--- /dev/null
+From 0407ca811f88ff128ee5d3c2c33a16671252abc8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Sep 2023 19:26:17 +0300
+Subject: ALSA: hda: intel-sdw-acpi: Use u8 type for link index
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit 485ddd519fbd89a9d9ac4b02be489e03cbbeebba ]
+
+Use consistently u8 for sdw link index. The id is limited to 4, u8 is
+adequate in size to store it.
+
+This change will also fixes the following compiler warning/error (W=1):
+
+sound/hda/intel-sdw-acpi.c: In function ‘sdw_intel_acpi_scan’:
+sound/hda/intel-sdw-acpi.c:34:35: error: ‘-subproperties’ directive output may be truncated writing 14 bytes into a region of size between 7 and 17 [-Werror=format-truncation=]
+ 34 | "mipi-sdw-link-%d-subproperties", i);
+ | ^~~~~~~~~~~~~~
+In function ‘is_link_enabled’,
+ inlined from ‘sdw_intel_scan_controller’ at sound/hda/intel-sdw-acpi.c:106:8,
+ inlined from ‘sdw_intel_acpi_scan’ at sound/hda/intel-sdw-acpi.c:180:9:
+sound/hda/intel-sdw-acpi.c:33:9: note: ‘snprintf’ output between 30 and 40 bytes into a destination of size 32
+ 33 | snprintf(name, sizeof(name),
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ 34 | "mipi-sdw-link-%d-subproperties", i);
+ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+cc1: all warnings being treated as errors
+
+The warnings got brought to light by a recent patch upstream:
+commit 6d4ab2e97dcf ("extrawarn: enable format and stringop overflow warnings in W=1")
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20230912162617.29178-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/intel-sdw-acpi.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/sound/hda/intel-sdw-acpi.c b/sound/hda/intel-sdw-acpi.c
+index 5cb92f7ccbcac..b57d72ea4503f 100644
+--- a/sound/hda/intel-sdw-acpi.c
++++ b/sound/hda/intel-sdw-acpi.c
+@@ -23,7 +23,7 @@ static int ctrl_link_mask;
+ module_param_named(sdw_link_mask, ctrl_link_mask, int, 0444);
+ MODULE_PARM_DESC(sdw_link_mask, "Intel link mask (one bit per link)");
+
+-static bool is_link_enabled(struct fwnode_handle *fw_node, int i)
++static bool is_link_enabled(struct fwnode_handle *fw_node, u8 idx)
+ {
+ struct fwnode_handle *link;
+ char name[32];
+@@ -31,7 +31,7 @@ static bool is_link_enabled(struct fwnode_handle *fw_node, int i)
+
+ /* Find master handle */
+ snprintf(name, sizeof(name),
+- "mipi-sdw-link-%d-subproperties", i);
++ "mipi-sdw-link-%hhu-subproperties", idx);
+
+ link = fwnode_get_named_child_node(fw_node, name);
+ if (!link)
+@@ -51,8 +51,8 @@ static int
+ sdw_intel_scan_controller(struct sdw_intel_acpi_info *info)
+ {
+ struct acpi_device *adev = acpi_fetch_acpi_dev(info->handle);
+- int ret, i;
+- u8 count;
++ u8 count, i;
++ int ret;
+
+ if (!adev)
+ return -EINVAL;
+--
+2.40.1
+
--- /dev/null
+From a5693a55acc4c6ab214b14f29109c2d829edafc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Sep 2023 16:00:11 +0100
+Subject: ASoC: cs42l42: Don't rely on GPIOD_OUT_LOW to set RESET initially low
+
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+
+[ Upstream commit a479b44ac0a0ac25cd48e5356200078924d78022 ]
+
+The ACPI setting for a GPIO default state has higher priority than the
+flag passed to devm_gpiod_get_optional() so ACPI can override the
+GPIOD_OUT_LOW. Explicitly set the GPIO low when hard resetting.
+
+Although GPIOD_OUT_LOW can't be relied on this doesn't seem like a
+reason to stop passing it to devm_gpiod_get_optional(). So we still pass
+it to state our intent, but can deal with it having no effect.
+
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20230913150012.604775-3-sbinding@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs42l42.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c
+index 914cdd737fa3b..735061690ded0 100644
+--- a/sound/soc/codecs/cs42l42.c
++++ b/sound/soc/codecs/cs42l42.c
+@@ -2281,6 +2281,12 @@ int cs42l42_common_probe(struct cs42l42_private *cs42l42,
+ if (cs42l42->reset_gpio) {
+ dev_dbg(cs42l42->dev, "Found reset GPIO\n");
+
++ /*
++ * ACPI can override the default GPIO state we requested
++ * so ensure that we start with RESET low.
++ */
++ gpiod_set_value_cansleep(cs42l42->reset_gpio, 0);
++
+ /* Ensure minimum reset pulse width */
+ usleep_range(10, 500);
+
+--
+2.40.1
+
--- /dev/null
+From 8dd3f6483bd7ea99101fd634e3ca7e0b192d5b75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Sep 2023 16:00:10 +0100
+Subject: ASoC: cs42l42: Ensure a reset pulse meets minimum pulse width.
+
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+
+[ Upstream commit 41dac81b56c82c51a6d00fda5f3af7691ffee2d7 ]
+
+The CS42L42 can accept very short reset pulses of a few microseconds
+but there's no reason to force a very short pulse.
+Allow a wide range for the usleep_range() so it can be relaxed about
+the choice of timing source.
+
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20230913150012.604775-2-sbinding@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs42l42.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c
+index 2fefbcf7bd130..914cdd737fa3b 100644
+--- a/sound/soc/codecs/cs42l42.c
++++ b/sound/soc/codecs/cs42l42.c
+@@ -2280,6 +2280,10 @@ int cs42l42_common_probe(struct cs42l42_private *cs42l42,
+
+ if (cs42l42->reset_gpio) {
+ dev_dbg(cs42l42->dev, "Found reset GPIO\n");
++
++ /* Ensure minimum reset pulse width */
++ usleep_range(10, 500);
++
+ gpiod_set_value_cansleep(cs42l42->reset_gpio, 1);
+ }
+ usleep_range(CS42L42_BOOT_TIME_US, CS42L42_BOOT_TIME_US * 2);
+--
+2.40.1
+
--- /dev/null
+From ae40ff6290e66649726b5b30828b98f3ba0cf03e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Sep 2023 14:38:07 +0800
+Subject: ASoC: fsl: imx-pcm-rpmsg: Add SNDRV_PCM_INFO_BATCH flag
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 2f9426905a63be7ccf8cd10109caf1848aa0993a ]
+
+The rpmsg pcm device is a device which should support
+double buffering.
+
+Found this issue with pipewire. When there is no
+SNDRV_PCM_INFO_BATCH flag in driver, the pipewire will
+set headroom to be zero, and because rpmsg pcm device
+don't support residue report, when the latency setting
+is small, the "delay" always larger than "target" in
+alsa-pcm.c, that reading next period data is not
+scheduled on time.
+
+With SNDRV_PCM_INFO_BATCH flag in driver, the pipewire
+will select a smaller period size for device, then
+the task of reading next period data will be scheduled
+on time.
+
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://lore.kernel.org/r/1694414287-13291-1-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/imx-pcm-rpmsg.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/fsl/imx-pcm-rpmsg.c b/sound/soc/fsl/imx-pcm-rpmsg.c
+index 35049043e5322..933bac7ea1864 100644
+--- a/sound/soc/fsl/imx-pcm-rpmsg.c
++++ b/sound/soc/fsl/imx-pcm-rpmsg.c
+@@ -19,6 +19,7 @@
+ static struct snd_pcm_hardware imx_rpmsg_pcm_hardware = {
+ .info = SNDRV_PCM_INFO_INTERLEAVED |
+ SNDRV_PCM_INFO_BLOCK_TRANSFER |
++ SNDRV_PCM_INFO_BATCH |
+ SNDRV_PCM_INFO_MMAP |
+ SNDRV_PCM_INFO_MMAP_VALID |
+ SNDRV_PCM_INFO_NO_PERIOD_WAKEUP |
+--
+2.40.1
+
--- /dev/null
+From 685eaec927cc919cbedd0cfaf1c8b3c0b79fa553 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Sep 2023 18:26:56 +0800
+Subject: ASoC: imx-rpmsg: Set ignore_pmdown_time for dai_link
+
+From: Chancel Liu <chancel.liu@nxp.com>
+
+[ Upstream commit fac58baf8fcfcd7481e8f6d60206ce2a47c1476c ]
+
+i.MX rpmsg sound cards work on codec slave mode. MCLK will be disabled
+by CPU DAI driver in hw_free(). Some codec requires MCLK present at
+power up/down sequence. So need to set ignore_pmdown_time to power down
+codec immediately before MCLK is turned off.
+
+Take WM8962 as an example, if MCLK is disabled before DAPM power down
+playback stream, FIFO error will arise in WM8962 which will have bad
+impact on playback next.
+
+Signed-off-by: Chancel Liu <chancel.liu@nxp.com>
+Acked-by: Shengjiu Wang <shengjiu.wang@gmail.com>
+Link: https://lore.kernel.org/r/20230913102656.2966757-1-chancel.liu@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/imx-rpmsg.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/sound/soc/fsl/imx-rpmsg.c b/sound/soc/fsl/imx-rpmsg.c
+index 4d99f4858a14f..76c6febf24990 100644
+--- a/sound/soc/fsl/imx-rpmsg.c
++++ b/sound/soc/fsl/imx-rpmsg.c
+@@ -88,6 +88,14 @@ static int imx_rpmsg_probe(struct platform_device *pdev)
+ SND_SOC_DAIFMT_NB_NF |
+ SND_SOC_DAIFMT_CBC_CFC;
+
++ /*
++ * i.MX rpmsg sound cards work on codec slave mode. MCLK will be
++ * disabled by CPU DAI driver in hw_free(). Some codec requires MCLK
++ * present at power up/down sequence. So need to set ignore_pmdown_time
++ * to power down codec immediately before MCLK is turned off.
++ */
++ data->dai.ignore_pmdown_time = 1;
++
+ /* Optional codec node */
+ ret = of_parse_phandle_with_fixed_args(np, "audio-codec", 0, 0, &args);
+ if (ret) {
+--
+2.40.1
+
--- /dev/null
+From 4bde0258cb3cf4064a16e760d1c2a55e3f25a460 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Sep 2023 16:41:53 +0300
+Subject: ASoC: SOF: Intel: MTL: Reduce the DSP init timeout
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+
+[ Upstream commit e0f96246c4402514acda040be19ee24c1619e01a ]
+
+20s seems unnecessarily large for the DSP init timeout. This coupled with
+multiple FW boot attempts causes an excessive delay in the error path when
+booting in recovery mode. Reduce it to 0.5s and use the existing
+HDA_DSP_INIT_TIMEOUT_US.
+
+Link: https://github.com/thesofproject/linux/issues/4565
+Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://lore.kernel.org/r/20230915134153.9688-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/mtl.c | 2 +-
+ sound/soc/sof/intel/mtl.h | 1 -
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/sound/soc/sof/intel/mtl.c b/sound/soc/sof/intel/mtl.c
+index 10298532816fe..d7048f1d6a048 100644
+--- a/sound/soc/sof/intel/mtl.c
++++ b/sound/soc/sof/intel/mtl.c
+@@ -453,7 +453,7 @@ static int mtl_dsp_cl_init(struct snd_sof_dev *sdev, int stream_tag, bool imr_bo
+ /* step 3: wait for IPC DONE bit from ROM */
+ ret = snd_sof_dsp_read_poll_timeout(sdev, HDA_DSP_BAR, chip->ipc_ack, status,
+ ((status & chip->ipc_ack_mask) == chip->ipc_ack_mask),
+- HDA_DSP_REG_POLL_INTERVAL_US, MTL_DSP_PURGE_TIMEOUT_US);
++ HDA_DSP_REG_POLL_INTERVAL_US, HDA_DSP_INIT_TIMEOUT_US);
+ if (ret < 0) {
+ if (hda->boot_iteration == HDA_FW_BOOT_ATTEMPTS)
+ dev_err(sdev->dev, "timeout waiting for purge IPC done\n");
+diff --git a/sound/soc/sof/intel/mtl.h b/sound/soc/sof/intel/mtl.h
+index 788bf0e3ea879..00e3526889d3d 100644
+--- a/sound/soc/sof/intel/mtl.h
++++ b/sound/soc/sof/intel/mtl.h
+@@ -54,7 +54,6 @@
+ #define MTL_DSP_IRQSTS_IPC BIT(0)
+ #define MTL_DSP_IRQSTS_SDW BIT(6)
+
+-#define MTL_DSP_PURGE_TIMEOUT_US 20000000 /* 20s */
+ #define MTL_DSP_REG_POLL_INTERVAL_US 10 /* 10 us */
+
+ /* Memory windows */
+--
+2.40.1
+
--- /dev/null
+From 8fb108a05ccf67229e3846086b32a769347211ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Sep 2023 00:19:16 +0200
+Subject: ata: libata-eh: do not clear ATA_PFLAG_EH_PENDING in ata_eh_reset()
+
+From: Niklas Cassel <niklas.cassel@wdc.com>
+
+[ Upstream commit 80cc944eca4f0baa9c381d0706f3160e491437f2 ]
+
+ata_scsi_port_error_handler() starts off by clearing ATA_PFLAG_EH_PENDING,
+before calling ap->ops->error_handler() (without holding the ap->lock).
+
+If an error IRQ is received while ap->ops->error_handler() is running,
+the irq handler will set ATA_PFLAG_EH_PENDING.
+
+Once ap->ops->error_handler() returns, ata_scsi_port_error_handler()
+checks if ATA_PFLAG_EH_PENDING is set, and if it is, another iteration
+of ATA EH is performed.
+
+The problem is that ATA_PFLAG_EH_PENDING is not only cleared by
+ata_scsi_port_error_handler(), it is also cleared by ata_eh_reset().
+
+ata_eh_reset() is called by ap->ops->error_handler(). This additional
+clearing done by ata_eh_reset() breaks the whole retry logic in
+ata_scsi_port_error_handler(). Thus, if an error IRQ is received while
+ap->ops->error_handler() is running, the port will currently remain
+frozen and will never get re-enabled.
+
+The additional clearing in ata_eh_reset() was introduced in commit
+1e641060c4b5 ("libata: clear eh_info on reset completion").
+
+Looking at the original error report:
+https://marc.info/?l=linux-ide&m=124765325828495&w=2
+
+We can see the following happening:
+[ 1.074659] ata3: XXX port freeze
+[ 1.074700] ata3: XXX hardresetting link, stopping engine
+[ 1.074746] ata3: XXX flipping SControl
+
+[ 1.411471] ata3: XXX irq_stat=400040 CONN|PHY
+[ 1.411475] ata3: XXX port freeze
+
+[ 1.420049] ata3: XXX starting engine
+[ 1.420096] ata3: XXX rc=0, class=1
+[ 1.420142] ata3: XXX clearing IRQs for thawing
+[ 1.420188] ata3: XXX port thawed
+[ 1.420234] ata3: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
+
+We are not supposed to be able to receive an error IRQ while the port is
+frozen (PxIE is set to 0, i.e. all IRQs for the port are disabled).
+
+AHCI 1.3.1 section 10.7.1.1 First Tier (IS Register) states:
+"Each bit location can be thought of as reporting a '1' if the virtual
+"interrupt line" for that port is indicating it wishes to generate an
+interrupt. That is, if a port has one or more interrupt status bit set,
+and the enables for those status bits are set, then this bit shall be set."
+
+Additionally, AHCI state P:ComInit clearly shows that the state machine
+will only jump to P:ComInitSetIS (which sets IS.IPS(x) to '1'), if PxIE.PCE
+is set to '1'. In our case, PxIE is set to 0, so IS.IPS(x) won't get set.
+
+So IS.IPS(x) only gets set if PxIS and PxIE is set.
+
+AHCI 1.3.1 section 10.7.1.1 First Tier (IS Register) also states:
+"The bits in this register are read/write clear. It is set by the level of
+the virtual interrupt line being a set, and cleared by a write of '1' from
+the software."
+
+So if IS.IPS(x) is set, you need to explicitly clear it by writing a 1 to
+IS.IPS(x) for that port.
+
+Since PxIE is cleared, the only way to get an interrupt while the port is
+frozen, is if IS.IPS(x) is set, and the only way IS.IPS(x) can be set when
+the port is frozen, is if it was set before the port was frozen.
