--- /dev/null
+From f21c43e680c875ffda0914501a58a121599e8a36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Sep 2023 13:54:34 -0500
+Subject: Add DMI ID for MSI Bravo 15 B7ED
+
+From: Walt Holman <waltholman09@gmail.com>
+
+[ Upstream commit e616a916fe8431ebd5eb3cf4ac224d143c57083c ]
+
+Signed-off-by: Walt Holman <waltholman09@gmail.com>
+Link: https://lore.kernel.org/r/20230910185433.13677-1-waltholman09@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/yc/acp6x-mach.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c
+index f7ee792bd1be9..ba3094b1e90a0 100644
+--- a/sound/soc/amd/yc/acp6x-mach.c
++++ b/sound/soc/amd/yc/acp6x-mach.c
+@@ -255,6 +255,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "M6500RC"),
+ }
+ },
++ {
++ .driver_data = &acp6x_card,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "Micro-Star International Co., Ltd."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Bravo 15 B7ED"),
++ }
++ },
+ {
+ .driver_data = &acp6x_card,
+ .matches = {
+--
+2.40.1
+
--- /dev/null
+From 6b7fc5d596f0773aee256a871cc062b0862ff849 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Sep 2023 19:26:17 +0300
+Subject: ALSA: hda: intel-sdw-acpi: Use u8 type for link index
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit 485ddd519fbd89a9d9ac4b02be489e03cbbeebba ]
+
+Use consistently u8 for sdw link index. The id is limited to 4, u8 is
+adequate in size to store it.
+
+This change will also fixes the following compiler warning/error (W=1):
+
+sound/hda/intel-sdw-acpi.c: In function ‘sdw_intel_acpi_scan’:
+sound/hda/intel-sdw-acpi.c:34:35: error: ‘-subproperties’ directive output may be truncated writing 14 bytes into a region of size between 7 and 17 [-Werror=format-truncation=]
+ 34 | "mipi-sdw-link-%d-subproperties", i);
+ | ^~~~~~~~~~~~~~
+In function ‘is_link_enabled’,
+ inlined from ‘sdw_intel_scan_controller’ at sound/hda/intel-sdw-acpi.c:106:8,
+ inlined from ‘sdw_intel_acpi_scan’ at sound/hda/intel-sdw-acpi.c:180:9:
+sound/hda/intel-sdw-acpi.c:33:9: note: ‘snprintf’ output between 30 and 40 bytes into a destination of size 32
+ 33 | snprintf(name, sizeof(name),
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ 34 | "mipi-sdw-link-%d-subproperties", i);
+ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+cc1: all warnings being treated as errors
+
+The warnings got brought to light by a recent patch upstream:
+commit 6d4ab2e97dcf ("extrawarn: enable format and stringop overflow warnings in W=1")
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20230912162617.29178-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/intel-sdw-acpi.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/sound/hda/intel-sdw-acpi.c b/sound/hda/intel-sdw-acpi.c
+index 5cb92f7ccbcac..b57d72ea4503f 100644
+--- a/sound/hda/intel-sdw-acpi.c
++++ b/sound/hda/intel-sdw-acpi.c
+@@ -23,7 +23,7 @@ static int ctrl_link_mask;
+ module_param_named(sdw_link_mask, ctrl_link_mask, int, 0444);
+ MODULE_PARM_DESC(sdw_link_mask, "Intel link mask (one bit per link)");
+
+-static bool is_link_enabled(struct fwnode_handle *fw_node, int i)
++static bool is_link_enabled(struct fwnode_handle *fw_node, u8 idx)
+ {
+ struct fwnode_handle *link;
+ char name[32];
+@@ -31,7 +31,7 @@ static bool is_link_enabled(struct fwnode_handle *fw_node, int i)
+
+ /* Find master handle */
+ snprintf(name, sizeof(name),
+- "mipi-sdw-link-%d-subproperties", i);
++ "mipi-sdw-link-%hhu-subproperties", idx);
+
+ link = fwnode_get_named_child_node(fw_node, name);
+ if (!link)
+@@ -51,8 +51,8 @@ static int
+ sdw_intel_scan_controller(struct sdw_intel_acpi_info *info)
+ {
+ struct acpi_device *adev = acpi_fetch_acpi_dev(info->handle);
+- int ret, i;
+- u8 count;
++ u8 count, i;
++ int ret;
+
+ if (!adev)
+ return -EINVAL;
+--
+2.40.1
+
--- /dev/null
+From 227ddb3083145b78a479561865e066ae3d57c7d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Sep 2023 20:38:07 +0530
+Subject: ASoC: amd: yc: Add DMI entries to support Victus by HP Gaming Laptop
+ 15-fb0xxx (8A3E)
+
+From: Shubh <shubhisroking@gmail.com>
+
+[ Upstream commit d1cf5d30b43f1a331032ebf3e11d9e366ab0f885 ]
+
+This model requires an additional detection quirk to
+enable the internal microphone.
+
+Signed-off-by: Shubh <shubhisroking@gmail.com>
+Link: https://lore.kernel.org/r/20230902150807.133523-1-shubhisroking@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/yc/acp6x-mach.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c
+index b304b3562c82b..f7ee792bd1be9 100644
+--- a/sound/soc/amd/yc/acp6x-mach.c
++++ b/sound/soc/amd/yc/acp6x-mach.c
+@@ -325,6 +325,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "8A22"),
+ }
+ },
++ {
++ .driver_data = &acp6x_card,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "HP"),
++ DMI_MATCH(DMI_BOARD_NAME, "8A3E"),
++ }
++ },
+ {
+ .driver_data = &acp6x_card,
+ .matches = {
+--
+2.40.1
+
--- /dev/null
+From b7ddf716f817eeb17ec23256b5c0c3c3c9168cc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Sep 2023 16:00:12 +0100
+Subject: ASoC: cs42l42: Avoid stale SoundWire ATTACH after hard reset
+
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+
+[ Upstream commit 2d066c6a78654c179f95c9beda1985d4c6befa4e ]
+
+In SoundWire mode leave hard RESET asserted when exiting probe,
+and wait for an UNATTACHED notification before deasserting RESET.
+
+If the boot state of the reset GPIO was deasserted it is possible
+that the SoundWire core had already enumerated the CS42L42 before
+cs42l42_sdw_probe() is called. When cs42l42_common_probe() hard
+resets the CS42L42 it triggers a race condition:
+
+1) After cs42l42_sdw_probe() returns the thread that called it
+ will call cs42l42_sdw_update_status() to report the last
+ status recorded by the SoundWire core.
+
+2) The SoundWire bus master will see a PING with the CS42L42
+ now reporting as unenumerated and will trigger the core
+ SoundWire code to start enumerating CS42L42.
+
+These two threads are racing against each other. If (1)
+happens before (2) a stale ATTACHED notification will be
+reported to the cs42l42 driver when in fact the status of
+cs42l42 is now unattached.
+
+To avoid this race condition:
+
+- Leave RESET asserted on exit from cs42l42_sdw_probe().
+ This ensures that an UNATTACHED notification must be
+ sent to the cs42l42 driver. If cs42l42 was already
+ enumerated it will be seen to drop off the bus, causing
+ an UNATTACH notification. If it was never enumerated the
+ status is already UNATTACHED and this will be reported
+ by thread (1).
+
+- When the UNATTACH notification is received, release RESET.
+ This will cause CS42L42 to be enumerated and eventually
+ report an ATTACHED notification.
+
+- The ATTACHED notification is now valid.
+
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20230913150012.604775-4-sbinding@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs42l42-sdw.c | 20 ++++++++++++++++++++
+ sound/soc/codecs/cs42l42.c | 11 ++++++++++-
+ sound/soc/codecs/cs42l42.h | 1 +
+ 3 files changed, 31 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/cs42l42-sdw.c b/sound/soc/codecs/cs42l42-sdw.c
+index eeab07c850f95..974bae4abfad1 100644
+--- a/sound/soc/codecs/cs42l42-sdw.c
++++ b/sound/soc/codecs/cs42l42-sdw.c
+@@ -344,6 +344,16 @@ static int cs42l42_sdw_update_status(struct sdw_slave *peripheral,
+ switch (status) {
+ case SDW_SLAVE_ATTACHED:
+ dev_dbg(cs42l42->dev, "ATTACHED\n");
++
++ /*
++ * The SoundWire core can report stale ATTACH notifications
++ * if we hard-reset CS42L42 in probe() but it had already been
++ * enumerated. Reject the ATTACH if we haven't yet seen an
++ * UNATTACH report for the device being in reset.
++ */
++ if (cs42l42->sdw_waiting_first_unattach)
++ break;
++
+ /*
+ * Initialise codec, this only needs to be done once.
+ * When resuming from suspend, resume callback will handle re-init of codec,
+@@ -354,6 +364,16 @@ static int cs42l42_sdw_update_status(struct sdw_slave *peripheral,
+ break;
+ case SDW_SLAVE_UNATTACHED:
+ dev_dbg(cs42l42->dev, "UNATTACHED\n");
++
++ if (cs42l42->sdw_waiting_first_unattach) {
++ /*
++ * SoundWire core has seen that CS42L42 is not on
++ * the bus so release RESET and wait for ATTACH.
++ */
++ cs42l42->sdw_waiting_first_unattach = false;
++ gpiod_set_value_cansleep(cs42l42->reset_gpio, 1);
++ }
++
+ break;
+ default:
+ break;
+diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c
+index dc93861ddfb02..2961340f15e2e 100644
+--- a/sound/soc/codecs/cs42l42.c
++++ b/sound/soc/codecs/cs42l42.c
+@@ -2330,7 +2330,16 @@ int cs42l42_common_probe(struct cs42l42_private *cs42l42,
+ /* Ensure minimum reset pulse width */
+ usleep_range(10, 500);
+
+- gpiod_set_value_cansleep(cs42l42->reset_gpio, 1);
++ /*
++ * On SoundWire keep the chip in reset until we get an UNATTACH
++ * notification from the SoundWire core. This acts as a
++ * synchronization point to reject stale ATTACH notifications
++ * if the chip was already enumerated before we reset it.
++ */
++ if (cs42l42->sdw_peripheral)
++ cs42l42->sdw_waiting_first_unattach = true;
++ else
++ gpiod_set_value_cansleep(cs42l42->reset_gpio, 1);
+ }
+ usleep_range(CS42L42_BOOT_TIME_US, CS42L42_BOOT_TIME_US * 2);
+
+diff --git a/sound/soc/codecs/cs42l42.h b/sound/soc/codecs/cs42l42.h
+index 4bd7b85a57471..7785125b73ab9 100644
+--- a/sound/soc/codecs/cs42l42.h
++++ b/sound/soc/codecs/cs42l42.h
+@@ -53,6 +53,7 @@ struct cs42l42_private {
+ u8 stream_use;
+ bool hp_adc_up_pending;
+ bool suspended;
++ bool sdw_waiting_first_unattach;
+ bool init_done;
+ };
+
+--
+2.40.1
+
--- /dev/null
+From d28f20adc5b573763f25d8ece90a3dcbabc07d91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Sep 2023 16:00:11 +0100
+Subject: ASoC: cs42l42: Don't rely on GPIOD_OUT_LOW to set RESET initially low
+
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+
+[ Upstream commit a479b44ac0a0ac25cd48e5356200078924d78022 ]
+
+The ACPI setting for a GPIO default state has higher priority than the
+flag passed to devm_gpiod_get_optional() so ACPI can override the
+GPIOD_OUT_LOW. Explicitly set the GPIO low when hard resetting.
+
+Although GPIOD_OUT_LOW can't be relied on this doesn't seem like a
+reason to stop passing it to devm_gpiod_get_optional(). So we still pass
+it to state our intent, but can deal with it having no effect.
+
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20230913150012.604775-3-sbinding@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs42l42.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c
+index 56d2857a4f01c..dc93861ddfb02 100644
+--- a/sound/soc/codecs/cs42l42.c
++++ b/sound/soc/codecs/cs42l42.c
+@@ -2321,6 +2321,12 @@ int cs42l42_common_probe(struct cs42l42_private *cs42l42,
+ if (cs42l42->reset_gpio) {
+ dev_dbg(cs42l42->dev, "Found reset GPIO\n");
+
++ /*
++ * ACPI can override the default GPIO state we requested
++ * so ensure that we start with RESET low.
++ */
++ gpiod_set_value_cansleep(cs42l42->reset_gpio, 0);
++
+ /* Ensure minimum reset pulse width */
+ usleep_range(10, 500);
+
+--
+2.40.1
+
--- /dev/null
+From a0662709004eb2980e58172ebf5d19fcce45d6f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Sep 2023 16:00:10 +0100
+Subject: ASoC: cs42l42: Ensure a reset pulse meets minimum pulse width.
+
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+
+[ Upstream commit 41dac81b56c82c51a6d00fda5f3af7691ffee2d7 ]
+
+The CS42L42 can accept very short reset pulses of a few microseconds
+but there's no reason to force a very short pulse.
+Allow a wide range for the usleep_range() so it can be relaxed about
+the choice of timing source.
+
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20230913150012.604775-2-sbinding@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs42l42.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c
+index a0de0329406a1..56d2857a4f01c 100644
+--- a/sound/soc/codecs/cs42l42.c
++++ b/sound/soc/codecs/cs42l42.c
+@@ -2320,6 +2320,10 @@ int cs42l42_common_probe(struct cs42l42_private *cs42l42,
+
+ if (cs42l42->reset_gpio) {
+ dev_dbg(cs42l42->dev, "Found reset GPIO\n");
++
++ /* Ensure minimum reset pulse width */
++ usleep_range(10, 500);
++
+ gpiod_set_value_cansleep(cs42l42->reset_gpio, 1);
+ }
+ usleep_range(CS42L42_BOOT_TIME_US, CS42L42_BOOT_TIME_US * 2);
+--
+2.40.1
+
--- /dev/null
+From 72047478b849e085b0151aa73de0d1e9c37e216c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Sep 2023 14:38:07 +0800
+Subject: ASoC: fsl: imx-pcm-rpmsg: Add SNDRV_PCM_INFO_BATCH flag
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 2f9426905a63be7ccf8cd10109caf1848aa0993a ]
+
+The rpmsg pcm device is a device which should support
+double buffering.
+
+Found this issue with pipewire. When there is no
+SNDRV_PCM_INFO_BATCH flag in driver, the pipewire will
+set headroom to be zero, and because rpmsg pcm device
+don't support residue report, when the latency setting
+is small, the "delay" always larger than "target" in
+alsa-pcm.c, that reading next period data is not
+scheduled on time.
+
+With SNDRV_PCM_INFO_BATCH flag in driver, the pipewire
+will select a smaller period size for device, then
+the task of reading next period data will be scheduled
+on time.
+
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://lore.kernel.org/r/1694414287-13291-1-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/imx-pcm-rpmsg.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/fsl/imx-pcm-rpmsg.c b/sound/soc/fsl/imx-pcm-rpmsg.c
+index 765dad607bf61..5eef1554a93a1 100644
+--- a/sound/soc/fsl/imx-pcm-rpmsg.c
++++ b/sound/soc/fsl/imx-pcm-rpmsg.c
+@@ -19,6 +19,7 @@
+ static struct snd_pcm_hardware imx_rpmsg_pcm_hardware = {
+ .info = SNDRV_PCM_INFO_INTERLEAVED |
+ SNDRV_PCM_INFO_BLOCK_TRANSFER |
++ SNDRV_PCM_INFO_BATCH |
+ SNDRV_PCM_INFO_MMAP |
+ SNDRV_PCM_INFO_MMAP_VALID |
+ SNDRV_PCM_INFO_NO_PERIOD_WAKEUP |
+--
+2.40.1
+
--- /dev/null
+From 241cd09ed503fe13270ee24204c5ba9e2b2fb9e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Sep 2023 18:26:56 +0800
+Subject: ASoC: imx-rpmsg: Set ignore_pmdown_time for dai_link
+
+From: Chancel Liu <chancel.liu@nxp.com>
+
+[ Upstream commit fac58baf8fcfcd7481e8f6d60206ce2a47c1476c ]
+
+i.MX rpmsg sound cards work on codec slave mode. MCLK will be disabled
+by CPU DAI driver in hw_free(). Some codec requires MCLK present at
+power up/down sequence. So need to set ignore_pmdown_time to power down
+codec immediately before MCLK is turned off.
+
+Take WM8962 as an example, if MCLK is disabled before DAPM power down
+playback stream, FIFO error will arise in WM8962 which will have bad
+impact on playback next.
+
+Signed-off-by: Chancel Liu <chancel.liu@nxp.com>
+Acked-by: Shengjiu Wang <shengjiu.wang@gmail.com>
+Link: https://lore.kernel.org/r/20230913102656.2966757-1-chancel.liu@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/imx-rpmsg.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/sound/soc/fsl/imx-rpmsg.c b/sound/soc/fsl/imx-rpmsg.c
+index 3c7b95db2eacc..b578f9a32d7f1 100644
+--- a/sound/soc/fsl/imx-rpmsg.c
++++ b/sound/soc/fsl/imx-rpmsg.c
+@@ -89,6 +89,14 @@ static int imx_rpmsg_probe(struct platform_device *pdev)
+ SND_SOC_DAIFMT_NB_NF |
+ SND_SOC_DAIFMT_CBC_CFC;
+
++ /*
++ * i.MX rpmsg sound cards work on codec slave mode. MCLK will be
++ * disabled by CPU DAI driver in hw_free(). Some codec requires MCLK
++ * present at power up/down sequence. So need to set ignore_pmdown_time
++ * to power down codec immediately before MCLK is turned off.
++ */
++ data->dai.ignore_pmdown_time = 1;
++
+ /* Optional codec node */
+ ret = of_parse_phandle_with_fixed_args(np, "audio-codec", 0, 0, &args);
+ if (ret) {
+--
+2.40.1
+
--- /dev/null
+From 6f7626db95fa31ab88104afd3c0c37850b9323f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Sep 2023 13:32:45 +0200
+Subject: ASoC: rt5640: Only cancel jack-detect work on suspend if active
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 8fc7cc507d61fc655172836c74fb7fcc8b7a978b ]
+
+If jack-detection is not used; or has already been disabled then
+there is no need to call rt5640_cancel_work().
+
+Move the rt5640_cancel_work() inside the "if (rt5640->jack) {}" block,
+grouping it together with the disabling of the IRQ which queues the work
+in the first place.
+
+This also makes suspend() symetrical with resume() which re-queues the work
+in an "if (rt5640->jack) {}" block.
+
+Cc: Oder Chiou <oder_chiou@realtek.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20230912113245.320159-7-hdegoede@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5640.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/rt5640.c b/sound/soc/codecs/rt5640.c
+index a39d556ad1a10..0a05554da3739 100644
+--- a/sound/soc/codecs/rt5640.c
++++ b/sound/soc/codecs/rt5640.c
+@@ -2802,9 +2802,9 @@ static int rt5640_suspend(struct snd_soc_component *component)
+ if (rt5640->jack) {
+ /* disable jack interrupts during system suspend */
+ disable_irq(rt5640->irq);
++ rt5640_cancel_work(rt5640);
+ }
+
+- rt5640_cancel_work(rt5640);
+ snd_soc_component_force_bias_level(component, SND_SOC_BIAS_OFF);
+ rt5640_reset(component);
+ regcache_cache_only(rt5640->regmap, true);
+--
+2.40.1
+
--- /dev/null
+From e395bb344967cb9f228e3abb8037d64f133a5f29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Sep 2023 16:41:53 +0300
+Subject: ASoC: SOF: Intel: MTL: Reduce the DSP init timeout
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+
+[ Upstream commit e0f96246c4402514acda040be19ee24c1619e01a ]
+
+20s seems unnecessarily large for the DSP init timeout. This coupled with
+multiple FW boot attempts causes an excessive delay in the error path when
+booting in recovery mode. Reduce it to 0.5s and use the existing
+HDA_DSP_INIT_TIMEOUT_US.
+
+Link: https://github.com/thesofproject/linux/issues/4565
+Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://lore.kernel.org/r/20230915134153.9688-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/mtl.c | 2 +-
+ sound/soc/sof/intel/mtl.h | 1 -
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/sound/soc/sof/intel/mtl.c b/sound/soc/sof/intel/mtl.c
+index 30fe77fd87bf8..79e9a7ed8feaa 100644
+--- a/sound/soc/sof/intel/mtl.c
++++ b/sound/soc/sof/intel/mtl.c
+@@ -460,7 +460,7 @@ int mtl_dsp_cl_init(struct snd_sof_dev *sdev, int stream_tag, bool imr_boot)
+ /* step 3: wait for IPC DONE bit from ROM */
+ ret = snd_sof_dsp_read_poll_timeout(sdev, HDA_DSP_BAR, chip->ipc_ack, status,
+ ((status & chip->ipc_ack_mask) == chip->ipc_ack_mask),
+- HDA_DSP_REG_POLL_INTERVAL_US, MTL_DSP_PURGE_TIMEOUT_US);
++ HDA_DSP_REG_POLL_INTERVAL_US, HDA_DSP_INIT_TIMEOUT_US);
+ if (ret < 0) {
+ if (hda->boot_iteration == HDA_FW_BOOT_ATTEMPTS)
+ dev_err(sdev->dev, "timeout waiting for purge IPC done\n");
+diff --git a/sound/soc/sof/intel/mtl.h b/sound/soc/sof/intel/mtl.h
+index 2794fe6e81396..9a0b8b9d8a0c9 100644
+--- a/sound/soc/sof/intel/mtl.h
++++ b/sound/soc/sof/intel/mtl.h
+@@ -62,7 +62,6 @@
+ #define MTL_DSP_IRQSTS_IPC BIT(0)
+ #define MTL_DSP_IRQSTS_SDW BIT(6)
+
+-#define MTL_DSP_PURGE_TIMEOUT_US 20000000 /* 20s */
+ #define MTL_DSP_REG_POLL_INTERVAL_US 10 /* 10 us */
+
+ /* Memory windows */
+--
+2.40.1
+
--- /dev/null
+From fcd4a7613de2415039a6b16565bb0e1d4af1fb40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Sep 2023 15:47:25 +0300
+Subject: ASoC: SOF: sof-audio: Fix DSP core put imbalance on widget setup
+ failure
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit bb0216d4db9ecaa51af45d8504757becbe5c050d ]
+
+In case the widget setup fails we should only decrement the core usage
+count if the sof_widget_free_unlocked() has not been called as part of
+the error handling.
+sof_widget_free_unlocked() calls snd_sof_dsp_core_put() and the additional
+core_put will cause imbalance in core usage count.
+Use the existing use_count_decremented to handle this issue.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20230914124725.17397-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/sof-audio.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/sof-audio.c b/sound/soc/sof/sof-audio.c
+index e7ef77012c358..e5405f854a910 100644
+--- a/sound/soc/sof/sof-audio.c
++++ b/sound/soc/sof/sof-audio.c
+@@ -212,7 +212,8 @@ static int sof_widget_setup_unlocked(struct snd_sof_dev *sdev,
+ sof_widget_free_unlocked(sdev, swidget);
+ use_count_decremented = true;
+ core_put:
+- snd_sof_dsp_core_put(sdev, swidget->core);
++ if (!use_count_decremented)
++ snd_sof_dsp_core_put(sdev, swidget->core);
+ pipe_widget_free:
+ if (swidget->id != snd_soc_dapm_scheduler)
+ sof_widget_free_unlocked(sdev, swidget->spipe->pipe_widget);
+--
+2.40.1
+
--- /dev/null
+From f8433d7d283b0386223becd96349413633445624 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Sep 2023 17:02:50 +0100
+Subject: ASoC: wm_adsp: Fix missing locking in wm_adsp_[read|write]_ctl()
+
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+
+[ Upstream commit 781118bc2fc1026c8285f83ea7ecab07071a09c4 ]
+
+wm_adsp_read_ctl() and wm_adsp_write_ctl() must hold the cs_dsp pwr_lock
+mutex when calling cs_dsp_coeff_read_ctrl() and cs_dsp_coeff_write_ctrl().
+
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20230913160250.3700346-1-rf@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm_adsp.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
+index 5a89abfe87846..8c20ff6808941 100644
+--- a/sound/soc/codecs/wm_adsp.c
++++ b/sound/soc/codecs/wm_adsp.c
+@@ -687,7 +687,10 @@ int wm_adsp_write_ctl(struct wm_adsp *dsp, const char *name, int type,
+ struct wm_coeff_ctl *ctl;
+ int ret;
+
++ mutex_lock(&dsp->cs_dsp.pwr_lock);
+ ret = cs_dsp_coeff_write_ctrl(cs_ctl, 0, buf, len);
++ mutex_unlock(&dsp->cs_dsp.pwr_lock);
++
+ if (ret < 0)
+ return ret;
+
+@@ -703,8 +706,14 @@ EXPORT_SYMBOL_GPL(wm_adsp_write_ctl);
+ int wm_adsp_read_ctl(struct wm_adsp *dsp, const char *name, int type,
+ unsigned int alg, void *buf, size_t len)
+ {
+- return cs_dsp_coeff_read_ctrl(cs_dsp_get_ctl(&dsp->cs_dsp, name, type, alg),
+- 0, buf, len);
++ int ret;
++
++ mutex_lock(&dsp->cs_dsp.pwr_lock);
++ ret = cs_dsp_coeff_read_ctrl(cs_dsp_get_ctl(&dsp->cs_dsp, name, type, alg),
++ 0, buf, len);
++ mutex_unlock(&dsp->cs_dsp.pwr_lock);
++
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(wm_adsp_read_ctl);
+
+--
+2.40.1
+
--- /dev/null
+From 038f3d5c05dbef95637b7d7e2efc838e662c02de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Sep 2023 00:19:16 +0200
+Subject: ata: libata-eh: do not clear ATA_PFLAG_EH_PENDING in ata_eh_reset()
+
+From: Niklas Cassel <niklas.cassel@wdc.com>
+
+[ Upstream commit 80cc944eca4f0baa9c381d0706f3160e491437f2 ]
+
+ata_scsi_port_error_handler() starts off by clearing ATA_PFLAG_EH_PENDING,
+before calling ap->ops->error_handler() (without holding the ap->lock).
+
+If an error IRQ is received while ap->ops->error_handler() is running,
+the irq handler will set ATA_PFLAG_EH_PENDING.
+
+Once ap->ops->error_handler() returns, ata_scsi_port_error_handler()
+checks if ATA_PFLAG_EH_PENDING is set, and if it is, another iteration
+of ATA EH is performed.
+
+The problem is that ATA_PFLAG_EH_PENDING is not only cleared by
+ata_scsi_port_error_handler(), it is also cleared by ata_eh_reset().
+
+ata_eh_reset() is called by ap->ops->error_handler(). This additional
+clearing done by ata_eh_reset() breaks the whole retry logic in
+ata_scsi_port_error_handler(). Thus, if an error IRQ is received while
+ap->ops->error_handler() is running, the port will currently remain
+frozen and will never get re-enabled.
+
+The additional clearing in ata_eh_reset() was introduced in commit
+1e641060c4b5 ("libata: clear eh_info on reset completion").
+
+Looking at the original error report:
+https://marc.info/?l=linux-ide&m=124765325828495&w=2
+
+We can see the following happening:
+[ 1.074659] ata3: XXX port freeze
+[ 1.074700] ata3: XXX hardresetting link, stopping engine
+[ 1.074746] ata3: XXX flipping SControl
+
+[ 1.411471] ata3: XXX irq_stat=400040 CONN|PHY
+[ 1.411475] ata3: XXX port freeze
+
+[ 1.420049] ata3: XXX starting engine
+[ 1.420096] ata3: XXX rc=0, class=1
+[ 1.420142] ata3: XXX clearing IRQs for thawing
+[ 1.420188] ata3: XXX port thawed
+[ 1.420234] ata3: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
+
+We are not supposed to be able to receive an error IRQ while the port is
+frozen (PxIE is set to 0, i.e. all IRQs for the port are disabled).
+
+AHCI 1.3.1 section 10.7.1.1 First Tier (IS Register) states:
+"Each bit location can be thought of as reporting a '1' if the virtual
+"interrupt line" for that port is indicating it wishes to generate an
+interrupt. That is, if a port has one or more interrupt status bit set,
+and the enables for those status bits are set, then this bit shall be set."
+
+Additionally, AHCI state P:ComInit clearly shows that the state machine
+will only jump to P:ComInitSetIS (which sets IS.IPS(x) to '1'), if PxIE.PCE
+is set to '1'. In our case, PxIE is set to 0, so IS.IPS(x) won't get set.
+
+So IS.IPS(x) only gets set if PxIS and PxIE is set.
+
+AHCI 1.3.1 section 10.7.1.1 First Tier (IS Register) also states:
+"The bits in this register are read/write clear. It is set by the level of
+the virtual interrupt line being a set, and cleared by a write of '1' from
+the software."
+
+So if IS.IPS(x) is set, you need to explicitly clear it by writing a 1 to
+IS.IPS(x) for that port.
+
+Since PxIE is cleared, the only way to get an interrupt while the port is
+frozen, is if IS.IPS(x) is set, and the only way IS.IPS(x) can be set when
+the port is frozen, is if it was set before the port was frozen.
+
+However, since commit 737dd811a3db ("ata: libahci: clear pending interrupt
+status"), we clear both PxIS and IS.IPS(x) after freezing the port, but
+before the COMRESET, so the problem that commit 1e641060c4b5 ("libata:
+clear eh_info on reset completion") fixed can no longer happen.
+
+Thus, revert commit 1e641060c4b5 ("libata: clear eh_info on reset
+completion"), so that the retry logic in ata_scsi_port_error_handler()
+works once again. (The retry logic is still needed, since we can still
+get an error IRQ _after_ the port has been thawed, but before
+ata_scsi_port_error_handler() takes the ap->lock in order to check
+if ATA_PFLAG_EH_PENDING is set.)
+
+Signed-off-by: Niklas Cassel <niklas.cassel@wdc.com>
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-eh.c | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index 35e03679b0bfe..d7914c7d1a0d1 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -2822,18 +2822,11 @@ int ata_eh_reset(struct ata_link *link, int classify,
+ }
+ }
+
+- /*
+- * Some controllers can't be frozen very well and may set spurious
+- * error conditions during reset. Clear accumulated error
+- * information and re-thaw the port if frozen. As reset is the
+- * final recovery action and we cross check link onlineness against
+- * device classification later, no hotplug event is lost by this.
+- */
++ /* clear cached SError */
+ spin_lock_irqsave(link->ap->lock, flags);
+- memset(&link->eh_info, 0, sizeof(link->eh_info));
++ link->eh_info.serror = 0;
+ if (slave)
+- memset(&slave->eh_info, 0, sizeof(link->eh_info));
+- ap->pflags &= ~ATA_PFLAG_EH_PENDING;
++ slave->eh_info.serror = 0;
+ spin_unlock_irqrestore(link->ap->lock, flags);
+
+ if (ata_port_is_frozen(ap))
+--
+2.40.1
+
--- /dev/null
+From ebd880d907f81b4546a63bc5aa37e61801d3d3ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Sep 2023 00:19:17 +0200
+Subject: ata: libata-eh: do not thaw the port twice in ata_eh_reset()
+
+From: Niklas Cassel <niklas.cassel@wdc.com>
+
+[ Upstream commit 7a3bc2b3989e05bbaa904a63279049a401491c84 ]
+
+commit 1e641060c4b5 ("libata: clear eh_info on reset completion") added
+a workaround that broke the retry mechanism in ATA EH.
+
+Tejun himself suggested to remove this workaround when it was identified
+to cause additional problems:
+https://lore.kernel.org/linux-ide/20110426135027.GI878@htj.dyndns.org/
+
+He even said:
+"Hmm... it seems I wasn't thinking straight when I added that work around."
+https://lore.kernel.org/linux-ide/20110426155229.GM878@htj.dyndns.org/
+
+While removing the workaround solved the issue, however, the workaround was
+kept to avoid "spurious hotplug events during reset", and instead another
+workaround was added on top of the existing workaround in commit
+8c56cacc724c ("libata: fix unexpectedly frozen port after ata_eh_reset()").
+
+Because these IRQs happened when the port was frozen, we know that they
+were actually a side effect of PxIS and IS.IPS(x) not being cleared before
+the COMRESET. This is now done in commit 94152042eaa9 ("ata: libahci: clear
+pending interrupt status"), so these workarounds can now be removed.
+
+Since commit 1e641060c4b5 ("libata: clear eh_info on reset completion") has
+now been reverted, the ATA EH retry mechanism is functional again, so there
+is once again no need to thaw the port more than once in ata_eh_reset().
