblank,
+ 						1, mode->hblank);
+ 	if (imx335->hblank_ctrl)
+ 		imx335->hblank_ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+-- 
+2.43.0
+
diff --git a/queue-6.1/media-renesas-vsp1-fix-references-to-pad-config.patch b/queue-6.1/media-renesas-vsp1-fix-references-to-pad-config.patch
new file mode 100644
index 00000000000..7343e68c024
--- /dev/null
+++ b/queue-6.1/media-renesas-vsp1-fix-references-to-pad-config.patch
@@ -0,0 +1,1137 @@
+From d06e8025873b45c9e93f0ce03370295368730007 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Nov 2023 03:37:15 +0200
+Subject: media: renesas: vsp1: Fix references to pad config
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit 30d187cd74874aaf24e1b4a2dd2a64dc850c6b14 ]
+
+V4L2 subdev operations have moved from operating on a
+v4l2_subdev_pad_config to a v4l2_subdev_state a long time ago. Fix
+remaining incorrect references to pad config in function and variable
+names.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../media/platform/renesas/vsp1/vsp1_brx.c    | 40 +++++----
+ .../media/platform/renesas/vsp1/vsp1_clu.c    |  3 +-
+ .../media/platform/renesas/vsp1/vsp1_entity.c | 85 +++++++++----------
+ .../media/platform/renesas/vsp1/vsp1_entity.h | 10 +--
+ .../media/platform/renesas/vsp1/vsp1_hgo.c    |  4 +-
+ .../media/platform/renesas/vsp1/vsp1_hgt.c    |  4 +-
+ .../media/platform/renesas/vsp1/vsp1_histo.c  | 24 +++---
+ .../media/platform/renesas/vsp1/vsp1_hsit.c   | 11 ++-
+ .../media/platform/renesas/vsp1/vsp1_lif.c    |  2 +-
+ .../media/platform/renesas/vsp1/vsp1_rpf.c    |  8 +-
+ .../media/platform/renesas/vsp1/vsp1_rwpf.c   | 37 ++++----
+ .../media/platform/renesas/vsp1/vsp1_sru.c    | 36 ++++----
+ .../media/platform/renesas/vsp1/vsp1_uds.c    | 39 ++++-----
+ .../media/platform/renesas/vsp1/vsp1_uif.c    | 24 +++---
+ .../media/platform/renesas/vsp1/vsp1_video.c  |  4 +-
+ .../media/platform/renesas/vsp1/vsp1_wpf.c    | 10 +--
+ 16 files changed, 162 insertions(+), 179 deletions(-)
+
+diff --git a/drivers/media/platform/renesas/vsp1/vsp1_brx.c b/drivers/media/platform/renesas/vsp1/vsp1_brx.c
+index 89385b4cabe5..23e815cea825 100644
+--- a/drivers/media/platform/renesas/vsp1/vsp1_brx.c
++++ b/drivers/media/platform/renesas/vsp1/vsp1_brx.c
+@@ -136,29 +136,28 @@ static int brx_set_format(struct v4l2_subdev *subdev,
+ 			  struct v4l2_subdev_format *fmt)
+ {
+ 	struct vsp1_brx *brx = to_brx(subdev);
+-	struct v4l2_subdev_state *config;
++	struct v4l2_subdev_state *state;
+ 	struct v4l2_mbus_framefmt *format;
+ 	int ret = 0;
+ 
+ 	mutex_lock(&brx->entity.lock);
+ 
+-	config = vsp1_entity_get_pad_config(&brx->entity, sd_state,
+-					    fmt->which);
+-	if (!config) {
++	state = vsp1_entity_get_state(&brx->entity, sd_state, fmt->which);
++	if (!state) {
+ 		ret = -EINVAL;
+ 		goto done;
+ 	}
+ 
+-	brx_try_format(brx, config, fmt->pad, &fmt->format);
++	brx_try_format(brx, state, fmt->pad, &fmt->format);
+ 
+-	format = vsp1_entity_get_pad_format(&brx->entity, config, fmt->pad);
++	format = vsp1_entity_get_pad_format(&brx->entity, state, fmt->pad);
+ 	*format = fmt->format;
+ 
+ 	/* Reset the compose rectangle. */
+ 	if (fmt->pad != brx->entity.source_pad) {
+ 		struct v4l2_rect *compose;
+ 
+-		compose = brx_get_compose(brx, config, fmt->pad);
++		compose = brx_get_compose(brx, state, fmt->pad);
+ 		compose->left = 0;
+ 		compose->top = 0;
+ 		compose->width = format->width;
+@@ -171,7 +170,7 @@ static int brx_set_format(struct v4l2_subdev *subdev,
+ 
+ 		for (i = 0; i <= brx->entity.source_pad; ++i) {
+ 			format = vsp1_entity_get_pad_format(&brx->entity,
+-							    config, i);
++							    state, i);
+ 			format->code = fmt->format.code;
+ 		}
+ 	}
+@@ -186,7 +185,7 @@ static int brx_get_selection(struct v4l2_subdev *subdev,
+ 			     struct v4l2_subdev_selection *sel)
+ {
+ 	struct vsp1_brx *brx = to_brx(subdev);
+-	struct v4l2_subdev_state *config;
++	struct v4l2_subdev_state *state;
+ 
+ 	if (sel->pad == brx->entity.source_pad)
+ 		return -EINVAL;
+@@ -200,13 +199,13 @@ static int brx_get_selection(struct v4l2_subdev *subdev,
+ 		return 0;
+ 
+ 	case V4L2_SEL_TGT_COMPOSE:
+-		config = vsp1_entity_get_pad_config(&brx->entity, sd_state,
+-						    sel->which);
+-		if (!config)
++		state = vsp1_entity_get_state(&brx->entity, sd_state,
++					      sel->which);
++		if (!state)
+ 			return -EINVAL;
+ 
+ 		mutex_lock(&brx->entity.lock);
+-		sel->r = *brx_get_compose(brx, config, sel->pad);
++		sel->r = *brx_get_compose(brx, state, sel->pad);
+ 		mutex_unlock(&brx->entity.lock);
+ 		return 0;
+ 
+@@ -220,7 +219,7 @@ static int brx_set_selection(struct v4l2_subdev *subdev,
+ 			     struct v4l2_subdev_selection *sel)
+ {
+ 	struct vsp1_brx *brx = to_brx(subdev);
+-	struct v4l2_subdev_state *config;
++	struct v4l2_subdev_state *state;
+ 	struct v4l2_mbus_framefmt *format;
+ 	struct v4l2_rect *compose;
+ 	int ret = 0;
+@@ -233,9 +232,8 @@ static int brx_set_selection(struct v4l2_subdev *subdev,
+ 
+ 	mutex_lock(&brx->entity.lock);
+ 
+-	config = vsp1_entity_get_pad_config(&brx->entity, sd_state,
+-					    sel->which);
+-	if (!config) {
++	state = vsp1_entity_get_state(&brx->entity, sd_state, sel->which);
++	if (!state) {
+ 		ret = -EINVAL;
+ 		goto done;
+ 	}
+@@ -244,7 +242,7 @@ static int brx_set_selection(struct v4l2_subdev *subdev,
+ 	 * The compose rectangle top left corner must be inside the output
+ 	 * frame.
+ 	 */
+-	format = vsp1_entity_get_pad_format(&brx->entity, config,
++	format = vsp1_entity_get_pad_format(&brx->entity, state,
+ 					    brx->entity.source_pad);
+ 	sel->r.left = clamp_t(unsigned int, sel->r.left, 0, format->width - 1);
+ 	sel->r.top = clamp_t(unsigned int, sel->r.top, 0, format->height - 1);
+@@ -253,11 +251,11 @@ static int brx_set_selection(struct v4l2_subdev *subdev,
+ 	 * Scaling isn't supported, the compose rectangle size must be identical
+ 	 * to the sink format size.
+ 	 */
+-	format = vsp1_entity_get_pad_format(&brx->entity, config, sel->pad);
++	format = vsp1_entity_get_pad_format(&brx->entity, state, sel->pad);
+ 	sel->r.width = format->width;
+ 	sel->r.height = format->height;
+ 
+-	compose = brx_get_compose(brx, config, sel->pad);
++	compose = brx_get_compose(brx, state, sel->pad);
+ 	*compose = sel->r;
+ 
+ done:
+@@ -293,7 +291,7 @@ static void brx_configure_stream(struct vsp1_entity *entity,
+ 	unsigned int flags;
+ 	unsigned int i;
+ 
+-	format = vsp1_entity_get_pad_format(&brx->entity, brx->entity.config,
++	format = vsp1_entity_get_pad_format(&brx->entity, brx->entity.state,
+ 					    brx->entity.source_pad);
+ 
+ 	/*
+diff --git a/drivers/media/platform/renesas/vsp1/vsp1_clu.c b/drivers/media/platform/renesas/vsp1/vsp1_clu.c
+index c5217fee24f1..50a5c0dc0e86 100644
+--- a/drivers/media/platform/renesas/vsp1/vsp1_clu.c
++++ b/drivers/media/platform/renesas/vsp1/vsp1_clu.c
+@@ -182,8 +182,7 @@ static void clu_configure_stream(struct vsp1_entity *entity,
+ 	 * The yuv_mode can't be changed during streaming. Cache it internally
+ 	 * for future runtime configuration calls.
+ 	 */
+-	format = vsp1_entity_get_pad_format(&clu->entity,
+-					    clu->entity.config,
++	format = vsp1_entity_get_pad_format(&clu->entity, clu->entity.state,
+ 					    CLU_PAD_SINK);
+ 	clu->yuv_mode = format->code == MEDIA_BUS_FMT_AYUV8_1X32;
+ }
+diff --git a/drivers/media/platform/renesas/vsp1/vsp1_entity.c b/drivers/media/platform/renesas/vsp1/vsp1_entity.c
+index c31f05a80bb5..47413f5c4824 100644
+--- a/drivers/media/platform/renesas/vsp1/vsp1_entity.c
++++ b/drivers/media/platform/renesas/vsp1/vsp1_entity.c
+@@ -101,27 +101,26 @@ void vsp1_entity_configure_partition(struct vsp1_entity *entity,
+  */
+ 
+ /**
+- * vsp1_entity_get_pad_config - Get the pad configuration for an entity
++ * vsp1_entity_get_state - Get the subdev state for an entity
+  * @entity: the entity
+  * @sd_state: the TRY state
+- * @which: configuration selector (ACTIVE or TRY)
++ * @which: state selector (ACTIVE or TRY)
+  *
+  * When called with which set to V4L2_SUBDEV_FORMAT_ACTIVE the caller must hold
+  * the entity lock to access the returned configuration.
+  *
+- * Return the pad configuration requested by the which argument. The TRY
+- * configuration is passed explicitly to the function through the cfg argument
+- * and simply returned when requested. The ACTIVE configuration comes from the
+- * entity structure.
++ * Return the subdev state requested by the which argument. The TRY state is
++ * passed explicitly to the function through the sd_state argument and simply
++ * returned when requested. The ACTIVE state comes from the entity structure.
+  */
+ struct v4l2_subdev_state *
+-vsp1_entity_get_pad_config(struct vsp1_entity *entity,
+-			   struct v4l2_subdev_state *sd_state,
+-			   enum v4l2_subdev_format_whence which)
++vsp1_entity_get_state(struct vsp1_entity *entity,
++		      struct v4l2_subdev_state *sd_state,
++		      enum v4l2_subdev_format_whence which)
+ {
+ 	switch (which) {
+ 	case V4L2_SUBDEV_FORMAT_ACTIVE:
+-		return entity->config;
++		return entity->state;
+ 	case V4L2_SUBDEV_FORMAT_TRY:
+ 	default:
+ 		return sd_state;
+@@ -176,10 +175,11 @@ vsp1_entity_get_pad_selection(struct vsp1_entity *entity,
+ /*
+  * vsp1_entity_init_cfg - Initialize formats on all pads
+  * @subdev: V4L2 subdevice
+- * @cfg: V4L2 subdev pad configuration
++ * @sd_state: V4L2 subdev state
+  *
+- * Initialize all pad formats with default values in the given pad config. This
+- * function can be used as a handler for the subdev pad::init_cfg operation.
++ * Initialize all pad formats with default values in the given subdev state.
++ * This function can be used as a handler for the subdev pad::init_cfg
++ * operation.
+  */
+ int vsp1_entity_init_cfg(struct v4l2_subdev *subdev,
+ 			 struct v4l2_subdev_state *sd_state)
+@@ -202,7 +202,7 @@ int vsp1_entity_init_cfg(struct v4l2_subdev *subdev,
+ /*
+  * vsp1_subdev_get_pad_format - Subdev pad get_fmt handler
+  * @subdev: V4L2 subdevice
+- * @cfg: V4L2 subdev pad configuration
++ * @sd_state: V4L2 subdev state
+  * @fmt: V4L2 subdev format
+  *
+  * This function implements the subdev get_fmt pad operation. It can be used as
+@@ -213,14 +213,14 @@ int vsp1_subdev_get_pad_format(struct v4l2_subdev *subdev,
+ 			       struct v4l2_subdev_format *fmt)
+ {
+ 	struct vsp1_entity *entity = to_vsp1_entity(subdev);
+-	struct v4l2_subdev_state *config;
++	struct v4l2_subdev_state *state;
+ 
+-	config = vsp1_entity_get_pad_config(entity, sd_state, fmt->which);
+-	if (!config)
++	state = vsp1_entity_get_state(entity, sd_state, fmt->which);
++	if (!state)
+ 		return -EINVAL;
+ 
+ 	mutex_lock(&entity->lock);
+-	fmt->format = *vsp1_entity_get_pad_format(entity, config, fmt->pad);
++	fmt->format = *vsp1_entity_get_pad_format(entity, state, fmt->pad);
+ 	mutex_unlock(&entity->lock);
+ 
+ 	return 0;
+@@ -229,7 +229,7 @@ int vsp1_subdev_get_pad_format(struct v4l2_subdev *subdev,
+ /*
+  * vsp1_subdev_enum_mbus_code - Subdev pad enum_mbus_code handler
+  * @subdev: V4L2 subdevice
+- * @cfg: V4L2 subdev pad configuration
++ * @sd_state: V4L2 subdev state
+  * @code: Media bus code enumeration
+  * @codes: Array of supported media bus codes
+  * @ncodes: Number of supported media bus codes
+@@ -252,7 +252,7 @@ int vsp1_subdev_enum_mbus_code(struct v4l2_subdev *subdev,
+ 
+ 		code->code = codes[code->index];
+ 	} else {
+-		struct v4l2_subdev_state *config;
++		struct v4l2_subdev_state *state;
+ 		struct v4l2_mbus_framefmt *format;
+ 
+ 		/*
+@@ -262,13 +262,12 @@ int vsp1_subdev_enum_mbus_code(struct v4l2_subdev *subdev,
+ 		if (code->index)
+ 			return -EINVAL;
+ 
+-		config = vsp1_entity_get_pad_config(entity, sd_state,
+-						    code->which);
+-		if (!config)
++		state = vsp1_entity_get_state(entity, sd_state, code->which);
++		if (!state)
+ 			return -EINVAL;
+ 
+ 		mutex_lock(&entity->lock);
+-		format = vsp1_entity_get_pad_format(entity, config, 0);
++		format = vsp1_entity_get_pad_format(entity, state, 0);
+ 		code->code = format->code;
+ 		mutex_unlock(&entity->lock);
+ 	}
+@@ -279,7 +278,7 @@ int vsp1_subdev_enum_mbus_code(struct v4l2_subdev *subdev,
+ /*
+  * vsp1_subdev_enum_frame_size - Subdev pad enum_frame_size handler
+  * @subdev: V4L2 subdevice
+- * @cfg: V4L2 subdev pad configuration
++ * @sd_state: V4L2 subdev state
+  * @fse: Frame size enumeration
+  * @min_width: Minimum image width
+  * @min_height: Minimum image height
+@@ -298,15 +297,15 @@ int vsp1_subdev_enum_frame_size(struct v4l2_subdev *subdev,
+ 				unsigned int max_width, unsigned int max_height)
+ {
+ 	struct vsp1_entity *entity = to_vsp1_entity(subdev);
+-	struct v4l2_subdev_state *config;
++	struct v4l2_subdev_state *state;
+ 	struct v4l2_mbus_framefmt *format;
+ 	int ret = 0;
+ 
+-	config = vsp1_entity_get_pad_config(entity, sd_state, fse->which);
+-	if (!config)
++	state = vsp1_entity_get_state(entity, sd_state, fse->which);
++	if (!state)
+ 		return -EINVAL;
+ 
+-	format = vsp1_entity_get_pad_format(entity, config, fse->pad);
++	format = vsp1_entity_get_pad_format(entity, state, fse->pad);
+ 
+ 	mutex_lock(&entity->lock);
+ 
+@@ -339,7 +338,7 @@ int vsp1_subdev_enum_frame_size(struct v4l2_subdev *subdev,
+ /*
+  * vsp1_subdev_set_pad_format - Subdev pad set_fmt handler
+  * @subdev: V4L2 subdevice
+- * @cfg: V4L2 subdev pad configuration
++ * @sd_state: V4L2 subdev state
+  * @fmt: V4L2 subdev format
+  * @codes: Array of supported media bus codes
+  * @ncodes: Number of supported media bus codes
+@@ -362,7 +361,7 @@ int vsp1_subdev_set_pad_format(struct v4l2_subdev *subdev,
+ 			       unsigned int max_width, unsigned int max_height)
+ {
+ 	struct vsp1_entity *entity = to_vsp1_entity(subdev);
+-	struct v4l2_subdev_state *config;
++	struct v4l2_subdev_state *state;
+ 	struct v4l2_mbus_framefmt *format;
+ 	struct v4l2_rect *selection;
+ 	unsigned int i;
+@@ -370,13 +369,13 @@ int vsp1_subdev_set_pad_format(struct v4l2_subdev *subdev,
+ 
+ 	mutex_lock(&entity->lock);
+ 
+-	config = vsp1_entity_get_pad_config(entity, sd_state, fmt->which);
+-	if (!config) {
++	state = vsp1_entity_get_state(entity, sd_state, fmt->which);
++	if (!state) {
+ 		ret = -EINVAL;
+ 		goto done;
+ 	}
+ 
+-	format = vsp1_entity_get_pad_format(entity, config, fmt->pad);
++	format = vsp1_entity_get_pad_format(entity, state, fmt->pad);
+ 
+ 	if (fmt->pad == entity->source_pad) {
+ 		/* The output format can't be modified. */
+@@ -404,18 +403,18 @@ int vsp1_subdev_set_pad_format(struct v4l2_subdev *subdev,
+ 	fmt->format = *format;
+ 
+ 	/* Propagate the format to the source pad. */
+-	format = vsp1_entity_get_pad_format(entity, config, entity->source_pad);
++	format = vsp1_entity_get_pad_format(entity, state, entity->source_pad);
+ 	*format = fmt->format;
+ 
+ 	/* Reset the crop and compose rectangles. */
+-	selection = vsp1_entity_get_pad_selection(entity, config, fmt->pad,
++	selection = vsp1_entity_get_pad_selection(entity, state, fmt->pad,
+ 						  V4L2_SEL_TGT_CROP);
+ 	selection->left = 0;
+ 	selection->top = 0;
+ 	selection->width = format->width;
+ 	selection->height = format->height;
+ 
+-	selection = vsp1_entity_get_pad_selection(entity, config, fmt->pad,
++	selection = vsp1_entity_get_pad_selection(entity, state, fmt->pad,
+ 						  V4L2_SEL_TGT_COMPOSE);
+ 	selection->left = 0;
+ 	selection->top = 0;
+@@ -672,18 +671,18 @@ int vsp1_entity_init(struct vsp1_device *vsp1, struct vsp1_entity *entity,
+ 	vsp1_entity_init_cfg(subdev, NULL);
+ 
+ 	/*
+-	 * Allocate the pad configuration to store formats and selection
++	 * Allocate the subdev state to store formats and selection
+ 	 * rectangles.
+ 	 */
+ 	/*
+ 	 * FIXME: Drop this call, drivers are not supposed to use
+ 	 * __v4l2_subdev_state_alloc().
+ 	 */
+-	entity->config = __v4l2_subdev_state_alloc(&entity->subdev,
+-						   "vsp1:config->lock", &key);
+-	if (IS_ERR(entity->config)) {
++	entity->state = __v4l2_subdev_state_alloc(&entity->subdev,
++						  "vsp1:state->lock", &key);
++	if (IS_ERR(entity->state)) {
+ 		media_entity_cleanup(&entity->subdev.entity);
+-		return PTR_ERR(entity->config);
++		return PTR_ERR(entity->state);
+ 	}
+ 
+ 	return 0;
+@@ -695,6 +694,6 @@ void vsp1_entity_destroy(struct vsp1_entity *entity)
+ 		entity->ops->destroy(entity);
+ 	if (entity->subdev.ctrl_handler)
+ 		v4l2_ctrl_handler_free(entity->subdev.ctrl_handler);
+-	__v4l2_subdev_state_free(entity->config);
++	__v4l2_subdev_state_free(entity->state);
+ 	media_entity_cleanup(&entity->subdev.entity);
+ }
+diff --git a/drivers/media/platform/renesas/vsp1/vsp1_entity.h b/drivers/media/platform/renesas/vsp1/vsp1_entity.h
+index f22724439cdc..68bf4424cfdf 100644
+--- a/drivers/media/platform/renesas/vsp1/vsp1_entity.h
++++ b/drivers/media/platform/renesas/vsp1/vsp1_entity.h
+@@ -115,9 +115,9 @@ struct vsp1_entity {
+ 	unsigned int sink_pad;
+ 
+ 	struct v4l2_subdev subdev;
+-	struct v4l2_subdev_state *config;
++	struct v4l2_subdev_state *state;
+ 
+-	struct mutex lock;	/* Protects the pad config */
++	struct mutex lock;	/* Protects the state */
+ };
+ 
+ static inline struct vsp1_entity *to_vsp1_entity(struct v4l2_subdev *subdev)
+@@ -137,9 +137,9 @@ int vsp1_entity_link_setup(struct media_entity *entity,
+ 			   const struct media_pad *remote, u32 flags);
+ 
+ struct v4l2_subdev_state *
+-vsp1_entity_get_pad_config(struct vsp1_entity *entity,
+-			   struct v4l2_subdev_state *sd_state,
+-			   enum v4l2_subdev_format_whence which);
++vsp1_entity_get_state(struct vsp1_entity *entity,
++		      struct v4l2_subdev_state *sd_state,
++		      enum v4l2_subdev_format_whence which);
+ struct v4l2_mbus_framefmt *
+ vsp1_entity_get_pad_format(struct vsp1_entity *entity,
+ 			   struct v4l2_subdev_state *sd_state,
+diff --git a/drivers/media/platform/renesas/vsp1/vsp1_hgo.c b/drivers/media/platform/renesas/vsp1/vsp1_hgo.c
+index bf3f981f93a1..4a55a46bc70f 100644
+--- a/drivers/media/platform/renesas/vsp1/vsp1_hgo.c
++++ b/drivers/media/platform/renesas/vsp1/vsp1_hgo.c
+@@ -140,9 +140,9 @@ static void hgo_configure_stream(struct vsp1_entity *entity,
+ 	unsigned int hratio;
+ 	unsigned int vratio;
+ 
+-	crop = vsp1_entity_get_pad_selection(entity, entity->config,
++	crop = vsp1_entity_get_pad_selection(entity, entity->state,
+ 					     HISTO_PAD_SINK, V4L2_SEL_TGT_CROP);
+-	compose = vsp1_entity_get_pad_selection(entity, entity->config,
++	compose = vsp1_entity_get_pad_selection(entity, entity->state,
+ 						HISTO_PAD_SINK,
+ 						V4L2_SEL_TGT_COMPOSE);
+ 
+diff --git a/drivers/media/platform/renesas/vsp1/vsp1_hgt.c b/drivers/media/platform/renesas/vsp1/vsp1_hgt.c
+index aa1c718e0453..8281b86874ab 100644
+--- a/drivers/media/platform/renesas/vsp1/vsp1_hgt.c
++++ b/drivers/media/platform/renesas/vsp1/vsp1_hgt.c
+@@ -139,9 +139,9 @@ static void hgt_configure_stream(struct vsp1_entity *entity,
+ 	u8 upper;
+ 	unsigned int i;
+ 
+-	crop = vsp1_entity_get_pad_selection(entity, entity->config,
++	crop = vsp1_entity_get_pad_selection(entity, entity->state,
+ 					     HISTO_PAD_SINK, V4L2_SEL_TGT_CROP);
+-	compose = vsp1_entity_get_pad_selection(entity, entity->config,
++	compose = vsp1_entity_get_pad_selection(entity, entity->state,
+ 						HISTO_PAD_SINK,
+ 						V4L2_SEL_TGT_COMPOSE);
+ 
+diff --git a/drivers/media/platform/renesas/vsp1/vsp1_histo.c b/drivers/media/platform/renesas/vsp1/vsp1_histo.c
+index f22449dd654c..71155282ca11 100644
+--- a/drivers/media/platform/renesas/vsp1/vsp1_histo.c
++++ b/drivers/media/platform/renesas/vsp1/vsp1_histo.c
+@@ -203,7 +203,7 @@ static int histo_get_selection(struct v4l2_subdev *subdev,
+ 			       struct v4l2_subdev_selection *sel)
+ {
+ 	struct vsp1_histogram *histo = subdev_to_histo(subdev);
+-	struct v4l2_subdev_state *config;
++	struct v4l2_subdev_state *state;
+ 	struct v4l2_mbus_framefmt *format;
+ 	struct v4l2_rect *crop;
+ 	int ret = 0;
+@@ -213,9 +213,8 @@ static int histo_get_selection(struct v4l2_subdev *subdev,
+ 
+ 	mutex_lock(&histo->entity.lock);
+ 
+-	config = vsp1_entity_get_pad_config(&histo->entity, sd_state,
+-					    sel->which);
+-	if (!config) {
++	state = vsp1_entity_get_state(&histo->entity, sd_state, sel->which);
++	if (!state) {
+ 		ret = -EINVAL;
+ 		goto done;
+ 	}
+@@ -223,7 +222,7 @@ static int histo_get_selection(struct v4l2_subdev *subdev,
+ 	switch (sel->target) {
+ 	case V4L2_SEL_TGT_COMPOSE_BOUNDS:
+ 	case V4L2_SEL_TGT_COMPOSE_DEFAULT:
+-		crop = vsp1_entity_get_pad_selection(&histo->entity, config,
++		crop = vsp1_entity_get_pad_selection(&histo->entity, state,
+ 						     HISTO_PAD_SINK,
+ 						     V4L2_SEL_TGT_CROP);
+ 		sel->r.left = 0;
+@@ -234,7 +233,7 @@ static int histo_get_selection(struct v4l2_subdev *subdev,
+ 
+ 	case V4L2_SEL_TGT_CROP_BOUNDS:
+ 	case V4L2_SEL_TGT_CROP_DEFAULT:
+-		format = vsp1_entity_get_pad_format(&histo->entity, config,
++		format = vsp1_entity_get_pad_format(&histo->entity, state,
+ 						    HISTO_PAD_SINK);
+ 		sel->r.left = 0;
+ 		sel->r.top = 0;
+@@ -244,7 +243,7 @@ static int histo_get_selection(struct v4l2_subdev *subdev,
+ 
+ 	case V4L2_SEL_TGT_COMPOSE:
+ 	case V4L2_SEL_TGT_CROP:
+-		sel->r = *vsp1_entity_get_pad_selection(&histo->entity, config,
++		sel->r = *vsp1_entity_get_pad_selection(&histo->entity, state,
+ 							sel->pad, sel->target);
+ 		break;
+ 
+@@ -346,7 +345,7 @@ static int histo_set_selection(struct v4l2_subdev *subdev,
+ 			       struct v4l2_subdev_selection *sel)
+ {
+ 	struct vsp1_histogram *histo = subdev_to_histo(subdev);
+-	struct v4l2_subdev_state *config;
++	struct v4l2_subdev_state *state;
+ 	int ret;
+ 
+ 	if (sel->pad != HISTO_PAD_SINK)
+@@ -354,17 +353,16 @@ static int histo_set_selection(struct v4l2_subdev *subdev,
+ 
+ 	mutex_lock(&histo->entity.lock);
+ 
+-	config = vsp1_entity_get_pad_config(&histo->entity, sd_state,
+-					    sel->which);
+-	if (!config) {
++	state = vsp1_entity_get_state(&histo->entity, sd_state, sel->which);
++	if (!state) {
+ 		ret = -EINVAL;
+ 		goto done;
+ 	}
+ 
+ 	if (sel->target == V4L2_SEL_TGT_CROP)
+-		ret = histo_set_crop(subdev, config, sel);
++		ret = histo_set_crop(subdev, state, sel);
+ 	else if (sel->target == V4L2_SEL_TGT_COMPOSE)
+-		ret = histo_set_compose(subdev, config, sel);
++		ret = histo_set_compose(subdev, state, sel);
+ 	else
+ 		ret = -EINVAL;
+ 
+diff --git a/drivers/media/platform/renesas/vsp1/vsp1_hsit.c b/drivers/media/platform/renesas/vsp1/vsp1_hsit.c
+index 361a870380c2..6342ac7bdf54 100644
+--- a/drivers/media/platform/renesas/vsp1/vsp1_hsit.c
++++ b/drivers/media/platform/renesas/vsp1/vsp1_hsit.c
+@@ -66,20 +66,19 @@ static int hsit_set_format(struct v4l2_subdev *subdev,
+ 			   struct v4l2_subdev_format *fmt)
+ {
+ 	struct vsp1_hsit *hsit = to_hsit(subdev);
+-	struct v4l2_subdev_state *config;
++	struct v4l2_subdev_state *state;
+ 	struct v4l2_mbus_framefmt *format;
+ 	int ret = 0;
+ 
+ 	mutex_lock(&hsit->entity.lock);
+ 
+-	config = vsp1_entity_get_pad_config(&hsit->entity, sd_state,
+-					    fmt->which);
+-	if (!config) {
++	state = vsp1_entity_get_state(&hsit->entity, sd_state, fmt->which);
++	if (!state) {
+ 		ret = -EINVAL;
+ 		goto done;
+ 	}
+ 
+-	format = vsp1_entity_get_pad_format(&hsit->entity, config, fmt->pad);
++	format = vsp1_entity_get_pad_format(&hsit->entity, state, fmt->pad);
+ 
+ 	if (fmt->pad == HSIT_PAD_SOURCE) {
+ 		/*
+@@ -102,7 +101,7 @@ static int hsit_set_format(struct v4l2_subdev *subdev,
+ 	fmt->format = *format;
+ 
+ 	/* Propagate the format to the source pad. */
+-	format = vsp1_entity_get_pad_format(&hsit->entity, config,
++	format = vsp1_entity_get_pad_format(&hsit->entity, state,
+ 					    HSIT_PAD_SOURCE);
+ 	*format = fmt->format;
+ 	format->code = hsit->inverse ? MEDIA_BUS_FMT_ARGB8888_1X32
+diff --git a/drivers/media/platform/renesas/vsp1/vsp1_lif.c b/drivers/media/platform/renesas/vsp1/vsp1_lif.c
+index 186a5730e1e3..a135f5399be2 100644
+--- a/drivers/media/platform/renesas/vsp1/vsp1_lif.c
++++ b/drivers/media/platform/renesas/vsp1/vsp1_lif.c
+@@ -94,7 +94,7 @@ static void lif_configure_stream(struct vsp1_entity *entity,
+ 	unsigned int obth;
+ 	unsigned int lbth;
+ 
+-	format = vsp1_entity_get_pad_format(&lif->entity, lif->entity.config,
++	format = vsp1_entity_get_pad_format(&lif->entity, lif->entity.state,
+ 					    LIF_PAD_SOURCE);
+ 
+ 	switch (entity->vsp1->version & VI6_IP_VERSION_MODEL_MASK) {
+diff --git a/drivers/media/platform/renesas/vsp1/vsp1_rpf.c b/drivers/media/platform/renesas/vsp1/vsp1_rpf.c
+index 75083cb234fe..e2c7df1bd6c6 100644
+--- a/drivers/media/platform/renesas/vsp1/vsp1_rpf.c
++++ b/drivers/media/platform/renesas/vsp1/vsp1_rpf.c
+@@ -89,10 +89,10 @@ static void rpf_configure_stream(struct vsp1_entity *entity,
+ 
+ 	/* Format */
+ 	sink_format = vsp1_entity_get_pad_format(&rpf->entity,
+-						 rpf->entity.config,
++						 rpf->entity.state,
+ 						 RWPF_PAD_SINK);
+ 	source_format = vsp1_entity_get_pad_format(&rpf->entity,
+-						   rpf->entity.config,
++						   rpf->entity.state,
+ 						   RWPF_PAD_SOURCE);
+ 
+ 	infmt = VI6_RPF_INFMT_CIPM
+@@ -114,7 +114,7 @@ static void rpf_configure_stream(struct vsp1_entity *entity,
+ 		const struct v4l2_rect *compose;
+ 
+ 		compose = vsp1_entity_get_pad_selection(pipe->brx,
+-							pipe->brx->config,
++							pipe->brx->state,
+ 							rpf->brx_input,
+ 							V4L2_SEL_TGT_COMPOSE);
+ 		left = compose->left;
+@@ -258,7 +258,7 @@ static void rpf_configure_partition(struct vsp1_entity *entity,
+ 	 * offsets are needed, as planes 2 and 3 always have identical
+ 	 * strides.