+
+However, since commit 737dd811a3db ("ata: libahci: clear pending interrupt
+status"), we clear both PxIS and IS.IPS(x) after freezing the port, but
+before the COMRESET, so the problem that commit 1e641060c4b5 ("libata:
+clear eh_info on reset completion") fixed can no longer happen.
+
+Thus, revert commit 1e641060c4b5 ("libata: clear eh_info on reset
+completion"), so that the retry logic in ata_scsi_port_error_handler()
+works once again. (The retry logic is still needed, since we can still
+get an error IRQ _after_ the port has been thawed, but before
+ata_scsi_port_error_handler() takes the ap->lock in order to check
+if ATA_PFLAG_EH_PENDING is set.)
+
+Signed-off-by: Niklas Cassel <niklas.cassel@wdc.com>
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-eh.c | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index a3ae5fc2a42fc..6d4c80b6daaef 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -2704,18 +2704,11 @@ int ata_eh_reset(struct ata_link *link, int classify,
+ }
+ }
+
+- /*
+- * Some controllers can't be frozen very well and may set spurious
+- * error conditions during reset. Clear accumulated error
+- * information and re-thaw the port if frozen. As reset is the
+- * final recovery action and we cross check link onlineness against
+- * device classification later, no hotplug event is lost by this.
+- */
++ /* clear cached SError */
+ spin_lock_irqsave(link->ap->lock, flags);
+- memset(&link->eh_info, 0, sizeof(link->eh_info));
++ link->eh_info.serror = 0;
+ if (slave)
+- memset(&slave->eh_info, 0, sizeof(link->eh_info));
+- ap->pflags &= ~ATA_PFLAG_EH_PENDING;
++ slave->eh_info.serror = 0;
+ spin_unlock_irqrestore(link->ap->lock, flags);
+
+ if (ap->pflags & ATA_PFLAG_FROZEN)
+--
+2.40.1
+
--- /dev/null
+From c195b265f98d6d766ff58bf0dd5c793de14edd89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Sep 2023 21:54:36 +0200
+Subject: ata: sata_mv: Fix incorrect string length computation in
+ mv_dump_mem()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit e97eb65dd464e7f118a16a26337322d07eb653e2 ]
+
+snprintf() returns the "number of characters which *would* be generated for
+the given input", not the size *really* generated.
+
+In order to avoid too large values for 'o' (and potential negative values
+for "sizeof(linebuf) o") use scnprintf() instead of snprintf().
+
+Note that given the "w < 4" in the for loop, the buffer can NOT
+overflow, but using the *right* function is always better.
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/sata_mv.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
+index e3cff01201b80..17f9062b0eaa5 100644
+--- a/drivers/ata/sata_mv.c
++++ b/drivers/ata/sata_mv.c
+@@ -1255,8 +1255,8 @@ static void mv_dump_mem(struct device *dev, void __iomem *start, unsigned bytes)
+
+ for (b = 0; b < bytes; ) {
+ for (w = 0, o = 0; b < bytes && w < 4; w++) {
+- o += snprintf(linebuf + o, sizeof(linebuf) - o,
+- "%08x ", readl(start + b));
++ o += scnprintf(linebuf + o, sizeof(linebuf) - o,
++ "%08x ", readl(start + b));
+ b += sizeof(u32);
+ }
+ dev_dbg(dev, "%s: %p: %s\n",
+--
+2.40.1
+
--- /dev/null
+From f30232931a8ba03d5e9ccc4a52d92c34de6f93f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Aug 2023 22:53:52 +0200
+Subject: bpf: Annotate bpf_long_memcpy with data_race
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit 6a86b5b5cd76d2734304a0173f5f01aa8aa2025e ]
+
+syzbot reported a data race splat between two processes trying to
+update the same BPF map value via syscall on different CPUs:
+
+ BUG: KCSAN: data-race in bpf_percpu_array_update / bpf_percpu_array_update
+
+ write to 0xffffe8fffe7425d8 of 8 bytes by task 8257 on cpu 1:
+ bpf_long_memcpy include/linux/bpf.h:428 [inline]
+ bpf_obj_memcpy include/linux/bpf.h:441 [inline]
+ copy_map_value_long include/linux/bpf.h:464 [inline]
+ bpf_percpu_array_update+0x3bb/0x500 kernel/bpf/arraymap.c:380
+ bpf_map_update_value+0x190/0x370 kernel/bpf/syscall.c:175
+ generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1749
+ bpf_map_do_batch+0x2df/0x3d0 kernel/bpf/syscall.c:4648
+ __sys_bpf+0x28a/0x780
+ __do_sys_bpf kernel/bpf/syscall.c:5241 [inline]
+ __se_sys_bpf kernel/bpf/syscall.c:5239 [inline]
+ __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5239
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+ write to 0xffffe8fffe7425d8 of 8 bytes by task 8268 on cpu 0:
+ bpf_long_memcpy include/linux/bpf.h:428 [inline]
+ bpf_obj_memcpy include/linux/bpf.h:441 [inline]
+ copy_map_value_long include/linux/bpf.h:464 [inline]
+ bpf_percpu_array_update+0x3bb/0x500 kernel/bpf/arraymap.c:380
+ bpf_map_update_value+0x190/0x370 kernel/bpf/syscall.c:175
+ generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1749
+ bpf_map_do_batch+0x2df/0x3d0 kernel/bpf/syscall.c:4648
+ __sys_bpf+0x28a/0x780
+ __do_sys_bpf kernel/bpf/syscall.c:5241 [inline]
+ __se_sys_bpf kernel/bpf/syscall.c:5239 [inline]
+ __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5239
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+ value changed: 0x0000000000000000 -> 0xfffffff000002788
+
+The bpf_long_memcpy is used with 8-byte aligned pointers, power-of-8 size
+and forced to use long read/writes to try to atomically copy long counters.
+It is best-effort only and no barriers are here since it _will_ race with
+concurrent updates from BPF programs. The bpf_long_memcpy() is called from
+bpf(2) syscall. Marco suggested that the best way to make this known to
+KCSAN would be to use data_race() annotation.
+
+Reported-by: syzbot+97522333291430dd277f@syzkaller.appspotmail.com
+Suggested-by: Marco Elver <elver@google.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Marco Elver <elver@google.com>
+Link: https://lore.kernel.org/bpf/000000000000d87a7f06040c970c@google.com
+Link: https://lore.kernel.org/bpf/57628f7a15e20d502247c3b55fceb1cb2b31f266.1693342186.git.daniel@iogearbox.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bpf.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index b3d3aa8437dce..1ed2ec035e779 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -301,7 +301,7 @@ static inline void bpf_long_memcpy(void *dst, const void *src, u32 size)
+
+ size /= sizeof(long);
+ while (size--)
+- *ldst++ = *lsrc++;
++ data_race(*ldst++ = *lsrc++);
+ }
+
+ /* copy everything but bpf_spin_lock, bpf_timer, and kptrs. There could be one of each. */
+--
+2.40.1
+
--- /dev/null
+From a50155f0117232f18bf1d9ece0990930235e0a45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Sep 2023 12:47:30 -0700
+Subject: bpf: Clarify error expectations from bpf_clone_redirect
+
+From: Stanislav Fomichev <sdf@google.com>
+
+[ Upstream commit 7cb779a6867fea00b4209bcf6de2f178a743247d ]
+
+Commit 151e887d8ff9 ("veth: Fixing transmit return status for dropped
+packets") exposed the fact that bpf_clone_redirect is capable of
+returning raw NET_XMIT_XXX return codes.
+
+This is in the conflict with its UAPI doc which says the following:
+"0 on success, or a negative error in case of failure."
+
+Update the UAPI to reflect the fact that bpf_clone_redirect can
+return positive error numbers, but don't explicitly define
+their meaning.
+
+Reported-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Stanislav Fomichev <sdf@google.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20230911194731.286342-1-sdf@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/bpf.h | 4 +++-
+ tools/include/uapi/linux/bpf.h | 4 +++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
+index 51b9aa640ad2a..53bc487947197 100644
+--- a/include/uapi/linux/bpf.h
++++ b/include/uapi/linux/bpf.h
+@@ -1837,7 +1837,9 @@ union bpf_attr {
+ * performed again, if the helper is used in combination with
+ * direct packet access.
+ * Return
+- * 0 on success, or a negative error in case of failure.
++ * 0 on success, or a negative error in case of failure. Positive
++ * error indicates a potential drop or congestion in the target
++ * device. The particular positive error codes are not defined.
+ *
+ * u64 bpf_get_current_pid_tgid(void)
+ * Description
+diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
+index 51b9aa640ad2a..53bc487947197 100644
+--- a/tools/include/uapi/linux/bpf.h
++++ b/tools/include/uapi/linux/bpf.h
+@@ -1837,7 +1837,9 @@ union bpf_attr {
+ * performed again, if the helper is used in combination with
+ * direct packet access.
+ * Return
+- * 0 on success, or a negative error in case of failure.
++ * 0 on success, or a negative error in case of failure. Positive
++ * error indicates a potential drop or congestion in the target
++ * device. The particular positive error codes are not defined.
+ *
+ * u64 bpf_get_current_pid_tgid(void)
+ * Description
+--
+2.40.1
+
--- /dev/null
+From d52a59815cd0e28dfa2d0b817a3900d76d56333c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Sep 2023 21:39:22 +0800
+Subject: bpf: Ensure unit_size is matched with slab cache object size
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit c930472552022bd09aab3cd946ba3f243070d5c7 ]
+
+Add extra check in bpf_mem_alloc_init() to ensure the unit_size of
+bpf_mem_cache is matched with the object_size of underlying slab cache.
+If these two sizes are unmatched, print a warning once and return
+-EINVAL in bpf_mem_alloc_init(), so the mismatch can be found early and
+the potential issue can be prevented.
+
+Suggested-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Link: https://lore.kernel.org/r/20230908133923.2675053-4-houtao@huaweicloud.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/memalloc.c | 33 +++++++++++++++++++++++++++++++--
+ 1 file changed, 31 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/memalloc.c b/kernel/bpf/memalloc.c
+index ace303a220ae8..f66a081195ac1 100644
+--- a/kernel/bpf/memalloc.c
++++ b/kernel/bpf/memalloc.c
+@@ -347,6 +347,24 @@ static void prefill_mem_cache(struct bpf_mem_cache *c, int cpu)
+ alloc_bulk(c, c->unit_size <= 256 ? 4 : 1, cpu_to_node(cpu));
+ }
+
++static int check_obj_size(struct bpf_mem_cache *c, unsigned int idx)
++{
++ struct llist_node *first;
++ unsigned int obj_size;
++
++ first = c->free_llist.first;
++ if (!first)
++ return 0;
++
++ obj_size = ksize(first);
++ if (obj_size != c->unit_size) {
++ WARN_ONCE(1, "bpf_mem_cache[%u]: unexpected object size %u, expect %u\n",
++ idx, obj_size, c->unit_size);
++ return -EINVAL;
++ }
++ return 0;
++}
++
+ /* When size != 0 bpf_mem_cache for each cpu.
+ * This is typical bpf hash map use case when all elements have equal size.
+ *
+@@ -357,10 +375,10 @@ static void prefill_mem_cache(struct bpf_mem_cache *c, int cpu)
+ int bpf_mem_alloc_init(struct bpf_mem_alloc *ma, int size, bool percpu)
+ {
+ static u16 sizes[NUM_CACHES] = {96, 192, 16, 32, 64, 128, 256, 512, 1024, 2048, 4096};
++ int cpu, i, err, unit_size, percpu_size = 0;
+ struct bpf_mem_caches *cc, __percpu *pcc;
+ struct bpf_mem_cache *c, __percpu *pc;
+ struct obj_cgroup *objcg = NULL;
+- int cpu, i, unit_size, percpu_size = 0;
+
+ if (size) {
+ pc = __alloc_percpu_gfp(sizeof(*pc), 8, GFP_KERNEL);
+@@ -395,6 +413,7 @@ int bpf_mem_alloc_init(struct bpf_mem_alloc *ma, int size, bool percpu)
+ pcc = __alloc_percpu_gfp(sizeof(*cc), 8, GFP_KERNEL);
+ if (!pcc)
+ return -ENOMEM;
++ err = 0;
+ #ifdef CONFIG_MEMCG_KMEM
+ objcg = get_obj_cgroup_from_current();
+ #endif
+@@ -405,10 +424,20 @@ int bpf_mem_alloc_init(struct bpf_mem_alloc *ma, int size, bool percpu)
+ c->unit_size = sizes[i];
+ c->objcg = objcg;
+ prefill_mem_cache(c, cpu);
++ err = check_obj_size(c, i);
++ if (err)
++ goto out;
+ }
+ }
++
++out:
+ ma->caches = pcc;
+- return 0;
++ /* refill_work is either zeroed or initialized, so it is safe to
++ * call irq_work_sync().
++ */
++ if (err)
++ bpf_mem_alloc_destroy(ma);
++ return err;
+ }
+
+ static void drain_mem_cache(struct bpf_mem_cache *c)
+--
+2.40.1
+
--- /dev/null
+From 58aa74df2100fe261a76a08282e5770839f0aded Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Aug 2023 09:06:44 +0100
+Subject: btrfs: assert delayed node locked when removing delayed item
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit a57c2d4e46f519b24558ae0752c17eec416ac72a ]
+
+When removing a delayed item, or releasing which will remove it as well,
+we will modify one of the delayed node's rbtrees and item counter if the
+delayed item is in one of the rbtrees. This require having the delayed
+node's mutex locked, otherwise we will race with other tasks modifying
+the rbtrees and the counter.
+
+This is motivated by a previous version of another patch actually calling
+btrfs_release_delayed_item() after unlocking the delayed node's mutex and
+against a delayed item that is in a rbtree.
+
+So assert at __btrfs_remove_delayed_item() that the delayed node's mutex
+is locked.
+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/delayed-inode.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
+index 9dacf72a75d0e..1331e56e8e84f 100644
+--- a/fs/btrfs/delayed-inode.c
++++ b/fs/btrfs/delayed-inode.c
+@@ -407,6 +407,7 @@ static void finish_one_item(struct btrfs_delayed_root *delayed_root)
+
+ static void __btrfs_remove_delayed_item(struct btrfs_delayed_item *delayed_item)
+ {
++ struct btrfs_delayed_node *delayed_node = delayed_item->delayed_node;
+ struct rb_root_cached *root;
+ struct btrfs_delayed_root *delayed_root;
+
+@@ -414,18 +415,21 @@ static void __btrfs_remove_delayed_item(struct btrfs_delayed_item *delayed_item)
+ if (RB_EMPTY_NODE(&delayed_item->rb_node))
+ return;
+
+- delayed_root = delayed_item->delayed_node->root->fs_info->delayed_root;
++ /* If it's in a rbtree, then we need to have delayed node locked. */
++ lockdep_assert_held(&delayed_node->mutex);
++
++ delayed_root = delayed_node->root->fs_info->delayed_root;
+
+ BUG_ON(!delayed_root);
+
+ if (delayed_item->type == BTRFS_DELAYED_INSERTION_ITEM)
+- root = &delayed_item->delayed_node->ins_root;
++ root = &delayed_node->ins_root;
+ else
+- root = &delayed_item->delayed_node->del_root;
++ root = &delayed_node->del_root;
+
+ rb_erase_cached(&delayed_item->rb_node, root);
+ RB_CLEAR_NODE(&delayed_item->rb_node);
+- delayed_item->delayed_node->count--;
++ delayed_node->count--;
+
+ finish_one_item(delayed_root);
+ }
+--
+2.40.1
+
--- /dev/null
+From f63fbd28442b0efc7509d90b2f24fc2542a0f273 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Dec 2022 14:13:51 +0800
+Subject: ceph: drop messages from MDS when unmounting
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Xiubo Li <xiubli@redhat.com>
+
+[ Upstream commit e3dfcab2080dc1f9a4b09cc1327361bc2845bfcd ]
+
+When unmounting all the dirty buffers will be flushed and after
+the last osd request is finished the last reference of the i_count
+will be released. Then it will flush the dirty cap/snap to MDSs,
+and the unmounting won't wait the possible acks, which will ihold
+the inodes when updating the metadata locally but makes no sense
+any more, of this. This will make the evict_inodes() to skip these
+inodes.