+
+This reverts "the workaround on top of the workaround" introduced in commit
+8c56cacc724c ("libata: fix unexpectedly frozen port after ata_eh_reset()").
+
+Signed-off-by: Niklas Cassel <niklas.cassel@wdc.com>
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-eh.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index d7914c7d1a0d1..960ef5c6f2c10 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -2829,9 +2829,6 @@ int ata_eh_reset(struct ata_link *link, int classify,
+ slave->eh_info.serror = 0;
+ spin_unlock_irqrestore(link->ap->lock, flags);
+
+- if (ata_port_is_frozen(ap))
+- ata_eh_thaw_port(ap);
+-
+ /*
+ * Make sure onlineness and classification result correspond.
+ * Hotplug could have happened during reset and some
+--
+2.40.1
+
--- /dev/null
+From 31e5b24e78c2c454b0a84991cdc6d11d3a4a3a52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Sep 2023 21:54:36 +0200
+Subject: ata: sata_mv: Fix incorrect string length computation in
+ mv_dump_mem()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit e97eb65dd464e7f118a16a26337322d07eb653e2 ]
+
+snprintf() returns the "number of characters which *would* be generated for
+the given input", not the size *really* generated.
+
+In order to avoid too large values for 'o' (and potential negative values
+for "sizeof(linebuf) o") use scnprintf() instead of snprintf().
+
+Note that given the "w < 4" in the for loop, the buffer can NOT
+overflow, but using the *right* function is always better.
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/sata_mv.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
+index d404e631d1527..68e660e4cc410 100644
+--- a/drivers/ata/sata_mv.c
++++ b/drivers/ata/sata_mv.c
+@@ -1255,8 +1255,8 @@ static void mv_dump_mem(struct device *dev, void __iomem *start, unsigned bytes)
+
+ for (b = 0; b < bytes; ) {
+ for (w = 0, o = 0; b < bytes && w < 4; w++) {
+- o += snprintf(linebuf + o, sizeof(linebuf) - o,
+- "%08x ", readl(start + b));
++ o += scnprintf(linebuf + o, sizeof(linebuf) - o,
++ "%08x ", readl(start + b));
+ b += sizeof(u32);
+ }
+ dev_dbg(dev, "%s: %p: %s\n",
+--
+2.40.1
+
--- /dev/null
+From 22862851d106e81fe76c448ee7df7fe953ffd9cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Aug 2023 22:53:52 +0200
+Subject: bpf: Annotate bpf_long_memcpy with data_race
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit 6a86b5b5cd76d2734304a0173f5f01aa8aa2025e ]
+
+syzbot reported a data race splat between two processes trying to
+update the same BPF map value via syscall on different CPUs:
+
+ BUG: KCSAN: data-race in bpf_percpu_array_update / bpf_percpu_array_update
+
+ write to 0xffffe8fffe7425d8 of 8 bytes by task 8257 on cpu 1:
+ bpf_long_memcpy include/linux/bpf.h:428 [inline]
+ bpf_obj_memcpy include/linux/bpf.h:441 [inline]
+ copy_map_value_long include/linux/bpf.h:464 [inline]
+ bpf_percpu_array_update+0x3bb/0x500 kernel/bpf/arraymap.c:380
+ bpf_map_update_value+0x190/0x370 kernel/bpf/syscall.c:175
+ generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1749
+ bpf_map_do_batch+0x2df/0x3d0 kernel/bpf/syscall.c:4648
+ __sys_bpf+0x28a/0x780
+ __do_sys_bpf kernel/bpf/syscall.c:5241 [inline]
+ __se_sys_bpf kernel/bpf/syscall.c:5239 [inline]
+ __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5239
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+ write to 0xffffe8fffe7425d8 of 8 bytes by task 8268 on cpu 0:
+ bpf_long_memcpy include/linux/bpf.h:428 [inline]
+ bpf_obj_memcpy include/linux/bpf.h:441 [inline]
+ copy_map_value_long include/linux/bpf.h:464 [inline]
+ bpf_percpu_array_update+0x3bb/0x500 kernel/bpf/arraymap.c:380
+ bpf_map_update_value+0x190/0x370 kernel/bpf/syscall.c:175
+ generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1749
+ bpf_map_do_batch+0x2df/0x3d0 kernel/bpf/syscall.c:4648
+ __sys_bpf+0x28a/0x780
+ __do_sys_bpf kernel/bpf/syscall.c:5241 [inline]
+ __se_sys_bpf kernel/bpf/syscall.c:5239 [inline]
+ __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5239
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+ value changed: 0x0000000000000000 -> 0xfffffff000002788
+
+The bpf_long_memcpy is used with 8-byte aligned pointers, power-of-8 size
+and forced to use long read/writes to try to atomically copy long counters.
+It is best-effort only and no barriers are here since it _will_ race with
+concurrent updates from BPF programs. The bpf_long_memcpy() is called from
+bpf(2) syscall. Marco suggested that the best way to make this known to
+KCSAN would be to use data_race() annotation.
+
+Reported-by: syzbot+97522333291430dd277f@syzkaller.appspotmail.com
+Suggested-by: Marco Elver <elver@google.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Marco Elver <elver@google.com>
+Link: https://lore.kernel.org/bpf/000000000000d87a7f06040c970c@google.com
+Link: https://lore.kernel.org/bpf/57628f7a15e20d502247c3b55fceb1cb2b31f266.1693342186.git.daniel@iogearbox.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bpf.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index 28e2e0ce2ed07..477d91b926b35 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -425,7 +425,7 @@ static inline void bpf_long_memcpy(void *dst, const void *src, u32 size)
+
+ size /= sizeof(long);
+ while (size--)
+- *ldst++ = *lsrc++;
++ data_race(*ldst++ = *lsrc++);
+ }
+
+ /* copy everything but bpf_spin_lock, bpf_timer, and kptrs. There could be one of each. */
+--
+2.40.1
+
--- /dev/null
+From 9e9f5aa37827ba0396ff2bff95ee6d8ef013186b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Sep 2023 12:47:30 -0700
+Subject: bpf: Clarify error expectations from bpf_clone_redirect
+
+From: Stanislav Fomichev <sdf@google.com>
+
+[ Upstream commit 7cb779a6867fea00b4209bcf6de2f178a743247d ]
+
+Commit 151e887d8ff9 ("veth: Fixing transmit return status for dropped
+packets") exposed the fact that bpf_clone_redirect is capable of
+returning raw NET_XMIT_XXX return codes.
+
+This is in the conflict with its UAPI doc which says the following:
+"0 on success, or a negative error in case of failure."
+
+Update the UAPI to reflect the fact that bpf_clone_redirect can
+return positive error numbers, but don't explicitly define
+their meaning.
+
+Reported-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Stanislav Fomichev <sdf@google.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20230911194731.286342-1-sdf@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/bpf.h | 4 +++-
+ tools/include/uapi/linux/bpf.h | 4 +++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
+index 60a9d59beeabb..25f668165b567 100644
+--- a/include/uapi/linux/bpf.h
++++ b/include/uapi/linux/bpf.h
+@@ -1897,7 +1897,9 @@ union bpf_attr {
+ * performed again, if the helper is used in combination with
+ * direct packet access.
+ * Return
+- * 0 on success, or a negative error in case of failure.
++ * 0 on success, or a negative error in case of failure. Positive
++ * error indicates a potential drop or congestion in the target
++ * device. The particular positive error codes are not defined.
+ *
+ * u64 bpf_get_current_pid_tgid(void)
+ * Description
+diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
+index 60a9d59beeabb..25f668165b567 100644
+--- a/tools/include/uapi/linux/bpf.h
++++ b/tools/include/uapi/linux/bpf.h
+@@ -1897,7 +1897,9 @@ union bpf_attr {
+ * performed again, if the helper is used in combination with
+ * direct packet access.
+ * Return
+- * 0 on success, or a negative error in case of failure.
++ * 0 on success, or a negative error in case of failure. Positive
++ * error indicates a potential drop or congestion in the target
++ * device. The particular positive error codes are not defined.
+ *
+ * u64 bpf_get_current_pid_tgid(void)
+ * Description
+--
+2.40.1
+
--- /dev/null
+From f0255aec1eb41ec35646e43ee18dde9a9edf0191 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Sep 2023 21:39:22 +0800
+Subject: bpf: Ensure unit_size is matched with slab cache object size
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit c930472552022bd09aab3cd946ba3f243070d5c7 ]
+
+Add extra check in bpf_mem_alloc_init() to ensure the unit_size of
+bpf_mem_cache is matched with the object_size of underlying slab cache.
+If these two sizes are unmatched, print a warning once and return
+-EINVAL in bpf_mem_alloc_init(), so the mismatch can be found early and
+the potential issue can be prevented.
+
+Suggested-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Link: https://lore.kernel.org/r/20230908133923.2675053-4-houtao@huaweicloud.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/memalloc.c | 33 +++++++++++++++++++++++++++++++--
+ 1 file changed, 31 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/memalloc.c b/kernel/bpf/memalloc.c
+index 0668bcd7c926f..bcf84e71f549c 100644
+--- a/kernel/bpf/memalloc.c
++++ b/kernel/bpf/memalloc.c
+@@ -370,6 +370,24 @@ static void prefill_mem_cache(struct bpf_mem_cache *c, int cpu)
+ alloc_bulk(c, c->unit_size <= 256 ? 4 : 1, cpu_to_node(cpu));
+ }
+
++static int check_obj_size(struct bpf_mem_cache *c, unsigned int idx)
++{
++ struct llist_node *first;
++ unsigned int obj_size;
++
++ first = c->free_llist.first;
++ if (!first)
++ return 0;
++
++ obj_size = ksize(first);
++ if (obj_size != c->unit_size) {
++ WARN_ONCE(1, "bpf_mem_cache[%u]: unexpected object size %u, expect %u\n",
++ idx, obj_size, c->unit_size);
++ return -EINVAL;
++ }
++ return 0;
++}
++
+ /* When size != 0 bpf_mem_cache for each cpu.
+ * This is typical bpf hash map use case when all elements have equal size.
+ *
+@@ -380,10 +398,10 @@ static void prefill_mem_cache(struct bpf_mem_cache *c, int cpu)
+ int bpf_mem_alloc_init(struct bpf_mem_alloc *ma, int size, bool percpu)
+ {
+ static u16 sizes[NUM_CACHES] = {96, 192, 16, 32, 64, 128, 256, 512, 1024, 2048, 4096};
++ int cpu, i, err, unit_size, percpu_size = 0;
+ struct bpf_mem_caches *cc, __percpu *pcc;
+ struct bpf_mem_cache *c, __percpu *pc;
+ struct obj_cgroup *objcg = NULL;
+- int cpu, i, unit_size, percpu_size = 0;
+
+ if (size) {
+ pc = __alloc_percpu_gfp(sizeof(*pc), 8, GFP_KERNEL);
+@@ -419,6 +437,7 @@ int bpf_mem_alloc_init(struct bpf_mem_alloc *ma, int size, bool percpu)
+ pcc = __alloc_percpu_gfp(sizeof(*cc), 8, GFP_KERNEL);
+ if (!pcc)
+ return -ENOMEM;
++ err = 0;
+ #ifdef CONFIG_MEMCG_KMEM
+ objcg = get_obj_cgroup_from_current();
+ #endif
+@@ -429,10 +448,20 @@ int bpf_mem_alloc_init(struct bpf_mem_alloc *ma, int size, bool percpu)
+ c->unit_size = sizes[i];
+ c->objcg = objcg;
+ prefill_mem_cache(c, cpu);
++ err = check_obj_size(c, i);
++ if (err)
++ goto out;
+ }
+ }
++
++out:
+ ma->caches = pcc;
+- return 0;
++ /* refill_work is either zeroed or initialized, so it is safe to
++ * call irq_work_sync().
++ */
++ if (err)
++ bpf_mem_alloc_destroy(ma);
++ return err;
+ }
+
+ static void drain_mem_cache(struct bpf_mem_cache *c)
+--
+2.40.1
+
--- /dev/null
+From 35d5d2e59eabfb58fb78688b6a0faafb895dbd75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Aug 2023 09:06:44 +0100
+Subject: btrfs: assert delayed node locked when removing delayed item
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit a57c2d4e46f519b24558ae0752c17eec416ac72a ]
+
+When removing a delayed item, or releasing which will remove it as well,
+we will modify one of the delayed node's rbtrees and item counter if the
+delayed item is in one of the rbtrees. This require having the delayed
+node's mutex locked, otherwise we will race with other tasks modifying
+the rbtrees and the counter.
+
+This is motivated by a previous version of another patch actually calling
+btrfs_release_delayed_item() after unlocking the delayed node's mutex and
+against a delayed item that is in a rbtree.
+
+So assert at __btrfs_remove_delayed_item() that the delayed node's mutex
+is locked.
+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/delayed-inode.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
+index b5f684cb4e749..142e0a0f6a9fe 100644
+--- a/fs/btrfs/delayed-inode.c
++++ b/fs/btrfs/delayed-inode.c
+@@ -412,6 +412,7 @@ static void finish_one_item(struct btrfs_delayed_root *delayed_root)
+
+ static void __btrfs_remove_delayed_item(struct btrfs_delayed_item *delayed_item)
+ {
++ struct btrfs_delayed_node *delayed_node = delayed_item->delayed_node;
+ struct rb_root_cached *root;
+ struct btrfs_delayed_root *delayed_root;
+
+@@ -419,18 +420,21 @@ static void __btrfs_remove_delayed_item(struct btrfs_delayed_item *delayed_item)
+ if (RB_EMPTY_NODE(&delayed_item->rb_node))
+ return;
+
+- delayed_root = delayed_item->delayed_node->root->fs_info->delayed_root;
++ /* If it's in a rbtree, then we need to have delayed node locked. */
++ lockdep_assert_held(&delayed_node->mutex);
++
++ delayed_root = delayed_node->root->fs_info->delayed_root;
+
+ BUG_ON(!delayed_root);
+
+ if (delayed_item->type == BTRFS_DELAYED_INSERTION_ITEM)
+- root = &delayed_item->delayed_node->ins_root;
++ root = &delayed_node->ins_root;
+ else
+- root = &delayed_item->delayed_node->del_root;
++ root = &delayed_node->del_root;
+
+ rb_erase_cached(&delayed_item->rb_node, root);
+ RB_CLEAR_NODE(&delayed_item->rb_node);
+- delayed_item->delayed_node->count--;
++ delayed_node->count--;
+
+ finish_one_item(delayed_root);
+ }
+--
+2.40.1
+
--- /dev/null
+From f27b1308df54f994ecb0c98746c3f4e9aa8f9047 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Dec 2022 14:13:51 +0800
+Subject: ceph: drop messages from MDS when unmounting
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Xiubo Li <xiubli@redhat.com>
+
+[ Upstream commit e3dfcab2080dc1f9a4b09cc1327361bc2845bfcd ]
+
+When unmounting all the dirty buffers will be flushed and after
+the last osd request is finished the last reference of the i_count
+will be released. Then it will flush the dirty cap/snap to MDSs,
+and the unmounting won't wait the possible acks, which will ihold
+the inodes when updating the metadata locally but makes no sense
+any more, of this. This will make the evict_inodes() to skip these
+inodes.
+
+If encrypt is enabled the kernel generate a warning when removing
+the encrypt keys when the skipped inodes still hold the keyring:
+
+WARNING: CPU: 4 PID: 168846 at fs/crypto/keyring.c:242 fscrypt_destroy_keyring+0x7e/0xd0
+CPU: 4 PID: 168846 Comm: umount Tainted: G S 6.1.0-rc5-ceph-g72ead199864c #1
+Hardware name: Supermicro SYS-5018R-WR/X10SRW-F, BIOS 2.0 12/17/2015
+RIP: 0010:fscrypt_destroy_keyring+0x7e/0xd0
+RSP: 0018:ffffc9000b277e28 EFLAGS: 00010202
+RAX: 0000000000000002 RBX: ffff88810d52ac00 RCX: ffff88810b56aa00
+RDX: 0000000080000000 RSI: ffffffff822f3a09 RDI: ffff888108f59000
+RBP: ffff8881d394fb88 R08: 0000000000000028 R09: 0000000000000000
+R10: 0000000000000001 R11: 11ff4fe6834fcd91 R12: ffff8881d394fc40
+R13: ffff888108f59000 R14: ffff8881d394f800 R15: 0000000000000000
+FS: 00007fd83f6f1080(0000) GS:ffff88885fd00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007f918d417000 CR3: 000000017f89a005 CR4: 00000000003706e0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+<TASK>
+generic_shutdown_super+0x47/0x120
+kill_anon_super+0x14/0x30
+ceph_kill_sb+0x36/0x90 [ceph]
+deactivate_locked_super+0x29/0x60
+cleanup_mnt+0xb8/0x140
+task_work_run+0x67/0xb0
+exit_to_user_mode_prepare+0x23d/0x240
+syscall_exit_to_user_mode+0x25/0x60
+do_syscall_64+0x40/0x80
+entry_SYSCALL_64_after_hwframe+0x63/0xcd
+RIP: 0033:0x7fd83dc39e9b
+
+Later the kernel will crash when iput() the inodes and dereferencing
+the "sb->s_master_keys", which has been released by the
+generic_shutdown_super().
+
+Link: https://tracker.ceph.com/issues/59162
+Signed-off-by: Xiubo Li <xiubli@redhat.com>
+Reviewed-and-tested-by: Luís Henriques <lhenriques@suse.de>
+Reviewed-by: Milind Changire <mchangir@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/caps.c | 6 +++-
+ fs/ceph/mds_client.c | 12 +++++--
+ fs/ceph/mds_client.h | 11 +++++--
+ fs/ceph/quota.c | 14 ++++-----
+ fs/ceph/snap.c | 10 +++---
+ fs/ceph/super.c | 75 +++++++++++++++++++++++++++++++++++++++++---
+ fs/ceph/super.h | 3 ++
+ 7 files changed, 109 insertions(+), 22 deletions(-)
+
+diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
+index e2bb0d0072da5..c268bd07e7ddd 100644
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -4105,6 +4105,9 @@ void ceph_handle_caps(struct ceph_mds_session *session,
+
+ dout("handle_caps from mds%d\n", session->s_mds);
+
++ if (!ceph_inc_mds_stopping_blocker(mdsc, session))
++ return;
++
+ /* decode */
+ end = msg->front.iov_base + msg->front.iov_len;
+ if (msg->front.iov_len < sizeof(*h))
+@@ -4201,7 +4204,6 @@ void ceph_handle_caps(struct ceph_mds_session *session,
+ vino.snap, inode);
+
+ mutex_lock(&session->s_mutex);
+- inc_session_sequence(session);
+ dout(" mds%d seq %lld cap seq %u\n", session->s_mds, session->s_seq,
+ (unsigned)seq);
+
+@@ -4309,6 +4311,8 @@ void ceph_handle_caps(struct ceph_mds_session *session,
+ done_unlocked:
+ iput(inode);
+ out:
++ ceph_dec_mds_stopping_blocker(mdsc);
++
+ ceph_put_string(extra_info.pool_ns);
+
+ /* Defer closing the sessions after s_mutex lock being released */
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index 5fb367b1d4b06..4b0ba067e9c93 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -4550,6 +4550,9 @@ static void handle_lease(struct ceph_mds_client *mdsc,
+
+ dout("handle_lease from mds%d\n", mds);
+
++ if (!ceph_inc_mds_stopping_blocker(mdsc, session))
++ return;
++
+ /* decode */
+ if (msg->front.iov_len < sizeof(*h) + sizeof(u32))
+ goto bad;
+@@ -4568,8 +4571,6 @@ static void handle_lease(struct ceph_mds_client *mdsc,
+ dname.len, dname.name);
+
+ mutex_lock(&session->s_mutex);
+- inc_session_sequence(session);
+-
+ if (!inode) {
+ dout("handle_lease no inode %llx\n", vino.ino);
+ goto release;
+@@ -4631,9 +4632,13 @@ static void handle_lease(struct ceph_mds_client *mdsc,
+ out:
+ mutex_unlock(&session->s_mutex);
+ iput(inode);
++
++ ceph_dec_mds_stopping_blocker(mdsc);
+ return;
+
+ bad:
++ ceph_dec_mds_stopping_blocker(mdsc);
++
+ pr_err("corrupt lease message\n");
+ ceph_msg_dump(msg);
+ }
+@@ -4829,6 +4834,9 @@ int ceph_mdsc_init(struct ceph_fs_client *fsc)
+ }
+
+ init_completion(&mdsc->safe_umount_waiters);
++ spin_lock_init(&mdsc->stopping_lock);
++ atomic_set(&mdsc->stopping_blockers, 0);
++ init_completion(&mdsc->stopping_waiter);
+ init_waitqueue_head(&mdsc->session_close_wq);
+ INIT_LIST_HEAD(&mdsc->waiting_for_map);
+ mdsc->quotarealms_inodes = RB_ROOT;
+diff --git a/fs/ceph/mds_client.h b/fs/ceph/mds_client.h
+index 86d2965e68a1f..cff7392809032 100644
+--- a/fs/ceph/mds_client.h
++++ b/fs/ceph/mds_client.h
+@@ -381,8 +381,9 @@ struct cap_wait {
+ };
+
+ enum {
+- CEPH_MDSC_STOPPING_BEGIN = 1,
+- CEPH_MDSC_STOPPING_FLUSHED = 2,
++ CEPH_MDSC_STOPPING_BEGIN = 1,
++ CEPH_MDSC_STOPPING_FLUSHING = 2,
++ CEPH_MDSC_STOPPING_FLUSHED = 3,
+ };
+
+ /*
+@@ -401,7 +402,11 @@ struct ceph_mds_client {
+ struct ceph_mds_session **sessions; /* NULL for mds if no session */
+ atomic_t num_sessions;
+ int max_sessions; /* len of sessions array */
+- int stopping; /* true if shutting down */
++
++ spinlock_t stopping_lock; /* protect snap_empty */
++ int stopping; /* the stage of shutting down */
++ atomic_t stopping_blockers;
++ struct completion stopping_waiter;
+
+ atomic64_t quotarealms_count; /* # realms with quota */
+ /*
+diff --git a/fs/ceph/quota.c b/fs/ceph/quota.c
+index 64592adfe48fb..f7fcf7f08ec64 100644
+--- a/fs/ceph/quota.c
++++ b/fs/ceph/quota.c
+@@ -47,25 +47,23 @@ void ceph_handle_quota(struct ceph_mds_client *mdsc,
+ struct inode *inode;
+ struct ceph_inode_info *ci;
+
++ if (!ceph_inc_mds_stopping_blocker(mdsc, session))
++ return;
++
+ if (msg->front.iov_len < sizeof(*h)) {
+ pr_err("%s corrupt message mds%d len %d\n", __func__,
+ session->s_mds, (int)msg->front.iov_len);
+ ceph_msg_dump(msg);
+- return;
++ goto out;
+ }
+
+- /* increment msg sequence number */
+- mutex_lock(&session->s_mutex);
+- inc_session_sequence(session);
+- mutex_unlock(&session->s_mutex);
+-
+ /* lookup inode */
+ vino.ino = le64_to_cpu(h->ino);
+ vino.snap = CEPH_NOSNAP;
+ inode = ceph_find_inode(sb, vino);
+ if (!inode) {
+ pr_warn("Failed to find inode %llu\n", vino.ino);
+- return;
++ goto out;
+ }
+ ci = ceph_inode(inode);
+
+@@ -78,6 +76,8 @@ void ceph_handle_quota(struct ceph_mds_client *mdsc,
+ spin_unlock(&ci->i_ceph_lock);
+
+ iput(inode);
++out:
++ ceph_dec_mds_stopping_blocker(mdsc);
+ }
+
+ static struct ceph_quotarealm_inode *
+diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
+index 343d738448dcd..7ddc6bad77ef3 100644
+--- a/fs/ceph/snap.c
++++ b/fs/ceph/snap.c
+@@ -1015,6 +1015,9 @@ void ceph_handle_snap(struct ceph_mds_client *mdsc,
+ int locked_rwsem = 0;
+ bool close_sessions = false;
+
++ if (!ceph_inc_mds_stopping_blocker(mdsc, session))
++ return;
++
+ /* decode */
+ if (msg->front.iov_len < sizeof(*h))
+ goto bad;
+@@ -1030,10 +1033,6 @@ void ceph_handle_snap(struct ceph_mds_client *mdsc,
+ dout("%s from mds%d op %s split %llx tracelen %d\n", __func__,
+ mds, ceph_snap_op_name(op), split, trace_len);
+
+- mutex_lock(&session->s_mutex);
+- inc_session_sequence(session);
+- mutex_unlock(&session->s_mutex);
+-
+ down_write(&mdsc->snap_rwsem);
+ locked_rwsem = 1;
+
+@@ -1151,6 +1150,7 @@ void ceph_handle_snap(struct ceph_mds_client *mdsc,
+ up_write(&mdsc->snap_rwsem);
+
+ flush_snaps(mdsc);
++ ceph_dec_mds_stopping_blocker(mdsc);
+ return;
+
+ bad:
+@@ -1160,6 +1160,8 @@ void ceph_handle_snap(struct ceph_mds_client *mdsc,
+ if (locked_rwsem)
+ up_write(&mdsc->snap_rwsem);
+
++ ceph_dec_mds_stopping_blocker(mdsc);
++
+ if (close_sessions)
+ ceph_mdsc_close_sessions(mdsc);
+ return;
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index a5f52013314d6..281b493fdac8e 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -1365,25 +1365,90 @@ static int ceph_init_fs_context(struct fs_context *fc)
+ return -ENOMEM;
+ }
+
++/*
++ * Return true if it successfully increases the blocker counter,
++ * or false if the mdsc is in stopping and flushed state.
++ */
++static bool __inc_stopping_blocker(struct ceph_mds_client *mdsc)
++{
++ spin_lock(&mdsc->stopping_lock);
++ if (mdsc->stopping >= CEPH_MDSC_STOPPING_FLUSHING) {
++ spin_unlock(&mdsc->stopping_lock);
++ return false;
++ }
++ atomic_inc(&mdsc->stopping_blockers);
++ spin_unlock(&mdsc->stopping_lock);
++ return true;
++}
++
++static void __dec_stopping_blocker(struct ceph_mds_client *mdsc)
++{
++ spin_lock(&mdsc->stopping_lock);
++ if (!atomic_dec_return(&mdsc->stopping_blockers) &&
++ mdsc->stopping >= CEPH_MDSC_STOPPING_FLUSHING)
++ complete_all(&mdsc->stopping_waiter);
++ spin_unlock(&mdsc->stopping_lock);
++}
++
++/* For metadata IO requests */
++bool ceph_inc_mds_stopping_blocker(struct ceph_mds_client *mdsc,
++ struct ceph_mds_session *session)
++{
++ mutex_lock(&session->s_mutex);
++ inc_session_sequence(session);
++ mutex_unlock(&session->s_mutex);
++
++ return __inc_stopping_blocker(mdsc);
++}
++
++void ceph_dec_mds_stopping_blocker(struct ceph_mds_client *mdsc)
++{
++ __dec_stopping_blocker(mdsc);
++}
++
+ static void ceph_kill_sb(struct super_block *s)
+ {
+ struct ceph_fs_client *fsc = ceph_sb_to_client(s);
++ struct ceph_mds_client *mdsc = fsc->mdsc;
++ bool wait;
+
+ dout("kill_sb %p\n", s);
+
+- ceph_mdsc_pre_umount(fsc->mdsc);
++ ceph_mdsc_pre_umount(mdsc);
+ flush_fs_workqueues(fsc);
+
+ /*
+ * Though the kill_anon_super() will finally trigger the
+- * sync_filesystem() anyway, we still need to do it here
+- * and then bump the stage of shutdown to stop the work
+- * queue as earlier as possible.
++ * sync_filesystem() anyway, we still need to do it here and
++ * then bump the stage of shutdown. This will allow us to
++ * drop any further message, which will increase the inodes'
++ * i_count reference counters but makes no sense any more,
++ * from MDSs.
++ *
++ * Without this when evicting the inodes it may fail in the
++ * kill_anon_super(), which will trigger a warning when
++ * destroying the fscrypt keyring and then possibly trigger
++ * a further crash in ceph module when the iput() tries to
++ * evict the inodes later.
+ */
+ sync_filesystem(s);
+
+- fsc->mdsc->stopping = CEPH_MDSC_STOPPING_FLUSHED;
++ spin_lock(&mdsc->stopping_lock);
++ mdsc->stopping = CEPH_MDSC_STOPPING_FLUSHING;
++ wait = !!atomic_read(&mdsc->stopping_blockers);
++ spin_unlock(&mdsc->stopping_lock);
++
++ if (wait && atomic_read(&mdsc->stopping_blockers)) {
++ long timeleft = wait_for_completion_killable_timeout(
++ &mdsc->stopping_waiter,
++ fsc->client->options->mount_timeout);
++ if (!timeleft) /* timed out */
++ pr_warn("umount timed out, %ld\n", timeleft);
++ else if (timeleft < 0) /* killed */
++ pr_warn("umount was killed, %ld\n", timeleft);
++ }
+
++ mdsc->stopping = CEPH_MDSC_STOPPING_FLUSHED;
+ kill_anon_super(s);
+
+ fsc->client->extra_mon_dispatch = NULL;
+diff --git a/fs/ceph/super.h b/fs/ceph/super.h
+index 3bfddf34d488b..e6c1edf9e12b0 100644
+--- a/fs/ceph/super.h
++++ b/fs/ceph/super.h
+@@ -1375,4 +1375,7 @@ extern bool ceph_quota_update_statfs(struct ceph_fs_client *fsc,
+ struct kstatfs *buf);
+ extern void ceph_cleanup_quotarealms_inodes(struct ceph_mds_client *mdsc);
+
++bool ceph_inc_mds_stopping_blocker(struct ceph_mds_client *mdsc,
++ struct ceph_mds_session *session);
++void ceph_dec_mds_stopping_blocker(struct ceph_mds_client *mdsc);
+ #endif /* _FS_CEPH_SUPER_H */
+--
+2.40.1
+
--- /dev/null
+From 982bf30fa13ccdde986ddc11b0595b2d1d79e8d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Aug 2023 11:32:21 +0900
+Subject: dma-debug: don't call __dma_entry_alloc_check_leak() under
+ free_entries_lock
+
+From: Sergey Senozhatsky <senozhatsky@chromium.org>
+
+[ Upstream commit fb5a4315591dae307a65fc246ca80b5159d296e1 ]
+
+__dma_entry_alloc_check_leak() calls into printk -> serial console
+output (qcom geni) and grabs port->lock under free_entries_lock
+spin lock, which is a reverse locking dependency chain as qcom_geni
+IRQ handler can call into dma-debug code and grab free_entries_lock
+under port->lock.
+
+Move __dma_entry_alloc_check_leak() call out of free_entries_lock
+scope so that we don't acquire serial console's port->lock under it.
+
+Trimmed-down lockdep splat:
+
+ The existing dependency chain (in reverse order) is:
+
+ -> #2 (free_entries_lock){-.-.}-{2:2}:
+ _raw_spin_lock_irqsave+0x60/0x80
+ dma_entry_alloc+0x38/0x110
+ debug_dma_map_page+0x60/0xf8
+ dma_map_page_attrs+0x1e0/0x230
+ dma_map_single_attrs.constprop.0+0x6c/0xc8
+ geni_se_rx_dma_prep+0x40/0xcc
+ qcom_geni_serial_isr+0x310/0x510
+ __handle_irq_event_percpu+0x110/0x244
+ handle_irq_event_percpu+0x20/0x54
+ handle_irq_event+0x50/0x88
+ handle_fasteoi_irq+0xa4/0xcc
+ handle_irq_desc+0x28/0x40
+ generic_handle_domain_irq+0x24/0x30
+ gic_handle_irq+0xc4/0x148
+ do_interrupt_handler+0xa4/0xb0
+ el1_interrupt+0x34/0x64
+ el1h_64_irq_handler+0x18/0x24
+ el1h_64_irq+0x64/0x68
+ arch_local_irq_enable+0x4/0x8
+ ____do_softirq+0x18/0x24
+ ...