+ 	 */
+-	crop = *vsp1_rwpf_get_crop(rpf, rpf->entity.config);
++	crop = *vsp1_rwpf_get_crop(rpf, rpf->entity.state);
+ 
+ 	/*
+ 	 * Partition Algorithm Control
+diff --git a/drivers/media/platform/renesas/vsp1/vsp1_rwpf.c b/drivers/media/platform/renesas/vsp1/vsp1_rwpf.c
+index 22a82d218152..8a4165368f53 100644
+--- a/drivers/media/platform/renesas/vsp1/vsp1_rwpf.c
++++ b/drivers/media/platform/renesas/vsp1/vsp1_rwpf.c
+@@ -62,15 +62,14 @@ static int vsp1_rwpf_set_format(struct v4l2_subdev *subdev,
+ 				struct v4l2_subdev_format *fmt)
+ {
+ 	struct vsp1_rwpf *rwpf = to_rwpf(subdev);
+-	struct v4l2_subdev_state *config;
++	struct v4l2_subdev_state *state;
+ 	struct v4l2_mbus_framefmt *format;
+ 	int ret = 0;
+ 
+ 	mutex_lock(&rwpf->entity.lock);
+ 
+-	config = vsp1_entity_get_pad_config(&rwpf->entity, sd_state,
+-					    fmt->which);
+-	if (!config) {
++	state = vsp1_entity_get_state(&rwpf->entity, sd_state, fmt->which);
++	if (!state) {
+ 		ret = -EINVAL;
+ 		goto done;
+ 	}
+@@ -81,7 +80,7 @@ static int vsp1_rwpf_set_format(struct v4l2_subdev *subdev,
+ 	    fmt->format.code != MEDIA_BUS_FMT_AYUV8_1X32)
+ 		fmt->format.code = MEDIA_BUS_FMT_AYUV8_1X32;
+ 
+-	format = vsp1_entity_get_pad_format(&rwpf->entity, config, fmt->pad);
++	format = vsp1_entity_get_pad_format(&rwpf->entity, state, fmt->pad);
+ 
+ 	if (fmt->pad == RWPF_PAD_SOURCE) {
+ 		/*
+@@ -107,7 +106,7 @@ static int vsp1_rwpf_set_format(struct v4l2_subdev *subdev,
+ 		struct v4l2_rect *crop;
+ 
+ 		/* Update the sink crop rectangle. */
+-		crop = vsp1_rwpf_get_crop(rwpf, config);
++		crop = vsp1_rwpf_get_crop(rwpf, state);
+ 		crop->left = 0;
+ 		crop->top = 0;
+ 		crop->width = fmt->format.width;
+@@ -115,7 +114,7 @@ static int vsp1_rwpf_set_format(struct v4l2_subdev *subdev,
+ 	}
+ 
+ 	/* Propagate the format to the source pad. */
+-	format = vsp1_entity_get_pad_format(&rwpf->entity, config,
++	format = vsp1_entity_get_pad_format(&rwpf->entity, state,
+ 					    RWPF_PAD_SOURCE);
+ 	*format = fmt->format;
+ 
+@@ -134,7 +133,7 @@ static int vsp1_rwpf_get_selection(struct v4l2_subdev *subdev,
+ 				   struct v4l2_subdev_selection *sel)
+ {
+ 	struct vsp1_rwpf *rwpf = to_rwpf(subdev);
+-	struct v4l2_subdev_state *config;
++	struct v4l2_subdev_state *state;
+ 	struct v4l2_mbus_framefmt *format;
+ 	int ret = 0;
+ 
+@@ -147,20 +146,19 @@ static int vsp1_rwpf_get_selection(struct v4l2_subdev *subdev,
+ 
+ 	mutex_lock(&rwpf->entity.lock);
+ 
+-	config = vsp1_entity_get_pad_config(&rwpf->entity, sd_state,
+-					    sel->which);
+-	if (!config) {
++	state = vsp1_entity_get_state(&rwpf->entity, sd_state, sel->which);
++	if (!state) {
+ 		ret = -EINVAL;
+ 		goto done;
+ 	}
+ 
+ 	switch (sel->target) {
+ 	case V4L2_SEL_TGT_CROP:
+-		sel->r = *vsp1_rwpf_get_crop(rwpf, config);
++		sel->r = *vsp1_rwpf_get_crop(rwpf, state);
+ 		break;
+ 
+ 	case V4L2_SEL_TGT_CROP_BOUNDS:
+-		format = vsp1_entity_get_pad_format(&rwpf->entity, config,
++		format = vsp1_entity_get_pad_format(&rwpf->entity, state,
+ 						    RWPF_PAD_SINK);
+ 		sel->r.left = 0;
+ 		sel->r.top = 0;
+@@ -183,7 +181,7 @@ static int vsp1_rwpf_set_selection(struct v4l2_subdev *subdev,
+ 				   struct v4l2_subdev_selection *sel)
+ {
+ 	struct vsp1_rwpf *rwpf = to_rwpf(subdev);
+-	struct v4l2_subdev_state *config;
++	struct v4l2_subdev_state *state;
+ 	struct v4l2_mbus_framefmt *format;
+ 	struct v4l2_rect *crop;
+ 	int ret = 0;
+@@ -200,15 +198,14 @@ static int vsp1_rwpf_set_selection(struct v4l2_subdev *subdev,
+ 
+ 	mutex_lock(&rwpf->entity.lock);
+ 
+-	config = vsp1_entity_get_pad_config(&rwpf->entity, sd_state,
+-					    sel->which);
+-	if (!config) {
++	state = vsp1_entity_get_state(&rwpf->entity, sd_state, sel->which);
++	if (!state) {
+ 		ret = -EINVAL;
+ 		goto done;
+ 	}
+ 
+ 	/* Make sure the crop rectangle is entirely contained in the image. */
+-	format = vsp1_entity_get_pad_format(&rwpf->entity, config,
++	format = vsp1_entity_get_pad_format(&rwpf->entity, state,
+ 					    RWPF_PAD_SINK);
+ 
+ 	/*
+@@ -229,11 +226,11 @@ static int vsp1_rwpf_set_selection(struct v4l2_subdev *subdev,
+ 	sel->r.height = min_t(unsigned int, sel->r.height,
+ 			      format->height - sel->r.top);
+ 
+-	crop = vsp1_rwpf_get_crop(rwpf, config);
++	crop = vsp1_rwpf_get_crop(rwpf, state);
+ 	*crop = sel->r;
+ 
+ 	/* Propagate the format to the source pad. */
+-	format = vsp1_entity_get_pad_format(&rwpf->entity, config,
++	format = vsp1_entity_get_pad_format(&rwpf->entity, state,
+ 					    RWPF_PAD_SOURCE);
+ 	format->width = crop->width;
+ 	format->height = crop->height;
+diff --git a/drivers/media/platform/renesas/vsp1/vsp1_sru.c b/drivers/media/platform/renesas/vsp1/vsp1_sru.c
+index b614a2aea461..2dd6f8575614 100644
+--- a/drivers/media/platform/renesas/vsp1/vsp1_sru.c
++++ b/drivers/media/platform/renesas/vsp1/vsp1_sru.c
+@@ -123,16 +123,15 @@ static int sru_enum_frame_size(struct v4l2_subdev *subdev,
+ 			       struct v4l2_subdev_frame_size_enum *fse)
+ {
+ 	struct vsp1_sru *sru = to_sru(subdev);
+-	struct v4l2_subdev_state *config;
++	struct v4l2_subdev_state *state;
+ 	struct v4l2_mbus_framefmt *format;
+ 	int ret = 0;
+ 
+-	config = vsp1_entity_get_pad_config(&sru->entity, sd_state,
+-					    fse->which);
+-	if (!config)
++	state = vsp1_entity_get_state(&sru->entity, sd_state, fse->which);
++	if (!state)
+ 		return -EINVAL;
+ 
+-	format = vsp1_entity_get_pad_format(&sru->entity, config, SRU_PAD_SINK);
++	format = vsp1_entity_get_pad_format(&sru->entity, state, SRU_PAD_SINK);
+ 
+ 	mutex_lock(&sru->entity.lock);
+ 
+@@ -221,31 +220,30 @@ static int sru_set_format(struct v4l2_subdev *subdev,
+ 			  struct v4l2_subdev_format *fmt)
+ {
+ 	struct vsp1_sru *sru = to_sru(subdev);
+-	struct v4l2_subdev_state *config;
++	struct v4l2_subdev_state *state;
+ 	struct v4l2_mbus_framefmt *format;
+ 	int ret = 0;
+ 
+ 	mutex_lock(&sru->entity.lock);
+ 
+-	config = vsp1_entity_get_pad_config(&sru->entity, sd_state,
+-					    fmt->which);
+-	if (!config) {
++	state = vsp1_entity_get_state(&sru->entity, sd_state, fmt->which);
++	if (!state) {
+ 		ret = -EINVAL;
+ 		goto done;
+ 	}
+ 
+-	sru_try_format(sru, config, fmt->pad, &fmt->format);
++	sru_try_format(sru, state, fmt->pad, &fmt->format);
+ 
+-	format = vsp1_entity_get_pad_format(&sru->entity, config, fmt->pad);
++	format = vsp1_entity_get_pad_format(&sru->entity, state, fmt->pad);
+ 	*format = fmt->format;
+ 
+ 	if (fmt->pad == SRU_PAD_SINK) {
+ 		/* Propagate the format to the source pad. */
+-		format = vsp1_entity_get_pad_format(&sru->entity, config,
++		format = vsp1_entity_get_pad_format(&sru->entity, state,
+ 						    SRU_PAD_SOURCE);
+ 		*format = fmt->format;
+ 
+-		sru_try_format(sru, config, SRU_PAD_SOURCE, format);
++		sru_try_format(sru, state, SRU_PAD_SOURCE, format);
+ 	}
+ 
+ done:
+@@ -280,9 +278,9 @@ static void sru_configure_stream(struct vsp1_entity *entity,
+ 	struct v4l2_mbus_framefmt *output;
+ 	u32 ctrl0;
+ 
+-	input = vsp1_entity_get_pad_format(&sru->entity, sru->entity.config,
++	input = vsp1_entity_get_pad_format(&sru->entity, sru->entity.state,
+ 					   SRU_PAD_SINK);
+-	output = vsp1_entity_get_pad_format(&sru->entity, sru->entity.config,
++	output = vsp1_entity_get_pad_format(&sru->entity, sru->entity.state,
+ 					    SRU_PAD_SOURCE);
+ 
+ 	if (input->code == MEDIA_BUS_FMT_ARGB8888_1X32)
+@@ -310,9 +308,9 @@ static unsigned int sru_max_width(struct vsp1_entity *entity,
+ 	struct v4l2_mbus_framefmt *input;
+ 	struct v4l2_mbus_framefmt *output;
+ 
+-	input = vsp1_entity_get_pad_format(&sru->entity, sru->entity.config,
++	input = vsp1_entity_get_pad_format(&sru->entity, sru->entity.state,
+ 					   SRU_PAD_SINK);
+-	output = vsp1_entity_get_pad_format(&sru->entity, sru->entity.config,
++	output = vsp1_entity_get_pad_format(&sru->entity, sru->entity.state,
+ 					    SRU_PAD_SOURCE);
+ 
+ 	/*
+@@ -336,9 +334,9 @@ static void sru_partition(struct vsp1_entity *entity,
+ 	struct v4l2_mbus_framefmt *input;
+ 	struct v4l2_mbus_framefmt *output;
+ 
+-	input = vsp1_entity_get_pad_format(&sru->entity, sru->entity.config,
++	input = vsp1_entity_get_pad_format(&sru->entity, sru->entity.state,
+ 					   SRU_PAD_SINK);
+-	output = vsp1_entity_get_pad_format(&sru->entity, sru->entity.config,
++	output = vsp1_entity_get_pad_format(&sru->entity, sru->entity.state,
+ 					    SRU_PAD_SOURCE);
+ 
+ 	/* Adapt if SRUx2 is enabled. */
+diff --git a/drivers/media/platform/renesas/vsp1/vsp1_uds.c b/drivers/media/platform/renesas/vsp1/vsp1_uds.c
+index 1c290cda005a..59ff4ae46cea 100644
+--- a/drivers/media/platform/renesas/vsp1/vsp1_uds.c
++++ b/drivers/media/platform/renesas/vsp1/vsp1_uds.c
+@@ -128,17 +128,15 @@ static int uds_enum_frame_size(struct v4l2_subdev *subdev,
+ 			       struct v4l2_subdev_frame_size_enum *fse)
+ {
+ 	struct vsp1_uds *uds = to_uds(subdev);
+-	struct v4l2_subdev_state *config;
++	struct v4l2_subdev_state *state;
+ 	struct v4l2_mbus_framefmt *format;
+ 	int ret = 0;
+ 
+-	config = vsp1_entity_get_pad_config(&uds->entity, sd_state,
+-					    fse->which);
+-	if (!config)
++	state = vsp1_entity_get_state(&uds->entity, sd_state, fse->which);
++	if (!state)
+ 		return -EINVAL;
+ 
+-	format = vsp1_entity_get_pad_format(&uds->entity, config,
+-					    UDS_PAD_SINK);
++	format = vsp1_entity_get_pad_format(&uds->entity, state, UDS_PAD_SINK);
+ 
+ 	mutex_lock(&uds->entity.lock);
+ 
+@@ -205,31 +203,30 @@ static int uds_set_format(struct v4l2_subdev *subdev,
+ 			  struct v4l2_subdev_format *fmt)
+ {
+ 	struct vsp1_uds *uds = to_uds(subdev);
+-	struct v4l2_subdev_state *config;
++	struct v4l2_subdev_state *state;
+ 	struct v4l2_mbus_framefmt *format;
+ 	int ret = 0;
+ 
+ 	mutex_lock(&uds->entity.lock);
+ 
+-	config = vsp1_entity_get_pad_config(&uds->entity, sd_state,
+-					    fmt->which);
+-	if (!config) {
++	state = vsp1_entity_get_state(&uds->entity, sd_state, fmt->which);
++	if (!state) {
+ 		ret = -EINVAL;
+ 		goto done;
+ 	}
+ 
+-	uds_try_format(uds, config, fmt->pad, &fmt->format);
++	uds_try_format(uds, state, fmt->pad, &fmt->format);
+ 
+-	format = vsp1_entity_get_pad_format(&uds->entity, config, fmt->pad);
++	format = vsp1_entity_get_pad_format(&uds->entity, state, fmt->pad);
+ 	*format = fmt->format;
+ 
+ 	if (fmt->pad == UDS_PAD_SINK) {
+ 		/* Propagate the format to the source pad. */
+-		format = vsp1_entity_get_pad_format(&uds->entity, config,
++		format = vsp1_entity_get_pad_format(&uds->entity, state,
+ 						    UDS_PAD_SOURCE);
+ 		*format = fmt->format;
+ 
+-		uds_try_format(uds, config, UDS_PAD_SOURCE, format);
++		uds_try_format(uds, state, UDS_PAD_SOURCE, format);
+ 	}
+ 
+ done:
+@@ -269,9 +266,9 @@ static void uds_configure_stream(struct vsp1_entity *entity,
+ 	unsigned int vscale;
+ 	bool multitap;
+ 
+-	input = vsp1_entity_get_pad_format(&uds->entity, uds->entity.config,
++	input = vsp1_entity_get_pad_format(&uds->entity, uds->entity.state,
+ 					   UDS_PAD_SINK);
+-	output = vsp1_entity_get_pad_format(&uds->entity, uds->entity.config,
++	output = vsp1_entity_get_pad_format(&uds->entity, uds->entity.state,
+ 					    UDS_PAD_SOURCE);
+ 
+ 	hscale = uds_compute_ratio(input->width, output->width);
+@@ -314,7 +311,7 @@ static void uds_configure_partition(struct vsp1_entity *entity,
+ 	struct vsp1_partition *partition = pipe->partition;
+ 	const struct v4l2_mbus_framefmt *output;
+ 
+-	output = vsp1_entity_get_pad_format(&uds->entity, uds->entity.config,
++	output = vsp1_entity_get_pad_format(&uds->entity, uds->entity.state,
+ 					    UDS_PAD_SOURCE);
+ 
+ 	/* Input size clipping. */
+@@ -339,9 +336,9 @@ static unsigned int uds_max_width(struct vsp1_entity *entity,
+ 	const struct v4l2_mbus_framefmt *input;
+ 	unsigned int hscale;
+ 
+-	input = vsp1_entity_get_pad_format(&uds->entity, uds->entity.config,
++	input = vsp1_entity_get_pad_format(&uds->entity, uds->entity.state,
+ 					   UDS_PAD_SINK);
+-	output = vsp1_entity_get_pad_format(&uds->entity, uds->entity.config,
++	output = vsp1_entity_get_pad_format(&uds->entity, uds->entity.state,
+ 					    UDS_PAD_SOURCE);
+ 	hscale = output->width / input->width;
+ 
+@@ -381,9 +378,9 @@ static void uds_partition(struct vsp1_entity *entity,
+ 	partition->uds_sink = *window;
+ 	partition->uds_source = *window;
+ 
+-	input = vsp1_entity_get_pad_format(&uds->entity, uds->entity.config,
++	input = vsp1_entity_get_pad_format(&uds->entity, uds->entity.state,
+ 					   UDS_PAD_SINK);
+-	output = vsp1_entity_get_pad_format(&uds->entity, uds->entity.config,
++	output = vsp1_entity_get_pad_format(&uds->entity, uds->entity.state,
+ 					    UDS_PAD_SOURCE);
+ 
+ 	partition->uds_sink.width = window->width * input->width
+diff --git a/drivers/media/platform/renesas/vsp1/vsp1_uif.c b/drivers/media/platform/renesas/vsp1/vsp1_uif.c
+index 83d7f17df80e..d84d10f35090 100644
+--- a/drivers/media/platform/renesas/vsp1/vsp1_uif.c
++++ b/drivers/media/platform/renesas/vsp1/vsp1_uif.c
+@@ -86,7 +86,7 @@ static int uif_get_selection(struct v4l2_subdev *subdev,
+ 			     struct v4l2_subdev_selection *sel)
+ {
+ 	struct vsp1_uif *uif = to_uif(subdev);
+-	struct v4l2_subdev_state *config;
++	struct v4l2_subdev_state *state;
+ 	struct v4l2_mbus_framefmt *format;
+ 	int ret = 0;
+ 
+@@ -95,9 +95,8 @@ static int uif_get_selection(struct v4l2_subdev *subdev,
+ 
+ 	mutex_lock(&uif->entity.lock);
+ 
+-	config = vsp1_entity_get_pad_config(&uif->entity, sd_state,
+-					    sel->which);
+-	if (!config) {
++	state = vsp1_entity_get_state(&uif->entity, sd_state, sel->which);
++	if (!state) {
+ 		ret = -EINVAL;
+ 		goto done;
+ 	}
+@@ -105,7 +104,7 @@ static int uif_get_selection(struct v4l2_subdev *subdev,
+ 	switch (sel->target) {
+ 	case V4L2_SEL_TGT_CROP_BOUNDS:
+ 	case V4L2_SEL_TGT_CROP_DEFAULT:
+-		format = vsp1_entity_get_pad_format(&uif->entity, config,
++		format = vsp1_entity_get_pad_format(&uif->entity, state,
+ 						    UIF_PAD_SINK);
+ 		sel->r.left = 0;
+ 		sel->r.top = 0;
+@@ -114,7 +113,7 @@ static int uif_get_selection(struct v4l2_subdev *subdev,
+ 		break;
+ 
+ 	case V4L2_SEL_TGT_CROP:
+-		sel->r = *vsp1_entity_get_pad_selection(&uif->entity, config,
++		sel->r = *vsp1_entity_get_pad_selection(&uif->entity, state,
+ 							sel->pad, sel->target);
+ 		break;
+ 
+@@ -133,7 +132,7 @@ static int uif_set_selection(struct v4l2_subdev *subdev,
+ 			     struct v4l2_subdev_selection *sel)
+ {
+ 	struct vsp1_uif *uif = to_uif(subdev);
+-	struct v4l2_subdev_state *config;
++	struct v4l2_subdev_state *state;
+ 	struct v4l2_mbus_framefmt *format;
+ 	struct v4l2_rect *selection;
+ 	int ret = 0;
+@@ -144,15 +143,14 @@ static int uif_set_selection(struct v4l2_subdev *subdev,
+ 
+ 	mutex_lock(&uif->entity.lock);
+ 
+-	config = vsp1_entity_get_pad_config(&uif->entity, sd_state,
+-					    sel->which);
+-	if (!config) {
++	state = vsp1_entity_get_state(&uif->entity, sd_state, sel->which);
++	if (!state) {
+ 		ret = -EINVAL;
+ 		goto done;
+ 	}
+ 
+ 	/* The crop rectangle must be inside the input frame. */
+-	format = vsp1_entity_get_pad_format(&uif->entity, config, UIF_PAD_SINK);
++	format = vsp1_entity_get_pad_format(&uif->entity, state, UIF_PAD_SINK);
+ 
+ 	sel->r.left = clamp_t(unsigned int, sel->r.left, 0, format->width - 1);
+ 	sel->r.top = clamp_t(unsigned int, sel->r.top, 0, format->height - 1);
+@@ -162,7 +160,7 @@ static int uif_set_selection(struct v4l2_subdev *subdev,
+ 				format->height - sel->r.top);
+ 
+ 	/* Store the crop rectangle. */
+-	selection = vsp1_entity_get_pad_selection(&uif->entity, config,
++	selection = vsp1_entity_get_pad_selection(&uif->entity, state,
+ 						  sel->pad, V4L2_SEL_TGT_CROP);
+ 	*selection = sel->r;
+ 
+@@ -206,7 +204,7 @@ static void uif_configure_stream(struct vsp1_entity *entity,
+ 	vsp1_uif_write(uif, dlb, VI6_UIF_DISCOM_DOCMPMR,
+ 		       VI6_UIF_DISCOM_DOCMPMR_SEL(9));
+ 
+-	crop = vsp1_entity_get_pad_selection(entity, entity->config,
++	crop = vsp1_entity_get_pad_selection(entity, entity->state,
+ 					     UIF_PAD_SINK, V4L2_SEL_TGT_CROP);
+ 
+ 	left = crop->left;
+diff --git a/drivers/media/platform/renesas/vsp1/vsp1_video.c b/drivers/media/platform/renesas/vsp1/vsp1_video.c
+index 9d24647c8f32..af5da185261d 100644
+--- a/drivers/media/platform/renesas/vsp1/vsp1_video.c
++++ b/drivers/media/platform/renesas/vsp1/vsp1_video.c
+@@ -197,7 +197,7 @@ static void vsp1_video_calculate_partition(struct vsp1_pipeline *pipe,
+ 	 * at the WPF sink.
+ 	 */
+ 	format = vsp1_entity_get_pad_format(&pipe->output->entity,
+-					    pipe->output->entity.config,
++					    pipe->output->entity.state,
+ 					    RWPF_PAD_SINK);
+ 
+ 	/* A single partition simply processes the output size in full. */
+@@ -262,7 +262,7 @@ static int vsp1_video_pipeline_setup_partitions(struct vsp1_pipeline *pipe)
+ 	 * at the WPF sink.
+ 	 */
+ 	format = vsp1_entity_get_pad_format(&pipe->output->entity,
+-					    pipe->output->entity.config,
++					    pipe->output->entity.state,
+ 					    RWPF_PAD_SINK);
+ 	div_size = format->width;
+ 
+diff --git a/drivers/media/platform/renesas/vsp1/vsp1_wpf.c b/drivers/media/platform/renesas/vsp1/vsp1_wpf.c
+index 94e91d7bb56c..4c1de322963d 100644
+--- a/drivers/media/platform/renesas/vsp1/vsp1_wpf.c
++++ b/drivers/media/platform/renesas/vsp1/vsp1_wpf.c
+@@ -66,10 +66,10 @@ static int vsp1_wpf_set_rotation(struct vsp1_rwpf *wpf, unsigned int rotation)
+ 	}
+ 
+ 	sink_format = vsp1_entity_get_pad_format(&wpf->entity,
+-						 wpf->entity.config,
++						 wpf->entity.state,
+ 						 RWPF_PAD_SINK);
+ 	source_format = vsp1_entity_get_pad_format(&wpf->entity,
+-						   wpf->entity.config,
++						   wpf->entity.state,
+ 						   RWPF_PAD_SOURCE);
+ 
+ 	mutex_lock(&wpf->entity.lock);
+@@ -269,10 +269,10 @@ static void wpf_configure_stream(struct vsp1_entity *entity,
+ 	int ret;
+ 
+ 	sink_format = vsp1_entity_get_pad_format(&wpf->entity,
+-						 wpf->entity.config,
++						 wpf->entity.state,
+ 						 RWPF_PAD_SINK);
+ 	source_format = vsp1_entity_get_pad_format(&wpf->entity,
+-						   wpf->entity.config,
++						   wpf->entity.state,
+ 						   RWPF_PAD_SOURCE);
+ 
+ 	/* Format */
+@@ -407,7 +407,7 @@ static void wpf_configure_partition(struct vsp1_entity *entity,
+ 	unsigned int i;
+ 
+ 	sink_format = vsp1_entity_get_pad_format(&wpf->entity,
+-						 wpf->entity.config,
++						 wpf->entity.state,
+ 						 RWPF_PAD_SINK);
+ 	width = sink_format->width;
+ 	height = sink_format->height;
+-- 
+2.43.0
+
diff --git a/queue-6.1/media-rkisp1-drop-irqf_shared.patch b/queue-6.1/media-rkisp1-drop-irqf_shared.patch
new file mode 100644
index 00000000000..3dcaf412f78
--- /dev/null
+++ b/queue-6.1/media-rkisp1-drop-irqf_shared.patch
@@ -0,0 +1,44 @@
+From 0aa982181e1986d1e2e9e1e6d3bd228aaf7e6e88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Dec 2023 08:57:45 +0100
+Subject: media: rkisp1: Drop IRQF_SHARED
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 85d2a31fe4d9be1555f621ead7a520d8791e0f74 ]
+
+In all known platforms the ISP has dedicated IRQ lines, but for some
+reason the driver uses IRQF_SHARED.
+
+Supporting IRQF_SHARED properly requires handling interrupts even when
+our device is disabled, and the driver does not handle this. To avoid
+adding such code, and to be sure the driver won't accidentally be used
+in a platform with shared interrupts, let's drop the IRQF_SHARED flag.
+
+Link: https://lore.kernel.org/r/20231207-rkisp-irq-fix-v3-1-358a2c871a3c@ideasonboard.com
+
+Tested-by: Adam Ford <aford173@gmail.com>  #imx8mp-beacon
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
+index 2b76339f9381..46d94e4c9745 100644
+--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
+@@ -542,7 +542,7 @@ static int rkisp1_probe(struct platform_device *pdev)
+ 		if (irq < 0)
+ 			return irq;
+ 
+-		ret = devm_request_irq(dev, irq, info->isrs[i].isr, IRQF_SHARED,
++		ret = devm_request_irq(dev, irq, info->isrs[i].isr, 0,
+ 				       dev_driver_string(dev), dev);
+ 		if (ret) {
+ 			dev_err(dev, "request irq failed: %d\n", ret);
+-- 
+2.43.0
+
diff --git a/queue-6.1/media-rkisp1-fix-irq-disable-race-issue.patch b/queue-6.1/media-rkisp1-fix-irq-disable-race-issue.patch
new file mode 100644
index 00000000000..a26da3d91cd
--- /dev/null
+++ b/queue-6.1/media-rkisp1-fix-irq-disable-race-issue.patch
@@ -0,0 +1,99 @@
+From bae36622c08c91a993ea2d5069eedabfaf4b504d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Dec 2023 08:57:48 +0100
+Subject: media: rkisp1: Fix IRQ disable race issue
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 870565f063a58576e8a4529f122cac4325c6b395 ]
+
+In rkisp1_isp_stop() and rkisp1_csi_disable() the driver masks the
+interrupts and then apparently assumes that the interrupt handler won't
+be running, and proceeds in the stop procedure. This is not the case, as
+the interrupt handler can already be running, which would lead to the
+ISP being disabled while the interrupt handler handling a captured
+frame.
+
+This brings up two issues: 1) the ISP could be powered off while the
+interrupt handler is still running and accessing registers, leading to
+board lockup, and 2) the interrupt handler code and the code that
+disables the streaming might do things that conflict.
+
+It is not clear to me if 2) causes a real issue, but 1) can be seen with
+a suitable delay (or printk in my case) in the interrupt handler,
+leading to board lockup.
+
+Link: https://lore.kernel.org/r/20231207-rkisp-irq-fix-v3-4-358a2c871a3c@ideasonboard.com
+
+Tested-by: Adam Ford <aford173@gmail.com>  #imx8mp-beacon
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/rockchip/rkisp1/rkisp1-csi.c     | 14 ++++++++++++-
+ .../platform/rockchip/rkisp1/rkisp1-isp.c     | 20 ++++++++++++++++---
+ 2 files changed, 30 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
+index d7acc94e10f8..e862f515cc6d 100644
+--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
+@@ -141,8 +141,20 @@ static void rkisp1_csi_disable(struct rkisp1_csi *csi)
+ 	struct rkisp1_device *rkisp1 = csi->rkisp1;
+ 	u32 val;
+ 
+-	/* Mask and clear interrupts. */
++	/* Mask MIPI interrupts. */
+ 	rkisp1_write(rkisp1, RKISP1_CIF_MIPI_IMSC, 0);
++
++	/* Flush posted writes */
++	rkisp1_read(rkisp1, RKISP1_CIF_MIPI_IMSC);
++
++	/*
++	 * Wait until the IRQ handler has ended. The IRQ handler may get called
++	 * even after this, but it will return immediately as the MIPI
++	 * interrupts have been masked.
++	 */
++	synchronize_irq(rkisp1->irqs[RKISP1_IRQ_MIPI]);
++
++	/* Clear MIPI interrupt status */
+ 	rkisp1_write(rkisp1, RKISP1_CIF_MIPI_ICR, ~0);
+ 
+ 	val = rkisp1_read(rkisp1, RKISP1_CIF_MIPI_CTRL);
+diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
+index 585cf3f53469..00dca284c122 100644
+--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
+@@ -281,11 +281,25 @@ static void rkisp1_isp_stop(struct rkisp1_isp *isp)
+ 	 * ISP(mi) stop in mi frame end -> Stop ISP(mipi) ->
+ 	 * Stop ISP(isp) ->wait for ISP isp off
+ 	 */
+-	/* stop and clear MI and ISP interrupts */
+-	rkisp1_write(rkisp1, RKISP1_CIF_ISP_IMSC, 0);
+-	rkisp1_write(rkisp1, RKISP1_CIF_ISP_ICR, ~0);
+ 
++	/* Mask MI and ISP interrupts */
++	rkisp1_write(rkisp1, RKISP1_CIF_ISP_IMSC, 0);
+ 	rkisp1_write(rkisp1, RKISP1_CIF_MI_IMSC, 0);
++
++	/* Flush posted writes */
++	rkisp1_read(rkisp1, RKISP1_CIF_MI_IMSC);
++
++	/*
++	 * Wait until the IRQ handler has ended. The IRQ handler may get called
++	 * even after this, but it will return immediately as the MI and ISP
++	 * interrupts have been masked.
++	 */
++	synchronize_irq(rkisp1->irqs[RKISP1_IRQ_ISP]);
++	if (rkisp1->irqs[RKISP1_IRQ_ISP] != rkisp1->irqs[RKISP1_IRQ_MI])
++		synchronize_irq(rkisp1->irqs[RKISP1_IRQ_MI]);
++
++	/* Clear MI and ISP interrupt status */
++	rkisp1_write(rkisp1, RKISP1_CIF_ISP_ICR, ~0);
+ 	rkisp1_write(rkisp1, RKISP1_CIF_MI_ICR, ~0);
+ 
+ 	/* stop ISP */
+-- 
+2.43.0
+
diff --git a/queue-6.1/media-rkisp1-fix-irq-handler-return-values.patch b/queue-6.1/media-rkisp1-fix-irq-handler-return-values.patch
new file mode 100644
index 00000000000..e340a6cb41b
--- /dev/null
+++ b/queue-6.1/media-rkisp1-fix-irq-handler-return-values.patch
@@ -0,0 +1,64 @@
+From b0d6b3f590fab0ba7e4b433d974c088689b63927 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Dec 2023 08:57:46 +0100
+Subject: media: rkisp1: Fix IRQ handler return values
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 3eb7910e1b16a2c136be26a8380f21469225b2f6 ]
+
+The IRQ handler rkisp1_isr() calls sub-handlers, all of which returns an
+irqreturn_t value, but rkisp1_isr() ignores those values and always
+returns IRQ_HANDLED.
+
+Fix this by collecting the return values, and returning IRQ_HANDLED or
+IRQ_NONE as appropriate.
+
+Link: https://lore.kernel.org/r/20231207-rkisp-irq-fix-v3-2-358a2c871a3c@ideasonboard.com
+
+Tested-by: Adam Ford <aford173@gmail.com>  #imx8mp-beacon
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../media/platform/rockchip/rkisp1/rkisp1-dev.c  | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
+index 46d94e4c9745..8d990957ea21 100644
+--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
+@@ -442,17 +442,25 @@ static int rkisp1_entities_register(struct rkisp1_device *rkisp1)
+ 
+ static irqreturn_t rkisp1_isr(int irq, void *ctx)
+ {
++	irqreturn_t ret = IRQ_NONE;
++
+ 	/*
+ 	 * Call rkisp1_capture_isr() first to handle the frame that
+ 	 * potentially completed using the current frame_sequence number before
+ 	 * it is potentially incremented by rkisp1_isp_isr() in the vertical
+ 	 * sync.
+ 	 */
+-	rkisp1_capture_isr(irq, ctx);
+-	rkisp1_isp_isr(irq, ctx);
+-	rkisp1_csi_isr(irq, ctx);
+ 
+-	return IRQ_HANDLED;
++	if (rkisp1_capture_isr(irq, ctx) == IRQ_HANDLED)
++		ret = IRQ_HANDLED;
++
++	if (rkisp1_isp_isr(irq, ctx) == IRQ_HANDLED)
++		ret = IRQ_HANDLED;
++
++	if (rkisp1_csi_isr(irq, ctx) == IRQ_HANDLED)
++		ret = IRQ_HANDLED;
++
++	return ret;
+ }
+ 
+ static const char * const px30_isp_clks[] = {
+-- 
+2.43.0
+
diff --git a/queue-6.1/media-rkisp1-store-irq-lines.patch b/queue-6.1/media-rkisp1-store-irq-lines.patch
new file mode 100644
index 00000000000..36a61960672
--- /dev/null
+++ b/queue-6.1/media-rkisp1-store-irq-lines.patch
@@ -0,0 +1,126 @@
+From 3ba90e002ab1e8a9263ce89c4c8cef5714b96176 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Dec 2023 08:57:47 +0100
+Subject: media: rkisp1: Store IRQ lines
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 0753874617de883c6d4da903142f334f76a75d70 ]
+
+Store the IRQ lines used by the driver for easy access. These are needed
+in future patches which fix IRQ race issues.
+
+Link: https://lore.kernel.org/r/20231207-rkisp-irq-fix-v3-3-358a2c871a3c@ideasonboard.com
+
+Tested-by: Adam Ford <aford173@gmail.com>  #imx8mp-beacon
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/rockchip/rkisp1/rkisp1-common.h    | 11 ++++++++++-
+ .../media/platform/rockchip/rkisp1/rkisp1-dev.c | 17 +++++++++++++----
+ 2 files changed, 23 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h b/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h
+index a1293c45aae1..f9ec1c613894 100644
+--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h
++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h
+@@ -61,6 +61,14 @@ struct dentry;
+ 						 RKISP1_CIF_ISP_EXP_END |	\
+ 						 RKISP1_CIF_ISP_HIST_MEASURE_RDY)
+ 
++/* IRQ lines */
++enum rkisp1_irq_line {
++	RKISP1_IRQ_ISP = 0,
++	RKISP1_IRQ_MI,
++	RKISP1_IRQ_MIPI,
++	RKISP1_NUM_IRQS,
++};
++
+ /* enum for the resizer pads */
+ enum rkisp1_rsz_pad {
+ 	RKISP1_RSZ_PAD_SINK,
+@@ -441,7 +449,6 @@ struct rkisp1_debug {
+  * struct rkisp1_device - ISP platform device
+  *
+  * @base_addr:	   base register address
+- * @irq:	   the irq number
+  * @dev:	   a pointer to the struct device
+  * @clk_size:	   number of clocks
+  * @clks:	   array of clocks
+@@ -459,6 +466,7 @@ struct rkisp1_debug {
+  * @stream_lock:   serializes {start/stop}_streaming callbacks between the capture devices.
+  * @debug:	   debug params to be exposed on debugfs
+  * @info:	   version-specific ISP information
++ * @irqs:          IRQ line numbers
+  */
+ struct rkisp1_device {
+ 	void __iomem *base_addr;
+@@ -479,6 +487,7 @@ struct rkisp1_device {
+ 	struct mutex stream_lock; /* serialize {start/stop}_streaming cb between capture devices */
+ 	struct rkisp1_debug debug;
+ 	const struct rkisp1_info *info;
++	int irqs[RKISP1_NUM_IRQS];
+ };
+ 
+ /*
+diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
+index 8d990957ea21..aeb6bb63667e 100644
+--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
+@@ -114,6 +114,7 @@
+ struct rkisp1_isr_data {
+ 	const char *name;
+ 	irqreturn_t (*isr)(int irq, void *ctx);
++	u32 line_mask;
+ };
+ 
+ /* ----------------------------------------------------------------------------
+@@ -471,9 +472,9 @@ static const char * const px30_isp_clks[] = {
+ };
+ 
+ static const struct rkisp1_isr_data px30_isp_isrs[] = {
+-	{ "isp", rkisp1_isp_isr },
+-	{ "mi", rkisp1_capture_isr },
+-	{ "mipi", rkisp1_csi_isr },
++	{ "isp", rkisp1_isp_isr, BIT(RKISP1_IRQ_ISP) },
++	{ "mi", rkisp1_capture_isr, BIT(RKISP1_IRQ_MI) },
++	{ "mipi", rkisp1_csi_isr, BIT(RKISP1_IRQ_MIPI) },
+ };
+ 
+ static const struct rkisp1_info px30_isp_info = {
+@@ -492,7 +493,7 @@ static const char * const rk3399_isp_clks[] = {
+ };
+ 
+ static const struct rkisp1_isr_data rk3399_isp_isrs[] = {
+-	{ NULL, rkisp1_isr },
++	{ NULL, rkisp1_isr, BIT(RKISP1_IRQ_ISP) | BIT(RKISP1_IRQ_MI) | BIT(RKISP1_IRQ_MIPI) },
+ };
+ 
+ static const struct rkisp1_info rk3399_isp_info = {
+@@ -543,6 +544,9 @@ static int rkisp1_probe(struct platform_device *pdev)
+ 	if (IS_ERR(rkisp1->base_addr))
+ 		return PTR_ERR(rkisp1->base_addr);
+ 
++	for (unsigned int il = 0; il < ARRAY_SIZE(rkisp1->irqs); ++il)
++		rkisp1->irqs[il] = -1;
++
+ 	for (i = 0; i < info->isr_size; i++) {
+ 		irq = info->isrs[i].name
+ 		    ? platform_get_irq_byname(pdev, info->isrs[i].name)
+@@ -550,6 +554,11 @@ static int rkisp1_probe(struct platform_device *pdev)
+ 		if (irq < 0)
+ 			return irq;
+ 
++		for (unsigned int il = 0; il < ARRAY_SIZE(rkisp1->irqs); ++il) {
++			if (info->isrs[i].line_mask & BIT(il))
++				rkisp1->irqs[il] = irq;
++		}
++
+ 		ret = devm_request_irq(dev, irq, info->isrs[i].isr, 0,
+ 				       dev_driver_string(dev), dev);
+ 		if (ret) {
+-- 
+2.43.0
+
diff --git a/queue-6.1/media-rockchip-rga-fix-swizzling-for-rgb-formats.patch b/queue-6.1/media-rockchip-rga-fix-swizzling-for-rgb-formats.patch
new file mode 100644
index 00000000000..4186d944e78
--- /dev/null
+++ b/queue-6.1/media-rockchip-rga-fix-swizzling-for-rgb-formats.patch
@@ -0,0 +1,74 @@
+From 4d3eb8c7a940bf7d25211d4d8a2af33fad82d44b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Oct 2023 13:00:22 +0200
+Subject: media: rockchip: rga: fix swizzling for RGB formats
+
+From: Michael Tretter <m.tretter@pengutronix.de>
+
+[ Upstream commit 9e7dc39260edac180c206bb6149595a40eabae3e ]
+
+When using 32 bit RGB formats, the RGA on the rk3568 produces wrong
+colors as the wrong color channels are read or written.  The reason is
+that the format description for the channel swizzeling is wrong and the
+wrong bits are configured. For example, when converting ARGB32 to NV12,
+the alpha channel is used as blue channel.. This doesn't happen if the
+color format is the same on both sides.
+
+Fix the color_swap settings of the formats to correctly handle 32 bit
+RGB formats.
+
+For RGA_COLOR_FMT_XBGR8888, the RGA_COLOR_ALPHA_SWAP bit doesn't have an
+effect. Thus, it isn't possible to handle the V4L2_PIX_FMT_XRGB32. Thus,
+it is removed from the list of supported formats.
+
+Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rockchip/rga/rga.c | 15 +++------------
+ 1 file changed, 3 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/media/platform/rockchip/rga/rga.c b/drivers/media/platform/rockchip/rga/rga.c
+index 61b25fcf826e..9b20cef5afc6 100644
+--- a/drivers/media/platform/rockchip/rga/rga.c
++++ b/drivers/media/platform/rockchip/rga/rga.c
+@@ -187,25 +187,16 @@ static int rga_setup_ctrls(struct rga_ctx *ctx)
+ static struct rga_fmt formats[] = {
+ 	{
+ 		.fourcc = V4L2_PIX_FMT_ARGB32,
+-		.color_swap = RGA_COLOR_RB_SWAP,
++		.color_swap = RGA_COLOR_ALPHA_SWAP,
+ 		.hw_format = RGA_COLOR_FMT_ABGR8888,
+ 		.depth = 32,
+ 		.uv_factor = 1,
+ 		.y_div = 1,
+ 		.x_div = 1,
+ 	},
+-	{
+-		.fourcc = V4L2_PIX_FMT_XRGB32,
+-		.color_swap = RGA_COLOR_RB_SWAP,
+-		.hw_format = RGA_COLOR_FMT_XBGR8888,
+-		.depth = 32,
+-		.uv_factor = 1,
+-		.y_div = 1,
+-		.x_div = 1,
+-	},
+ 	{
+ 		.fourcc = V4L2_PIX_FMT_ABGR32,
+-		.color_swap = RGA_COLOR_ALPHA_SWAP,
++		.color_swap = RGA_COLOR_RB_SWAP,
+ 		.hw_format = RGA_COLOR_FMT_ABGR8888,
+ 		.depth = 32,
+ 		.uv_factor = 1,
+@@ -214,7 +205,7 @@ static struct rga_fmt formats[] = {
+ 	},
+ 	{
+ 		.fourcc = V4L2_PIX_FMT_XBGR32,
+-		.color_swap = RGA_COLOR_ALPHA_SWAP,
++		.color_swap = RGA_COLOR_RB_SWAP,
+ 		.hw_format = RGA_COLOR_FMT_XBGR8888,
+ 		.depth = 32,
+ 		.uv_factor = 1,
+-- 
+2.43.0
+
diff --git a/queue-6.1/media-stk1160-fixed-high-volume-of-stk1160_dbg-messa.patch b/queue-6.1/media-stk1160-fixed-high-volume-of-stk1160_dbg-messa.patch
new file mode 100644
index 00000000000..a7d39106456
--- /dev/null
+++ b/queue-6.1/media-stk1160-fixed-high-volume-of-stk1160_dbg-messa.patch
@@ -0,0 +1,47 @@
+From e948e39fe1f835f458cb1488f5ce38617bb994ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Nov 2023 14:32:36 +0530
+Subject: media: stk1160: Fixed high volume of stk1160_dbg messages
+
+From: Ghanshyam Agrawal <ghanshyam1898@gmail.com>
+
+[ Upstream commit b3695e86d25aafbe175dd51f6aaf6f68d341d590 ]
+
+The function stk1160_dbg gets called too many times, which causes
+the output to get flooded with messages. Since stk1160_dbg uses
+printk, it is now replaced with printk_ratelimited.
+
+Suggested-by: Phillip Potter <phil@philpotter.co.uk>
+Signed-off-by: Ghanshyam Agrawal <ghanshyam1898@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/stk1160/stk1160-video.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/usb/stk1160/stk1160-video.c b/drivers/media/usb/stk1160/stk1160-video.c
+index 4e966f6bf608..366f0e4a5dc0 100644
+--- a/drivers/media/usb/stk1160/stk1160-video.c
++++ b/drivers/media/usb/stk1160/stk1160-video.c
+@@ -107,8 +107,7 @@ void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len)
+ 
+ 	/*
+ 	 * TODO: These stk1160_dbg are very spammy!
+-	 * We should 1) check why we are getting them
+-	 * and 2) add ratelimit.
++	 * We should check why we are getting them.
+ 	 *
+ 	 * UPDATE: One of the reasons (the only one?) for getting these
+ 	 * is incorrect standard (mismatch between expected and configured).
+@@ -151,7 +150,7 @@ void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len)
+ 
+ 	/* Let the bug hunt begin! sanity checks! */
+ 	if (lencopy < 0) {
+-		stk1160_dbg("copy skipped: negative lencopy\n");
++		printk_ratelimited(KERN_DEBUG "copy skipped: negative lencopy\n");
+ 		return;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/mfd-ti_am335x_tscadc-fix-ti-soc-dependencies.patch b/queue-6.1/mfd-ti_am335x_tscadc-fix-ti-soc-dependencies.patch
new file mode 100644
index 00000000000..5cd4235b2cd
--- /dev/null
+++ b/queue-6.1/mfd-ti_am335x_tscadc-fix-ti-soc-dependencies.patch
@@ -0,0 +1,35 @@
+From 09f51b7adabe4c5d177bc35bd07e52452457e8b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 15:56:39 +0000
+Subject: mfd: ti_am335x_tscadc: Fix TI SoC dependencies
+
+From: Peter Robinson <pbrobinson@gmail.com>
+
+[ Upstream commit 284d16c456e5d4b143f375b8ccc4038ab3f4ee0f ]
+
+The ti_am335x_tscadc is specific to some TI SoCs, update
+the dependencies for those SoCs and compile testing.
+
+Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
+Link: https://lore.kernel.org/r/20231220155643.445849-1-pbrobinson@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
+index 9da8235cb690..43cb511fd8ba 100644
+--- a/drivers/mfd/Kconfig
++++ b/drivers/mfd/Kconfig
+@@ -1440,6 +1440,7 @@ config MFD_DAVINCI_VOICECODEC
+ 
+ config MFD_TI_AM335X_TSCADC
+ 	tristate "TI ADC / Touch Screen chip support"
++	depends on ARCH_OMAP2PLUS || ARCH_K3 || COMPILE_TEST
+ 	select MFD_CORE
+ 	select REGMAP
+ 	select REGMAP_MMIO
+-- 
+2.43.0
+
diff --git a/queue-6.1/misc-lis3lv02d_i2c-add-missing-setting-of-the-reg_ct.patch b/queue-6.1/misc-lis3lv02d_i2c-add-missing-setting-of-the-reg_ct.patch
new file mode 100644
index 00000000000..9a2a3a379fa
--- /dev/null
+++ b/queue-6.1/misc-lis3lv02d_i2c-add-missing-setting-of-the-reg_ct.patch
@@ -0,0 +1,60 @@
+From 53b69e26d6afa4aded7c9af643de8e6cafe9bf46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Dec 2023 19:34:02 +0100
+Subject: misc: lis3lv02d_i2c: Add missing setting of the reg_ctrl callback
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit b1b9f7a494400c0c39f8cd83de3aaa6111c55087 ]
+
+The lis3lv02d_i2c driver was missing a line to set the lis3_dev's
+reg_ctrl callback.
+
+lis3_reg_ctrl(on) is called from the init callback, but due to
+the missing reg_ctrl callback the regulators where never turned off
+again leading to the following oops/backtrace when detaching the driver:
+
+[   82.313527] ------------[ cut here ]------------
+[   82.313546] WARNING: CPU: 1 PID: 1724 at drivers/regulator/core.c:2396 _regulator_put+0x219/0x230
+...
+[   82.313695] RIP: 0010:_regulator_put+0x219/0x230
+...