+
+If encrypt is enabled the kernel generate a warning when removing
+the encrypt keys when the skipped inodes still hold the keyring:
+
+WARNING: CPU: 4 PID: 168846 at fs/crypto/keyring.c:242 fscrypt_destroy_keyring+0x7e/0xd0
+CPU: 4 PID: 168846 Comm: umount Tainted: G S 6.1.0-rc5-ceph-g72ead199864c #1
+Hardware name: Supermicro SYS-5018R-WR/X10SRW-F, BIOS 2.0 12/17/2015
+RIP: 0010:fscrypt_destroy_keyring+0x7e/0xd0
+RSP: 0018:ffffc9000b277e28 EFLAGS: 00010202
+RAX: 0000000000000002 RBX: ffff88810d52ac00 RCX: ffff88810b56aa00
+RDX: 0000000080000000 RSI: ffffffff822f3a09 RDI: ffff888108f59000
+RBP: ffff8881d394fb88 R08: 0000000000000028 R09: 0000000000000000
+R10: 0000000000000001 R11: 11ff4fe6834fcd91 R12: ffff8881d394fc40
+R13: ffff888108f59000 R14: ffff8881d394f800 R15: 0000000000000000
+FS: 00007fd83f6f1080(0000) GS:ffff88885fd00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007f918d417000 CR3: 000000017f89a005 CR4: 00000000003706e0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+<TASK>
+generic_shutdown_super+0x47/0x120
+kill_anon_super+0x14/0x30
+ceph_kill_sb+0x36/0x90 [ceph]
+deactivate_locked_super+0x29/0x60
+cleanup_mnt+0xb8/0x140
+task_work_run+0x67/0xb0
+exit_to_user_mode_prepare+0x23d/0x240
+syscall_exit_to_user_mode+0x25/0x60
+do_syscall_64+0x40/0x80
+entry_SYSCALL_64_after_hwframe+0x63/0xcd
+RIP: 0033:0x7fd83dc39e9b
+
+Later the kernel will crash when iput() the inodes and dereferencing
+the "sb->s_master_keys", which has been released by the
+generic_shutdown_super().
+
+Link: https://tracker.ceph.com/issues/59162
+Signed-off-by: Xiubo Li <xiubli@redhat.com>
+Reviewed-and-tested-by: Luís Henriques <lhenriques@suse.de>
+Reviewed-by: Milind Changire <mchangir@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/caps.c | 6 +++-
+ fs/ceph/mds_client.c | 12 +++++--
+ fs/ceph/mds_client.h | 11 +++++--
+ fs/ceph/quota.c | 14 ++++-----
+ fs/ceph/snap.c | 10 +++---
+ fs/ceph/super.c | 75 +++++++++++++++++++++++++++++++++++++++++---
+ fs/ceph/super.h | 3 ++
+ 7 files changed, 109 insertions(+), 22 deletions(-)
+
+diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
+index 4a9ad5ff726d4..36052a3626830 100644
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -4100,6 +4100,9 @@ void ceph_handle_caps(struct ceph_mds_session *session,
+
+ dout("handle_caps from mds%d\n", session->s_mds);
+
++ if (!ceph_inc_mds_stopping_blocker(mdsc, session))
++ return;
++
+ /* decode */
+ end = msg->front.iov_base + msg->front.iov_len;
+ if (msg->front.iov_len < sizeof(*h))
+@@ -4196,7 +4199,6 @@ void ceph_handle_caps(struct ceph_mds_session *session,
+ vino.snap, inode);
+
+ mutex_lock(&session->s_mutex);
+- inc_session_sequence(session);
+ dout(" mds%d seq %lld cap seq %u\n", session->s_mds, session->s_seq,
+ (unsigned)seq);
+
+@@ -4299,6 +4301,8 @@ void ceph_handle_caps(struct ceph_mds_session *session,
+ done_unlocked:
+ iput(inode);
+ out:
++ ceph_dec_mds_stopping_blocker(mdsc);
++
+ ceph_put_string(extra_info.pool_ns);
+
+ /* Defer closing the sessions after s_mutex lock being released */
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index 5399a9ea5b4f1..f6a7fd47efd7a 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -4546,6 +4546,9 @@ static void handle_lease(struct ceph_mds_client *mdsc,
+
+ dout("handle_lease from mds%d\n", mds);
+
++ if (!ceph_inc_mds_stopping_blocker(mdsc, session))
++ return;
++
+ /* decode */
+ if (msg->front.iov_len < sizeof(*h) + sizeof(u32))
+ goto bad;
+@@ -4564,8 +4567,6 @@ static void handle_lease(struct ceph_mds_client *mdsc,
+ dname.len, dname.name);
+
+ mutex_lock(&session->s_mutex);
+- inc_session_sequence(session);
+-
+ if (!inode) {
+ dout("handle_lease no inode %llx\n", vino.ino);
+ goto release;
+@@ -4627,9 +4628,13 @@ static void handle_lease(struct ceph_mds_client *mdsc,
+ out:
+ mutex_unlock(&session->s_mutex);
+ iput(inode);
++
++ ceph_dec_mds_stopping_blocker(mdsc);
+ return;
+
+ bad:
++ ceph_dec_mds_stopping_blocker(mdsc);
++
+ pr_err("corrupt lease message\n");
+ ceph_msg_dump(msg);
+ }
+@@ -4825,6 +4830,9 @@ int ceph_mdsc_init(struct ceph_fs_client *fsc)
+ }
+
+ init_completion(&mdsc->safe_umount_waiters);
++ spin_lock_init(&mdsc->stopping_lock);
++ atomic_set(&mdsc->stopping_blockers, 0);
++ init_completion(&mdsc->stopping_waiter);
+ init_waitqueue_head(&mdsc->session_close_wq);
+ INIT_LIST_HEAD(&mdsc->waiting_for_map);
+ mdsc->quotarealms_inodes = RB_ROOT;
+diff --git a/fs/ceph/mds_client.h b/fs/ceph/mds_client.h
+index 9a80658f41679..0913959ccfa64 100644
+--- a/fs/ceph/mds_client.h
++++ b/fs/ceph/mds_client.h
+@@ -381,8 +381,9 @@ struct cap_wait {
+ };
+
+ enum {
+- CEPH_MDSC_STOPPING_BEGIN = 1,
+- CEPH_MDSC_STOPPING_FLUSHED = 2,
++ CEPH_MDSC_STOPPING_BEGIN = 1,
++ CEPH_MDSC_STOPPING_FLUSHING = 2,
++ CEPH_MDSC_STOPPING_FLUSHED = 3,
+ };
+
+ /*
+@@ -401,7 +402,11 @@ struct ceph_mds_client {
+ struct ceph_mds_session **sessions; /* NULL for mds if no session */
+ atomic_t num_sessions;
+ int max_sessions; /* len of sessions array */
+- int stopping; /* true if shutting down */
++
++ spinlock_t stopping_lock; /* protect snap_empty */
++ int stopping; /* the stage of shutting down */
++ atomic_t stopping_blockers;
++ struct completion stopping_waiter;
+
+ atomic64_t quotarealms_count; /* # realms with quota */
+ /*
+diff --git a/fs/ceph/quota.c b/fs/ceph/quota.c
+index 64592adfe48fb..f7fcf7f08ec64 100644
+--- a/fs/ceph/quota.c
++++ b/fs/ceph/quota.c
+@@ -47,25 +47,23 @@ void ceph_handle_quota(struct ceph_mds_client *mdsc,
+ struct inode *inode;
+ struct ceph_inode_info *ci;
+
++ if (!ceph_inc_mds_stopping_blocker(mdsc, session))
++ return;
++
+ if (msg->front.iov_len < sizeof(*h)) {
+ pr_err("%s corrupt message mds%d len %d\n", __func__,
+ session->s_mds, (int)msg->front.iov_len);
+ ceph_msg_dump(msg);
+- return;
++ goto out;
+ }
+
+- /* increment msg sequence number */
+- mutex_lock(&session->s_mutex);
+- inc_session_sequence(session);
+- mutex_unlock(&session->s_mutex);
+-
+ /* lookup inode */
+ vino.ino = le64_to_cpu(h->ino);
+ vino.snap = CEPH_NOSNAP;
+ inode = ceph_find_inode(sb, vino);
+ if (!inode) {
+ pr_warn("Failed to find inode %llu\n", vino.ino);
+- return;
++ goto out;
+ }
+ ci = ceph_inode(inode);
+
+@@ -78,6 +76,8 @@ void ceph_handle_quota(struct ceph_mds_client *mdsc,
+ spin_unlock(&ci->i_ceph_lock);
+
+ iput(inode);
++out:
++ ceph_dec_mds_stopping_blocker(mdsc);
+ }
+
+ static struct ceph_quotarealm_inode *
+diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
+index 2e73ba62bd7aa..82f7592e1747b 100644
+--- a/fs/ceph/snap.c
++++ b/fs/ceph/snap.c
+@@ -1012,6 +1012,9 @@ void ceph_handle_snap(struct ceph_mds_client *mdsc,
+ int locked_rwsem = 0;
+ bool close_sessions = false;
+
++ if (!ceph_inc_mds_stopping_blocker(mdsc, session))
++ return;
++
+ /* decode */
+ if (msg->front.iov_len < sizeof(*h))
+ goto bad;
+@@ -1027,10 +1030,6 @@ void ceph_handle_snap(struct ceph_mds_client *mdsc,
+ dout("%s from mds%d op %s split %llx tracelen %d\n", __func__,
+ mds, ceph_snap_op_name(op), split, trace_len);
+
+- mutex_lock(&session->s_mutex);
+- inc_session_sequence(session);
+- mutex_unlock(&session->s_mutex);
+-
+ down_write(&mdsc->snap_rwsem);
+ locked_rwsem = 1;
+
+@@ -1148,6 +1147,7 @@ void ceph_handle_snap(struct ceph_mds_client *mdsc,
+ up_write(&mdsc->snap_rwsem);
+
+ flush_snaps(mdsc);
++ ceph_dec_mds_stopping_blocker(mdsc);
+ return;
+
+ bad:
+@@ -1157,6 +1157,8 @@ void ceph_handle_snap(struct ceph_mds_client *mdsc,
+ if (locked_rwsem)
+ up_write(&mdsc->snap_rwsem);
+
++ ceph_dec_mds_stopping_blocker(mdsc);
++
+ if (close_sessions)
+ ceph_mdsc_close_sessions(mdsc);
+ return;
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index a5f52013314d6..281b493fdac8e 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -1365,25 +1365,90 @@ static int ceph_init_fs_context(struct fs_context *fc)
+ return -ENOMEM;
+ }
+
++/*
++ * Return true if it successfully increases the blocker counter,
++ * or false if the mdsc is in stopping and flushed state.
++ */
++static bool __inc_stopping_blocker(struct ceph_mds_client *mdsc)
++{
++ spin_lock(&mdsc->stopping_lock);
++ if (mdsc->stopping >= CEPH_MDSC_STOPPING_FLUSHING) {
++ spin_unlock(&mdsc->stopping_lock);
++ return false;
++ }
++ atomic_inc(&mdsc->stopping_blockers);
++ spin_unlock(&mdsc->stopping_lock);
++ return true;
++}
++
++static void __dec_stopping_blocker(struct ceph_mds_client *mdsc)
++{
++ spin_lock(&mdsc->stopping_lock);
++ if (!atomic_dec_return(&mdsc->stopping_blockers) &&
++ mdsc->stopping >= CEPH_MDSC_STOPPING_FLUSHING)
++ complete_all(&mdsc->stopping_waiter);
++ spin_unlock(&mdsc->stopping_lock);
++}
++
++/* For metadata IO requests */
++bool ceph_inc_mds_stopping_blocker(struct ceph_mds_client *mdsc,
++ struct ceph_mds_session *session)
++{
++ mutex_lock(&session->s_mutex);
++ inc_session_sequence(session);
++ mutex_unlock(&session->s_mutex);
++
++ return __inc_stopping_blocker(mdsc);
++}
++
++void ceph_dec_mds_stopping_blocker(struct ceph_mds_client *mdsc)
++{
++ __dec_stopping_blocker(mdsc);
++}
++
+ static void ceph_kill_sb(struct super_block *s)
+ {
+ struct ceph_fs_client *fsc = ceph_sb_to_client(s);
++ struct ceph_mds_client *mdsc = fsc->mdsc;
++ bool wait;
+
+ dout("kill_sb %p\n", s);
+
+- ceph_mdsc_pre_umount(fsc->mdsc);
++ ceph_mdsc_pre_umount(mdsc);
+ flush_fs_workqueues(fsc);
+
+ /*
+ * Though the kill_anon_super() will finally trigger the
+- * sync_filesystem() anyway, we still need to do it here
+- * and then bump the stage of shutdown to stop the work
+- * queue as earlier as possible.
++ * sync_filesystem() anyway, we still need to do it here and
++ * then bump the stage of shutdown. This will allow us to
++ * drop any further message, which will increase the inodes'
++ * i_count reference counters but makes no sense any more,
++ * from MDSs.
++ *
++ * Without this when evicting the inodes it may fail in the
++ * kill_anon_super(), which will trigger a warning when
++ * destroying the fscrypt keyring and then possibly trigger
++ * a further crash in ceph module when the iput() tries to
++ * evict the inodes later.
+ */
+ sync_filesystem(s);
+
+- fsc->mdsc->stopping = CEPH_MDSC_STOPPING_FLUSHED;
++ spin_lock(&mdsc->stopping_lock);
++ mdsc->stopping = CEPH_MDSC_STOPPING_FLUSHING;
++ wait = !!atomic_read(&mdsc->stopping_blockers);
++ spin_unlock(&mdsc->stopping_lock);
++
++ if (wait && atomic_read(&mdsc->stopping_blockers)) {
++ long timeleft = wait_for_completion_killable_timeout(
++ &mdsc->stopping_waiter,
++ fsc->client->options->mount_timeout);
++ if (!timeleft) /* timed out */
++ pr_warn("umount timed out, %ld\n", timeleft);
++ else if (timeleft < 0) /* killed */
++ pr_warn("umount was killed, %ld\n", timeleft);
++ }
+
++ mdsc->stopping = CEPH_MDSC_STOPPING_FLUSHED;
+ kill_anon_super(s);
+
+ fsc->client->extra_mon_dispatch = NULL;
+diff --git a/fs/ceph/super.h b/fs/ceph/super.h
+index 562f42f4a77d7..7ca74f5f70be5 100644
+--- a/fs/ceph/super.h
++++ b/fs/ceph/super.h
+@@ -1374,4 +1374,7 @@ extern bool ceph_quota_update_statfs(struct ceph_fs_client *fsc,
+ struct kstatfs *buf);
+ extern void ceph_cleanup_quotarealms_inodes(struct ceph_mds_client *mdsc);
+
++bool ceph_inc_mds_stopping_blocker(struct ceph_mds_client *mdsc,
++ struct ceph_mds_session *session);
++void ceph_dec_mds_stopping_blocker(struct ceph_mds_client *mdsc);
+ #endif /* _FS_CEPH_SUPER_H */
+--
+2.40.1
+
--- /dev/null
+From f3ca4e02fdbe2583514b73ce0b96cefaa53b0597 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Aug 2023 11:32:21 +0900
+Subject: dma-debug: don't call __dma_entry_alloc_check_leak() under
+ free_entries_lock
+
+From: Sergey Senozhatsky <senozhatsky@chromium.org>
+
+[ Upstream commit fb5a4315591dae307a65fc246ca80b5159d296e1 ]
+
+__dma_entry_alloc_check_leak() calls into printk -> serial console
+output (qcom geni) and grabs port->lock under free_entries_lock
+spin lock, which is a reverse locking dependency chain as qcom_geni
+IRQ handler can call into dma-debug code and grab free_entries_lock
+under port->lock.
+
+Move __dma_entry_alloc_check_leak() call out of free_entries_lock
+scope so that we don't acquire serial console's port->lock under it.