+
+ -> #1 (&port_lock_key){-.-.}-{2:2}:
+ _raw_spin_lock_irqsave+0x60/0x80
+ qcom_geni_serial_console_write+0x184/0x1dc
+ console_flush_all+0x344/0x454
+ console_unlock+0x94/0xf0
+ vprintk_emit+0x238/0x24c
+ vprintk_default+0x3c/0x48
+ vprintk+0xb4/0xbc
+ _printk+0x68/0x90
+ register_console+0x230/0x38c
+ uart_add_one_port+0x338/0x494
+ qcom_geni_serial_probe+0x390/0x424
+ platform_probe+0x70/0xc0
+ really_probe+0x148/0x280
+ __driver_probe_device+0xfc/0x114
+ driver_probe_device+0x44/0x100
+ __device_attach_driver+0x64/0xdc
+ bus_for_each_drv+0xb0/0xd8
+ __device_attach+0xe4/0x140
+ device_initial_probe+0x1c/0x28
+ bus_probe_device+0x44/0xb0
+ device_add+0x538/0x668
+ of_device_add+0x44/0x50
+ of_platform_device_create_pdata+0x94/0xc8
+ of_platform_bus_create+0x270/0x304
+ of_platform_populate+0xac/0xc4
+ devm_of_platform_populate+0x60/0xac
+ geni_se_probe+0x154/0x160
+ platform_probe+0x70/0xc0
+ ...
+
+ -> #0 (console_owner){-...}-{0:0}:
+ __lock_acquire+0xdf8/0x109c
+ lock_acquire+0x234/0x284
+ console_flush_all+0x330/0x454
+ console_unlock+0x94/0xf0
+ vprintk_emit+0x238/0x24c
+ vprintk_default+0x3c/0x48
+ vprintk+0xb4/0xbc
+ _printk+0x68/0x90
+ dma_entry_alloc+0xb4/0x110
+ debug_dma_map_sg+0xdc/0x2f8
+ __dma_map_sg_attrs+0xac/0xe4
+ dma_map_sgtable+0x30/0x4c
+ get_pages+0x1d4/0x1e4 [msm]
+ msm_gem_pin_pages_locked+0x38/0xac [msm]
+ msm_gem_pin_vma_locked+0x58/0x88 [msm]
+ msm_ioctl_gem_submit+0xde4/0x13ac [msm]
+ drm_ioctl_kernel+0xe0/0x15c
+ drm_ioctl+0x2e8/0x3f4
+ vfs_ioctl+0x30/0x50
+ ...
+
+ Chain exists of:
+ console_owner --> &port_lock_key --> free_entries_lock
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(free_entries_lock);
+ lock(&port_lock_key);
+ lock(free_entries_lock);
+ lock(console_owner);
+
+ *** DEADLOCK ***
+
+ Call trace:
+ dump_backtrace+0xb4/0xf0
+ show_stack+0x20/0x30
+ dump_stack_lvl+0x60/0x84
+ dump_stack+0x18/0x24
+ print_circular_bug+0x1cc/0x234
+ check_noncircular+0x78/0xac
+ __lock_acquire+0xdf8/0x109c
+ lock_acquire+0x234/0x284
+ console_flush_all+0x330/0x454
+ console_unlock+0x94/0xf0
+ vprintk_emit+0x238/0x24c
+ vprintk_default+0x3c/0x48
+ vprintk+0xb4/0xbc
+ _printk+0x68/0x90
+ dma_entry_alloc+0xb4/0x110
+ debug_dma_map_sg+0xdc/0x2f8
+ __dma_map_sg_attrs+0xac/0xe4
+ dma_map_sgtable+0x30/0x4c
+ get_pages+0x1d4/0x1e4 [msm]
+ msm_gem_pin_pages_locked+0x38/0xac [msm]
+ msm_gem_pin_vma_locked+0x58/0x88 [msm]
+ msm_ioctl_gem_submit+0xde4/0x13ac [msm]
+ drm_ioctl_kernel+0xe0/0x15c
+ drm_ioctl+0x2e8/0x3f4
+ vfs_ioctl+0x30/0x50
+ ...
+
+Reported-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Acked-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/dma/debug.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
+index f190651bcaddc..06366acd27b08 100644
+--- a/kernel/dma/debug.c
++++ b/kernel/dma/debug.c
+@@ -637,15 +637,19 @@ static struct dma_debug_entry *__dma_entry_alloc(void)
+ return entry;
+ }
+
+-static void __dma_entry_alloc_check_leak(void)
++/*
++ * This should be called outside of free_entries_lock scope to avoid potential
++ * deadlocks with serial consoles that use DMA.
++ */
++static void __dma_entry_alloc_check_leak(u32 nr_entries)
+ {
+- u32 tmp = nr_total_entries % nr_prealloc_entries;
++ u32 tmp = nr_entries % nr_prealloc_entries;
+
+ /* Shout each time we tick over some multiple of the initial pool */
+ if (tmp < DMA_DEBUG_DYNAMIC_ENTRIES) {
+ pr_info("dma_debug_entry pool grown to %u (%u00%%)\n",
+- nr_total_entries,
+- (nr_total_entries / nr_prealloc_entries));
++ nr_entries,
++ (nr_entries / nr_prealloc_entries));
+ }
+ }
+
+@@ -656,8 +660,10 @@ static void __dma_entry_alloc_check_leak(void)
+ */
+ static struct dma_debug_entry *dma_entry_alloc(void)
+ {
++ bool alloc_check_leak = false;
+ struct dma_debug_entry *entry;
+ unsigned long flags;
++ u32 nr_entries;
+
+ spin_lock_irqsave(&free_entries_lock, flags);
+ if (num_free_entries == 0) {
+@@ -667,13 +673,17 @@ static struct dma_debug_entry *dma_entry_alloc(void)
+ pr_err("debugging out of memory - disabling\n");
+ return NULL;
+ }
+- __dma_entry_alloc_check_leak();
++ alloc_check_leak = true;
++ nr_entries = nr_total_entries;
+ }
+
+ entry = __dma_entry_alloc();
+
+ spin_unlock_irqrestore(&free_entries_lock, flags);
+
++ if (alloc_check_leak)
++ __dma_entry_alloc_check_leak(nr_entries);
++
+ #ifdef CONFIG_STACKTRACE
+ entry->stack_len = stack_trace_save(entry->stack_entries,
+ ARRAY_SIZE(entry->stack_entries),
+--
+2.40.1
+
--- /dev/null
+From 7d7873c6a39711cedd5d35212aed1f5da583276d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Aug 2023 14:04:26 -0400
+Subject: drm/amd/display: Don't check registers, if using AUX BL control
+
+From: Swapnil Patel <swapnil.patel@amd.com>
+
+[ Upstream commit f5b2c10b57615828b531bb0ae56bd6325a41167e ]
+
+[Why]
+Currently the driver looks DCN registers to access if BL is on or not.
+This check is not valid if we are using AUX based brightness control.
+This causes driver to not send out "backlight off" command during power off
+sequence as it already thinks it is off.
+
+[How]
+Only check DCN registers if we aren't using AUX based brightness control.
+
+Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
+Acked-by: Stylon Wang <stylon.wang@amd.com>
+Signed-off-by: Swapnil Patel <swapnil.patel@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+index 6966420dfbac3..15fa19ee748cf 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+@@ -964,7 +964,9 @@ void dce110_edp_backlight_control(
+ return;
+ }
+
+- if (link->panel_cntl) {
++ if (link->panel_cntl && !(link->dpcd_sink_ext_caps.bits.oled ||
++ link->dpcd_sink_ext_caps.bits.hdr_aux_backlight_control == 1 ||
++ link->dpcd_sink_ext_caps.bits.sdr_aux_backlight_control == 1)) {
+ bool is_backlight_on = link->panel_cntl->funcs->is_panel_backlight_on(link->panel_cntl);
+
+ if ((enable && is_backlight_on) || (!enable && !is_backlight_on)) {
+--
+2.40.1
+
--- /dev/null
+From 9a9eb617f4a569128b77bd8f2c046db13bbc7b72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Sep 2023 21:21:55 +0800
+Subject: drm/amdgpu: fallback to old RAS error message for aqua_vanjaram
+
+From: Hawking Zhang <Hawking.Zhang@amd.com>
+
+[ Upstream commit ffd6bde302061aeee405ab364403af30210f0b99 ]
+
+So driver doesn't generate incorrect message until
+the new format is settled down for aqua_vanjaram
+
+Signed-off-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Reviewed-by: Yang Wang <kevinyang.wang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+index 8aaa427f8c0f6..7d5019a884024 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+@@ -1061,7 +1061,8 @@ int amdgpu_ras_query_error_status(struct amdgpu_device *adev,
+ info->ce_count = obj->err_data.ce_count;
+
+ if (err_data.ce_count) {
+- if (adev->smuio.funcs &&
++ if (!adev->aid_mask &&
++ adev->smuio.funcs &&
+ adev->smuio.funcs->get_socket_id &&
+ adev->smuio.funcs->get_die_id) {
+ dev_info(adev->dev, "socket: %d, die: %d "
+@@ -1081,7 +1082,8 @@ int amdgpu_ras_query_error_status(struct amdgpu_device *adev,
+ }
+ }
+ if (err_data.ue_count) {
+- if (adev->smuio.funcs &&
++ if (!adev->aid_mask &&
++ adev->smuio.funcs &&
+ adev->smuio.funcs->get_socket_id &&
+ adev->smuio.funcs->get_die_id) {
+ dev_info(adev->dev, "socket: %d, die: %d "
+--
+2.40.1
+
--- /dev/null
+From 11b152e11d4a615db014514ba2cbe0168c9ddf51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Sep 2023 10:13:51 -0400
+Subject: drm/amdgpu: Handle null atom context in VBIOS info ioctl
+
+From: David Francis <David.Francis@amd.com>
+
+[ Upstream commit 5e7e82254270c8cf8b107451c5de01cee2f135ae ]
+
+On some APU systems, there is no atom context and so the
+atom_context struct is null.
+
+Add a check to the VBIOS_INFO branch of amdgpu_info_ioctl
+to handle this case, returning all zeroes.
+
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: David Francis <David.Francis@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+index f678bdd5f353d..b9fc7e2db5e59 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -940,12 +940,17 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
+ struct atom_context *atom_context;
+
+ atom_context = adev->mode_info.atom_context;
+- memcpy(vbios_info.name, atom_context->name, sizeof(atom_context->name));
+- memcpy(vbios_info.vbios_pn, atom_context->vbios_pn, sizeof(atom_context->vbios_pn));
+- vbios_info.version = atom_context->version;
+- memcpy(vbios_info.vbios_ver_str, atom_context->vbios_ver_str,
+- sizeof(atom_context->vbios_ver_str));
+- memcpy(vbios_info.date, atom_context->date, sizeof(atom_context->date));
++ if (atom_context) {
++ memcpy(vbios_info.name, atom_context->name,
++ sizeof(atom_context->name));
++ memcpy(vbios_info.vbios_pn, atom_context->vbios_pn,
++ sizeof(atom_context->vbios_pn));
++ vbios_info.version = atom_context->version;
++ memcpy(vbios_info.vbios_ver_str, atom_context->vbios_ver_str,
++ sizeof(atom_context->vbios_ver_str));
++ memcpy(vbios_info.date, atom_context->date,
++ sizeof(atom_context->date));
++ }
+
+ return copy_to_user(out, &vbios_info,
+ min((size_t)size, sizeof(vbios_info))) ? -EFAULT : 0;
+--
+2.40.1
+
--- /dev/null
+From 0b7332b7be0f69e506ee491bf76209cb04fe4b4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Sep 2023 15:44:54 -0400
+Subject: drm/amdgpu/nbio4.3: set proper rmmio_remap.reg_offset for SR-IOV
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit ab43213e7afd08ac68d4282060bacf309e70fd14 ]
+
+Needed for HDP flush to work correctly.
+
+Reviewed-by: Timmy Tsai <timmtsai@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/nbio_v4_3.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/nbio_v4_3.c b/drivers/gpu/drm/amd/amdgpu/nbio_v4_3.c
+index d5ed9e0e1a5f1..e5b5b0f4940f4 100644
+--- a/drivers/gpu/drm/amd/amdgpu/nbio_v4_3.c
++++ b/drivers/gpu/drm/amd/amdgpu/nbio_v4_3.c
+@@ -345,6 +345,9 @@ static void nbio_v4_3_init_registers(struct amdgpu_device *adev)
+ data &= ~RCC_DEV0_EPF2_STRAP2__STRAP_NO_SOFT_RESET_DEV0_F2_MASK;
+ WREG32_SOC15(NBIO, 0, regRCC_DEV0_EPF2_STRAP2, data);
+ }
++ if (amdgpu_sriov_vf(adev))
++ adev->rmmio_remap.reg_offset = SOC15_REG_OFFSET(NBIO, 0,
++ regBIF_BX_DEV0_EPF0_VF0_HDP_MEM_COHERENCY_FLUSH_CNTL) << 2;
+ }
+
+ static u32 nbio_v4_3_get_rom_offset(struct amdgpu_device *adev)
+--
+2.40.1
+
--- /dev/null
+From 26c094444dafab9d5664c1996923c40df78be794 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Sep 2023 11:35:04 -0400
+Subject: drm/amdgpu/soc21: don't remap HDP registers for SR-IOV
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 1832403cd41ca6b19b24e9d64f79cb08d920ca44 ]
+
+This matches the behavior for soc15 and nv.
+
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Timmy Tsai <timmtsai@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/soc21.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/soc21.c b/drivers/gpu/drm/amd/amdgpu/soc21.c
+index e5e5d68a4d702..1a5ffbf884891 100644
+--- a/drivers/gpu/drm/amd/amdgpu/soc21.c
++++ b/drivers/gpu/drm/amd/amdgpu/soc21.c
+@@ -786,7 +786,7 @@ static int soc21_common_hw_init(void *handle)
+ * for the purpose of expose those registers
+ * to process space
+ */
+- if (adev->nbio.funcs->remap_hdp_registers)
++ if (adev->nbio.funcs->remap_hdp_registers && !amdgpu_sriov_vf(adev))
+ adev->nbio.funcs->remap_hdp_registers(adev);
+ /* enable the doorbell aperture */
+ adev->nbio.funcs->enable_doorbell_aperture(adev, true);
+--
+2.40.1
+
--- /dev/null
+From 0984d305927ed02e48819d59414c6376e8a8f871 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Aug 2023 11:59:09 -0400
+Subject: drm/amdgpu: Store CU info from all XCCs for GFX v9.4.3
+
+From: Mukul Joshi <mukul.joshi@amd.com>
+
+[ Upstream commit 97e3c6a853f2af9145daf0c6ca25bcdf55c759d4 ]
+
+Currently, we store CU info only for a single XCC assuming
+that it is the same for all XCCs. However, that may not be
+true. As a result, store CU info for all XCCs. This info is
+later used for CU masking.
+
+Signed-off-by: Mukul Joshi <mukul.joshi@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 2 +-
+ drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h | 3 +-
+ drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 2 +-
+ drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 +-
+ drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 +-
+ drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 2 +-
+ drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 2 +-
+ drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 2 +-
+ drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 4 +-
+ drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 76 +++++++++----------
+ drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 3 +-
+ drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c | 8 +-
+ drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 11 ++-
+ .../gpu/drm/amd/include/kgd_kfd_interface.h | 6 +-
+ 14 files changed, 60 insertions(+), 65 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
+index b4fcad0e62f7e..a7c8beff1647c 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
+@@ -492,7 +492,7 @@ void amdgpu_amdkfd_get_cu_info(struct amdgpu_device *adev, struct kfd_cu_info *c
+ cu_info->cu_active_number = acu_info.number;
+ cu_info->cu_ao_mask = acu_info.ao_cu_mask;
+ memcpy(&cu_info->cu_bitmap[0], &acu_info.bitmap[0],
+- sizeof(acu_info.bitmap));
++ sizeof(cu_info->cu_bitmap));
+ cu_info->num_shader_engines = adev->gfx.config.max_shader_engines;
+ cu_info->num_shader_arrays_per_engine = adev->gfx.config.max_sh_per_se;
+ cu_info->num_cu_per_sh = adev->gfx.config.max_cu_per_sh;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
+index a4ff515ce8966..59ba03d387fcc 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
+@@ -43,6 +43,7 @@
+ #define AMDGPU_GFX_LBPW_DISABLED_MODE 0x00000008L
+
+ #define AMDGPU_MAX_GC_INSTANCES 8
++#define KGD_MAX_QUEUES 128
+
+ #define AMDGPU_MAX_GFX_QUEUES KGD_MAX_QUEUES
+ #define AMDGPU_MAX_COMPUTE_QUEUES KGD_MAX_QUEUES
+@@ -254,7 +255,7 @@ struct amdgpu_cu_info {
+ uint32_t number;
+ uint32_t ao_cu_mask;
+ uint32_t ao_cu_bitmap[4][4];
+- uint32_t bitmap[4][4];
++ uint32_t bitmap[AMDGPU_MAX_GC_INSTANCES][4][4];
+ };
+
+ struct amdgpu_gfx_ras {
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+index d4ca19ba5a289..f678bdd5f353d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -839,7 +839,7 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
+ memcpy(&dev_info->cu_ao_bitmap[0], &adev->gfx.cu_info.ao_cu_bitmap[0],
+ sizeof(adev->gfx.cu_info.ao_cu_bitmap));
+ memcpy(&dev_info->cu_bitmap[0], &adev->gfx.cu_info.bitmap[0],
+- sizeof(adev->gfx.cu_info.bitmap));
++ sizeof(dev_info->cu_bitmap));
+ dev_info->vram_type = adev->gmc.vram_type;
+ dev_info->vram_bit_width = adev->gmc.vram_width;
+ dev_info->vce_harvest_config = adev->vce.harvest_config;
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+index 44af8022b89fa..f743bf2c92877 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+@@ -9448,7 +9448,7 @@ static int gfx_v10_0_get_cu_info(struct amdgpu_device *adev,
+ gfx_v10_0_set_user_wgp_inactive_bitmap_per_sh(
+ adev, disable_masks[i * 2 + j]);
+ bitmap = gfx_v10_0_get_cu_active_bitmap_per_sh(adev);
+- cu_info->bitmap[i][j] = bitmap;
++ cu_info->bitmap[0][i][j] = bitmap;
+
+ for (k = 0; k < adev->gfx.config.max_cu_per_sh; k++) {
+ if (bitmap & mask) {
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+index 0451533ddde41..a82cba884c48f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+@@ -6394,7 +6394,7 @@ static int gfx_v11_0_get_cu_info(struct amdgpu_device *adev,
+ * SE6: {SH0,SH1} --> {bitmap[2][2], bitmap[2][3]}
+ * SE7: {SH0,SH1} --> {bitmap[3][2], bitmap[3][3]}
+ */
+- cu_info->bitmap[i % 4][j + (i / 4) * 2] = bitmap;
++ cu_info->bitmap[0][i % 4][j + (i / 4) * 2] = bitmap;
+
+ for (k = 0; k < adev->gfx.config.max_cu_per_sh; k++) {
+ if (bitmap & mask)
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
+index da6caff78c22b..34f9211b26793 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c
+@@ -3577,7 +3577,7 @@ static void gfx_v6_0_get_cu_info(struct amdgpu_device *adev)
+ gfx_v6_0_set_user_cu_inactive_bitmap(
+ adev, disable_masks[i * 2 + j]);
+ bitmap = gfx_v6_0_get_cu_enabled(adev);
+- cu_info->bitmap[i][j] = bitmap;
++ cu_info->bitmap[0][i][j] = bitmap;
+
+ for (k = 0; k < adev->gfx.config.max_cu_per_sh; k++) {
+ if (bitmap & mask) {
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+index 8c174c11eaee0..6feae2548e8ee 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+@@ -5122,7 +5122,7 @@ static void gfx_v7_0_get_cu_info(struct amdgpu_device *adev)
+ gfx_v7_0_set_user_cu_inactive_bitmap(
+ adev, disable_masks[i * 2 + j]);
+ bitmap = gfx_v7_0_get_cu_active_bitmap(adev);
+- cu_info->bitmap[i][j] = bitmap;
++ cu_info->bitmap[0][i][j] = bitmap;
+
+ for (k = 0; k < adev->gfx.config.max_cu_per_sh; k ++) {
+ if (bitmap & mask) {
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+index 51c1745c83697..885ebd703260f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+@@ -7121,7 +7121,7 @@ static void gfx_v8_0_get_cu_info(struct amdgpu_device *adev)
+ gfx_v8_0_set_user_cu_inactive_bitmap(
+ adev, disable_masks[i * 2 + j]);
+ bitmap = gfx_v8_0_get_cu_active_bitmap(adev);
+- cu_info->bitmap[i][j] = bitmap;
++ cu_info->bitmap[0][i][j] = bitmap;
+
+ for (k = 0; k < adev->gfx.config.max_cu_per_sh; k ++) {
+ if (bitmap & mask) {
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+index 372ae2fc42e0c..602d74023b0b9 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+@@ -1497,7 +1497,7 @@ static void gfx_v9_0_init_always_on_cu_mask(struct amdgpu_device *adev)
+ amdgpu_gfx_select_se_sh(adev, i, j, 0xffffffff, 0);
+
+ for (k = 0; k < adev->gfx.config.max_cu_per_sh; k ++) {
+- if (cu_info->bitmap[i][j] & mask) {
++ if (cu_info->bitmap[0][i][j] & mask) {
+ if (counter == pg_always_on_cu_num)
+ WREG32_SOC15(GC, 0, mmRLC_PG_ALWAYS_ON_CU_MASK, cu_bitmap);
+ if (counter < always_on_cu_num)
+@@ -7237,7 +7237,7 @@ static int gfx_v9_0_get_cu_info(struct amdgpu_device *adev,
+ * SE6,SH0 --> bitmap[2][1]
+ * SE7,SH0 --> bitmap[3][1]
+ */
+- cu_info->bitmap[i % 4][j + i / 4] = bitmap;
++ cu_info->bitmap[0][i % 4][j + i / 4] = bitmap;
+
+ for (k = 0; k < adev->gfx.config.max_cu_per_sh; k ++) {
+ if (bitmap & mask) {
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
+index 4f883b94f98ef..84a74a6c6b2de 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
+@@ -4228,7 +4228,7 @@ static void gfx_v9_4_3_set_gds_init(struct amdgpu_device *adev)
+ }
+
+ static void gfx_v9_4_3_set_user_cu_inactive_bitmap(struct amdgpu_device *adev,
+- u32 bitmap)
++ u32 bitmap, int xcc_id)
+ {
+ u32 data;
+
+@@ -4238,15 +4238,15 @@ static void gfx_v9_4_3_set_user_cu_inactive_bitmap(struct amdgpu_device *adev,
+ data = bitmap << GC_USER_SHADER_ARRAY_CONFIG__INACTIVE_CUS__SHIFT;
+ data &= GC_USER_SHADER_ARRAY_CONFIG__INACTIVE_CUS_MASK;
+
+- WREG32_SOC15(GC, GET_INST(GC, 0), regGC_USER_SHADER_ARRAY_CONFIG, data);
++ WREG32_SOC15(GC, GET_INST(GC, xcc_id), regGC_USER_SHADER_ARRAY_CONFIG, data);
+ }
+
+-static u32 gfx_v9_4_3_get_cu_active_bitmap(struct amdgpu_device *adev)
++static u32 gfx_v9_4_3_get_cu_active_bitmap(struct amdgpu_device *adev, int xcc_id)
+ {
+ u32 data, mask;
+
+- data = RREG32_SOC15(GC, GET_INST(GC, 0), regCC_GC_SHADER_ARRAY_CONFIG);
+- data |= RREG32_SOC15(GC, GET_INST(GC, 0), regGC_USER_SHADER_ARRAY_CONFIG);
++ data = RREG32_SOC15(GC, GET_INST(GC, xcc_id), regCC_GC_SHADER_ARRAY_CONFIG);
++ data |= RREG32_SOC15(GC, GET_INST(GC, xcc_id), regGC_USER_SHADER_ARRAY_CONFIG);
+
+ data &= CC_GC_SHADER_ARRAY_CONFIG__INACTIVE_CUS_MASK;
+ data >>= CC_GC_SHADER_ARRAY_CONFIG__INACTIVE_CUS__SHIFT;
+@@ -4259,7 +4259,7 @@ static u32 gfx_v9_4_3_get_cu_active_bitmap(struct amdgpu_device *adev)
+ static int gfx_v9_4_3_get_cu_info(struct amdgpu_device *adev,
+ struct amdgpu_cu_info *cu_info)
+ {
+- int i, j, k, counter, active_cu_number = 0;
++ int i, j, k, counter, xcc_id, active_cu_number = 0;
+ u32 mask, bitmap, ao_bitmap, ao_cu_mask = 0;
+ unsigned disable_masks[4 * 4];
+
+@@ -4278,46 +4278,38 @@ static int gfx_v9_4_3_get_cu_info(struct amdgpu_device *adev,
+ adev->gfx.config.max_sh_per_se);
+
+ mutex_lock(&adev->grbm_idx_mutex);
+- for (i = 0; i < adev->gfx.config.max_shader_engines; i++) {
+- for (j = 0; j < adev->gfx.config.max_sh_per_se; j++) {
+- mask = 1;
+- ao_bitmap = 0;
+- counter = 0;
+- gfx_v9_4_3_xcc_select_se_sh(adev, i, j, 0xffffffff, 0);
+- gfx_v9_4_3_set_user_cu_inactive_bitmap(
+- adev, disable_masks[i * adev->gfx.config.max_sh_per_se + j]);
+- bitmap = gfx_v9_4_3_get_cu_active_bitmap(adev);
+-
+- /*
+- * The bitmap(and ao_cu_bitmap) in cu_info structure is
+- * 4x4 size array, and it's usually suitable for Vega
+- * ASICs which has 4*2 SE/SH layout.
+- * But for Arcturus, SE/SH layout is changed to 8*1.
+- * To mostly reduce the impact, we make it compatible
+- * with current bitmap array as below:
+- * SE4,SH0 --> bitmap[0][1]
+- * SE5,SH0 --> bitmap[1][1]
+- * SE6,SH0 --> bitmap[2][1]
+- * SE7,SH0 --> bitmap[3][1]
+- */
+- cu_info->bitmap[i % 4][j + i / 4] = bitmap;
+-
+- for (k = 0; k < adev->gfx.config.max_cu_per_sh; k++) {
+- if (bitmap & mask) {
+- if (counter < adev->gfx.config.max_cu_per_sh)
+- ao_bitmap |= mask;
+- counter++;
++ for (xcc_id = 0; xcc_id < NUM_XCC(adev->gfx.xcc_mask); xcc_id++) {
++ for (i = 0; i < adev->gfx.config.max_shader_engines; i++) {
++ for (j = 0; j < adev->gfx.config.max_sh_per_se; j++) {
++ mask = 1;
++ ao_bitmap = 0;
++ counter = 0;
++ gfx_v9_4_3_xcc_select_se_sh(adev, i, j, 0xffffffff, xcc_id);
++ gfx_v9_4_3_set_user_cu_inactive_bitmap(
++ adev,
++ disable_masks[i * adev->gfx.config.max_sh_per_se + j],
++ xcc_id);
++ bitmap = gfx_v9_4_3_get_cu_active_bitmap(adev, xcc_id);
++
++ cu_info->bitmap[xcc_id][i][j] = bitmap;
++
++ for (k = 0; k < adev->gfx.config.max_cu_per_sh; k++) {
++ if (bitmap & mask) {
++ if (counter < adev->gfx.config.max_cu_per_sh)
++ ao_bitmap |= mask;
++ counter++;
++ }
++ mask <<= 1;
+ }
+- mask <<= 1;
++ active_cu_number += counter;
++ if (i < 2 && j < 2)
++ ao_cu_mask |= (ao_bitmap << (i * 16 + j * 8));
++ cu_info->ao_cu_bitmap[i][j] = ao_bitmap;
+ }
+- active_cu_number += counter;
+- if (i < 2 && j < 2)
+- ao_cu_mask |= (ao_bitmap << (i * 16 + j * 8));
+- cu_info->ao_cu_bitmap[i % 4][j + i / 4] = ao_bitmap;
+ }
++ gfx_v9_4_3_xcc_select_se_sh(adev, 0xffffffff, 0xffffffff, 0xffffffff,
++ xcc_id);
+ }
+- gfx_v9_4_3_xcc_select_se_sh(adev, 0xffffffff, 0xffffffff, 0xffffffff,
+- 0);
+ mutex_unlock(&adev->grbm_idx_mutex);
+
+ cu_info->number = active_cu_number;
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
+index f5a6f562e2a80..11b9837292536 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c
+@@ -2154,7 +2154,8 @@ static int kfd_create_vcrat_image_gpu(void *pcrat_image,
+
+ amdgpu_amdkfd_get_cu_info(kdev->adev, &cu_info);
+ cu->num_simd_per_cu = cu_info.simd_per_cu;
+- cu->num_simd_cores = cu_info.simd_per_cu * cu_info.cu_active_number;
++ cu->num_simd_cores = cu_info.simd_per_cu *
++ (cu_info.cu_active_number / kdev->kfd->num_nodes);
+ cu->max_waves_simd = cu_info.max_waves_per_simd;
+
+ cu->wave_front_size = cu_info.wave_front_size;
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
+index 863cf060af484..35e05ee89eac5 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
+@@ -104,11 +104,13 @@ void mqd_symmetrically_map_cu_mask(struct mqd_manager *mm,
+ bool wgp_mode_req = KFD_GC_VERSION(mm->dev) >= IP_VERSION(10, 0, 0);
+ uint32_t en_mask = wgp_mode_req ? 0x3 : 0x1;
+ int i, se, sh, cu, cu_bitmap_sh_mul, inc = wgp_mode_req ? 2 : 1;
++ uint32_t cu_active_per_node;
+
+ amdgpu_amdkfd_get_cu_info(mm->dev->adev, &cu_info);
+
+- if (cu_mask_count > cu_info.cu_active_number)
+- cu_mask_count = cu_info.cu_active_number;
++ cu_active_per_node = cu_info.cu_active_number / mm->dev->kfd->num_nodes;
++ if (cu_mask_count > cu_active_per_node)
++ cu_mask_count = cu_active_per_node;
+
+ /* Exceeding these bounds corrupts the stack and indicates a coding error.
+ * Returning with no CU's enabled will hang the queue, which should be
+@@ -141,7 +143,7 @@ void mqd_symmetrically_map_cu_mask(struct mqd_manager *mm,
+ for (se = 0; se < cu_info.num_shader_engines; se++)
+ for (sh = 0; sh < cu_info.num_shader_arrays_per_engine; sh++)
+ cu_per_sh[se][sh] = hweight32(
+- cu_info.cu_bitmap[se % 4][sh + (se / 4) * cu_bitmap_sh_mul]);
++ cu_info.cu_bitmap[0][se % 4][sh + (se / 4) * cu_bitmap_sh_mul]);
+
+ /* Symmetrically map cu_mask to all SEs & SHs:
+ * se_mask programs up to 2 SH in the upper and lower 16 bits.