+[   82.314767] Call Trace:
+[   82.314770]  <TASK>
+[   82.314772]  ? _regulator_put+0x219/0x230
+[   82.314777]  ? __warn+0x81/0x170
+[   82.314784]  ? _regulator_put+0x219/0x230
+[   82.314791]  ? report_bug+0x18d/0x1c0
+[   82.314801]  ? handle_bug+0x3c/0x80
+[   82.314806]  ? exc_invalid_op+0x13/0x60
+[   82.314812]  ? asm_exc_invalid_op+0x16/0x20
+[   82.314845]  ? _regulator_put+0x219/0x230
+[   82.314857]  regulator_bulk_free+0x39/0x60
+[   82.314865]  i2c_device_remove+0x22/0xb0
+
+Add the missing setting of the callback so that the regulators
+properly get turned off again when not used.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20231224183402.95640-1-hdegoede@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/lis3lv02d/lis3lv02d_i2c.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/misc/lis3lv02d/lis3lv02d_i2c.c b/drivers/misc/lis3lv02d/lis3lv02d_i2c.c
+index d7daa01fe7ca..fdec2c30eb16 100644
+--- a/drivers/misc/lis3lv02d/lis3lv02d_i2c.c
++++ b/drivers/misc/lis3lv02d/lis3lv02d_i2c.c
+@@ -151,6 +151,7 @@ static int lis3lv02d_i2c_probe(struct i2c_client *client,
+ 	lis3_dev.init	  = lis3_i2c_init;
+ 	lis3_dev.read	  = lis3_i2c_read;
+ 	lis3_dev.write	  = lis3_i2c_write;
++	lis3_dev.reg_ctrl = lis3_reg_ctrl;
+ 	lis3_dev.irq	  = client->irq;
+ 	lis3_dev.ac	  = lis3lv02d_axis_map;
+ 	lis3_dev.pm_dev	  = &client->dev;
+-- 
+2.43.0
+
diff --git a/queue-6.1/net-atlantic-eliminate-double-free-in-error-handling.patch b/queue-6.1/net-atlantic-eliminate-double-free-in-error-handling.patch
new file mode 100644
index 00000000000..137e2e48816
--- /dev/null
+++ b/queue-6.1/net-atlantic-eliminate-double-free-in-error-handling.patch
@@ -0,0 +1,288 @@
+From b3d98fd50b5938407bab247e1515700f2f1546e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Dec 2023 10:50:44 +0100
+Subject: net: atlantic: eliminate double free in error handling logic
+
+From: Igor Russkikh <irusskikh@marvell.com>
+
+[ Upstream commit b3cb7a830a24527877b0bc900b9bd74a96aea928 ]
+
+Driver has a logic leak in ring data allocation/free,
+where aq_ring_free could be called multiple times on same ring,
+if system is under stress and got memory allocation error.
+
+Ring pointer was used as an indicator of failure, but this is
+not correct since only ring data is allocated/deallocated.
+Ring itself is an array member.
+
+Changing ring allocation functions to return error code directly.
+This simplifies error handling and eliminates aq_ring_free
+on higher layer.
+
+Signed-off-by: Igor Russkikh <irusskikh@marvell.com>
+Link: https://lore.kernel.org/r/20231213095044.23146-1-irusskikh@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/aquantia/atlantic/aq_ptp.c   | 28 +++------
+ .../net/ethernet/aquantia/atlantic/aq_ring.c  | 61 +++++--------------
+ .../net/ethernet/aquantia/atlantic/aq_ring.h  | 22 +++----
+ .../net/ethernet/aquantia/atlantic/aq_vec.c   | 23 +++----
+ 4 files changed, 47 insertions(+), 87 deletions(-)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c b/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c
+index 28c9b6f1a54f..abd4832e4ed2 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ptp.c
+@@ -953,8 +953,6 @@ int aq_ptp_ring_alloc(struct aq_nic_s *aq_nic)
+ {
+ 	struct aq_ptp_s *aq_ptp = aq_nic->aq_ptp;
+ 	unsigned int tx_ring_idx, rx_ring_idx;
+-	struct aq_ring_s *hwts;
+-	struct aq_ring_s *ring;
+ 	int err;
+ 
+ 	if (!aq_ptp)
+@@ -962,29 +960,23 @@ int aq_ptp_ring_alloc(struct aq_nic_s *aq_nic)
+ 
+ 	tx_ring_idx = aq_ptp_ring_idx(aq_nic->aq_nic_cfg.tc_mode);
+ 
+-	ring = aq_ring_tx_alloc(&aq_ptp->ptp_tx, aq_nic,
+-				tx_ring_idx, &aq_nic->aq_nic_cfg);
+-	if (!ring) {
+-		err = -ENOMEM;
++	err = aq_ring_tx_alloc(&aq_ptp->ptp_tx, aq_nic,
++			       tx_ring_idx, &aq_nic->aq_nic_cfg);
++	if (err)
+ 		goto err_exit;
+-	}
+ 
+ 	rx_ring_idx = aq_ptp_ring_idx(aq_nic->aq_nic_cfg.tc_mode);
+ 
+-	ring = aq_ring_rx_alloc(&aq_ptp->ptp_rx, aq_nic,
+-				rx_ring_idx, &aq_nic->aq_nic_cfg);
+-	if (!ring) {
+-		err = -ENOMEM;
++	err = aq_ring_rx_alloc(&aq_ptp->ptp_rx, aq_nic,
++			       rx_ring_idx, &aq_nic->aq_nic_cfg);
++	if (err)
+ 		goto err_exit_ptp_tx;
+-	}
+ 
+-	hwts = aq_ring_hwts_rx_alloc(&aq_ptp->hwts_rx, aq_nic, PTP_HWST_RING_IDX,
+-				     aq_nic->aq_nic_cfg.rxds,
+-				     aq_nic->aq_nic_cfg.aq_hw_caps->rxd_size);
+-	if (!hwts) {
+-		err = -ENOMEM;
++	err = aq_ring_hwts_rx_alloc(&aq_ptp->hwts_rx, aq_nic, PTP_HWST_RING_IDX,
++				    aq_nic->aq_nic_cfg.rxds,
++				    aq_nic->aq_nic_cfg.aq_hw_caps->rxd_size);
++	if (err)
+ 		goto err_exit_ptp_rx;
+-	}
+ 
+ 	err = aq_ptp_skb_ring_init(&aq_ptp->skb_ring, aq_nic->aq_nic_cfg.rxds);
+ 	if (err != 0) {
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+index 4d9d7d1edb9b..9c314fe14ab6 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+@@ -132,8 +132,8 @@ static int aq_get_rxpages(struct aq_ring_s *self, struct aq_ring_buff_s *rxbuf)
+ 	return 0;
+ }
+ 
+-static struct aq_ring_s *aq_ring_alloc(struct aq_ring_s *self,
+-				       struct aq_nic_s *aq_nic)
++static int aq_ring_alloc(struct aq_ring_s *self,
++			 struct aq_nic_s *aq_nic)
+ {
+ 	int err = 0;
+ 
+@@ -156,46 +156,29 @@ static struct aq_ring_s *aq_ring_alloc(struct aq_ring_s *self,
+ err_exit:
+ 	if (err < 0) {
+ 		aq_ring_free(self);
+-		self = NULL;
+ 	}
+ 
+-	return self;
++	return err;
+ }
+ 
+-struct aq_ring_s *aq_ring_tx_alloc(struct aq_ring_s *self,
+-				   struct aq_nic_s *aq_nic,
+-				   unsigned int idx,
+-				   struct aq_nic_cfg_s *aq_nic_cfg)
++int aq_ring_tx_alloc(struct aq_ring_s *self,
++		     struct aq_nic_s *aq_nic,
++		     unsigned int idx,
++		     struct aq_nic_cfg_s *aq_nic_cfg)
+ {
+-	int err = 0;
+-
+ 	self->aq_nic = aq_nic;
+ 	self->idx = idx;
+ 	self->size = aq_nic_cfg->txds;
+ 	self->dx_size = aq_nic_cfg->aq_hw_caps->txd_size;
+ 
+-	self = aq_ring_alloc(self, aq_nic);
+-	if (!self) {
+-		err = -ENOMEM;
+-		goto err_exit;
+-	}
+-
+-err_exit:
+-	if (err < 0) {
+-		aq_ring_free(self);
+-		self = NULL;
+-	}
+-
+-	return self;
++	return aq_ring_alloc(self, aq_nic);
+ }
+ 
+-struct aq_ring_s *aq_ring_rx_alloc(struct aq_ring_s *self,
+-				   struct aq_nic_s *aq_nic,
+-				   unsigned int idx,
+-				   struct aq_nic_cfg_s *aq_nic_cfg)
++int aq_ring_rx_alloc(struct aq_ring_s *self,
++		     struct aq_nic_s *aq_nic,
++		     unsigned int idx,
++		     struct aq_nic_cfg_s *aq_nic_cfg)
+ {
+-	int err = 0;
+-
+ 	self->aq_nic = aq_nic;
+ 	self->idx = idx;
+ 	self->size = aq_nic_cfg->rxds;
+@@ -217,22 +200,10 @@ struct aq_ring_s *aq_ring_rx_alloc(struct aq_ring_s *self,
+ 		self->tail_size = 0;
+ 	}
+ 
+-	self = aq_ring_alloc(self, aq_nic);
+-	if (!self) {
+-		err = -ENOMEM;
+-		goto err_exit;
+-	}
+-
+-err_exit:
+-	if (err < 0) {
+-		aq_ring_free(self);
+-		self = NULL;
+-	}
+-
+-	return self;
++	return aq_ring_alloc(self, aq_nic);
+ }
+ 
+-struct aq_ring_s *
++int
+ aq_ring_hwts_rx_alloc(struct aq_ring_s *self, struct aq_nic_s *aq_nic,
+ 		      unsigned int idx, unsigned int size, unsigned int dx_size)
+ {
+@@ -250,10 +221,10 @@ aq_ring_hwts_rx_alloc(struct aq_ring_s *self, struct aq_nic_s *aq_nic,
+ 					   GFP_KERNEL);
+ 	if (!self->dx_ring) {
+ 		aq_ring_free(self);
+-		return NULL;
++		return -ENOMEM;
+ 	}
+ 
+-	return self;
++	return 0;
+ }
+ 
+ int aq_ring_init(struct aq_ring_s *self, const enum atl_ring_type ring_type)
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
+index 0a6c34438c1d..52847310740a 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.h
+@@ -183,14 +183,14 @@ static inline unsigned int aq_ring_avail_dx(struct aq_ring_s *self)
+ 		self->sw_head - self->sw_tail - 1);
+ }
+ 
+-struct aq_ring_s *aq_ring_tx_alloc(struct aq_ring_s *self,
+-				   struct aq_nic_s *aq_nic,
+-				   unsigned int idx,
+-				   struct aq_nic_cfg_s *aq_nic_cfg);
+-struct aq_ring_s *aq_ring_rx_alloc(struct aq_ring_s *self,
+-				   struct aq_nic_s *aq_nic,
+-				   unsigned int idx,
+-				   struct aq_nic_cfg_s *aq_nic_cfg);
++int aq_ring_tx_alloc(struct aq_ring_s *self,
++		     struct aq_nic_s *aq_nic,
++		     unsigned int idx,
++		     struct aq_nic_cfg_s *aq_nic_cfg);
++int aq_ring_rx_alloc(struct aq_ring_s *self,
++		     struct aq_nic_s *aq_nic,
++		     unsigned int idx,
++		     struct aq_nic_cfg_s *aq_nic_cfg);
+ 
+ int aq_ring_init(struct aq_ring_s *self, const enum atl_ring_type ring_type);
+ void aq_ring_rx_deinit(struct aq_ring_s *self);
+@@ -207,9 +207,9 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
+ 		     int budget);
+ int aq_ring_rx_fill(struct aq_ring_s *self);
+ 
+-struct aq_ring_s *aq_ring_hwts_rx_alloc(struct aq_ring_s *self,
+-		struct aq_nic_s *aq_nic, unsigned int idx,
+-		unsigned int size, unsigned int dx_size);
++int aq_ring_hwts_rx_alloc(struct aq_ring_s *self,
++			  struct aq_nic_s *aq_nic, unsigned int idx,
++			  unsigned int size, unsigned int dx_size);
+ void aq_ring_hwts_rx_clean(struct aq_ring_s *self, struct aq_nic_s *aq_nic);
+ 
+ unsigned int aq_ring_fill_stats_data(struct aq_ring_s *self, u64 *data);
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
+index f5db1c44e9b9..9769ab4f9bef 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
+@@ -136,35 +136,32 @@ int aq_vec_ring_alloc(struct aq_vec_s *self, struct aq_nic_s *aq_nic,
+ 		const unsigned int idx_ring = AQ_NIC_CFG_TCVEC2RING(aq_nic_cfg,
+ 								    i, idx);
+ 
+-		ring = aq_ring_tx_alloc(&self->ring[i][AQ_VEC_TX_ID], aq_nic,
+-					idx_ring, aq_nic_cfg);
+-		if (!ring) {
+-			err = -ENOMEM;
++		ring = &self->ring[i][AQ_VEC_TX_ID];
++		err = aq_ring_tx_alloc(ring, aq_nic, idx_ring, aq_nic_cfg);
++		if (err)
+ 			goto err_exit;
+-		}
+ 
+ 		++self->tx_rings;
+ 
+ 		aq_nic_set_tx_ring(aq_nic, idx_ring, ring);
+ 
+-		if (xdp_rxq_info_reg(&self->ring[i][AQ_VEC_RX_ID].xdp_rxq,
++		ring = &self->ring[i][AQ_VEC_RX_ID];
++		if (xdp_rxq_info_reg(&ring->xdp_rxq,
+ 				     aq_nic->ndev, idx,
+ 				     self->napi.napi_id) < 0) {
+ 			err = -ENOMEM;
+ 			goto err_exit;
+ 		}
+-		if (xdp_rxq_info_reg_mem_model(&self->ring[i][AQ_VEC_RX_ID].xdp_rxq,
++		if (xdp_rxq_info_reg_mem_model(&ring->xdp_rxq,
+ 					       MEM_TYPE_PAGE_SHARED, NULL) < 0) {
+-			xdp_rxq_info_unreg(&self->ring[i][AQ_VEC_RX_ID].xdp_rxq);
++			xdp_rxq_info_unreg(&ring->xdp_rxq);
+ 			err = -ENOMEM;
+ 			goto err_exit;
+ 		}
+ 
+-		ring = aq_ring_rx_alloc(&self->ring[i][AQ_VEC_RX_ID], aq_nic,
+-					idx_ring, aq_nic_cfg);
+-		if (!ring) {
+-			xdp_rxq_info_unreg(&self->ring[i][AQ_VEC_RX_ID].xdp_rxq);
+-			err = -ENOMEM;
++		err = aq_ring_rx_alloc(ring, aq_nic, idx_ring, aq_nic_cfg);
++		if (err) {
++			xdp_rxq_info_unreg(&ring->xdp_rxq);
+ 			goto err_exit;
+ 		}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/net-dsa-mv88e6xxx-fix-mv88e6352_serdes_get_stats-err.patch b/queue-6.1/net-dsa-mv88e6xxx-fix-mv88e6352_serdes_get_stats-err.patch
new file mode 100644
index 00000000000..00a2ab48660
--- /dev/null
+++ b/queue-6.1/net-dsa-mv88e6xxx-fix-mv88e6352_serdes_get_stats-err.patch
@@ -0,0 +1,102 @@
+From e2ac1770072ad3167bcc08bab6d6f7068b5a021a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 14:50:24 +0100
+Subject: net: dsa: mv88e6xxx: Fix mv88e6352_serdes_get_stats error path
+
+From: Tobias Waldekranz <tobias@waldekranz.com>
+
+[ Upstream commit fc82a08ae795ee6b73fb6b50785f7be248bec7b5 ]
+
+mv88e6xxx_get_stats, which collects stats from various sources,
+expects all callees to return the number of stats read. If an error
+occurs, 0 should be returned.
+
+Prevent future mishaps of this kind by updating the return type to
+reflect this contract.
+
+Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mv88e6xxx/chip.h   |  4 ++--
+ drivers/net/dsa/mv88e6xxx/serdes.c | 10 +++++-----
+ drivers/net/dsa/mv88e6xxx/serdes.h |  8 ++++----
+ 3 files changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.h b/drivers/net/dsa/mv88e6xxx/chip.h
+index e693154cf803..97a47d8743fd 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.h
++++ b/drivers/net/dsa/mv88e6xxx/chip.h
+@@ -601,8 +601,8 @@ struct mv88e6xxx_ops {
+ 	int (*serdes_get_sset_count)(struct mv88e6xxx_chip *chip, int port);
+ 	int (*serdes_get_strings)(struct mv88e6xxx_chip *chip,  int port,
+ 				  uint8_t *data);
+-	int (*serdes_get_stats)(struct mv88e6xxx_chip *chip,  int port,
+-				uint64_t *data);
++	size_t (*serdes_get_stats)(struct mv88e6xxx_chip *chip, int port,
++				   uint64_t *data);
+ 
+ 	/* SERDES registers for ethtool */
+ 	int (*serdes_get_regs_len)(struct mv88e6xxx_chip *chip,  int port);
+diff --git a/drivers/net/dsa/mv88e6xxx/serdes.c b/drivers/net/dsa/mv88e6xxx/serdes.c
+index d94150d8f3f4..4c38df4982bf 100644
+--- a/drivers/net/dsa/mv88e6xxx/serdes.c
++++ b/drivers/net/dsa/mv88e6xxx/serdes.c
+@@ -342,8 +342,8 @@ static uint64_t mv88e6352_serdes_get_stat(struct mv88e6xxx_chip *chip,
+ 	return val;
+ }
+ 
+-int mv88e6352_serdes_get_stats(struct mv88e6xxx_chip *chip, int port,
+-			       uint64_t *data)
++size_t mv88e6352_serdes_get_stats(struct mv88e6xxx_chip *chip, int port,
++				  uint64_t *data)
+ {
+ 	struct mv88e6xxx_port *mv88e6xxx_port = &chip->ports[port];
+ 	struct mv88e6352_serdes_hw_stat *stat;
+@@ -352,7 +352,7 @@ int mv88e6352_serdes_get_stats(struct mv88e6xxx_chip *chip, int port,
+ 
+ 	err = mv88e6352_g2_scratch_port_has_serdes(chip, port);
+ 	if (err <= 0)
+-		return err;
++		return 0;
+ 
+ 	BUILD_BUG_ON(ARRAY_SIZE(mv88e6352_serdes_hw_stats) >
+ 		     ARRAY_SIZE(mv88e6xxx_port->serdes_stats));
+@@ -798,8 +798,8 @@ static uint64_t mv88e6390_serdes_get_stat(struct mv88e6xxx_chip *chip, int lane,
+ 	return reg[0] | ((u64)reg[1] << 16) | ((u64)reg[2] << 32);
+ }
+ 
+-int mv88e6390_serdes_get_stats(struct mv88e6xxx_chip *chip, int port,
+-			       uint64_t *data)
++size_t mv88e6390_serdes_get_stats(struct mv88e6xxx_chip *chip, int port,
++				  uint64_t *data)
+ {
+ 	struct mv88e6390_serdes_hw_stat *stat;
+ 	int lane;
+diff --git a/drivers/net/dsa/mv88e6xxx/serdes.h b/drivers/net/dsa/mv88e6xxx/serdes.h
+index 29bb4e91e2f6..67369054951f 100644
+--- a/drivers/net/dsa/mv88e6xxx/serdes.h
++++ b/drivers/net/dsa/mv88e6xxx/serdes.h
+@@ -165,13 +165,13 @@ irqreturn_t mv88e6393x_serdes_irq_status(struct mv88e6xxx_chip *chip, int port,
+ int mv88e6352_serdes_get_sset_count(struct mv88e6xxx_chip *chip, int port);
+ int mv88e6352_serdes_get_strings(struct mv88e6xxx_chip *chip,
+ 				 int port, uint8_t *data);
+-int mv88e6352_serdes_get_stats(struct mv88e6xxx_chip *chip, int port,
+-			       uint64_t *data);
++size_t mv88e6352_serdes_get_stats(struct mv88e6xxx_chip *chip, int port,
++				  uint64_t *data);
+ int mv88e6390_serdes_get_sset_count(struct mv88e6xxx_chip *chip, int port);
+ int mv88e6390_serdes_get_strings(struct mv88e6xxx_chip *chip,
+ 				 int port, uint8_t *data);
+-int mv88e6390_serdes_get_stats(struct mv88e6xxx_chip *chip, int port,
+-			       uint64_t *data);
++size_t mv88e6390_serdes_get_stats(struct mv88e6xxx_chip *chip, int port,
++				  uint64_t *data);
+ 
+ int mv88e6352_serdes_get_regs_len(struct mv88e6xxx_chip *chip, int port);
+ void mv88e6352_serdes_get_regs(struct mv88e6xxx_chip *chip, int port, void *_p);
+-- 
+2.43.0
+
diff --git a/queue-6.1/net-dsa-qca8k-put-mdio-bus-of-node-on-qca8k_mdio_reg.patch b/queue-6.1/net-dsa-qca8k-put-mdio-bus-of-node-on-qca8k_mdio_reg.patch
new file mode 100644
index 00000000000..94f9b30b07c
--- /dev/null
+++ b/queue-6.1/net-dsa-qca8k-put-mdio-bus-of-node-on-qca8k_mdio_reg.patch
@@ -0,0 +1,96 @@
+From 0780da01b6a788c28212a69d7fc44155118e94d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jan 2024 16:00:31 +0200
+Subject: net: dsa: qca8k: put MDIO bus OF node on qca8k_mdio_register()
+ failure
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 68e1010cda7967cfca9c8650ee1f4efcae54ab90 ]
+
+of_get_child_by_name() gives us an OF node with an elevated refcount,
+which should be dropped when we're done with it. This is so that,
+if (of_node_check_flag(node, OF_DYNAMIC)) is true, the node's memory can
+eventually be freed.
+
+There are 2 distinct paths to be considered in qca8k_mdio_register():
+
+- devm_of_mdiobus_register() succeeds: since commit 3b73a7b8ec38 ("net:
+  mdio_bus: add refcounting for fwnodes to mdiobus"), the MDIO core
+  treats this well.
+
+- devm_of_mdiobus_register() or anything up to that point fails: it is
+  the duty of the qca8k driver to release the OF node.
+
+This change addresses the second case by making sure that the OF node
+reference is not leaked.
+
+The "mdio" node may be NULL, but of_node_put(NULL) is safe.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Alvin Å ipraga <alsi@bang-olufsen.dk>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/qca/qca8k-8xxx.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/dsa/qca/qca8k-8xxx.c b/drivers/net/dsa/qca/qca8k-8xxx.c
+index 1e94ba1031ec..7c3c90c9edbe 100644
+--- a/drivers/net/dsa/qca/qca8k-8xxx.c
++++ b/drivers/net/dsa/qca/qca8k-8xxx.c
+@@ -842,10 +842,15 @@ qca8k_mdio_register(struct qca8k_priv *priv)
+ 	struct dsa_switch *ds = priv->ds;
+ 	struct device_node *mdio;
+ 	struct mii_bus *bus;
++	int err;
++
++	mdio = of_get_child_by_name(priv->dev->of_node, "mdio");
+ 
+ 	bus = devm_mdiobus_alloc(ds->dev);
+-	if (!bus)
+-		return -ENOMEM;
++	if (!bus) {
++		err = -ENOMEM;
++		goto out_put_node;
++	}
+ 
+ 	bus->priv = (void *)priv;
+ 	snprintf(bus->id, MII_BUS_ID_SIZE, "qca8k-%d.%d",
+@@ -855,12 +860,12 @@ qca8k_mdio_register(struct qca8k_priv *priv)
+ 	ds->slave_mii_bus = bus;
+ 
+ 	/* Check if the devicetree declare the port:phy mapping */
+-	mdio = of_get_child_by_name(priv->dev->of_node, "mdio");
+ 	if (of_device_is_available(mdio)) {
+ 		bus->name = "qca8k slave mii";
+ 		bus->read = qca8k_internal_mdio_read;
+ 		bus->write = qca8k_internal_mdio_write;
+-		return devm_of_mdiobus_register(priv->dev, bus, mdio);
++		err = devm_of_mdiobus_register(priv->dev, bus, mdio);
++		goto out_put_node;
+ 	}
+ 
+ 	/* If a mapping can't be found the legacy mapping is used,
+@@ -869,7 +874,13 @@ qca8k_mdio_register(struct qca8k_priv *priv)
+ 	bus->name = "qca8k-legacy slave mii";
+ 	bus->read = qca8k_legacy_mdio_read;
+ 	bus->write = qca8k_legacy_mdio_write;
+-	return devm_mdiobus_register(priv->dev, bus);
++
++	err = devm_mdiobus_register(priv->dev, bus);
++
++out_put_node:
++	of_node_put(mdio);
++
++	return err;
+ }
+ 
+ static int
+-- 
+2.43.0
+
diff --git a/queue-6.1/net-mvmdio-avoid-excessive-sleeps-in-polled-mode.patch b/queue-6.1/net-mvmdio-avoid-excessive-sleeps-in-polled-mode.patch
new file mode 100644
index 00000000000..4c77f3d65ab
--- /dev/null
+++ b/queue-6.1/net-mvmdio-avoid-excessive-sleeps-in-polled-mode.patch
@@ -0,0 +1,139 @@
+From e809ecb6a2323dc7d3d124ceba1d2ce839aea15c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 11:08:10 +0100
+Subject: net: mvmdio: Avoid excessive sleeps in polled mode
+
+From: Tobias Waldekranz <tobias@waldekranz.com>
+
+[ Upstream commit 7dd12fe34686d89c332b1a05104d18d728591f0a ]
+
+Before this change, when operating in polled mode, i.e. no IRQ is
+available, every individual C45 access would be hit with a 150us sleep
+after the bus access.
+
+For example, on a board with a CN9130 SoC connected to an MV88X3310
+PHY, a single C45 read would take around 165us:
+
+    root@infix:~$ mdio f212a600.mdio-mii mmd 4:1 bench 0xc003
+    Performed 1000 reads in 165ms
+
+By replacing the long sleep with a tighter poll loop, we observe a 10x
+increase in bus throughput:
+
+    root@infix:~$ mdio f212a600.mdio-mii mmd 4:1 bench 0xc003
+    Performed 1000 reads in 15ms
+
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Tested-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/20231204100811.2708884-3-tobias@waldekranz.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/mvmdio.c | 53 ++++++++-------------------
+ 1 file changed, 16 insertions(+), 37 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/mvmdio.c b/drivers/net/ethernet/marvell/mvmdio.c
+index ef878973b859..b4c576e79a95 100644
+--- a/drivers/net/ethernet/marvell/mvmdio.c
++++ b/drivers/net/ethernet/marvell/mvmdio.c
+@@ -23,6 +23,7 @@
+ #include <linux/delay.h>
+ #include <linux/interrupt.h>
+ #include <linux/io.h>
++#include <linux/iopoll.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/of_device.h>
+@@ -58,11 +59,6 @@
+  * - Armada 370       (Globalscale Mirabox):   41us to 43us (Polled)
+  */
+ #define MVMDIO_SMI_TIMEOUT		1000 /* 1000us = 1ms */
+-#define MVMDIO_SMI_POLL_INTERVAL_MIN	45
+-#define MVMDIO_SMI_POLL_INTERVAL_MAX	55
+-
+-#define MVMDIO_XSMI_POLL_INTERVAL_MIN	150
+-#define MVMDIO_XSMI_POLL_INTERVAL_MAX	160
+ 
+ struct orion_mdio_dev {
+ 	void __iomem *regs;
+@@ -84,8 +80,6 @@ enum orion_mdio_bus_type {
+ 
+ struct orion_mdio_ops {
+ 	int (*is_done)(struct orion_mdio_dev *);
+-	unsigned int poll_interval_min;
+-	unsigned int poll_interval_max;
+ };
+ 
+ /* Wait for the SMI unit to be ready for another operation
+@@ -94,34 +88,23 @@ static int orion_mdio_wait_ready(const struct orion_mdio_ops *ops,
+ 				 struct mii_bus *bus)
+ {
+ 	struct orion_mdio_dev *dev = bus->priv;
+-	unsigned long timeout = usecs_to_jiffies(MVMDIO_SMI_TIMEOUT);
+-	unsigned long end = jiffies + timeout;
+-	int timedout = 0;
++	unsigned long timeout;
++	int done;
+ 
+-	while (1) {
+-	        if (ops->is_done(dev))
++	if (dev->err_interrupt <= 0) {
++		if (!read_poll_timeout_atomic(ops->is_done, done, done, 2,
++					      MVMDIO_SMI_TIMEOUT, false, dev))
++			return 0;
++	} else {
++		/* wait_event_timeout does not guarantee a delay of at
++		 * least one whole jiffie, so timeout must be no less
++		 * than two.
++		 */
++		timeout = max(usecs_to_jiffies(MVMDIO_SMI_TIMEOUT), 2);
++
++		if (wait_event_timeout(dev->smi_busy_wait,
++				       ops->is_done(dev), timeout))
+ 			return 0;
+-	        else if (timedout)
+-			break;
+-
+-	        if (dev->err_interrupt <= 0) {
+-			usleep_range(ops->poll_interval_min,
+-				     ops->poll_interval_max);
+-
+-			if (time_is_before_jiffies(end))
+-				++timedout;
+-	        } else {
+-			/* wait_event_timeout does not guarantee a delay of at
+-			 * least one whole jiffie, so timeout must be no less
+-			 * than two.
+-			 */
+-			if (timeout < 2)
+-				timeout = 2;
+-			wait_event_timeout(dev->smi_busy_wait,
+-				           ops->is_done(dev), timeout);
+-
+-			++timedout;
+-	        }
+ 	}
+ 
+ 	dev_err(bus->parent, "Timeout: SMI busy for too long\n");
+@@ -135,8 +118,6 @@ static int orion_mdio_smi_is_done(struct orion_mdio_dev *dev)
+ 
+ static const struct orion_mdio_ops orion_mdio_smi_ops = {
+ 	.is_done = orion_mdio_smi_is_done,
+-	.poll_interval_min = MVMDIO_SMI_POLL_INTERVAL_MIN,
+-	.poll_interval_max = MVMDIO_SMI_POLL_INTERVAL_MAX,
+ };
+ 
+ static int orion_mdio_smi_read(struct mii_bus *bus, int mii_id,
+@@ -200,8 +181,6 @@ static int orion_mdio_xsmi_is_done(struct orion_mdio_dev *dev)
+ 
+ static const struct orion_mdio_ops orion_mdio_xsmi_ops = {
+ 	.is_done = orion_mdio_xsmi_is_done,
+-	.poll_interval_min = MVMDIO_XSMI_POLL_INTERVAL_MIN,
+-	.poll_interval_max = MVMDIO_XSMI_POLL_INTERVAL_MAX,
+ };
+ 
+ static int orion_mdio_xsmi_read(struct mii_bus *bus, int mii_id,
+-- 
+2.43.0
+
diff --git a/queue-6.1/net-phy-at803x-fix-passing-the-wrong-reference-for-c.patch b/queue-6.1/net-phy-at803x-fix-passing-the-wrong-reference-for-c.patch
new file mode 100644
index 00000000000..9458c3b5d57
--- /dev/null
+++ b/queue-6.1/net-phy-at803x-fix-passing-the-wrong-reference-for-c.patch
@@ -0,0 +1,54 @@
+From 03e151c0dcd4f022ab91de0199f376e91b0dba54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Dec 2023 15:51:48 +0100
+Subject: net: phy: at803x: fix passing the wrong reference for config_intr
+
+From: Christian Marangi <ansuelsmth@gmail.com>
+
+[ Upstream commit f8fdbf3389f44c7026f16e36cb1f2ff017f7f5b2 ]
+
+Fix passing the wrong reference for config_initr on passing the function
+pointer, drop the wrong & from at803x_config_intr in the PHY struct.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/at803x.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c
+index edd4b1e58d96..75868e63b81b 100644
+--- a/drivers/net/phy/at803x.c
++++ b/drivers/net/phy/at803x.c
+@@ -2051,7 +2051,7 @@ static struct phy_driver at803x_driver[] = {
+ 	.write_page		= at803x_write_page,
+ 	.get_features		= at803x_get_features,
+ 	.read_status		= at803x_read_status,
+-	.config_intr		= &at803x_config_intr,
++	.config_intr		= at803x_config_intr,
+ 	.handle_interrupt	= at803x_handle_interrupt,
+ 	.get_tunable		= at803x_get_tunable,
+ 	.set_tunable		= at803x_set_tunable,
+@@ -2081,7 +2081,7 @@ static struct phy_driver at803x_driver[] = {
+ 	.resume			= at803x_resume,
+ 	.flags			= PHY_POLL_CABLE_TEST,
+ 	/* PHY_BASIC_FEATURES */
+-	.config_intr		= &at803x_config_intr,
++	.config_intr		= at803x_config_intr,
+ 	.handle_interrupt	= at803x_handle_interrupt,
+ 	.cable_test_start	= at803x_cable_test_start,
+ 	.cable_test_get_status	= at803x_cable_test_get_status,
+@@ -2097,7 +2097,7 @@ static struct phy_driver at803x_driver[] = {
+ 	.resume			= at803x_resume,
+ 	.flags			= PHY_POLL_CABLE_TEST,
+ 	/* PHY_BASIC_FEATURES */
+-	.config_intr		= &at803x_config_intr,
++	.config_intr		= at803x_config_intr,
+ 	.handle_interrupt	= at803x_handle_interrupt,
+ 	.cable_test_start	= at803x_cable_test_start,
+ 	.cable_test_get_status	= at803x_cable_test_get_status,
+-- 
+2.43.0
+
diff --git a/queue-6.1/net-smc-disable-seid-on-non-s390-archs-where-virtual.patch b/queue-6.1/net-smc-disable-seid-on-non-s390-archs-where-virtual.patch
new file mode 100644
index 00000000000..9db02cf7795
--- /dev/null
+++ b/queue-6.1/net-smc-disable-seid-on-non-s390-archs-where-virtual.patch
@@ -0,0 +1,91 @@
+From dc2aa4f042427cb58cfb3fc85de4f0e2160cde0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 22:26:15 +0800
+Subject: net/smc: disable SEID on non-s390 archs where virtual ISM may be used
+
+From: Wen Gu <guwen@linux.alibaba.com>
+
+[ Upstream commit c6b8b8eb49904018e22e4e4b1fa502e57dc747d9 ]
+
+The system EID (SEID) is an internal EID used by SMC-D to represent the
+s390 physical machine that OS is executing on. On s390 architecture, it
+predefined by fixed string and part of cpuid and is enabled regardless
+of whether underlay device is virtual ISM or platform firmware ISM.
+
+However on non-s390 architectures where SMC-D can be used with virtual
+ISM devices, there is no similar information to identify physical
+machines, especially in virtualization scenarios. So in such cases, SEID
+is forcibly disabled and the user-defined UEID will be used to represent
+the communicable space.
+
+Signed-off-by: Wen Gu <guwen@linux.alibaba.com>
+Reviewed-and-tested-by: Wenjia Zhang <wenjia@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_clc.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
+index 9b8999e2afca..867df4522815 100644
+--- a/net/smc/smc_clc.c
++++ b/net/smc/smc_clc.c
+@@ -155,10 +155,12 @@ static int smc_clc_ueid_remove(char *ueid)
+ 			rc = 0;
+ 		}
+ 	}
++#if IS_ENABLED(CONFIG_S390)
+ 	if (!rc && !smc_clc_eid_table.ueid_cnt) {
+ 		smc_clc_eid_table.seid_enabled = 1;
+ 		rc = -EAGAIN;	/* indicate success and enabling of seid */
+ 	}
++#endif
+ 	write_unlock(&smc_clc_eid_table.lock);
+ 	return rc;
+ }
+@@ -273,22 +275,30 @@ int smc_nl_dump_seid(struct sk_buff *skb, struct netlink_callback *cb)
+ 
+ int smc_nl_enable_seid(struct sk_buff *skb, struct genl_info *info)
+ {
++#if IS_ENABLED(CONFIG_S390)
+ 	write_lock(&smc_clc_eid_table.lock);
+ 	smc_clc_eid_table.seid_enabled = 1;
+ 	write_unlock(&smc_clc_eid_table.lock);
+ 	return 0;
++#else
++	return -EOPNOTSUPP;
++#endif
+ }
+ 
+ int smc_nl_disable_seid(struct sk_buff *skb, struct genl_info *info)
+ {
+ 	int rc = 0;
+ 
++#if IS_ENABLED(CONFIG_S390)
+ 	write_lock(&smc_clc_eid_table.lock);
+ 	if (!smc_clc_eid_table.ueid_cnt)
+ 		rc = -ENOENT;
+ 	else
+ 		smc_clc_eid_table.seid_enabled = 0;
+ 	write_unlock(&smc_clc_eid_table.lock);
++#else
++	rc = -EOPNOTSUPP;
++#endif
+ 	return rc;
+ }
+ 
+@@ -1168,7 +1178,11 @@ void __init smc_clc_init(void)
+ 	INIT_LIST_HEAD(&smc_clc_eid_table.list);
+ 	rwlock_init(&smc_clc_eid_table.lock);
+ 	smc_clc_eid_table.ueid_cnt = 0;
++#if IS_ENABLED(CONFIG_S390)
+ 	smc_clc_eid_table.seid_enabled = 1;
++#else
++	smc_clc_eid_table.seid_enabled = 0;
++#endif
+ }
+ 
+ void smc_clc_exit(void)
+-- 
+2.43.0
+
diff --git a/queue-6.1/net-usb-ax88179_178a-avoid-two-consecutive-device-re.patch b/queue-6.1/net-usb-ax88179_178a-avoid-two-consecutive-device-re.patch
new file mode 100644
index 00000000000..47e7a829ff8
--- /dev/null
+++ b/queue-6.1/net-usb-ax88179_178a-avoid-two-consecutive-device-re.patch
@@ -0,0 +1,43 @@
+From 22027e58575b2714a5091679778c256919cb7068 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Nov 2023 13:11:41 +0100
+Subject: net: usb: ax88179_178a: avoid two consecutive device resets
+
+From: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
+
+[ Upstream commit d2689b6a86b9d23574bd4b654bf770b6034e2c7e ]
+
+The device is always reset two consecutive times (ax88179_reset is called
+twice), one from usbnet_probe during the device binding and the other from
+usbnet_open.
+
+Remove the non-necessary reset during the device binding and let the reset
+operation from open to keep the normal behavior (tested with generic ASIX
+Electronics Corp. AX88179 Gigabit Ethernet device).
+
+Reported-by: Herb Wei <weihao.bj@ieisystem.com>
+Tested-by: Herb Wei <weihao.bj@ieisystem.com>
+Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
+Link: https://lore.kernel.org/r/20231120121239.54504-1-jtornosm@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/ax88179_178a.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
+index 5a1bf42ce156..d837c1887416 100644
+--- a/drivers/net/usb/ax88179_178a.c
++++ b/drivers/net/usb/ax88179_178a.c
+@@ -1315,8 +1315,6 @@ static int ax88179_bind(struct usbnet *dev, struct usb_interface *intf)
+ 
+ 	netif_set_tso_max_size(dev->net, 16384);
+ 
+-	ax88179_reset(dev);
+-
+ 	return 0;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/octeontx2-af-fix-max-npc-mcam-entry-check-while-vali.patch b/queue-6.1/octeontx2-af-fix-max-npc-mcam-entry-check-while-vali.patch
new file mode 100644
index 00000000000..d201c3f3105
--- /dev/null
+++ b/queue-6.1/octeontx2-af-fix-max-npc-mcam-entry-check-while-vali.patch
@@ -0,0 +1,54 @@
+From b652136636fbd597ecaadf890f51a6ee14e4ddb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Jan 2024 20:20:42 +0530
+Subject: octeontx2-af: Fix max NPC MCAM entry check while validating ref_entry
+
+From: Suman Ghosh <sumang@marvell.com>
+
+[ Upstream commit 4ebb1f95e0c3c3e0eec5bb21aa43097580c4b6e4 ]
+
+As of today, the last MCAM entry was not getting allocated because of
+a <= check with the max_bmap count. This patch modifies that and if the
+requested entry is greater than the available entries then set it to the
+max value.
+
+Signed-off-by: Suman Ghosh <sumang@marvell.com>
+Link: https://lore.kernel.org/r/20240101145042.419697-1-sumang@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
+index 0bcf3e559280..3784347b6fd8 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
+@@ -2678,18 +2678,17 @@ int rvu_mbox_handler_npc_mcam_alloc_entry(struct rvu *rvu,
+ 	rsp->entry = NPC_MCAM_ENTRY_INVALID;
+ 	rsp->free_count = 0;
+ 
+-	/* Check if ref_entry is within range */
+-	if (req->priority && req->ref_entry >= mcam->bmap_entries) {
+-		dev_err(rvu->dev, "%s: reference entry %d is out of range\n",
+-			__func__, req->ref_entry);
+-		return NPC_MCAM_INVALID_REQ;
+-	}
++	/* Check if ref_entry is greater that the range
++	 * then set it to max value.
++	 */
++	if (req->ref_entry > mcam->bmap_entries)
++		req->ref_entry = mcam->bmap_entries;
+ 
+ 	/* ref_entry can't be '0' if requested priority is high.
+ 	 * Can't be last entry if requested priority is low.
+ 	 */
+ 	if ((!req->ref_entry && req->priority == NPC_MCAM_HIGHER_PRIO) ||
+-	    ((req->ref_entry == (mcam->bmap_entries - 1)) &&
++	    ((req->ref_entry == mcam->bmap_entries) &&
+ 	     req->priority == NPC_MCAM_LOWER_PRIO))
+ 		return NPC_MCAM_INVALID_REQ;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/pci-add-intel_hda_arl-to-pci_ids.h.patch b/queue-6.1/pci-add-intel_hda_arl-to-pci_ids.h.patch
new file mode 100644
index 00000000000..e081fd1deef
--- /dev/null
+++ b/queue-6.1/pci-add-intel_hda_arl-to-pci_ids.h.patch
@@ -0,0 +1,41 @@
+From 22bdffb575a688dbd64f1ae977c4c07e8c7af8fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 15:27:06 -0600
+Subject: PCI: add INTEL_HDA_ARL to pci_ids.h
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 5ec42bf04d72fd6d0a6855810cc779e0ee31dfd7 ]
+
+The PCI ID insertion follows the increasing order in the table, but
+this hardware follows MTL (MeteorLake).