+
+Trimmed-down lockdep splat:
+
+ The existing dependency chain (in reverse order) is:
+
+ -> #2 (free_entries_lock){-.-.}-{2:2}:
+ _raw_spin_lock_irqsave+0x60/0x80
+ dma_entry_alloc+0x38/0x110
+ debug_dma_map_page+0x60/0xf8
+ dma_map_page_attrs+0x1e0/0x230
+ dma_map_single_attrs.constprop.0+0x6c/0xc8
+ geni_se_rx_dma_prep+0x40/0xcc
+ qcom_geni_serial_isr+0x310/0x510
+ __handle_irq_event_percpu+0x110/0x244
+ handle_irq_event_percpu+0x20/0x54
+ handle_irq_event+0x50/0x88
+ handle_fasteoi_irq+0xa4/0xcc
+ handle_irq_desc+0x28/0x40
+ generic_handle_domain_irq+0x24/0x30
+ gic_handle_irq+0xc4/0x148
+ do_interrupt_handler+0xa4/0xb0
+ el1_interrupt+0x34/0x64
+ el1h_64_irq_handler+0x18/0x24
+ el1h_64_irq+0x64/0x68
+ arch_local_irq_enable+0x4/0x8
+ ____do_softirq+0x18/0x24
+ ...
+
+ -> #1 (&port_lock_key){-.-.}-{2:2}:
+ _raw_spin_lock_irqsave+0x60/0x80
+ qcom_geni_serial_console_write+0x184/0x1dc
+ console_flush_all+0x344/0x454
+ console_unlock+0x94/0xf0
+ vprintk_emit+0x238/0x24c
+ vprintk_default+0x3c/0x48
+ vprintk+0xb4/0xbc
+ _printk+0x68/0x90
+ register_console+0x230/0x38c
+ uart_add_one_port+0x338/0x494
+ qcom_geni_serial_probe+0x390/0x424
+ platform_probe+0x70/0xc0
+ really_probe+0x148/0x280
+ __driver_probe_device+0xfc/0x114
+ driver_probe_device+0x44/0x100
+ __device_attach_driver+0x64/0xdc
+ bus_for_each_drv+0xb0/0xd8
+ __device_attach+0xe4/0x140
+ device_initial_probe+0x1c/0x28
+ bus_probe_device+0x44/0xb0
+ device_add+0x538/0x668
+ of_device_add+0x44/0x50
+ of_platform_device_create_pdata+0x94/0xc8
+ of_platform_bus_create+0x270/0x304
+ of_platform_populate+0xac/0xc4
+ devm_of_platform_populate+0x60/0xac
+ geni_se_probe+0x154/0x160
+ platform_probe+0x70/0xc0
+ ...
+
+ -> #0 (console_owner){-...}-{0:0}:
+ __lock_acquire+0xdf8/0x109c
+ lock_acquire+0x234/0x284
+ console_flush_all+0x330/0x454
+ console_unlock+0x94/0xf0
+ vprintk_emit+0x238/0x24c
+ vprintk_default+0x3c/0x48
+ vprintk+0xb4/0xbc
+ _printk+0x68/0x90
+ dma_entry_alloc+0xb4/0x110
+ debug_dma_map_sg+0xdc/0x2f8
+ __dma_map_sg_attrs+0xac/0xe4
+ dma_map_sgtable+0x30/0x4c
+ get_pages+0x1d4/0x1e4 [msm]
+ msm_gem_pin_pages_locked+0x38/0xac [msm]
+ msm_gem_pin_vma_locked+0x58/0x88 [msm]
+ msm_ioctl_gem_submit+0xde4/0x13ac [msm]
+ drm_ioctl_kernel+0xe0/0x15c
+ drm_ioctl+0x2e8/0x3f4
+ vfs_ioctl+0x30/0x50
+ ...
+
+ Chain exists of:
+ console_owner --> &port_lock_key --> free_entries_lock
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(free_entries_lock);
+ lock(&port_lock_key);
+ lock(free_entries_lock);
+ lock(console_owner);
+
+ *** DEADLOCK ***
+
+ Call trace:
+ dump_backtrace+0xb4/0xf0
+ show_stack+0x20/0x30
+ dump_stack_lvl+0x60/0x84
+ dump_stack+0x18/0x24
+ print_circular_bug+0x1cc/0x234
+ check_noncircular+0x78/0xac
+ __lock_acquire+0xdf8/0x109c
+ lock_acquire+0x234/0x284
+ console_flush_all+0x330/0x454
+ console_unlock+0x94/0xf0
+ vprintk_emit+0x238/0x24c
+ vprintk_default+0x3c/0x48
+ vprintk+0xb4/0xbc
+ _printk+0x68/0x90
+ dma_entry_alloc+0xb4/0x110
+ debug_dma_map_sg+0xdc/0x2f8
+ __dma_map_sg_attrs+0xac/0xe4
+ dma_map_sgtable+0x30/0x4c
+ get_pages+0x1d4/0x1e4 [msm]
+ msm_gem_pin_pages_locked+0x38/0xac [msm]
+ msm_gem_pin_vma_locked+0x58/0x88 [msm]
+ msm_ioctl_gem_submit+0xde4/0x13ac [msm]
+ drm_ioctl_kernel+0xe0/0x15c
+ drm_ioctl+0x2e8/0x3f4
+ vfs_ioctl+0x30/0x50
+ ...
+
+Reported-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Acked-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/dma/debug.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
+index 18c93c2276cae..3ff7089d11a92 100644
+--- a/kernel/dma/debug.c
++++ b/kernel/dma/debug.c
+@@ -603,15 +603,19 @@ static struct dma_debug_entry *__dma_entry_alloc(void)
+ return entry;
+ }
+
+-static void __dma_entry_alloc_check_leak(void)
++/*
++ * This should be called outside of free_entries_lock scope to avoid potential
++ * deadlocks with serial consoles that use DMA.
++ */
++static void __dma_entry_alloc_check_leak(u32 nr_entries)
+ {
+- u32 tmp = nr_total_entries % nr_prealloc_entries;
++ u32 tmp = nr_entries % nr_prealloc_entries;
+
+ /* Shout each time we tick over some multiple of the initial pool */
+ if (tmp < DMA_DEBUG_DYNAMIC_ENTRIES) {
+ pr_info("dma_debug_entry pool grown to %u (%u00%%)\n",
+- nr_total_entries,
+- (nr_total_entries / nr_prealloc_entries));
++ nr_entries,
++ (nr_entries / nr_prealloc_entries));
+ }
+ }
+
+@@ -622,8 +626,10 @@ static void __dma_entry_alloc_check_leak(void)
+ */
+ static struct dma_debug_entry *dma_entry_alloc(void)
+ {
++ bool alloc_check_leak = false;
+ struct dma_debug_entry *entry;
+ unsigned long flags;
++ u32 nr_entries;
+
+ spin_lock_irqsave(&free_entries_lock, flags);
+ if (num_free_entries == 0) {
+@@ -633,13 +639,17 @@ static struct dma_debug_entry *dma_entry_alloc(void)
+ pr_err("debugging out of memory - disabling\n");
+ return NULL;
+ }
+- __dma_entry_alloc_check_leak();
++ alloc_check_leak = true;
++ nr_entries = nr_total_entries;
+ }
+
+ entry = __dma_entry_alloc();
+
+ spin_unlock_irqrestore(&free_entries_lock, flags);
+
++ if (alloc_check_leak)
++ __dma_entry_alloc_check_leak(nr_entries);
++
+ #ifdef CONFIG_STACKTRACE
+ entry->stack_len = stack_trace_save(entry->stack_entries,
+ ARRAY_SIZE(entry->stack_entries),
+--
+2.40.1
+
--- /dev/null
+From fe57df094f68c5ccdcdc8ec13531e7d4e9db8d0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Aug 2023 14:04:26 -0400
+Subject: drm/amd/display: Don't check registers, if using AUX BL control
+
+From: Swapnil Patel <swapnil.patel@amd.com>
+
+[ Upstream commit f5b2c10b57615828b531bb0ae56bd6325a41167e ]
+
+[Why]
+Currently the driver looks DCN registers to access if BL is on or not.
+This check is not valid if we are using AUX based brightness control.
+This causes driver to not send out "backlight off" command during power off
+sequence as it already thinks it is off.
+
+[How]
+Only check DCN registers if we aren't using AUX based brightness control.
+
+Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
+Acked-by: Stylon Wang <stylon.wang@amd.com>
+Signed-off-by: Swapnil Patel <swapnil.patel@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+index 9378c98d02cfe..508f5fe268484 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+@@ -973,7 +973,9 @@ void dce110_edp_backlight_control(
+ return;
+ }
+
+- if (link->panel_cntl) {
++ if (link->panel_cntl && !(link->dpcd_sink_ext_caps.bits.oled ||
++ link->dpcd_sink_ext_caps.bits.hdr_aux_backlight_control == 1 ||
++ link->dpcd_sink_ext_caps.bits.sdr_aux_backlight_control == 1)) {
+ bool is_backlight_on = link->panel_cntl->funcs->is_panel_backlight_on(link->panel_cntl);
+
+ if ((enable && is_backlight_on) || (!enable && !is_backlight_on)) {
+--
+2.40.1
+
--- /dev/null
+From a8df859a47f5391b01e437867f9706189c1afb7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Sep 2023 10:13:51 -0400
+Subject: drm/amdgpu: Handle null atom context in VBIOS info ioctl
+
+From: David Francis <David.Francis@amd.com>
+
+[ Upstream commit 5e7e82254270c8cf8b107451c5de01cee2f135ae ]
+
+On some APU systems, there is no atom context and so the
+atom_context struct is null.
+
+Add a check to the VBIOS_INFO branch of amdgpu_info_ioctl
+to handle this case, returning all zeroes.
+
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: David Francis <David.Francis@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+index 9e3313dd956ae..24b4bd6bb2771 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -896,12 +896,17 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
+ struct atom_context *atom_context;
+
+ atom_context = adev->mode_info.atom_context;
+- memcpy(vbios_info.name, atom_context->name, sizeof(atom_context->name));
+- memcpy(vbios_info.vbios_pn, atom_context->vbios_pn, sizeof(atom_context->vbios_pn));
+- vbios_info.version = atom_context->version;
+- memcpy(vbios_info.vbios_ver_str, atom_context->vbios_ver_str,
+- sizeof(atom_context->vbios_ver_str));
+- memcpy(vbios_info.date, atom_context->date, sizeof(atom_context->date));
++ if (atom_context) {
++ memcpy(vbios_info.name, atom_context->name,
++ sizeof(atom_context->name));
++ memcpy(vbios_info.vbios_pn, atom_context->vbios_pn,
++ sizeof(atom_context->vbios_pn));
++ vbios_info.version = atom_context->version;
++ memcpy(vbios_info.vbios_ver_str, atom_context->vbios_ver_str,
++ sizeof(atom_context->vbios_ver_str));
++ memcpy(vbios_info.date, atom_context->date,
++ sizeof(atom_context->date));
++ }
+
+ return copy_to_user(out, &vbios_info,
+ min((size_t)size, sizeof(vbios_info))) ? -EFAULT : 0;
+--
+2.40.1
+
--- /dev/null
+From a8f7a22a6f79b0e40c0f7012aa68409639e9c402 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Sep 2023 15:44:54 -0400
+Subject: drm/amdgpu/nbio4.3: set proper rmmio_remap.reg_offset for SR-IOV
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit ab43213e7afd08ac68d4282060bacf309e70fd14 ]
+
+Needed for HDP flush to work correctly.
+
+Reviewed-by: Timmy Tsai <timmtsai@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/nbio_v4_3.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/nbio_v4_3.c b/drivers/gpu/drm/amd/amdgpu/nbio_v4_3.c
+index 09fdcd20cb919..c52a378396af1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/nbio_v4_3.c
++++ b/drivers/gpu/drm/amd/amdgpu/nbio_v4_3.c
+@@ -344,6 +344,9 @@ static void nbio_v4_3_init_registers(struct amdgpu_device *adev)
+ data &= ~RCC_DEV0_EPF2_STRAP2__STRAP_NO_SOFT_RESET_DEV0_F2_MASK;
+ WREG32_SOC15(NBIO, 0, regRCC_DEV0_EPF2_STRAP2, data);
+ }
++ if (amdgpu_sriov_vf(adev))
++ adev->rmmio_remap.reg_offset = SOC15_REG_OFFSET(NBIO, 0,
++ regBIF_BX_DEV0_EPF0_VF0_HDP_MEM_COHERENCY_FLUSH_CNTL) << 2;
+ }
+
+ static u32 nbio_v4_3_get_rom_offset(struct amdgpu_device *adev)
+--
+2.40.1
+
--- /dev/null
+From e9ee771f81ebfd8c77bff6c86a616e4a8f48ed84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Sep 2023 11:35:04 -0400
+Subject: drm/amdgpu/soc21: don't remap HDP registers for SR-IOV
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 1832403cd41ca6b19b24e9d64f79cb08d920ca44 ]
+
+This matches the behavior for soc15 and nv.
+
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Timmy Tsai <timmtsai@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/soc21.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/soc21.c b/drivers/gpu/drm/amd/amdgpu/soc21.c
+index d150a90daa403..56af7b5abac14 100644
+--- a/drivers/gpu/drm/amd/amdgpu/soc21.c
++++ b/drivers/gpu/drm/amd/amdgpu/soc21.c
+@@ -755,7 +755,7 @@ static int soc21_common_hw_init(void *handle)
+ * for the purpose of expose those registers
+ * to process space
+ */
+- if (adev->nbio.funcs->remap_hdp_registers)
++ if (adev->nbio.funcs->remap_hdp_registers && !amdgpu_sriov_vf(adev))
+ adev->nbio.funcs->remap_hdp_registers(adev);
+ /* enable the doorbell aperture */
+ soc21_enable_doorbell_aperture(adev, true);
+--
+2.40.1
+
--- /dev/null
+From e2f209ec32e6344ae21bd8f29aa9921081259f27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Sep 2023 11:03:49 +0200
+Subject: fbdev/sh7760fb: Depend on FB=y
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+[ Upstream commit f75f71b2c418a27a7c05139bb27a0c83adf88d19 ]
+
+Fix linker error if FB=m about missing fb_io_read and fb_io_write. The
+linker's error message suggests that this config setting has already
+been broken for other symbols.
+
+ All errors (new ones prefixed by >>):
+
+ sh4-linux-ld: drivers/video/fbdev/sh7760fb.o: in function `sh7760fb_probe':
+ sh7760fb.c:(.text+0x374): undefined reference to `framebuffer_alloc'
+ sh4-linux-ld: sh7760fb.c:(.text+0x394): undefined reference to `fb_videomode_to_var'
+ sh4-linux-ld: sh7760fb.c:(.text+0x39c): undefined reference to `fb_alloc_cmap'
+ sh4-linux-ld: sh7760fb.c:(.text+0x3a4): undefined reference to `register_framebuffer'
+ sh4-linux-ld: sh7760fb.c:(.text+0x3ac): undefined reference to `fb_dealloc_cmap'
+ sh4-linux-ld: sh7760fb.c:(.text+0x434): undefined reference to `framebuffer_release'
+ sh4-linux-ld: drivers/video/fbdev/sh7760fb.o: in function `sh7760fb_remove':
+ sh7760fb.c:(.text+0x800): undefined reference to `unregister_framebuffer'
+ sh4-linux-ld: sh7760fb.c:(.text+0x804): undefined reference to `fb_dealloc_cmap'
+ sh4-linux-ld: sh7760fb.c:(.text+0x814): undefined reference to `framebuffer_release'
+ >> sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0xc): undefined reference to `fb_io_read'
+ >> sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0x10): undefined reference to `fb_io_write'
+ sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0x2c): undefined reference to `cfb_fillrect'
+ sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0x30): undefined reference to `cfb_copyarea'
+ sh4-linux-ld: drivers/video/fbdev/sh7760fb.o:(.rodata+0x34): undefined reference to `cfb_imageblit'
+
+Suggested-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202309130632.LS04CPWu-lkp@intel.com/
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Acked-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230918090400.13264-1-tzimmermann@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
+index 974e862cd20d6..ff95f19224901 100644
+--- a/drivers/video/fbdev/Kconfig
++++ b/drivers/video/fbdev/Kconfig
+@@ -2015,7 +2015,7 @@ config FB_COBALT
+
+ config FB_SH7760
+ bool "SH7760/SH7763/SH7720/SH7721 LCDC support"
+- depends on FB && (CPU_SUBTYPE_SH7760 || CPU_SUBTYPE_SH7763 \
++ depends on FB=y && (CPU_SUBTYPE_SH7760 || CPU_SUBTYPE_SH7763 \
+ || CPU_SUBTYPE_SH7720 || CPU_SUBTYPE_SH7721)
+ select FB_CFB_FILLRECT
+ select FB_CFB_COPYAREA
+--
+2.40.1
+
--- /dev/null
+From 92f9fed4d5f0945823e1a9af76b8cdf8314e3281 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Sep 2023 17:05:23 +0100
+Subject: firmware: cirrus: cs_dsp: Only log list of algorithms in debug build
+
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+
+[ Upstream commit 69343ce91435f222052015c5af86b550391bac85 ]
+
+Change the logging of each algorithm from info level to debug level.