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+index 4a17bb7c7b27d..ea67a353beb00 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+@@ -450,8 +450,7 @@ static ssize_t node_show(struct kobject *kobj, struct attribute *attr,
+ sysfs_show_32bit_prop(buffer, offs, "cpu_cores_count",
+ dev->node_props.cpu_cores_count);
+ sysfs_show_32bit_prop(buffer, offs, "simd_count",
+- dev->gpu ? (dev->node_props.simd_count *
+- NUM_XCC(dev->gpu->xcc_mask)) : 0);
++ dev->gpu ? dev->node_props.simd_count : 0);
+ sysfs_show_32bit_prop(buffer, offs, "mem_banks_count",
+ dev->node_props.mem_banks_count);
+ sysfs_show_32bit_prop(buffer, offs, "caches_count",
+@@ -1658,7 +1657,7 @@ static int fill_in_l2_l3_pcache(struct kfd_cache_properties **props_ext,
+ int i, j, k;
+ struct kfd_cache_properties *pcache = NULL;
+
+- cu_sibling_map_mask = cu_info->cu_bitmap[0][0];
++ cu_sibling_map_mask = cu_info->cu_bitmap[0][0][0];
+ cu_sibling_map_mask &=
+ ((1 << pcache_info[cache_type].num_cu_shared) - 1);
+ first_active_cu = ffs(cu_sibling_map_mask);
+@@ -1701,7 +1700,7 @@ static int fill_in_l2_l3_pcache(struct kfd_cache_properties **props_ext,
+ pcache->sibling_map[k+3] = (uint8_t)((cu_sibling_map_mask >> 24) & 0xFF);
+ k += 4;
+
+- cu_sibling_map_mask = cu_info->cu_bitmap[i % 4][j + i / 4];
++ cu_sibling_map_mask = cu_info->cu_bitmap[0][i % 4][j + i / 4];
+ cu_sibling_map_mask &= ((1 << pcache_info[cache_type].num_cu_shared) - 1);
+ }
+ }
+@@ -1762,8 +1761,8 @@ static void kfd_fill_cache_non_crat_info(struct kfd_topology_device *dev, struct
+ for (k = 0; k < pcu_info->num_cu_per_sh; k += pcache_info[ct].num_cu_shared) {
+
+ ret = fill_in_l1_pcache(&props_ext, pcache_info, pcu_info,
+- pcu_info->cu_bitmap[i % 4][j + i / 4], ct,
+- cu_processor_id, k);
++ pcu_info->cu_bitmap[0][i % 4][j + i / 4], ct,
++ cu_processor_id, k);
+
+ if (ret < 0)
+ break;
+diff --git a/drivers/gpu/drm/amd/include/kgd_kfd_interface.h b/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
+index d0df3381539f0..74cc545085a02 100644
+--- a/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
++++ b/drivers/gpu/drm/amd/include/kgd_kfd_interface.h
+@@ -31,12 +31,12 @@
+ #include <linux/types.h>
+ #include <linux/bitmap.h>
+ #include <linux/dma-fence.h>
++#include "amdgpu_irq.h"
++#include "amdgpu_gfx.h"
+
+ struct pci_dev;
+ struct amdgpu_device;
+
+-#define KGD_MAX_QUEUES 128
+-
+ struct kfd_dev;
+ struct kgd_mem;
+
+@@ -68,7 +68,7 @@ struct kfd_cu_info {
+ uint32_t wave_front_size;
+ uint32_t max_scratch_slots_per_cu;
+ uint32_t lds_size;
+- uint32_t cu_bitmap[4][4];
++ uint32_t cu_bitmap[AMDGPU_MAX_GC_INSTANCES][4][4];
+ };
+
+ /* For getting GPU local memory information from KGD */
+--
+2.40.1
+
--- /dev/null
+From 0b660da3e8fd09420dbb041c9c2ed191ec67076f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Nov 2022 15:14:32 -0500
+Subject: drm/amdkfd: Checkpoint and restore queues on GFX11
+
+From: David Francis <David.Francis@amd.com>
+
+[ Upstream commit 9296da8c40900b4dae3d973aa22be306e2a77671 ]
+
+The code in kfd_mqd_manager_v11.c to support criu dump and
+restore of queue state was missing.
+
+Added it; should be equivalent to kfd_mqd_manager_v10.c.
+
+CC: Felix Kuehling <felix.kuehling@amd.com>
+Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: David Francis <David.Francis@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c | 41 +++++++++++++++++++
+ 1 file changed, 41 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c
+index 97f754949ca92..352757f2d3202 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c
+@@ -321,6 +321,43 @@ static int get_wave_state(struct mqd_manager *mm, void *mqd,
+ return 0;
+ }
+
++static void checkpoint_mqd(struct mqd_manager *mm, void *mqd, void *mqd_dst, void *ctl_stack_dst)
++{
++ struct v11_compute_mqd *m;
++
++ m = get_mqd(mqd);
++
++ memcpy(mqd_dst, m, sizeof(struct v11_compute_mqd));
++}
++
++static void restore_mqd(struct mqd_manager *mm, void **mqd,
++ struct kfd_mem_obj *mqd_mem_obj, uint64_t *gart_addr,
++ struct queue_properties *qp,
++ const void *mqd_src,
++ const void *ctl_stack_src, const u32 ctl_stack_size)
++{
++ uint64_t addr;
++ struct v11_compute_mqd *m;
++
++ m = (struct v11_compute_mqd *) mqd_mem_obj->cpu_ptr;
++ addr = mqd_mem_obj->gpu_addr;
++
++ memcpy(m, mqd_src, sizeof(*m));
++
++ *mqd = m;
++ if (gart_addr)
++ *gart_addr = addr;
++
++ m->cp_hqd_pq_doorbell_control =
++ qp->doorbell_off <<
++ CP_HQD_PQ_DOORBELL_CONTROL__DOORBELL_OFFSET__SHIFT;
++ pr_debug("cp_hqd_pq_doorbell_control 0x%x\n",
++ m->cp_hqd_pq_doorbell_control);
++
++ qp->is_active = 0;
++}
++
++
+ static void init_mqd_hiq(struct mqd_manager *mm, void **mqd,
+ struct kfd_mem_obj *mqd_mem_obj, uint64_t *gart_addr,
+ struct queue_properties *q)
+@@ -438,6 +475,8 @@ struct mqd_manager *mqd_manager_init_v11(enum KFD_MQD_TYPE type,
+ mqd->mqd_size = sizeof(struct v11_compute_mqd);
+ mqd->get_wave_state = get_wave_state;
+ mqd->mqd_stride = kfd_mqd_stride;
++ mqd->checkpoint_mqd = checkpoint_mqd;
++ mqd->restore_mqd = restore_mqd;
+ #if defined(CONFIG_DEBUG_FS)
+ mqd->debugfs_show_mqd = debugfs_show_mqd;
+ #endif
+@@ -482,6 +521,8 @@ struct mqd_manager *mqd_manager_init_v11(enum KFD_MQD_TYPE type,
+ mqd->update_mqd = update_mqd_sdma;
+ mqd->destroy_mqd = kfd_destroy_mqd_sdma;
+ mqd->is_occupied = kfd_is_occupied_sdma;
++ mqd->checkpoint_mqd = checkpoint_mqd;
++ mqd->restore_mqd = restore_mqd;
+ mqd->mqd_size = sizeof(struct v11_sdma_mqd);
+ mqd->mqd_stride = kfd_mqd_stride;
+ #if defined(CONFIG_DEBUG_FS)
+--
+2.40.1
+
--- /dev/null
+From 7d8488befbe225e24c545a004ec4c81dd256c902 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Aug 2023 12:18:06 -0400
+Subject: drm/amdkfd: Update cache info reporting for GFX v9.4.3
+
+From: Mukul Joshi <mukul.joshi@amd.com>
+
+[ Upstream commit 0752e66e91fa86fa5481b04b22053363833ffb85 ]
+
+Update cache info reporting in sysfs to report the correct
+number of CUs and associated cache information based on
+different spatial partitioning modes.
+
+Signed-off-by: Mukul Joshi <mukul.joshi@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_crat.h | 4 ++
+ drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 82 +++++++++++++----------
+ drivers/gpu/drm/amd/amdkfd/kfd_topology.h | 2 +-
+ 3 files changed, 51 insertions(+), 37 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_crat.h b/drivers/gpu/drm/amd/amdkfd/kfd_crat.h
+index fc719389b5d65..4684711aa695a 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.h
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.h
+@@ -79,6 +79,10 @@ struct crat_header {
+ #define CRAT_SUBTYPE_IOLINK_AFFINITY 5
+ #define CRAT_SUBTYPE_MAX 6
+
++/*
++ * Do not change the value of CRAT_SIBLINGMAP_SIZE from 32
++ * as it breaks the ABI.
++ */
+ #define CRAT_SIBLINGMAP_SIZE 32
+
+ /*
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+index ea67a353beb00..5582191022106 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+@@ -1650,14 +1650,17 @@ static int fill_in_l1_pcache(struct kfd_cache_properties **props_ext,
+ static int fill_in_l2_l3_pcache(struct kfd_cache_properties **props_ext,
+ struct kfd_gpu_cache_info *pcache_info,
+ struct kfd_cu_info *cu_info,
+- int cache_type, unsigned int cu_processor_id)
++ int cache_type, unsigned int cu_processor_id,
++ struct kfd_node *knode)
+ {
+ unsigned int cu_sibling_map_mask;
+ int first_active_cu;
+- int i, j, k;
++ int i, j, k, xcc, start, end;
+ struct kfd_cache_properties *pcache = NULL;
+
+- cu_sibling_map_mask = cu_info->cu_bitmap[0][0][0];
++ start = ffs(knode->xcc_mask) - 1;
++ end = start + NUM_XCC(knode->xcc_mask);
++ cu_sibling_map_mask = cu_info->cu_bitmap[start][0][0];
+ cu_sibling_map_mask &=
+ ((1 << pcache_info[cache_type].num_cu_shared) - 1);
+ first_active_cu = ffs(cu_sibling_map_mask);
+@@ -1692,16 +1695,18 @@ static int fill_in_l2_l3_pcache(struct kfd_cache_properties **props_ext,
+ cu_sibling_map_mask = cu_sibling_map_mask >> (first_active_cu - 1);
+ k = 0;
+
+- for (i = 0; i < cu_info->num_shader_engines; i++) {
+- for (j = 0; j < cu_info->num_shader_arrays_per_engine; j++) {
+- pcache->sibling_map[k] = (uint8_t)(cu_sibling_map_mask & 0xFF);
+- pcache->sibling_map[k+1] = (uint8_t)((cu_sibling_map_mask >> 8) & 0xFF);
+- pcache->sibling_map[k+2] = (uint8_t)((cu_sibling_map_mask >> 16) & 0xFF);
+- pcache->sibling_map[k+3] = (uint8_t)((cu_sibling_map_mask >> 24) & 0xFF);
+- k += 4;
+-
+- cu_sibling_map_mask = cu_info->cu_bitmap[0][i % 4][j + i / 4];
+- cu_sibling_map_mask &= ((1 << pcache_info[cache_type].num_cu_shared) - 1);
++ for (xcc = start; xcc < end; xcc++) {
++ for (i = 0; i < cu_info->num_shader_engines; i++) {
++ for (j = 0; j < cu_info->num_shader_arrays_per_engine; j++) {
++ pcache->sibling_map[k] = (uint8_t)(cu_sibling_map_mask & 0xFF);
++ pcache->sibling_map[k+1] = (uint8_t)((cu_sibling_map_mask >> 8) & 0xFF);
++ pcache->sibling_map[k+2] = (uint8_t)((cu_sibling_map_mask >> 16) & 0xFF);
++ pcache->sibling_map[k+3] = (uint8_t)((cu_sibling_map_mask >> 24) & 0xFF);
++ k += 4;
++
++ cu_sibling_map_mask = cu_info->cu_bitmap[xcc][i % 4][j + i / 4];
++ cu_sibling_map_mask &= ((1 << pcache_info[cache_type].num_cu_shared) - 1);
++ }
+ }
+ }
+ pcache->sibling_map_size = k;
+@@ -1719,7 +1724,7 @@ static int fill_in_l2_l3_pcache(struct kfd_cache_properties **props_ext,
+ static void kfd_fill_cache_non_crat_info(struct kfd_topology_device *dev, struct kfd_node *kdev)
+ {
+ struct kfd_gpu_cache_info *pcache_info = NULL;
+- int i, j, k;
++ int i, j, k, xcc, start, end;
+ int ct = 0;
+ unsigned int cu_processor_id;
+ int ret;
+@@ -1753,37 +1758,42 @@ static void kfd_fill_cache_non_crat_info(struct kfd_topology_device *dev, struct
+ * then it will consider only one CU from
+ * the shared unit
+ */
++ start = ffs(kdev->xcc_mask) - 1;
++ end = start + NUM_XCC(kdev->xcc_mask);
++
+ for (ct = 0; ct < num_of_cache_types; ct++) {
+ cu_processor_id = gpu_processor_id;
+ if (pcache_info[ct].cache_level == 1) {
+- for (i = 0; i < pcu_info->num_shader_engines; i++) {
+- for (j = 0; j < pcu_info->num_shader_arrays_per_engine; j++) {
+- for (k = 0; k < pcu_info->num_cu_per_sh; k += pcache_info[ct].num_cu_shared) {
+-
+- ret = fill_in_l1_pcache(&props_ext, pcache_info, pcu_info,
+- pcu_info->cu_bitmap[0][i % 4][j + i / 4], ct,
+- cu_processor_id, k);
+-
+- if (ret < 0)
+- break;
+-
+- if (!ret) {
+- num_of_entries++;
+- list_add_tail(&props_ext->list, &dev->cache_props);
++ for (xcc = start; xcc < end; xcc++) {
++ for (i = 0; i < pcu_info->num_shader_engines; i++) {
++ for (j = 0; j < pcu_info->num_shader_arrays_per_engine; j++) {
++ for (k = 0; k < pcu_info->num_cu_per_sh; k += pcache_info[ct].num_cu_shared) {
++
++ ret = fill_in_l1_pcache(&props_ext, pcache_info, pcu_info,
++ pcu_info->cu_bitmap[xcc][i % 4][j + i / 4], ct,
++ cu_processor_id, k);
++
++ if (ret < 0)
++ break;
++
++ if (!ret) {
++ num_of_entries++;
++ list_add_tail(&props_ext->list, &dev->cache_props);
++ }
++
++ /* Move to next CU block */
++ num_cu_shared = ((k + pcache_info[ct].num_cu_shared) <=
++ pcu_info->num_cu_per_sh) ?
++ pcache_info[ct].num_cu_shared :
++ (pcu_info->num_cu_per_sh - k);
++ cu_processor_id += num_cu_shared;
+ }
+-
+- /* Move to next CU block */
+- num_cu_shared = ((k + pcache_info[ct].num_cu_shared) <=
+- pcu_info->num_cu_per_sh) ?
+- pcache_info[ct].num_cu_shared :
+- (pcu_info->num_cu_per_sh - k);
+- cu_processor_id += num_cu_shared;
+ }
+ }
+ }
+ } else {
+ ret = fill_in_l2_l3_pcache(&props_ext, pcache_info,
+- pcu_info, ct, cu_processor_id);
++ pcu_info, ct, cu_processor_id, kdev);
+
+ if (ret < 0)
+ break;
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.h b/drivers/gpu/drm/amd/amdkfd/kfd_topology.h
+index cba2cd5ed9d19..46927263e014d 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.h
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.h
+@@ -86,7 +86,7 @@ struct kfd_mem_properties {
+ struct attribute attr;
+ };
+
+-#define CACHE_SIBLINGMAP_SIZE 64
++#define CACHE_SIBLINGMAP_SIZE 128
+
+ struct kfd_cache_properties {
+ struct list_head list;
+--
+2.40.1
+
--- /dev/null
+From 1487ac8c2d54a00d2427876c016234e4c887f64f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Aug 2023 11:35:25 -0400
+Subject: drm/amdkfd: Update CU masking for GFX 9.4.3
+
+From: Mukul Joshi <mukul.joshi@amd.com>
+
+[ Upstream commit fc6efed2c728c9c10b058512fc9c1613f870a8e8 ]
+
+The CU mask passed from user-space will change based on
+different spatial partitioning mode. As a result, update
+CU masking code for GFX9.4.3 to work for all partitioning
+modes.
+
+Signed-off-by: Mukul Joshi <mukul.joshi@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c | 28 ++++++++---
+ drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h | 2 +-
+ .../gpu/drm/amd/amdkfd/kfd_mqd_manager_cik.c | 2 +-
+ .../gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c | 2 +-
+ .../gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c | 2 +-
+ .../gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 46 ++++++++++++-------
+ .../gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c | 2 +-
+ 7 files changed, 56 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
+index 35e05ee89eac5..254f343f967a3 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
+@@ -97,14 +97,16 @@ void free_mqd_hiq_sdma(struct mqd_manager *mm, void *mqd,
+
+ void mqd_symmetrically_map_cu_mask(struct mqd_manager *mm,
+ const uint32_t *cu_mask, uint32_t cu_mask_count,
+- uint32_t *se_mask)
++ uint32_t *se_mask, uint32_t inst)
+ {
+ struct kfd_cu_info cu_info;
+ uint32_t cu_per_sh[KFD_MAX_NUM_SE][KFD_MAX_NUM_SH_PER_SE] = {0};
+ bool wgp_mode_req = KFD_GC_VERSION(mm->dev) >= IP_VERSION(10, 0, 0);
+ uint32_t en_mask = wgp_mode_req ? 0x3 : 0x1;
+- int i, se, sh, cu, cu_bitmap_sh_mul, inc = wgp_mode_req ? 2 : 1;
++ int i, se, sh, cu, cu_bitmap_sh_mul, cu_inc = wgp_mode_req ? 2 : 1;
+ uint32_t cu_active_per_node;
++ int inc = cu_inc * NUM_XCC(mm->dev->xcc_mask);
++ int xcc_inst = inst + ffs(mm->dev->xcc_mask) - 1;
+
+ amdgpu_amdkfd_get_cu_info(mm->dev->adev, &cu_info);
+
+@@ -143,7 +145,8 @@ void mqd_symmetrically_map_cu_mask(struct mqd_manager *mm,
+ for (se = 0; se < cu_info.num_shader_engines; se++)
+ for (sh = 0; sh < cu_info.num_shader_arrays_per_engine; sh++)
+ cu_per_sh[se][sh] = hweight32(
+- cu_info.cu_bitmap[0][se % 4][sh + (se / 4) * cu_bitmap_sh_mul]);
++ cu_info.cu_bitmap[xcc_inst][se % 4][sh + (se / 4) *
++ cu_bitmap_sh_mul]);
+
+ /* Symmetrically map cu_mask to all SEs & SHs:
+ * se_mask programs up to 2 SH in the upper and lower 16 bits.
+@@ -166,20 +169,33 @@ void mqd_symmetrically_map_cu_mask(struct mqd_manager *mm,
+ * cu_mask[0] bit8 -> se_mask[0] bit1 (SE0,SH0,CU1)
+ * ...
+ *
++ * For GFX 9.4.3, the following code only looks at a
++ * subset of the cu_mask corresponding to the inst parameter.
++ * If we have n XCCs under one GPU node
++ * cu_mask[0] bit0 -> XCC0 se_mask[0] bit0 (XCC0,SE0,SH0,CU0)
++ * cu_mask[0] bit1 -> XCC1 se_mask[0] bit0 (XCC1,SE0,SH0,CU0)
++ * ..
++ * cu_mask[0] bitn -> XCCn se_mask[0] bit0 (XCCn,SE0,SH0,CU0)
++ * cu_mask[0] bit n+1 -> XCC0 se_mask[1] bit0 (XCC0,SE1,SH0,CU0)
++ *
++ * For example, if there are 6 XCCs under 1 KFD node, this code
++ * running for each inst, will look at the bits as:
++ * inst, inst + 6, inst + 12...
++ *
+ * First ensure all CUs are disabled, then enable user specified CUs.
+ */
+ for (i = 0; i < cu_info.num_shader_engines; i++)
+ se_mask[i] = 0;
+
+- i = 0;
+- for (cu = 0; cu < 16; cu += inc) {
++ i = inst;
++ for (cu = 0; cu < 16; cu += cu_inc) {
+ for (sh = 0; sh < cu_info.num_shader_arrays_per_engine; sh++) {
+ for (se = 0; se < cu_info.num_shader_engines; se++) {
+ if (cu_per_sh[se][sh] > cu) {
+ if (cu_mask[i / 32] & (en_mask << (i % 32)))
+ se_mask[se] |= en_mask << (cu + sh * 16);
+ i += inc;
+- if (i == cu_mask_count)
++ if (i >= cu_mask_count)
+ return;
+ }
+ }
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h
+index 23158db7da035..57bf5e513f4d1 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h
+@@ -138,7 +138,7 @@ void free_mqd_hiq_sdma(struct mqd_manager *mm, void *mqd,
+
+ void mqd_symmetrically_map_cu_mask(struct mqd_manager *mm,
+ const uint32_t *cu_mask, uint32_t cu_mask_count,
+- uint32_t *se_mask);
++ uint32_t *se_mask, uint32_t inst);
+
+ int kfd_hiq_load_mqd_kiq(struct mqd_manager *mm, void *mqd,
+ uint32_t pipe_id, uint32_t queue_id,
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_cik.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_cik.c
+index 65c9f01a1f86c..faa01ee0d1655 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_cik.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_cik.c
+@@ -52,7 +52,7 @@ static void update_cu_mask(struct mqd_manager *mm, void *mqd,
+ return;
+
+ mqd_symmetrically_map_cu_mask(mm,
+- minfo->cu_mask.ptr, minfo->cu_mask.count, se_mask);
++ minfo->cu_mask.ptr, minfo->cu_mask.count, se_mask, 0);
+
+ m = get_mqd(mqd);
+ m->compute_static_thread_mgmt_se0 = se_mask[0];
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c
+index 94c0fc2e57b7f..0fcb176601295 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c
+@@ -52,7 +52,7 @@ static void update_cu_mask(struct mqd_manager *mm, void *mqd,
+ return;
+
+ mqd_symmetrically_map_cu_mask(mm,
+- minfo->cu_mask.ptr, minfo->cu_mask.count, se_mask);
++ minfo->cu_mask.ptr, minfo->cu_mask.count, se_mask, 0);
+
+ m = get_mqd(mqd);
+ m->compute_static_thread_mgmt_se0 = se_mask[0];
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c
+index 23b30783dce31..97f754949ca92 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c
+@@ -71,7 +71,7 @@ static void update_cu_mask(struct mqd_manager *mm, void *mqd,
+ }
+
+ mqd_symmetrically_map_cu_mask(mm,
+- minfo->cu_mask.ptr, minfo->cu_mask.count, se_mask);
++ minfo->cu_mask.ptr, minfo->cu_mask.count, se_mask, 0);
+
+ m->compute_static_thread_mgmt_se0 = se_mask[0];
+ m->compute_static_thread_mgmt_se1 = se_mask[1];
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
+index 601bb9f68048c..a76ae27c8a919 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c
+@@ -60,7 +60,7 @@ static inline struct v9_sdma_mqd *get_sdma_mqd(void *mqd)
+ }
+
+ static void update_cu_mask(struct mqd_manager *mm, void *mqd,
+- struct mqd_update_info *minfo)
++ struct mqd_update_info *minfo, uint32_t inst)
+ {
+ struct v9_mqd *m;
+ uint32_t se_mask[KFD_MAX_NUM_SE] = {0};
+@@ -69,27 +69,36 @@ static void update_cu_mask(struct mqd_manager *mm, void *mqd,
+ return;
+
+ mqd_symmetrically_map_cu_mask(mm,
+- minfo->cu_mask.ptr, minfo->cu_mask.count, se_mask);
++ minfo->cu_mask.ptr, minfo->cu_mask.count, se_mask, inst);
+
+ m = get_mqd(mqd);
++
+ m->compute_static_thread_mgmt_se0 = se_mask[0];
+ m->compute_static_thread_mgmt_se1 = se_mask[1];
+ m->compute_static_thread_mgmt_se2 = se_mask[2];
+ m->compute_static_thread_mgmt_se3 = se_mask[3];
+- m->compute_static_thread_mgmt_se4 = se_mask[4];
+- m->compute_static_thread_mgmt_se5 = se_mask[5];
+- m->compute_static_thread_mgmt_se6 = se_mask[6];
+- m->compute_static_thread_mgmt_se7 = se_mask[7];
+-
+- pr_debug("update cu mask to %#x %#x %#x %#x %#x %#x %#x %#x\n",
+- m->compute_static_thread_mgmt_se0,
+- m->compute_static_thread_mgmt_se1,
+- m->compute_static_thread_mgmt_se2,
+- m->compute_static_thread_mgmt_se3,
+- m->compute_static_thread_mgmt_se4,
+- m->compute_static_thread_mgmt_se5,
+- m->compute_static_thread_mgmt_se6,
+- m->compute_static_thread_mgmt_se7);
++ if (KFD_GC_VERSION(mm->dev) != IP_VERSION(9, 4, 3)) {
++ m->compute_static_thread_mgmt_se4 = se_mask[4];
++ m->compute_static_thread_mgmt_se5 = se_mask[5];
++ m->compute_static_thread_mgmt_se6 = se_mask[6];
++ m->compute_static_thread_mgmt_se7 = se_mask[7];
++
++ pr_debug("update cu mask to %#x %#x %#x %#x %#x %#x %#x %#x\n",
++ m->compute_static_thread_mgmt_se0,
++ m->compute_static_thread_mgmt_se1,
++ m->compute_static_thread_mgmt_se2,
++ m->compute_static_thread_mgmt_se3,
++ m->compute_static_thread_mgmt_se4,
++ m->compute_static_thread_mgmt_se5,
++ m->compute_static_thread_mgmt_se6,
++ m->compute_static_thread_mgmt_se7);
++ } else {
++ pr_debug("inst: %u, update cu mask to %#x %#x %#x %#x\n",
++ inst, m->compute_static_thread_mgmt_se0,
++ m->compute_static_thread_mgmt_se1,
++ m->compute_static_thread_mgmt_se2,
++ m->compute_static_thread_mgmt_se3);
++ }
+ }
+
+ static void set_priority(struct v9_mqd *m, struct queue_properties *q)
+@@ -290,7 +299,8 @@ static void update_mqd(struct mqd_manager *mm, void *mqd,
+ if (mm->dev->kfd->cwsr_enabled && q->ctx_save_restore_area_address)
+ m->cp_hqd_ctx_save_control = 0;
+
+- update_cu_mask(mm, mqd, minfo);
++ if (KFD_GC_VERSION(mm->dev) != IP_VERSION(9, 4, 3))
++ update_cu_mask(mm, mqd, minfo, 0);
+ set_priority(m, q);
+
+ q->is_active = QUEUE_IS_ACTIVE(*q);
+@@ -654,6 +664,8 @@ static void update_mqd_v9_4_3(struct mqd_manager *mm, void *mqd,
+ m = get_mqd(mqd + size * xcc);
+ update_mqd(mm, m, q, minfo);
+
++ update_cu_mask(mm, mqd, minfo, xcc);
++
+ if (q->format == KFD_QUEUE_FORMAT_AQL) {
+ switch (xcc) {
+ case 0:
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c
+index d1e962da51dd3..2551a7529b5e0 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c
+@@ -55,7 +55,7 @@ static void update_cu_mask(struct mqd_manager *mm, void *mqd,
+ return;
+
+ mqd_symmetrically_map_cu_mask(mm,
+- minfo->cu_mask.ptr, minfo->cu_mask.count, se_mask);
++ minfo->cu_mask.ptr, minfo->cu_mask.count, se_mask, 0);
+
+ m = get_mqd(mqd);
+ m->compute_static_thread_mgmt_se0 = se_mask[0];
+--
+2.40.1
+
--- /dev/null
+From bbaae37a00b9ab43ab81b3bda67300f9966f10c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Aug 2023 17:17:04 +0200
+Subject: efi/x86: Ensure that EFI_RUNTIME_MAP is enabled for kexec
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit aba7e066c738d4b349413a271b2a236aa55bacbc ]
+
+CONFIG_EFI_RUNTIME_MAP needs to be enabled in order for kexec to be able
+to provide the required information about the EFI runtime mappings to
+the incoming kernel, regardless of whether kexec_load() or
+kexec_file_load() is being used. Without this information, kexec boot in
+EFI mode is not possible.
+
+The CONFIG_EFI_RUNTIME_MAP option is currently directly configurable if
+CONFIG_EXPERT is enabled, so that it can be turned on for debugging
+purposes even if KEXEC is not enabled. However, the upshot of this is
+that it can also be disabled even when it shouldn't.
+
+So tweak the Kconfig declarations to avoid this situation.
+
+Reported-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index e36261b4ea14f..68ce4f786dcd1 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -1955,6 +1955,7 @@ config EFI
+ select UCS2_STRING
+ select EFI_RUNTIME_WRAPPERS
+ select ARCH_USE_MEMREMAP_PROT
++ select EFI_RUNTIME_MAP if KEXEC_CORE
+ help
+ This enables the kernel to use EFI runtime services that are
+ available (such as the EFI variable services).
+@@ -2030,7 +2031,6 @@ config EFI_MAX_FAKE_MEM
+ config EFI_RUNTIME_MAP
+ bool "Export EFI runtime maps to sysfs" if EXPERT
+ depends on EFI
+- default KEXEC_CORE
+ help
+ Export EFI runtime memory regions to /sys/firmware/efi/runtime-map.
+ That memory map is required by the 2nd kernel to set up EFI virtual
+--
+2.40.1
+
--- /dev/null
+From 14a8deed01337fe0685c740b6b0ecc84dfc49bda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Sep 2023 11:03:49 +0200
+Subject: fbdev/sh7760fb: Depend on FB=y
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+[ Upstream commit f75f71b2c418a27a7c05139bb27a0c83adf88d19 ]
+
+Fix linker error if FB=m about missing fb_io_read and fb_io_write. The
+linker's error message suggests that this config setting has already
+been broken for other symbols.
+
+ All errors (new ones prefixed by >>):
+
+ sh4-linux-ld: drivers/video/fbdev/sh7760fb.o: in function `sh7760fb_probe':
+ sh7760fb.c:(.text+0x374): undefined reference to `framebuffer_alloc'
+ sh4-linux-ld: sh7760fb.c:(.text+0x394): undefined reference to `fb_videomode_to_var'
+ sh4-linux-ld: sh7760fb.c:(.text+0x39c): undefined reference to `fb_alloc_cmap'
+ sh4-linux-ld: sh7760fb.c:(.text+0x3a4): undefined reference to `register_framebuffer'
+ sh4-linux-ld: sh7760fb.c:(.text+0x3ac): undefined reference to `fb_dealloc_cmap'
+ sh4-linux-ld: sh7760fb.c:(.text+0x434): undefined reference to `framebuffer_release'
+ sh4-linux-ld: drivers/video/fbdev/sh7760fb.o: in function `sh7760fb_remove':
+ sh7760fb.c:(.text+0x800): undefined reference to `unregister_framebuffer'
+ sh4-linux-ld: sh7760fb.c:(.text+0x804): undefined reference to `fb_dealloc_cmap'
+ sh4-linux-ld: sh7760fb.c:(.text+0x814): undefined reference to `framebuffer_release'
+ >> sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0xc): undefined reference to `fb_io_read'
+ >> sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0x10): undefined reference to `fb_io_write'
+ sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0x2c): undefined reference to `cfb_fillrect'
+ sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0x30): undefined reference to `cfb_copyarea'
+ sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0x34): undefined reference to `cfb_imageblit'
+
+Suggested-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202309130632.LS04CPWu-lkp@intel.com/
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Acked-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230918090400.13264-1-tzimmermann@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
+index 6df9bd09454a2..80c999a67779f 100644
+--- a/drivers/video/fbdev/Kconfig
++++ b/drivers/video/fbdev/Kconfig
+@@ -2003,7 +2003,7 @@ config FB_COBALT
+
+ config FB_SH7760
+ bool "SH7760/SH7763/SH7720/SH7721 LCDC support"
+- depends on FB && (CPU_SUBTYPE_SH7760 || CPU_SUBTYPE_SH7763 \
++ depends on FB=y && (CPU_SUBTYPE_SH7760 || CPU_SUBTYPE_SH7763 \
+ || CPU_SUBTYPE_SH7720 || CPU_SUBTYPE_SH7721)
+ select FB_CFB_FILLRECT
+ select FB_CFB_COPYAREA
+--
+2.40.1
+
--- /dev/null
+From ccb5fc630d057a3fee14eaa7fe83cace1db7908e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Sep 2023 17:05:23 +0100
+Subject: firmware: cirrus: cs_dsp: Only log list of algorithms in debug build
+
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+
+[ Upstream commit 69343ce91435f222052015c5af86b550391bac85 ]
+
+Change the logging of each algorithm from info level to debug level.
+
+On the original devices supported by this code there were typically only
+one or two algorithms in a firmware and one or two DSPs so this logging
+only used a small number of log lines.
+
+However, for the latest devices there could be 30-40 algorithms in a
+firmware and 8 DSPs being loaded in parallel, so using 300+ lines of log
+for information that isn't particularly important to have logged.