+
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Acked-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20231204212710.185976-2-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/pci_ids.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index b76ff0850618..73cc1e7dd15a 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -3000,6 +3000,7 @@
+ #define PCI_DEVICE_ID_INTEL_82443GX_0	0x71a0
+ #define PCI_DEVICE_ID_INTEL_82443GX_2	0x71a2
+ #define PCI_DEVICE_ID_INTEL_82372FB_1	0x7601
++#define PCI_DEVICE_ID_INTEL_HDA_ARL	0x7728
+ #define PCI_DEVICE_ID_INTEL_SCH_LPC	0x8119
+ #define PCI_DEVICE_ID_INTEL_SCH_IDE	0x811a
+ #define PCI_DEVICE_ID_INTEL_E6XX_CU	0x8183
+-- 
+2.43.0
+
diff --git a/queue-6.1/pci-add-no-pm-reset-quirk-for-nvidia-spectrum-device.patch b/queue-6.1/pci-add-no-pm-reset-quirk-for-nvidia-spectrum-device.patch
new file mode 100644
index 00000000000..aff7ca3640c
--- /dev/null
+++ b/queue-6.1/pci-add-no-pm-reset-quirk-for-nvidia-spectrum-device.patch
@@ -0,0 +1,62 @@
+From aa4ca96a23422cb421846405d5ca02c1a06fc5a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Nov 2023 13:17:16 +0100
+Subject: PCI: Add no PM reset quirk for NVIDIA Spectrum devices
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit 3ed48c80b28d8dcd584d6ddaf00c75b7673e1a05 ]
+
+Spectrum-{1,2,3,4} devices report that a D3hot->D0 transition causes a
+reset (i.e., they advertise NoSoftRst-). However, this transition does
+not have any effect on the device: It continues to be operational and
+network ports remain up. Advertising this support makes it seem as if a
+PM reset is viable for these devices. Mark it as unavailable to skip it
+when testing reset methods.
+
+Before:
+
+ # cat /sys/bus/pci/devices/0000\:03\:00.0/reset_method
+ pm bus
+
+After:
+
+ # cat /sys/bus/pci/devices/0000\:03\:00.0/reset_method
+ bus
+
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 8765544bac35..030c8e665757 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3691,6 +3691,19 @@ static void quirk_no_pm_reset(struct pci_dev *dev)
+ DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_ATI, PCI_ANY_ID,
+ 			       PCI_CLASS_DISPLAY_VGA, 8, quirk_no_pm_reset);
+ 
++/*
++ * Spectrum-{1,2,3,4} devices report that a D3hot->D0 transition causes a reset
++ * (i.e., they advertise NoSoftRst-). However, this transition does not have
++ * any effect on the device: It continues to be operational and network ports
++ * remain up. Advertising this support makes it seem as if a PM reset is viable
++ * for these devices. Mark it as unavailable to skip it when testing reset
++ * methods.
++ */
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, 0xcb84, quirk_no_pm_reset);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, 0xcf6c, quirk_no_pm_reset);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, 0xcf70, quirk_no_pm_reset);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, 0xcf80, quirk_no_pm_reset);
++
+ /*
+  * Thunderbolt controllers with broken MSI hotplug signaling:
+  * Entire 1st generation (Light Ridge, Eagle Ridge, Light Peak) and part
+-- 
+2.43.0
+
diff --git a/queue-6.1/pci-aer-decode-requester-id-when-no-error-info-found.patch b/queue-6.1/pci-aer-decode-requester-id-when-no-error-info-found.patch
new file mode 100644
index 00000000000..b7929b79be3
--- /dev/null
+++ b/queue-6.1/pci-aer-decode-requester-id-when-no-error-info-found.patch
@@ -0,0 +1,69 @@
+From 6e02125ddaaf567b94d15203eace27ac50789f0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Dec 2023 16:42:30 -0600
+Subject: PCI/AER: Decode Requester ID when no error info found
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+[ Upstream commit 1291b716bbf969e101d517bfb8ba18d958f758b8 ]
+
+When a device with AER detects an error, it logs error information in its
+own AER Error Status registers.  It may send an Error Message to the Root
+Port (RCEC in the case of an RCiEP), which logs the fact that an Error
+Message was received (Root Error Status) and the Requester ID of the
+message source (Error Source Identification).
+
+aer_print_port_info() prints the Requester ID from the Root Port Error
+Source in the usual Linux "bb:dd.f" format, but when find_source_device()
+finds no error details in the hierarchy below the Root Port, it printed the
+raw Requester ID without decoding it.
+
+Decode the Requester ID in the usual Linux format so it matches other
+messages.
+
+Sample message changes:
+
+  - pcieport 0000:00:1c.5: AER: Correctable error received: 0000:00:1c.5
+  - pcieport 0000:00:1c.5: AER: can't find device of ID00e5
+  + pcieport 0000:00:1c.5: AER: Correctable error message received from 0000:00:1c.5
+  + pcieport 0000:00:1c.5: AER: found no error details for 0000:00:1c.5
+
+Link: https://lore.kernel.org/r/20231206224231.732765-3-helgaas@kernel.org
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/aer.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c
+index e2d8a74f83c3..5426f450ce91 100644
+--- a/drivers/pci/pcie/aer.c
++++ b/drivers/pci/pcie/aer.c
+@@ -748,7 +748,7 @@ static void aer_print_port_info(struct pci_dev *dev, struct aer_err_info *info)
+ 	u8 bus = info->id >> 8;
+ 	u8 devfn = info->id & 0xff;
+ 
+-	pci_info(dev, "%s%s error received: %04x:%02x:%02x.%d\n",
++	pci_info(dev, "%s%s error message received from %04x:%02x:%02x.%d\n",
+ 		 info->multi_error_valid ? "Multiple " : "",
+ 		 aer_error_severity_string[info->severity],
+ 		 pci_domain_nr(dev->bus), bus, PCI_SLOT(devfn),
+@@ -936,7 +936,12 @@ static bool find_source_device(struct pci_dev *parent,
+ 		pci_walk_bus(parent->subordinate, find_device_iter, e_info);
+ 
+ 	if (!e_info->error_dev_num) {
+-		pci_info(parent, "can't find device of ID%04x\n", e_info->id);
++		u8 bus = e_info->id >> 8;
++		u8 devfn = e_info->id & 0xff;
++
++		pci_info(parent, "found no error details for %04x:%02x:%02x.%d\n",
++			 pci_domain_nr(parent->bus), bus, PCI_SLOT(devfn),
++			 PCI_FUNC(devfn));
+ 		return false;
+ 	}
+ 	return true;
+-- 
+2.43.0
+
diff --git a/queue-6.1/pci-fix-64gt-s-effective-data-rate-calculation.patch b/queue-6.1/pci-fix-64gt-s-effective-data-rate-calculation.patch
new file mode 100644
index 00000000000..54db8752ada
--- /dev/null
+++ b/queue-6.1/pci-fix-64gt-s-effective-data-rate-calculation.patch
@@ -0,0 +1,40 @@
+From f42b536870ac7dea052f069deae4e1aab03c5928 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jan 2024 19:27:00 +0200
+Subject: PCI: Fix 64GT/s effective data rate calculation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit ac4f1897fa5433a1b07a625503a91b6aa9d7e643 ]
+
+Unlike the lower rates, the PCIe 64GT/s Data Rate uses 1b/1b encoding, not
+128b/130b (PCIe r6.1 sec 1.2, Table 1-1).  Correct the PCIE_SPEED2MBS_ENC()
+calculation to reflect that.
+
+Link: https://lore.kernel.org/r/20240102172701.65501-1-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
+index ed6d75d138c7..e1d02b7c6029 100644
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -274,7 +274,7 @@ void pci_bus_put(struct pci_bus *bus);
+ 
+ /* PCIe speed to Mb/s reduced by encoding overhead */
+ #define PCIE_SPEED2MBS_ENC(speed) \
+-	((speed) == PCIE_SPEED_64_0GT ? 64000*128/130 : \
++	((speed) == PCIE_SPEED_64_0GT ? 64000*1/1 : \
+ 	 (speed) == PCIE_SPEED_32_0GT ? 32000*128/130 : \
+ 	 (speed) == PCIE_SPEED_16_0GT ? 16000*128/130 : \
+ 	 (speed) == PCIE_SPEED_8_0GT  ?  8000*128/130 : \
+-- 
+2.43.0
+
diff --git a/queue-6.1/pci-only-override-amd-usb-controller-if-required.patch b/queue-6.1/pci-only-override-amd-usb-controller-if-required.patch
new file mode 100644
index 00000000000..e257f444773
--- /dev/null
+++ b/queue-6.1/pci-only-override-amd-usb-controller-if-required.patch
@@ -0,0 +1,55 @@
+From 0292608b45006d62e0976da9c78202317decfa91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Nov 2023 13:04:36 -0300
+Subject: PCI: Only override AMD USB controller if required
+
+From: Guilherme G. Piccoli <gpiccoli@igalia.com>
+
+[ Upstream commit e585a37e5061f6d5060517aed1ca4ccb2e56a34c ]
+
+By running a Van Gogh device (Steam Deck), the following message
+was noticed in the kernel log:
+
+  pci 0000:04:00.3: PCI class overridden (0x0c03fe -> 0x0c03fe) so dwc3 driver can claim this instead of xhci
+
+Effectively this means the quirk executed but changed nothing, since the
+class of this device was already the proper one (likely adjusted by newer
+firmware versions).
+
+Check and perform the override only if necessary.
+
+Link: https://lore.kernel.org/r/20231120160531.361552-1-gpiccoli@igalia.com
+Signed-off-by: Guilherme G. Piccoli <gpiccoli@igalia.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Huang Rui <ray.huang@amd.com>
+Cc: Vicki Pfau <vi@endrift.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 030c8e665757..51d634fbdfb8 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -607,10 +607,13 @@ static void quirk_amd_dwc_class(struct pci_dev *pdev)
+ {
+ 	u32 class = pdev->class;
+ 
+-	/* Use "USB Device (not host controller)" class */
+-	pdev->class = PCI_CLASS_SERIAL_USB_DEVICE;
+-	pci_info(pdev, "PCI class overridden (%#08x -> %#08x) so dwc3 driver can claim this instead of xhci\n",
+-		 class, pdev->class);
++	if (class != PCI_CLASS_SERIAL_USB_DEVICE) {
++		/* Use "USB Device (not host controller)" class */
++		pdev->class = PCI_CLASS_SERIAL_USB_DEVICE;
++		pci_info(pdev,
++			"PCI class overridden (%#08x -> %#08x) so dwc3 driver can claim this instead of xhci\n",
++			class, pdev->class);
++	}
+ }
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB,
+ 		quirk_amd_dwc_class);
+-- 
+2.43.0
+
diff --git a/queue-6.1/pci-switchtec-fix-stdev_release-crash-after-surprise.patch b/queue-6.1/pci-switchtec-fix-stdev_release-crash-after-surprise.patch
new file mode 100644
index 00000000000..6620b7c21bf
--- /dev/null
+++ b/queue-6.1/pci-switchtec-fix-stdev_release-crash-after-surprise.patch
@@ -0,0 +1,104 @@
+From c979716ecafadc0a2400e47ed84e8d762a4f4e4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Nov 2023 20:23:16 -0800
+Subject: PCI: switchtec: Fix stdev_release() crash after surprise hot remove
+
+From: Daniel Stodden <dns@arista.com>
+
+[ Upstream commit df25461119d987b8c81d232cfe4411e91dcabe66 ]
+
+A PCI device hot removal may occur while stdev->cdev is held open. The call
+to stdev_release() then happens during close or exit, at a point way past
+switchtec_pci_remove(). Otherwise the last ref would vanish with the
+trailing put_device(), just before return.
+
+At that later point in time, the devm cleanup has already removed the
+stdev->mmio_mrpc mapping. Also, the stdev->pdev reference was not a counted
+one. Therefore, in DMA mode, the iowrite32() in stdev_release() will cause
+a fatal page fault, and the subsequent dma_free_coherent(), if reached,
+would pass a stale &stdev->pdev->dev pointer.
+
+Fix by moving MRPC DMA shutdown into switchtec_pci_remove(), after
+stdev_kill(). Counting the stdev->pdev ref is now optional, but may prevent
+future accidents.
+
+Reproducible via the script at
+https://lore.kernel.org/r/20231113212150.96410-1-dns@arista.com
+
+Link: https://lore.kernel.org/r/20231122042316.91208-2-dns@arista.com
+Signed-off-by: Daniel Stodden <dns@arista.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Reviewed-by: Dmitry Safonov <dima@arista.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/switch/switchtec.c | 25 +++++++++++++++++--------
+ 1 file changed, 17 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
+index 0c1faa6c1973..3f3320d0a4f8 100644
+--- a/drivers/pci/switch/switchtec.c
++++ b/drivers/pci/switch/switchtec.c
+@@ -1308,13 +1308,6 @@ static void stdev_release(struct device *dev)
+ {
+ 	struct switchtec_dev *stdev = to_stdev(dev);
+ 
+-	if (stdev->dma_mrpc) {
+-		iowrite32(0, &stdev->mmio_mrpc->dma_en);
+-		flush_wc_buf(stdev);
+-		writeq(0, &stdev->mmio_mrpc->dma_addr);
+-		dma_free_coherent(&stdev->pdev->dev, sizeof(*stdev->dma_mrpc),
+-				stdev->dma_mrpc, stdev->dma_mrpc_dma_addr);
+-	}
+ 	kfree(stdev);
+ }
+ 
+@@ -1358,7 +1351,7 @@ static struct switchtec_dev *stdev_create(struct pci_dev *pdev)
+ 		return ERR_PTR(-ENOMEM);
+ 
+ 	stdev->alive = true;
+-	stdev->pdev = pdev;
++	stdev->pdev = pci_dev_get(pdev);
+ 	INIT_LIST_HEAD(&stdev->mrpc_queue);
+ 	mutex_init(&stdev->mrpc_mutex);
+ 	stdev->mrpc_busy = 0;
+@@ -1391,6 +1384,7 @@ static struct switchtec_dev *stdev_create(struct pci_dev *pdev)
+ 	return stdev;
+ 
+ err_put:
++	pci_dev_put(stdev->pdev);
+ 	put_device(&stdev->dev);
+ 	return ERR_PTR(rc);
+ }
+@@ -1646,6 +1640,18 @@ static int switchtec_init_pci(struct switchtec_dev *stdev,
+ 	return 0;
+ }
+ 
++static void switchtec_exit_pci(struct switchtec_dev *stdev)
++{
++	if (stdev->dma_mrpc) {
++		iowrite32(0, &stdev->mmio_mrpc->dma_en);
++		flush_wc_buf(stdev);
++		writeq(0, &stdev->mmio_mrpc->dma_addr);
++		dma_free_coherent(&stdev->pdev->dev, sizeof(*stdev->dma_mrpc),
++				  stdev->dma_mrpc, stdev->dma_mrpc_dma_addr);
++		stdev->dma_mrpc = NULL;
++	}
++}
++
+ static int switchtec_pci_probe(struct pci_dev *pdev,
+ 			       const struct pci_device_id *id)
+ {
+@@ -1705,6 +1711,9 @@ static void switchtec_pci_remove(struct pci_dev *pdev)
+ 	ida_free(&switchtec_minor_ida, MINOR(stdev->dev.devt));
+ 	dev_info(&stdev->dev, "unregistered.\n");
+ 	stdev_kill(stdev);
++	switchtec_exit_pci(stdev);
++	pci_dev_put(stdev->pdev);
++	stdev->pdev = NULL;
+ 	put_device(&stdev->dev);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/perf-core-fix-narrow-startup-race-when-creating-the-.patch b/queue-6.1/perf-core-fix-narrow-startup-race-when-creating-the-.patch
new file mode 100644
index 00000000000..6603109886e
--- /dev/null
+++ b/queue-6.1/perf-core-fix-narrow-startup-race-when-creating-the-.patch
@@ -0,0 +1,82 @@
+From 480d64aafa04d536b0a8b0f41fb754521df7c4dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jun 2023 15:09:09 +0200
+Subject: perf/core: Fix narrow startup race when creating the perf
+ nr_addr_filters sysfs file
+
+From: Greg KH <gregkh@linuxfoundation.org>
+
+[ Upstream commit 652ffc2104ec1f69dd4a46313888c33527145ccf ]
+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/2023061204-decal-flyable-6090@gregkh
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/core.c | 40 ++++++++++++++++++++++++++++------------
+ 1 file changed, 28 insertions(+), 12 deletions(-)
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 8c7d2f4f5fba..1e4841ebc22e 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -11223,9 +11223,32 @@ static DEVICE_ATTR_RW(perf_event_mux_interval_ms);
+ static struct attribute *pmu_dev_attrs[] = {
+ 	&dev_attr_type.attr,
+ 	&dev_attr_perf_event_mux_interval_ms.attr,
++	&dev_attr_nr_addr_filters.attr,
++	NULL,
++};
++
++static umode_t pmu_dev_is_visible(struct kobject *kobj, struct attribute *a, int n)
++{
++	struct device *dev = kobj_to_dev(kobj);
++	struct pmu *pmu = dev_get_drvdata(dev);
++
++	if (!pmu->nr_addr_filters)
++		return 0;
++
++	return a->mode;
++
++	return 0;
++}
++
++static struct attribute_group pmu_dev_attr_group = {
++	.is_visible = pmu_dev_is_visible,
++	.attrs = pmu_dev_attrs,
++};
++
++static const struct attribute_group *pmu_dev_groups[] = {
++	&pmu_dev_attr_group,
+ 	NULL,
+ };
+-ATTRIBUTE_GROUPS(pmu_dev);
+ 
+ static int pmu_bus_running;
+ static struct bus_type pmu_bus = {
+@@ -11261,18 +11284,11 @@ static int pmu_dev_alloc(struct pmu *pmu)
+ 	if (ret)
+ 		goto free_dev;
+ 
+-	/* For PMUs with address filters, throw in an extra attribute: */
+-	if (pmu->nr_addr_filters)
+-		ret = device_create_file(pmu->dev, &dev_attr_nr_addr_filters);
+-
+-	if (ret)
+-		goto del_dev;
+-
+-	if (pmu->attr_update)
++	if (pmu->attr_update) {
+ 		ret = sysfs_update_groups(&pmu->dev->kobj, pmu->attr_update);
+-
+-	if (ret)
+-		goto del_dev;
++		if (ret)
++			goto del_dev;
++	}
+ 
+ out:
+ 	return ret;
+-- 
+2.43.0
+
diff --git a/queue-6.1/perf-cs-etm-bump-minimum-opencsd-version-to-ensure-a.patch b/queue-6.1/perf-cs-etm-bump-minimum-opencsd-version-to-ensure-a.patch
new file mode 100644
index 00000000000..c045284c2da
--- /dev/null
+++ b/queue-6.1/perf-cs-etm-bump-minimum-opencsd-version-to-ensure-a.patch
@@ -0,0 +1,59 @@
+From 56d3fd36aa3032149321a5f615fcecf292cad343 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Sep 2023 14:37:15 +0100
+Subject: perf cs-etm: Bump minimum OpenCSD version to ensure a bugfix is
+ present
+
+From: James Clark <james.clark@arm.com>
+
+[ Upstream commit 2dbba30fd69b604802a9535b74bddb5bcca23793 ]
+
+Since commit d927ef5004ef ("perf cs-etm: Add exception level consistency
+check"), the exception that was added to Perf will be triggered unless
+the following bugfix from OpenCSD is present:
+
+ - _Version 1.2.1_:
+  - __Bugfix__:
+    ETM4x / ETE - output of context elements to client can in some
+    circumstances be delayed until after subsequent atoms have been
+    processed leading to incorrect memory decode access via the client
+    callbacks. Fixed to flush context elements immediately they are
+    committed.
+
+Rather than remove the assert and silently fail, just increase the
+minimum version requirement to avoid hard to debug issues and
+regressions.
+
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: James Clark <james.clark@arm.com>
+Tested-by: Leo Yan <leo.yan@linaro.org>
+Cc: John Garry <john.g.garry@oracle.com>
+Cc: Mike Leach <mike.leach@linaro.org>
+Cc: Will Deacon <will@kernel.org>
+Cc: linux-arm-kernel@lists.infradead.org
+Link: https://lore.kernel.org/r/20230901133716.677499-1-james.clark@arm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/build/feature/test-libopencsd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/build/feature/test-libopencsd.c b/tools/build/feature/test-libopencsd.c
+index eb6303ff446e..4cfcef9da3e4 100644
+--- a/tools/build/feature/test-libopencsd.c
++++ b/tools/build/feature/test-libopencsd.c
+@@ -4,9 +4,9 @@
+ /*
+  * Check OpenCSD library version is sufficient to provide required features
+  */
+-#define OCSD_MIN_VER ((1 << 16) | (1 << 8) | (1))
++#define OCSD_MIN_VER ((1 << 16) | (2 << 8) | (1))
+ #if !defined(OCSD_VER_NUM) || (OCSD_VER_NUM < OCSD_MIN_VER)
+-#error "OpenCSD >= 1.1.1 is required"
++#error "OpenCSD >= 1.2.1 is required"
+ #endif
+ 
+ int main(void)
+-- 
+2.43.0
+
diff --git a/queue-6.1/perf-fix-the-nr_addr_filters-fix.patch b/queue-6.1/perf-fix-the-nr_addr_filters-fix.patch
new file mode 100644
index 00000000000..736fd192c9c
--- /dev/null
+++ b/queue-6.1/perf-fix-the-nr_addr_filters-fix.patch
@@ -0,0 +1,50 @@
+From 76d3f40a333e533997d9dcc9591b41b3ed68feaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 11:07:56 +0100
+Subject: perf: Fix the nr_addr_filters fix
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 388a1fb7da6aaa1970c7e2a7d7fcd983a87a8484 ]
+
+Thomas reported that commit 652ffc2104ec ("perf/core: Fix narrow
+startup race when creating the perf nr_addr_filters sysfs file") made
+the entire attribute group vanish, instead of only the nr_addr_filters
+attribute.
+
+Additionally a stray return.
+
+Insufficient coffee was involved with both writing and merging the
+patch.
+
+Fixes: 652ffc2104ec ("perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file")
+Reported-by: Thomas Richter <tmricht@linux.ibm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Tested-by: Thomas Richter <tmricht@linux.ibm.com>
+Link: https://lkml.kernel.org/r/20231122100756.GP8262@noisy.programming.kicks-ass.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/core.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 1e4841ebc22e..872d149b1959 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -11232,12 +11232,10 @@ static umode_t pmu_dev_is_visible(struct kobject *kobj, struct attribute *a, int
+ 	struct device *dev = kobj_to_dev(kobj);
+ 	struct pmu *pmu = dev_get_drvdata(dev);
+ 
+-	if (!pmu->nr_addr_filters)
++	if (n == 2 && !pmu->nr_addr_filters)
+ 		return 0;
+ 
+ 	return a->mode;
+-
+-	return 0;
+ }
+ 
+ static struct attribute_group pmu_dev_attr_group = {
+-- 
+2.43.0
+
diff --git a/queue-6.1/pm-devfreq-synchronize-devfreq_monitor_-start-stop.patch b/queue-6.1/pm-devfreq-synchronize-devfreq_monitor_-start-stop.patch
new file mode 100644
index 00000000000..2d7e7f4dfd3
--- /dev/null
+++ b/queue-6.1/pm-devfreq-synchronize-devfreq_monitor_-start-stop.patch
@@ -0,0 +1,167 @@
+From 4d07047c2f1237937eb545aaeef1dc66b6855495 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Nov 2023 02:41:58 +0530
+Subject: PM / devfreq: Synchronize devfreq_monitor_[start/stop]
+
+From: Mukesh Ojha <quic_mojha@quicinc.com>
+
+[ Upstream commit aed5ed595960c6d301dcd4ed31aeaa7a8054c0c6 ]
+
+There is a chance if a frequent switch of the governor
+done in a loop result in timer list corruption where
+timer cancel being done from two place one from
+cancel_delayed_work_sync() and followed by expire_timers()
+can be seen from the traces[1].
+
+while true
+do
+        echo "simple_ondemand" > /sys/class/devfreq/1d84000.ufshc/governor
+        echo "performance" > /sys/class/devfreq/1d84000.ufshc/governor
+done
+
+It looks to be issue with devfreq driver where
+device_monitor_[start/stop] need to synchronized so that
+delayed work should get corrupted while it is either
+being queued or running or being cancelled.
+
+Let's use polling flag and devfreq lock to synchronize the
+queueing the timer instance twice and work data being
+corrupted.
+
+[1]
+...
+..
+<idle>-0    [003]   9436.209662:  timer_cancel   timer=0xffffff80444f0428
+<idle>-0    [003]   9436.209664:  timer_expire_entry   timer=0xffffff80444f0428  now=0x10022da1c  function=__typeid__ZTSFvP10timer_listE_global_addr  baseclk=0x10022da1c
+<idle>-0    [003]   9436.209718:  timer_expire_exit   timer=0xffffff80444f0428
+kworker/u16:6-14217    [003]   9436.209863:  timer_start   timer=0xffffff80444f0428  function=__typeid__ZTSFvP10timer_listE_global_addr  expires=0x10022da2b  now=0x10022da1c  flags=182452227
+vendor.xxxyyy.ha-1593    [004]   9436.209888:  timer_cancel   timer=0xffffff80444f0428
+vendor.xxxyyy.ha-1593    [004]   9436.216390:  timer_init   timer=0xffffff80444f0428
+vendor.xxxyyy.ha-1593    [004]   9436.216392:  timer_start   timer=0xffffff80444f0428  function=__typeid__ZTSFvP10timer_listE_global_addr  expires=0x10022da2c  now=0x10022da1d  flags=186646532
+vendor.xxxyyy.ha-1593    [005]   9436.220992:  timer_cancel   timer=0xffffff80444f0428
+xxxyyyTraceManag-7795    [004]   9436.261641:  timer_cancel   timer=0xffffff80444f0428
+
+[2]
+
+ 9436.261653][    C4] Unable to handle kernel paging request at virtual address dead00000000012a
+[ 9436.261664][    C4] Mem abort info:
+[ 9436.261666][    C4]   ESR = 0x96000044
+[ 9436.261669][    C4]   EC = 0x25: DABT (current EL), IL = 32 bits
+[ 9436.261671][    C4]   SET = 0, FnV = 0
+[ 9436.261673][    C4]   EA = 0, S1PTW = 0
+[ 9436.261675][    C4] Data abort info:
+[ 9436.261677][    C4]   ISV = 0, ISS = 0x00000044
+[ 9436.261680][    C4]   CM = 0, WnR = 1
+[ 9436.261682][    C4] [dead00000000012a] address between user and kernel address ranges
+[ 9436.261685][    C4] Internal error: Oops: 96000044 [#1] PREEMPT SMP
+[ 9436.261701][    C4] Skip md ftrace buffer dump for: 0x3a982d0
+...
+
+[ 9436.262138][    C4] CPU: 4 PID: 7795 Comm: TraceManag Tainted: G S      W  O      5.10.149-android12-9-o-g17f915d29d0c #1
+[ 9436.262141][    C4] Hardware name: Qualcomm Technologies, Inc.  (DT)
+[ 9436.262144][    C4] pstate: 22400085 (nzCv daIf +PAN -UAO +TCO BTYPE=--)
+[ 9436.262161][    C4] pc : expire_timers+0x9c/0x438
+[ 9436.262164][    C4] lr : expire_timers+0x2a4/0x438
+[ 9436.262168][    C4] sp : ffffffc010023dd0
+[ 9436.262171][    C4] x29: ffffffc010023df0 x28: ffffffd0636fdc18
+[ 9436.262178][    C4] x27: ffffffd063569dd0 x26: ffffffd063536008
+[ 9436.262182][    C4] x25: 0000000000000001 x24: ffffff88f7c69280
+[ 9436.262185][    C4] x23: 00000000000000e0 x22: dead000000000122
+[ 9436.262188][    C4] x21: 000000010022da29 x20: ffffff8af72b4e80
+[ 9436.262191][    C4] x19: ffffffc010023e50 x18: ffffffc010025038
+[ 9436.262195][    C4] x17: 0000000000000240 x16: 0000000000000201
+[ 9436.262199][    C4] x15: ffffffffffffffff x14: ffffff889f3c3100
+[ 9436.262203][    C4] x13: ffffff889f3c3100 x12: 00000000049f56b8
+[ 9436.262207][    C4] x11: 00000000049f56b8 x10: 00000000ffffffff
+[ 9436.262212][    C4] x9 : ffffffc010023e50 x8 : dead000000000122
+[ 9436.262216][    C4] x7 : ffffffffffffffff x6 : ffffffc0100239d8
+[ 9436.262220][    C4] x5 : 0000000000000000 x4 : 0000000000000101
+[ 9436.262223][    C4] x3 : 0000000000000080 x2 : ffffff889edc155c
+[ 9436.262227][    C4] x1 : ffffff8001005200 x0 : ffffff80444f0428
+[ 9436.262232][    C4] Call trace:
+[ 9436.262236][    C4]  expire_timers+0x9c/0x438
+[ 9436.262240][    C4]  __run_timers+0x1f0/0x330
+[ 9436.262245][    C4]  run_timer_softirq+0x28/0x58
+[ 9436.262255][    C4]  efi_header_end+0x168/0x5ec
+[ 9436.262265][    C4]  __irq_exit_rcu+0x108/0x124
+[ 9436.262274][    C4]  __handle_domain_irq+0x118/0x1e4
+[ 9436.262282][    C4]  gic_handle_irq.30369+0x6c/0x2bc
+[ 9436.262286][    C4]  el0_irq_naked+0x60/0x6c
+
+Link: https://lore.kernel.org/all/1700860318-4025-1-git-send-email-quic_mojha@quicinc.com/
+Reported-by: Joyyoung Huang <huangzaiyang@oppo.com>
+Acked-by: MyungJoo Ham <myungjoo.ham@samsung.com>
+Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/devfreq/devfreq.c | 24 ++++++++++++++++++++++--
+ 1 file changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
+index 2951a87ccb97..344e276165e4 100644
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -461,10 +461,14 @@ static void devfreq_monitor(struct work_struct *work)
+ 	if (err)
+ 		dev_err(&devfreq->dev, "dvfs failed with (%d) error\n", err);
+ 
++	if (devfreq->stop_polling)
++		goto out;
++
+ 	queue_delayed_work(devfreq_wq, &devfreq->work,
+ 				msecs_to_jiffies(devfreq->profile->polling_ms));
+-	mutex_unlock(&devfreq->lock);
+ 
++out:
++	mutex_unlock(&devfreq->lock);
+ 	trace_devfreq_monitor(devfreq);
+ }
+ 
+@@ -482,6 +486,10 @@ void devfreq_monitor_start(struct devfreq *devfreq)
+ 	if (IS_SUPPORTED_FLAG(devfreq->governor->flags, IRQ_DRIVEN))
+ 		return;
+ 
++	mutex_lock(&devfreq->lock);
++	if (delayed_work_pending(&devfreq->work))
++		goto out;
++
+ 	switch (devfreq->profile->timer) {
+ 	case DEVFREQ_TIMER_DEFERRABLE:
+ 		INIT_DEFERRABLE_WORK(&devfreq->work, devfreq_monitor);
+@@ -490,12 +498,16 @@ void devfreq_monitor_start(struct devfreq *devfreq)
+ 		INIT_DELAYED_WORK(&devfreq->work, devfreq_monitor);
+ 		break;
+ 	default:
+-		return;
++		goto out;
+ 	}
+ 
+ 	if (devfreq->profile->polling_ms)
+ 		queue_delayed_work(devfreq_wq, &devfreq->work,
+ 			msecs_to_jiffies(devfreq->profile->polling_ms));
++
++out:
++	devfreq->stop_polling = false;
++	mutex_unlock(&devfreq->lock);
+ }
+ EXPORT_SYMBOL(devfreq_monitor_start);
+ 
+@@ -512,6 +524,14 @@ void devfreq_monitor_stop(struct devfreq *devfreq)
+ 	if (IS_SUPPORTED_FLAG(devfreq->governor->flags, IRQ_DRIVEN))
+ 		return;
+ 
++	mutex_lock(&devfreq->lock);
++	if (devfreq->stop_polling) {
++		mutex_unlock(&devfreq->lock);
++		return;
++	}
++
++	devfreq->stop_polling = true;
++	mutex_unlock(&devfreq->lock);
+ 	cancel_delayed_work_sync(&devfreq->work);
+ }
+ EXPORT_SYMBOL(devfreq_monitor_stop);
+-- 
+2.43.0
+
diff --git a/queue-6.1/pnp-acpi-fix-fortify-warning.patch b/queue-6.1/pnp-acpi-fix-fortify-warning.patch
new file mode 100644
index 00000000000..ab34a481251
--- /dev/null
+++ b/queue-6.1/pnp-acpi-fix-fortify-warning.patch
@@ -0,0 +1,83 @@
+From cc00a81a44cb876d671aba15e52df12e511f4ca7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Nov 2023 05:52:10 +0300
+Subject: PNP: ACPI: fix fortify warning
+
+From: Dmitry Antipov <dmantipov@yandex.ru>
+
+[ Upstream commit ba3f5058db437d919f8468db50483dd9028ff688 ]
+
+When compiling with gcc version 14.0.0 20231126 (experimental)
+and CONFIG_FORTIFY_SOURCE=y, I've noticed the following:
+
+In file included from ./include/linux/string.h:295,
+                 from ./include/linux/bitmap.h:12,
+                 from ./include/linux/cpumask.h:12,
+                 from ./arch/x86/include/asm/paravirt.h:17,
+                 from ./arch/x86/include/asm/cpuid.h:62,
+                 from ./arch/x86/include/asm/processor.h:19,
+                 from ./arch/x86/include/asm/cpufeature.h:5,
+                 from ./arch/x86/include/asm/thread_info.h:53,
+                 from ./include/linux/thread_info.h:60,
+                 from ./arch/x86/include/asm/preempt.h:9,
+                 from ./include/linux/preempt.h:79,
+                 from ./include/linux/spinlock.h:56,
+                 from ./include/linux/mmzone.h:8,
+                 from ./include/linux/gfp.h:7,
+                 from ./include/linux/slab.h:16,
+                 from ./include/linux/resource_ext.h:11,
+                 from ./include/linux/acpi.h:13,
+                 from drivers/pnp/pnpacpi/rsparser.c:11:
+In function 'fortify_memcpy_chk',
+    inlined from 'pnpacpi_parse_allocated_vendor' at drivers/pnp/pnpacpi/rsparser.c:158:3,
+    inlined from 'pnpacpi_allocated_resource' at drivers/pnp/pnpacpi/rsparser.c:249:3:
+./include/linux/fortify-string.h:588:25: warning: call to '__read_overflow2_field'
+declared with attribute warning: detected read beyond size of field (2nd parameter);
+maybe use struct_group()? [-Wattribute-warning]
+  588 |                         __read_overflow2_field(q_size_field, size);
+      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+According to the comments in include/linux/fortify-string.h, 'memcpy()',
+'memmove()' and 'memset()' must not be used beyond individual struct
+members to ensure that the compiler can enforce protection against
+buffer overflows, and, IIUC, this also applies to partial copies from
+the particular member ('vendor->byte_data' in this case). So it should
+be better (and safer) to do both copies at once (and 'byte_data' of
+'struct acpi_resource_vendor_typed' seems to be a good candidate for
+'__counted_by(byte_length)' as well).
+
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pnp/pnpacpi/rsparser.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c
+index 4f05f610391b..c02ce0834c2c 100644
+--- a/drivers/pnp/pnpacpi/rsparser.c
++++ b/drivers/pnp/pnpacpi/rsparser.c
+@@ -151,13 +151,13 @@ static int vendor_resource_matches(struct pnp_dev *dev,
+ static void pnpacpi_parse_allocated_vendor(struct pnp_dev *dev,
+ 				    struct acpi_resource_vendor_typed *vendor)
+ {
+-	if (vendor_resource_matches(dev, vendor, &hp_ccsr_uuid, 16)) {
+-		u64 start, length;
++	struct { u64 start, length; } range;
+ 
+-		memcpy(&start, vendor->byte_data, sizeof(start));
+-		memcpy(&length, vendor->byte_data + 8, sizeof(length));
+-
+-		pnp_add_mem_resource(dev, start, start + length - 1, 0);
++	if (vendor_resource_matches(dev, vendor, &hp_ccsr_uuid,
++				    sizeof(range))) {
++		memcpy(&range, vendor->byte_data, sizeof(range));
++		pnp_add_mem_resource(dev, range.start, range.start +
++				     range.length - 1, 0);
+ 	}
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/powerpc-64s-fix-config_numa-n-build-due-to-create_se.patch b/queue-6.1/powerpc-64s-fix-config_numa-n-build-due-to-create_se.patch
new file mode 100644
index 00000000000..6047c08f389
--- /dev/null
+++ b/queue-6.1/powerpc-64s-fix-config_numa-n-build-due-to-create_se.patch
@@ -0,0 +1,65 @@
+From 308a84594fe73f08d0cbb1f8c5ad9de39e7cde55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 00:19:19 +1100
+Subject: powerpc/64s: Fix CONFIG_NUMA=n build due to create_section_mapping()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit ede66cd22441820cbd399936bf84fdc4294bc7fa ]
+
+With CONFIG_NUMA=n the build fails with:
+
+  arch/powerpc/mm/book3s64/pgtable.c:275:15: error: no previous prototype for ‘create_section_mapping’ [-Werror=missing-prototypes]
+  275 | int __meminit create_section_mapping(unsigned long start, unsigned long end,
+      |               ^~~~~~~~~~~~~~~~~~~~~~
+
+That happens because the prototype for create_section_mapping() is in
+asm/mmzone.h, but asm/mmzone.h is only included by linux/mmzone.h
+when CONFIG_NUMA=y.
+
+In fact the prototype is only needed by arch/powerpc/mm code, so move
+the prototype into arch/powerpc/mm/mmu_decl.h, which also fixes the
+build error.
+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231129131919.2528517-5-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/mmzone.h | 5 -----
+ arch/powerpc/mm/mmu_decl.h        | 5 +++++
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/mmzone.h b/arch/powerpc/include/asm/mmzone.h
+index 3764d3585d30..da827d2d0866 100644
+--- a/arch/powerpc/include/asm/mmzone.h
++++ b/arch/powerpc/include/asm/mmzone.h
+@@ -43,10 +43,5 @@ u64 memory_hotplug_max(void);
+ #define memory_hotplug_max() memblock_end_of_DRAM()
+ #endif /* CONFIG_NUMA */
+ 
+-#ifdef CONFIG_MEMORY_HOTPLUG
+-extern int create_section_mapping(unsigned long start, unsigned long end,
+-				  int nid, pgprot_t prot);
+-#endif
+-
+ #endif /* __KERNEL__ */
+ #endif /* _ASM_MMZONE_H_ */
+diff --git a/arch/powerpc/mm/mmu_decl.h b/arch/powerpc/mm/mmu_decl.h
+index bd9784f77f2e..71250605b784 100644
+--- a/arch/powerpc/mm/mmu_decl.h
++++ b/arch/powerpc/mm/mmu_decl.h
+@@ -179,3 +179,8 @@ static inline bool debug_pagealloc_enabled_or_kfence(void)
+ {
+ 	return IS_ENABLED(CONFIG_KFENCE) || debug_pagealloc_enabled();
+ }
++
++#ifdef CONFIG_MEMORY_HOTPLUG
++int create_section_mapping(unsigned long start, unsigned long end,
++			   int nid, pgprot_t prot);
++#endif
+-- 
+2.43.0
+
diff --git a/queue-6.1/powerpc-fix-build-error-due-to-is_valid_bugaddr.patch b/queue-6.1/powerpc-fix-build-error-due-to-is_valid_bugaddr.patch
new file mode 100644
index 00000000000..b9761319bb8
--- /dev/null
+++ b/queue-6.1/powerpc-fix-build-error-due-to-is_valid_bugaddr.patch
@@ -0,0 +1,48 @@
+From d4cdc9d0c5936968a868384f26ba85dc128c051d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 22:44:33 +1100
+Subject: powerpc: Fix build error due to is_valid_bugaddr()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit f8d3555355653848082c351fa90775214fb8a4fa ]
+
+With CONFIG_GENERIC_BUG=n the build fails with:
+
+  arch/powerpc/kernel/traps.c:1442:5: error: no previous prototype for ‘is_valid_bugaddr’ [-Werror=missing-prototypes]
+  1442 | int is_valid_bugaddr(unsigned long addr)
+       |     ^~~~~~~~~~~~~~~~
+
+The prototype is only defined, and the function is only needed, when
+CONFIG_GENERIC_BUG=y, so move the implementation under that.
+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231130114433.3053544-2-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/traps.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
+index 3956f32682c6..362b712386f6 100644
+--- a/arch/powerpc/kernel/traps.c
++++ b/arch/powerpc/kernel/traps.c
+@@ -1439,10 +1439,12 @@ static int emulate_instruction(struct pt_regs *regs)
+ 	return -EINVAL;
+ }
+ 
++#ifdef CONFIG_GENERIC_BUG
+ int is_valid_bugaddr(unsigned long addr)
+ {
+ 	return is_kernel_addr(addr);
+ }
++#endif
+ 
+ #ifdef CONFIG_MATH_EMULATION
+ static int emulate_math(struct pt_regs *regs)
+-- 
+2.43.0
+
diff --git a/queue-6.1/powerpc-lib-validate-size-for-vector-operations.patch b/queue-6.1/powerpc-lib-validate-size-for-vector-operations.patch
new file mode 100644
index 00000000000..a3f10354321
--- /dev/null
+++ b/queue-6.1/powerpc-lib-validate-size-for-vector-operations.patch
@@ -0,0 +1,71 @@
+From e544f47ce43972b390073885a47da798a93a3b63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Nov 2023 12:47:05 +0530
+Subject: powerpc/lib: Validate size for vector operations
+
+From: Naveen N Rao <naveen@kernel.org>
+
+[ Upstream commit 8f9abaa6d7de0a70fc68acaedce290c1f96e2e59 ]
+
+Some of the fp/vmx code in sstep.c assume a certain maximum size for the
+instructions being emulated. The size of those operations however is
+determined separately in analyse_instr().