+
+On the original devices supported by this code there were typically only
+one or two algorithms in a firmware and one or two DSPs so this logging
+only used a small number of log lines.
+
+However, for the latest devices there could be 30-40 algorithms in a
+firmware and 8 DSPs being loaded in parallel, so using 300+ lines of log
+for information that isn't particularly important to have logged.
+
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20230913160523.3701189-1-rf@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/cirrus/cs_dsp.c | 34 ++++++++++++++++----------------
+ 1 file changed, 17 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/firmware/cirrus/cs_dsp.c b/drivers/firmware/cirrus/cs_dsp.c
+index 81c5f94b1be11..64ed9d3f5d5d8 100644
+--- a/drivers/firmware/cirrus/cs_dsp.c
++++ b/drivers/firmware/cirrus/cs_dsp.c
+@@ -1821,15 +1821,15 @@ static int cs_dsp_adsp2_setup_algs(struct cs_dsp *dsp)
+ return PTR_ERR(adsp2_alg);
+
+ for (i = 0; i < n_algs; i++) {
+- cs_dsp_info(dsp,
+- "%d: ID %x v%d.%d.%d XM@%x YM@%x ZM@%x\n",
+- i, be32_to_cpu(adsp2_alg[i].alg.id),
+- (be32_to_cpu(adsp2_alg[i].alg.ver) & 0xff0000) >> 16,
+- (be32_to_cpu(adsp2_alg[i].alg.ver) & 0xff00) >> 8,
+- be32_to_cpu(adsp2_alg[i].alg.ver) & 0xff,
+- be32_to_cpu(adsp2_alg[i].xm),
+- be32_to_cpu(adsp2_alg[i].ym),
+- be32_to_cpu(adsp2_alg[i].zm));
++ cs_dsp_dbg(dsp,
++ "%d: ID %x v%d.%d.%d XM@%x YM@%x ZM@%x\n",
++ i, be32_to_cpu(adsp2_alg[i].alg.id),
++ (be32_to_cpu(adsp2_alg[i].alg.ver) & 0xff0000) >> 16,
++ (be32_to_cpu(adsp2_alg[i].alg.ver) & 0xff00) >> 8,
++ be32_to_cpu(adsp2_alg[i].alg.ver) & 0xff,
++ be32_to_cpu(adsp2_alg[i].xm),
++ be32_to_cpu(adsp2_alg[i].ym),
++ be32_to_cpu(adsp2_alg[i].zm));
+
+ alg_region = cs_dsp_create_region(dsp, WMFW_ADSP2_XM,
+ adsp2_alg[i].alg.id,
+@@ -1954,14 +1954,14 @@ static int cs_dsp_halo_setup_algs(struct cs_dsp *dsp)
+ return PTR_ERR(halo_alg);
+
+ for (i = 0; i < n_algs; i++) {
+- cs_dsp_info(dsp,
+- "%d: ID %x v%d.%d.%d XM@%x YM@%x\n",
+- i, be32_to_cpu(halo_alg[i].alg.id),
+- (be32_to_cpu(halo_alg[i].alg.ver) & 0xff0000) >> 16,
+- (be32_to_cpu(halo_alg[i].alg.ver) & 0xff00) >> 8,
+- be32_to_cpu(halo_alg[i].alg.ver) & 0xff,
+- be32_to_cpu(halo_alg[i].xm_base),
+- be32_to_cpu(halo_alg[i].ym_base));
++ cs_dsp_dbg(dsp,
++ "%d: ID %x v%d.%d.%d XM@%x YM@%x\n",
++ i, be32_to_cpu(halo_alg[i].alg.id),
++ (be32_to_cpu(halo_alg[i].alg.ver) & 0xff0000) >> 16,
++ (be32_to_cpu(halo_alg[i].alg.ver) & 0xff00) >> 8,
++ be32_to_cpu(halo_alg[i].alg.ver) & 0xff,
++ be32_to_cpu(halo_alg[i].xm_base),
++ be32_to_cpu(halo_alg[i].ym_base));
+
+ ret = cs_dsp_halo_create_regions(dsp, halo_alg[i].alg.id,
+ halo_alg[i].alg.ver,
+--
+2.40.1
+
--- /dev/null
+From b3aef4101ef1e68fb3a94a4d9a7a06f712584999 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Sep 2023 14:26:29 +0800
+Subject: LoongArch: Set all reserved memblocks on Node#0 at initialization
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit b795fb9f5861ee256070d59e33130980a01fadd7 ]
+
+After commit 61167ad5fecdea ("mm: pass nid to reserve_bootmem_region()")
+we get a panic if DEFERRED_STRUCT_PAGE_INIT is enabled:
+
+[ 0.000000] CPU 0 Unable to handle kernel paging request at virtual address 0000000000002b82, era == 90000000040e3f28, ra == 90000000040e3f18
+[ 0.000000] Oops[#1]:
+[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.5.0+ #733
+[ 0.000000] pc 90000000040e3f28 ra 90000000040e3f18 tp 90000000046f4000 sp 90000000046f7c90
+[ 0.000000] a0 0000000000000001 a1 0000000000200000 a2 0000000000000040 a3 90000000046f7ca0
+[ 0.000000] a4 90000000046f7ca4 a5 0000000000000000 a6 90000000046f7c38 a7 0000000000000000
+[ 0.000000] t0 0000000000000002 t1 9000000004b00ac8 t2 90000000040e3f18 t3 90000000040f0800
+[ 0.000000] t4 00000000000f0000 t5 80000000ffffe07e t6 0000000000000003 t7 900000047fff5e20
+[ 0.000000] t8 aaaaaaaaaaaaaaab u0 0000000000000018 s9 0000000000000000 s0 fffffefffe000000
+[ 0.000000] s1 0000000000000000 s2 0000000000000080 s3 0000000000000040 s4 0000000000000000
+[ 0.000000] s5 0000000000000000 s6 fffffefffe000000 s7 900000000470b740 s8 9000000004ad4000
+[ 0.000000] ra: 90000000040e3f18 reserve_bootmem_region+0xec/0x21c
+[ 0.000000] ERA: 90000000040e3f28 reserve_bootmem_region+0xfc/0x21c
+[ 0.000000] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)
+[ 0.000000] PRMD: 00000000 (PPLV0 -PIE -PWE)
+[ 0.000000] EUEN: 00000000 (-FPE -SXE -ASXE -BTE)
+[ 0.000000] ECFG: 00070800 (LIE=11 VS=7)
+[ 0.000000] ESTAT: 00010800 [PIL] (IS=11 ECode=1 EsubCode=0)
+[ 0.000000] BADV: 0000000000002b82
+[ 0.000000] PRID: 0014d000 (Loongson-64bit, Loongson-3A6000)
+[ 0.000000] Modules linked in:
+[ 0.000000] Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____))
+[ 0.000000] Stack : 0000000000000000 9000000002eb5430 0000003a00000020 90000000045ccd00
+[ 0.000000] 900000000470e000 90000000002c1918 0000000000000000 9000000004110780
+[ 0.000000] 00000000fe6c0000 0000000480000000 9000000004b4e368 9000000004110748
+[ 0.000000] 0000000000000000 900000000421ca84 9000000004620000 9000000004564970
+[ 0.000000] 90000000046f7d78 9000000002cc9f70 90000000002c1918 900000000470e000
+[ 0.000000] 9000000004564970 90000000040bc0e0 90000000046f7d78 0000000000000000
+[ 0.000000] 0000000000004000 90000000045ccd00 0000000000000000 90000000002c1918
+[ 0.000000] 90000000002c1900 900000000470b700 9000000004b4df78 9000000004620000
+[ 0.000000] 90000000046200a8 90000000046200a8 0000000000000000 9000000004218b2c
+[ 0.000000] 9000000004270008 0000000000000001 0000000000000000 90000000045ccd00
+[ 0.000000] ...
+[ 0.000000] Call Trace:
+[ 0.000000] [<90000000040e3f28>] reserve_bootmem_region+0xfc/0x21c
+[ 0.000000] [<900000000421ca84>] memblock_free_all+0x114/0x350
+[ 0.000000] [<9000000004218b2c>] mm_core_init+0x138/0x3cc
+[ 0.000000] [<9000000004200e38>] start_kernel+0x488/0x7a4
+[ 0.000000] [<90000000040df0d8>] kernel_entry+0xd8/0xdc
+[ 0.000000]
+[ 0.000000] Code: 02eb21ad 00410f4c 380c31ac <262b818d> 6800b70d 02c1c196 0015001c 57fe4bb1 260002cd
+
+The reason is early memblock_reserve() in memblock_init() set node id to
+MAX_NUMNODES, making NODE_DATA(nid) a NULL dereference in the call chain
+reserve_bootmem_region() -> init_reserved_page(). After memblock_init(),
+those late calls of memblock_reserve() operate on subregions of memblock
+.memory regions. As a result, these reserved regions will be set to the
+correct node at the first iteration of memmap_init_reserved_pages().
+
+So set all reserved memblocks on Node#0 at initialization can avoid this
+panic.
+
+Reported-by: WANG Xuerui <git@xen0n.name>
+Tested-by: WANG Xuerui <git@xen0n.name>
+Reviewed-by: WANG Xuerui <git@xen0n.name> # with nits addressed
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/kernel/mem.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/loongarch/kernel/mem.c b/arch/loongarch/kernel/mem.c
+index 4a4107a6a9651..aed901c57fb43 100644
+--- a/arch/loongarch/kernel/mem.c
++++ b/arch/loongarch/kernel/mem.c
+@@ -50,7 +50,6 @@ void __init memblock_init(void)
+ }
+
+ memblock_set_current_limit(PFN_PHYS(max_low_pfn));
+- memblock_set_node(0, PHYS_ADDR_MAX, &memblock.memory, 0);
+
+ /* Reserve the first 2MB */
+ memblock_reserve(PHYS_OFFSET, 0x200000);
+@@ -58,4 +57,7 @@ void __init memblock_init(void)
+ /* Reserve the kernel text/data/bss */
+ memblock_reserve(__pa_symbol(&_text),
+ __pa_symbol(&_end) - __pa_symbol(&_text));
++
++ memblock_set_node(0, PHYS_ADDR_MAX, &memblock.memory, 0);
++ memblock_set_node(0, PHYS_ADDR_MAX, &memblock.reserved, 0);
+ }
+--
+2.40.1
+
--- /dev/null
+From 83888a3c469898c0fe41a672421cb12fa7d00b3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Aug 2023 12:41:32 +0200
+Subject: media: vb2: frame_vector.c: replace WARN_ONCE with a comment
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 735de5caf79e06cc9fb96b1b4f4974674ae3e917 ]
+
+The WARN_ONCE was issued also in cases that had nothing to do with VM_IO
+(e.g. if the start address was just a random value and uaccess fails with
+-EFAULT).
+
+There are no reports of WARN_ONCE being issued for actual VM_IO cases, so
+just drop it and instead add a note to the comment before the function.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Reported-by: Yikebaer Aizezi <yikebaer61@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/common/videobuf2/frame_vector.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/common/videobuf2/frame_vector.c b/drivers/media/common/videobuf2/frame_vector.c
+index 144027035892a..07ebe4424df3a 100644
+--- a/drivers/media/common/videobuf2/frame_vector.c
++++ b/drivers/media/common/videobuf2/frame_vector.c
+@@ -30,6 +30,10 @@
+ * different type underlying the specified range of virtual addresses.
+ * When the function isn't able to map a single page, it returns error.
+ *
++ * Note that get_vaddr_frames() cannot follow VM_IO mappings. It used
++ * to be able to do that, but that could (racily) return non-refcounted
++ * pfns.
++ *
+ * This function takes care of grabbing mmap_lock as necessary.
+ */
+ int get_vaddr_frames(unsigned long start, unsigned int nr_frames,
+@@ -55,8 +59,6 @@ int get_vaddr_frames(unsigned long start, unsigned int nr_frames,
+ if (likely(ret > 0))
+ return ret;
+
+- /* This used to (racily) return non-refcounted pfns. Let people know */
+- WARN_ONCE(1, "get_vaddr_frames() cannot follow VM_IO mapping");
+ vec->nr_frames = 0;
+ return ret ? ret : -EFAULT;
+ }
+--
+2.40.1
+
--- /dev/null
+From 50b5e5e21333778ff6a8b0ac6d5b10376ff7f0e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Sep 2023 09:24:51 +0300
+Subject: memblock tests: fix warning: "__ALIGN_KERNEL" redefined
+
+From: Mike Rapoport (IBM) <rppt@kernel.org>
+
+[ Upstream commit 5e1bffbdb63baf89f3bf0b6bafb50903432a7434 ]
+
+Building memblock tests produces the following warning:
+
+cc -I. -I../../include -Wall -O2 -fsanitize=address -fsanitize=undefined -D CONFIG_PHYS_ADDR_T_64BIT -c -o main.o main.c
+In file included from ../../include/linux/pfn.h:5,
+ from ./linux/memory_hotplug.h:6,
+ from ./linux/init.h:7,
+ from ./linux/memblock.h:11,
+ from tests/common.h:8,
+ from tests/basic_api.h:5,
+ from main.c:2:
+../../include/linux/mm.h:14: warning: "__ALIGN_KERNEL" redefined
+ 14 | #define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1)
+ |
+In file included from ../../include/linux/mm.h:6,
+ from ../../include/linux/pfn.h:5,
+ from ./linux/memory_hotplug.h:6,
+ from ./linux/init.h:7,
+ from ./linux/memblock.h:11,
+ from tests/common.h:8,
+ from tests/basic_api.h:5,
+ from main.c:2:
+../../include/uapi/linux/const.h:31: note: this is the location of the previous definition
+ 31 | #define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (__typeof__(x))(a) - 1)
+ |
+
+Remove definitions of __ALIGN_KERNEL and __ALIGN_KERNEL_MASK from
+tools/include/linux/mm.h to fix it.
+
+Signed-off-by: Mike Rapoport (IBM) <rppt@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/linux/mm.h | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/tools/include/linux/mm.h b/tools/include/linux/mm.h
+index a03d9bba51514..43be27bcc897d 100644
+--- a/tools/include/linux/mm.h
++++ b/tools/include/linux/mm.h
+@@ -11,8 +11,6 @@
+
+ #define PHYS_ADDR_MAX (~(phys_addr_t)0)
+
+-#define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1)
+-#define __ALIGN_KERNEL_MASK(x, mask) (((x) + (mask)) & ~(mask))
+ #define ALIGN(x, a) __ALIGN_KERNEL((x), (a))
+ #define ALIGN_DOWN(x, a) __ALIGN_KERNEL((x) - ((a) - 1), (a))
+
+--
+2.40.1
+
--- /dev/null
+From dd065519bb0216ae64ad11d8b8814a0d11dec30d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Sep 2023 10:45:40 +0300
+Subject: =?UTF-8?q?memblock=20tests:=20fix=20warning=20=E2=80=98struct=20s?=
+ =?UTF-8?q?eq=5Ffile=E2=80=99=20declared=20inside=20parameter=20list?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mike Rapoport (IBM) <rppt@kernel.org>
+
+[ Upstream commit 55122e0130e51eb71f5ec62d10525db0468f28e8 ]
+
+Building memblock tests produces the following warning:
+
+cc -I. -I../../include -Wall -O2 -fsanitize=address -fsanitize=undefined -D CONFIG_PHYS_ADDR_T_64BIT -c -o main.o main.c
+In file included from tests/common.h:9,
+ from tests/basic_api.h:5,
+ from main.c:2:
+./linux/memblock.h:601:50: warning: ‘struct seq_file’ declared inside parameter list will not be visible outside of this definition or declaration
+ 601 | static inline void memtest_report_meminfo(struct seq_file *m) { }
+ | ^~~~~~~~
+
+Add declaration of 'struct seq_file' to tools/include/linux/seq_file.h
+to fix it.