+
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20230913160523.3701189-1-rf@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/cirrus/cs_dsp.c | 34 ++++++++++++++++----------------
+ 1 file changed, 17 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/firmware/cirrus/cs_dsp.c b/drivers/firmware/cirrus/cs_dsp.c
+index 49b70c70dc696..79d4254d1f9bc 100644
+--- a/drivers/firmware/cirrus/cs_dsp.c
++++ b/drivers/firmware/cirrus/cs_dsp.c
+@@ -1863,15 +1863,15 @@ static int cs_dsp_adsp2_setup_algs(struct cs_dsp *dsp)
+ return PTR_ERR(adsp2_alg);
+
+ for (i = 0; i < n_algs; i++) {
+- cs_dsp_info(dsp,
+- "%d: ID %x v%d.%d.%d XM@%x YM@%x ZM@%x\n",
+- i, be32_to_cpu(adsp2_alg[i].alg.id),
+- (be32_to_cpu(adsp2_alg[i].alg.ver) & 0xff0000) >> 16,
+- (be32_to_cpu(adsp2_alg[i].alg.ver) & 0xff00) >> 8,
+- be32_to_cpu(adsp2_alg[i].alg.ver) & 0xff,
+- be32_to_cpu(adsp2_alg[i].xm),
+- be32_to_cpu(adsp2_alg[i].ym),
+- be32_to_cpu(adsp2_alg[i].zm));
++ cs_dsp_dbg(dsp,
++ "%d: ID %x v%d.%d.%d XM@%x YM@%x ZM@%x\n",
++ i, be32_to_cpu(adsp2_alg[i].alg.id),
++ (be32_to_cpu(adsp2_alg[i].alg.ver) & 0xff0000) >> 16,
++ (be32_to_cpu(adsp2_alg[i].alg.ver) & 0xff00) >> 8,
++ be32_to_cpu(adsp2_alg[i].alg.ver) & 0xff,
++ be32_to_cpu(adsp2_alg[i].xm),
++ be32_to_cpu(adsp2_alg[i].ym),
++ be32_to_cpu(adsp2_alg[i].zm));
+
+ alg_region = cs_dsp_create_region(dsp, WMFW_ADSP2_XM,
+ adsp2_alg[i].alg.id,
+@@ -1996,14 +1996,14 @@ static int cs_dsp_halo_setup_algs(struct cs_dsp *dsp)
+ return PTR_ERR(halo_alg);
+
+ for (i = 0; i < n_algs; i++) {
+- cs_dsp_info(dsp,
+- "%d: ID %x v%d.%d.%d XM@%x YM@%x\n",
+- i, be32_to_cpu(halo_alg[i].alg.id),
+- (be32_to_cpu(halo_alg[i].alg.ver) & 0xff0000) >> 16,
+- (be32_to_cpu(halo_alg[i].alg.ver) & 0xff00) >> 8,
+- be32_to_cpu(halo_alg[i].alg.ver) & 0xff,
+- be32_to_cpu(halo_alg[i].xm_base),
+- be32_to_cpu(halo_alg[i].ym_base));
++ cs_dsp_dbg(dsp,
++ "%d: ID %x v%d.%d.%d XM@%x YM@%x\n",
++ i, be32_to_cpu(halo_alg[i].alg.id),
++ (be32_to_cpu(halo_alg[i].alg.ver) & 0xff0000) >> 16,
++ (be32_to_cpu(halo_alg[i].alg.ver) & 0xff00) >> 8,
++ be32_to_cpu(halo_alg[i].alg.ver) & 0xff,
++ be32_to_cpu(halo_alg[i].xm_base),
++ be32_to_cpu(halo_alg[i].ym_base));
+
+ ret = cs_dsp_halo_create_regions(dsp, halo_alg[i].alg.id,
+ halo_alg[i].alg.ver,
+--
+2.40.1
+
--- /dev/null
+From a3762209990c77ea842a80185f68f88afb8a717e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Sep 2023 08:05:51 -0500
+Subject: gfs2: fix glock shrinker ref issues
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+[ Upstream commit 62862485a4c3a52029fc30f4bdde9af04afdafc9 ]
+
+Before this patch, function gfs2_scan_glock_lru would only try to free
+glocks that had a reference count of 0. But if the reference count ever
+got to 0, the glock should have already been freed.
+
+Shrinker function gfs2_dispose_glock_lru checks whether glocks on the
+LRU are demote_ok, and if so, tries to demote them. But that's only
+possible if the reference count is at least 1.
+
+This patch changes gfs2_scan_glock_lru so it will try to demote and/or
+dispose of glocks that have a reference count of 1 and which are either
+demotable, or are already unlocked.
+
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/glock.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index 1438e7465e306..59c1aed0b9b90 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -2017,7 +2017,9 @@ static long gfs2_scan_glock_lru(int nr)
+ if (!test_bit(GLF_LOCK, &gl->gl_flags)) {
+ if (!spin_trylock(&gl->gl_lockref.lock))
+ continue;
+- if (!gl->gl_lockref.count) {
++ if (gl->gl_lockref.count <= 1 &&
++ (gl->gl_state == LM_ST_UNLOCKED ||
++ demote_ok(gl))) {
+ list_move(&gl->gl_lru, &dispose);
+ atomic_dec(&lru_count);
+ freed++;
+--
+2.40.1
+
--- /dev/null
+From 484cb1cb71191e7a383bc47f555a6d34278d68b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Sep 2023 16:07:49 +0200
+Subject: i2c: designware: fix __i2c_dw_disable() in case master is holding SCL
+ low
+
+From: Yann Sionneau <ysionneau@kalray.eu>
+
+[ Upstream commit 2409205acd3c7c877f3d0080cac6a5feb3358f83 ]
+
+The DesignWare IP can be synthesized with the IC_EMPTYFIFO_HOLD_MASTER_EN
+parameter.
+In this case, when the TX FIFO gets empty and the last command didn't have
+the STOP bit (IC_DATA_CMD[9]), the controller will hold SCL low until
+a new command is pushed into the TX FIFO or the transfer is aborted.
+
+When the controller is holding SCL low, it cannot be disabled.
+The transfer must first be aborted.
+Also, the bus recovery won't work because SCL is held low by the master.
+
+Check if the master is holding SCL low in __i2c_dw_disable() before trying
+to disable the controller. If SCL is held low, an abort is initiated.
+When the abort is done, then proceed with disabling the controller.
+
+This whole situation can happen for instance during SMBus read data block
+if the slave just responds with "byte count == 0".
+This puts the driver in an unrecoverable state, because the controller is
+holding SCL low and the current __i2c_dw_disable() procedure is not
+working. In this situation only a SoC reset can fix the i2c bus.
+
+Co-developed-by: Jonathan Borne <jborne@kalray.eu>
+Signed-off-by: Jonathan Borne <jborne@kalray.eu>
+Signed-off-by: Yann Sionneau <ysionneau@kalray.eu>
+Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-designware-common.c | 17 +++++++++++++++++
+ drivers/i2c/busses/i2c-designware-core.h | 3 +++
+ 2 files changed, 20 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-designware-common.c b/drivers/i2c/busses/i2c-designware-common.c
+index cdd8c67d91298..affcfb243f0f5 100644
+--- a/drivers/i2c/busses/i2c-designware-common.c
++++ b/drivers/i2c/busses/i2c-designware-common.c
+@@ -441,8 +441,25 @@ int i2c_dw_set_sda_hold(struct dw_i2c_dev *dev)
+
+ void __i2c_dw_disable(struct dw_i2c_dev *dev)
+ {
++ unsigned int raw_intr_stats;
++ unsigned int enable;
+ int timeout = 100;
++ bool abort_needed;
+ unsigned int status;
++ int ret;
++
++ regmap_read(dev->map, DW_IC_RAW_INTR_STAT, &raw_intr_stats);
++ regmap_read(dev->map, DW_IC_ENABLE, &enable);
++
++ abort_needed = raw_intr_stats & DW_IC_INTR_MST_ON_HOLD;
++ if (abort_needed) {
++ regmap_write(dev->map, DW_IC_ENABLE, enable | DW_IC_ENABLE_ABORT);
++ ret = regmap_read_poll_timeout(dev->map, DW_IC_ENABLE, enable,
++ !(enable & DW_IC_ENABLE_ABORT), 10,
++ 100);
++ if (ret)
++ dev_err(dev->dev, "timeout while trying to abort current transfer\n");
++ }
+
+ do {
+ __i2c_dw_disable_nowait(dev);
+diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h
+index cf4f684f53566..a7f6f3eafad7d 100644
+--- a/drivers/i2c/busses/i2c-designware-core.h
++++ b/drivers/i2c/busses/i2c-designware-core.h
+@@ -98,6 +98,7 @@
+ #define DW_IC_INTR_START_DET BIT(10)
+ #define DW_IC_INTR_GEN_CALL BIT(11)
+ #define DW_IC_INTR_RESTART_DET BIT(12)
++#define DW_IC_INTR_MST_ON_HOLD BIT(13)
+
+ #define DW_IC_INTR_DEFAULT_MASK (DW_IC_INTR_RX_FULL | \
+ DW_IC_INTR_TX_ABRT | \
+@@ -108,6 +109,8 @@
+ DW_IC_INTR_RX_UNDER | \
+ DW_IC_INTR_RD_REQ)
+
++#define DW_IC_ENABLE_ABORT BIT(1)
++
+ #define DW_IC_STATUS_ACTIVITY BIT(0)
+ #define DW_IC_STATUS_TFE BIT(2)
+ #define DW_IC_STATUS_RFNE BIT(3)
+--
+2.40.1
+
--- /dev/null
+From 7d80981f27ce880297eb29dd1a35a2653ee40aa7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Sep 2023 14:26:29 +0800
+Subject: LoongArch: Set all reserved memblocks on Node#0 at initialization
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit b795fb9f5861ee256070d59e33130980a01fadd7 ]
+
+After commit 61167ad5fecdea ("mm: pass nid to reserve_bootmem_region()")
+we get a panic if DEFERRED_STRUCT_PAGE_INIT is enabled:
+
+[ 0.000000] CPU 0 Unable to handle kernel paging request at virtual address 0000000000002b82, era == 90000000040e3f28, ra == 90000000040e3f18
+[ 0.000000] Oops[#1]:
+[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.5.0+ #733
+[ 0.000000] pc 90000000040e3f28 ra 90000000040e3f18 tp 90000000046f4000 sp 90000000046f7c90
+[ 0.000000] a0 0000000000000001 a1 0000000000200000 a2 0000000000000040 a3 90000000046f7ca0
+[ 0.000000] a4 90000000046f7ca4 a5 0000000000000000 a6 90000000046f7c38 a7 0000000000000000
+[ 0.000000] t0 0000000000000002 t1 9000000004b00ac8 t2 90000000040e3f18 t3 90000000040f0800
+[ 0.000000] t4 00000000000f0000 t5 80000000ffffe07e t6 0000000000000003 t7 900000047fff5e20
+[ 0.000000] t8 aaaaaaaaaaaaaaab u0 0000000000000018 s9 0000000000000000 s0 fffffefffe000000
+[ 0.000000] s1 0000000000000000 s2 0000000000000080 s3 0000000000000040 s4 0000000000000000
+[ 0.000000] s5 0000000000000000 s6 fffffefffe000000 s7 900000000470b740 s8 9000000004ad4000
+[ 0.000000] ra: 90000000040e3f18 reserve_bootmem_region+0xec/0x21c
+[ 0.000000] ERA: 90000000040e3f28 reserve_bootmem_region+0xfc/0x21c
+[ 0.000000] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)
+[ 0.000000] PRMD: 00000000 (PPLV0 -PIE -PWE)
+[ 0.000000] EUEN: 00000000 (-FPE -SXE -ASXE -BTE)
+[ 0.000000] ECFG: 00070800 (LIE=11 VS=7)
+[ 0.000000] ESTAT: 00010800 [PIL] (IS=11 ECode=1 EsubCode=0)
+[ 0.000000] BADV: 0000000000002b82
+[ 0.000000] PRID: 0014d000 (Loongson-64bit, Loongson-3A6000)
+[ 0.000000] Modules linked in:
+[ 0.000000] Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____))
+[ 0.000000] Stack : 0000000000000000 9000000002eb5430 0000003a00000020 90000000045ccd00
+[ 0.000000] 900000000470e000 90000000002c1918 0000000000000000 9000000004110780
+[ 0.000000] 00000000fe6c0000 0000000480000000 9000000004b4e368 9000000004110748
+[ 0.000000] 0000000000000000 900000000421ca84 9000000004620000 9000000004564970
+[ 0.000000] 90000000046f7d78 9000000002cc9f70 90000000002c1918 900000000470e000
+[ 0.000000] 9000000004564970 90000000040bc0e0 90000000046f7d78 0000000000000000
+[ 0.000000] 0000000000004000 90000000045ccd00 0000000000000000 90000000002c1918
+[ 0.000000] 90000000002c1900 900000000470b700 9000000004b4df78 9000000004620000
+[ 0.000000] 90000000046200a8 90000000046200a8 0000000000000000 9000000004218b2c
+[ 0.000000] 9000000004270008 0000000000000001 0000000000000000 90000000045ccd00
+[ 0.000000] ...
+[ 0.000000] Call Trace:
+[ 0.000000] [<90000000040e3f28>] reserve_bootmem_region+0xfc/0x21c
+[ 0.000000] [<900000000421ca84>] memblock_free_all+0x114/0x350
+[ 0.000000] [<9000000004218b2c>] mm_core_init+0x138/0x3cc
+[ 0.000000] [<9000000004200e38>] start_kernel+0x488/0x7a4
+[ 0.000000] [<90000000040df0d8>] kernel_entry+0xd8/0xdc
+[ 0.000000]
+[ 0.000000] Code: 02eb21ad 00410f4c 380c31ac <262b818d> 6800b70d 02c1c196 0015001c 57fe4bb1 260002cd
+
+The reason is early memblock_reserve() in memblock_init() set node id to
+MAX_NUMNODES, making NODE_DATA(nid) a NULL dereference in the call chain
+reserve_bootmem_region() -> init_reserved_page(). After memblock_init(),
+those late calls of memblock_reserve() operate on subregions of memblock
+.memory regions. As a result, these reserved regions will be set to the
+correct node at the first iteration of memmap_init_reserved_pages().
+
+So set all reserved memblocks on Node#0 at initialization can avoid this
+panic.
+
+Reported-by: WANG Xuerui <git@xen0n.name>
+Tested-by: WANG Xuerui <git@xen0n.name>
+Reviewed-by: WANG Xuerui <git@xen0n.name> # with nits addressed
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/kernel/mem.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/loongarch/kernel/mem.c b/arch/loongarch/kernel/mem.c
+index 4a4107a6a9651..aed901c57fb43 100644
+--- a/arch/loongarch/kernel/mem.c
++++ b/arch/loongarch/kernel/mem.c
+@@ -50,7 +50,6 @@ void __init memblock_init(void)
+ }
+
+ memblock_set_current_limit(PFN_PHYS(max_low_pfn));
+- memblock_set_node(0, PHYS_ADDR_MAX, &memblock.memory, 0);
+
+ /* Reserve the first 2MB */
+ memblock_reserve(PHYS_OFFSET, 0x200000);
+@@ -58,4 +57,7 @@ void __init memblock_init(void)
+ /* Reserve the kernel text/data/bss */
+ memblock_reserve(__pa_symbol(&_text),
+ __pa_symbol(&_end) - __pa_symbol(&_text));
++
++ memblock_set_node(0, PHYS_ADDR_MAX, &memblock.memory, 0);
++ memblock_set_node(0, PHYS_ADDR_MAX, &memblock.reserved, 0);
+ }
+--
+2.40.1
+
--- /dev/null
+From bcdc67a955d3c23b7f07435df4d332cf9fd14acd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Sep 2023 14:26:29 +0800
+Subject: LoongArch: Use _UL() and _ULL()
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 3563b477ddfe057ff1ef63636cacf198130276cb ]
+
+Use _UL() and _ULL() that are provided by const.h.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/include/asm/addrspace.h | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/loongarch/include/asm/addrspace.h b/arch/loongarch/include/asm/addrspace.h
+index 5c9c03bdf9156..b24437e28c6ed 100644
+--- a/arch/loongarch/include/asm/addrspace.h
++++ b/arch/loongarch/include/asm/addrspace.h
+@@ -19,7 +19,7 @@
+ */
+ #ifndef __ASSEMBLY__
+ #ifndef PHYS_OFFSET
+-#define PHYS_OFFSET _AC(0, UL)
++#define PHYS_OFFSET _UL(0)
+ #endif
+ extern unsigned long vm_map_base;
+ #endif /* __ASSEMBLY__ */
+@@ -43,7 +43,7 @@ extern unsigned long vm_map_base;
+ * Memory above this physical address will be considered highmem.
+ */
+ #ifndef HIGHMEM_START
+-#define HIGHMEM_START (_AC(1, UL) << _AC(DMW_PABITS, UL))
++#define HIGHMEM_START (_UL(1) << _UL(DMW_PABITS))
+ #endif
+
+ #define TO_PHYS(x) ( ((x) & TO_PHYS_MASK))
+@@ -65,16 +65,16 @@ extern unsigned long vm_map_base;
+ #define _ATYPE_
+ #define _ATYPE32_
+ #define _ATYPE64_
+-#define _CONST64_(x) x
+ #else
+ #define _ATYPE_ __PTRDIFF_TYPE__
+ #define _ATYPE32_ int
+ #define _ATYPE64_ __s64
++#endif
++
+ #ifdef CONFIG_64BIT
+-#define _CONST64_(x) x ## UL
++#define _CONST64_(x) _UL(x)
+ #else
+-#define _CONST64_(x) x ## ULL
+-#endif
++#define _CONST64_(x) _ULL(x)
+ #endif
+
+ /*
+--
+2.40.1
+
--- /dev/null
+From 2304d481935e2f8185c44d57f5a106a1f6394266 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Aug 2023 12:41:32 +0200
+Subject: media: vb2: frame_vector.c: replace WARN_ONCE with a comment
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 735de5caf79e06cc9fb96b1b4f4974674ae3e917 ]
+
+The WARN_ONCE was issued also in cases that had nothing to do with VM_IO
+(e.g. if the start address was just a random value and uaccess fails with
+-EFAULT).
+
+There are no reports of WARN_ONCE being issued for actual VM_IO cases, so
+just drop it and instead add a note to the comment before the function.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Reported-by: Yikebaer Aizezi <yikebaer61@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/common/videobuf2/frame_vector.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/common/videobuf2/frame_vector.c b/drivers/media/common/videobuf2/frame_vector.c
+index 0f430ddc1f670..fd87747be9b17 100644
+--- a/drivers/media/common/videobuf2/frame_vector.c
++++ b/drivers/media/common/videobuf2/frame_vector.c
+@@ -31,6 +31,10 @@
+ * different type underlying the specified range of virtual addresses.
+ * When the function isn't able to map a single page, it returns error.
+ *
++ * Note that get_vaddr_frames() cannot follow VM_IO mappings. It used
++ * to be able to do that, but that could (racily) return non-refcounted
++ * pfns.
++ *
+ * This function takes care of grabbing mmap_lock as necessary.
+ */
+ int get_vaddr_frames(unsigned long start, unsigned int nr_frames, bool write,
+@@ -59,8 +63,6 @@ int get_vaddr_frames(unsigned long start, unsigned int nr_frames, bool write,
+ if (likely(ret > 0))
+ return ret;
+
+- /* This used to (racily) return non-refcounted pfns. Let people know */
+- WARN_ONCE(1, "get_vaddr_frames() cannot follow VM_IO mapping");
+ vec->nr_frames = 0;
+ return ret ? ret : -EFAULT;
+ }
+--
+2.40.1
+
--- /dev/null
+From f03de24cf2ba69084c344e3b10de44cc03af7cdb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Sep 2023 09:24:51 +0300
+Subject: memblock tests: fix warning: "__ALIGN_KERNEL" redefined
+
+From: Mike Rapoport (IBM) <rppt@kernel.org>
+
+[ Upstream commit 5e1bffbdb63baf89f3bf0b6bafb50903432a7434 ]
+
+Building memblock tests produces the following warning:
+
+cc -I. -I../../include -Wall -O2 -fsanitize=address -fsanitize=undefined -D CONFIG_PHYS_ADDR_T_64BIT -c -o main.o main.c
+In file included from ../../include/linux/pfn.h:5,
+ from ./linux/memory_hotplug.h:6,
+ from ./linux/init.h:7,
+ from ./linux/memblock.h:11,
+ from tests/common.h:8,
+ from tests/basic_api.h:5,
+ from main.c:2:
+../../include/linux/mm.h:14: warning: "__ALIGN_KERNEL" redefined
+ 14 | #define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1)
+ |
+In file included from ../../include/linux/mm.h:6,
+ from ../../include/linux/pfn.h:5,
+ from ./linux/memory_hotplug.h:6,
+ from ./linux/init.h:7,
+ from ./linux/memblock.h:11,
+ from tests/common.h:8,
+ from tests/basic_api.h:5,
+ from main.c:2:
+../../include/uapi/linux/const.h:31: note: this is the location of the previous definition
+ 31 | #define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (__typeof__(x))(a) - 1)
+ |
+
+Remove definitions of __ALIGN_KERNEL and __ALIGN_KERNEL_MASK from
+tools/include/linux/mm.h to fix it.
+
+Signed-off-by: Mike Rapoport (IBM) <rppt@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/linux/mm.h | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/tools/include/linux/mm.h b/tools/include/linux/mm.h
+index 2bc94079d6166..f3c82ab5b14cd 100644
+--- a/tools/include/linux/mm.h
++++ b/tools/include/linux/mm.h
+@@ -11,8 +11,6 @@
+
+ #define PHYS_ADDR_MAX (~(phys_addr_t)0)
+
+-#define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1)
+-#define __ALIGN_KERNEL_MASK(x, mask) (((x) + (mask)) & ~(mask))
+ #define ALIGN(x, a) __ALIGN_KERNEL((x), (a))
+ #define ALIGN_DOWN(x, a) __ALIGN_KERNEL((x) - ((a) - 1), (a))
+
+--
+2.40.1
+
--- /dev/null
+From 23a3c410d0b65ea3ffc68bc910972fe033b9f4fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Sep 2023 10:45:40 +0300
+Subject: =?UTF-8?q?memblock=20tests:=20fix=20warning=20=E2=80=98struct=20s?=
+ =?UTF-8?q?eq=5Ffile=E2=80=99=20declared=20inside=20parameter=20list?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mike Rapoport (IBM) <rppt@kernel.org>
+
+[ Upstream commit 55122e0130e51eb71f5ec62d10525db0468f28e8 ]
+
+Building memblock tests produces the following warning:
+
+cc -I. -I../../include -Wall -O2 -fsanitize=address -fsanitize=undefined -D CONFIG_PHYS_ADDR_T_64BIT -c -o main.o main.c
+In file included from tests/common.h:9,
+ from tests/basic_api.h:5,
+ from main.c:2:
+./linux/memblock.h:601:50: warning: ‘struct seq_file’ declared inside parameter list will not be visible outside of this definition or declaration
+ 601 | static inline void memtest_report_meminfo(struct seq_file *m) { }
+ | ^~~~~~~~
+
+Add declaration of 'struct seq_file' to tools/include/linux/seq_file.h
+to fix it.
+
+Signed-off-by: Mike Rapoport (IBM) <rppt@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/linux/seq_file.h | 2 ++
+ tools/testing/memblock/tests/basic_api.c | 2 +-
+ tools/testing/memblock/tests/common.h | 1 +
+ 3 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/include/linux/seq_file.h b/tools/include/linux/seq_file.h
+index 102fd9217f1f9..f6bc226af0c1d 100644
+--- a/tools/include/linux/seq_file.h
++++ b/tools/include/linux/seq_file.h
+@@ -1,4 +1,6 @@
+ #ifndef _TOOLS_INCLUDE_LINUX_SEQ_FILE_H
+ #define _TOOLS_INCLUDE_LINUX_SEQ_FILE_H
+
++struct seq_file;
++
+ #endif /* _TOOLS_INCLUDE_LINUX_SEQ_FILE_H */
+diff --git a/tools/testing/memblock/tests/basic_api.c b/tools/testing/memblock/tests/basic_api.c
+index 411647094cc37..57bf2688edfd6 100644
+--- a/tools/testing/memblock/tests/basic_api.c
++++ b/tools/testing/memblock/tests/basic_api.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0-or-later
++#include "basic_api.h"
+ #include <string.h>
+ #include <linux/memblock.h>
+-#include "basic_api.h"
+
+ #define EXPECTED_MEMBLOCK_REGIONS 128
+ #define FUNC_ADD "memblock_add"
+diff --git a/tools/testing/memblock/tests/common.h b/tools/testing/memblock/tests/common.h
+index 4f23302ee6779..b5ec59aa62d72 100644
+--- a/tools/testing/memblock/tests/common.h
++++ b/tools/testing/memblock/tests/common.h
+@@ -5,6 +5,7 @@
+ #include <stdlib.h>
+ #include <assert.h>
+ #include <linux/types.h>
++#include <linux/seq_file.h>
+ #include <linux/memblock.h>
+ #include <linux/sizes.h>
+ #include <linux/printk.h>
+--
+2.40.1
+
--- /dev/null
+From cdadb45f8038b2de27453b09cecd4ce0f26c1d50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Sep 2023 09:12:35 -0700
+Subject: ncsi: Propagate carrier gain/loss events to the NCSI controller
+
+From: Johnathan Mantey <johnathanx.mantey@intel.com>
+
+[ Upstream commit 3780bb29311eccb7a1c9641032a112eed237f7e3 ]
+
+Report the carrier/no-carrier state for the network interface
+shared between the BMC and the passthrough channel. Without this
+functionality the BMC is unable to reconfigure the NIC in the event
+of a re-cabling to a different subnet.
+
+Signed-off-by: Johnathan Mantey <johnathanx.mantey@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ncsi/ncsi-aen.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/ncsi/ncsi-aen.c b/net/ncsi/ncsi-aen.c
+index 62fb1031763d1..f8854bff286cb 100644
+--- a/net/ncsi/ncsi-aen.c
++++ b/net/ncsi/ncsi-aen.c
+@@ -89,6 +89,11 @@ static int ncsi_aen_handler_lsc(struct ncsi_dev_priv *ndp,
+ if ((had_link == has_link) || chained)
+ return 0;
+
++ if (had_link)
++ netif_carrier_off(ndp->ndev.dev);
++ else
++ netif_carrier_on(ndp->ndev.dev);
++
+ if (!ndp->multi_package && !nc->package->multi_channel) {
+ if (had_link) {
+ ndp->flags |= NCSI_DEV_RESHUFFLE;
+--
+2.40.1
+
--- /dev/null
+From c92eb6a05cfb55ddc77f05f8b851eaeb8837c692 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Sep 2023 20:10:03 +0200
+Subject: net: hsr: Add __packed to struct hsr_sup_tlv.
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit fbd825fcd7dd4c11d4c48c3d0adc248a4a0ce90b ]
+
+Struct hsr_sup_tlv describes HW layout and therefore it needs a __packed
+attribute to ensure the compiler does not add any padding.
+Due to the size and __packed attribute of the structs that use
+hsr_sup_tlv it has no functional impact.
+
+Add __packed to struct hsr_sup_tlv.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/hsr/hsr_main.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/hsr/hsr_main.h b/net/hsr/hsr_main.h
+index 6851e33df7d14..18e01791ad799 100644
+--- a/net/hsr/hsr_main.h
++++ b/net/hsr/hsr_main.h
+@@ -83,7 +83,7 @@ struct hsr_vlan_ethhdr {
+ struct hsr_sup_tlv {
+ u8 HSR_TLV_type;
+ u8 HSR_TLV_length;
+-};
++} __packed;
+
+ /* HSR/PRP Supervision Frame data types.
+ * Field names as defined in the IEC:2010 standard for HSR.
+--
+2.40.1
+
--- /dev/null
+From 4ca6e88c514b7484b4859a19d3d198f7de8de1d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Sep 2023 11:31:42 +0800
+Subject: net/smc: bugfix for smcr v2 server connect success statistic
+
+From: Guangguan Wang <guangguan.wang@linux.alibaba.com>
+
+[ Upstream commit 6912e724832c47bb381eb1bd1e483ec8df0d0f0f ]
+
+In the macro SMC_STAT_SERV_SUCC_INC, the smcd_version is used
+to determin whether to increase the v1 statistic or the v2
+statistic. It is correct for SMCD. But for SMCR, smcr_version
+should be used.
+
+Signed-off-by: Guangguan Wang <guangguan.wang@linux.alibaba.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_stats.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/smc/smc_stats.h b/net/smc/smc_stats.h
+index b60fe1eb37ab6..aa8928975cc63 100644
+--- a/net/smc/smc_stats.h
++++ b/net/smc/smc_stats.h
+@@ -243,8 +243,9 @@ while (0)
+ #define SMC_STAT_SERV_SUCC_INC(net, _ini) \
+ do { \
+ typeof(_ini) i = (_ini); \
+- bool is_v2 = (i->smcd_version & SMC_V2); \
+ bool is_smcd = (i->is_smcd); \
++ u8 version = is_smcd ? i->smcd_version : i->smcr_version; \
++ bool is_v2 = (version & SMC_V2); \
+ typeof(net->smc.smc_stats) smc_stats = (net)->smc.smc_stats; \
+ if (is_v2 && is_smcd) \
+ this_cpu_inc(smc_stats->smc[SMC_TYPE_D].srv_v2_succ_cnt); \
+--
+2.40.1
+
--- /dev/null
+From 46564175c91deda7ae9503f553badc08d434a025 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Jul 2023 15:54:16 -0400
+Subject: NFSv4.1: fix zero value filehandle in post open getattr
+
+From: Olga Kornievskaia <kolga@netapp.com>
+
+[ Upstream commit 4506f23e117161a20104c8fa04f33e1ca63c26af ]
+
+Currently, if the OPEN compound experiencing an error and needs to
+get the file attributes separately, it will send a stand alone
+GETATTR but it would use the filehandle from the results of
+the OPEN compound. In case of the CLAIM_FH OPEN, nfs_openres's fh
+is zero value. That generate a GETATTR that's sent with a zero
+value filehandle, and results in the server returning an error.
+
+Instead, for the CLAIM_FH OPEN, take the filehandle that was used
+in the PUTFH of the OPEN compound.
+
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 3bc6bfdf7b814..890ae26006ee1 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2703,8 +2703,12 @@ static int _nfs4_proc_open(struct nfs4_opendata *data,
+ return status;
+ }
+ if (!(o_res->f_attr->valid & NFS_ATTR_FATTR)) {
++ struct nfs_fh *fh = &o_res->fh;
++
+ nfs4_sequence_free_slot(&o_res->seq_res);
+- nfs4_proc_getattr(server, &o_res->fh, o_res->f_attr, NULL);
++ if (o_arg->claim == NFS4_OPEN_CLAIM_FH)
++ fh = NFS_FH(d_inode(data->dentry));
++ nfs4_proc_getattr(server, fh, o_res->f_attr, NULL);
+ }
+ return 0;
+ }
+--
+2.40.1
+
--- /dev/null
+From 302eca23c371a19e346e7301dfc985a57092209f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Aug 2023 12:43:01 -0700
+Subject: nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid()
+
+From: Nigel Kirkland <nkirkland2304@gmail.com>
+
+[ Upstream commit 8ae5b3a685dc59a8cf7ccfe0e850999ba9727a3c ]
+
+The nvme_fc_fcp_op structure describing an AEN operation is initialized with a
+null request structure pointer. An FC LLDD may make a call to
+nvme_fc_io_getuuid passing a pointer to an nvmefc_fcp_req for an AEN operation.
+
+Add validation of the request structure pointer before dereference.
+
+Signed-off-by: Nigel Kirkland <nkirkland2304@gmail.com>
+Reviewed-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 1cd2bf82319a9..a15b37750d6e9 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -1924,7 +1924,7 @@ char *nvme_fc_io_getuuid(struct nvmefc_fcp_req *req)
+ struct nvme_fc_fcp_op *op = fcp_req_to_fcp_op(req);
+ struct request *rq = op->rq;
+
+- if (!IS_ENABLED(CONFIG_BLK_CGROUP_FC_APPID) || !rq->bio)
++ if (!IS_ENABLED(CONFIG_BLK_CGROUP_FC_APPID) || !rq || !rq->bio)
+ return NULL;
+ return blkcg_get_fc_appid(rq->bio);
+ }
+--
+2.40.1
+
--- /dev/null
+From 9a13a1a2e44a03c950860a07ed9f1025c18361f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Sep 2023 17:52:49 +0200
+Subject: nvme-pci: do not set the NUMA node of device if it has none
+
+From: Pratyush Yadav <ptyadav@amazon.de>
+
+[ Upstream commit dad651b2a44eb6b201738f810254279dca29d30d ]
+
+If a device has no NUMA node information associated with it, the driver
+puts the device in node first_memory_node (say node 0). Not having a
+NUMA node and being associated with node 0 are completely different
+things and it makes little sense to mix the two.