+
+Add a check to validate the assumption on the maximum size of the
+operations, so as to prevent any unintended kernel stack corruption.
+
+Signed-off-by: Naveen N Rao <naveen@kernel.org>
+Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Build-tested-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231123071705.397625-1-naveen@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/lib/sstep.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
+index 398b5694aeb7..ec30af8eadb7 100644
+--- a/arch/powerpc/lib/sstep.c
++++ b/arch/powerpc/lib/sstep.c
+@@ -586,6 +586,8 @@ static int do_fp_load(struct instruction_op *op, unsigned long ea,
+ 	} u;
+ 
+ 	nb = GETSIZE(op->type);
++	if (nb > sizeof(u))
++		return -EINVAL;
+ 	if (!address_ok(regs, ea, nb))
+ 		return -EFAULT;
+ 	rn = op->reg;
+@@ -636,6 +638,8 @@ static int do_fp_store(struct instruction_op *op, unsigned long ea,
+ 	} u;
+ 
+ 	nb = GETSIZE(op->type);
++	if (nb > sizeof(u))
++		return -EINVAL;
+ 	if (!address_ok(regs, ea, nb))
+ 		return -EFAULT;
+ 	rn = op->reg;
+@@ -680,6 +684,9 @@ static nokprobe_inline int do_vec_load(int rn, unsigned long ea,
+ 		u8 b[sizeof(__vector128)];
+ 	} u = {};
+ 
++	if (size > sizeof(u))
++		return -EINVAL;
++
+ 	if (!address_ok(regs, ea & ~0xfUL, 16))
+ 		return -EFAULT;
+ 	/* align to multiple of size */
+@@ -707,6 +714,9 @@ static nokprobe_inline int do_vec_store(int rn, unsigned long ea,
+ 		u8 b[sizeof(__vector128)];
+ 	} u;
+ 
++	if (size > sizeof(u))
++		return -EINVAL;
++
+ 	if (!address_ok(regs, ea & ~0xfUL, 16))
+ 		return -EFAULT;
+ 	/* align to multiple of size */
+-- 
+2.43.0
+
diff --git a/queue-6.1/powerpc-mm-fix-build-failures-due-to-arch_reserved_k.patch b/queue-6.1/powerpc-mm-fix-build-failures-due-to-arch_reserved_k.patch
new file mode 100644
index 00000000000..a1616e27738
--- /dev/null
+++ b/queue-6.1/powerpc-mm-fix-build-failures-due-to-arch_reserved_k.patch
@@ -0,0 +1,68 @@
+From 148980c8bb66fe0ff0371f3d1cf2c61a1e44cc35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 22:44:32 +1100
+Subject: powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit d8c3f243d4db24675b653f0568bb65dae34e6455 ]
+
+With NUMA=n and FA_DUMP=y or PRESERVE_FA_DUMP=y the build fails with:
+
+  arch/powerpc/kernel/fadump.c:1739:22: error: no previous prototype for ‘arch_reserved_kernel_pages’ [-Werror=missing-prototypes]
+  1739 | unsigned long __init arch_reserved_kernel_pages(void)
+       |                      ^~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The prototype for arch_reserved_kernel_pages() is in include/linux/mm.h,
+but it's guarded by __HAVE_ARCH_RESERVED_KERNEL_PAGES. The powerpc
+headers define __HAVE_ARCH_RESERVED_KERNEL_PAGES in asm/mmzone.h, which
+is not included into the generic headers when NUMA=n.
+
+Move the definition of __HAVE_ARCH_RESERVED_KERNEL_PAGES into asm/mmu.h
+which is included regardless of NUMA=n.
+
+Additionally the ifdef around __HAVE_ARCH_RESERVED_KERNEL_PAGES needs to
+also check for CONFIG_PRESERVE_FA_DUMP.
+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231130114433.3053544-1-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/mmu.h    | 4 ++++
+ arch/powerpc/include/asm/mmzone.h | 3 ---
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/mmu.h b/arch/powerpc/include/asm/mmu.h
+index 94b981152667..07fabb054aea 100644
+--- a/arch/powerpc/include/asm/mmu.h
++++ b/arch/powerpc/include/asm/mmu.h
+@@ -417,5 +417,9 @@ extern void *abatron_pteptrs[2];
+ #include <asm/nohash/mmu.h>
+ #endif
+ 
++#if defined(CONFIG_FA_DUMP) || defined(CONFIG_PRESERVE_FA_DUMP)
++#define __HAVE_ARCH_RESERVED_KERNEL_PAGES
++#endif
++
+ #endif /* __KERNEL__ */
+ #endif /* _ASM_POWERPC_MMU_H_ */
+diff --git a/arch/powerpc/include/asm/mmzone.h b/arch/powerpc/include/asm/mmzone.h
+index 4c6c6dbd182f..3764d3585d30 100644
+--- a/arch/powerpc/include/asm/mmzone.h
++++ b/arch/powerpc/include/asm/mmzone.h
+@@ -42,9 +42,6 @@ u64 memory_hotplug_max(void);
+ #else
+ #define memory_hotplug_max() memblock_end_of_DRAM()
+ #endif /* CONFIG_NUMA */
+-#ifdef CONFIG_FA_DUMP
+-#define __HAVE_ARCH_RESERVED_KERNEL_PAGES
+-#endif
+ 
+ #ifdef CONFIG_MEMORY_HOTPLUG
+ extern int create_section_mapping(unsigned long start, unsigned long end,
+-- 
+2.43.0
+
diff --git a/queue-6.1/powerpc-mm-fix-null-pointer-dereference-in-pgtable_c.patch b/queue-6.1/powerpc-mm-fix-null-pointer-dereference-in-pgtable_c.patch
new file mode 100644
index 00000000000..8efb5b165a5
--- /dev/null
+++ b/queue-6.1/powerpc-mm-fix-null-pointer-dereference-in-pgtable_c.patch
@@ -0,0 +1,49 @@
+From eaa5cf46afa1aa415a9906d2c16845fdf2dd11e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 10:32:23 +0800
+Subject: powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
+
+From: Kunwu Chan <chentao@kylinos.cn>
+
+[ Upstream commit f46c8a75263f97bda13c739ba1c90aced0d3b071 ]
+
+kasprintf() returns a pointer to dynamically allocated memory
+which can be NULL upon failure. Ensure the allocation was successful
+by checking the pointer validity.
+
+Suggested-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Suggested-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231204023223.2447523-1-chentao@kylinos.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/init-common.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/mm/init-common.c b/arch/powerpc/mm/init-common.c
+index 119ef491f797..d3a7726ecf51 100644
+--- a/arch/powerpc/mm/init-common.c
++++ b/arch/powerpc/mm/init-common.c
+@@ -126,7 +126,7 @@ void pgtable_cache_add(unsigned int shift)
+ 	 * as to leave enough 0 bits in the address to contain it. */
+ 	unsigned long minalign = max(MAX_PGTABLE_INDEX_SIZE + 1,
+ 				     HUGEPD_SHIFT_MASK + 1);
+-	struct kmem_cache *new;
++	struct kmem_cache *new = NULL;
+ 
+ 	/* It would be nice if this was a BUILD_BUG_ON(), but at the
+ 	 * moment, gcc doesn't seem to recognize is_power_of_2 as a
+@@ -139,7 +139,8 @@ void pgtable_cache_add(unsigned int shift)
+ 
+ 	align = max_t(unsigned long, align, minalign);
+ 	name = kasprintf(GFP_KERNEL, "pgtable-2^%d", shift);
+-	new = kmem_cache_create(name, table_size, align, 0, ctor(shift));
++	if (name)
++		new = kmem_cache_create(name, table_size, align, 0, ctor(shift));
+ 	if (!new)
+ 		panic("Could not allocate pgtable cache for order %d", shift);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/powerpc-pmd_move_must_withdraw-is-only-needed-for-co.patch b/queue-6.1/powerpc-pmd_move_must_withdraw-is-only-needed-for-co.patch
new file mode 100644
index 00000000000..2176221cc50
--- /dev/null
+++ b/queue-6.1/powerpc-pmd_move_must_withdraw-is-only-needed-for-co.patch
@@ -0,0 +1,56 @@
+From 44b55c5e14da5d51cef786dccb9164d93a82b9ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Nov 2023 13:28:09 +1100
+Subject: powerpc: pmd_move_must_withdraw() is only needed for
+ CONFIG_TRANSPARENT_HUGEPAGE
+
+From: Stephen Rothwell <sfr@canb.auug.org.au>
+
+[ Upstream commit 0d555b57ee660d8a871781c0eebf006e855e918d ]
+
+The linux-next build of powerpc64 allnoconfig fails with:
+
+  arch/powerpc/mm/book3s64/pgtable.c:557:5: error: no previous prototype for 'pmd_move_must_withdraw'
+    557 | int pmd_move_must_withdraw(struct spinlock *new_pmd_ptl,
+        |     ^~~~~~~~~~~~~~~~~~~~~~
+
+Caused by commit:
+
+  c6345dfa6e3e ("Makefile.extrawarn: turn on missing-prototypes globally")
+
+Fix it by moving the function definition under
+CONFIG_TRANSPARENT_HUGEPAGE like the prototype. The function is only
+called when CONFIG_TRANSPARENT_HUGEPAGE=y.
+
+Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
+[mpe: Flesh out change log from linux-next patch]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231127132809.45c2b398@canb.auug.org.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/book3s64/pgtable.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/powerpc/mm/book3s64/pgtable.c b/arch/powerpc/mm/book3s64/pgtable.c
+index f6151a589298..87aa76c73799 100644
+--- a/arch/powerpc/mm/book3s64/pgtable.c
++++ b/arch/powerpc/mm/book3s64/pgtable.c
+@@ -463,6 +463,7 @@ void ptep_modify_prot_commit(struct vm_area_struct *vma, unsigned long addr,
+ 	set_pte_at(vma->vm_mm, addr, ptep, pte);
+ }
+ 
++#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+ /*
+  * For hash translation mode, we use the deposited table to store hash slot
+  * information and they are stored at PTRS_PER_PMD offset from related pmd
+@@ -484,6 +485,7 @@ int pmd_move_must_withdraw(struct spinlock *new_pmd_ptl,
+ 
+ 	return true;
+ }
++#endif
+ 
+ /*
+  * Does the CPU support tlbie?
+-- 
+2.43.0
+
diff --git a/queue-6.1/pstore-ram-fix-crash-when-setting-number-of-cpus-to-.patch b/queue-6.1/pstore-ram-fix-crash-when-setting-number-of-cpus-to-.patch
new file mode 100644
index 00000000000..f3f60007eca
--- /dev/null
+++ b/queue-6.1/pstore-ram-fix-crash-when-setting-number-of-cpus-to-.patch
@@ -0,0 +1,47 @@
+From 7daa041b533f70ea119b8a55e82a99fffdff64e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Feb 2023 10:36:32 +0800
+Subject: pstore/ram: Fix crash when setting number of cpus to an odd number
+
+From: Weichen Chen <weichen.chen@mediatek.com>
+
+[ Upstream commit d49270a04623ce3c0afddbf3e984cb245aa48e9c ]
+
+When the number of cpu cores is adjusted to 7 or other odd numbers,
+the zone size will become an odd number.
+The address of the zone will become:
+    addr of zone0 = BASE
+    addr of zone1 = BASE + zone_size
+    addr of zone2 = BASE + zone_size*2
+    ...
+The address of zone1/3/5/7 will be mapped to non-alignment va.
+Eventually crashes will occur when accessing these va.
+
+So, use ALIGN_DOWN() to make sure the zone size is even
+to avoid this bug.
+
+Signed-off-by: Weichen Chen <weichen.chen@mediatek.com>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Tested-by: "Guilherme G. Piccoli" <gpiccoli@igalia.com>
+Link: https://lore.kernel.org/r/20230224023632.6840-1-weichen.chen@mediatek.com
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pstore/ram.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
+index f3fa3625d772..e15b4631364a 100644
+--- a/fs/pstore/ram.c
++++ b/fs/pstore/ram.c
+@@ -519,6 +519,7 @@ static int ramoops_init_przs(const char *name,
+ 	}
+ 
+ 	zone_sz = mem_sz / *cnt;
++	zone_sz = ALIGN_DOWN(zone_sz, 2);
+ 	if (!zone_sz) {
+ 		dev_err(dev, "%s zone size == 0\n", name);
+ 		goto fail;
+-- 
+2.43.0
+
diff --git a/queue-6.1/rdma-ipoib-fix-error-code-return-in-ipoib_mcast_join.patch b/queue-6.1/rdma-ipoib-fix-error-code-return-in-ipoib_mcast_join.patch
new file mode 100644
index 00000000000..f45a6791180
--- /dev/null
+++ b/queue-6.1/rdma-ipoib-fix-error-code-return-in-ipoib_mcast_join.patch
@@ -0,0 +1,34 @@
+From b9301da3598c75d1076d6f690db2ffaa9ce1de4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Nov 2023 14:03:15 +0100
+Subject: RDMA/IPoIB: Fix error code return in ipoib_mcast_join
+
+From: Jack Wang <jinpu.wang@ionos.com>
+
+[ Upstream commit 753fff78f430704548f45eda52d6d55371a52c0f ]
+
+Return the error code in case of ib_sa_join_multicast fail.
+
+Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
+Link: https://lore.kernel.org/r/20231121130316.126364-2-jinpu.wang@ionos.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+index 5b3154503bf4..9e6967a40042 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+@@ -546,6 +546,7 @@ static int ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast)
+ 		spin_unlock_irq(&priv->lock);
+ 		complete(&mcast->done);
+ 		spin_lock_irq(&priv->lock);
++		return ret;
+ 	}
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/regulator-core-only-increment-use_count-when-enable_.patch b/queue-6.1/regulator-core-only-increment-use_count-when-enable_.patch
new file mode 100644
index 00000000000..718644757d6
--- /dev/null
+++ b/queue-6.1/regulator-core-only-increment-use_count-when-enable_.patch
@@ -0,0 +1,113 @@
+From 45b8a4a05896a2fe78d73735aa4646f78b86faa9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Nov 2023 15:42:31 +0800
+Subject: regulator: core: Only increment use_count when enable_count changes
+
+From: Rui Zhang <zr.zhang@vivo.com>
+
+[ Upstream commit 7993d3a9c34f609c02171e115fd12c10e2105ff4 ]
+
+The use_count of a regulator should only be incremented when the
+enable_count changes from 0 to 1. Similarly, the use_count should
+only be decremented when the enable_count changes from 1 to 0.
+
+In the previous implementation, use_count was sometimes decremented
+to 0 when some consumer called unbalanced disable,
+leading to unexpected disable even the regulator is enabled by
+other consumers. With this change, the use_count accurately reflects
+the number of users which the regulator is enabled.
+
+This should make things more robust in the case where a consumer does
+leak references.
+
+Signed-off-by: Rui Zhang <zr.zhang@vivo.com>
+Link: https://lore.kernel.org/r/20231103074231.8031-1-zr.zhang@vivo.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 56 +++++++++++++++++++++-------------------
+ 1 file changed, 30 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 34d3d8281906..c8702011b761 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -2925,7 +2925,8 @@ static int _regulator_enable(struct regulator *regulator)
+ 		/* Fallthrough on positive return values - already enabled */
+ 	}
+ 
+-	rdev->use_count++;
++	if (regulator->enable_count == 1)
++		rdev->use_count++;
+ 
+ 	return 0;
+ 
+@@ -3000,37 +3001,40 @@ static int _regulator_disable(struct regulator *regulator)
+ 
+ 	lockdep_assert_held_once(&rdev->mutex.base);
+ 
+-	if (WARN(rdev->use_count <= 0,
++	if (WARN(regulator->enable_count == 0,
+ 		 "unbalanced disables for %s\n", rdev_get_name(rdev)))
+ 		return -EIO;
+ 
+-	/* are we the last user and permitted to disable ? */
+-	if (rdev->use_count == 1 &&
+-	    (rdev->constraints && !rdev->constraints->always_on)) {
+-
+-		/* we are last user */
+-		if (regulator_ops_is_valid(rdev, REGULATOR_CHANGE_STATUS)) {
+-			ret = _notifier_call_chain(rdev,
+-						   REGULATOR_EVENT_PRE_DISABLE,
+-						   NULL);
+-			if (ret & NOTIFY_STOP_MASK)
+-				return -EINVAL;
+-
+-			ret = _regulator_do_disable(rdev);
+-			if (ret < 0) {
+-				rdev_err(rdev, "failed to disable: %pe\n", ERR_PTR(ret));
+-				_notifier_call_chain(rdev,
+-						REGULATOR_EVENT_ABORT_DISABLE,
++	if (regulator->enable_count == 1) {
++	/* disabling last enable_count from this regulator */
++		/* are we the last user and permitted to disable ? */
++		if (rdev->use_count == 1 &&
++		    (rdev->constraints && !rdev->constraints->always_on)) {
++
++			/* we are last user */
++			if (regulator_ops_is_valid(rdev, REGULATOR_CHANGE_STATUS)) {
++				ret = _notifier_call_chain(rdev,
++							   REGULATOR_EVENT_PRE_DISABLE,
++							   NULL);
++				if (ret & NOTIFY_STOP_MASK)
++					return -EINVAL;
++
++				ret = _regulator_do_disable(rdev);
++				if (ret < 0) {
++					rdev_err(rdev, "failed to disable: %pe\n", ERR_PTR(ret));
++					_notifier_call_chain(rdev,
++							REGULATOR_EVENT_ABORT_DISABLE,
++							NULL);
++					return ret;
++				}
++				_notifier_call_chain(rdev, REGULATOR_EVENT_DISABLE,
+ 						NULL);
+-				return ret;
+ 			}
+-			_notifier_call_chain(rdev, REGULATOR_EVENT_DISABLE,
+-					NULL);
+-		}
+ 
+-		rdev->use_count = 0;
+-	} else if (rdev->use_count > 1) {
+-		rdev->use_count--;
++			rdev->use_count = 0;
++		} else if (rdev->use_count > 1) {
++			rdev->use_count--;
++		}
+ 	}
+ 
+ 	if (ret == 0)
+-- 
+2.43.0
+
diff --git a/queue-6.1/rxrpc_find_service_conn_rcu-fix-the-usage-of-read_se.patch b/queue-6.1/rxrpc_find_service_conn_rcu-fix-the-usage-of-read_se.patch
new file mode 100644
index 00000000000..32f5cb6c175
--- /dev/null
+++ b/queue-6.1/rxrpc_find_service_conn_rcu-fix-the-usage-of-read_se.patch
@@ -0,0 +1,46 @@
+From 8c05e7a88cd5cd8a3ebf621e89b928b6e283c834 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Nov 2023 17:48:46 +0100
+Subject: rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+[ Upstream commit bad1a11c0f061aa073bab785389fe04f19ba02e1 ]
+
+rxrpc_find_service_conn_rcu() should make the "seq" counter odd on the
+second pass, otherwise read_seqbegin_or_lock() never takes the lock.
+
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+Link: https://lore.kernel.org/r/20231117164846.GA10410@redhat.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rxrpc/conn_service.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/rxrpc/conn_service.c b/net/rxrpc/conn_service.c
+index 6e6aa02c6f9e..249353417a18 100644
+--- a/net/rxrpc/conn_service.c
++++ b/net/rxrpc/conn_service.c
+@@ -31,7 +31,7 @@ struct rxrpc_connection *rxrpc_find_service_conn_rcu(struct rxrpc_peer *peer,
+ 	struct rxrpc_conn_proto k;
+ 	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
+ 	struct rb_node *p;
+-	unsigned int seq = 0;
++	unsigned int seq = 1;
+ 
+ 	k.epoch	= sp->hdr.epoch;
+ 	k.cid	= sp->hdr.cid & RXRPC_CIDMASK;
+@@ -41,6 +41,7 @@ struct rxrpc_connection *rxrpc_find_service_conn_rcu(struct rxrpc_peer *peer,
+ 		 * under just the RCU read lock, so we have to check for
+ 		 * changes.
+ 		 */
++		seq++; /* 2 on the 1st/lockless path, otherwise odd */
+ 		read_seqbegin_or_lock(&peer->service_conn_lock, &seq);
+ 
+ 		p = rcu_dereference_raw(peer->service_conns.rb_node);
+-- 
+2.43.0
+
diff --git a/queue-6.1/s390-ptrace-handle-setting-of-fpc-register-correctly.patch b/queue-6.1/s390-ptrace-handle-setting-of-fpc-register-correctly.patch
new file mode 100644
index 00000000000..7dd774026ee
--- /dev/null
+++ b/queue-6.1/s390-ptrace-handle-setting-of-fpc-register-correctly.patch
@@ -0,0 +1,71 @@
+From 7451d1521aac85d5117d4d1457a6391d772923fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 18:55:59 +0100
+Subject: s390/ptrace: handle setting of fpc register correctly
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+[ Upstream commit 8b13601d19c541158a6e18b278c00ba69ae37829 ]
+
+If the content of the floating point control (fpc) register of a traced
+process is modified with the ptrace interface the new value is tested for
+validity by temporarily loading it into the fpc register.
+
+This may lead to corruption of the fpc register of the tracing process:
+if an interrupt happens while the value is temporarily loaded into the
+fpc register, and within interrupt context floating point or vector
+registers are used, the current fp/vx registers are saved with
+save_fpu_regs() assuming they belong to user space and will be loaded into
+fp/vx registers when returning to user space.
+
+test_fp_ctl() restores the original user space fpc register value, however
+it will be discarded, when returning to user space.
+
+In result the tracer will incorrectly continue to run with the value that
+was supposed to be used for the traced process.
+
+Fix this by saving fpu register contents with save_fpu_regs() before using
+test_fp_ctl().
+
+Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/ptrace.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
+index 092b16b4dd4f..6b442edb3857 100644
+--- a/arch/s390/kernel/ptrace.c
++++ b/arch/s390/kernel/ptrace.c
+@@ -385,6 +385,7 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data)
+ 		/*
+ 		 * floating point control reg. is in the thread structure
+ 		 */
++		save_fpu_regs();
+ 		if ((unsigned int) data != 0 ||
+ 		    test_fp_ctl(data >> (BITS_PER_LONG - 32)))
+ 			return -EINVAL;
+@@ -741,6 +742,7 @@ static int __poke_user_compat(struct task_struct *child,
+ 		/*
+ 		 * floating point control reg. is in the thread structure
+ 		 */
++		save_fpu_regs();
+ 		if (test_fp_ctl(tmp))
+ 			return -EINVAL;
+ 		child->thread.fpu.fpc = data;
+@@ -904,9 +906,7 @@ static int s390_fpregs_set(struct task_struct *target,
+ 	int rc = 0;
+ 	freg_t fprs[__NUM_FPRS];
+ 
+-	if (target == current)
+-		save_fpu_regs();
+-
++	save_fpu_regs();
+ 	if (MACHINE_HAS_VX)
+ 		convert_vx_to_fp(fprs, target->thread.fpu.vxrs);
+ 	else
+-- 
+2.43.0
+
diff --git a/queue-6.1/s390-vfio-ap-fix-sysfs-status-attribute-for-ap-queue.patch b/queue-6.1/s390-vfio-ap-fix-sysfs-status-attribute-for-ap-queue.patch
new file mode 100644
index 00000000000..b16bc43140f
--- /dev/null
+++ b/queue-6.1/s390-vfio-ap-fix-sysfs-status-attribute-for-ap-queue.patch
@@ -0,0 +1,95 @@
+From a3abc4b1dc39a86175428ec10a1cf0b97e631010 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Nov 2023 15:11:30 -0500
+Subject: s390/vfio-ap: fix sysfs status attribute for AP queue devices
+
+From: Tony Krowiak <akrowiak@linux.ibm.com>
+
+[ Upstream commit a0d8f4eeb7c4ffaee21702bcc91a09b3988c5b7a ]
+
+The 'status' attribute for AP queue devices bound to the vfio_ap device
+driver displays incorrect status when the mediated device is attached to a
+guest, but the queue device is not passed through. In the current
+implementation, the status displayed is 'in_use' which is not correct; it
+should be 'assigned'. This can happen if one of the queue devices
+associated with a given adapter is not bound to the vfio_ap device driver.
+For example:
+
+Queues listed in /sys/bus/ap/drivers/vfio_ap:
+14.0005
+14.0006
+14.000d
+16.0006
+16.000d
+
+Queues listed in /sys/devices/vfio_ap/matrix/$UUID/matrix
+14.0005
+14.0006
+14.000d
+16.0005
+16.0006
+16.000d
+
+Queues listed in /sys/devices/vfio_ap/matrix/$UUID/guest_matrix
+14.0005
+14.0006
+14.000d
+
+The reason no queues for adapter 0x16 are listed in the guest_matrix is
+because queue 16.0005 is not bound to the vfio_ap device driver, so no
+queue associated with the adapter is passed through to the guest;
+therefore, each queue device for adapter 0x16 should display 'assigned'
+instead of 'in_use', because those queues are not in use by a guest, but
+only assigned to the mediated device.
+
+Let's check the AP configuration for the guest to determine whether a
+queue device is passed through before displaying a status of 'in_use'.
+
+Signed-off-by: Tony Krowiak <akrowiak@linux.ibm.com>
+Acked-by: Halil Pasic <pasic@linux.ibm.com>
+Acked-by: Harald Freudenberger <freude@linux.ibm.com>
+Link: https://lore.kernel.org/r/20231108201135.351419-1-akrowiak@linux.ibm.com
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/crypto/vfio_ap_ops.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c
+index 0659aa2863ab..86a8bd532489 100644
+--- a/drivers/s390/crypto/vfio_ap_ops.c
++++ b/drivers/s390/crypto/vfio_ap_ops.c
+@@ -1742,6 +1742,7 @@ static ssize_t status_show(struct device *dev,
+ {
+ 	ssize_t nchars = 0;
+ 	struct vfio_ap_queue *q;
++	unsigned long apid, apqi;
+ 	struct ap_matrix_mdev *matrix_mdev;
+ 	struct ap_device *apdev = to_ap_dev(dev);
+ 
+@@ -1749,8 +1750,21 @@ static ssize_t status_show(struct device *dev,
+ 	q = dev_get_drvdata(&apdev->device);
+ 	matrix_mdev = vfio_ap_mdev_for_queue(q);
+ 
++	/* If the queue is assigned to the matrix mediated device, then
++	 * determine whether it is passed through to a guest; otherwise,
++	 * indicate that it is unassigned.
++	 */
+ 	if (matrix_mdev) {
+-		if (matrix_mdev->kvm)
++		apid = AP_QID_CARD(q->apqn);
++		apqi = AP_QID_QUEUE(q->apqn);
++		/*
++		 * If the queue is passed through to the guest, then indicate
++		 * that it is in use; otherwise, indicate that it is
++		 * merely assigned to a matrix mediated device.
++		 */
++		if (matrix_mdev->kvm &&
++		    test_bit_inv(apid, matrix_mdev->shadow_apcb.apm) &&
++		    test_bit_inv(apqi, matrix_mdev->shadow_apcb.aqm))
+ 			nchars = scnprintf(buf, PAGE_SIZE, "%s\n",
+ 					   AP_QUEUE_IN_USE);
+ 		else
+-- 
+2.43.0
+
diff --git a/queue-6.1/scsi-arcmsr-support-new-pci-device-ids-1883-and-1886.patch b/queue-6.1/scsi-arcmsr-support-new-pci-device-ids-1883-and-1886.patch
new file mode 100644
index 00000000000..f9456ae552b
--- /dev/null
+++ b/queue-6.1/scsi-arcmsr-support-new-pci-device-ids-1883-and-1886.patch
@@ -0,0 +1,70 @@
+From 83bf48f4ff33e9f643fe54a4048b72cc6d1f9ad5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Oct 2023 17:50:27 +0800
+Subject: scsi: arcmsr: Support new PCI device IDs 1883 and 1886
+
+From: ching Huang <ching2048@areca.com.tw>
+
+[ Upstream commit 41c8a1a1e90fa4721f856bf3cf71211fd16d6434 ]
+
+Add support for Areca RAID controllers with PCI device IDs 1883 and 1886.
+
+Signed-off-by: ching Huang <ching2048@areca.com.tw>
+Link: https://lore.kernel.org/r/7732e743eaad57681b1552eec9c6a86c76dbe459.camel@areca.com.tw
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/arcmsr/arcmsr.h     | 4 ++++
+ drivers/scsi/arcmsr/arcmsr_hba.c | 6 ++++++
+ 2 files changed, 10 insertions(+)
+
+diff --git a/drivers/scsi/arcmsr/arcmsr.h b/drivers/scsi/arcmsr/arcmsr.h
+index 07df255c4b1b..b513d4d9c35a 100644
+--- a/drivers/scsi/arcmsr/arcmsr.h
++++ b/drivers/scsi/arcmsr/arcmsr.h
+@@ -77,9 +77,13 @@ struct device_attribute;
+ #ifndef PCI_DEVICE_ID_ARECA_1203
+ #define PCI_DEVICE_ID_ARECA_1203	0x1203
+ #endif
++#ifndef PCI_DEVICE_ID_ARECA_1883
++#define PCI_DEVICE_ID_ARECA_1883	0x1883
++#endif
+ #ifndef PCI_DEVICE_ID_ARECA_1884
+ #define PCI_DEVICE_ID_ARECA_1884	0x1884
+ #endif
++#define PCI_DEVICE_ID_ARECA_1886_0	0x1886
+ #define PCI_DEVICE_ID_ARECA_1886	0x188A
+ #define	ARCMSR_HOURS			(1000 * 60 * 60 * 4)
+ #define	ARCMSR_MINUTES			(1000 * 60 * 60)
+diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
+index d3fb8a9c1c39..fc9d4005830b 100644
+--- a/drivers/scsi/arcmsr/arcmsr_hba.c
++++ b/drivers/scsi/arcmsr/arcmsr_hba.c
+@@ -214,8 +214,12 @@ static struct pci_device_id arcmsr_device_id_table[] = {
+ 		.driver_data = ACB_ADAPTER_TYPE_A},
+ 	{PCI_DEVICE(PCI_VENDOR_ID_ARECA, PCI_DEVICE_ID_ARECA_1880),
+ 		.driver_data = ACB_ADAPTER_TYPE_C},
++	{PCI_DEVICE(PCI_VENDOR_ID_ARECA, PCI_DEVICE_ID_ARECA_1883),
++		.driver_data = ACB_ADAPTER_TYPE_C},
+ 	{PCI_DEVICE(PCI_VENDOR_ID_ARECA, PCI_DEVICE_ID_ARECA_1884),
+ 		.driver_data = ACB_ADAPTER_TYPE_E},
++	{PCI_DEVICE(PCI_VENDOR_ID_ARECA, PCI_DEVICE_ID_ARECA_1886_0),
++		.driver_data = ACB_ADAPTER_TYPE_F},
+ 	{PCI_DEVICE(PCI_VENDOR_ID_ARECA, PCI_DEVICE_ID_ARECA_1886),
+ 		.driver_data = ACB_ADAPTER_TYPE_F},
+ 	{0, 0}, /* Terminating entry */
+@@ -4708,9 +4712,11 @@ static const char *arcmsr_info(struct Scsi_Host *host)
+ 	case PCI_DEVICE_ID_ARECA_1680:
+ 	case PCI_DEVICE_ID_ARECA_1681:
+ 	case PCI_DEVICE_ID_ARECA_1880:
++	case PCI_DEVICE_ID_ARECA_1883:
+ 	case PCI_DEVICE_ID_ARECA_1884:
+ 		type = "SAS/SATA";
+ 		break;
++	case PCI_DEVICE_ID_ARECA_1886_0:
+ 	case PCI_DEVICE_ID_ARECA_1886:
+ 		type = "NVMe/SAS/SATA";
+ 		break;
+-- 
+2.43.0
+
diff --git a/queue-6.1/scsi-hisi_sas-set-.phy_attached-before-notifing-phyu.patch b/queue-6.1/scsi-hisi_sas-set-.phy_attached-before-notifing-phyu.patch
new file mode 100644
index 00000000000..02e2f9fd7bd
--- /dev/null
+++ b/queue-6.1/scsi-hisi_sas-set-.phy_attached-before-notifing-phyu.patch
@@ -0,0 +1,57 @@
+From 384c38bd4cb044b127ea3be34797694dd3451e18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 11:45:12 +0800
+Subject: scsi: hisi_sas: Set .phy_attached before notifing phyup event
+ HISI_PHYE_PHY_UP_PM
+
+From: Yihang Li <liyihang9@huawei.com>
+
+[ Upstream commit ce26497c745d0541aec930d5211b431a1c26af97 ]
+
+Currently in directly attached scenario, the phyup event
+HISI_PHYE_PHY_UP_PM is notified before .phy_attached is set - this may
+cause the phyup work hisi_sas_bytes_dmaed() execution failed and the
+attached device will not be found.
+
+To fix it, set .phy_attached before notifing phyup event.
+
+Signed-off-by: Yihang Li <liyihang9@huawei.com>
+Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
+Link: https://lore.kernel.org/r/1702525516-51258-2-git-send-email-chenxiang66@hisilicon.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index 0c80ff9affa3..7ae56a2fe232 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -1565,6 +1565,11 @@ static irqreturn_t phy_up_v3_hw(int phy_no, struct hisi_hba *hisi_hba)
+ 	}
+ 
+ 	phy->port_id = port_id;
++	spin_lock(&phy->lock);
++	/* Delete timer and set phy_attached atomically */
++	del_timer(&phy->timer);
++	phy->phy_attached = 1;
++	spin_unlock(&phy->lock);
+ 
+ 	/*
+ 	 * Call pm_runtime_get_noresume() which pairs with
+@@ -1578,11 +1583,6 @@ static irqreturn_t phy_up_v3_hw(int phy_no, struct hisi_hba *hisi_hba)
+ 
+ 	res = IRQ_HANDLED;
+ 
+-	spin_lock(&phy->lock);
+-	/* Delete timer and set phy_attached atomically */
+-	del_timer(&phy->timer);
+-	phy->phy_attached = 1;
+-	spin_unlock(&phy->lock);
+ end:
+ 	if (phy->reset_completion)
+ 		complete(phy->reset_completion);
+-- 
+2.43.0
+
diff --git a/queue-6.1/scsi-libfc-don-t-schedule-abort-twice.patch b/queue-6.1/scsi-libfc-don-t-schedule-abort-twice.patch
new file mode 100644
index 00000000000..e18f5952be5
--- /dev/null
+++ b/queue-6.1/scsi-libfc-don-t-schedule-abort-twice.patch
@@ -0,0 +1,68 @@
+From 882cfe0af8cc8441022a43271a3deb1cb871e191 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 17:58:30 +0100
+Subject: scsi: libfc: Don't schedule abort twice
+
+From: Hannes Reinecke <hare@suse.de>
+
+[ Upstream commit b57c4db5d23b9df0118a25e2441c9288edd73710 ]
+
+The current FC error recovery is sending up to three REC (recovery) frames
+in 10 second intervals, and as a final step sending an ABTS after 30
+seconds for the command itself.  Unfortunately sending an ABTS is also the
+action for the SCSI abort handler, and the default timeout for SCSI
+commands is also 30 seconds. This causes two ABTS to be scheduled, with the
+libfc one slightly earlier. The ABTS scheduled by SCSI EH then sees the
+command to be already aborted, and will always return with a 'GOOD' status
+irrespective on the actual result from the first ABTS.  This causes the
+SCSI EH abort handler to always succeed, and SCSI EH never to be engaged.
+Fix this by not issuing an ABTS when a SCSI command is present for the
+exchange, but rather wait for the abort scheduled from SCSI EH.  And warn
+if an abort is already scheduled to avoid similar errors in the future.
+
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Link: https://lore.kernel.org/r/20231129165832.224100-2-hare@kernel.org
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libfc/fc_fcp.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/libfc/fc_fcp.c b/drivers/scsi/libfc/fc_fcp.c
+index 945adca5e72f..3f189cedf6db 100644
+--- a/drivers/scsi/libfc/fc_fcp.c
++++ b/drivers/scsi/libfc/fc_fcp.c
+@@ -265,6 +265,11 @@ static int fc_fcp_send_abort(struct fc_fcp_pkt *fsp)
+ 	if (!fsp->seq_ptr)
+ 		return -EINVAL;
+ 
++	if (fsp->state & FC_SRB_ABORT_PENDING) {
++		FC_FCP_DBG(fsp, "abort already pending\n");
++		return -EBUSY;
++	}
++
+ 	this_cpu_inc(fsp->lp->stats->FcpPktAborts);
+ 
+ 	fsp->state |= FC_SRB_ABORT_PENDING;
+@@ -1690,11 +1695,12 @@ static void fc_fcp_recovery(struct fc_fcp_pkt *fsp, u8 code)
+ 	fsp->status_code = code;
+ 	fsp->cdb_status = 0;
+ 	fsp->io_status = 0;
+-	/*
+-	 * if this fails then we let the scsi command timer fire and
+-	 * scsi-ml escalate.
+-	 */
+-	fc_fcp_send_abort(fsp);
++	if (!fsp->cmd)
++		/*
++		 * Only abort non-scsi commands; otherwise let the
++		 * scsi command timer fire and scsi-ml escalate.
++		 */
++		fc_fcp_send_abort(fsp);
+ }
+ 
+ /**
+-- 
+2.43.0
+
diff --git a/queue-6.1/scsi-libfc-fix-up-timeout-error-in-fc_fcp_rec_error.patch b/queue-6.1/scsi-libfc-fix-up-timeout-error-in-fc_fcp_rec_error.patch
new file mode 100644
index 00000000000..e8359843f1d
--- /dev/null
+++ b/queue-6.1/scsi-libfc-fix-up-timeout-error-in-fc_fcp_rec_error.patch
@@ -0,0 +1,37 @@
+From 106cd35c6762f1e6486cdafceb0f8e74c8bed695 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 17:58:31 +0100
+Subject: scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
+
+From: Hannes Reinecke <hare@suse.de>
+
+[ Upstream commit 53122a49f49796beb2c4a1bb702303b66347e29f ]
+
+We should set the status to FC_TIMED_OUT when a timeout error is passed to
+fc_fcp_rec_error().
+
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Link: https://lore.kernel.org/r/20231129165832.224100-3-hare@kernel.org
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libfc/fc_fcp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/libfc/fc_fcp.c b/drivers/scsi/libfc/fc_fcp.c
+index 3f189cedf6db..05be0810b5e3 100644
+--- a/drivers/scsi/libfc/fc_fcp.c
++++ b/drivers/scsi/libfc/fc_fcp.c
+@@ -1676,7 +1676,7 @@ static void fc_fcp_rec_error(struct fc_fcp_pkt *fsp, struct fc_frame *fp)
+ 		if (fsp->recov_retry++ < FC_MAX_RECOV_RETRY)
+ 			fc_fcp_rec(fsp);
+ 		else
+-			fc_fcp_recovery(fsp, FC_ERROR);
++			fc_fcp_recovery(fsp, FC_TIMED_OUT);
+ 		break;
+ 	}
+ 	fc_fcp_unlock_pkt(fsp);
+-- 
+2.43.0
+
diff --git a/queue-6.1/scsi-lpfc-fix-possible-file-string-name-overflow-whe.patch b/queue-6.1/scsi-lpfc-fix-possible-file-string-name-overflow-whe.patch
new file mode 100644
index 00000000000..995eedb23e3
--- /dev/null
+++ b/queue-6.1/scsi-lpfc-fix-possible-file-string-name-overflow-whe.patch
@@ -0,0 +1,64 @@
+From 65b74caab3f541c91103778777f56cbf0aba1a36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Oct 2023 12:12:17 -0700
+Subject: scsi: lpfc: Fix possible file string name overflow when updating
+ firmware
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit f5779b529240b715f0e358489ad0ed933bf77c97 ]
+
+Because file_name and phba->ModelName are both declared a size 80 bytes,
+the extra ".grp" file extension could cause an overflow into file_name.