+
+Signed-off-by: Mike Rapoport (IBM) <rppt@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/linux/seq_file.h | 2 ++
+ tools/testing/memblock/tests/basic_api.c | 2 +-
+ tools/testing/memblock/tests/common.h | 1 +
+ 3 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/include/linux/seq_file.h b/tools/include/linux/seq_file.h
+index 102fd9217f1f9..f6bc226af0c1d 100644
+--- a/tools/include/linux/seq_file.h
++++ b/tools/include/linux/seq_file.h
+@@ -1,4 +1,6 @@
+ #ifndef _TOOLS_INCLUDE_LINUX_SEQ_FILE_H
+ #define _TOOLS_INCLUDE_LINUX_SEQ_FILE_H
+
++struct seq_file;
++
+ #endif /* _TOOLS_INCLUDE_LINUX_SEQ_FILE_H */
+diff --git a/tools/testing/memblock/tests/basic_api.c b/tools/testing/memblock/tests/basic_api.c
+index a13a57ba0815f..7ce628e31a431 100644
+--- a/tools/testing/memblock/tests/basic_api.c
++++ b/tools/testing/memblock/tests/basic_api.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0-or-later
++#include "basic_api.h"
+ #include <string.h>
+ #include <linux/memblock.h>
+-#include "basic_api.h"
+
+ #define EXPECTED_MEMBLOCK_REGIONS 128
+ #define FUNC_ADD "memblock_add"
+diff --git a/tools/testing/memblock/tests/common.h b/tools/testing/memblock/tests/common.h
+index d6bbbe63bfc36..4c33ce04c0645 100644
+--- a/tools/testing/memblock/tests/common.h
++++ b/tools/testing/memblock/tests/common.h
+@@ -5,6 +5,7 @@
+ #include <stdlib.h>
+ #include <assert.h>
+ #include <linux/types.h>
++#include <linux/seq_file.h>
+ #include <linux/memblock.h>
+ #include <linux/sizes.h>
+ #include <linux/printk.h>
+--
+2.40.1
+
--- /dev/null
+From d7017089ff7723bce847fd211b525a479632c02e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Sep 2023 09:12:35 -0700
+Subject: ncsi: Propagate carrier gain/loss events to the NCSI controller
+
+From: Johnathan Mantey <johnathanx.mantey@intel.com>
+
+[ Upstream commit 3780bb29311eccb7a1c9641032a112eed237f7e3 ]
+
+Report the carrier/no-carrier state for the network interface
+shared between the BMC and the passthrough channel. Without this
+functionality the BMC is unable to reconfigure the NIC in the event
+of a re-cabling to a different subnet.
+
+Signed-off-by: Johnathan Mantey <johnathanx.mantey@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ncsi/ncsi-aen.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/ncsi/ncsi-aen.c b/net/ncsi/ncsi-aen.c
+index 62fb1031763d1..f8854bff286cb 100644
+--- a/net/ncsi/ncsi-aen.c
++++ b/net/ncsi/ncsi-aen.c
+@@ -89,6 +89,11 @@ static int ncsi_aen_handler_lsc(struct ncsi_dev_priv *ndp,
+ if ((had_link == has_link) || chained)
+ return 0;
+
++ if (had_link)
++ netif_carrier_off(ndp->ndev.dev);
++ else
++ netif_carrier_on(ndp->ndev.dev);
++
+ if (!ndp->multi_package && !nc->package->multi_channel) {
+ if (had_link) {
+ ndp->flags |= NCSI_DEV_RESHUFFLE;
+--
+2.40.1
+
--- /dev/null
+From c586e59747a8ebdd16c913335711db715eb82b17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Sep 2023 20:10:03 +0200
+Subject: net: hsr: Add __packed to struct hsr_sup_tlv.
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit fbd825fcd7dd4c11d4c48c3d0adc248a4a0ce90b ]
+
+Struct hsr_sup_tlv describes HW layout and therefore it needs a __packed
+attribute to ensure the compiler does not add any padding.
+Due to the size and __packed attribute of the structs that use
+hsr_sup_tlv it has no functional impact.
+
+Add __packed to struct hsr_sup_tlv.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/hsr/hsr_main.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/hsr/hsr_main.h b/net/hsr/hsr_main.h
+index 16ae9fb09ccd2..58a5a8b3891ff 100644
+--- a/net/hsr/hsr_main.h
++++ b/net/hsr/hsr_main.h
+@@ -83,7 +83,7 @@ struct hsr_vlan_ethhdr {
+ struct hsr_sup_tlv {
+ u8 HSR_TLV_type;
+ u8 HSR_TLV_length;
+-};
++} __packed;
+
+ /* HSR/PRP Supervision Frame data types.
+ * Field names as defined in the IEC:2010 standard for HSR.
+--
+2.40.1
+
--- /dev/null
+From 3a6b249bd5967ea72691f3fe2d4408963ce5314e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Sep 2023 11:31:42 +0800
+Subject: net/smc: bugfix for smcr v2 server connect success statistic
+
+From: Guangguan Wang <guangguan.wang@linux.alibaba.com>
+
+[ Upstream commit 6912e724832c47bb381eb1bd1e483ec8df0d0f0f ]
+
+In the macro SMC_STAT_SERV_SUCC_INC, the smcd_version is used
+to determin whether to increase the v1 statistic or the v2
+statistic. It is correct for SMCD. But for SMCR, smcr_version
+should be used.
+
+Signed-off-by: Guangguan Wang <guangguan.wang@linux.alibaba.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_stats.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/smc/smc_stats.h b/net/smc/smc_stats.h
+index 84b7ecd8c05ca..4dbc237b7c19e 100644
+--- a/net/smc/smc_stats.h
++++ b/net/smc/smc_stats.h
+@@ -244,8 +244,9 @@ while (0)
+ #define SMC_STAT_SERV_SUCC_INC(net, _ini) \
+ do { \
+ typeof(_ini) i = (_ini); \
+- bool is_v2 = (i->smcd_version & SMC_V2); \
+ bool is_smcd = (i->is_smcd); \
++ u8 version = is_smcd ? i->smcd_version : i->smcr_version; \
++ bool is_v2 = (version & SMC_V2); \
+ typeof(net->smc.smc_stats) smc_stats = (net)->smc.smc_stats; \
+ if (is_v2 && is_smcd) \
+ this_cpu_inc(smc_stats->smc[SMC_TYPE_D].srv_v2_succ_cnt); \
+--
+2.40.1
+
--- /dev/null
+From cd65dc625a065f70c89cbd08884f8c211775d762 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Jul 2023 15:54:16 -0400
+Subject: NFSv4.1: fix zero value filehandle in post open getattr
+
+From: Olga Kornievskaia <kolga@netapp.com>
+
+[ Upstream commit 4506f23e117161a20104c8fa04f33e1ca63c26af ]
+
+Currently, if the OPEN compound experiencing an error and needs to
+get the file attributes separately, it will send a stand alone
+GETATTR but it would use the filehandle from the results of
+the OPEN compound. In case of the CLAIM_FH OPEN, nfs_openres's fh
+is zero value. That generate a GETATTR that's sent with a zero
+value filehandle, and results in the server returning an error.
+
+Instead, for the CLAIM_FH OPEN, take the filehandle that was used
+in the PUTFH of the OPEN compound.
+
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index acb1346da13e9..be570c65ae154 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2708,8 +2708,12 @@ static int _nfs4_proc_open(struct nfs4_opendata *data,
+ return status;
+ }
+ if (!(o_res->f_attr->valid & NFS_ATTR_FATTR)) {
++ struct nfs_fh *fh = &o_res->fh;
++
+ nfs4_sequence_free_slot(&o_res->seq_res);
+- nfs4_proc_getattr(server, &o_res->fh, o_res->f_attr, NULL);
++ if (o_arg->claim == NFS4_OPEN_CLAIM_FH)
++ fh = NFS_FH(d_inode(data->dentry));
++ nfs4_proc_getattr(server, fh, o_res->f_attr, NULL);
+ }
+ return 0;
+ }
+--
+2.40.1
+
--- /dev/null
+From eb02931163862f214b54479f7b0fb4a577a139d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Aug 2023 12:43:01 -0700
+Subject: nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid()
+
+From: Nigel Kirkland <nkirkland2304@gmail.com>
+
+[ Upstream commit 8ae5b3a685dc59a8cf7ccfe0e850999ba9727a3c ]
+
+The nvme_fc_fcp_op structure describing an AEN operation is initialized with a
+null request structure pointer. An FC LLDD may make a call to
+nvme_fc_io_getuuid passing a pointer to an nvmefc_fcp_req for an AEN operation.
+
+Add validation of the request structure pointer before dereference.
+
+Signed-off-by: Nigel Kirkland <nkirkland2304@gmail.com>
+Reviewed-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 6c3d469eed7e3..177a365b8ec55 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -1911,7 +1911,7 @@ char *nvme_fc_io_getuuid(struct nvmefc_fcp_req *req)
+ struct nvme_fc_fcp_op *op = fcp_req_to_fcp_op(req);
+ struct request *rq = op->rq;
+
+- if (!IS_ENABLED(CONFIG_BLK_CGROUP_FC_APPID) || !rq->bio)
++ if (!IS_ENABLED(CONFIG_BLK_CGROUP_FC_APPID) || !rq || !rq->bio)
+ return NULL;
+ return blkcg_get_fc_appid(rq->bio);
+ }
+--
+2.40.1
+
--- /dev/null
+From 9c62a67fc401bae093ad50487bb2071c1d30bfda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Aug 2023 22:08:32 +0200
+Subject: parisc: drivers: Fix sparse warning
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit b137b9d60b8add5620a06c687a71ce18776730b0 ]
+
+Fix "warning: directive in macro's argument list" warning.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/kernel/drivers.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c
+index e7ee0c0c91d35..8f12b9f318ae6 100644
+--- a/arch/parisc/kernel/drivers.c
++++ b/arch/parisc/kernel/drivers.c
+@@ -924,9 +924,9 @@ static __init void qemu_header(void)
+ pr_info("#define PARISC_MODEL \"%s\"\n\n",
+ boot_cpu_data.pdc.sys_model_name);
+
++ #define p ((unsigned long *)&boot_cpu_data.pdc.model)
+ pr_info("#define PARISC_PDC_MODEL 0x%lx, 0x%lx, 0x%lx, "
+ "0x%lx, 0x%lx, 0x%lx, 0x%lx, 0x%lx, 0x%lx\n\n",
+- #define p ((unsigned long *)&boot_cpu_data.pdc.model)
+ p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7], p[8]);
+ #undef p
+
+--
+2.40.1
+
--- /dev/null
+From 374d762e84eb3772f68e52b4fd2f79ee49f602e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Aug 2023 11:59:55 +0200
+Subject: parisc: iosapic.c: Fix sparse warnings
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit 927c6c8aa27c284a799b8c18784e37d3373af908 ]
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/parisc/iosapic.c | 4 ++--
+ drivers/parisc/iosapic_private.h | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/parisc/iosapic.c b/drivers/parisc/iosapic.c
+index bcc1dae007803..890c3c0f3d140 100644
+--- a/drivers/parisc/iosapic.c
++++ b/drivers/parisc/iosapic.c
+@@ -202,9 +202,9 @@ static inline void iosapic_write(void __iomem *iosapic, unsigned int reg, u32 va
+
+ static DEFINE_SPINLOCK(iosapic_lock);
+
+-static inline void iosapic_eoi(void __iomem *addr, unsigned int data)
++static inline void iosapic_eoi(__le32 __iomem *addr, __le32 data)
+ {
+- __raw_writel(data, addr);
++ __raw_writel((__force u32)data, addr);
+ }
+
+ /*
+diff --git a/drivers/parisc/iosapic_private.h b/drivers/parisc/iosapic_private.h
+index 73ecc657ad954..bd8ff40162b4b 100644
+--- a/drivers/parisc/iosapic_private.h
++++ b/drivers/parisc/iosapic_private.h
+@@ -118,8 +118,8 @@ struct iosapic_irt {
+ struct vector_info {
+ struct iosapic_info *iosapic; /* I/O SAPIC this vector is on */
+ struct irt_entry *irte; /* IRT entry */
+- u32 __iomem *eoi_addr; /* precalculate EOI reg address */
+- u32 eoi_data; /* IA64: ? PA: swapped txn_data */
++ __le32 __iomem *eoi_addr; /* precalculate EOI reg address */
++ __le32 eoi_data; /* IA64: ? PA: swapped txn_data */
+ int txn_irq; /* virtual IRQ number for processor */
+ ulong txn_addr; /* IA64: id_eid PA: partial HPA */
+ u32 txn_data; /* CPU interrupt bit */
+--
+2.40.1
+
--- /dev/null
+From 15cf53eb0dcfe75cfa8c17fc4f34586f63f00667 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Aug 2023 22:36:12 +0200
+Subject: parisc: irq: Make irq_stack_union static to avoid sparse warning
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit b1bef1388c427cdad7331a9c8eb4ebbbe5b954b0 ]
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/kernel/irq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/parisc/kernel/irq.c b/arch/parisc/kernel/irq.c
+index b05055f3ba4b8..9ddb2e3970589 100644
+--- a/arch/parisc/kernel/irq.c
++++ b/arch/parisc/kernel/irq.c
+@@ -368,7 +368,7 @@ union irq_stack_union {
+ volatile unsigned int lock[1];
+ };
+
+-DEFINE_PER_CPU(union irq_stack_union, irq_stack_union) = {
++static DEFINE_PER_CPU(union irq_stack_union, irq_stack_union) = {
+ .slock = { 1,1,1,1 },
+ };
+ #endif
+--
+2.40.1
+
--- /dev/null
+From 9d5de031e6900820a431591be32474fbccf5192d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Aug 2023 08:10:01 +0200
+Subject: parisc: sba: Fix compile warning wrt list of SBA devices
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit eb3255ee8f6f4691471a28fbf22db5e8901116cd ]
+
+Fix this makecheck warning:
+drivers/parisc/sba_iommu.c:98:19: warning: symbol 'sba_list'
+ was not declared. Should it be static?
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/include/asm/ropes.h | 3 +++
+ drivers/char/agp/parisc-agp.c | 2 --
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/parisc/include/asm/ropes.h b/arch/parisc/include/asm/ropes.h
+index 8e51c775c80a6..62399c7ea94a1 100644
+--- a/arch/parisc/include/asm/ropes.h
++++ b/arch/parisc/include/asm/ropes.h
+@@ -86,6 +86,9 @@ struct sba_device {
+ struct ioc ioc[MAX_IOC];
+ };
+
++/* list of SBA's in system, see drivers/parisc/sba_iommu.c */
++extern struct sba_device *sba_list;
++
+ #define ASTRO_RUNWAY_PORT 0x582
+ #define IKE_MERCED_PORT 0x803
+ #define REO_MERCED_PORT 0x804
+diff --git a/drivers/char/agp/parisc-agp.c b/drivers/char/agp/parisc-agp.c
+index 514f9f287a781..c6f181702b9a7 100644
+--- a/drivers/char/agp/parisc-agp.c
++++ b/drivers/char/agp/parisc-agp.c
+@@ -394,8 +394,6 @@ find_quicksilver(struct device *dev, void *data)
+ static int __init
+ parisc_agp_init(void)
+ {
+- extern struct sba_device *sba_list;
+-
+ int err = -1;
+ struct parisc_device *sba = NULL, *lba = NULL;
+ struct lba_device *lbadev = NULL;
+--
+2.40.1
+
--- /dev/null
+From 5731965113174bacbe79d0015551879e2274937d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Sep 2023 09:32:43 -0400
+Subject: platform/mellanox: mlxbf-bootctl: add NET dependency into Kconfig
+
+From: David Thompson <davthompson@nvidia.com>
+
+[ Upstream commit c2dffda1d8f7511505bbbf16ba282f2079b30089 ]
+
+The latest version of the mlxbf_bootctl driver utilizes
+"sysfs_format_mac", and this API is only available if
+NET is defined in the kernel configuration. This patch
+changes the mlxbf_bootctl Kconfig to depend on NET.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202309031058.JvwNDBKt-lkp@intel.com/
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: David Thompson <davthompson@nvidia.com>
+Link: https://lore.kernel.org/r/20230905133243.31550-1-davthompson@nvidia.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/mellanox/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/mellanox/Kconfig b/drivers/platform/mellanox/Kconfig
+index 30b50920b278c..f7dfa0e785fd6 100644
+--- a/drivers/platform/mellanox/Kconfig
++++ b/drivers/platform/mellanox/Kconfig
+@@ -60,6 +60,7 @@ config MLXBF_BOOTCTL
+ tristate "Mellanox BlueField Firmware Boot Control driver"
+ depends on ARM64
+ depends on ACPI
++ depends on NET
+ help
+ The Mellanox BlueField firmware implements functionality to
+ request swapping the primary and alternate eMMC boot partition,
+--
+2.40.1
+
--- /dev/null
+From 9d637c3947b0bcd2a2064147368119722ad769ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Sep 2023 20:28:13 +1200
+Subject: platform/x86: asus-wmi: Support 2023 ROG X16 tablet mode
+
+From: Luke D. Jones <luke@ljones.dev>
+
+[ Upstream commit 4106a70ddad57ee6d8f98b81d6f036740c72762b ]
+
+Add quirk for ASUS ROG X16 (GV601V, 2023 versions) Flow 2-in-1
+to enable tablet mode with lid flip (all screen rotations).