+
+Signed-off-by: Pratyush Yadav <ptyadav@amazon.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 2f57da12d9836..347cb5daebc3c 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -2916,9 +2916,6 @@ static struct nvme_dev *nvme_pci_alloc_dev(struct pci_dev *pdev,
+ struct nvme_dev *dev;
+ int ret = -ENOMEM;
+
+- if (node == NUMA_NO_NODE)
+- set_dev_node(&pdev->dev, first_memory_node);
+-
+ dev = kzalloc_node(sizeof(*dev), GFP_KERNEL, node);
+ if (!dev)
+ return ERR_PTR(-ENOMEM);
+--
+2.40.1
+
--- /dev/null
+From bf10d42c84c1e2ea37cb02529d89a135ad98e0d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Sep 2023 16:56:13 -0700
+Subject: objtool: Fix _THIS_IP_ detection for cold functions
+
+From: Josh Poimboeuf <jpoimboe@kernel.org>
+
+[ Upstream commit 72178d5d1a38dd185d1db15f177f2d122ef10d9b ]
+
+Cold functions and their non-cold counterparts can use _THIS_IP_ to
+reference each other. Don't warn about !ENDBR in that case.
+
+Note that for GCC this is currently irrelevant in light of the following
+commit
+
+ c27cd083cfb9 ("Compiler attributes: GCC cold function alignment workarounds")
+
+which disabled cold functions in the kernel. However this may still be
+possible with Clang.
+
+Fixes several warnings like the following:
+
+ drivers/scsi/bnx2i/bnx2i.prelink.o: warning: objtool: bnx2i_hw_ep_disconnect+0x19d: relocation to !ENDBR: bnx2i_hw_ep_disconnect.cold+0x0
+ drivers/net/ipvlan/ipvlan.prelink.o: warning: objtool: ipvlan_addr4_event.cold+0x28: relocation to !ENDBR: ipvlan_addr4_event+0xda
+ drivers/net/ipvlan/ipvlan.prelink.o: warning: objtool: ipvlan_addr6_event.cold+0x26: relocation to !ENDBR: ipvlan_addr6_event+0xb7
+ drivers/net/ethernet/broadcom/tg3.prelink.o: warning: objtool: tg3_set_ringparam.cold+0x17: relocation to !ENDBR: tg3_set_ringparam+0x115
+ drivers/net/ethernet/broadcom/tg3.prelink.o: warning: objtool: tg3_self_test.cold+0x17: relocation to !ENDBR: tg3_self_test+0x2e1
+ drivers/target/iscsi/cxgbit/cxgbit.prelink.o: warning: objtool: __cxgbit_free_conn.cold+0x24: relocation to !ENDBR: __cxgbit_free_conn+0xfb
+ net/can/can.prelink.o: warning: objtool: can_rx_unregister.cold+0x2c: relocation to !ENDBR: can_rx_unregister+0x11b
+ drivers/net/ethernet/qlogic/qed/qed.prelink.o: warning: objtool: qed_spq_post+0xc0: relocation to !ENDBR: qed_spq_post.cold+0x9a
+ drivers/net/ethernet/qlogic/qed/qed.prelink.o: warning: objtool: qed_iwarp_ll2_comp_syn_pkt.cold+0x12f: relocation to !ENDBR: qed_iwarp_ll2_comp_syn_pkt+0x34b
+ net/tipc/tipc.prelink.o: warning: objtool: tipc_nametbl_publish.cold+0x21: relocation to !ENDBR: tipc_nametbl_publish+0xa6
+
+Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/d8f1ab6a23a6105bc023c132b105f245c7976be6.1694476559.git.jpoimboe@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/objtool/check.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index 1384090530dbe..e308d1ba664ef 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -4333,7 +4333,8 @@ static int validate_ibt_insn(struct objtool_file *file, struct instruction *insn
+ continue;
+ }
+
+- if (insn_func(dest) && insn_func(dest) == insn_func(insn)) {
++ if (insn_func(dest) && insn_func(insn) &&
++ insn_func(dest)->pfunc == insn_func(insn)->pfunc) {
+ /*
+ * Anything from->to self is either _THIS_IP_ or
+ * IRET-to-self.
+--
+2.40.1
+
--- /dev/null
+From 32d4bd093cd3c469d808867e943a0b1fdd935718 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Aug 2023 11:36:52 +0200
+Subject: parisc: ccio-dma: Fix sparse warnings
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit 9a47a710cf517801a8b4fff9949c4cecb5fd019a ]
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/parisc/ccio-dma.c | 18 +++++++++---------
+ drivers/parisc/iommu-helpers.h | 4 ++--
+ 2 files changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c
+index 10e846286f4ef..623707fc6ff1c 100644
+--- a/drivers/parisc/ccio-dma.c
++++ b/drivers/parisc/ccio-dma.c
+@@ -222,7 +222,7 @@ struct ioa_registers {
+ struct ioc {
+ struct ioa_registers __iomem *ioc_regs; /* I/O MMU base address */
+ u8 *res_map; /* resource map, bit == pdir entry */
+- u64 *pdir_base; /* physical base address */
++ __le64 *pdir_base; /* physical base address */
+ u32 pdir_size; /* bytes, function of IOV Space size */
+ u32 res_hint; /* next available IOVP -
+ circular search */
+@@ -347,7 +347,7 @@ ccio_alloc_range(struct ioc *ioc, struct device *dev, size_t size)
+ BUG_ON(pages_needed == 0);
+ BUG_ON((pages_needed * IOVP_SIZE) > DMA_CHUNK_SIZE);
+
+- DBG_RES("%s() size: %d pages_needed %d\n",
++ DBG_RES("%s() size: %zu pages_needed %d\n",
+ __func__, size, pages_needed);
+
+ /*
+@@ -435,7 +435,7 @@ ccio_free_range(struct ioc *ioc, dma_addr_t iova, unsigned long pages_mapped)
+ BUG_ON((pages_mapped * IOVP_SIZE) > DMA_CHUNK_SIZE);
+ BUG_ON(pages_mapped > BITS_PER_LONG);
+
+- DBG_RES("%s(): res_idx: %d pages_mapped %d\n",
++ DBG_RES("%s(): res_idx: %d pages_mapped %lu\n",
+ __func__, res_idx, pages_mapped);
+
+ #ifdef CCIO_COLLECT_STATS
+@@ -551,7 +551,7 @@ static u32 hint_lookup[] = {
+ * index are bits 12:19 of the value returned by LCI.
+ */
+ static void
+-ccio_io_pdir_entry(u64 *pdir_ptr, space_t sid, unsigned long vba,
++ccio_io_pdir_entry(__le64 *pdir_ptr, space_t sid, unsigned long vba,
+ unsigned long hints)
+ {
+ register unsigned long pa;
+@@ -727,7 +727,7 @@ ccio_map_single(struct device *dev, void *addr, size_t size,
+ unsigned long flags;
+ dma_addr_t iovp;
+ dma_addr_t offset;
+- u64 *pdir_start;
++ __le64 *pdir_start;
+ unsigned long hint = hint_lookup[(int)direction];
+
+ BUG_ON(!dev);
+@@ -754,8 +754,8 @@ ccio_map_single(struct device *dev, void *addr, size_t size,
+
+ pdir_start = &(ioc->pdir_base[idx]);
+
+- DBG_RUN("%s() 0x%p -> 0x%lx size: %0x%x\n",
+- __func__, addr, (long)iovp | offset, size);
++ DBG_RUN("%s() %px -> %#lx size: %zu\n",
++ __func__, addr, (long)(iovp | offset), size);
+
+ /* If not cacheline aligned, force SAFE_DMA on the whole mess */
+ if((size % L1_CACHE_BYTES) || ((unsigned long)addr % L1_CACHE_BYTES))
+@@ -813,7 +813,7 @@ ccio_unmap_page(struct device *dev, dma_addr_t iova, size_t size,
+ return;
+ }
+
+- DBG_RUN("%s() iovp 0x%lx/%x\n",
++ DBG_RUN("%s() iovp %#lx/%zx\n",
+ __func__, (long)iova, size);
+
+ iova ^= offset; /* clear offset bits */
+@@ -1291,7 +1291,7 @@ ccio_ioc_init(struct ioc *ioc)
+ iova_space_size>>20,
+ iov_order + PAGE_SHIFT);
+
+- ioc->pdir_base = (u64 *)__get_free_pages(GFP_KERNEL,
++ ioc->pdir_base = (__le64 *)__get_free_pages(GFP_KERNEL,
+ get_order(ioc->pdir_size));
+ if(NULL == ioc->pdir_base) {
+ panic("%s() could not allocate I/O Page Table\n", __func__);
+diff --git a/drivers/parisc/iommu-helpers.h b/drivers/parisc/iommu-helpers.h
+index a00c38b6224ab..c43f1a212a5c8 100644
+--- a/drivers/parisc/iommu-helpers.h
++++ b/drivers/parisc/iommu-helpers.h
+@@ -31,8 +31,8 @@ iommu_fill_pdir(struct ioc *ioc, struct scatterlist *startsg, int nents,
+ unsigned long vaddr;
+ long size;
+
+- DBG_RUN_SG(" %d : %08lx/%05x %p/%05x\n", nents,
+- (unsigned long)sg_dma_address(startsg), cnt,
++ DBG_RUN_SG(" %d : %08lx %p/%05x\n", nents,
++ (unsigned long)sg_dma_address(startsg),
+ sg_virt(startsg), startsg->length
+ );
+
+--
+2.40.1
+
--- /dev/null
+From edad70c0574de4a3d1d1982fc19243b8b059ae25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Aug 2023 22:08:32 +0200
+Subject: parisc: drivers: Fix sparse warning
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit b137b9d60b8add5620a06c687a71ce18776730b0 ]
+
+Fix "warning: directive in macro's argument list" warning.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/kernel/drivers.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c
+index 8f4b77648491a..ed8b759480614 100644
+--- a/arch/parisc/kernel/drivers.c
++++ b/arch/parisc/kernel/drivers.c
+@@ -925,9 +925,9 @@ static __init void qemu_header(void)
+ pr_info("#define PARISC_MODEL \"%s\"\n\n",
+ boot_cpu_data.pdc.sys_model_name);
+
++ #define p ((unsigned long *)&boot_cpu_data.pdc.model)
+ pr_info("#define PARISC_PDC_MODEL 0x%lx, 0x%lx, 0x%lx, "
+ "0x%lx, 0x%lx, 0x%lx, 0x%lx, 0x%lx, 0x%lx\n\n",
+- #define p ((unsigned long *)&boot_cpu_data.pdc.model)
+ p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7], p[8]);
+ #undef p
+
+--
+2.40.1
+
--- /dev/null
+From 2e1d399c19226d11c2ba638642e89396e31f15eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Aug 2023 11:59:55 +0200
+Subject: parisc: iosapic.c: Fix sparse warnings
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit 927c6c8aa27c284a799b8c18784e37d3373af908 ]
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/parisc/iosapic.c | 4 ++--
+ drivers/parisc/iosapic_private.h | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/parisc/iosapic.c b/drivers/parisc/iosapic.c
+index bcc1dae007803..890c3c0f3d140 100644
+--- a/drivers/parisc/iosapic.c
++++ b/drivers/parisc/iosapic.c
+@@ -202,9 +202,9 @@ static inline void iosapic_write(void __iomem *iosapic, unsigned int reg, u32 va
+
+ static DEFINE_SPINLOCK(iosapic_lock);
+
+-static inline void iosapic_eoi(void __iomem *addr, unsigned int data)
++static inline void iosapic_eoi(__le32 __iomem *addr, __le32 data)
+ {
+- __raw_writel(data, addr);
++ __raw_writel((__force u32)data, addr);
+ }
+
+ /*
+diff --git a/drivers/parisc/iosapic_private.h b/drivers/parisc/iosapic_private.h
+index 73ecc657ad954..bd8ff40162b4b 100644
+--- a/drivers/parisc/iosapic_private.h
++++ b/drivers/parisc/iosapic_private.h
+@@ -118,8 +118,8 @@ struct iosapic_irt {
+ struct vector_info {
+ struct iosapic_info *iosapic; /* I/O SAPIC this vector is on */
+ struct irt_entry *irte; /* IRT entry */
+- u32 __iomem *eoi_addr; /* precalculate EOI reg address */
+- u32 eoi_data; /* IA64: ? PA: swapped txn_data */
++ __le32 __iomem *eoi_addr; /* precalculate EOI reg address */
++ __le32 eoi_data; /* IA64: ? PA: swapped txn_data */
+ int txn_irq; /* virtual IRQ number for processor */
+ ulong txn_addr; /* IA64: id_eid PA: partial HPA */
+ u32 txn_data; /* CPU interrupt bit */
+--
+2.40.1
+
--- /dev/null
+From 9cf07839a47f1f7853b1e63c749fb40f240b8efa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Aug 2023 22:36:12 +0200
+Subject: parisc: irq: Make irq_stack_union static to avoid sparse warning
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit b1bef1388c427cdad7331a9c8eb4ebbbe5b954b0 ]
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/kernel/irq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/parisc/kernel/irq.c b/arch/parisc/kernel/irq.c
+index 12c4d4104ade4..2f81bfd4f15e1 100644
+--- a/arch/parisc/kernel/irq.c
++++ b/arch/parisc/kernel/irq.c
+@@ -365,7 +365,7 @@ union irq_stack_union {
+ volatile unsigned int lock[1];
+ };
+
+-DEFINE_PER_CPU(union irq_stack_union, irq_stack_union) = {
++static DEFINE_PER_CPU(union irq_stack_union, irq_stack_union) = {
+ .slock = { 1,1,1,1 },
+ };
+ #endif
+--
+2.40.1
+
--- /dev/null
+From c54ca6234d3b6273392c74ea24b31b18125f0791 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Aug 2023 08:10:01 +0200
+Subject: parisc: sba: Fix compile warning wrt list of SBA devices
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit eb3255ee8f6f4691471a28fbf22db5e8901116cd ]
+
+Fix this makecheck warning:
+drivers/parisc/sba_iommu.c:98:19: warning: symbol 'sba_list'
+ was not declared. Should it be static?
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/include/asm/ropes.h | 3 +++
+ drivers/char/agp/parisc-agp.c | 2 --
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/parisc/include/asm/ropes.h b/arch/parisc/include/asm/ropes.h
+index 8e51c775c80a6..62399c7ea94a1 100644
+--- a/arch/parisc/include/asm/ropes.h
++++ b/arch/parisc/include/asm/ropes.h
+@@ -86,6 +86,9 @@ struct sba_device {
+ struct ioc ioc[MAX_IOC];
+ };
+
++/* list of SBA's in system, see drivers/parisc/sba_iommu.c */
++extern struct sba_device *sba_list;
++
+ #define ASTRO_RUNWAY_PORT 0x582
+ #define IKE_MERCED_PORT 0x803
+ #define REO_MERCED_PORT 0x804
+diff --git a/drivers/char/agp/parisc-agp.c b/drivers/char/agp/parisc-agp.c
+index 514f9f287a781..c6f181702b9a7 100644
+--- a/drivers/char/agp/parisc-agp.c
++++ b/drivers/char/agp/parisc-agp.c
+@@ -394,8 +394,6 @@ find_quicksilver(struct device *dev, void *data)
+ static int __init
+ parisc_agp_init(void)
+ {
+- extern struct sba_device *sba_list;
+-
+ int err = -1;
+ struct parisc_device *sba = NULL, *lba = NULL;
+ struct lba_device *lbadev = NULL;
+--
+2.40.1
+
--- /dev/null
+From 2c2869190bb60b10a323cad94bf86125f648fa26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Aug 2023 11:49:57 +0200
+Subject: parisc: sba-iommu: Fix sparse warnigs
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit c1ebb94071cb4455177bafa619423acb3494d15d ]
+
+Fix sparse warnings, as pdir is __le64 *.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/include/asm/ropes.h | 4 ++--
+ drivers/parisc/iommu-helpers.h | 4 ++--
+ drivers/parisc/sba_iommu.c | 28 ++++++++++++++--------------
+ 3 files changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/arch/parisc/include/asm/ropes.h b/arch/parisc/include/asm/ropes.h
+index 62399c7ea94a1..c46ad399a74f2 100644
+--- a/arch/parisc/include/asm/ropes.h
++++ b/arch/parisc/include/asm/ropes.h
+@@ -29,7 +29,7 @@
+ struct ioc {
+ void __iomem *ioc_hpa; /* I/O MMU base address */
+ char *res_map; /* resource map, bit == pdir entry */
+- u64 *pdir_base; /* physical base address */
++ __le64 *pdir_base; /* physical base address */
+ unsigned long ibase; /* pdir IOV Space base - shared w/lba_pci */
+ unsigned long imask; /* pdir IOV Space mask - shared w/lba_pci */
+ #ifdef ZX1_SUPPORT
+@@ -113,7 +113,7 @@ static inline int IS_PLUTO(struct parisc_device *d) {
+
+ #define SBA_PDIR_VALID_BIT 0x8000000000000000ULL
+
+-#define SBA_AGPGART_COOKIE 0x0000badbadc0ffeeULL
++#define SBA_AGPGART_COOKIE (__force __le64) 0x0000badbadc0ffeeULL
+
+ #define SBA_FUNC_ID 0x0000 /* function id */
+ #define SBA_FCLASS 0x0008 /* function class, bist, header, rev... */
+diff --git a/drivers/parisc/iommu-helpers.h b/drivers/parisc/iommu-helpers.h
+index 0905be256de08..a00c38b6224ab 100644
+--- a/drivers/parisc/iommu-helpers.h
++++ b/drivers/parisc/iommu-helpers.h
+@@ -14,13 +14,13 @@
+ static inline unsigned int
+ iommu_fill_pdir(struct ioc *ioc, struct scatterlist *startsg, int nents,
+ unsigned long hint,
+- void (*iommu_io_pdir_entry)(u64 *, space_t, unsigned long,
++ void (*iommu_io_pdir_entry)(__le64 *, space_t, unsigned long,
+ unsigned long))
+ {
+ struct scatterlist *dma_sg = startsg; /* pointer to current DMA */
+ unsigned int n_mappings = 0;
+ unsigned long dma_offset = 0, dma_len = 0;
+- u64 *pdirp = NULL;
++ __le64 *pdirp = NULL;
+
+ /* Horrible hack. For efficiency's sake, dma_sg starts one
+ * entry below the true start (it is immediately incremented
+diff --git a/drivers/parisc/sba_iommu.c b/drivers/parisc/sba_iommu.c
+index b8e91cbb60567..780ea219cd8d4 100644
+--- a/drivers/parisc/sba_iommu.c
++++ b/drivers/parisc/sba_iommu.c
+@@ -202,7 +202,7 @@ static void
+ sba_dump_pdir_entry(struct ioc *ioc, char *msg, uint pide)
+ {
+ /* start printing from lowest pde in rval */
+- u64 *ptr = &(ioc->pdir_base[pide & (~0U * BITS_PER_LONG)]);
++ __le64 *ptr = &(ioc->pdir_base[pide & (~0U * BITS_PER_LONG)]);
+ unsigned long *rptr = (unsigned long *) &(ioc->res_map[(pide >>3) & ~(sizeof(unsigned long) - 1)]);
+ uint rcnt;
+
+@@ -569,7 +569,7 @@ typedef unsigned long space_t;
+ */
+
+ static void
+-sba_io_pdir_entry(u64 *pdir_ptr, space_t sid, unsigned long vba,
++sba_io_pdir_entry(__le64 *pdir_ptr, space_t sid, unsigned long vba,
+ unsigned long hint)
+ {
+ u64 pa; /* physical address */
+@@ -613,7 +613,7 @@ static void
+ sba_mark_invalid(struct ioc *ioc, dma_addr_t iova, size_t byte_cnt)
+ {
+ u32 iovp = (u32) SBA_IOVP(ioc,iova);
+- u64 *pdir_ptr = &ioc->pdir_base[PDIR_INDEX(iovp)];
++ __le64 *pdir_ptr = &ioc->pdir_base[PDIR_INDEX(iovp)];
+
+ #ifdef ASSERT_PDIR_SANITY
+ /* Assert first pdir entry is set.
+@@ -714,7 +714,7 @@ sba_map_single(struct device *dev, void *addr, size_t size,
+ unsigned long flags;
+ dma_addr_t iovp;
+ dma_addr_t offset;
+- u64 *pdir_start;
++ __le64 *pdir_start;
+ int pide;
+
+ ioc = GET_IOC(dev);
+@@ -1432,7 +1432,7 @@ sba_ioc_init(struct parisc_device *sba, struct ioc *ioc, int ioc_num)
+
+ ioc->pdir_size = pdir_size = (iova_space_size/IOVP_SIZE) * sizeof(u64);
+
+- DBG_INIT("%s() hpa 0x%lx mem %ldMB IOV %dMB (%d bits)\n",
++ DBG_INIT("%s() hpa %px mem %ldMB IOV %dMB (%d bits)\n",
+ __func__,
+ ioc->ioc_hpa,
+ (unsigned long) totalram_pages() >> (20 - PAGE_SHIFT),
+@@ -1469,7 +1469,7 @@ sba_ioc_init(struct parisc_device *sba, struct ioc *ioc, int ioc_num)
+ ioc->iovp_mask = ~(iova_space_mask + PAGE_SIZE - 1);
+ #endif
+
+- DBG_INIT("%s() IOV base 0x%lx mask 0x%0lx\n",
++ DBG_INIT("%s() IOV base %#lx mask %#0lx\n",
+ __func__, ioc->ibase, ioc->imask);
+
+ /*
+@@ -1581,7 +1581,7 @@ printk("sba_hw_init(): mem_boot 0x%x 0x%x 0x%x 0x%x\n", PAGE0->mem_boot.hpa,
+
+ if (!IS_PLUTO(sba_dev->dev)) {
+ ioc_ctl = READ_REG(sba_dev->sba_hpa+IOC_CTRL);
+- DBG_INIT("%s() hpa 0x%lx ioc_ctl 0x%Lx ->",
++ DBG_INIT("%s() hpa %px ioc_ctl 0x%Lx ->",
+ __func__, sba_dev->sba_hpa, ioc_ctl);
+ ioc_ctl &= ~(IOC_CTRL_RM | IOC_CTRL_NC | IOC_CTRL_CE);
+ ioc_ctl |= IOC_CTRL_DD | IOC_CTRL_D4 | IOC_CTRL_TC;
+@@ -1666,14 +1666,14 @@ printk("sba_hw_init(): mem_boot 0x%x 0x%x 0x%x 0x%x\n", PAGE0->mem_boot.hpa,
+ /* flush out the last writes */
+ READ_REG(sba_dev->ioc[i].ioc_hpa + ROPE7_CTL);
+
+- DBG_INIT(" ioc[%d] ROPE_CFG 0x%Lx ROPE_DBG 0x%Lx\n",
++ DBG_INIT(" ioc[%d] ROPE_CFG %#lx ROPE_DBG %lx\n",
+ i,
+- READ_REG(sba_dev->ioc[i].ioc_hpa + 0x40),
+- READ_REG(sba_dev->ioc[i].ioc_hpa + 0x50)
++ (unsigned long) READ_REG(sba_dev->ioc[i].ioc_hpa + 0x40),
++ (unsigned long) READ_REG(sba_dev->ioc[i].ioc_hpa + 0x50)
+ );
+- DBG_INIT(" STATUS_CONTROL 0x%Lx FLUSH_CTRL 0x%Lx\n",
+- READ_REG(sba_dev->ioc[i].ioc_hpa + 0x108),
+- READ_REG(sba_dev->ioc[i].ioc_hpa + 0x400)
++ DBG_INIT(" STATUS_CONTROL %#lx FLUSH_CTRL %#lx\n",
++ (unsigned long) READ_REG(sba_dev->ioc[i].ioc_hpa + 0x108),
++ (unsigned long) READ_REG(sba_dev->ioc[i].ioc_hpa + 0x400)
+ );
+
+ if (IS_PLUTO(sba_dev->dev)) {
+@@ -1737,7 +1737,7 @@ sba_common_init(struct sba_device *sba_dev)
+ #ifdef ASSERT_PDIR_SANITY
+ /* Mark first bit busy - ie no IOVA 0 */
+ sba_dev->ioc[i].res_map[0] = 0x80;
+- sba_dev->ioc[i].pdir_base[0] = 0xeeffc0addbba0080ULL;
++ sba_dev->ioc[i].pdir_base[0] = (__force __le64) 0xeeffc0addbba0080ULL;
+ #endif
+
+ /* Third (and last) part of PIRANHA BUG */
+--
+2.40.1
+
--- /dev/null
+From 246eccc6074bfce61acfab7522ade637ea922265 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Sep 2023 09:32:43 -0400
+Subject: platform/mellanox: mlxbf-bootctl: add NET dependency into Kconfig
+
+From: David Thompson <davthompson@nvidia.com>
+
+[ Upstream commit c2dffda1d8f7511505bbbf16ba282f2079b30089 ]
+
+The latest version of the mlxbf_bootctl driver utilizes
+"sysfs_format_mac", and this API is only available if
+NET is defined in the kernel configuration. This patch
+changes the mlxbf_bootctl Kconfig to depend on NET.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202309031058.JvwNDBKt-lkp@intel.com/
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: David Thompson <davthompson@nvidia.com>
+Link: https://lore.kernel.org/r/20230905133243.31550-1-davthompson@nvidia.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/mellanox/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/mellanox/Kconfig b/drivers/platform/mellanox/Kconfig
+index 30b50920b278c..f7dfa0e785fd6 100644
+--- a/drivers/platform/mellanox/Kconfig
++++ b/drivers/platform/mellanox/Kconfig
+@@ -60,6 +60,7 @@ config MLXBF_BOOTCTL
+ tristate "Mellanox BlueField Firmware Boot Control driver"
+ depends on ARM64
+ depends on ACPI
++ depends on NET
+ help
+ The Mellanox BlueField firmware implements functionality to
+ request swapping the primary and alternate eMMC boot partition,
+--
+2.40.1
+
--- /dev/null
+From f8f54465419ad7245fed0becee343f2dc1167fdb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Sep 2023 20:28:13 +1200
+Subject: platform/x86: asus-wmi: Support 2023 ROG X16 tablet mode
+
+From: Luke D. Jones <luke@ljones.dev>
+
+[ Upstream commit 4106a70ddad57ee6d8f98b81d6f036740c72762b ]
+
+Add quirk for ASUS ROG X16 (GV601V, 2023 versions) Flow 2-in-1
+to enable tablet mode with lid flip (all screen rotations).
+
+Signed-off-by: Luke D. Jones <luke@ljones.dev>
+Link: https://lore.kernel.org/r/20230905082813.13470-1-luke@ljones.dev
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/asus-nb-wmi.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
+index fdf7da06af306..d85d895fee894 100644
+--- a/drivers/platform/x86/asus-nb-wmi.c
++++ b/drivers/platform/x86/asus-nb-wmi.c
+@@ -478,6 +478,15 @@ static const struct dmi_system_id asus_quirks[] = {
+ },
+ .driver_data = &quirk_asus_tablet_mode,
+ },
++ {
++ .callback = dmi_matched,
++ .ident = "ASUS ROG FLOW X16",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "GV601V"),
++ },
++ .driver_data = &quirk_asus_tablet_mode,
++ },
+ {
+ .callback = dmi_matched,
+ .ident = "ASUS VivoBook E410MA",
+--
+2.40.1
+
--- /dev/null
+From 9c774009629155ca092b864e6703f9cf61b4ad08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Aug 2023 16:34:56 +1000
+Subject: powerpc/watchpoint: Disable pagefaults when getting user instruction
+
+From: Benjamin Gray <bgray@linux.ibm.com>
+
+[ Upstream commit 3241f260eb830d27d09cc604690ec24533fdb433 ]
+
+This is called in an atomic context, so is not allowed to sleep if a
+user page needs to be faulted in and has nowhere it can be deferred to.
+The pagefault_disabled() function is documented as preventing user
+access methods from sleeping.
+
+In practice the page will be mapped in nearly always because we are
+reading the instruction that just triggered the watchpoint trap.
+
+Signed-off-by: Benjamin Gray <bgray@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230829063457.54157-3-bgray@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/hw_breakpoint_constraints.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/hw_breakpoint_constraints.c b/arch/powerpc/kernel/hw_breakpoint_constraints.c
+index a74623025f3ab..9e51801c49152 100644
+--- a/arch/powerpc/kernel/hw_breakpoint_constraints.c
++++ b/arch/powerpc/kernel/hw_breakpoint_constraints.c
+@@ -131,8 +131,13 @@ void wp_get_instr_detail(struct pt_regs *regs, ppc_inst_t *instr,
+ int *type, int *size, unsigned long *ea)
+ {
+ struct instruction_op op;
++ int err;
+
+- if (__get_user_instr(*instr, (void __user *)regs->nip))
++ pagefault_disable();
++ err = __get_user_instr(*instr, (void __user *)regs->nip);
++ pagefault_enable();
++
++ if (err)
+ return;
+
+ analyse_instr(&op, regs, *instr);
+--
+2.40.1
+
--- /dev/null
+From 4ec0d60e914242de33fe8bbea13a9d608f26e5ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Aug 2023 16:34:57 +1000
+Subject: powerpc/watchpoints: Annotate atomic context in more places
+
+From: Benjamin Gray <bgray@linux.ibm.com>
+
+[ Upstream commit 27646b2e02b096a6936b3e3b6ba334ae20763eab ]
+
+It can be easy to miss that the notifier mechanism invokes the callbacks
+in an atomic context, so add some comments to that effect on the two
+handlers we register here.
+
+Signed-off-by: Benjamin Gray <bgray@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230829063457.54157-4-bgray@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/hw_breakpoint.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/arch/powerpc/kernel/hw_breakpoint.c b/arch/powerpc/kernel/hw_breakpoint.c
+index 0a1e17b334284..f432db3faa5b0 100644
+--- a/arch/powerpc/kernel/hw_breakpoint.c
++++ b/arch/powerpc/kernel/hw_breakpoint.c
+@@ -637,6 +637,11 @@ static void handle_p10dd1_spurious_exception(struct arch_hw_breakpoint **info,
+ }
+ }
+
++/*
++ * Handle a DABR or DAWR exception.
++ *
++ * Called in atomic context.
++ */
+ int hw_breakpoint_handler(struct die_args *args)
+ {
+ bool err = false;
+@@ -763,6 +768,8 @@ NOKPROBE_SYMBOL(hw_breakpoint_handler);
+
+ /*
+ * Handle single-step exceptions following a DABR hit.
++ *
++ * Called in atomic context.
+ */
+ static int single_step_dabr_instruction(struct die_args *args)
+ {
+@@ -820,6 +827,8 @@ NOKPROBE_SYMBOL(single_step_dabr_instruction);
+
+ /*
+ * Handle debug exception notifications.
++ *
++ * Called in atomic context.
+ */
+ int hw_breakpoint_exceptions_notify(
+ struct notifier_block *unused, unsigned long val, void *data)
+--
+2.40.1
+
--- /dev/null
+From 23121b71d1971074a4de343fa753f43ef4f91832 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Aug 2023 16:34:55 +1000
+Subject: powerpc/watchpoints: Disable preemption in thread_change_pc()
+
+From: Benjamin Gray <bgray@linux.ibm.com>
+
+[ Upstream commit cc879ab3ce39bc39f9b1d238b283f43a5f6f957d ]
+
+thread_change_pc() uses CPU local data, so must be protected from
+swapping CPUs while it is reading the breakpoint struct.
+
+The error is more noticeable after 1e60f3564bad ("powerpc/watchpoints:
+Track perf single step directly on the breakpoint"), which added an
+unconditional __this_cpu_read() call in thread_change_pc(). However the
+existing __this_cpu_read() that runs if a breakpoint does need to be
+re-inserted has the same issue.