+
+Define a ELX_FW_NAME_SIZE macro with value 84.  84 incorporates the 4 extra
+characters from ".grp".  file_name is changed to be declared as a char and
+initialized to zeros i.e. null chars.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Link: https://lore.kernel.org/r/20231031191224.150862-3-justintee8345@gmail.com
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc.h      | 1 +
+ drivers/scsi/lpfc/lpfc_init.c | 4 ++--
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
+index 664ac3069c4b..dc5ac3cc70f6 100644
+--- a/drivers/scsi/lpfc/lpfc.h
++++ b/drivers/scsi/lpfc/lpfc.h
+@@ -33,6 +33,7 @@
+ struct lpfc_sli2_slim;
+ 
+ #define ELX_MODEL_NAME_SIZE	80
++#define ELX_FW_NAME_SIZE	84
+ 
+ #define LPFC_PCI_DEV_LP		0x1
+ #define LPFC_PCI_DEV_OC		0x2
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index f59de61803dc..1a0bafde34d8 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -14778,7 +14778,7 @@ lpfc_write_firmware(const struct firmware *fw, void *context)
+ int
+ lpfc_sli4_request_firmware_update(struct lpfc_hba *phba, uint8_t fw_upgrade)
+ {
+-	uint8_t file_name[ELX_MODEL_NAME_SIZE];
++	char file_name[ELX_FW_NAME_SIZE] = {0};
+ 	int ret;
+ 	const struct firmware *fw;
+ 
+@@ -14787,7 +14787,7 @@ lpfc_sli4_request_firmware_update(struct lpfc_hba *phba, uint8_t fw_upgrade)
+ 	    LPFC_SLI_INTF_IF_TYPE_2)
+ 		return -EPERM;
+ 
+-	snprintf(file_name, ELX_MODEL_NAME_SIZE, "%s.grp", phba->ModelName);
++	scnprintf(file_name, sizeof(file_name), "%s.grp", phba->ModelName);
+ 
+ 	if (fw_upgrade == INT_FW_UPGRADE) {
+ 		ret = request_firmware_nowait(THIS_MODULE, FW_ACTION_UEVENT,
+-- 
+2.43.0
+
diff --git a/queue-6.1/scsi-mpi3mr-add-pci-checks-where-sas5116-diverges-fr.patch b/queue-6.1/scsi-mpi3mr-add-pci-checks-where-sas5116-diverges-fr.patch
new file mode 100644
index 00000000000..36a2db97d59
--- /dev/null
+++ b/queue-6.1/scsi-mpi3mr-add-pci-checks-where-sas5116-diverges-fr.patch
@@ -0,0 +1,54 @@
+From abb1770290b17bd6de18c43334184fb7eee26a48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Nov 2023 21:31:29 +0530
+Subject: scsi: mpi3mr: Add PCI checks where SAS5116 diverges from SAS4116
+
+From: Sumit Saxena <sumit.saxena@broadcom.com>
+
+[ Upstream commit c9260ff28ee561fca5f96425c9328a9698e8427b ]
+
+Add PCI IDs checks for the cases where SAS5116 diverges from SAS4116 in
+behavior.
+
+Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
+Link: https://lore.kernel.org/r/20231123160132.4155-3-sumit.saxena@broadcom.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpi3mr/mpi3mr_fw.c | 3 ++-
+ drivers/scsi/mpi3mr/mpi3mr_os.c | 5 ++++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/mpi3mr/mpi3mr_fw.c b/drivers/scsi/mpi3mr/mpi3mr_fw.c
+index d2c7de804b99..41636c4c43af 100644
+--- a/drivers/scsi/mpi3mr/mpi3mr_fw.c
++++ b/drivers/scsi/mpi3mr/mpi3mr_fw.c
+@@ -1886,7 +1886,8 @@ static int mpi3mr_create_op_reply_q(struct mpi3mr_ioc *mrioc, u16 qidx)
+ 
+ 	reply_qid = qidx + 1;
+ 	op_reply_q->num_replies = MPI3MR_OP_REP_Q_QD;
+-	if (!mrioc->pdev->revision)
++	if ((mrioc->pdev->device == MPI3_MFGPAGE_DEVID_SAS4116) &&
++		!mrioc->pdev->revision)
+ 		op_reply_q->num_replies = MPI3MR_OP_REP_Q_QD4K;
+ 	op_reply_q->ci = 0;
+ 	op_reply_q->ephase = 1;
+diff --git a/drivers/scsi/mpi3mr/mpi3mr_os.c b/drivers/scsi/mpi3mr/mpi3mr_os.c
+index 85f5b349c7e4..7a6b006e70c8 100644
+--- a/drivers/scsi/mpi3mr/mpi3mr_os.c
++++ b/drivers/scsi/mpi3mr/mpi3mr_os.c
+@@ -4963,7 +4963,10 @@ mpi3mr_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 		mpi3mr_init_drv_cmd(&mrioc->evtack_cmds[i],
+ 				    MPI3MR_HOSTTAG_EVTACKCMD_MIN + i);
+ 
+-	if (pdev->revision)
++	if ((pdev->device == MPI3_MFGPAGE_DEVID_SAS4116) &&
++		!pdev->revision)
++		mrioc->enable_segqueue = false;
++	else
+ 		mrioc->enable_segqueue = true;
+ 
+ 	init_waitqueue_head(&mrioc->reset_waitq);
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-fix-issues-in-setup_classid_environmen.patch b/queue-6.1/selftests-bpf-fix-issues-in-setup_classid_environmen.patch
new file mode 100644
index 00000000000..a32478ab192
--- /dev/null
+++ b/queue-6.1/selftests-bpf-fix-issues-in-setup_classid_environmen.patch
@@ -0,0 +1,85 @@
+From 0bf54cfba4227f071dfea05c640bd6e0b3f300ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Nov 2023 09:00:30 +0000
+Subject: selftests/bpf: Fix issues in setup_classid_environment()
+
+From: Yafang Shao <laoar.shao@gmail.com>
+
+[ Upstream commit 4849775587844e44d215289c425bcd70f315efe7 ]
+
+If the net_cls subsystem is already mounted, attempting to mount it again
+in setup_classid_environment() will result in a failure with the error code
+EBUSY. Despite this, tmpfs will have been successfully mounted at
+/sys/fs/cgroup/net_cls. Consequently, the /sys/fs/cgroup/net_cls directory
+will be empty, causing subsequent setup operations to fail.
+
+Here's an error log excerpt illustrating the issue when net_cls has already
+been mounted at /sys/fs/cgroup/net_cls prior to running
+setup_classid_environment():
+
+- Before that change
+
+  $ tools/testing/selftests/bpf/test_progs --name=cgroup_v1v2
+  test_cgroup_v1v2:PASS:server_fd 0 nsec
+  test_cgroup_v1v2:PASS:client_fd 0 nsec
+  test_cgroup_v1v2:PASS:cgroup_fd 0 nsec
+  test_cgroup_v1v2:PASS:server_fd 0 nsec
+  run_test:PASS:skel_open 0 nsec
+  run_test:PASS:prog_attach 0 nsec
+  test_cgroup_v1v2:PASS:cgroup-v2-only 0 nsec
+  (cgroup_helpers.c:248: errno: No such file or directory) Opening Cgroup Procs: /sys/fs/cgroup/net_cls/cgroup.procs
+  (cgroup_helpers.c:540: errno: No such file or directory) Opening cgroup classid: /sys/fs/cgroup/net_cls/cgroup-test-work-dir/net_cls.classid
+  run_test:PASS:skel_open 0 nsec
+  run_test:PASS:prog_attach 0 nsec
+  (cgroup_helpers.c:248: errno: No such file or directory) Opening Cgroup Procs: /sys/fs/cgroup/net_cls/cgroup-test-work-dir/cgroup.procs
+  run_test:FAIL:join_classid unexpected error: 1 (errno 2)
+  test_cgroup_v1v2:FAIL:cgroup-v1v2 unexpected error: -1 (errno 2)
+  (cgroup_helpers.c:248: errno: No such file or directory) Opening Cgroup Procs: /sys/fs/cgroup/net_cls/cgroup.procs
+  #44      cgroup_v1v2:FAIL
+  Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED
+
+- After that change
+  $ tools/testing/selftests/bpf/test_progs --name=cgroup_v1v2
+  #44      cgroup_v1v2:OK
+  Summary: 1/0 PASSED, 0 SKIPPED, 0 FAILED
+
+Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
+Link: https://lore.kernel.org/r/20231111090034.4248-3-laoar.shao@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/cgroup_helpers.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/cgroup_helpers.c b/tools/testing/selftests/bpf/cgroup_helpers.c
+index e914cc45b766..6f00bee917a0 100644
+--- a/tools/testing/selftests/bpf/cgroup_helpers.c
++++ b/tools/testing/selftests/bpf/cgroup_helpers.c
+@@ -467,10 +467,20 @@ int setup_classid_environment(void)
+ 		return 1;
+ 	}
+ 
+-	if (mount("net_cls", NETCLS_MOUNT_PATH, "cgroup", 0, "net_cls") &&
+-	    errno != EBUSY) {
+-		log_err("mount cgroup net_cls");
+-		return 1;
++	if (mount("net_cls", NETCLS_MOUNT_PATH, "cgroup", 0, "net_cls")) {
++		if (errno != EBUSY) {
++			log_err("mount cgroup net_cls");
++			return 1;
++		}
++
++		if (rmdir(NETCLS_MOUNT_PATH)) {
++			log_err("rmdir cgroup net_cls");
++			return 1;
++		}
++		if (umount(CGROUP_MOUNT_DFLT)) {
++			log_err("umount cgroup base");
++			return 1;
++		}
+ 	}
+ 
+ 	cleanup_classid_environment();
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-fix-pyperf180-compilation-failure-with.patch b/queue-6.1/selftests-bpf-fix-pyperf180-compilation-failure-with.patch
new file mode 100644
index 00000000000..0cda83826f8
--- /dev/null
+++ b/queue-6.1/selftests-bpf-fix-pyperf180-compilation-failure-with.patch
@@ -0,0 +1,83 @@
+From c29ee6a7c5ba0651e716b7d5f093b80356f8d63d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Nov 2023 11:36:44 -0800
+Subject: selftests/bpf: Fix pyperf180 compilation failure with clang18
+
+From: Yonghong Song <yonghong.song@linux.dev>
+
+[ Upstream commit 100888fb6d8a185866b1520031ee7e3182b173de ]
+
+With latest clang18 (main branch of llvm-project repo), when building bpf selftests,
+    [~/work/bpf-next (master)]$ make -C tools/testing/selftests/bpf LLVM=1 -j
+
+The following compilation error happens:
+    fatal error: error in backend: Branch target out of insn range
+    ...
+    Stack dump:
+    0.      Program arguments: clang -g -Wall -Werror -D__TARGET_ARCH_x86 -mlittle-endian
+      -I/home/yhs/work/bpf-next/tools/testing/selftests/bpf/tools/include
+      -I/home/yhs/work/bpf-next/tools/testing/selftests/bpf -I/home/yhs/work/bpf-next/tools/include/uapi
+      -I/home/yhs/work/bpf-next/tools/testing/selftests/usr/include -idirafter
+      /home/yhs/work/llvm-project/llvm/build.18/install/lib/clang/18/include -idirafter /usr/local/include
+      -idirafter /usr/include -Wno-compare-distinct-pointer-types -DENABLE_ATOMICS_TESTS -O2 --target=bpf
+      -c progs/pyperf180.c -mcpu=v3 -o /home/yhs/work/bpf-next/tools/testing/selftests/bpf/pyperf180.bpf.o
+    1.      <eof> parser at end of file
+    2.      Code generation
+    ...
+
+The compilation failure only happens to cpu=v2 and cpu=v3. cpu=v4 is okay
+since cpu=v4 supports 32-bit branch target offset.
+
+The above failure is due to upstream llvm patch [1] where some inlining behavior
+are changed in clang18.
+
+To workaround the issue, previously all 180 loop iterations are fully unrolled.
+The bpf macro __BPF_CPU_VERSION__ (implemented in clang18 recently) is used to avoid
+unrolling changes if cpu=v4. If __BPF_CPU_VERSION__ is not available and the
+compiler is clang18, the unrollng amount is unconditionally reduced.
+
+  [1] https://github.com/llvm/llvm-project/commit/1a2e77cf9e11dbf56b5720c607313a566eebb16e
+
+Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Tested-by: Alan Maguire <alan.maguire@oracle.com>
+Link: https://lore.kernel.org/bpf/20231110193644.3130906-1-yonghong.song@linux.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/progs/pyperf180.c | 22 +++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/progs/pyperf180.c b/tools/testing/selftests/bpf/progs/pyperf180.c
+index c39f559d3100..42c4a8b62e36 100644
+--- a/tools/testing/selftests/bpf/progs/pyperf180.c
++++ b/tools/testing/selftests/bpf/progs/pyperf180.c
+@@ -1,4 +1,26 @@
+ // SPDX-License-Identifier: GPL-2.0
+ // Copyright (c) 2019 Facebook
+ #define STACK_MAX_LEN 180
++
++/* llvm upstream commit at clang18
++ *   https://github.com/llvm/llvm-project/commit/1a2e77cf9e11dbf56b5720c607313a566eebb16e
++ * changed inlining behavior and caused compilation failure as some branch
++ * target distance exceeded 16bit representation which is the maximum for
++ * cpu v1/v2/v3. Macro __BPF_CPU_VERSION__ is later implemented in clang18
++ * to specify which cpu version is used for compilation. So a smaller
++ * unroll_count can be set if __BPF_CPU_VERSION__ is less than 4, which
++ * reduced some branch target distances and resolved the compilation failure.
++ *
++ * To capture the case where a developer/ci uses clang18 but the corresponding
++ * repo checkpoint does not have __BPF_CPU_VERSION__, a smaller unroll_count
++ * will be set as well to prevent potential compilation failures.
++ */
++#ifdef __BPF_CPU_VERSION__
++#if __BPF_CPU_VERSION__ < 4
++#define UNROLL_COUNT 90
++#endif
++#elif __clang_major__ == 18
++#define UNROLL_COUNT 90
++#endif
++
+ #include "pyperf.h"
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-bpf-satisfy-compiler-by-having-explicit-re.patch b/queue-6.1/selftests-bpf-satisfy-compiler-by-having-explicit-re.patch
new file mode 100644
index 00000000000..a024f513ce7
--- /dev/null
+++ b/queue-6.1/selftests-bpf-satisfy-compiler-by-having-explicit-re.patch
@@ -0,0 +1,35 @@
+From 21f261a06b1b35156c97595cf4b5a3494df25e84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Nov 2023 20:37:44 -0700
+Subject: selftests/bpf: satisfy compiler by having explicit return in btf test
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit f4c7e887324f5776eef6e6e47a90e0ac8058a7a8 ]
+
+Some compilers complain about get_pprint_mapv_size() not returning value
+in some code paths. Fix with explicit return.
+
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/r/20231102033759.2541186-3-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/btf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/btf.c b/tools/testing/selftests/bpf/prog_tests/btf.c
+index d711f4bea98e..47cb753ef1e3 100644
+--- a/tools/testing/selftests/bpf/prog_tests/btf.c
++++ b/tools/testing/selftests/bpf/prog_tests/btf.c
+@@ -5211,6 +5211,7 @@ static size_t get_pprint_mapv_size(enum pprint_mapv_kind_t mapv_kind)
+ #endif
+ 
+ 	assert(0);
++	return 0;
+ }
+ 
+ static void set_pprint_mapv(enum pprint_mapv_kind_t mapv_kind,
+-- 
+2.43.0
+
diff --git a/queue-6.1/selftests-sgx-fix-linker-script-asserts.patch b/queue-6.1/selftests-sgx-fix-linker-script-asserts.patch
new file mode 100644
index 00000000000..e198e0ecf32
--- /dev/null
+++ b/queue-6.1/selftests-sgx-fix-linker-script-asserts.patch
@@ -0,0 +1,39 @@
+From 1b860c52b86674dc120d266c9650694fab73b456 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Oct 2023 17:38:50 +0200
+Subject: selftests/sgx: Fix linker script asserts
+
+From: Jo Van Bulck <jo.vanbulck@cs.kuleuven.be>
+
+[ Upstream commit 9fd552ee32c6c1e27c125016b87d295bea6faea7 ]
+
+DEFINED only considers symbols, not section names. Hence, replace the
+check for .got.plt with the _GLOBAL_OFFSET_TABLE_ symbol and remove other
+(non-essential) asserts.
+
+Signed-off-by: Jo Van Bulck <jo.vanbulck@cs.kuleuven.be>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Link: https://lore.kernel.org/all/20231005153854.25566-10-jo.vanbulck%40cs.kuleuven.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/sgx/test_encl.lds | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/sgx/test_encl.lds b/tools/testing/selftests/sgx/test_encl.lds
+index a1ec64f7d91f..108bc11d1d8c 100644
+--- a/tools/testing/selftests/sgx/test_encl.lds
++++ b/tools/testing/selftests/sgx/test_encl.lds
+@@ -34,8 +34,4 @@ SECTIONS
+ 	}
+ }
+ 
+-ASSERT(!DEFINED(.altinstructions), "ALTERNATIVES are not supported in enclaves")
+-ASSERT(!DEFINED(.altinstr_replacement), "ALTERNATIVES are not supported in enclaves")
+-ASSERT(!DEFINED(.discard.retpoline_safe), "RETPOLINE ALTERNATIVES are not supported in enclaves")
+-ASSERT(!DEFINED(.discard.nospec), "RETPOLINE ALTERNATIVES are not supported in enclaves")
+-ASSERT(!DEFINED(.got.plt), "Libcalls are not supported in enclaves")
++ASSERT(!DEFINED(_GLOBAL_OFFSET_TABLE_), "Libcalls through GOT are not supported in enclaves")
+-- 
+2.43.0
+
diff --git a/queue-6.1/series b/queue-6.1/series
new file mode 100644
index 00000000000..a302c8a1263
--- /dev/null
+++ b/queue-6.1/series
@@ -0,0 +1,192 @@
+asm-generic-make-sparse-happy-with-odd-sized-put_una.patch
+powerpc-mm-fix-null-pointer-dereference-in-pgtable_c.patch
+arm64-irq-set-the-correct-node-for-vmap-stack.patch
+drivers-perf-pmuv3-don-t-expose-sw_incr-event-in-sys.patch
+powerpc-fix-build-error-due-to-is_valid_bugaddr.patch
+powerpc-mm-fix-build-failures-due-to-arch_reserved_k.patch
+powerpc-64s-fix-config_numa-n-build-due-to-create_se.patch
+x86-boot-ignore-nmis-during-very-early-boot.patch
+powerpc-pmd_move_must_withdraw-is-only-needed-for-co.patch
+powerpc-lib-validate-size-for-vector-operations.patch
+x86-mce-mark-fatal-mce-s-page-as-poison-to-avoid-pan.patch
+perf-core-fix-narrow-startup-race-when-creating-the-.patch
+debugobjects-stop-accessing-objects-after-releasing-.patch
+regulator-core-only-increment-use_count-when-enable_.patch
+audit-send-netlink-ack-before-setting-connection-in-.patch
+acpi-video-add-quirk-for-the-colorful-x15-at-23-lapt.patch
+pnp-acpi-fix-fortify-warning.patch
+acpi-extlog-fix-null-pointer-dereference-check.patch
+acpi-numa-fix-the-logic-of-getting-the-fake_pxm-valu.patch
+pm-devfreq-synchronize-devfreq_monitor_-start-stop.patch
+acpi-apei-set-memory-failure-flags-as-mf_action_requ.patch
+fs-jfs-ubsan-array-index-out-of-bounds-in-dbadjtree.patch
+ubsan-array-index-out-of-bounds-in-dtsplitroot.patch
+jfs-fix-slab-out-of-bounds-read-in-dtsearch.patch
+jfs-fix-array-index-out-of-bounds-in-dbadjtree.patch
+jfs-fix-uaf-in-jfs_evict_inode.patch
+pstore-ram-fix-crash-when-setting-number-of-cpus-to-.patch
+crypto-octeontx2-fix-cptvf-driver-cleanup.patch
+erofs-fix-ztailpacking-for-subpage-compressed-blocks.patch
+crypto-stm32-crc32-fix-parsing-list-of-devices.patch
+afs-fix-the-usage-of-read_seqbegin_or_lock-in-afs_lo.patch
+afs-fix-the-usage-of-read_seqbegin_or_lock-in-afs_fi.patch
+rxrpc_find_service_conn_rcu-fix-the-usage-of-read_se.patch
+jfs-fix-array-index-out-of-bounds-in-dinewext.patch
+arch-consolidate-arch_irq_work_raise-prototypes.patch
+s390-vfio-ap-fix-sysfs-status-attribute-for-ap-queue.patch
+hexagon-make-pfn-accessors-statics-inlines.patch
+s390-ptrace-handle-setting-of-fpc-register-correctly.patch
+kvm-s390-fix-setting-of-fpc-register.patch
+sunrpc-fix-a-suspicious-rcu-usage-warning.patch
+ecryptfs-reject-casefold-directory-inodes.patch
+ext4-fix-inconsistent-between-segment-fstrim-and-ful.patch
+ext4-unify-the-type-of-flexbg_size-to-unsigned-int.patch
+ext4-remove-unnecessary-check-from-alloc_flex_gd.patch
+ext4-avoid-online-resizing-failures-due-to-oversized.patch
+wifi-rt2x00-restart-beacon-queue-when-hardware-reset.patch
+selftests-bpf-satisfy-compiler-by-having-explicit-re.patch
+selftests-bpf-fix-pyperf180-compilation-failure-with.patch
+wifi-rt2x00-correct-wrong-bbp-register-in-rxdcoc-cal.patch
+selftests-bpf-fix-issues-in-setup_classid_environmen.patch
+soc-xilinx-fix-for-call-trace-due-to-the-usage-of-sm.patch
+soc-xilinx-fix-unhandled-sgi-warning-message.patch
+scsi-lpfc-fix-possible-file-string-name-overflow-whe.patch
+pci-add-no-pm-reset-quirk-for-nvidia-spectrum-device.patch
+bonding-return-enomem-instead-of-bug-in-alb_upper_de.patch
+net-usb-ax88179_178a-avoid-two-consecutive-device-re.patch
+scsi-mpi3mr-add-pci-checks-where-sas5116-diverges-fr.patch
+scsi-arcmsr-support-new-pci-device-ids-1883-and-1886.patch
+arm-dts-imx7d-fix-coresight-funnel-ports.patch
+arm-dts-imx7s-fix-lcdif-compatible.patch
+arm-dts-imx7s-fix-nand-controller-size-cells.patch
+wifi-ath9k-fix-potential-array-index-out-of-bounds-r.patch
+wifi-ath11k-fix-race-due-to-setting-ath11k_flag_ext_.patch
+bpf-check-rcu_read_lock_trace_held-before-calling-bp.patch
+scsi-libfc-don-t-schedule-abort-twice.patch
+scsi-libfc-fix-up-timeout-error-in-fc_fcp_rec_error.patch
+net-mvmdio-avoid-excessive-sleeps-in-polled-mode.patch
+bpf-set-uattr-batch.count-as-zero-before-batched-upd.patch
+wifi-wfx-fix-possible-null-pointer-dereference-in-wf.patch
+arm-dts-rockchip-fix-rk3036-hdmi-ports-node.patch
+arm-dts-imx25-27-eukrea-fix-rtc-node-name.patch
+arm-dts-imx-use-flash-0-0-pattern.patch
+arm-dts-imx27-fix-sram-node.patch
+arm-dts-imx1-fix-sram-node.patch
+net-phy-at803x-fix-passing-the-wrong-reference-for-c.patch
+ionic-pass-opcode-to-devcmd_wait.patch
+ionic-bypass-firmware-cmds-when-stuck-in-reset.patch
+block-rnbd-srv-check-for-unlikely-string-overflow.patch
+arm-dts-imx25-fix-the-iim-compatible-string.patch
+arm-dts-imx25-27-pass-timing0.patch
+arm-dts-imx27-apf27dev-fix-led-name.patch
+arm-dts-imx23-sansa-use-preferred-i2c-gpios-properti.patch
+arm-dts-imx23-28-fix-the-dma-controller-node-name.patch
+scsi-hisi_sas-set-.phy_attached-before-notifing-phyu.patch
+ice-fix-ice_aq_vsi_q_opt_rss_-register-values.patch
+net-atlantic-eliminate-double-free-in-error-handling.patch
+net-dsa-mv88e6xxx-fix-mv88e6352_serdes_get_stats-err.patch
+block-prevent-an-integer-overflow-in-bvec_try_merge_.patch
+md-whenassemble-the-array-consult-the-superblock-of-.patch
+cfi-add-cfi_noseal.patch
+arm64-dts-qcom-msm8996-fix-in-ports-is-a-required-pr.patch
+arm64-dts-qcom-msm8998-fix-out-ports-is-a-required-p.patch
+ice-fix-pre-shifted-bit-usage.patch
+arm64-dts-amlogic-fix-format-for-s4-uart-node.patch
+wifi-rtl8xxxu-add-additional-usb-ids-for-rtl8192eu-d.patch
+libbpf-fix-null-pointer-dereference-in-bpf_object__c.patch
+wifi-rtlwifi-rtl8723-be-ae-using-calculate_bit_shift.patch
+wifi-cfg80211-free-beacon_ies-when-overridden-from-h.patch
+bluetooth-qca-set-both-wideband_speech-and-le_states.patch
+bluetooth-hci_sync-fix-br-edr-wakeup-bug.patch
+bluetooth-l2cap-fix-possible-multiple-reject-send.patch
+net-smc-disable-seid-on-non-s390-archs-where-virtual.patch
+bridge-cfm-fix-enum-typo-in-br_cc_ccm_tx_parse.patch
+i40e-fix-vf-disable-behavior-to-block-all-traffic.patch
+octeontx2-af-fix-max-npc-mcam-entry-check-while-vali.patch
+net-dsa-qca8k-put-mdio-bus-of-node-on-qca8k_mdio_reg.patch
+f2fs-fix-to-check-return-value-of-f2fs_reserve_new_b.patch
+alsa-hda-refer-to-correct-stream-index-at-loops.patch
+asoc-doc-fix-undefined-snd_soc_dapm_nopm-argument.patch
+drm-fix-color-lut-rounding.patch
+fast_dput-handle-underflows-gracefully.patch
+rdma-ipoib-fix-error-code-return-in-ipoib_mcast_join.patch
+drm-panel-edp-add-override_edid_mode-quirk-for-gener.patch
+drm-bridge-anx7625-fix-set-hpd-irq-detect-window-to-.patch
+drm-amd-display-fix-tiled-display-misalignment.patch
+media-renesas-vsp1-fix-references-to-pad-config.patch
+f2fs-fix-write-pointers-on-zoned-device-after-roll-f.patch
+asoc-amd-add-new-dmi-entries-for-acp5x-platform.patch
+drm-drm_file-fix-use-of-uninitialized-variable.patch
+drm-framebuffer-fix-use-of-uninitialized-variable.patch
+drm-mipi-dsi-fix-detach-call-without-attach.patch
+media-stk1160-fixed-high-volume-of-stk1160_dbg-messa.patch
+media-rockchip-rga-fix-swizzling-for-rgb-formats.patch
+pci-add-intel_hda_arl-to-pci_ids.h.patch
+alsa-hda-intel-add-hda_arl-pci-id-support.patch
+media-rkisp1-drop-irqf_shared.patch
+media-rkisp1-fix-irq-handler-return-values.patch
+media-rkisp1-store-irq-lines.patch
+media-rkisp1-fix-irq-disable-race-issue.patch
+hwmon-nct6775-fix-fan-speed-set-failure-in-automatic.patch
+hwmon-pc87360-bounds-check-data-innr-usage.patch
+f2fs-fix-to-tag-gcing-flag-on-page-during-block-migr.patch
+drm-exynos-call-drm_atomic_helper_shutdown-at-shutdo.patch
+ib-ipoib-fix-mcast-list-locking.patch
+media-amphion-remove-mutext-lock-in-condition-of-wai.patch
+media-ddbridge-fix-an-error-code-problem-in-ddb_prob.patch
+media-i2c-imx335-fix-hblank-min-max-values.patch
+drm-amd-display-for-prefetch-mode-0-extend-prefetch-.patch
+drm-msm-dpu-ratelimit-framedone-timeout-msgs.patch
+drm-msm-dpu-fix-writeback-programming-for-yuv-cases.patch
+drm-amdgpu-fix-ftrace-event-amdgpu_bo_move-always-mo.patch
+clk-hi3620-fix-memory-leak-in-hi3620_mmc_clk_init.patch
+clk-mmp-pxa168-fix-memory-leak-in-pxa168_clk_init.patch
+watchdog-it87_wdt-keep-wdtctrl-bit-3-unmodified-for-.patch
+drm-amd-display-make-flip_timestamp_in_us-a-64-bit-v.patch
+clk-imx-clk-imx8qxp-fix-lvds-bypass-pixel-and-phy-cl.patch
+drm-amdgpu-fix-ecc-irq-enable-disable-unpaired.patch
+drm-amdgpu-let-kfd-sync-with-vm-fences.patch
+drm-amd-display-fixing-stream-allocation-regression.patch
+drm-amdgpu-fix-fw-from-request_firmware-not-released.patch
+drm-amdgpu-drop-fence-check-in-to_amdgpu_amdkfd_fenc.patch
+drm-amdkfd-fix-iterator-used-outside-loop-in-kfd_add.patch
+alsa-hda-conexant-fix-headset-auto-detect-fail-in-cx.patch
+leds-trigger-panic-don-t-register-panic-notifier-if-.patch
+um-fix-naming-clash-between-uml-and-scheduler.patch
+um-don-t-use-vfprintf-for-os_info.patch
+um-net-fix-return-type-of-uml_net_start_xmit.patch
+um-time-travel-fix-time-corruption.patch
+i3c-master-cdns-update-maximum-prescaler-value-for-i.patch
+xen-gntdev-fix-the-abuse-of-underlying-struct-page-i.patch
+mfd-ti_am335x_tscadc-fix-ti-soc-dependencies.patch
+mailbox-arm_mhuv2-fix-a-bug-for-mhuv2_sender_interru.patch
+pci-only-override-amd-usb-controller-if-required.patch
+pci-switchtec-fix-stdev_release-crash-after-surprise.patch
+perf-cs-etm-bump-minimum-opencsd-version-to-ensure-a.patch
+xhci-fix-possible-null-pointer-deref-during-xhci-urb.patch
+usb-hub-replace-hardcoded-quirk-value-with-bit-macro.patch
+usb-hub-add-quirk-to-decrease-in-ep-poll-interval-fo.patch
+selftests-sgx-fix-linker-script-asserts.patch
+tty-allow-tiocslcktrmios-with-cap_checkpoint_restore.patch
+fs-kernfs-dir-obey-s_isgid.patch
+spmi-mediatek-fix-uaf-on-device-remove.patch
+pci-fix-64gt-s-effective-data-rate-calculation.patch
+pci-aer-decode-requester-id-when-no-error-info-found.patch
+9p-fix-initialisation-of-netfs_inode-for-9p.patch
+misc-lis3lv02d_i2c-add-missing-setting-of-the-reg_ct.patch
+libsubcmd-fix-memory-leak-in-uniq.patch
+drm-amdkfd-fix-lock-dependency-warning.patch
+drm-amdkfd-fix-lock-dependency-warning-with-srcu.patch
+virtio_net-fix-d-directive-writing-between-1-and-11-.patch
+blk-mq-fix-io-hang-from-sbitmap-wakeup-race.patch
+ceph-reinitialize-mds-feature-bit-even-when-session-.patch
+ceph-fix-deadlock-or-deadcode-of-misusing-dget.patch
+ceph-fix-invalid-pointer-access-if-get_quota_realm-r.patch
+drm-amd-powerplay-fix-kzalloc-parameter-atom_tonga_p.patch
+drm-amdgpu-fix-with-right-return-code-eio-in-amdgpu_.patch
+drm-amdgpu-release-adev-pm.fw-before-return-in-amdgp.patch
+drm-amdkfd-fix-node-null-check-in-svm_range_get_rang.patch
+i2c-rk3x-adjust-mask-value-offset-for-i2c2-on-rv1126.patch
+perf-fix-the-nr_addr_filters-fix.patch
+wifi-cfg80211-fix-rcu-dereference-in-__cfg80211_bss_.patch
+drm-using-mul_u32_u32-requires-linux-math64.h.patch
diff --git a/queue-6.1/soc-xilinx-fix-for-call-trace-due-to-the-usage-of-sm.patch b/queue-6.1/soc-xilinx-fix-for-call-trace-due-to-the-usage-of-sm.patch
new file mode 100644
index 00000000000..53c24d76075
--- /dev/null
+++ b/queue-6.1/soc-xilinx-fix-for-call-trace-due-to-the-usage-of-sm.patch
@@ -0,0 +1,70 @@
+From 567b77ea0eb819603b7bacdb8626cc26b991eac9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Oct 2023 22:56:22 -0700
+Subject: soc: xilinx: Fix for call trace due to the usage of
+ smp_processor_id()
+
+From: HariBabu Gattem <haribabu.gattem@xilinx.com>
+
+[ Upstream commit daed80ed07580e5adc0e6d8bc79933a35154135a ]
+
+When preemption is enabled in kernel and if any task which can be
+preempted should not use smp_processor_id() directly, since CPU
+switch can happen at any time, the previous value of cpu_id
+differs with current cpu_id. As a result we see the below call trace
+during xlnx_event_manager_probe.
+
+[ 6.140197] dump_backtrace+0x0/0x190
+[ 6.143884] show_stack+0x18/0x40
+[ 6.147220] dump_stack_lvl+0x7c/0xa0
+[ 6.150907] dump_stack+0x18/0x34
+[ 6.154241] check_preemption_disabled+0x124/0x134
+[ 6.159068] debug_smp_processor_id+0x20/0x2c
+[ 6.163453] xlnx_event_manager_probe+0x48/0x250
+
+To protect cpu_id, It is recommended to use get_cpu()/put_cpu()
+to disable preemption, get the cpu_id and enable preemption respectively.
+(For Reference, Documentation/locking/preempt-locking.rst and
+Documentation/kernel-hacking/hacking.rst)
+
+Use preempt_disable()/smp_processor_id()/preempt_enable()
+API's to achieve the same.
+
+Signed-off-by: HariBabu Gattem <haribabu.gattem@xilinx.com>
+Signed-off-by: Jay Buddhabhatti <jay.buddhabhatti@amd.com>
+Link: https://lore.kernel.org/r/20231027055622.21544-1-jay.buddhabhatti@amd.com
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/xilinx/xlnx_event_manager.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soc/xilinx/xlnx_event_manager.c b/drivers/soc/xilinx/xlnx_event_manager.c
+index f9d9b82b562d..56d22d3989bb 100644
+--- a/drivers/soc/xilinx/xlnx_event_manager.c
++++ b/drivers/soc/xilinx/xlnx_event_manager.c
+@@ -555,7 +555,7 @@ static void xlnx_disable_percpu_irq(void *data)
+ static int xlnx_event_init_sgi(struct platform_device *pdev)
+ {
+ 	int ret = 0;
+-	int cpu = smp_processor_id();
++	int cpu;
+ 	/*
+ 	 * IRQ related structures are used for the following:
+ 	 * for each SGI interrupt ensure its mapped by GIC IRQ domain
+@@ -592,9 +592,12 @@ static int xlnx_event_init_sgi(struct platform_device *pdev)
+ 	sgi_fwspec.param[0] = sgi_num;
+ 	virq_sgi = irq_create_fwspec_mapping(&sgi_fwspec);
+ 
++	cpu = get_cpu();
+ 	per_cpu(cpu_number1, cpu) = cpu;
+ 	ret = request_percpu_irq(virq_sgi, xlnx_event_handler, "xlnx_event_mgmt",
+ 				 &cpu_number1);
++	put_cpu();
++
+ 	WARN_ON(ret);
+ 	if (ret) {
+ 		irq_dispose_mapping(virq_sgi);
+-- 
+2.43.0
+
diff --git a/queue-6.1/soc-xilinx-fix-unhandled-sgi-warning-message.patch b/queue-6.1/soc-xilinx-fix-unhandled-sgi-warning-message.patch
new file mode 100644
index 00000000000..8c72cf02947
--- /dev/null
+++ b/queue-6.1/soc-xilinx-fix-unhandled-sgi-warning-message.patch
@@ -0,0 +1,39 @@
+From 2021e267b71783cd006efa814deaa5e4b567fc28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Oct 2023 23:53:59 +0530
+Subject: soc: xilinx: fix unhandled SGI warning message
+
+From: Tanmay Shah <tanmay.shah@xilinx.com>
+
+[ Upstream commit 9c6724abf969251af53cdae525ad8100ec78d3c2 ]
+
+Xen broadcasts SGI to each VM when multiple VMs run on Xen hypervisor. In
+such case spurious SGI is expected if one event is registered by one VM and
+not registered by another VM. We let users know that Unhandled SGI is not
+error and expected if kernel is running on Xen hypervisor.
+
+Signed-off-by: Tanmay Shah <tanmay.shah@xilinx.com>
+Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+Link: https://lore.kernel.org/r/1698431039-2734260-1-git-send-email-radhey.shyam.pandey@amd.com
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/xilinx/xlnx_event_manager.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/xilinx/xlnx_event_manager.c b/drivers/soc/xilinx/xlnx_event_manager.c
+index 56d22d3989bb..8293cc40047f 100644
+--- a/drivers/soc/xilinx/xlnx_event_manager.c
++++ b/drivers/soc/xilinx/xlnx_event_manager.c
+@@ -477,7 +477,7 @@ static void xlnx_call_notify_cb_handler(const u32 *payload)
+ 		}
+ 	}
+ 	if (!is_callback_found)
+-		pr_warn("Didn't find any registered callback for 0x%x 0x%x\n",
++		pr_warn("Unhandled SGI node 0x%x event 0x%x. Expected with Xen hypervisor\n",
+ 			payload[1], payload[2]);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/spmi-mediatek-fix-uaf-on-device-remove.patch b/queue-6.1/spmi-mediatek-fix-uaf-on-device-remove.patch
new file mode 100644
index 00000000000..8d523f7f952
--- /dev/null
+++ b/queue-6.1/spmi-mediatek-fix-uaf-on-device-remove.patch
@@ -0,0 +1,78 @@
+From 02891fcc7e67c8105ef363dceda8490284be577d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Dec 2023 15:17:25 -0800
+Subject: spmi: mediatek: Fix UAF on device remove
+
+From: Yu-Che Cheng <giver@chromium.org>
+
+[ Upstream commit e821d50ab5b956ed0effa49faaf29912fd4106d9 ]
+
+The pmif driver data that contains the clocks is allocated along with
+spmi_controller.
+On device remove, spmi_controller will be freed first, and then devres
+, including the clocks, will be cleanup.
+This leads to UAF because putting the clocks will access the clocks in
+the pmif driver data, which is already freed along with spmi_controller.
+
+This can be reproduced by enabling DEBUG_TEST_DRIVER_REMOVE and
+building the kernel with KASAN.
+
+Fix the UAF issue by using unmanaged clk_bulk_get() and putting the
+clocks before freeing spmi_controller.
+
+Reported-by: Fei Shao <fshao@chromium.org>
+Signed-off-by: Yu-Che Cheng <giver@chromium.org>
+Link: https://lore.kernel.org/r/20230717173934.1.If004a6e055a189c7f2d0724fa814422c26789839@changeid
+Tested-by: Fei Shao <fshao@chromium.org>
+Reviewed-by: Fei Shao <fshao@chromium.org>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Link: https://lore.kernel.org/r/20231206231733.4031901-3-sboyd@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spmi/spmi-mtk-pmif.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spmi/spmi-mtk-pmif.c b/drivers/spmi/spmi-mtk-pmif.c
+index 01e8851e639d..bf8c0d4109b1 100644
+--- a/drivers/spmi/spmi-mtk-pmif.c
++++ b/drivers/spmi/spmi-mtk-pmif.c
+@@ -475,7 +475,7 @@ static int mtk_spmi_probe(struct platform_device *pdev)
+ 	for (i = 0; i < arb->nclks; i++)
+ 		arb->clks[i].id = pmif_clock_names[i];
+ 
+-	err = devm_clk_bulk_get(&pdev->dev, arb->nclks, arb->clks);
++	err = clk_bulk_get(&pdev->dev, arb->nclks, arb->clks);
+ 	if (err) {
+ 		dev_err(&pdev->dev, "Failed to get clocks: %d\n", err);
+ 		goto err_put_ctrl;
+@@ -484,7 +484,7 @@ static int mtk_spmi_probe(struct platform_device *pdev)
+ 	err = clk_bulk_prepare_enable(arb->nclks, arb->clks);
+ 	if (err) {
+ 		dev_err(&pdev->dev, "Failed to enable clocks: %d\n", err);
+-		goto err_put_ctrl;
++		goto err_put_clks;
+ 	}
+ 
+ 	ctrl->cmd = pmif_arb_cmd;
+@@ -510,6 +510,8 @@ static int mtk_spmi_probe(struct platform_device *pdev)
+ 
+ err_domain_remove:
+ 	clk_bulk_disable_unprepare(arb->nclks, arb->clks);
++err_put_clks:
++	clk_bulk_put(arb->nclks, arb->clks);
+ err_put_ctrl:
+ 	spmi_controller_put(ctrl);
+ 	return err;
+@@ -521,6 +523,7 @@ static int mtk_spmi_remove(struct platform_device *pdev)
+ 	struct pmif *arb = spmi_controller_get_drvdata(ctrl);
+ 
+ 	clk_bulk_disable_unprepare(arb->nclks, arb->clks);
++	clk_bulk_put(arb->nclks, arb->clks);
+ 	spmi_controller_remove(ctrl);
+ 	spmi_controller_put(ctrl);
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.1/sunrpc-fix-a-suspicious-rcu-usage-warning.patch b/queue-6.1/sunrpc-fix-a-suspicious-rcu-usage-warning.patch
new file mode 100644
index 00000000000..a11f0691312
--- /dev/null
+++ b/queue-6.1/sunrpc-fix-a-suspicious-rcu-usage-warning.patch
@@ -0,0 +1,121 @@
+From 672f69eb4dc70d13d0a66dc8d0d70f8049220653 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Nov 2023 17:06:18 -0500
+Subject: SUNRPC: Fix a suspicious RCU usage warning
+
+From: Anna Schumaker <Anna.Schumaker@Netapp.com>
+
+[ Upstream commit 31b62908693c90d4d07db597e685d9f25a120073 ]
+
+I received the following warning while running cthon against an ontap
+server running pNFS:
+
+[   57.202521] =============================
+[   57.202522] WARNING: suspicious RCU usage
+[   57.202523] 6.7.0-rc3-g2cc14f52aeb7 #41492 Not tainted
+[   57.202525] -----------------------------
+[   57.202525] net/sunrpc/xprtmultipath.c:349 RCU-list traversed in non-reader section!!