+
+Signed-off-by: Luke D. Jones <luke@ljones.dev>
+Link: https://lore.kernel.org/r/20230905082813.13470-1-luke@ljones.dev
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/asus-nb-wmi.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
+index fdf7da06af306..d85d895fee894 100644
+--- a/drivers/platform/x86/asus-nb-wmi.c
++++ b/drivers/platform/x86/asus-nb-wmi.c
+@@ -478,6 +478,15 @@ static const struct dmi_system_id asus_quirks[] = {
+ },
+ .driver_data = &quirk_asus_tablet_mode,
+ },
++ {
++ .callback = dmi_matched,
++ .ident = "ASUS ROG FLOW X16",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "GV601V"),
++ },
++ .driver_data = &quirk_asus_tablet_mode,
++ },
+ {
+ .callback = dmi_matched,
+ .ident = "ASUS VivoBook E410MA",
+--
+2.40.1
+
--- /dev/null
+From 05f0b10295598f0e3c1a5cdf675358b019ca8252 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Aug 2023 16:34:56 +1000
+Subject: powerpc/watchpoint: Disable pagefaults when getting user instruction
+
+From: Benjamin Gray <bgray@linux.ibm.com>
+
+[ Upstream commit 3241f260eb830d27d09cc604690ec24533fdb433 ]
+
+This is called in an atomic context, so is not allowed to sleep if a
+user page needs to be faulted in and has nowhere it can be deferred to.
+The pagefault_disabled() function is documented as preventing user
+access methods from sleeping.
+
+In practice the page will be mapped in nearly always because we are
+reading the instruction that just triggered the watchpoint trap.
+
+Signed-off-by: Benjamin Gray <bgray@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230829063457.54157-3-bgray@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/hw_breakpoint_constraints.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/hw_breakpoint_constraints.c b/arch/powerpc/kernel/hw_breakpoint_constraints.c
+index a74623025f3ab..9e51801c49152 100644
+--- a/arch/powerpc/kernel/hw_breakpoint_constraints.c
++++ b/arch/powerpc/kernel/hw_breakpoint_constraints.c
+@@ -131,8 +131,13 @@ void wp_get_instr_detail(struct pt_regs *regs, ppc_inst_t *instr,
+ int *type, int *size, unsigned long *ea)
+ {
+ struct instruction_op op;
++ int err;
+
+- if (__get_user_instr(*instr, (void __user *)regs->nip))
++ pagefault_disable();
++ err = __get_user_instr(*instr, (void __user *)regs->nip);
++ pagefault_enable();
++
++ if (err)
+ return;
+
+ analyse_instr(&op, regs, *instr);
+--
+2.40.1
+
--- /dev/null
+From b54a0bd9afe64f54b85fa4fc0a85ee1d4ef46950 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Aug 2023 16:34:57 +1000
+Subject: powerpc/watchpoints: Annotate atomic context in more places
+
+From: Benjamin Gray <bgray@linux.ibm.com>
+
+[ Upstream commit 27646b2e02b096a6936b3e3b6ba334ae20763eab ]
+
+It can be easy to miss that the notifier mechanism invokes the callbacks
+in an atomic context, so add some comments to that effect on the two
+handlers we register here.
+
+Signed-off-by: Benjamin Gray <bgray@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230829063457.54157-4-bgray@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/hw_breakpoint.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/arch/powerpc/kernel/hw_breakpoint.c b/arch/powerpc/kernel/hw_breakpoint.c
+index a72f86c130488..02436f80e60e2 100644
+--- a/arch/powerpc/kernel/hw_breakpoint.c
++++ b/arch/powerpc/kernel/hw_breakpoint.c
+@@ -637,6 +637,11 @@ static void handle_p10dd1_spurious_exception(struct arch_hw_breakpoint **info,
+ }
+ }
+
++/*
++ * Handle a DABR or DAWR exception.
++ *
++ * Called in atomic context.
++ */
+ int hw_breakpoint_handler(struct die_args *args)
+ {
+ bool err = false;
+@@ -763,6 +768,8 @@ NOKPROBE_SYMBOL(hw_breakpoint_handler);
+
+ /*
+ * Handle single-step exceptions following a DABR hit.
++ *
++ * Called in atomic context.
+ */
+ static int single_step_dabr_instruction(struct die_args *args)
+ {
+@@ -820,6 +827,8 @@ NOKPROBE_SYMBOL(single_step_dabr_instruction);
+
+ /*
+ * Handle debug exception notifications.
++ *
++ * Called in atomic context.
+ */
+ int hw_breakpoint_exceptions_notify(
+ struct notifier_block *unused, unsigned long val, void *data)
+--
+2.40.1
+
--- /dev/null
+From e883601550372d0f6ee76a9666fa6a8b8420bc52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Aug 2023 16:34:55 +1000
+Subject: powerpc/watchpoints: Disable preemption in thread_change_pc()
+
+From: Benjamin Gray <bgray@linux.ibm.com>
+
+[ Upstream commit cc879ab3ce39bc39f9b1d238b283f43a5f6f957d ]
+
+thread_change_pc() uses CPU local data, so must be protected from
+swapping CPUs while it is reading the breakpoint struct.
+
+The error is more noticeable after 1e60f3564bad ("powerpc/watchpoints:
+Track perf single step directly on the breakpoint"), which added an
+unconditional __this_cpu_read() call in thread_change_pc(). However the
+existing __this_cpu_read() that runs if a breakpoint does need to be
+re-inserted has the same issue.
+
+Signed-off-by: Benjamin Gray <bgray@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230829063457.54157-2-bgray@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/hw_breakpoint.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/hw_breakpoint.c b/arch/powerpc/kernel/hw_breakpoint.c
+index 8db1a15d7acbe..a72f86c130488 100644
+--- a/arch/powerpc/kernel/hw_breakpoint.c
++++ b/arch/powerpc/kernel/hw_breakpoint.c
+@@ -505,11 +505,13 @@ void thread_change_pc(struct task_struct *tsk, struct pt_regs *regs)
+ struct arch_hw_breakpoint *info;
+ int i;
+
++ preempt_disable();
++
+ for (i = 0; i < nr_wp_slots(); i++) {
+ if (unlikely(tsk->thread.last_hit_ubp[i]))
+ goto reset;
+ }
+- return;
++ goto out;
+
+ reset:
+ regs_set_return_msr(regs, regs->msr & ~MSR_SE);
+@@ -518,6 +520,9 @@ void thread_change_pc(struct task_struct *tsk, struct pt_regs *regs)
+ __set_breakpoint(i, info);
+ tsk->thread.last_hit_ubp[i] = NULL;
+ }
++
++out:
++ preempt_enable();
+ }
+
+ static bool is_larx_stcx_instr(int type)
+--
+2.40.1
+
--- /dev/null
+From 7cc9212abeb85760e8653911c3812b96ae19e832 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Sep 2023 16:19:30 +0800
+Subject: ring-buffer: Avoid softlockup in ring_buffer_resize()
+
+From: Zheng Yejian <zhengyejian1@huawei.com>
+
+[ Upstream commit f6bd2c92488c30ef53b5bd80c52f0a7eee9d545a ]
+
+When user resize all trace ring buffer through file 'buffer_size_kb',
+then in ring_buffer_resize(), kernel allocates buffer pages for each
+cpu in a loop.
+
+If the kernel preemption model is PREEMPT_NONE and there are many cpus
+and there are many buffer pages to be allocated, it may not give up cpu
+for a long time and finally cause a softlockup.
+
+To avoid it, call cond_resched() after each cpu buffer allocation.
+
+Link: https://lore.kernel.org/linux-trace-kernel/20230906081930.3939106-1-zhengyejian1@huawei.com
+
+Cc: <mhiramat@kernel.org>
+Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/ring_buffer.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index de55107aef5d5..42ad59a002365 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -2212,6 +2212,8 @@ int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size,
+ err = -ENOMEM;
+ goto out_err;
+ }
++
++ cond_resched();
+ }
+
+ cpus_read_lock();
+--
+2.40.1
+
--- /dev/null
+From 28d551a694b3b0400dd7f6ce22a32a93b46fa08a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Sep 2023 12:28:20 -0400
+Subject: ring-buffer: Do not attempt to read past "commit"
+
+From: Steven Rostedt (Google) <rostedt@goodmis.org>
+
+[ Upstream commit 95a404bd60af6c4d9d8db01ad14fe8957ece31ca ]
+
+When iterating over the ring buffer while the ring buffer is active, the
+writer can corrupt the reader. There's barriers to help detect this and
+handle it, but that code missed the case where the last event was at the
+very end of the page and has only 4 bytes left.
+
+The checks to detect the corruption by the writer to reads needs to see the
+length of the event. If the length in the first 4 bytes is zero then the
+length is stored in the second 4 bytes. But if the writer is in the process
+of updating that code, there's a small window where the length in the first
+4 bytes could be zero even though the length is only 4 bytes. That will
+cause rb_event_length() to read the next 4 bytes which could happen to be off the
+allocated page.
+
+To protect against this, fail immediately if the next event pointer is
+less than 8 bytes from the end of the commit (last byte of data), as all
+events must be a minimum of 8 bytes anyway.
+
+Link: https://lore.kernel.org/all/20230905141245.26470-1-Tze-nan.Wu@mediatek.com/
+Link: https://lore.kernel.org/linux-trace-kernel/20230907122820.0899019c@gandalf.local.home
+
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Reported-by: Tze-nan Wu <Tze-nan.Wu@mediatek.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/ring_buffer.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index 42ad59a002365..c0b708b55c3b9 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -2388,6 +2388,11 @@ rb_iter_head_event(struct ring_buffer_iter *iter)
+ */
+ commit = rb_page_commit(iter_head_page);
+ smp_rmb();
++
++ /* An event needs to be at least 8 bytes in size */
++ if (iter->head > commit - 8)
++ goto reset;
++
+ event = __rb_page_index(iter_head_page, iter->head);
+ length = rb_event_length(event);
+
+--
+2.40.1
+
--- /dev/null
+From 537f8e5b15a1ab2989a0c2970a6f79d99143027e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Sep 2023 15:24:10 +0800
+Subject: riscv: errata: fix T-Head dcache.cva encoding
+
+From: Icenowy Zheng <uwu@icenowy.me>
+
+[ Upstream commit 8eb8fe67e2c84324398f5983c41b4f831d0705b3 ]
+
+The dcache.cva encoding shown in the comments are wrong, it's for
+dcache.cval1 (which is restricted to L1) instead.
+
+Fix this in the comment and in the hardcoded instruction.
+
+Signed-off-by: Icenowy Zheng <uwu@icenowy.me>
+Tested-by: Sergey Matyukevich <sergey.matyukevich@syntacore.com>
+Reviewed-by: Heiko Stuebner <heiko@sntech.de>
+Reviewed-by: Guo Ren <guoren@kernel.org>
+Tested-by: Drew Fustini <dfustini@baylibre.com>
+Link: https://lore.kernel.org/r/20230912072410.2481-1-jszhang@kernel.org
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/include/asm/errata_list.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/riscv/include/asm/errata_list.h b/arch/riscv/include/asm/errata_list.h
+index 19a771085781a..7d2675bb71611 100644
+--- a/arch/riscv/include/asm/errata_list.h
++++ b/arch/riscv/include/asm/errata_list.h
+@@ -100,7 +100,7 @@ asm volatile(ALTERNATIVE( \
+ * | 31 - 25 | 24 - 20 | 19 - 15 | 14 - 12 | 11 - 7 | 6 - 0 |
+ * 0000001 01001 rs1 000 00000 0001011
+ * dcache.cva rs1 (clean, virtual address)
+- * 0000001 00100 rs1 000 00000 0001011
++ * 0000001 00101 rs1 000 00000 0001011
+ *
+ * dcache.cipa rs1 (clean then invalidate, physical address)
+ * | 31 - 25 | 24 - 20 | 19 - 15 | 14 - 12 | 11 - 7 | 6 - 0 |
+@@ -113,7 +113,7 @@ asm volatile(ALTERNATIVE( \
+ * 0000000 11001 00000 000 00000 0001011
+ */
+ #define THEAD_inval_A0 ".long 0x0265000b"
+-#define THEAD_clean_A0 ".long 0x0245000b"
++#define THEAD_clean_A0 ".long 0x0255000b"
+ #define THEAD_flush_A0 ".long 0x0275000b"
+ #define THEAD_SYNC_S ".long 0x0190000b"
+
+--
+2.40.1
+
--- /dev/null
+From 82a0b6d2d2e786a7092aa6864bd28a847d46d930 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Sep 2023 10:03:40 -0700
+Subject: scsi: pm80xx: Avoid leaking tags when processing
+ OPC_INB_SET_CONTROLLER_CONFIG command
+
+From: Michal Grzedzicki <mge@meta.com>
+
+[ Upstream commit c13e7331745852d0dd7c35eabbe181cbd5b01172 ]
+
+Tags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed
+when we receive the response.
+
+Signed-off-by: Michal Grzedzicki <mge@meta.com>
+Link: https://lore.kernel.org/r/20230911170340.699533-2-mge@meta.com
+Acked-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm80xx_hwi.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index bcccea7c1244a..2bf293e8f7472 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -3750,10 +3750,12 @@ static int mpi_set_controller_config_resp(struct pm8001_hba_info *pm8001_ha,
+ (struct set_ctrl_cfg_resp *)(piomb + 4);
+ u32 status = le32_to_cpu(pPayload->status);
+ u32 err_qlfr_pgcd = le32_to_cpu(pPayload->err_qlfr_pgcd);
++ u32 tag = le32_to_cpu(pPayload->tag);
+
+ pm8001_dbg(pm8001_ha, MSG,
+ "SET CONTROLLER RESP: status 0x%x qlfr_pgcd 0x%x\n",
+ status, err_qlfr_pgcd);
++ pm8001_tag_free(pm8001_ha, tag);
+
+ return 0;
+ }
+--
+2.40.1
+
--- /dev/null
+From 1107dc8780098f172b42abce53be88b53ba88891 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Sep 2023 08:56:10 -0700
+Subject: scsi: pm80xx: Use phy-specific SAS address when sending PHY_START
+ command
+
+From: Michal Grzedzicki <mge@meta.com>
+
+[ Upstream commit 71996bb835aed58c7ec4967be1d05190a27339ec ]
+
+Some cards have more than one SAS address. Using an incorrect address
+causes communication issues with some devices like expanders.
+
+Closes: https://lore.kernel.org/linux-kernel/A57AEA84-5CA0-403E-8053-106033C73C70@fb.com/
+Signed-off-by: Michal Grzedzicki <mge@meta.com>
+Link: https://lore.kernel.org/r/20230913155611.3183612-1-mge@meta.com
+Acked-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_hwi.c | 2 +-
+ drivers/scsi/pm8001/pm80xx_hwi.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
+index 628b08ba6770b..e2c52c2d00b33 100644
+--- a/drivers/scsi/pm8001/pm8001_hwi.c
++++ b/drivers/scsi/pm8001/pm8001_hwi.c
+@@ -4313,7 +4313,7 @@ pm8001_chip_phy_start_req(struct pm8001_hba_info *pm8001_ha, u8 phy_id)
+ payload.sas_identify.dev_type = SAS_END_DEVICE;
+ payload.sas_identify.initiator_bits = SAS_PROTOCOL_ALL;
+ memcpy(payload.sas_identify.sas_addr,
+- pm8001_ha->sas_addr, SAS_ADDR_SIZE);
++ &pm8001_ha->phy[phy_id].dev_sas_addr, SAS_ADDR_SIZE);
+ payload.sas_identify.phy_id = phy_id;
+
+ return pm8001_mpi_build_cmd(pm8001_ha, 0, opcode, &payload,
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index f8b8624458f73..bcccea7c1244a 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -4803,7 +4803,7 @@ pm80xx_chip_phy_start_req(struct pm8001_hba_info *pm8001_ha, u8 phy_id)
+ payload.sas_identify.dev_type = SAS_END_DEVICE;
+ payload.sas_identify.initiator_bits = SAS_PROTOCOL_ALL;
+ memcpy(payload.sas_identify.sas_addr,
+- &pm8001_ha->sas_addr, SAS_ADDR_SIZE);
++ &pm8001_ha->phy[phy_id].dev_sas_addr, SAS_ADDR_SIZE);
+ payload.sas_identify.phy_id = phy_id;
+
+ return pm8001_mpi_build_cmd(pm8001_ha, 0, opcode, &payload,
+--
+2.40.1
+
--- /dev/null
+From dcc16ecfe646efdb15b47967c65af25e47203d7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Sep 2023 11:36:46 +0530
+Subject: scsi: qedf: Add synchronization between I/O completions and abort
+
+From: Javed Hasan <jhasan@marvell.com>
+
+[ Upstream commit 7df0b2605489bef3f4223ad66f1f9bb8d50d4cd2 ]
+
+Avoid race condition between I/O completion and abort processing by
+protecting the cmd_type with the rport lock.