+
+Signed-off-by: Benjamin Gray <bgray@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230829063457.54157-2-bgray@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/hw_breakpoint.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/hw_breakpoint.c b/arch/powerpc/kernel/hw_breakpoint.c
+index e1b4e70c8fd0f..0a1e17b334284 100644
+--- a/arch/powerpc/kernel/hw_breakpoint.c
++++ b/arch/powerpc/kernel/hw_breakpoint.c
+@@ -505,11 +505,13 @@ void thread_change_pc(struct task_struct *tsk, struct pt_regs *regs)
+ struct arch_hw_breakpoint *info;
+ int i;
+
++ preempt_disable();
++
+ for (i = 0; i < nr_wp_slots(); i++) {
+ if (unlikely(tsk->thread.last_hit_ubp[i]))
+ goto reset;
+ }
+- return;
++ goto out;
+
+ reset:
+ regs_set_return_msr(regs, regs->msr & ~MSR_SE);
+@@ -518,6 +520,9 @@ void thread_change_pc(struct task_struct *tsk, struct pt_regs *regs)
+ __set_breakpoint(i, info);
+ tsk->thread.last_hit_ubp[i] = NULL;
+ }
++
++out:
++ preempt_enable();
+ }
+
+ static bool is_larx_stcx_instr(int type)
+--
+2.40.1
+
--- /dev/null
+From 14aa319e824f098ee93465e02795677cf8a25485 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Sep 2023 16:19:30 +0800
+Subject: ring-buffer: Avoid softlockup in ring_buffer_resize()
+
+From: Zheng Yejian <zhengyejian1@huawei.com>
+
+[ Upstream commit f6bd2c92488c30ef53b5bd80c52f0a7eee9d545a ]
+
+When user resize all trace ring buffer through file 'buffer_size_kb',
+then in ring_buffer_resize(), kernel allocates buffer pages for each
+cpu in a loop.
+
+If the kernel preemption model is PREEMPT_NONE and there are many cpus
+and there are many buffer pages to be allocated, it may not give up cpu
+for a long time and finally cause a softlockup.
+
+To avoid it, call cond_resched() after each cpu buffer allocation.
+
+Link: https://lore.kernel.org/linux-trace-kernel/20230906081930.3939106-1-zhengyejian1@huawei.com
+
+Cc: <mhiramat@kernel.org>
+Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/ring_buffer.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index 52dea5dd5362e..1267e1016ab5c 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -2206,6 +2206,8 @@ int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size,
+ err = -ENOMEM;
+ goto out_err;
+ }
++
++ cond_resched();
+ }
+
+ cpus_read_lock();
+--
+2.40.1
+
--- /dev/null
+From bce88571421d51e7bec59caa78b78743c1c47bf7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Sep 2023 12:28:20 -0400
+Subject: ring-buffer: Do not attempt to read past "commit"
+
+From: Steven Rostedt (Google) <rostedt@goodmis.org>
+
+[ Upstream commit 95a404bd60af6c4d9d8db01ad14fe8957ece31ca ]
+
+When iterating over the ring buffer while the ring buffer is active, the
+writer can corrupt the reader. There's barriers to help detect this and
+handle it, but that code missed the case where the last event was at the
+very end of the page and has only 4 bytes left.
+
+The checks to detect the corruption by the writer to reads needs to see the
+length of the event. If the length in the first 4 bytes is zero then the
+length is stored in the second 4 bytes. But if the writer is in the process
+of updating that code, there's a small window where the length in the first
+4 bytes could be zero even though the length is only 4 bytes. That will
+cause rb_event_length() to read the next 4 bytes which could happen to be off the
+allocated page.
+
+To protect against this, fail immediately if the next event pointer is
+less than 8 bytes from the end of the commit (last byte of data), as all
+events must be a minimum of 8 bytes anyway.
+
+Link: https://lore.kernel.org/all/20230905141245.26470-1-Tze-nan.Wu@mediatek.com/
+Link: https://lore.kernel.org/linux-trace-kernel/20230907122820.0899019c@gandalf.local.home
+
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Reported-by: Tze-nan Wu <Tze-nan.Wu@mediatek.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/ring_buffer.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index 1267e1016ab5c..53b73b85cf737 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -2398,6 +2398,11 @@ rb_iter_head_event(struct ring_buffer_iter *iter)
+ */
+ commit = rb_page_commit(iter_head_page);
+ smp_rmb();
++
++ /* An event needs to be at least 8 bytes in size */
++ if (iter->head > commit - 8)
++ goto reset;
++
+ event = __rb_page_index(iter_head_page, iter->head);
+ length = rb_event_length(event);
+
+--
+2.40.1
+
--- /dev/null
+From 6340f103eacbc4416be85eab0589c92345c7997b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Sep 2023 15:24:10 +0800
+Subject: riscv: errata: fix T-Head dcache.cva encoding
+
+From: Icenowy Zheng <uwu@icenowy.me>
+
+[ Upstream commit 8eb8fe67e2c84324398f5983c41b4f831d0705b3 ]
+
+The dcache.cva encoding shown in the comments are wrong, it's for
+dcache.cval1 (which is restricted to L1) instead.
+
+Fix this in the comment and in the hardcoded instruction.
+
+Signed-off-by: Icenowy Zheng <uwu@icenowy.me>
+Tested-by: Sergey Matyukevich <sergey.matyukevich@syntacore.com>
+Reviewed-by: Heiko Stuebner <heiko@sntech.de>
+Reviewed-by: Guo Ren <guoren@kernel.org>
+Tested-by: Drew Fustini <dfustini@baylibre.com>
+Link: https://lore.kernel.org/r/20230912072410.2481-1-jszhang@kernel.org
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/include/asm/errata_list.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/riscv/include/asm/errata_list.h b/arch/riscv/include/asm/errata_list.h
+index fb1a810f3d8ce..feab334dd8329 100644
+--- a/arch/riscv/include/asm/errata_list.h
++++ b/arch/riscv/include/asm/errata_list.h
+@@ -100,7 +100,7 @@ asm volatile(ALTERNATIVE( \
+ * | 31 - 25 | 24 - 20 | 19 - 15 | 14 - 12 | 11 - 7 | 6 - 0 |
+ * 0000001 01001 rs1 000 00000 0001011
+ * dcache.cva rs1 (clean, virtual address)
+- * 0000001 00100 rs1 000 00000 0001011
++ * 0000001 00101 rs1 000 00000 0001011
+ *
+ * dcache.cipa rs1 (clean then invalidate, physical address)
+ * | 31 - 25 | 24 - 20 | 19 - 15 | 14 - 12 | 11 - 7 | 6 - 0 |
+@@ -113,7 +113,7 @@ asm volatile(ALTERNATIVE( \
+ * 0000000 11001 00000 000 00000 0001011
+ */
+ #define THEAD_inval_A0 ".long 0x0265000b"
+-#define THEAD_clean_A0 ".long 0x0245000b"
++#define THEAD_clean_A0 ".long 0x0255000b"
+ #define THEAD_flush_A0 ".long 0x0275000b"
+ #define THEAD_SYNC_S ".long 0x0190000b"
+
+--
+2.40.1
+
--- /dev/null
+From 42d0f3446fbf0d8afaf73c7804092b4a76f55875 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Sep 2023 10:03:40 -0700
+Subject: scsi: pm80xx: Avoid leaking tags when processing
+ OPC_INB_SET_CONTROLLER_CONFIG command
+
+From: Michal Grzedzicki <mge@meta.com>
+
+[ Upstream commit c13e7331745852d0dd7c35eabbe181cbd5b01172 ]
+
+Tags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed
+when we receive the response.
+
+Signed-off-by: Michal Grzedzicki <mge@meta.com>
+Link: https://lore.kernel.org/r/20230911170340.699533-2-mge@meta.com
+Acked-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm80xx_hwi.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index 9689fb830a5fb..e543bc36c84df 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -3671,10 +3671,12 @@ static int mpi_set_controller_config_resp(struct pm8001_hba_info *pm8001_ha,
+ (struct set_ctrl_cfg_resp *)(piomb + 4);
+ u32 status = le32_to_cpu(pPayload->status);
+ u32 err_qlfr_pgcd = le32_to_cpu(pPayload->err_qlfr_pgcd);
++ u32 tag = le32_to_cpu(pPayload->tag);
+
+ pm8001_dbg(pm8001_ha, MSG,
+ "SET CONTROLLER RESP: status 0x%x qlfr_pgcd 0x%x\n",
+ status, err_qlfr_pgcd);
++ pm8001_tag_free(pm8001_ha, tag);
+
+ return 0;
+ }
+--
+2.40.1
+
--- /dev/null
+From f6d102659ea4251bb17d9dc25bfaf0365d0b0bd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Sep 2023 08:56:10 -0700
+Subject: scsi: pm80xx: Use phy-specific SAS address when sending PHY_START
+ command
+
+From: Michal Grzedzicki <mge@meta.com>
+
+[ Upstream commit 71996bb835aed58c7ec4967be1d05190a27339ec ]
+
+Some cards have more than one SAS address. Using an incorrect address
+causes communication issues with some devices like expanders.
+
+Closes: https://lore.kernel.org/linux-kernel/A57AEA84-5CA0-403E-8053-106033C73C70@fb.com/
+Signed-off-by: Michal Grzedzicki <mge@meta.com>
+Link: https://lore.kernel.org/r/20230913155611.3183612-1-mge@meta.com
+Acked-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_hwi.c | 2 +-
+ drivers/scsi/pm8001/pm80xx_hwi.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
+index 73cd25f30ca58..00f22058ccf4e 100644
+--- a/drivers/scsi/pm8001/pm8001_hwi.c
++++ b/drivers/scsi/pm8001/pm8001_hwi.c
+@@ -4180,7 +4180,7 @@ pm8001_chip_phy_start_req(struct pm8001_hba_info *pm8001_ha, u8 phy_id)
+ payload.sas_identify.dev_type = SAS_END_DEVICE;
+ payload.sas_identify.initiator_bits = SAS_PROTOCOL_ALL;
+ memcpy(payload.sas_identify.sas_addr,
+- pm8001_ha->sas_addr, SAS_ADDR_SIZE);
++ &pm8001_ha->phy[phy_id].dev_sas_addr, SAS_ADDR_SIZE);
+ payload.sas_identify.phy_id = phy_id;
+
+ return pm8001_mpi_build_cmd(pm8001_ha, 0, opcode, &payload,
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index 39a12ee94a72f..9689fb830a5fb 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -4676,7 +4676,7 @@ pm80xx_chip_phy_start_req(struct pm8001_hba_info *pm8001_ha, u8 phy_id)
+ payload.sas_identify.dev_type = SAS_END_DEVICE;
+ payload.sas_identify.initiator_bits = SAS_PROTOCOL_ALL;
+ memcpy(payload.sas_identify.sas_addr,
+- &pm8001_ha->sas_addr, SAS_ADDR_SIZE);
++ &pm8001_ha->phy[phy_id].dev_sas_addr, SAS_ADDR_SIZE);
+ payload.sas_identify.phy_id = phy_id;
+
+ return pm8001_mpi_build_cmd(pm8001_ha, 0, opcode, &payload,
+--
+2.40.1
+
--- /dev/null
+From e550944310a934843828be91cb0d57850ae835f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Sep 2023 11:36:46 +0530
+Subject: scsi: qedf: Add synchronization between I/O completions and abort
+
+From: Javed Hasan <jhasan@marvell.com>
+
+[ Upstream commit 7df0b2605489bef3f4223ad66f1f9bb8d50d4cd2 ]
+
+Avoid race condition between I/O completion and abort processing by
+protecting the cmd_type with the rport lock.
+
+Signed-off-by: Javed Hasan <jhasan@marvell.com>
+Signed-off-by: Saurav Kashyap <skashyap@marvell.com>
+Link: https://lore.kernel.org/r/20230901060646.27885-1-skashyap@marvell.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qedf/qedf_io.c | 10 ++++++++--
+ drivers/scsi/qedf/qedf_main.c | 7 ++++++-
+ 2 files changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/qedf/qedf_io.c b/drivers/scsi/qedf/qedf_io.c
+index 4750ec5789a80..10fe3383855c0 100644
+--- a/drivers/scsi/qedf/qedf_io.c
++++ b/drivers/scsi/qedf/qedf_io.c
+@@ -1904,6 +1904,7 @@ int qedf_initiate_abts(struct qedf_ioreq *io_req, bool return_scsi_cmd_on_abts)
+ goto drop_rdata_kref;
+ }
+
++ spin_lock_irqsave(&fcport->rport_lock, flags);
+ if (!test_bit(QEDF_CMD_OUTSTANDING, &io_req->flags) ||
+ test_bit(QEDF_CMD_IN_CLEANUP, &io_req->flags) ||
+ test_bit(QEDF_CMD_IN_ABORT, &io_req->flags)) {
+@@ -1911,17 +1912,20 @@ int qedf_initiate_abts(struct qedf_ioreq *io_req, bool return_scsi_cmd_on_abts)
+ "io_req xid=0x%x sc_cmd=%p already in cleanup or abort processing or already completed.\n",
+ io_req->xid, io_req->sc_cmd);
+ rc = 1;
++ spin_unlock_irqrestore(&fcport->rport_lock, flags);
+ goto drop_rdata_kref;
+ }
+
++ /* Set the command type to abort */
++ io_req->cmd_type = QEDF_ABTS;
++ spin_unlock_irqrestore(&fcport->rport_lock, flags);
++
+ kref_get(&io_req->refcount);
+
+ xid = io_req->xid;
+ qedf->control_requests++;
+ qedf->packet_aborts++;
+
+- /* Set the command type to abort */
+- io_req->cmd_type = QEDF_ABTS;
+ io_req->return_scsi_cmd_on_abts = return_scsi_cmd_on_abts;
+
+ set_bit(QEDF_CMD_IN_ABORT, &io_req->flags);
+@@ -2210,7 +2214,9 @@ int qedf_initiate_cleanup(struct qedf_ioreq *io_req,
+ refcount, fcport, fcport->rdata->ids.port_id);
+
+ /* Cleanup cmds re-use the same TID as the original I/O */
++ spin_lock_irqsave(&fcport->rport_lock, flags);
+ io_req->cmd_type = QEDF_CLEANUP;
++ spin_unlock_irqrestore(&fcport->rport_lock, flags);
+ io_req->return_scsi_cmd_on_abts = return_scsi_cmd_on_abts;
+
+ init_completion(&io_req->cleanup_done);
+diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
+index 7825765c936cd..91f3f1d7098eb 100644
+--- a/drivers/scsi/qedf/qedf_main.c
++++ b/drivers/scsi/qedf/qedf_main.c
+@@ -2805,6 +2805,8 @@ void qedf_process_cqe(struct qedf_ctx *qedf, struct fcoe_cqe *cqe)
+ struct qedf_ioreq *io_req;
+ struct qedf_rport *fcport;
+ u32 comp_type;
++ u8 io_comp_type;
++ unsigned long flags;
+
+ comp_type = (cqe->cqe_data >> FCOE_CQE_CQE_TYPE_SHIFT) &
+ FCOE_CQE_CQE_TYPE_MASK;
+@@ -2838,11 +2840,14 @@ void qedf_process_cqe(struct qedf_ctx *qedf, struct fcoe_cqe *cqe)
+ return;
+ }
+
++ spin_lock_irqsave(&fcport->rport_lock, flags);
++ io_comp_type = io_req->cmd_type;
++ spin_unlock_irqrestore(&fcport->rport_lock, flags);
+
+ switch (comp_type) {
+ case FCOE_GOOD_COMPLETION_CQE_TYPE:
+ atomic_inc(&fcport->free_sqes);
+- switch (io_req->cmd_type) {
++ switch (io_comp_type) {
+ case QEDF_SCSI_CMD:
+ qedf_scsi_completion(qedf, cqe, io_req);
+ break;
+--
+2.40.1
+
--- /dev/null
+From d920f8722128e50705c4d897fe8f8da9e769012e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Sep 2023 10:30:44 +0900
+Subject: scsi: ufs: core: Move __ufshcd_send_uic_cmd() outside host_lock
+
+From: Kiwoong Kim <kwmad.kim@samsung.com>
+
+[ Upstream commit 2d3f59cf868b4a2dd678a96cd49bdd91411bd59f ]
+
+__ufshcd_send_uic_cmd() is wrapped by uic_cmd_mutex and its related
+contexts are accessed within the section wrapped by uic_cmd_mutex. Thus,
+wrapping with host_lock is redundant.
+
+Signed-off-by: Kiwoong Kim <kwmad.kim@samsung.com>
+Link: https://lore.kernel.org/r/782ba5f26f0a96e58d85dff50751787d2d2a6b2b.1693790060.git.kwmad.kim@samsung.com
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Chanwoo Lee <cw9316.lee@samsung.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufshcd.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index 9615a076735bd..75c6628af2c0e 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -2416,7 +2416,6 @@ __ufshcd_send_uic_cmd(struct ufs_hba *hba, struct uic_command *uic_cmd,
+ bool completion)
+ {
+ lockdep_assert_held(&hba->uic_cmd_mutex);
+- lockdep_assert_held(hba->host->host_lock);
+
+ if (!ufshcd_ready_for_uic_cmd(hba)) {
+ dev_err(hba->dev,
+@@ -2443,7 +2442,6 @@ __ufshcd_send_uic_cmd(struct ufs_hba *hba, struct uic_command *uic_cmd,
+ int ufshcd_send_uic_cmd(struct ufs_hba *hba, struct uic_command *uic_cmd)
+ {
+ int ret;
+- unsigned long flags;
+
+ if (hba->quirks & UFSHCD_QUIRK_BROKEN_UIC_CMD)
+ return 0;
+@@ -2452,9 +2450,7 @@ int ufshcd_send_uic_cmd(struct ufs_hba *hba, struct uic_command *uic_cmd)
+ mutex_lock(&hba->uic_cmd_mutex);
+ ufshcd_add_delay_before_dme_cmd(hba);
+
+- spin_lock_irqsave(hba->host->host_lock, flags);
+ ret = __ufshcd_send_uic_cmd(hba, uic_cmd, true);
+- spin_unlock_irqrestore(hba->host->host_lock, flags);
+ if (!ret)
+ ret = ufshcd_wait_for_uic_cmd(hba, uic_cmd);
+
+@@ -4166,8 +4162,8 @@ static int ufshcd_uic_pwr_ctrl(struct ufs_hba *hba, struct uic_command *cmd)
+ wmb();
+ reenable_intr = true;
+ }
+- ret = __ufshcd_send_uic_cmd(hba, cmd, false);
+ spin_unlock_irqrestore(hba->host->host_lock, flags);
++ ret = __ufshcd_send_uic_cmd(hba, cmd, false);
+ if (ret) {
+ dev_err(hba->dev,
+ "pwr ctrl cmd 0x%x with mode 0x%x uic error %d\n",
+--
+2.40.1
+
--- /dev/null
+From ee7bba5ad41d81211ee962e379d738a78fb37159 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Sep 2023 10:30:45 +0900
+Subject: scsi: ufs: core: Poll HCS.UCRDY before issuing a UIC command
+
+From: Kiwoong Kim <kwmad.kim@samsung.com>
+
+[ Upstream commit d32533d30e2119b0c0aa17596734f1f842f750df ]
+
+With auto hibern8 enabled, UIC could be busy processing a hibern8 operation
+and the HCI would reports UIC not ready for a short while through
+HCS.UCRDY. The UFS driver doesn't currently handle this situation. The
+UFSHCI spec specifies UCRDY like this: whether the host controller is ready
+to process UIC COMMAND
+
+The 'ready' could be seen as many different meanings. If the meaning
+includes not processing any request from HCI, processing a hibern8
+operation can be 'not ready'. In this situation, the driver needs to wait
+until the operations is completed.
+
+Signed-off-by: Kiwoong Kim <kwmad.kim@samsung.com>
+Link: https://lore.kernel.org/r/550484ffb66300bdcec63d3e304dfd55cb432f1f.1693790060.git.kwmad.kim@samsung.com
+Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
+Reviewed-by: Chanwoo Lee <cw9316.lee@samsung.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufshcd.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index 75c6628af2c0e..80c48eb6bf85c 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -22,6 +22,7 @@
+ #include <linux/module.h>
+ #include <linux/regulator/consumer.h>
+ #include <linux/sched/clock.h>
++#include <linux/iopoll.h>
+ #include <scsi/scsi_cmnd.h>
+ #include <scsi/scsi_dbg.h>
+ #include <scsi/scsi_driver.h>
+@@ -2324,7 +2325,11 @@ static inline int ufshcd_hba_capabilities(struct ufs_hba *hba)
+ */
+ static inline bool ufshcd_ready_for_uic_cmd(struct ufs_hba *hba)
+ {
+- return ufshcd_readl(hba, REG_CONTROLLER_STATUS) & UIC_COMMAND_READY;
++ u32 val;
++ int ret = read_poll_timeout(ufshcd_readl, val, val & UIC_COMMAND_READY,
++ 500, UIC_CMD_TIMEOUT * 1000, false, hba,
++ REG_CONTROLLER_STATUS);
++ return ret == 0 ? true : false;
+ }
+
+ /**
+--
+2.40.1
+
--- /dev/null
+From 1ca7e128cb238a6ce4a462179606afceab574649 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Aug 2023 18:09:40 -0300
+Subject: selftests: fix dependency checker script
+
+From: Ricardo B. Marliere <rbmarliere@gmail.com>
+
+[ Upstream commit 5f9dd2e896a91bfca90f8463eb6808c03d535d8a ]
+
+This patch fixes inconsistencies in the parsing rules of the levels 1
+and 2 of the kselftest_deps.sh. It was added the levels 4 and 5 to
+account for a few edge cases that are present in some tests, also some
+minor identation styling have been fixed (s/ /\t/g).
+
+Signed-off-by: Ricardo B. Marliere <rbmarliere@gmail.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/kselftest_deps.sh | 77 +++++++++++++++++++----
+ 1 file changed, 65 insertions(+), 12 deletions(-)
+
+diff --git a/tools/testing/selftests/kselftest_deps.sh b/tools/testing/selftests/kselftest_deps.sh
+index 4bc14d9e8ff1d..de59cc8f03c3f 100755
+--- a/tools/testing/selftests/kselftest_deps.sh
++++ b/tools/testing/selftests/kselftest_deps.sh
+@@ -46,11 +46,11 @@ fi
+ print_targets=0
+
+ while getopts "p" arg; do
+- case $arg in
+- p)
++ case $arg in
++ p)
+ print_targets=1
+ shift;;
+- esac
++ esac
+ done
+
+ if [ $# -eq 0 ]
+@@ -92,6 +92,10 @@ pass_cnt=0
+ # Get all TARGETS from selftests Makefile
+ targets=$(grep -E "^TARGETS +|^TARGETS =" Makefile | cut -d "=" -f2)
+
++# Initially, in LDLIBS related lines, the dep checker needs
++# to ignore lines containing the following strings:
++filter="\$(VAR_LDLIBS)\|pkg-config\|PKG_CONFIG\|IOURING_EXTRA_LIBS"
++
+ # Single test case
+ if [ $# -eq 2 ]
+ then
+@@ -100,6 +104,8 @@ then
+ l1_test $test
+ l2_test $test
+ l3_test $test
++ l4_test $test
++ l5_test $test
+
+ print_results $1 $2
+ exit $?
+@@ -113,7 +119,7 @@ fi
+ # Append space at the end of the list to append more tests.
+
+ l1_tests=$(grep -r --include=Makefile "^LDLIBS" | \
+- grep -v "VAR_LDLIBS" | awk -F: '{print $1}')
++ grep -v "$filter" | awk -F: '{print $1}' | uniq)
+
+ # Level 2: LDLIBS set dynamically.
+ #
+@@ -126,7 +132,7 @@ l1_tests=$(grep -r --include=Makefile "^LDLIBS" | \
+ # Append space at the end of the list to append more tests.
+
+ l2_tests=$(grep -r --include=Makefile ": LDLIBS" | \
+- grep -v "VAR_LDLIBS" | awk -F: '{print $1}')
++ grep -v "$filter" | awk -F: '{print $1}' | uniq)
+
+ # Level 3
+ # memfd and others use pkg-config to find mount and fuse libs
+@@ -138,11 +144,32 @@ l2_tests=$(grep -r --include=Makefile ": LDLIBS" | \
+ # VAR_LDLIBS := $(shell pkg-config fuse --libs 2>/dev/null)
+
+ l3_tests=$(grep -r --include=Makefile "^VAR_LDLIBS" | \
+- grep -v "pkg-config" | awk -F: '{print $1}')
++ grep -v "pkg-config\|PKG_CONFIG" | awk -F: '{print $1}' | uniq)
+
+-#echo $l1_tests
+-#echo $l2_1_tests
+-#echo $l3_tests
++# Level 4
++# some tests may fall back to default using `|| echo -l<libname>`
++# if pkg-config doesn't find the libs, instead of using VAR_LDLIBS
++# as per level 3 checks.
++# e.g:
++# netfilter/Makefile
++# LDLIBS += $(shell $(HOSTPKG_CONFIG) --libs libmnl 2>/dev/null || echo -lmnl)
++l4_tests=$(grep -r --include=Makefile "^LDLIBS" | \
++ grep "pkg-config\|PKG_CONFIG" | awk -F: '{print $1}' | uniq)
++
++# Level 5
++# some tests may use IOURING_EXTRA_LIBS to add extra libs to LDLIBS,
++# which in turn may be defined in a sub-Makefile
++# e.g.:
++# mm/Makefile
++# $(OUTPUT)/gup_longterm: LDLIBS += $(IOURING_EXTRA_LIBS)
++l5_tests=$(grep -r --include=Makefile "LDLIBS +=.*\$(IOURING_EXTRA_LIBS)" | \
++ awk -F: '{print $1}' | uniq)
++
++#echo l1_tests $l1_tests
++#echo l2_tests $l2_tests
++#echo l3_tests $l3_tests
++#echo l4_tests $l4_tests
++#echo l5_tests $l5_tests
+
+ all_tests
+ print_results $1 $2
+@@ -164,24 +191,32 @@ all_tests()
+ for test in $l3_tests; do
+ l3_test $test
+ done
++
++ for test in $l4_tests; do
++ l4_test $test
++ done
++
++ for test in $l5_tests; do
++ l5_test $test
++ done
+ }
+
+ # Use same parsing used for l1_tests and pick libraries this time.
+ l1_test()
+ {
+ test_libs=$(grep --include=Makefile "^LDLIBS" $test | \
+- grep -v "VAR_LDLIBS" | \
++ grep -v "$filter" | \
+ sed -e 's/\:/ /' | \
+ sed -e 's/+/ /' | cut -d "=" -f 2)
+
+ check_libs $test $test_libs
+ }
+
+-# Use same parsing used for l2__tests and pick libraries this time.
++# Use same parsing used for l2_tests and pick libraries this time.
+ l2_test()
+ {
+ test_libs=$(grep --include=Makefile ": LDLIBS" $test | \
+- grep -v "VAR_LDLIBS" | \
++ grep -v "$filter" | \
+ sed -e 's/\:/ /' | sed -e 's/+/ /' | \
+ cut -d "=" -f 2)
+
+@@ -197,6 +232,24 @@ l3_test()
+ check_libs $test $test_libs
+ }
+
++l4_test()
++{
++ test_libs=$(grep --include=Makefile "^VAR_LDLIBS\|^LDLIBS" $test | \
++ grep "\(pkg-config\|PKG_CONFIG\).*|| echo " | \
++ sed -e 's/.*|| echo //' | sed -e 's/)$//')
++
++ check_libs $test $test_libs
++}
++
++l5_test()
++{
++ tests=$(find $(dirname "$test") -type f -name "*.mk")
++ test_libs=$(grep "^IOURING_EXTRA_LIBS +\?=" $tests | \
++ cut -d "=" -f 2)
++
++ check_libs $test $test_libs
++}
++
+ check_libs()
+ {
+
+--
+2.40.1
+
--- /dev/null
+From 2ae79241ffd878b149ad6add95c7a9ed895af766 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jun 2023 08:11:44 +0800
+Subject: selftests/ftrace: Correctly enable event in instance-event.tc
+
+From: Zheng Yejian <zhengyejian1@huawei.com>
+
+[ Upstream commit f4e4ada586995b17f828c6d147d1800eb1471450 ]
+
+Function instance_set() expects to enable event 'sched_switch', so we
+should set 1 to its 'enable' file.
+
+Testcase passed after this patch:
+ # ./ftracetest test.d/instances/instance-event.tc
+ === Ftrace unit tests ===
+ [1] Test creation and deletion of trace instances while setting an event
+ [PASS]
+
+ # of passed: 1
+ # of failed: 0
+ # of unresolved: 0
+ # of untested: 0
+ # of unsupported: 0
+ # of xfailed: 0
+ # of undefined(test bug): 0
+
+Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../testing/selftests/ftrace/test.d/instances/instance-event.tc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc b/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc
+index 0eb47fbb3f44d..42422e4251078 100644
+--- a/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc
++++ b/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc
+@@ -39,7 +39,7 @@ instance_read() {
+
+ instance_set() {
+ while :; do
+- echo 1 > foo/events/sched/sched_switch
++ echo 1 > foo/events/sched/sched_switch/enable
+ done 2> /dev/null
+ }
+
+--
+2.40.1
+
gpio-pmic-eic-sprd-add-can_sleep-flag-for-pmic-eic-c.patch
i2c-npcm7xx-fix-callback-completion-ordering.patch
nfsd-fix-zero-nfsv4-read-results-when-rq_splice_ok-i.patch
+x86-reboot-vmclear-active-vmcses-before-emergency-re.patch
+ceph-drop-messages-from-mds-when-unmounting.patch
+dma-debug-don-t-call-__dma_entry_alloc_check_leak-un.patch
+bpf-annotate-bpf_long_memcpy-with-data_race.patch
+asoc-amd-yc-add-dmi-entries-to-support-victus-by-hp-.patch
+spi-sun6i-reduce-dma-rx-transfer-width-to-single-byt.patch
+spi-sun6i-fix-race-between-dma-rx-transfer-completio.patch
+nvme-fc-prevent-null-pointer-dereference-in-nvme_fc_.patch
+parisc-sba-fix-compile-warning-wrt-list-of-sba-devic.patch
+parisc-sba-iommu-fix-sparse-warnigs.patch
+parisc-ccio-dma-fix-sparse-warnings.patch
+parisc-iosapic.c-fix-sparse-warnings.patch
+parisc-drivers-fix-sparse-warning.patch
+parisc-irq-make-irq_stack_union-static-to-avoid-spar.patch
+scsi-qedf-add-synchronization-between-i-o-completion.patch
+scsi-ufs-core-move-__ufshcd_send_uic_cmd-outside-hos.patch
+scsi-ufs-core-poll-hcs.ucrdy-before-issuing-a-uic-co.patch
+selftests-ftrace-correctly-enable-event-in-instance-.patch
+ring-buffer-avoid-softlockup-in-ring_buffer_resize.patch
+btrfs-assert-delayed-node-locked-when-removing-delay.patch
+selftests-fix-dependency-checker-script.patch
+ring-buffer-do-not-attempt-to-read-past-commit.patch
+net-smc-bugfix-for-smcr-v2-server-connect-success-st.patch
+ata-sata_mv-fix-incorrect-string-length-computation-.patch
+efi-x86-ensure-that-efi_runtime_map-is-enabled-for-k.patch
+platform-mellanox-mlxbf-bootctl-add-net-dependency-i.patch
+platform-x86-asus-wmi-support-2023-rog-x16-tablet-mo.patch
+thermal-of-add-missing-of_node_put.patch
+drm-amdgpu-store-cu-info-from-all-xccs-for-gfx-v9.4..patch
+drm-amdkfd-update-cache-info-reporting-for-gfx-v9.4..patch
+drm-amdkfd-update-cu-masking-for-gfx-9.4.3.patch
+drm-amd-display-don-t-check-registers-if-using-aux-b.patch
+drm-amdgpu-soc21-don-t-remap-hdp-registers-for-sr-io.patch
+drm-amdgpu-nbio4.3-set-proper-rmmio_remap.reg_offset.patch
+drm-amdgpu-fallback-to-old-ras-error-message-for-aqu.patch
+drm-amdkfd-checkpoint-and-restore-queues-on-gfx11.patch
+drm-amdgpu-handle-null-atom-context-in-vbios-info-io.patch
+objtool-fix-_this_ip_-detection-for-cold-functions.patch
+nvme-pci-do-not-set-the-numa-node-of-device-if-it-ha.patch
+riscv-errata-fix-t-head-dcache.cva-encoding.patch
+scsi-pm80xx-use-phy-specific-sas-address-when-sendin.patch
+scsi-pm80xx-avoid-leaking-tags-when-processing-opc_i.patch
+smb3-correct-places-where-enotsupp-is-used-instead-o.patch
+ata-libata-eh-do-not-clear-ata_pflag_eh_pending-in-a.patch
+ata-libata-eh-do-not-thaw-the-port-twice-in-ata_eh_r.patch
+add-dmi-id-for-msi-bravo-15-b7ed.patch
+spi-nxp-fspi-reset-the-flshxcr1-registers.patch
+spi-stm32-add-a-delay-before-spi-disable.patch
+asoc-fsl-imx-pcm-rpmsg-add-sndrv_pcm_info_batch-flag.patch
+spi-intel-pci-add-support-for-granite-rapids-spi-ser.patch
+bpf-ensure-unit_size-is-matched-with-slab-cache-obje.patch
+bpf-clarify-error-expectations-from-bpf_clone_redire.patch
+asoc-rt5640-only-cancel-jack-detect-work-on-suspend-.patch
+alsa-hda-intel-sdw-acpi-use-u8-type-for-link-index.patch
+asoc-cs42l42-ensure-a-reset-pulse-meets-minimum-puls.patch
+asoc-cs42l42-don-t-rely-on-gpiod_out_low-to-set-rese.patch
+asoc-cs42l42-avoid-stale-soundwire-attach-after-hard.patch
+firmware-cirrus-cs_dsp-only-log-list-of-algorithms-i.patch
+asoc-wm_adsp-fix-missing-locking-in-wm_adsp_-read-wr.patch
+memblock-tests-fix-warning-__align_kernel-redefined.patch
+memblock-tests-fix-warning-struct-seq_file-declared-.patch
+asoc-imx-rpmsg-set-ignore_pmdown_time-for-dai_link.patch
+asoc-sof-sof-audio-fix-dsp-core-put-imbalance-on-wid.patch
+media-vb2-frame_vector.c-replace-warn_once-with-a-co.patch
+nfsv4.1-fix-zero-value-filehandle-in-post-open-getat.patch
+asoc-sof-intel-mtl-reduce-the-dsp-init-timeout.patch
+powerpc-watchpoints-disable-preemption-in-thread_cha.patch
+powerpc-watchpoint-disable-pagefaults-when-getting-u.patch
+powerpc-watchpoints-annotate-atomic-context-in-more-.patch
+ncsi-propagate-carrier-gain-loss-events-to-the-ncsi-.patch
+net-hsr-add-__packed-to-struct-hsr_sup_tlv.patch
+tsnep-fix-napi-scheduling.patch
+tsnep-fix-ethtool-channels.patch
+tsnep-fix-napi-polling-with-budget-0.patch
+gfs2-fix-glock-shrinker-ref-issues.patch
+i2c-designware-fix-__i2c_dw_disable-in-case-master-i.patch
+loongarch-use-_ul-and-_ull.patch
+loongarch-set-all-reserved-memblocks-on-node-0-at-in.patch
+fbdev-sh7760fb-depend-on-fb-y.patch
--- /dev/null
+From 383aad09f94789a6fe8261c25c4da9277e2eb712 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Sep 2023 01:10:40 -0500
+Subject: smb3: correct places where ENOTSUPP is used instead of preferred
+ EOPNOTSUPP
+
+From: Steve French <stfrench@microsoft.com>
+
+[ Upstream commit ebc3d4e44a7e05457825e03d0560153687265523 ]
+
+checkpatch flagged a few places with:
+ WARNING: ENOTSUPP is not a SUSV4 error code, prefer EOPNOTSUPP
+Also fixed minor typo
+
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/inode.c | 2 +-
+ fs/smb/client/smb2ops.c | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c
+index c3eeae07e1390..cb85d7977b1e3 100644
+--- a/fs/smb/client/inode.c
++++ b/fs/smb/client/inode.c
+@@ -2610,7 +2610,7 @@ int cifs_fiemap(struct inode *inode, struct fiemap_extent_info *fei, u64 start,
+ }
+
+ cifsFileInfo_put(cfile);
+- return -ENOTSUPP;
++ return -EOPNOTSUPP;
+ }
+
+ int cifs_truncate_page(struct address_space *mapping, loff_t from)
+diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
+index dd6a423dc6e11..a5cba71c30aed 100644
+--- a/fs/smb/client/smb2ops.c
++++ b/fs/smb/client/smb2ops.c
+@@ -297,7 +297,7 @@ smb2_adjust_credits(struct TCP_Server_Info *server,
+ cifs_server_dbg(VFS, "request has less credits (%d) than required (%d)",
+ credits->value, new_val);
+
+- return -ENOTSUPP;
++ return -EOPNOTSUPP;
+ }
+
+ spin_lock(&server->req_lock);
+@@ -1159,7 +1159,7 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon,
+ /* Use a fudge factor of 256 bytes in case we collide
+ * with a different set_EAs command.