+[   57.202527]
+               other info that might help us debug this:
+
+[   57.202528]
+               rcu_scheduler_active = 2, debug_locks = 1
+[   57.202529] no locks held by test5/3567.
+[   57.202530]
+               stack backtrace:
+[   57.202532] CPU: 0 PID: 3567 Comm: test5 Not tainted 6.7.0-rc3-g2cc14f52aeb7 #41492 5b09971b4965c0aceba19f3eea324a4a806e227e
+[   57.202534] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 2/2/2022
+[   57.202536] Call Trace:
+[   57.202537]  <TASK>
+[   57.202540]  dump_stack_lvl+0x77/0xb0
+[   57.202551]  lockdep_rcu_suspicious+0x154/0x1a0
+[   57.202556]  rpc_xprt_switch_has_addr+0x17c/0x190 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]
+[   57.202596]  rpc_clnt_setup_test_and_add_xprt+0x50/0x180 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]
+[   57.202621]  ? rpc_clnt_add_xprt+0x254/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]
+[   57.202646]  rpc_clnt_add_xprt+0x27a/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]
+[   57.202671]  ? __pfx_rpc_clnt_setup_test_and_add_xprt+0x10/0x10 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]
+[   57.202696]  nfs4_pnfs_ds_connect+0x345/0x760 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]
+[   57.202728]  ? __pfx_nfs4_test_session_trunk+0x10/0x10 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]
+[   57.202754]  nfs4_fl_prepare_ds+0x75/0xc0 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a]
+[   57.202760]  filelayout_write_pagelist+0x4a/0x200 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a]
+[   57.202765]  pnfs_generic_pg_writepages+0xbe/0x230 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]
+[   57.202788]  __nfs_pageio_add_request+0x3fd/0x520 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]
+[   57.202813]  nfs_pageio_add_request+0x18b/0x390 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]
+[   57.202831]  nfs_do_writepage+0x116/0x1e0 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]
+[   57.202849]  nfs_writepages_callback+0x13/0x30 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]
+[   57.202866]  write_cache_pages+0x265/0x450
+[   57.202870]  ? __pfx_nfs_writepages_callback+0x10/0x10 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]
+[   57.202891]  nfs_writepages+0x141/0x230 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]
+[   57.202913]  do_writepages+0xd2/0x230
+[   57.202917]  ? filemap_fdatawrite_wbc+0x5c/0x80
+[   57.202921]  filemap_fdatawrite_wbc+0x67/0x80
+[   57.202924]  filemap_write_and_wait_range+0xd9/0x170
+[   57.202930]  nfs_wb_all+0x49/0x180 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]
+[   57.202947]  nfs4_file_flush+0x72/0xb0 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]
+[   57.202969]  __se_sys_close+0x46/0xd0
+[   57.202972]  do_syscall_64+0x68/0x100
+[   57.202975]  ? do_syscall_64+0x77/0x100
+[   57.202976]  ? do_syscall_64+0x77/0x100
+[   57.202979]  entry_SYSCALL_64_after_hwframe+0x6e/0x76
+[   57.202982] RIP: 0033:0x7fe2b12e4a94
+[   57.202985] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d d5 18 0e 00 00 74 13 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 44 c3 0f 1f 00 48 83 ec 18 89 7c 24 0c e8 c3
+[   57.202987] RSP: 002b:00007ffe857ddb38 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
+[   57.202989] RAX: ffffffffffffffda RBX: 00007ffe857dfd68 RCX: 00007fe2b12e4a94
+[   57.202991] RDX: 0000000000002000 RSI: 00007ffe857ddc40 RDI: 0000000000000003
+[   57.202992] RBP: 00007ffe857dfc50 R08: 7fffffffffffffff R09: 0000000065650f49
+[   57.202993] R10: 00007fe2b11f8300 R11: 0000000000000202 R12: 0000000000000000
+[   57.202994] R13: 00007ffe857dfd80 R14: 00007fe2b1445000 R15: 0000000000000000
+[   57.202999]  </TASK>
+
+The problem seems to be that two out of three callers aren't taking the
+rcu_read_lock() before calling the list_for_each_entry_rcu() function in
+rpc_xprt_switch_has_addr(). I fix this by having
+rpc_xprt_switch_has_addr() unconditionaly take the rcu_read_lock(),
+which is okay to do recursively in the case that the lock has already
+been taken by a caller.
+
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xprtmultipath.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/net/sunrpc/xprtmultipath.c b/net/sunrpc/xprtmultipath.c
+index 74ee2271251e..720d3ba742ec 100644
+--- a/net/sunrpc/xprtmultipath.c
++++ b/net/sunrpc/xprtmultipath.c
+@@ -336,8 +336,9 @@ struct rpc_xprt *xprt_iter_current_entry_offline(struct rpc_xprt_iter *xpi)
+ 			xprt_switch_find_current_entry_offline);
+ }
+ 
+-bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps,
+-			      const struct sockaddr *sap)
++static
++bool __rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps,
++				const struct sockaddr *sap)
+ {
+ 	struct list_head *head;
+ 	struct rpc_xprt *pos;
+@@ -356,6 +357,18 @@ bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps,
+ 	return false;
+ }
+ 
++bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps,
++			      const struct sockaddr *sap)
++{
++	bool res;
++
++	rcu_read_lock();
++	res = __rpc_xprt_switch_has_addr(xps, sap);
++	rcu_read_unlock();
++
++	return res;
++}
++
+ static
+ struct rpc_xprt *xprt_switch_find_next_entry(struct list_head *head,
+ 		const struct rpc_xprt *cur, bool check_active)
+-- 
+2.43.0
+
diff --git a/queue-6.1/tty-allow-tiocslcktrmios-with-cap_checkpoint_restore.patch b/queue-6.1/tty-allow-tiocslcktrmios-with-cap_checkpoint_restore.patch
new file mode 100644
index 00000000000..d8278813d7e
--- /dev/null
+++ b/queue-6.1/tty-allow-tiocslcktrmios-with-cap_checkpoint_restore.patch
@@ -0,0 +1,63 @@
+From b78ef17738671f6d77ef585882f8b8e5cf7d9283 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Dec 2023 15:36:56 +0100
+Subject: tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE
+
+From: Adrian Reber <areber@redhat.com>
+
+[ Upstream commit e0f25b8992345aa5f113da2815f5add98738c611 ]
+
+The capability CAP_CHECKPOINT_RESTORE was introduced to allow non-root
+users to checkpoint and restore processes as non-root with CRIU.
+
+This change extends CAP_CHECKPOINT_RESTORE to enable the CRIU option
+'--shell-job' as non-root. CRIU's man-page describes the '--shell-job'
+option like this:
+
+  Allow one to dump shell jobs. This implies the restored task will
+  inherit session and process group ID from the criu itself. This option
+  also allows to migrate a single external tty connection, to migrate
+  applications like top.
+
+TIOCSLCKTRMIOS can only be done if the process has CAP_SYS_ADMIN and
+this change extends it to CAP_SYS_ADMIN or CAP_CHECKPOINT_RESTORE.
+
+With this change it is possible to checkpoint and restore processes
+which have a tty connection as non-root if CAP_CHECKPOINT_RESTORE is
+set.
+
+Acked-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Adrian Reber <areber@redhat.com>
+Acked-by: Andrei Vagin <avagin@gmail.com>
+Link: https://lore.kernel.org/r/20231208143656.1019-1-areber@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/tty_ioctl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c
+index 8767c504b95d..9d3b237304ea 100644
+--- a/drivers/tty/tty_ioctl.c
++++ b/drivers/tty/tty_ioctl.c
+@@ -859,7 +859,7 @@ int tty_mode_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg)
+ 			ret = -EFAULT;
+ 		return ret;
+ 	case TIOCSLCKTRMIOS:
+-		if (!capable(CAP_SYS_ADMIN))
++		if (!checkpoint_restore_ns_capable(&init_user_ns))
+ 			return -EPERM;
+ 		copy_termios_locked(real_tty, &kterm);
+ 		if (user_termios_to_kernel_termios(&kterm,
+@@ -876,7 +876,7 @@ int tty_mode_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg)
+ 			ret = -EFAULT;
+ 		return ret;
+ 	case TIOCSLCKTRMIOS:
+-		if (!capable(CAP_SYS_ADMIN))
++		if (!checkpoint_restore_ns_capable(&init_user_ns))
+ 			return -EPERM;
+ 		copy_termios_locked(real_tty, &kterm);
+ 		if (user_termios_to_kernel_termios_1(&kterm,
+-- 
+2.43.0
+
diff --git a/queue-6.1/ubsan-array-index-out-of-bounds-in-dtsplitroot.patch b/queue-6.1/ubsan-array-index-out-of-bounds-in-dtsplitroot.patch
new file mode 100644
index 00000000000..ed37e48f9a8
--- /dev/null
+++ b/queue-6.1/ubsan-array-index-out-of-bounds-in-dtsplitroot.patch
@@ -0,0 +1,77 @@
+From 8a3a2ffbf6f416a4651e41abdccb6aae24875862 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Oct 2023 00:10:28 +0500
+Subject: UBSAN: array-index-out-of-bounds in dtSplitRoot
+
+From: Osama Muhammad <osmtendev@gmail.com>
+
+[ Upstream commit 27e56f59bab5ddafbcfe69ad7a4a6ea1279c1b16 ]
+
+Syzkaller reported the following issue:
+
+oop0: detected capacity change from 0 to 32768
+
+UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1971:9
+index -2 is out of range for type 'struct dtslot [128]'
+CPU: 0 PID: 3613 Comm: syz-executor270 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106
+ ubsan_epilogue lib/ubsan.c:151 [inline]
+ __ubsan_handle_out_of_bounds+0xdb/0x130 lib/ubsan.c:283
+ dtSplitRoot+0x8d8/0x1900 fs/jfs/jfs_dtree.c:1971
+ dtSplitUp fs/jfs/jfs_dtree.c:985 [inline]
+ dtInsert+0x1189/0x6b80 fs/jfs/jfs_dtree.c:863
+ jfs_mkdir+0x757/0xb00 fs/jfs/namei.c:270
+ vfs_mkdir+0x3b3/0x590 fs/namei.c:4013
+ do_mkdirat+0x279/0x550 fs/namei.c:4038
+ __do_sys_mkdirat fs/namei.c:4053 [inline]
+ __se_sys_mkdirat fs/namei.c:4051 [inline]
+ __x64_sys_mkdirat+0x85/0x90 fs/namei.c:4051
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+RIP: 0033:0x7fcdc0113fd9
+Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
+RSP: 002b:00007ffeb8bc67d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
+RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcdc0113fd9
+RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000003
+RBP: 00007fcdc00d37a0 R08: 0000000000000000 R09: 00007fcdc00d37a0
+R10: 00005555559a72c0 R11: 0000000000000246 R12: 00000000f8008000
+R13: 0000000000000000 R14: 00083878000000f8 R15: 0000000000000000
+ </TASK>
+
+The issue is caused when the value of fsi becomes less than -1.
+The check to break the loop when fsi value becomes -1 is present
+but syzbot was able to produce value less than -1 which cause the error.
+This patch simply add the change for the values less than 0.
+
+The patch is tested via syzbot.
+
+Reported-and-tested-by: syzbot+d4b1df2e9d4ded6488ec@syzkaller.appspotmail.com
+Link: https://syzkaller.appspot.com/bug?extid=d4b1df2e9d4ded6488ec
+Signed-off-by: Osama Muhammad <osmtendev@gmail.com>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_dtree.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
+index 92b7c533407c..f3d3e8b3f50c 100644
+--- a/fs/jfs/jfs_dtree.c
++++ b/fs/jfs/jfs_dtree.c
+@@ -1970,7 +1970,7 @@ static int dtSplitRoot(tid_t tid,
+ 		do {
+ 			f = &rp->slot[fsi];
+ 			fsi = f->next;
+-		} while (fsi != -1);
++		} while (fsi >= 0);
+ 
+ 		f->next = n;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.1/um-don-t-use-vfprintf-for-os_info.patch b/queue-6.1/um-don-t-use-vfprintf-for-os_info.patch
new file mode 100644
index 00000000000..a447f7bbd0e
--- /dev/null
+++ b/queue-6.1/um-don-t-use-vfprintf-for-os_info.patch
@@ -0,0 +1,72 @@
+From d2174a9f5999254cd191071ce1fd88bf600cef51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Nov 2023 12:03:41 +0100
+Subject: um: Don't use vfprintf() for os_info()
+
+From: Benjamin Berg <benjamin@sipsolutions.net>
+
+[ Upstream commit 236f9fe39b02c15fa5530b53e9cca48354394389 ]
+
+The threads allocated inside the kernel have only a single page of
+stack. Unfortunately, the vfprintf function in standard glibc may use
+too much stack-space, overflowing it.
+
+To make os_info safe to be used by helper threads, use the kernel
+vscnprintf function into a smallish buffer and write out the information
+to stderr.
+
+Signed-off-by: Benjamin Berg <benjamin@sipsolutions.net>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/os-Linux/util.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/arch/um/os-Linux/util.c b/arch/um/os-Linux/util.c
+index fc0f2a9dee5a..1dca4ffbd572 100644
+--- a/arch/um/os-Linux/util.c
++++ b/arch/um/os-Linux/util.c
+@@ -173,23 +173,38 @@ __uml_setup("quiet", quiet_cmd_param,
+ "quiet\n"
+ "    Turns off information messages during boot.\n\n");
+ 
++/*
++ * The os_info/os_warn functions will be called by helper threads. These
++ * have a very limited stack size and using the libc formatting functions
++ * may overflow the stack.
++ * So pull in the kernel vscnprintf and use that instead with a fixed
++ * on-stack buffer.
++ */
++int vscnprintf(char *buf, size_t size, const char *fmt, va_list args);
++
+ void os_info(const char *fmt, ...)
+ {
++	char buf[256];
+ 	va_list list;
++	int len;
+ 
+ 	if (quiet_info)
+ 		return;
+ 
+ 	va_start(list, fmt);
+-	vfprintf(stderr, fmt, list);
++	len = vscnprintf(buf, sizeof(buf), fmt, list);
++	fwrite(buf, len, 1, stderr);
+ 	va_end(list);
+ }
+ 
+ void os_warn(const char *fmt, ...)
+ {
++	char buf[256];
+ 	va_list list;
++	int len;
+ 
+ 	va_start(list, fmt);
+-	vfprintf(stderr, fmt, list);
++	len = vscnprintf(buf, sizeof(buf), fmt, list);
++	fwrite(buf, len, 1, stderr);
+ 	va_end(list);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.1/um-fix-naming-clash-between-uml-and-scheduler.patch b/queue-6.1/um-fix-naming-clash-between-uml-and-scheduler.patch
new file mode 100644
index 00000000000..773002116f2
--- /dev/null
+++ b/queue-6.1/um-fix-naming-clash-between-uml-and-scheduler.patch
@@ -0,0 +1,82 @@
+From 455a55a13eb4e89f8cdd6336e8499710e60a78b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Sep 2023 15:34:44 +0100
+Subject: um: Fix naming clash between UML and scheduler
+
+From: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+
+[ Upstream commit 541d4e4d435c8b9bfd29f70a1da4a2db97794e0a ]
+
+__cant_sleep was already used and exported by the scheduler.
+The name had to be changed to a UML specific one.
+
+Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+Reviewed-by: Peter Lafreniere <peter@n8pjl.ca>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/include/shared/kern_util.h | 2 +-
+ arch/um/kernel/process.c           | 2 +-
+ arch/um/os-Linux/helper.c          | 6 +++---
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/um/include/shared/kern_util.h b/arch/um/include/shared/kern_util.h
+index d8b8b4f07e42..444bae755b16 100644
+--- a/arch/um/include/shared/kern_util.h
++++ b/arch/um/include/shared/kern_util.h
+@@ -50,7 +50,7 @@ extern void do_uml_exitcalls(void);
+  * Are we disallowed to sleep? Used to choose between GFP_KERNEL and
+  * GFP_ATOMIC.
+  */
+-extern int __cant_sleep(void);
++extern int __uml_cant_sleep(void);
+ extern int get_current_pid(void);
+ extern int copy_from_user_proc(void *to, void *from, int size);
+ extern char *uml_strdup(const char *string);
+diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
+index 010bc422a09d..a351c87db248 100644
+--- a/arch/um/kernel/process.c
++++ b/arch/um/kernel/process.c
+@@ -220,7 +220,7 @@ void arch_cpu_idle(void)
+ 	raw_local_irq_enable();
+ }
+ 
+-int __cant_sleep(void) {
++int __uml_cant_sleep(void) {
+ 	return in_atomic() || irqs_disabled() || in_interrupt();
+ 	/* Is in_interrupt() really needed? */
+ }
+diff --git a/arch/um/os-Linux/helper.c b/arch/um/os-Linux/helper.c
+index b459745f52e2..3cb8ac63be6e 100644
+--- a/arch/um/os-Linux/helper.c
++++ b/arch/um/os-Linux/helper.c
+@@ -46,7 +46,7 @@ int run_helper(void (*pre_exec)(void *), void *pre_data, char **argv)
+ 	unsigned long stack, sp;
+ 	int pid, fds[2], ret, n;
+ 
+-	stack = alloc_stack(0, __cant_sleep());
++	stack = alloc_stack(0, __uml_cant_sleep());
+ 	if (stack == 0)
+ 		return -ENOMEM;
+ 
+@@ -70,7 +70,7 @@ int run_helper(void (*pre_exec)(void *), void *pre_data, char **argv)
+ 	data.pre_data = pre_data;
+ 	data.argv = argv;
+ 	data.fd = fds[1];
+-	data.buf = __cant_sleep() ? uml_kmalloc(PATH_MAX, UM_GFP_ATOMIC) :
++	data.buf = __uml_cant_sleep() ? uml_kmalloc(PATH_MAX, UM_GFP_ATOMIC) :
+ 					uml_kmalloc(PATH_MAX, UM_GFP_KERNEL);
+ 	pid = clone(helper_child, (void *) sp, CLONE_VM, &data);
+ 	if (pid < 0) {
+@@ -121,7 +121,7 @@ int run_helper_thread(int (*proc)(void *), void *arg, unsigned int flags,
+ 	unsigned long stack, sp;
+ 	int pid, status, err;
+ 
+-	stack = alloc_stack(0, __cant_sleep());
++	stack = alloc_stack(0, __uml_cant_sleep());
+ 	if (stack == 0)
+ 		return -ENOMEM;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/um-net-fix-return-type-of-uml_net_start_xmit.patch b/queue-6.1/um-net-fix-return-type-of-uml_net_start_xmit.patch
new file mode 100644
index 00000000000..0a687fb0a6b
--- /dev/null
+++ b/queue-6.1/um-net-fix-return-type-of-uml_net_start_xmit.patch
@@ -0,0 +1,53 @@
+From 452427e9004753336d9dd4b7ccd8ffbe20fb68f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Dec 2023 09:49:46 -0700
+Subject: um: net: Fix return type of uml_net_start_xmit()
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit 7d748f60a4b82b50bf25fad1bd42d33f049f76aa ]
+
+With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG),
+indirect call targets are validated against the expected function
+pointer prototype to make sure the call target is valid to help mitigate
+ROP attacks. If they are not identical, there is a failure at run time,
+which manifests as either a kernel panic or thread getting killed. A
+warning in clang aims to catch these at compile time, which reveals:
+
+  arch/um/drivers/net_kern.c:353:21: warning: incompatible function pointer types initializing 'netdev_tx_t (*)(struct sk_buff *, struct net_device *)' (aka 'enum netdev_tx (*)(struct sk_buff *, struct net_device *)') with an expression of type 'int (struct sk_buff *, struct net_device *)' [-Wincompatible-function-pointer-types-strict]
+    353 |         .ndo_start_xmit         = uml_net_start_xmit,
+        |                                   ^~~~~~~~~~~~~~~~~~
+  1 warning generated.
+
+->ndo_start_xmit() in 'struct net_device_ops' expects a return type of
+'netdev_tx_t', not 'int'. Adjust the return type of uml_net_start_xmit()
+to match the prototype's to resolve the warning. While UML does not
+currently implement support for kCFI, it could in the future, which
+means this warning becomes a fatal CFI failure at run time.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202310031340.v1vPh207-lkp@intel.com/
+Acked-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/drivers/net_kern.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/um/drivers/net_kern.c b/arch/um/drivers/net_kern.c
+index 3d7836c46507..cabcc501b448 100644
+--- a/arch/um/drivers/net_kern.c
++++ b/arch/um/drivers/net_kern.c
+@@ -204,7 +204,7 @@ static int uml_net_close(struct net_device *dev)
+ 	return 0;
+ }
+ 
+-static int uml_net_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t uml_net_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ 	struct uml_net_private *lp = netdev_priv(dev);
+ 	unsigned long flags;
+-- 
+2.43.0
+
diff --git a/queue-6.1/um-time-travel-fix-time-corruption.patch b/queue-6.1/um-time-travel-fix-time-corruption.patch
new file mode 100644
index 00000000000..87f0a2692dc
--- /dev/null
+++ b/queue-6.1/um-time-travel-fix-time-corruption.patch
@@ -0,0 +1,93 @@
+From 39e3eefb6d164b00c69935bc607f167e34b91c2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Oct 2023 22:45:05 +0200
+Subject: um: time-travel: fix time corruption
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit abe4eaa8618bb36c2b33e9cdde0499296a23448c ]
+
+In 'basic' time-travel mode (without =inf-cpu or =ext), we
+still get timer interrupts. These can happen at arbitrary
+points in time, i.e. while in timer_read(), which pushes
+time forward just a little bit. Then, if we happen to get
+the interrupt after calculating the new time to push to,
+but before actually finishing that, the interrupt will set
+the time to a value that's incompatible with the forward,
+and we'll crash because time goes backwards when we do the
+forwarding.
+
+Fix this by reading the time_travel_time, calculating the
+adjustment, and doing the adjustment all with interrupts
+disabled.
+
+Reported-by: Vincent Whitchurch <Vincent.Whitchurch@axis.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/kernel/time.c | 32 +++++++++++++++++++++++++++-----
+ 1 file changed, 27 insertions(+), 5 deletions(-)
+
+diff --git a/arch/um/kernel/time.c b/arch/um/kernel/time.c
+index fddd1dec27e6..3e270da6b6f6 100644
+--- a/arch/um/kernel/time.c
++++ b/arch/um/kernel/time.c
+@@ -432,9 +432,29 @@ static void time_travel_update_time(unsigned long long next, bool idle)
+ 	time_travel_del_event(&ne);
+ }
+ 
++static void time_travel_update_time_rel(unsigned long long offs)
++{
++	unsigned long flags;
++
++	/*
++	 * Disable interrupts before calculating the new time so
++	 * that a real timer interrupt (signal) can't happen at
++	 * a bad time e.g. after we read time_travel_time but
++	 * before we've completed updating the time.
++	 */
++	local_irq_save(flags);
++	time_travel_update_time(time_travel_time + offs, false);
++	local_irq_restore(flags);
++}
++
+ void time_travel_ndelay(unsigned long nsec)
+ {
+-	time_travel_update_time(time_travel_time + nsec, false);
++	/*
++	 * Not strictly needed to use _rel() version since this is
++	 * only used in INFCPU/EXT modes, but it doesn't hurt and
++	 * is more readable too.
++	 */
++	time_travel_update_time_rel(nsec);
+ }
+ EXPORT_SYMBOL(time_travel_ndelay);
+ 
+@@ -568,7 +588,11 @@ static void time_travel_set_start(void)
+ #define time_travel_time 0
+ #define time_travel_ext_waiting 0
+ 
+-static inline void time_travel_update_time(unsigned long long ns, bool retearly)
++static inline void time_travel_update_time(unsigned long long ns, bool idle)
++{
++}
++
++static inline void time_travel_update_time_rel(unsigned long long offs)
+ {
+ }
+ 
+@@ -720,9 +744,7 @@ static u64 timer_read(struct clocksource *cs)
+ 		 */
+ 		if (!irqs_disabled() && !in_interrupt() && !in_softirq() &&
+ 		    !time_travel_ext_waiting)
+-			time_travel_update_time(time_travel_time +
+-						TIMER_MULTIPLIER,
+-						false);
++			time_travel_update_time_rel(TIMER_MULTIPLIER);
+ 		return time_travel_time / TIMER_MULTIPLIER;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/usb-hub-add-quirk-to-decrease-in-ep-poll-interval-fo.patch b/queue-6.1/usb-hub-add-quirk-to-decrease-in-ep-poll-interval-fo.patch
new file mode 100644
index 00000000000..89615940a99
--- /dev/null
+++ b/queue-6.1/usb-hub-add-quirk-to-decrease-in-ep-poll-interval-fo.patch
@@ -0,0 +1,98 @@
+From fd43b2db088864c268a24e4daa067a9131a92631 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Dec 2023 19:18:29 +0100
+Subject: usb: hub: Add quirk to decrease IN-ep poll interval for Microchip
+ USB491x hub
+
+From: Hardik Gajjar <hgajjar@de.adit-jv.com>
+
+[ Upstream commit 855d75cf8311fee156fabb5639bb53757ca83dd4 ]
+
+There is a potential delay in notifying Linux USB drivers of downstream
+USB bus activity when connecting a high-speed or superSpeed device via the
+Microchip USB491x hub. This delay is due to the fixed bInterval value of
+12 in the silicon of the Microchip USB491x hub.
+
+Microchip requested to ignore the device descriptor and decrease that
+value to 9 as it was too late to modify that in silicon.
+
+This patch speeds up the USB enummeration process that helps to pass
+Apple Carplay certifications and improve the User experience when utilizing
+the USB device via Microchip Multihost USB491x Hub.
+
+A new hub quirk HUB_QUIRK_REDUCE_FRAME_INTR_BINTERVAL speeds up
+the notification process for Microchip USB491x hub by limiting
+the maximum bInterval value to 9.
+
+Signed-off-by: Hardik Gajjar <hgajjar@de.adit-jv.com>
+Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/20231205181829.127353-2-hgajjar@de.adit-jv.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/core/hub.c | 29 +++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 9163fd5af046..4f181110d00d 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -47,12 +47,18 @@
+ #define USB_VENDOR_TEXAS_INSTRUMENTS		0x0451
+ #define USB_PRODUCT_TUSB8041_USB3		0x8140
+ #define USB_PRODUCT_TUSB8041_USB2		0x8142
++#define USB_VENDOR_MICROCHIP			0x0424
++#define USB_PRODUCT_USB4913			0x4913
++#define USB_PRODUCT_USB4914			0x4914
++#define USB_PRODUCT_USB4915			0x4915
+ #define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND	BIT(0)
+ #define HUB_QUIRK_DISABLE_AUTOSUSPEND		BIT(1)
++#define HUB_QUIRK_REDUCE_FRAME_INTR_BINTERVAL	BIT(2)
+ 
+ #define USB_TP_TRANSMISSION_DELAY	40	/* ns */
+ #define USB_TP_TRANSMISSION_DELAY_MAX	65535	/* ns */
+ #define USB_PING_RESPONSE_TIME		400	/* ns */
++#define USB_REDUCE_FRAME_INTR_BINTERVAL	9
+ 
+ /* Protect struct usb_device->state and ->children members
+  * Note: Both are also protected by ->dev.sem, except that ->state can
+@@ -1904,6 +1910,14 @@ static int hub_probe(struct usb_interface *intf, const struct usb_device_id *id)
+ 		usb_autopm_get_interface_no_resume(intf);
+ 	}
+ 
++	if ((id->driver_info & HUB_QUIRK_REDUCE_FRAME_INTR_BINTERVAL) &&
++	    desc->endpoint[0].desc.bInterval > USB_REDUCE_FRAME_INTR_BINTERVAL) {
++		desc->endpoint[0].desc.bInterval =
++			USB_REDUCE_FRAME_INTR_BINTERVAL;
++		/* Tell the HCD about the interrupt ep's new bInterval */
++		usb_set_interface(hdev, 0, 0);
++	}
++
+ 	if (hub_configure(hub, &desc->endpoint[0].desc) >= 0) {
+ 		onboard_hub_create_pdevs(hdev, &hub->onboard_hub_devs);
+ 
+@@ -5885,6 +5899,21 @@ static const struct usb_device_id hub_id_table[] = {
+       .idVendor = USB_VENDOR_TEXAS_INSTRUMENTS,
+       .idProduct = USB_PRODUCT_TUSB8041_USB3,
+       .driver_info = HUB_QUIRK_DISABLE_AUTOSUSPEND},
++	{ .match_flags = USB_DEVICE_ID_MATCH_VENDOR
++			| USB_DEVICE_ID_MATCH_PRODUCT,
++	  .idVendor = USB_VENDOR_MICROCHIP,
++	  .idProduct = USB_PRODUCT_USB4913,
++	  .driver_info = HUB_QUIRK_REDUCE_FRAME_INTR_BINTERVAL},
++	{ .match_flags = USB_DEVICE_ID_MATCH_VENDOR
++			| USB_DEVICE_ID_MATCH_PRODUCT,
++	  .idVendor = USB_VENDOR_MICROCHIP,
++	  .idProduct = USB_PRODUCT_USB4914,
++	  .driver_info = HUB_QUIRK_REDUCE_FRAME_INTR_BINTERVAL},
++	{ .match_flags = USB_DEVICE_ID_MATCH_VENDOR
++			| USB_DEVICE_ID_MATCH_PRODUCT,
++	  .idVendor = USB_VENDOR_MICROCHIP,
++	  .idProduct = USB_PRODUCT_USB4915,
++	  .driver_info = HUB_QUIRK_REDUCE_FRAME_INTR_BINTERVAL},
+     { .match_flags = USB_DEVICE_ID_MATCH_DEV_CLASS,
+       .bDeviceClass = USB_CLASS_HUB},
+     { .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS,
+-- 
+2.43.0
+
diff --git a/queue-6.1/usb-hub-replace-hardcoded-quirk-value-with-bit-macro.patch b/queue-6.1/usb-hub-replace-hardcoded-quirk-value-with-bit-macro.patch
new file mode 100644
index 00000000000..91b2ef1cc6b
--- /dev/null
+++ b/queue-6.1/usb-hub-replace-hardcoded-quirk-value-with-bit-macro.patch
@@ -0,0 +1,39 @@
+From 2c23f8e00206418e4d7dc0bad1230cdfefcd9b83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Dec 2023 19:18:28 +0100
+Subject: usb: hub: Replace hardcoded quirk value with BIT() macro
+
+From: Hardik Gajjar <hgajjar@de.adit-jv.com>
+
+[ Upstream commit 6666ea93d2c422ebeb8039d11e642552da682070 ]
+
+This patch replaces the hardcoded quirk value in the macro with
+BIT().
+
+Signed-off-by: Hardik Gajjar <hgajjar@de.adit-jv.com>
+Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/20231205181829.127353-1-hgajjar@de.adit-jv.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/core/hub.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 81c8f564cf87..9163fd5af046 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -47,8 +47,8 @@
+ #define USB_VENDOR_TEXAS_INSTRUMENTS		0x0451
+ #define USB_PRODUCT_TUSB8041_USB3		0x8140
+ #define USB_PRODUCT_TUSB8041_USB2		0x8142
+-#define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND	0x01
+-#define HUB_QUIRK_DISABLE_AUTOSUSPEND		0x02
++#define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND	BIT(0)
++#define HUB_QUIRK_DISABLE_AUTOSUSPEND		BIT(1)
+ 
+ #define USB_TP_TRANSMISSION_DELAY	40	/* ns */
+ #define USB_TP_TRANSMISSION_DELAY_MAX	65535	/* ns */
+-- 
+2.43.0
+
diff --git a/queue-6.1/virtio_net-fix-d-directive-writing-between-1-and-11-.patch b/queue-6.1/virtio_net-fix-d-directive-writing-between-1-and-11-.patch
new file mode 100644
index 00000000000..a58e0cc014e
--- /dev/null
+++ b/queue-6.1/virtio_net-fix-d-directive-writing-between-1-and-11-.patch
@@ -0,0 +1,84 @@
+From a6fefbfef8b7fb6ca7004d4c904c609a3b41ae68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jan 2024 10:09:02 +0800
+Subject: =?UTF-8?q?virtio=5Fnet:=20Fix=20"=E2=80=98%d=E2=80=99=20directive?=
+ =?UTF-8?q?=20writing=20between=201=20and=2011=20bytes=20into=20a=20region?=
+ =?UTF-8?q?=20of=20size=2010"=20warnings?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Zhu Yanjun <yanjun.zhu@linux.dev>
+
+[ Upstream commit e3fe8d28c67bf6c291e920c6d04fa22afa14e6e4 ]
+
+Fix the warnings when building virtio_net driver.
+
+"
+drivers/net/virtio_net.c: In function ‘init_vqs’:
+drivers/net/virtio_net.c:4551:48: warning: ‘%d’ directive writing between 1 and 11 bytes into a region of size 10 [-Wformat-overflow=]
+ 4551 |                 sprintf(vi->rq[i].name, "input.%d", i);
+      |                                                ^~
+In function ‘virtnet_find_vqs’,
+    inlined from ‘init_vqs’ at drivers/net/virtio_net.c:4645:8:
+drivers/net/virtio_net.c:4551:41: note: directive argument in the range [-2147483643, 65534]
+ 4551 |                 sprintf(vi->rq[i].name, "input.%d", i);
+      |                                         ^~~~~~~~~~
+drivers/net/virtio_net.c:4551:17: note: ‘sprintf’ output between 8 and 18 bytes into a destination of size 16
+ 4551 |                 sprintf(vi->rq[i].name, "input.%d", i);
+      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/net/virtio_net.c: In function ‘init_vqs’:
+drivers/net/virtio_net.c:4552:49: warning: ‘%d’ directive writing between 1 and 11 bytes into a region of size 9 [-Wformat-overflow=]
+ 4552 |                 sprintf(vi->sq[i].name, "output.%d", i);
+      |                                                 ^~
+In function ‘virtnet_find_vqs’,
+    inlined from ‘init_vqs’ at drivers/net/virtio_net.c:4645:8:
+drivers/net/virtio_net.c:4552:41: note: directive argument in the range [-2147483643, 65534]
+ 4552 |                 sprintf(vi->sq[i].name, "output.%d", i);
+      |                                         ^~~~~~~~~~~
+drivers/net/virtio_net.c:4552:17: note: ‘sprintf’ output between 9 and 19 bytes into a destination of size 16
+ 4552 |                 sprintf(vi->sq[i].name, "output.%d", i);
+
+"
+
+Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Link: https://lore.kernel.org/r/20240104020902.2753599-1-yanjun.zhu@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/virtio_net.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 21d3461fb5d1..45f1a871b7da 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -3474,10 +3474,11 @@ static int virtnet_find_vqs(struct virtnet_info *vi)
+ {
+ 	vq_callback_t **callbacks;
+ 	struct virtqueue **vqs;
+-	int ret = -ENOMEM;
+-	int i, total_vqs;
+ 	const char **names;
++	int ret = -ENOMEM;
++	int total_vqs;
+ 	bool *ctx;
++	u16 i;
+ 
+ 	/* We expect 1 RX virtqueue followed by 1 TX virtqueue, followed by
+ 	 * possible N-1 RX/TX queue pairs used in multiqueue mode, followed by
+@@ -3514,8 +3515,8 @@ static int virtnet_find_vqs(struct virtnet_info *vi)
+ 	for (i = 0; i < vi->max_queue_pairs; i++) {
+ 		callbacks[rxq2vq(i)] = skb_recv_done;
+ 		callbacks[txq2vq(i)] = skb_xmit_done;
+-		sprintf(vi->rq[i].name, "input.%d", i);
+-		sprintf(vi->sq[i].name, "output.%d", i);
++		sprintf(vi->rq[i].name, "input.%u", i);
++		sprintf(vi->sq[i].name, "output.%u", i);
+ 		names[rxq2vq(i)] = vi->rq[i].name;
+ 		names[txq2vq(i)] = vi->sq[i].name;
+ 		if (ctx)
+-- 
+2.43.0
+
diff --git a/queue-6.1/watchdog-it87_wdt-keep-wdtctrl-bit-3-unmodified-for-.patch b/queue-6.1/watchdog-it87_wdt-keep-wdtctrl-bit-3-unmodified-for-.patch
new file mode 100644
index 00000000000..a517d129688
--- /dev/null
+++ b/queue-6.1/watchdog-it87_wdt-keep-wdtctrl-bit-3-unmodified-for-.patch
@@ -0,0 +1,71 @@
+From 01010d89b8256c42232972a55ea0e69ea0213527 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Dec 2023 10:45:25 +0100
+Subject: watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786
+
+From: Werner Fischer <devlists@wefi.net>
+
+[ Upstream commit d12971849d71781c1e4ffd1117d4878ce233d319 ]
+
+WDTCTRL bit 3 sets the mode choice for the clock input of IT8784/IT8786.
+Some motherboards require this bit to be set to 1 (= PCICLK mode),
+otherwise the watchdog functionality gets broken. The BIOS of those
+motherboards sets WDTCTRL bit 3 already to 1.
+
+Instead of setting all bits of WDTCTRL to 0 by writing 0x00 to it, keep
+bit 3 of it unchanged for IT8784/IT8786 chips. In this way, bit 3 keeps
+the status as set by the BIOS of the motherboard.
+
+Watchdog tests have been successful with this patch with the following
+systems:
+  IT8784: Thomas-Krenn LES plus v2 (YANLING YL-KBRL2 V2)
+  IT8786: Thomas-Krenn LES plus v3 (YANLING YL-CLU L2)
+  IT8786: Thomas-Krenn LES network 6L v2 (YANLING YL-CLU6L)
+
+Link: https://lore.kernel.org/all/140b264d-341f-465b-8715-dacfe84b3f71@roeck-us.net/
+
+Signed-off-by: Werner Fischer <devlists@wefi.net>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20231213094525.11849-4-devlists@wefi.net
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/it87_wdt.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/watchdog/it87_wdt.c b/drivers/watchdog/it87_wdt.c
+index bb1122909396..843f9f8e3917 100644
+--- a/drivers/watchdog/it87_wdt.c
++++ b/drivers/watchdog/it87_wdt.c
+@@ -255,6 +255,7 @@ static struct watchdog_device wdt_dev = {
+ static int __init it87_wdt_init(void)
+ {
+ 	u8  chip_rev;
++	u8 ctrl;
+ 	int rc;
+ 
+ 	rc = superio_enter();
+@@ -313,7 +314,18 @@ static int __init it87_wdt_init(void)
+ 
+ 	superio_select(GPIO);
+ 	superio_outb(WDT_TOV1, WDTCFG);
+-	superio_outb(0x00, WDTCTRL);
++
++	switch (chip_type) {
++	case IT8784_ID:
++	case IT8786_ID:
++		ctrl = superio_inb(WDTCTRL);
++		ctrl &= 0x08;
++		superio_outb(ctrl, WDTCTRL);
++		break;
++	default:
++		superio_outb(0x00, WDTCTRL);
++	}
++
+ 	superio_exit();
+ 
+ 	if (timeout < 1 || timeout > max_units * 60) {
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-ath11k-fix-race-due-to-setting-ath11k_flag_ext_.patch b/queue-6.1/wifi-ath11k-fix-race-due-to-setting-ath11k_flag_ext_.patch
new file mode 100644
index 00000000000..e9cdc6ad6ac
--- /dev/null
+++ b/queue-6.1/wifi-ath11k-fix-race-due-to-setting-ath11k_flag_ext_.patch
@@ -0,0 +1,75 @@
+From 42697c3260af679bb6a5c40a51362f57052234b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Nov 2023 08:39:19 +0800
+Subject: wifi: ath11k: fix race due to setting ATH11K_FLAG_EXT_IRQ_ENABLED too
+ early
+
+From: Baochen Qiang <quic_bqiang@quicinc.com>
+
+[ Upstream commit 5082b3e3027eae393a4e86874bffb4ce3f83c26e ]
+
+We are seeing below error randomly in the case where only
+one MSI vector is configured:
+
+kernel: ath11k_pci 0000:03:00.0: wmi command 16387 timeout
+
+The reason is, currently, in ath11k_pcic_ext_irq_enable(),
+ATH11K_FLAG_EXT_IRQ_ENABLED is set before NAPI is enabled.
+This results in a race condition: after
+ATH11K_FLAG_EXT_IRQ_ENABLED is set but before NAPI enabled,
+CE interrupt breaks in. Since IRQ is shared by CE and data
+path, ath11k_pcic_ext_interrupt_handler() is also called
+where we call disable_irq_nosync() to disable IRQ. Then
+napi_schedule() is called but it does nothing because NAPI
+is not enabled at that time, meaning
+ath11k_pcic_ext_grp_napi_poll() will never run, so we have
+no chance to call enable_irq() to enable IRQ back. Finally
+we get above error.
+
+Fix it by setting ATH11K_FLAG_EXT_IRQ_ENABLED after all
+NAPI and IRQ work are done. With the fix, we are sure that
+by the time ATH11K_FLAG_EXT_IRQ_ENABLED is set, NAPI is
+enabled.
+
+Note that the fix above also introduce some side effects:
+if ath11k_pcic_ext_interrupt_handler() breaks in after NAPI
+enabled but before ATH11K_FLAG_EXT_IRQ_ENABLED set, nothing
+will be done by the handler this time, the work will be
+postponed till the next time the IRQ fires.