+ */
+- if(CIFSMaxBufSize - MAX_SMB2_CREATE_RESPONSE_SIZE -
++ if (CIFSMaxBufSize - MAX_SMB2_CREATE_RESPONSE_SIZE -
+ MAX_SMB2_CLOSE_RESPONSE_SIZE - 256 <
+ used_len + ea_name_len + ea_value_len + 1) {
+ rc = -ENOSPC;
+@@ -4716,7 +4716,7 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,
+
+ if (shdr->Command != SMB2_READ) {
+ cifs_server_dbg(VFS, "only big read responses are supported\n");
+- return -ENOTSUPP;
++ return -EOPNOTSUPP;
+ }
+
+ if (server->ops->is_session_expired &&
+--
+2.40.1
+
--- /dev/null
+From fd06263c0fd76438811bcdc0bb564d2eb57fb58e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Sep 2023 10:46:16 +0300
+Subject: spi: intel-pci: Add support for Granite Rapids SPI serial flash
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+[ Upstream commit 9855d60cfc720ff32355484c119acafd3c4dc806 ]
+
+Intel Granite Rapids has a flash controller that is compatible with the
+other Cannon Lake derivatives. Add Granite Rapids PCI ID to the driver
+list of supported devices.
+
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Link: https://lore.kernel.org/r/20230911074616.3473347-1-mika.westerberg@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-intel-pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/spi/spi-intel-pci.c b/drivers/spi/spi-intel-pci.c
+index a7381e774b953..57d767a68e7b2 100644
+--- a/drivers/spi/spi-intel-pci.c
++++ b/drivers/spi/spi-intel-pci.c
+@@ -72,6 +72,7 @@ static const struct pci_device_id intel_spi_pci_ids[] = {
+ { PCI_VDEVICE(INTEL, 0x4da4), (unsigned long)&bxt_info },
+ { PCI_VDEVICE(INTEL, 0x51a4), (unsigned long)&cnl_info },
+ { PCI_VDEVICE(INTEL, 0x54a4), (unsigned long)&cnl_info },
++ { PCI_VDEVICE(INTEL, 0x5794), (unsigned long)&cnl_info },
+ { PCI_VDEVICE(INTEL, 0x7a24), (unsigned long)&cnl_info },
+ { PCI_VDEVICE(INTEL, 0x7aa4), (unsigned long)&cnl_info },
+ { PCI_VDEVICE(INTEL, 0x7e23), (unsigned long)&cnl_info },
+--
+2.40.1
+
--- /dev/null
+From b566bec8a7ebf89a6807946e5801976dd5708062 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Sep 2023 13:32:54 -0500
+Subject: spi: nxp-fspi: reset the FLSHxCR1 registers
+
+From: Han Xu <han.xu@nxp.com>
+
+[ Upstream commit 18495676f7886e105133f1dc06c1d5e8d5436f32 ]
+
+Reset the FLSHxCR1 registers to default value. ROM may set the register
+value and it affects the SPI NAND normal functions.
+
+Signed-off-by: Han Xu <han.xu@nxp.com>
+Link: https://lore.kernel.org/r/20230906183254.235847-1-han.xu@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-nxp-fspi.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/spi/spi-nxp-fspi.c b/drivers/spi/spi-nxp-fspi.c
+index 5440176557875..8e44de084bbe3 100644
+--- a/drivers/spi/spi-nxp-fspi.c
++++ b/drivers/spi/spi-nxp-fspi.c
+@@ -1085,6 +1085,13 @@ static int nxp_fspi_default_setup(struct nxp_fspi *f)
+ fspi_writel(f, FSPI_AHBCR_PREF_EN | FSPI_AHBCR_RDADDROPT,
+ base + FSPI_AHBCR);
+
++ /* Reset the FLSHxCR1 registers. */
++ reg = FSPI_FLSHXCR1_TCSH(0x3) | FSPI_FLSHXCR1_TCSS(0x3);
++ fspi_writel(f, reg, base + FSPI_FLSHA1CR1);
++ fspi_writel(f, reg, base + FSPI_FLSHA2CR1);
++ fspi_writel(f, reg, base + FSPI_FLSHB1CR1);
++ fspi_writel(f, reg, base + FSPI_FLSHB2CR1);
++
+ /* AHB Read - Set lut sequence ID for all CS. */
+ fspi_writel(f, SEQID_LUT, base + FSPI_FLSHA1CR2);
+ fspi_writel(f, SEQID_LUT, base + FSPI_FLSHA2CR2);
+--
+2.40.1
+
--- /dev/null
+From 1376fd36d5c00ea9db90b275f3f8ac38274f4079 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Sep 2023 15:27:35 +0200
+Subject: spi: stm32: add a delay before SPI disable
+
+From: Valentin Caron <valentin.caron@foss.st.com>
+
+[ Upstream commit 6de8a70c84ee0586fdde4e671626b9caca6aed74 ]
+
+As explained in errata sheet, in section "2.14.5 Truncation of SPI output
+signals after EOT event":
+On STM32MP1x, EOT interrupt can be thrown before the true end of
+communication.
+
+So we add a delay of a half period to wait the real end of the
+transmission.
+
+Link: https://www.st.com/resource/en/errata_sheet/es0539-stm32mp131x3x5x-device-errata-stmicroelectronics.pdf
+Signed-off-by: Valentin Caron <valentin.caron@foss.st.com>
+Link: https://lore.kernel.org/r/20230906132735.748174-1-valentin.caron@foss.st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index 7ddf9db776b06..4737a36e5d4e9 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -275,6 +275,7 @@ struct stm32_spi_cfg {
+ * @fifo_size: size of the embedded fifo in bytes
+ * @cur_midi: master inter-data idleness in ns
+ * @cur_speed: speed configured in Hz
++ * @cur_half_period: time of a half bit in us
+ * @cur_bpw: number of bits in a single SPI data frame
+ * @cur_fthlv: fifo threshold level (data frames in a single data packet)
+ * @cur_comm: SPI communication mode
+@@ -302,6 +303,7 @@ struct stm32_spi {
+
+ unsigned int cur_midi;
+ unsigned int cur_speed;
++ unsigned int cur_half_period;
+ unsigned int cur_bpw;
+ unsigned int cur_fthlv;
+ unsigned int cur_comm;
+@@ -466,6 +468,8 @@ static int stm32_spi_prepare_mbr(struct stm32_spi *spi, u32 speed_hz,
+
+ spi->cur_speed = spi->clk_rate / (1 << mbrdiv);
+
++ spi->cur_half_period = DIV_ROUND_CLOSEST(USEC_PER_SEC, 2 * spi->cur_speed);
++
+ return mbrdiv - 1;
+ }
+
+@@ -707,6 +711,10 @@ static void stm32h7_spi_disable(struct stm32_spi *spi)
+ return;
+ }
+
++ /* Add a delay to make sure that transmission is ended. */
++ if (spi->cur_half_period)
++ udelay(spi->cur_half_period);
++
+ if (spi->cur_usedma && spi->dma_tx)
+ dmaengine_terminate_async(spi->dma_tx);
+ if (spi->cur_usedma && spi->dma_rx)
+--
+2.40.1
+
--- /dev/null
+From de7fa86e5980c9378b615e2b74ed75803b83022a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Aug 2023 17:25:58 +0200
+Subject: spi: sun6i: fix race between DMA RX transfer completion and RX FIFO
+ drain
+
+From: Tobias Schramm <t.schramm@manjaro.org>
+
+[ Upstream commit 1f11f4202caf5710204d334fe63392052783876d ]
+
+Previously the transfer complete IRQ immediately drained to RX FIFO to
+read any data remaining in FIFO to the RX buffer. This behaviour is
+correct when dealing with SPI in interrupt mode. However in DMA mode the
+transfer complete interrupt still fires as soon as all bytes to be
+transferred have been stored in the FIFO. At that point data in the FIFO
+still needs to be picked up by the DMA engine. Thus the drain procedure
+and DMA engine end up racing to read from RX FIFO, corrupting any data
+read. Additionally the RX buffer pointer is never adjusted according to
+DMA progress in DMA mode, thus calling the RX FIFO drain procedure in DMA
+mode is a bug.
+Fix corruptions in DMA RX mode by draining RX FIFO only in interrupt mode.
+Also wait for completion of RX DMA when in DMA mode before returning to
+ensure all data has been copied to the supplied memory buffer.
+
+Signed-off-by: Tobias Schramm <t.schramm@manjaro.org>
+Link: https://lore.kernel.org/r/20230827152558.5368-3-t.schramm@manjaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-sun6i.c | 29 ++++++++++++++++++++++++++++-
+ 1 file changed, 28 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-sun6i.c b/drivers/spi/spi-sun6i.c
+index bc9c88dce067a..26abd26dc3652 100644
+--- a/drivers/spi/spi-sun6i.c
++++ b/drivers/spi/spi-sun6i.c
+@@ -106,6 +106,7 @@ struct sun6i_spi {
+ struct reset_control *rstc;
+
+ struct completion done;
++ struct completion dma_rx_done;
+
+ const u8 *tx_buf;
+ u8 *rx_buf;
+@@ -200,6 +201,13 @@ static size_t sun6i_spi_max_transfer_size(struct spi_device *spi)
+ return SUN6I_MAX_XFER_SIZE - 1;
+ }
+
++static void sun6i_spi_dma_rx_cb(void *param)
++{
++ struct sun6i_spi *sspi = param;
++
++ complete(&sspi->dma_rx_done);
++}
++
+ static int sun6i_spi_prepare_dma(struct sun6i_spi *sspi,
+ struct spi_transfer *tfr)
+ {
+@@ -224,6 +232,8 @@ static int sun6i_spi_prepare_dma(struct sun6i_spi *sspi,
+ DMA_PREP_INTERRUPT);
+ if (!rxdesc)
+ return -EINVAL;
++ rxdesc->callback_param = sspi;
++ rxdesc->callback = sun6i_spi_dma_rx_cb;
+ }
+
+ txdesc = NULL;
+@@ -279,6 +289,7 @@ static int sun6i_spi_transfer_one(struct spi_master *master,
+ return -EINVAL;
+
+ reinit_completion(&sspi->done);
++ reinit_completion(&sspi->dma_rx_done);
+ sspi->tx_buf = tfr->tx_buf;
+ sspi->rx_buf = tfr->rx_buf;
+ sspi->len = tfr->len;
+@@ -479,6 +490,22 @@ static int sun6i_spi_transfer_one(struct spi_master *master,
+ start = jiffies;
+ timeout = wait_for_completion_timeout(&sspi->done,
+ msecs_to_jiffies(tx_time));
++
++ if (!use_dma) {
++ sun6i_spi_drain_fifo(sspi);
++ } else {
++ if (timeout && rx_len) {
++ /*
++ * Even though RX on the peripheral side has finished
++ * RX DMA might still be in flight
++ */
++ timeout = wait_for_completion_timeout(&sspi->dma_rx_done,
++ timeout);
++ if (!timeout)
++ dev_warn(&master->dev, "RX DMA timeout\n");
++ }
++ }
++
+ end = jiffies;
+ if (!timeout) {
+ dev_warn(&master->dev,
+@@ -506,7 +533,6 @@ static irqreturn_t sun6i_spi_handler(int irq, void *dev_id)
+ /* Transfer complete */
+ if (status & SUN6I_INT_CTL_TC) {
+ sun6i_spi_write(sspi, SUN6I_INT_STA_REG, SUN6I_INT_CTL_TC);
+- sun6i_spi_drain_fifo(sspi);
+ complete(&sspi->done);
+ return IRQ_HANDLED;
+ }
+@@ -665,6 +691,7 @@ static int sun6i_spi_probe(struct platform_device *pdev)
+ }
+
+ init_completion(&sspi->done);
++ init_completion(&sspi->dma_rx_done);
+
+ sspi->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL);
+ if (IS_ERR(sspi->rstc)) {
+--
+2.40.1
+
--- /dev/null
+From b96ea665f79f86f03c849471bb8447dc5886d58a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Aug 2023 17:25:57 +0200
+Subject: spi: sun6i: reduce DMA RX transfer width to single byte
+
+From: Tobias Schramm <t.schramm@manjaro.org>
+
+[ Upstream commit 171f8a49f212e87a8b04087568e1b3d132e36a18 ]
+
+Through empirical testing it has been determined that sometimes RX SPI
+transfers with DMA enabled return corrupted data. This is down to single
+or even multiple bytes lost during DMA transfer from SPI peripheral to
+memory. It seems the RX FIFO within the SPI peripheral can become
+confused when performing bus read accesses wider than a single byte to it
+during an active SPI transfer.
+
+This patch reduces the width of individual DMA read accesses to the
+RX FIFO to a single byte to mitigate that issue.
+
+Signed-off-by: Tobias Schramm <t.schramm@manjaro.org>
+Link: https://lore.kernel.org/r/20230827152558.5368-2-t.schramm@manjaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-sun6i.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-sun6i.c b/drivers/spi/spi-sun6i.c
+index cec2747235abf..bc9c88dce067a 100644
+--- a/drivers/spi/spi-sun6i.c
++++ b/drivers/spi/spi-sun6i.c
+@@ -211,7 +211,7 @@ static int sun6i_spi_prepare_dma(struct sun6i_spi *sspi,
+ struct dma_slave_config rxconf = {
+ .direction = DMA_DEV_TO_MEM,
+ .src_addr = sspi->dma_addr_rx,
+- .src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES,
++ .src_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE,
+ .src_maxburst = 8,
+ };
+
+--
+2.40.1
+
--- /dev/null
+From 7c6e9604bfc6588ae908995f192f316349daa901 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Sep 2023 11:55:18 +0200
+Subject: thermal/of: add missing of_node_put()
+
+From: Julia Lawall <Julia.Lawall@inria.fr>
+
+[ Upstream commit 8a81cf96f5510aaf9a65d103f7405079a7b0fcc5 ]
+
+for_each_child_of_node performs an of_node_get on each
+iteration, so a break out of the loop requires an
+of_node_put.
+
+This was done using the Coccinelle semantic patch
+iterators/for_each_child.cocci
+
+Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/thermal_of.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/thermal/thermal_of.c b/drivers/thermal/thermal_of.c
+index 22272f9c5934a..e615f735f4c03 100644
+--- a/drivers/thermal/thermal_of.c
++++ b/drivers/thermal/thermal_of.c
+@@ -38,8 +38,10 @@ static int of_find_trip_id(struct device_node *np, struct device_node *trip)
+ */
+ for_each_child_of_node(trips, t) {
+
+- if (t == trip)
++ if (t == trip) {
++ of_node_put(t);
+ goto out;
++ }
+ i++;
+ }
+
+@@ -402,8 +404,10 @@ static int thermal_of_for_each_cooling_maps(struct thermal_zone_device *tz,
+
+ for_each_child_of_node(cm_np, child) {
+ ret = thermal_of_for_each_cooling_device(tz_np, child, tz, cdev, action);
+- if (ret)
++ if (ret) {
++ of_node_put(child);
+ break;
++ }
+ }
+
+ of_node_put(cm_np);
+--
+2.40.1
+
--- /dev/null
+From a9ea9f04459906169ed355f5d9e381d4144dfdad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Sep 2023 23:01:25 +0200
+Subject: tsnep: Fix ethtool channels
+
+From: Gerhard Engleder <gerhard@engleder-embedded.com>
+
+[ Upstream commit a7f991953d73dd50c4c23b5437c0139960e1fad4 ]
+
+According to the NAPI documentation networking/napi.rst, for the ethtool
+API a channel is a IRQ/NAPI which services queues of a given type.
+
+tsnep uses a single IRQ/NAPI instance for every TX/RX queue pair.
+Therefore, combined channels shall be returned instead of separate tx/rx
+channels.
+
+Signed-off-by: Gerhard Engleder <gerhard@engleder-embedded.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/engleder/tsnep_ethtool.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/engleder/tsnep_ethtool.c b/drivers/net/ethernet/engleder/tsnep_ethtool.c
+index 716815dad7d21..65ec1abc94421 100644
+--- a/drivers/net/ethernet/engleder/tsnep_ethtool.c
++++ b/drivers/net/ethernet/engleder/tsnep_ethtool.c
+@@ -300,10 +300,8 @@ static void tsnep_ethtool_get_channels(struct net_device *netdev,
+ {
+ struct tsnep_adapter *adapter = netdev_priv(netdev);
+
+- ch->max_rx = adapter->num_rx_queues;
+- ch->max_tx = adapter->num_tx_queues;
+- ch->rx_count = adapter->num_rx_queues;
+- ch->tx_count = adapter->num_tx_queues;
++ ch->max_combined = adapter->num_queues;
++ ch->combined_count = adapter->num_queues;
+ }
+
+ static int tsnep_ethtool_get_ts_info(struct net_device *netdev,
+--
+2.40.1
+
--- /dev/null
+From 1d0ed83633b44224dd8f4e4a56676e079de92d79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Sep 2023 23:01:26 +0200
+Subject: tsnep: Fix NAPI polling with budget 0
+
+From: Gerhard Engleder <gerhard@engleder-embedded.com>
+
+[ Upstream commit 46589db3817bd8b523701274885984b5a5dda7d1 ]
+
+According to the NAPI documentation networking/napi.rst, Rx specific
+APIs like page pool and XDP cannot be used at all when budget is 0.
+skb Tx processing should happen regardless of the budget.
+
+Stop NAPI polling after Tx processing and skip Rx processing if budget
+is 0.
+
+Signed-off-by: Gerhard Engleder <gerhard@engleder-embedded.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/engleder/tsnep_main.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/engleder/tsnep_main.c b/drivers/net/ethernet/engleder/tsnep_main.c
+index a83f8bceadd16..479156576bc8a 100644
+--- a/drivers/net/ethernet/engleder/tsnep_main.c
++++ b/drivers/net/ethernet/engleder/tsnep_main.c
+@@ -1733,6 +1733,10 @@ static int tsnep_poll(struct napi_struct *napi, int budget)
+ if (queue->tx)
+ complete = tsnep_tx_poll(queue->tx, budget);
+
++ /* handle case where we are called by netpoll with a budget of 0 */
++ if (unlikely(budget <= 0))
++ return budget;
++
+ if (queue->rx) {
+ done = queue->rx->xsk_pool ?
+ tsnep_rx_poll_zc(queue->rx, napi, budget) :
+--
+2.40.1
+
--- /dev/null
+From b6317167aee29122d2c8972cb8479019e6e16e73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Sep 2023 23:01:24 +0200
+Subject: tsnep: Fix NAPI scheduling
+
+From: Gerhard Engleder <gerhard@engleder-embedded.com>
+
+[ Upstream commit ea852c17f5382a0a52041cfbd9a4451ae0fa1a38 ]
+
+According to the NAPI documentation networking/napi.rst, drivers which
+have to mask interrupts explicitly should use the napi_schedule_prep()
+and __napi_schedule() calls.
+
+No problem seen so far with current implementation. Nevertheless, let's
+align the implementation with documentation.
+
+Signed-off-by: Gerhard Engleder <gerhard@engleder-embedded.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/engleder/tsnep_main.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/engleder/tsnep_main.c b/drivers/net/ethernet/engleder/tsnep_main.c
+index 84751bb303a68..a83f8bceadd16 100644
+--- a/drivers/net/ethernet/engleder/tsnep_main.c
++++ b/drivers/net/ethernet/engleder/tsnep_main.c
+@@ -86,8 +86,11 @@ static irqreturn_t tsnep_irq(int irq, void *arg)
+
+ /* handle TX/RX queue 0 interrupt */
+ if ((active & adapter->queue[0].irq_mask) != 0) {
+- tsnep_disable_irq(adapter, adapter->queue[0].irq_mask);
+- napi_schedule(&adapter->queue[0].napi);
++ if (napi_schedule_prep(&adapter->queue[0].napi)) {
++ tsnep_disable_irq(adapter, adapter->queue[0].irq_mask);
++ /* schedule after masking to avoid races */
++ __napi_schedule(&adapter->queue[0].napi);
++ }
+ }
+
+ return IRQ_HANDLED;
+@@ -98,8 +101,11 @@ static irqreturn_t tsnep_irq_txrx(int irq, void *arg)
+ struct tsnep_queue *queue = arg;
+
+ /* handle TX/RX queue interrupt */
+- tsnep_disable_irq(queue->adapter, queue->irq_mask);
+- napi_schedule(&queue->napi);
++ if (napi_schedule_prep(&queue->napi)) {
++ tsnep_disable_irq(queue->adapter, queue->irq_mask);
++ /* schedule after masking to avoid races */
++ __napi_schedule(&queue->napi);
++ }
+
+ return IRQ_HANDLED;
+ }
+--
+2.40.1
+
--- /dev/null
+From f9ef6abd8512337684d28feb4ee41cc1cd5e6b1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jul 2023 13:18:41 -0700
+Subject: x86/reboot: VMCLEAR active VMCSes before emergency reboot
+
+From: Sean Christopherson <seanjc@google.com>
+
+[ Upstream commit b23c83ad2c638420ec0608a9de354507c41bec29 ]
+
+VMCLEAR active VMCSes before any emergency reboot, not just if the kernel
+may kexec into a new kernel after a crash. Per Intel's SDM, the VMX
+architecture doesn't require the CPU to flush the VMCS cache on INIT. If
+an emergency reboot doesn't RESET CPUs, cached VMCSes could theoretically
+be kept and only be written back to memory after the new kernel is booted,
+i.e. could effectively corrupt memory after reboot.
+
+Opportunistically remove the setting of the global pointer to NULL to make
+checkpatch happy.
+
+Cc: Andrew Cooper <Andrew.Cooper3@citrix.com>
+Link: https://lore.kernel.org/r/20230721201859.2307736-2-seanjc@google.com
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/kexec.h | 2 --
+ arch/x86/include/asm/reboot.h | 2 ++
+ arch/x86/kernel/crash.c | 31 -------------------------------
+ arch/x86/kernel/reboot.c | 22 ++++++++++++++++++++++
+ arch/x86/kvm/vmx/vmx.c | 10 +++-------
+ 5 files changed, 27 insertions(+), 40 deletions(-)
+
+diff --git a/arch/x86/include/asm/kexec.h b/arch/x86/include/asm/kexec.h
+index 5b77bbc28f969..819046974b997 100644
+--- a/arch/x86/include/asm/kexec.h
++++ b/arch/x86/include/asm/kexec.h
+@@ -205,8 +205,6 @@ int arch_kimage_file_post_load_cleanup(struct kimage *image);
+ #endif
+ #endif
+
+-typedef void crash_vmclear_fn(void);
+-extern crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss;
+ extern void kdump_nmi_shootdown_cpus(void);
+
+ #endif /* __ASSEMBLY__ */
+diff --git a/arch/x86/include/asm/reboot.h b/arch/x86/include/asm/reboot.h
+index 9177b4354c3f5..dc201724a6433 100644
+--- a/arch/x86/include/asm/reboot.h
++++ b/arch/x86/include/asm/reboot.h
+@@ -25,6 +25,8 @@ void __noreturn machine_real_restart(unsigned int type);
+ #define MRR_BIOS 0
+ #define MRR_APM 1
+
++typedef void crash_vmclear_fn(void);
++extern crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss;
+ void cpu_emergency_disable_virtualization(void);
+
+ typedef void (*nmi_shootdown_cb)(int, struct pt_regs*);
+diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
+index cdd92ab43cda4..54cd959cb3160 100644
+--- a/arch/x86/kernel/crash.c
++++ b/arch/x86/kernel/crash.c
+@@ -48,38 +48,12 @@ struct crash_memmap_data {
+ unsigned int type;
+ };
+
+-/*
+- * This is used to VMCLEAR all VMCSs loaded on the
+- * processor. And when loading kvm_intel module, the
+- * callback function pointer will be assigned.
+- *
+- * protected by rcu.
+- */
+-crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss = NULL;
+-EXPORT_SYMBOL_GPL(crash_vmclear_loaded_vmcss);
+-
+-static inline void cpu_crash_vmclear_loaded_vmcss(void)
+-{
+- crash_vmclear_fn *do_vmclear_operation = NULL;
+-
+- rcu_read_lock();
+- do_vmclear_operation = rcu_dereference(crash_vmclear_loaded_vmcss);
+- if (do_vmclear_operation)
+- do_vmclear_operation();
+- rcu_read_unlock();
+-}
+-
+ #if defined(CONFIG_SMP) && defined(CONFIG_X86_LOCAL_APIC)
+
+ static void kdump_nmi_callback(int cpu, struct pt_regs *regs)
+ {
+ crash_save_cpu(regs, cpu);
+
+- /*
+- * VMCLEAR VMCSs loaded on all cpus if needed.
+- */
+- cpu_crash_vmclear_loaded_vmcss();
+-
+ /*
+ * Disable Intel PT to stop its logging
+ */
+@@ -133,11 +107,6 @@ void native_machine_crash_shutdown(struct pt_regs *regs)
+
+ crash_smp_send_stop();
+
+- /*
+- * VMCLEAR VMCSs loaded on this cpu if needed.
+- */
+- cpu_crash_vmclear_loaded_vmcss();
+-
+ cpu_emergency_disable_virtualization();
+
+ /*
+diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
+index 3adbe97015c13..3fa4c6717a1db 100644
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -787,6 +787,26 @@ void machine_crash_shutdown(struct pt_regs *regs)
+ }
+ #endif
+
++/*
++ * This is used to VMCLEAR all VMCSs loaded on the
++ * processor. And when loading kvm_intel module, the
++ * callback function pointer will be assigned.
++ *
++ * protected by rcu.
++ */
++crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss;
++EXPORT_SYMBOL_GPL(crash_vmclear_loaded_vmcss);
++
++static inline void cpu_crash_vmclear_loaded_vmcss(void)
++{
++ crash_vmclear_fn *do_vmclear_operation = NULL;
++
++ rcu_read_lock();
++ do_vmclear_operation = rcu_dereference(crash_vmclear_loaded_vmcss);
++ if (do_vmclear_operation)
++ do_vmclear_operation();
++ rcu_read_unlock();
++}
+
+ /* This is the CPU performing the emergency shutdown work. */
+ int crashing_cpu = -1;
+@@ -798,6 +818,8 @@ int crashing_cpu = -1;
+ */
+ void cpu_emergency_disable_virtualization(void)
+ {
++ cpu_crash_vmclear_loaded_vmcss();
++
+ cpu_emergency_vmxoff();
+ cpu_emergency_svm_disable();
+ }
+diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
+index f2fb67a9dc050..bc6f0fea48b43 100644
+--- a/arch/x86/kvm/vmx/vmx.c
++++ b/arch/x86/kvm/vmx/vmx.c
+@@ -41,7 +41,7 @@
+ #include <asm/idtentry.h>
+ #include <asm/io.h>
+ #include <asm/irq_remapping.h>
+-#include <asm/kexec.h>
++#include <asm/reboot.h>
+ #include <asm/perf_event.h>
+ #include <asm/mmu_context.h>
+ #include <asm/mshyperv.h>
+@@ -754,7 +754,6 @@ static int vmx_set_guest_uret_msr(struct vcpu_vmx *vmx,
+ return ret;
+ }
+
+-#ifdef CONFIG_KEXEC_CORE
+ static void crash_vmclear_local_loaded_vmcss(void)
+ {
+ int cpu = raw_smp_processor_id();
+@@ -764,7 +763,6 @@ static void crash_vmclear_local_loaded_vmcss(void)
+ loaded_vmcss_on_cpu_link)
+ vmcs_clear(v->vmcs);
+ }
+-#endif /* CONFIG_KEXEC_CORE */
+
+ static void __loaded_vmcs_clear(void *arg)
+ {
+@@ -8623,10 +8621,9 @@ static void __vmx_exit(void)
+ {
+ allow_smaller_maxphyaddr = false;
+
+-#ifdef CONFIG_KEXEC_CORE
+ RCU_INIT_POINTER(crash_vmclear_loaded_vmcss, NULL);
+ synchronize_rcu();
+-#endif
++
+ vmx_cleanup_l1d_flush();
+ }
+
+@@ -8675,10 +8672,9 @@ static int __init vmx_init(void)
+ pi_init_cpu(cpu);
+ }
+
+-#ifdef CONFIG_KEXEC_CORE
+ rcu_assign_pointer(crash_vmclear_loaded_vmcss,
+ crash_vmclear_local_loaded_vmcss);
+-#endif
++
+ vmx_check_vmcs12_offsets();
+
+ /*
+--
+2.40.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