+
+Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23
+
+Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
+Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20231117003919.26218-1-quic_bqiang@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/pcic.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/pcic.c b/drivers/net/wireless/ath/ath11k/pcic.c
+index 380f9d37b644..e3b65efcc868 100644
+--- a/drivers/net/wireless/ath/ath11k/pcic.c
++++ b/drivers/net/wireless/ath/ath11k/pcic.c
+@@ -453,8 +453,6 @@ void ath11k_pcic_ext_irq_enable(struct ath11k_base *ab)
+ {
+ 	int i;
+ 
+-	set_bit(ATH11K_FLAG_EXT_IRQ_ENABLED, &ab->dev_flags);
+-
+ 	for (i = 0; i < ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {
+ 		struct ath11k_ext_irq_grp *irq_grp = &ab->ext_irq_grp[i];
+ 
+@@ -465,6 +463,8 @@ void ath11k_pcic_ext_irq_enable(struct ath11k_base *ab)
+ 		}
+ 		ath11k_pcic_ext_grp_enable(irq_grp);
+ 	}
++
++	set_bit(ATH11K_FLAG_EXT_IRQ_ENABLED, &ab->dev_flags);
+ }
+ EXPORT_SYMBOL(ath11k_pcic_ext_irq_enable);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-ath9k-fix-potential-array-index-out-of-bounds-r.patch b/queue-6.1/wifi-ath9k-fix-potential-array-index-out-of-bounds-r.patch
new file mode 100644
index 00000000000..dc34e10de0f
--- /dev/null
+++ b/queue-6.1/wifi-ath9k-fix-potential-array-index-out-of-bounds-r.patch
@@ -0,0 +1,61 @@
+From c12fc9af09ac65e7f207b903b7aed4c0bbe190f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 20:31:04 +0200
+Subject: wifi: ath9k: Fix potential array-index-out-of-bounds read in
+ ath9k_htc_txstatus()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
+
+[ Upstream commit 2adc886244dff60f948497b59affb6c6ebb3c348 ]
+
+Fix an array-index-out-of-bounds read in ath9k_htc_txstatus(). The bug
+occurs when txs->cnt, data from a URB provided by a USB device, is
+bigger than the size of the array txs->txstatus, which is
+HTC_MAX_TX_STATUS. WARN_ON() already checks it, but there is no bug
+handling code after the check. Make the function return if that is the
+case.
+
+Found by a modified version of syzkaller.
+
+UBSAN: array-index-out-of-bounds in htc_drv_txrx.c
+index 13 is out of range for type '__wmi_event_txstatus [12]'
+Call Trace:
+ ath9k_htc_txstatus
+ ath9k_wmi_event_tasklet
+ tasklet_action_common
+ __do_softirq
+ irq_exit_rxu
+ sysvec_apic_timer_interrupt
+
+Signed-off-by: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
+Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20231113065756.1491991-1-linuxlovemin@yonsei.ac.kr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+index 672789e3c55d..d6a3f001dacb 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+@@ -652,9 +652,10 @@ void ath9k_htc_txstatus(struct ath9k_htc_priv *priv, void *wmi_event)
+ 	struct ath9k_htc_tx_event *tx_pend;
+ 	int i;
+ 
+-	for (i = 0; i < txs->cnt; i++) {
+-		WARN_ON(txs->cnt > HTC_MAX_TX_STATUS);
++	if (WARN_ON_ONCE(txs->cnt > HTC_MAX_TX_STATUS))
++		return;
+ 
++	for (i = 0; i < txs->cnt; i++) {
+ 		__txs = &txs->txstatus[i];
+ 
+ 		skb = ath9k_htc_tx_get_packet(priv, __txs);
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-cfg80211-fix-rcu-dereference-in-__cfg80211_bss_.patch b/queue-6.1/wifi-cfg80211-fix-rcu-dereference-in-__cfg80211_bss_.patch
new file mode 100644
index 00000000000..bb59b66a1d9
--- /dev/null
+++ b/queue-6.1/wifi-cfg80211-fix-rcu-dereference-in-__cfg80211_bss_.patch
@@ -0,0 +1,38 @@
+From e51bbba7d8a26f0f1a38406ed34f6bc2ddc4f7ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jan 2024 20:13:51 +0800
+Subject: wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update
+
+From: Edward Adam Davis <eadavis@qq.com>
+
+[ Upstream commit 1184950e341c11b6f82bc5b59564411d9537ab27 ]
+
+Replace rcu_dereference() with rcu_access_pointer() since we hold
+the lock here (and aren't in an RCU critical section).
+
+Fixes: 32af9a9e1069 ("wifi: cfg80211: free beacon_ies when overridden from hidden BSS")
+Reported-and-tested-by: syzbot+864a269c27ee06b58374@syzkaller.appspotmail.com
+Signed-off-by: Edward Adam Davis <eadavis@qq.com>
+Link: https://msgid.link/tencent_BF8F0DF0258C8DBF124CDDE4DD8D992DCF07@qq.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/scan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/wireless/scan.c b/net/wireless/scan.c
+index 86906557a04e..3ad4c1032c03 100644
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -1811,7 +1811,7 @@ cfg80211_bss_update(struct cfg80211_registered_device *rdev,
+ 					 &hidden->hidden_list);
+ 				hidden->refcount++;
+ 
+-				ies = (void *)rcu_dereference(new->pub.beacon_ies);
++				ies = (void *)rcu_access_pointer(new->pub.beacon_ies);
+ 				rcu_assign_pointer(new->pub.beacon_ies,
+ 						   hidden->pub.beacon_ies);
+ 				if (ies)
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-cfg80211-free-beacon_ies-when-overridden-from-h.patch b/queue-6.1/wifi-cfg80211-free-beacon_ies-when-overridden-from-h.patch
new file mode 100644
index 00000000000..bd1cb25bb88
--- /dev/null
+++ b/queue-6.1/wifi-cfg80211-free-beacon_ies-when-overridden-from-h.patch
@@ -0,0 +1,44 @@
+From 0a4e95c53406c23403b77ed9b050aa88112d4f00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 13:41:41 +0200
+Subject: wifi: cfg80211: free beacon_ies when overridden from hidden BSS
+
+From: Benjamin Berg <benjamin.berg@intel.com>
+
+[ Upstream commit 32af9a9e1069e55bc02741fb00ac9d0ca1a2eaef ]
+
+This is a more of a cosmetic fix. The branch will only be taken if
+proberesp_ies is set, which implies that beacon_ies is not set unless we
+are connected to an AP that just did a channel switch. And, in that case
+we should have found the BSS in the internal storage to begin with.
+
+Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20231220133549.b898e22dadff.Id8c4c10aedd176ef2e18a4cad747b299f150f9df@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/scan.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/wireless/scan.c b/net/wireless/scan.c
+index b7e1631b3d80..86906557a04e 100644
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -1810,8 +1810,12 @@ cfg80211_bss_update(struct cfg80211_registered_device *rdev,
+ 				list_add(&new->hidden_list,
+ 					 &hidden->hidden_list);
+ 				hidden->refcount++;
++
++				ies = (void *)rcu_dereference(new->pub.beacon_ies);
+ 				rcu_assign_pointer(new->pub.beacon_ies,
+ 						   hidden->pub.beacon_ies);
++				if (ies)
++					kfree_rcu(ies, rcu_head);
+ 			}
+ 		} else {
+ 			/*
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-rt2x00-correct-wrong-bbp-register-in-rxdcoc-cal.patch b/queue-6.1/wifi-rt2x00-correct-wrong-bbp-register-in-rxdcoc-cal.patch
new file mode 100644
index 00000000000..93236e8762f
--- /dev/null
+++ b/queue-6.1/wifi-rt2x00-correct-wrong-bbp-register-in-rxdcoc-cal.patch
@@ -0,0 +1,39 @@
+From 73adab208489f5e28aceafb67c9f5e151a9e3199 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Nov 2023 12:38:51 +0800
+Subject: wifi: rt2x00: correct wrong BBP register in RxDCOC calibration
+
+From: Shiji Yang <yangshiji66@outlook.com>
+
+[ Upstream commit 50da74e1e8b682853d1e07fc8bbe3a0774ae5e09 ]
+
+Refer to Mediatek vendor driver RxDCOC_Calibration() function, when
+performing gainfreeze calibration, we should write register 140
+instead of 141. This fix can reduce the total calibration time from
+6 seconds to 1 second.
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/TYAP286MB0315B13B89DF57B6B27BB854BCAFA@TYAP286MB0315.JPNP286.PROD.OUTLOOK.COM
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+index 12b700c7b9c3..517d9023aae3 100644
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -8672,7 +8672,7 @@ static void rt2800_rxdcoc_calibration(struct rt2x00_dev *rt2x00dev)
+ 	rt2800_rfcsr_write_bank(rt2x00dev, 5, 4, saverfb5r4);
+ 	rt2800_rfcsr_write_bank(rt2x00dev, 7, 4, saverfb7r4);
+ 
+-	rt2800_bbp_write(rt2x00dev, 158, 141);
++	rt2800_bbp_write(rt2x00dev, 158, 140);
+ 	bbpreg = rt2800_bbp_read(rt2x00dev, 159);
+ 	bbpreg = bbpreg & (~0x40);
+ 	rt2800_bbp_write(rt2x00dev, 159, bbpreg);
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-rt2x00-restart-beacon-queue-when-hardware-reset.patch b/queue-6.1/wifi-rt2x00-restart-beacon-queue-when-hardware-reset.patch
new file mode 100644
index 00000000000..e5c298d871b
--- /dev/null
+++ b/queue-6.1/wifi-rt2x00-restart-beacon-queue-when-hardware-reset.patch
@@ -0,0 +1,79 @@
+From 53ce5ce00bd5d444bff3e601f3ec801df82cfc3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Nov 2023 16:58:00 +0800
+Subject: wifi: rt2x00: restart beacon queue when hardware reset
+
+From: Shiji Yang <yangshiji66@outlook.com>
+
+[ Upstream commit a11d965a218f0cd95b13fe44d0bcd8a20ce134a8 ]
+
+When a hardware reset is triggered, all registers are reset, so all
+queues are forced to stop in hardware interface. However, mac80211
+will not automatically stop the queue. If we don't manually stop the
+beacon queue, the queue will be deadlocked and unable to start again.
+This patch fixes the issue where Apple devices cannot connect to the
+AP after calling ieee80211_restart_hw().
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/TYAP286MB031530EB6D98DCE4DF20766CBCA4A@TYAP286MB0315.JPNP286.PROD.OUTLOOK.COM
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2x00dev.c |  3 +++
+ drivers/net/wireless/ralink/rt2x00/rt2x00mac.c | 11 +++++++++++
+ 2 files changed, 14 insertions(+)
+
+diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+index 9a9cfd0ce402..00b945053e19 100644
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+@@ -101,6 +101,7 @@ void rt2x00lib_disable_radio(struct rt2x00_dev *rt2x00dev)
+ 	rt2x00link_stop_tuner(rt2x00dev);
+ 	rt2x00queue_stop_queues(rt2x00dev);
+ 	rt2x00queue_flush_queues(rt2x00dev, true);
++	rt2x00queue_stop_queue(rt2x00dev->bcn);
+ 
+ 	/*
+ 	 * Disable radio.
+@@ -1286,6 +1287,7 @@ int rt2x00lib_start(struct rt2x00_dev *rt2x00dev)
+ 	rt2x00dev->intf_ap_count = 0;
+ 	rt2x00dev->intf_sta_count = 0;
+ 	rt2x00dev->intf_associated = 0;
++	rt2x00dev->intf_beaconing = 0;
+ 
+ 	/* Enable the radio */
+ 	retval = rt2x00lib_enable_radio(rt2x00dev);
+@@ -1312,6 +1314,7 @@ void rt2x00lib_stop(struct rt2x00_dev *rt2x00dev)
+ 	rt2x00dev->intf_ap_count = 0;
+ 	rt2x00dev->intf_sta_count = 0;
+ 	rt2x00dev->intf_associated = 0;
++	rt2x00dev->intf_beaconing = 0;
+ }
+ 
+ static inline void rt2x00lib_set_if_combinations(struct rt2x00_dev *rt2x00dev)
+diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
+index 4202c6517783..75fda72c14ca 100644
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
+@@ -598,6 +598,17 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
+ 	 */
+ 	if (changes & BSS_CHANGED_BEACON_ENABLED) {
+ 		mutex_lock(&intf->beacon_skb_mutex);
++
++		/*
++		 * Clear the 'enable_beacon' flag and clear beacon because
++		 * the beacon queue has been stopped after hardware reset.
++		 */
++		if (test_bit(DEVICE_STATE_RESET, &rt2x00dev->flags) &&
++		    intf->enable_beacon) {
++			intf->enable_beacon = false;
++			rt2x00queue_clear_beacon(rt2x00dev, vif);
++		}
++
+ 		if (!bss_conf->enable_beacon && intf->enable_beacon) {
+ 			rt2x00dev->intf_beaconing--;
+ 			intf->enable_beacon = false;
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-rtl8xxxu-add-additional-usb-ids-for-rtl8192eu-d.patch b/queue-6.1/wifi-rtl8xxxu-add-additional-usb-ids-for-rtl8192eu-d.patch
new file mode 100644
index 00000000000..c1da97ab27f
--- /dev/null
+++ b/queue-6.1/wifi-rtl8xxxu-add-additional-usb-ids-for-rtl8192eu-d.patch
@@ -0,0 +1,48 @@
+From 1cbf598dccc838c278d792a44a0c79cbd0f9691f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Dec 2023 20:30:17 +0800
+Subject: wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices
+
+From: Zenm Chen <zenmchen@gmail.com>
+
+[ Upstream commit 4e87ca403e2008b9e182239e1abbf6876a55eb33 ]
+
+Add additional USB IDs found in the vendor driver from
+https://github.com/Mange/rtl8192eu-linux-driver to support more
+RTL8192EU devices.
+
+Signed-off-by: Zenm Chen <zenmchen@gmail.com>
+Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231217123017.1982-1-zenmchen@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c    | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+index 3a9fa3ff37ac..6dd5ec1e4d8c 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -7030,6 +7030,18 @@ static const struct usb_device_id dev_table[] = {
+ 	.driver_info = (unsigned long)&rtl8192eu_fops},
+ {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_REALTEK, 0x818c, 0xff, 0xff, 0xff),
+ 	.driver_info = (unsigned long)&rtl8192eu_fops},
++/* D-Link DWA-131 rev C1 */
++{USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3312, 0xff, 0xff, 0xff),
++	.driver_info = (unsigned long)&rtl8192eu_fops},
++/* TP-Link TL-WN8200ND V2 */
++{USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x0126, 0xff, 0xff, 0xff),
++	.driver_info = (unsigned long)&rtl8192eu_fops},
++/* Mercusys MW300UM */
++{USB_DEVICE_AND_INTERFACE_INFO(0x2c4e, 0x0100, 0xff, 0xff, 0xff),
++	.driver_info = (unsigned long)&rtl8192eu_fops},
++/* Mercusys MW300UH */
++{USB_DEVICE_AND_INTERFACE_INFO(0x2c4e, 0x0104, 0xff, 0xff, 0xff),
++	.driver_info = (unsigned long)&rtl8192eu_fops},
+ #endif
+ { }
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-rtlwifi-rtl8723-be-ae-using-calculate_bit_shift.patch b/queue-6.1/wifi-rtlwifi-rtl8723-be-ae-using-calculate_bit_shift.patch
new file mode 100644
index 00000000000..6c0c003e97a
--- /dev/null
+++ b/queue-6.1/wifi-rtlwifi-rtl8723-be-ae-using-calculate_bit_shift.patch
@@ -0,0 +1,77 @@
+From 95677ac4b5bf0884645f0f4b97f48a1ded87611f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 14:57:39 +0800
+Subject: wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit 5c16618bc06a41ad68fd8499a21d35ef57ca06c2 ]
+
+Using calculate_bit_shift() to replace rtl8723_phy_calculate_bit_shift().
+And fix an undefined bitwise shift behavior problem.
+
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231219065739.1895666-12-suhui@nfschina.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/rtl8723ae/phy.c | 6 +++---
+ drivers/net/wireless/realtek/rtlwifi/rtl8723be/phy.c | 4 ++--
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/phy.c
+index fe9b407dc2af..71e29b103da5 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/phy.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/phy.c
+@@ -49,7 +49,7 @@ u32 rtl8723e_phy_query_rf_reg(struct ieee80211_hw *hw,
+ 							    rfpath, regaddr);
+ 	}
+ 
+-	bitshift = rtl8723_phy_calculate_bit_shift(bitmask);
++	bitshift = calculate_bit_shift(bitmask);
+ 	readback_value = (original_value & bitmask) >> bitshift;
+ 
+ 	spin_unlock(&rtlpriv->locks.rf_lock);
+@@ -80,7 +80,7 @@ void rtl8723e_phy_set_rf_reg(struct ieee80211_hw *hw,
+ 			original_value = rtl8723_phy_rf_serial_read(hw,
+ 								    rfpath,
+ 								    regaddr);
+-			bitshift = rtl8723_phy_calculate_bit_shift(bitmask);
++			bitshift = calculate_bit_shift(bitmask);
+ 			data =
+ 			    ((original_value & (~bitmask)) |
+ 			     (data << bitshift));
+@@ -89,7 +89,7 @@ void rtl8723e_phy_set_rf_reg(struct ieee80211_hw *hw,
+ 		rtl8723_phy_rf_serial_write(hw, rfpath, regaddr, data);
+ 	} else {
+ 		if (bitmask != RFREG_OFFSET_MASK) {
+-			bitshift = rtl8723_phy_calculate_bit_shift(bitmask);
++			bitshift = calculate_bit_shift(bitmask);
+ 			data =
+ 			    ((original_value & (~bitmask)) |
+ 			     (data << bitshift));
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/phy.c
+index 2b9313cb93db..094cb36153f5 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/phy.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/phy.c
+@@ -41,7 +41,7 @@ u32 rtl8723be_phy_query_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,
+ 	spin_lock(&rtlpriv->locks.rf_lock);
+ 
+ 	original_value = rtl8723_phy_rf_serial_read(hw, rfpath, regaddr);
+-	bitshift = rtl8723_phy_calculate_bit_shift(bitmask);
++	bitshift = calculate_bit_shift(bitmask);
+ 	readback_value = (original_value & bitmask) >> bitshift;
+ 
+ 	spin_unlock(&rtlpriv->locks.rf_lock);
+@@ -68,7 +68,7 @@ void rtl8723be_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path path,
+ 	if (bitmask != RFREG_OFFSET_MASK) {
+ 			original_value = rtl8723_phy_rf_serial_read(hw, path,
+ 								    regaddr);
+-			bitshift = rtl8723_phy_calculate_bit_shift(bitmask);
++			bitshift = calculate_bit_shift(bitmask);
+ 			data = ((original_value & (~bitmask)) |
+ 				(data << bitshift));
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.1/wifi-wfx-fix-possible-null-pointer-dereference-in-wf.patch b/queue-6.1/wifi-wfx-fix-possible-null-pointer-dereference-in-wf.patch
new file mode 100644
index 00000000000..ea08504f3a5
--- /dev/null
+++ b/queue-6.1/wifi-wfx-fix-possible-null-pointer-dereference-in-wf.patch
@@ -0,0 +1,98 @@
+From 206d3e3c4653912a7ff2b8ba818c9189ca63aec2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 20:11:28 +0300
+Subject: wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dmitry Antipov <dmantipov@yandex.ru>
+
+[ Upstream commit fe0a7776d4d19e613bb8dd80fe2d78ae49e8b49d ]
+
+Since 'ieee80211_beacon_get()' can return NULL, 'wfx_set_mfp_ap()'
+should check the return value before examining skb data. So convert
+the latter to return an appropriate error code and propagate it to
+return from 'wfx_start_ap()' as well. Compile tested only.
+
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Tested-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
+Acked-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20231204171130.141394-1-dmantipov@yandex.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/silabs/wfx/sta.c | 42 ++++++++++++++++-----------
+ 1 file changed, 25 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/net/wireless/silabs/wfx/sta.c b/drivers/net/wireless/silabs/wfx/sta.c
+index 626dfb4b7a55..073e870b2641 100644
+--- a/drivers/net/wireless/silabs/wfx/sta.c
++++ b/drivers/net/wireless/silabs/wfx/sta.c
+@@ -354,29 +354,38 @@ static int wfx_upload_ap_templates(struct wfx_vif *wvif)
+ 	return 0;
+ }
+ 
+-static void wfx_set_mfp_ap(struct wfx_vif *wvif)
++static int wfx_set_mfp_ap(struct wfx_vif *wvif)
+ {
+ 	struct ieee80211_vif *vif = wvif_to_vif(wvif);
+ 	struct sk_buff *skb = ieee80211_beacon_get(wvif->wdev->hw, vif, 0);
+ 	const int ieoffset = offsetof(struct ieee80211_mgmt, u.beacon.variable);
+-	const u16 *ptr = (u16 *)cfg80211_find_ie(WLAN_EID_RSN, skb->data + ieoffset,
+-						 skb->len - ieoffset);
+ 	const int pairwise_cipher_suite_count_offset = 8 / sizeof(u16);
+ 	const int pairwise_cipher_suite_size = 4 / sizeof(u16);
+ 	const int akm_suite_size = 4 / sizeof(u16);
++	const u16 *ptr;
+ 
+-	if (ptr) {
+-		ptr += pairwise_cipher_suite_count_offset;
+-		if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb)))
+-			return;
+-		ptr += 1 + pairwise_cipher_suite_size * *ptr;
+-		if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb)))
+-			return;
+-		ptr += 1 + akm_suite_size * *ptr;
+-		if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb)))
+-			return;
+-		wfx_hif_set_mfp(wvif, *ptr & BIT(7), *ptr & BIT(6));
+-	}
++	if (unlikely(!skb))
++		return -ENOMEM;
++
++	ptr = (u16 *)cfg80211_find_ie(WLAN_EID_RSN, skb->data + ieoffset,
++				      skb->len - ieoffset);
++	if (unlikely(!ptr))
++		return -EINVAL;
++
++	ptr += pairwise_cipher_suite_count_offset;
++	if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb)))
++		return -EINVAL;
++
++	ptr += 1 + pairwise_cipher_suite_size * *ptr;
++	if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb)))
++		return -EINVAL;
++
++	ptr += 1 + akm_suite_size * *ptr;
++	if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb)))
++		return -EINVAL;
++
++	wfx_hif_set_mfp(wvif, *ptr & BIT(7), *ptr & BIT(6));
++	return 0;
+ }
+ 
+ int wfx_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+@@ -394,8 +403,7 @@ int wfx_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 	ret = wfx_hif_start(wvif, &vif->bss_conf, wvif->channel);
+ 	if (ret > 0)
+ 		return -EIO;
+-	wfx_set_mfp_ap(wvif);
+-	return ret;
++	return wfx_set_mfp_ap(wvif);
+ }
+ 
+ void wfx_stop_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+-- 
+2.43.0
+
diff --git a/queue-6.1/x86-boot-ignore-nmis-during-very-early-boot.patch b/queue-6.1/x86-boot-ignore-nmis-during-very-early-boot.patch
new file mode 100644
index 00000000000..3e41df615a7
--- /dev/null
+++ b/queue-6.1/x86-boot-ignore-nmis-during-very-early-boot.patch
@@ -0,0 +1,94 @@
+From 4bb36a11a1a1016fd8a42375099e9780bc5219f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 15:44:49 -0500
+Subject: x86/boot: Ignore NMIs during very early boot
+
+From: Jun'ichi Nomura <junichi.nomura@nec.com>
+
+[ Upstream commit 78a509fba9c9b1fcb77f95b7c6be30da3d24823a ]
+
+When there are two racing NMIs on x86, the first NMI invokes NMI handler and
+the 2nd NMI is latched until IRET is executed.
+
+If panic on NMI and panic kexec are enabled, the first NMI triggers
+panic and starts booting the next kernel via kexec. Note that the 2nd
+NMI is still latched. During the early boot of the next kernel, once
+an IRET is executed as a result of a page fault, then the 2nd NMI is
+unlatched and invokes the NMI handler.
+
+However, NMI handler is not set up at the early stage of boot, which
+results in a boot failure.
+
+Avoid such problems by setting up a NOP handler for early NMIs.
+
+[ mingo: Refined the changelog. ]
+
+Signed-off-by: Jun'ichi Nomura <junichi.nomura@nec.com>
+Signed-off-by: Derek Barbosa <debarbos@redhat.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Paul E. McKenney <paulmck@kernel.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/boot/compressed/ident_map_64.c    | 5 +++++
+ arch/x86/boot/compressed/idt_64.c          | 1 +
+ arch/x86/boot/compressed/idt_handlers_64.S | 1 +
+ arch/x86/boot/compressed/misc.h            | 1 +
+ 4 files changed, 8 insertions(+)
+
+diff --git a/arch/x86/boot/compressed/ident_map_64.c b/arch/x86/boot/compressed/ident_map_64.c
+index b4155273df89..d34222816c9f 100644
+--- a/arch/x86/boot/compressed/ident_map_64.c
++++ b/arch/x86/boot/compressed/ident_map_64.c
+@@ -393,3 +393,8 @@ void do_boot_page_fault(struct pt_regs *regs, unsigned long error_code)
+ 	 */
+ 	kernel_add_identity_map(address, end);
+ }
++
++void do_boot_nmi_trap(struct pt_regs *regs, unsigned long error_code)
++{
++	/* Empty handler to ignore NMI during early boot */
++}
+diff --git a/arch/x86/boot/compressed/idt_64.c b/arch/x86/boot/compressed/idt_64.c
+index 3cdf94b41456..d100284bbef4 100644
+--- a/arch/x86/boot/compressed/idt_64.c
++++ b/arch/x86/boot/compressed/idt_64.c
+@@ -61,6 +61,7 @@ void load_stage2_idt(void)
+ 	boot_idt_desc.address = (unsigned long)boot_idt;
+ 
+ 	set_idt_entry(X86_TRAP_PF, boot_page_fault);
++	set_idt_entry(X86_TRAP_NMI, boot_nmi_trap);
+ 
+ #ifdef CONFIG_AMD_MEM_ENCRYPT
+ 	/*
+diff --git a/arch/x86/boot/compressed/idt_handlers_64.S b/arch/x86/boot/compressed/idt_handlers_64.S
+index 22890e199f5b..4d03c8562f63 100644
+--- a/arch/x86/boot/compressed/idt_handlers_64.S
++++ b/arch/x86/boot/compressed/idt_handlers_64.S
+@@ -70,6 +70,7 @@ SYM_FUNC_END(\name)
+ 	.code64
+ 
+ EXCEPTION_HANDLER	boot_page_fault do_boot_page_fault error_code=1
++EXCEPTION_HANDLER	boot_nmi_trap do_boot_nmi_trap error_code=0
+ 
+ #ifdef CONFIG_AMD_MEM_ENCRYPT
+ EXCEPTION_HANDLER	boot_stage1_vc do_vc_no_ghcb		error_code=1
+diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h
+index 20118fb7c53b..a49d9219c06e 100644
+--- a/arch/x86/boot/compressed/misc.h
++++ b/arch/x86/boot/compressed/misc.h
+@@ -190,6 +190,7 @@ static inline void cleanup_exception_handling(void) { }
+ 
+ /* IDT Entry Points */
+ void boot_page_fault(void);
++void boot_nmi_trap(void);
+ void boot_stage1_vc(void);
+ void boot_stage2_vc(void);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/x86-mce-mark-fatal-mce-s-page-as-poison-to-avoid-pan.patch b/queue-6.1/x86-mce-mark-fatal-mce-s-page-as-poison-to-avoid-pan.patch
new file mode 100644
index 00000000000..c2165852de1
--- /dev/null
+++ b/queue-6.1/x86-mce-mark-fatal-mce-s-page-as-poison-to-avoid-pan.patch
@@ -0,0 +1,83 @@
+From 29b5975ce7f52353a4cc382067ff35dfb15e3148 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Oct 2023 08:39:03 +0800
+Subject: x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump
+ kernel
+
+From: Zhiquan Li <zhiquan1.li@intel.com>
+
+[ Upstream commit 9f3b130048bfa2e44a8cfb1b616f826d9d5d8188 ]
+
+Memory errors don't happen very often, especially fatal ones. However,
+in large-scale scenarios such as data centers, that probability
+increases with the amount of machines present.
+
+When a fatal machine check happens, mce_panic() is called based on the
+severity grading of that error. The page containing the error is not
+marked as poison.
+
+However, when kexec is enabled, tools like makedumpfile understand when
+pages are marked as poison and do not touch them so as not to cause
+a fatal machine check exception again while dumping the previous
+kernel's memory.
+
+Therefore, mark the page containing the error as poisoned so that the
+kexec'ed kernel can avoid accessing the page.
+
+  [ bp: Rewrite commit message and comment. ]
+
+Co-developed-by: Youquan Song <youquan.song@intel.com>
+Signed-off-by: Youquan Song <youquan.song@intel.com>
+Signed-off-by: Zhiquan Li <zhiquan1.li@intel.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
+Link: https://lore.kernel.org/r/20231014051754.3759099-1-zhiquan1.li@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/mce/core.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c
+index f1a748da5fab..cad6ea1911e9 100644
+--- a/arch/x86/kernel/cpu/mce/core.c
++++ b/arch/x86/kernel/cpu/mce/core.c
+@@ -44,6 +44,7 @@
+ #include <linux/sync_core.h>
+ #include <linux/task_work.h>
+ #include <linux/hardirq.h>
++#include <linux/kexec.h>
+ 
+ #include <asm/intel-family.h>
+ #include <asm/processor.h>
+@@ -239,6 +240,7 @@ static noinstr void mce_panic(const char *msg, struct mce *final, char *exp)
+ 	struct llist_node *pending;
+ 	struct mce_evt_llist *l;
+ 	int apei_err = 0;
++	struct page *p;
+ 
+ 	/*
+ 	 * Allow instrumentation around external facilities usage. Not that it
+@@ -292,6 +294,20 @@ static noinstr void mce_panic(const char *msg, struct mce *final, char *exp)
+ 	if (!fake_panic) {
+ 		if (panic_timeout == 0)
+ 			panic_timeout = mca_cfg.panic_timeout;
++
++		/*
++		 * Kdump skips the poisoned page in order to avoid
++		 * touching the error bits again. Poison the page even
++		 * if the error is fatal and the machine is about to
++		 * panic.
++		 */
++		if (kexec_crash_loaded()) {
++			if (final && (final->status & MCI_STATUS_ADDRV)) {
++				p = pfn_to_online_page(final->addr >> PAGE_SHIFT);
++				if (p)
++					SetPageHWPoison(p);
++			}
++		}
+ 		panic(msg);
+ 	} else
+ 		pr_emerg(HW_ERR "Fake kernel panic: %s\n", msg);
+-- 
+2.43.0
+
diff --git a/queue-6.1/xen-gntdev-fix-the-abuse-of-underlying-struct-page-i.patch b/queue-6.1/xen-gntdev-fix-the-abuse-of-underlying-struct-page-i.patch
new file mode 100644
index 00000000000..6433e580dd1
--- /dev/null
+++ b/queue-6.1/xen-gntdev-fix-the-abuse-of-underlying-struct-page-i.patch
@@ -0,0 +1,151 @@
+From 038e530651dd86872b9a9422257e2ce3bdda6ad1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Jan 2024 12:34:26 +0200
+Subject: xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
+
+[ Upstream commit 2d2db7d40254d5fb53b11ebd703cd1ed0c5de7a1 ]
+
+DO NOT access the underlying struct page of an sg table exported
+by DMA-buf in dmabuf_imp_to_refs(), this is not allowed.
+Please see drivers/dma-buf/dma-buf.c:mangle_sg_table() for details.
+
+Fortunately, here (for special Xen device) we can avoid using
+pages and calculate gfns directly from dma addresses provided by
+the sg table.
+
+Suggested-by: Daniel Vetter <daniel@ffwll.ch>
+Signed-off-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
+Acked-by: Daniel Vetter <daniel@ffwll.ch>
+Link: https://lore.kernel.org/r/20240107103426.2038075-1-olekstysh@gmail.com
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/gntdev-dmabuf.c | 50 ++++++++++++++++++-------------------
+ 1 file changed, 25 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/xen/gntdev-dmabuf.c b/drivers/xen/gntdev-dmabuf.c
+index 940e5e9e8a54..335451309566 100644
+--- a/drivers/xen/gntdev-dmabuf.c
++++ b/drivers/xen/gntdev-dmabuf.c
+@@ -11,6 +11,7 @@
+ #include <linux/kernel.h>
+ #include <linux/errno.h>
+ #include <linux/dma-buf.h>
++#include <linux/dma-direct.h>
+ #include <linux/slab.h>
+ #include <linux/types.h>
+ #include <linux/uaccess.h>
+@@ -50,7 +51,7 @@ struct gntdev_dmabuf {
+ 
+ 	/* Number of pages this buffer has. */
+ 	int nr_pages;
+-	/* Pages of this buffer. */
++	/* Pages of this buffer (only for dma-buf export). */
+ 	struct page **pages;
+ };
+ 
+@@ -484,7 +485,7 @@ static int dmabuf_exp_from_refs(struct gntdev_priv *priv, int flags,
+ /* DMA buffer import support. */
+ 
+ static int
+-dmabuf_imp_grant_foreign_access(struct page **pages, u32 *refs,
++dmabuf_imp_grant_foreign_access(unsigned long *gfns, u32 *refs,
+ 				int count, int domid)
+ {
+ 	grant_ref_t priv_gref_head;
+@@ -507,7 +508,7 @@ dmabuf_imp_grant_foreign_access(struct page **pages, u32 *refs,
+ 		}
+ 
+ 		gnttab_grant_foreign_access_ref(cur_ref, domid,
+-						xen_page_to_gfn(pages[i]), 0);
++						gfns[i], 0);
+ 		refs[i] = cur_ref;
+ 	}
+ 
+@@ -529,7 +530,6 @@ static void dmabuf_imp_end_foreign_access(u32 *refs, int count)
+ 
+ static void dmabuf_imp_free_storage(struct gntdev_dmabuf *gntdev_dmabuf)
+ {
+-	kfree(gntdev_dmabuf->pages);
+ 	kfree(gntdev_dmabuf->u.imp.refs);
+ 	kfree(gntdev_dmabuf);
+ }
+@@ -549,12 +549,6 @@ static struct gntdev_dmabuf *dmabuf_imp_alloc_storage(int count)
+ 	if (!gntdev_dmabuf->u.imp.refs)
+ 		goto fail;
+ 
+-	gntdev_dmabuf->pages = kcalloc(count,
+-				       sizeof(gntdev_dmabuf->pages[0]),
+-				       GFP_KERNEL);
+-	if (!gntdev_dmabuf->pages)
+-		goto fail;
+-
+ 	gntdev_dmabuf->nr_pages = count;
+ 
+ 	for (i = 0; i < count; i++)
+@@ -576,7 +570,8 @@ dmabuf_imp_to_refs(struct gntdev_dmabuf_priv *priv, struct device *dev,
+ 	struct dma_buf *dma_buf;
+ 	struct dma_buf_attachment *attach;
+ 	struct sg_table *sgt;
+-	struct sg_page_iter sg_iter;
++	struct sg_dma_page_iter sg_iter;
++	unsigned long *gfns;
+ 	int i;
+ 
+ 	dma_buf = dma_buf_get(fd);
+@@ -624,26 +619,31 @@ dmabuf_imp_to_refs(struct gntdev_dmabuf_priv *priv, struct device *dev,
+ 
+ 	gntdev_dmabuf->u.imp.sgt = sgt;
+ 
+-	/* Now convert sgt to array of pages and check for page validity. */
++	gfns = kcalloc(count, sizeof(*gfns), GFP_KERNEL);
++	if (!gfns) {
++		ret = ERR_PTR(-ENOMEM);
++		goto fail_unmap;
++	}
++
++	/*
++	 * Now convert sgt to array of gfns without accessing underlying pages.
++	 * It is not allowed to access the underlying struct page of an sg table
++	 * exported by DMA-buf, but since we deal with special Xen dma device here
++	 * (not a normal physical one) look at the dma addresses in the sg table
++	 * and then calculate gfns directly from them.
++	 */
+ 	i = 0;
+-	for_each_sgtable_page(sgt, &sg_iter, 0) {
+-		struct page *page = sg_page_iter_page(&sg_iter);
+-		/*
+-		 * Check if page is valid: this can happen if we are given
+-		 * a page from VRAM or other resources which are not backed
+-		 * by a struct page.
+-		 */
+-		if (!pfn_valid(page_to_pfn(page))) {
+-			ret = ERR_PTR(-EINVAL);
+-			goto fail_unmap;
+-		}
++	for_each_sgtable_dma_page(sgt, &sg_iter, 0) {
++		dma_addr_t addr = sg_page_iter_dma_address(&sg_iter);
++		unsigned long pfn = bfn_to_pfn(XEN_PFN_DOWN(dma_to_phys(dev, addr)));
+ 
+-		gntdev_dmabuf->pages[i++] = page;
++		gfns[i++] = pfn_to_gfn(pfn);
+ 	}
+ 
+-	ret = ERR_PTR(dmabuf_imp_grant_foreign_access(gntdev_dmabuf->pages,
++	ret = ERR_PTR(dmabuf_imp_grant_foreign_access(gfns,
+ 						      gntdev_dmabuf->u.imp.refs,
+ 						      count, domid));
++	kfree(gfns);
+ 	if (IS_ERR(ret))
+ 		goto fail_end_access;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.1/xhci-fix-possible-null-pointer-deref-during-xhci-urb.patch b/queue-6.1/xhci-fix-possible-null-pointer-deref-during-xhci-urb.patch
new file mode 100644
index 00000000000..0ac00fc00dd
--- /dev/null
+++ b/queue-6.1/xhci-fix-possible-null-pointer-deref-during-xhci-urb.patch
@@ -0,0 +1,98 @@
+From 20c7e1ef816adf0f0b1236e56927c11b856154d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 17:06:47 +0200
+Subject: xhci: fix possible null pointer deref during xhci urb enqueue
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+[ Upstream commit e2e2aacf042f52854c92775b7800ba668e0bdfe4 ]
+
+There is a short gap between urb being submitted and actually added to the
+endpoint queue (linked). If the device is disconnected during this time
+then usb core is not yet aware of the pending urb, and device may be freed
+just before xhci_urq_enqueue() continues, dereferencing the freed device.
+
+Freeing the device is protected by the xhci spinlock, so make sure we take
+and keep the lock while checking that device exists, dereference it, and
+add the urb to the queue.
+
+Remove the unnecessary URB check, usb core checks it before calling
+xhci_urb_enqueue()
+
+Suggested-by: Kuen-Han Tsai <khtsai@google.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20231201150647.1307406-20-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci.c | 40 +++++++++++++++++++++++-----------------
+ 1 file changed, 23 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index c02ad4f76bb3..127fbad32a75 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -1654,24 +1654,7 @@ static int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ 	struct urb_priv	*urb_priv;
+ 	int num_tds;
+ 
+-	if (!urb)
+-		return -EINVAL;
+-	ret = xhci_check_args(hcd, urb->dev, urb->ep,
+-					true, true, __func__);
+-	if (ret <= 0)
+-		return ret ? ret : -EINVAL;
+-
+-	slot_id = urb->dev->slot_id;
+ 	ep_index = xhci_get_endpoint_index(&urb->ep->desc);
+-	ep_state = &xhci->devs[slot_id]->eps[ep_index].ep_state;
+-
+-	if (!HCD_HW_ACCESSIBLE(hcd))
+-		return -ESHUTDOWN;
+-
+-	if (xhci->devs[slot_id]->flags & VDEV_PORT_ERROR) {
+-		xhci_dbg(xhci, "Can't queue urb, port error, link inactive\n");
+-		return -ENODEV;
+-	}
+ 
+ 	if (usb_endpoint_xfer_isoc(&urb->ep->desc))
+ 		num_tds = urb->number_of_packets;
+@@ -1710,12 +1693,35 @@ static int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ 
+ 	spin_lock_irqsave(&xhci->lock, flags);
+ 
++	ret = xhci_check_args(hcd, urb->dev, urb->ep,
++			      true, true, __func__);
++	if (ret <= 0) {
++		ret = ret ? ret : -EINVAL;
++		goto free_priv;
++	}
++
++	slot_id = urb->dev->slot_id;
++
++	if (!HCD_HW_ACCESSIBLE(hcd)) {
++		ret = -ESHUTDOWN;
++		goto free_priv;
++	}
++
++	if (xhci->devs[slot_id]->flags & VDEV_PORT_ERROR) {
++		xhci_dbg(xhci, "Can't queue urb, port error, link inactive\n");
++		ret = -ENODEV;
++		goto free_priv;
++	}
++
+ 	if (xhci->xhc_state & XHCI_STATE_DYING) {
+ 		xhci_dbg(xhci, "Ep 0x%x: URB %p submitted for non-responsive xHCI host.\n",
+ 			 urb->ep->desc.bEndpointAddress, urb);
+ 		ret = -ESHUTDOWN;
+ 		goto free_priv;
+ 	}
++
++	ep_state = &xhci->devs[slot_id]->eps[ep_index].ep_state;
++
+ 	if (*ep_state & (EP_GETTING_STREAMS | EP_GETTING_NO_STREAMS)) {
+ 		xhci_warn(xhci, "WARN: Can't enqueue URB, ep in streams transition state %x\n",
+ 			  *ep_state);
+-- 
+2.43.0
+
-- 
2.47.3