+
+Signed-off-by: Javed Hasan <jhasan@marvell.com>
+Signed-off-by: Saurav Kashyap <skashyap@marvell.com>
+Link: https://lore.kernel.org/r/20230901060646.27885-1-skashyap@marvell.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qedf/qedf_io.c | 10 ++++++++--
+ drivers/scsi/qedf/qedf_main.c | 7 ++++++-
+ 2 files changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/qedf/qedf_io.c b/drivers/scsi/qedf/qedf_io.c
+index 4750ec5789a80..10fe3383855c0 100644
+--- a/drivers/scsi/qedf/qedf_io.c
++++ b/drivers/scsi/qedf/qedf_io.c
+@@ -1904,6 +1904,7 @@ int qedf_initiate_abts(struct qedf_ioreq *io_req, bool return_scsi_cmd_on_abts)
+ goto drop_rdata_kref;
+ }
+
++ spin_lock_irqsave(&fcport->rport_lock, flags);
+ if (!test_bit(QEDF_CMD_OUTSTANDING, &io_req->flags) ||
+ test_bit(QEDF_CMD_IN_CLEANUP, &io_req->flags) ||
+ test_bit(QEDF_CMD_IN_ABORT, &io_req->flags)) {
+@@ -1911,17 +1912,20 @@ int qedf_initiate_abts(struct qedf_ioreq *io_req, bool return_scsi_cmd_on_abts)
+ "io_req xid=0x%x sc_cmd=%p already in cleanup or abort processing or already completed.\n",
+ io_req->xid, io_req->sc_cmd);
+ rc = 1;
++ spin_unlock_irqrestore(&fcport->rport_lock, flags);
+ goto drop_rdata_kref;
+ }
+
++ /* Set the command type to abort */
++ io_req->cmd_type = QEDF_ABTS;
++ spin_unlock_irqrestore(&fcport->rport_lock, flags);
++
+ kref_get(&io_req->refcount);
+
+ xid = io_req->xid;
+ qedf->control_requests++;
+ qedf->packet_aborts++;
+
+- /* Set the command type to abort */
+- io_req->cmd_type = QEDF_ABTS;
+ io_req->return_scsi_cmd_on_abts = return_scsi_cmd_on_abts;
+
+ set_bit(QEDF_CMD_IN_ABORT, &io_req->flags);
+@@ -2210,7 +2214,9 @@ int qedf_initiate_cleanup(struct qedf_ioreq *io_req,
+ refcount, fcport, fcport->rdata->ids.port_id);
+
+ /* Cleanup cmds re-use the same TID as the original I/O */
++ spin_lock_irqsave(&fcport->rport_lock, flags);
+ io_req->cmd_type = QEDF_CLEANUP;
++ spin_unlock_irqrestore(&fcport->rport_lock, flags);
+ io_req->return_scsi_cmd_on_abts = return_scsi_cmd_on_abts;
+
+ init_completion(&io_req->cleanup_done);
+diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
+index c4f293d39f228..d969b0dc97326 100644
+--- a/drivers/scsi/qedf/qedf_main.c
++++ b/drivers/scsi/qedf/qedf_main.c
+@@ -2807,6 +2807,8 @@ void qedf_process_cqe(struct qedf_ctx *qedf, struct fcoe_cqe *cqe)
+ struct qedf_ioreq *io_req;
+ struct qedf_rport *fcport;
+ u32 comp_type;
++ u8 io_comp_type;
++ unsigned long flags;
+
+ comp_type = (cqe->cqe_data >> FCOE_CQE_CQE_TYPE_SHIFT) &
+ FCOE_CQE_CQE_TYPE_MASK;
+@@ -2840,11 +2842,14 @@ void qedf_process_cqe(struct qedf_ctx *qedf, struct fcoe_cqe *cqe)
+ return;
+ }
+
++ spin_lock_irqsave(&fcport->rport_lock, flags);
++ io_comp_type = io_req->cmd_type;
++ spin_unlock_irqrestore(&fcport->rport_lock, flags);
+
+ switch (comp_type) {
+ case FCOE_GOOD_COMPLETION_CQE_TYPE:
+ atomic_inc(&fcport->free_sqes);
+- switch (io_req->cmd_type) {
++ switch (io_comp_type) {
+ case QEDF_SCSI_CMD:
+ qedf_scsi_completion(qedf, cqe, io_req);
+ break;
+--
+2.40.1
+
--- /dev/null
+From ec5ac8708e2405ccbeed61501d9611159b3d5919 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Sep 2023 10:30:44 +0900
+Subject: scsi: ufs: core: Move __ufshcd_send_uic_cmd() outside host_lock
+
+From: Kiwoong Kim <kwmad.kim@samsung.com>
+
+[ Upstream commit 2d3f59cf868b4a2dd678a96cd49bdd91411bd59f ]
+
+__ufshcd_send_uic_cmd() is wrapped by uic_cmd_mutex and its related
+contexts are accessed within the section wrapped by uic_cmd_mutex. Thus,
+wrapping with host_lock is redundant.
+
+Signed-off-by: Kiwoong Kim <kwmad.kim@samsung.com>
+Link: https://lore.kernel.org/r/782ba5f26f0a96e58d85dff50751787d2d2a6b2b.1693790060.git.kwmad.kim@samsung.com
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Chanwoo Lee <cw9316.lee@samsung.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufshcd.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index 36437d39b93c8..135be6dd02523 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -2346,7 +2346,6 @@ __ufshcd_send_uic_cmd(struct ufs_hba *hba, struct uic_command *uic_cmd,
+ bool completion)
+ {
+ lockdep_assert_held(&hba->uic_cmd_mutex);
+- lockdep_assert_held(hba->host->host_lock);
+
+ if (!ufshcd_ready_for_uic_cmd(hba)) {
+ dev_err(hba->dev,
+@@ -2373,7 +2372,6 @@ __ufshcd_send_uic_cmd(struct ufs_hba *hba, struct uic_command *uic_cmd,
+ int ufshcd_send_uic_cmd(struct ufs_hba *hba, struct uic_command *uic_cmd)
+ {
+ int ret;
+- unsigned long flags;
+
+ if (hba->quirks & UFSHCD_QUIRK_BROKEN_UIC_CMD)
+ return 0;
+@@ -2382,9 +2380,7 @@ int ufshcd_send_uic_cmd(struct ufs_hba *hba, struct uic_command *uic_cmd)
+ mutex_lock(&hba->uic_cmd_mutex);
+ ufshcd_add_delay_before_dme_cmd(hba);
+
+- spin_lock_irqsave(hba->host->host_lock, flags);
+ ret = __ufshcd_send_uic_cmd(hba, uic_cmd, true);
+- spin_unlock_irqrestore(hba->host->host_lock, flags);
+ if (!ret)
+ ret = ufshcd_wait_for_uic_cmd(hba, uic_cmd);
+
+@@ -4076,8 +4072,8 @@ static int ufshcd_uic_pwr_ctrl(struct ufs_hba *hba, struct uic_command *cmd)
+ wmb();
+ reenable_intr = true;
+ }
+- ret = __ufshcd_send_uic_cmd(hba, cmd, false);
+ spin_unlock_irqrestore(hba->host->host_lock, flags);
++ ret = __ufshcd_send_uic_cmd(hba, cmd, false);
+ if (ret) {
+ dev_err(hba->dev,
+ "pwr ctrl cmd 0x%x with mode 0x%x uic error %d\n",
+--
+2.40.1
+
--- /dev/null
+From 60ff0d650ccd1f9de094d7bfa9258c71b8d5eaa1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Sep 2023 10:30:45 +0900
+Subject: scsi: ufs: core: Poll HCS.UCRDY before issuing a UIC command
+
+From: Kiwoong Kim <kwmad.kim@samsung.com>
+
+[ Upstream commit d32533d30e2119b0c0aa17596734f1f842f750df ]
+
+With auto hibern8 enabled, UIC could be busy processing a hibern8 operation
+and the HCI would reports UIC not ready for a short while through
+HCS.UCRDY. The UFS driver doesn't currently handle this situation. The
+UFSHCI spec specifies UCRDY like this: whether the host controller is ready
+to process UIC COMMAND
+
+The 'ready' could be seen as many different meanings. If the meaning
+includes not processing any request from HCI, processing a hibern8
+operation can be 'not ready'. In this situation, the driver needs to wait
+until the operations is completed.
+
+Signed-off-by: Kiwoong Kim <kwmad.kim@samsung.com>
+Link: https://lore.kernel.org/r/550484ffb66300bdcec63d3e304dfd55cb432f1f.1693790060.git.kwmad.kim@samsung.com
+Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
+Reviewed-by: Chanwoo Lee <cw9316.lee@samsung.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufshcd.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index 135be6dd02523..b4e3f14b9a3d7 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -22,6 +22,7 @@
+ #include <linux/module.h>
+ #include <linux/regulator/consumer.h>
+ #include <linux/sched/clock.h>
++#include <linux/iopoll.h>
+ #include <scsi/scsi_cmnd.h>
+ #include <scsi/scsi_dbg.h>
+ #include <scsi/scsi_driver.h>
+@@ -2254,7 +2255,11 @@ static inline int ufshcd_hba_capabilities(struct ufs_hba *hba)
+ */
+ static inline bool ufshcd_ready_for_uic_cmd(struct ufs_hba *hba)
+ {
+- return ufshcd_readl(hba, REG_CONTROLLER_STATUS) & UIC_COMMAND_READY;
++ u32 val;
++ int ret = read_poll_timeout(ufshcd_readl, val, val & UIC_COMMAND_READY,
++ 500, UIC_CMD_TIMEOUT * 1000, false, hba,
++ REG_CONTROLLER_STATUS);
++ return ret == 0 ? true : false;
+ }
+
+ /**
+--
+2.40.1
+
--- /dev/null
+From 97a7e68da56c39d915302447a32a0369bfe30492 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Aug 2023 18:09:40 -0300
+Subject: selftests: fix dependency checker script
+
+From: Ricardo B. Marliere <rbmarliere@gmail.com>
+
+[ Upstream commit 5f9dd2e896a91bfca90f8463eb6808c03d535d8a ]
+
+This patch fixes inconsistencies in the parsing rules of the levels 1
+and 2 of the kselftest_deps.sh. It was added the levels 4 and 5 to
+account for a few edge cases that are present in some tests, also some
+minor identation styling have been fixed (s/ /\t/g).
+
+Signed-off-by: Ricardo B. Marliere <rbmarliere@gmail.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/kselftest_deps.sh | 77 +++++++++++++++++++----
+ 1 file changed, 65 insertions(+), 12 deletions(-)
+
+diff --git a/tools/testing/selftests/kselftest_deps.sh b/tools/testing/selftests/kselftest_deps.sh
+index 708cb54296336..47a1281a3b702 100755
+--- a/tools/testing/selftests/kselftest_deps.sh
++++ b/tools/testing/selftests/kselftest_deps.sh
+@@ -46,11 +46,11 @@ fi
+ print_targets=0
+
+ while getopts "p" arg; do
+- case $arg in
+- p)
++ case $arg in
++ p)
+ print_targets=1
+ shift;;
+- esac
++ esac
+ done
+
+ if [ $# -eq 0 ]
+@@ -92,6 +92,10 @@ pass_cnt=0
+ # Get all TARGETS from selftests Makefile
+ targets=$(egrep "^TARGETS +|^TARGETS =" Makefile | cut -d "=" -f2)
+
++# Initially, in LDLIBS related lines, the dep checker needs
++# to ignore lines containing the following strings:
++filter="\$(VAR_LDLIBS)\|pkg-config\|PKG_CONFIG\|IOURING_EXTRA_LIBS"
++
+ # Single test case
+ if [ $# -eq 2 ]
+ then
+@@ -100,6 +104,8 @@ then
+ l1_test $test
+ l2_test $test
+ l3_test $test
++ l4_test $test
++ l5_test $test
+
+ print_results $1 $2
+ exit $?
+@@ -113,7 +119,7 @@ fi
+ # Append space at the end of the list to append more tests.
+
+ l1_tests=$(grep -r --include=Makefile "^LDLIBS" | \
+- grep -v "VAR_LDLIBS" | awk -F: '{print $1}')
++ grep -v "$filter" | awk -F: '{print $1}' | uniq)
+
+ # Level 2: LDLIBS set dynamically.
+ #
+@@ -126,7 +132,7 @@ l1_tests=$(grep -r --include=Makefile "^LDLIBS" | \
+ # Append space at the end of the list to append more tests.
+
+ l2_tests=$(grep -r --include=Makefile ": LDLIBS" | \
+- grep -v "VAR_LDLIBS" | awk -F: '{print $1}')
++ grep -v "$filter" | awk -F: '{print $1}' | uniq)
+
+ # Level 3
+ # memfd and others use pkg-config to find mount and fuse libs
+@@ -138,11 +144,32 @@ l2_tests=$(grep -r --include=Makefile ": LDLIBS" | \
+ # VAR_LDLIBS := $(shell pkg-config fuse --libs 2>/dev/null)
+
+ l3_tests=$(grep -r --include=Makefile "^VAR_LDLIBS" | \
+- grep -v "pkg-config" | awk -F: '{print $1}')
++ grep -v "pkg-config\|PKG_CONFIG" | awk -F: '{print $1}' | uniq)
+
+-#echo $l1_tests
+-#echo $l2_1_tests
+-#echo $l3_tests
++# Level 4
++# some tests may fall back to default using `|| echo -l<libname>`
++# if pkg-config doesn't find the libs, instead of using VAR_LDLIBS
++# as per level 3 checks.
++# e.g:
++# netfilter/Makefile
++# LDLIBS += $(shell $(HOSTPKG_CONFIG) --libs libmnl 2>/dev/null || echo -lmnl)
++l4_tests=$(grep -r --include=Makefile "^LDLIBS" | \
++ grep "pkg-config\|PKG_CONFIG" | awk -F: '{print $1}' | uniq)
++
++# Level 5
++# some tests may use IOURING_EXTRA_LIBS to add extra libs to LDLIBS,
++# which in turn may be defined in a sub-Makefile
++# e.g.:
++# mm/Makefile
++# $(OUTPUT)/gup_longterm: LDLIBS += $(IOURING_EXTRA_LIBS)
++l5_tests=$(grep -r --include=Makefile "LDLIBS +=.*\$(IOURING_EXTRA_LIBS)" | \
++ awk -F: '{print $1}' | uniq)
++
++#echo l1_tests $l1_tests
++#echo l2_tests $l2_tests
++#echo l3_tests $l3_tests
++#echo l4_tests $l4_tests
++#echo l5_tests $l5_tests
+
+ all_tests
+ print_results $1 $2
+@@ -164,24 +191,32 @@ all_tests()
+ for test in $l3_tests; do
+ l3_test $test
+ done
++
++ for test in $l4_tests; do
++ l4_test $test
++ done
++
++ for test in $l5_tests; do
++ l5_test $test
++ done
+ }
+
+ # Use same parsing used for l1_tests and pick libraries this time.
+ l1_test()
+ {
+ test_libs=$(grep --include=Makefile "^LDLIBS" $test | \
+- grep -v "VAR_LDLIBS" | \
++ grep -v "$filter" | \
+ sed -e 's/\:/ /' | \
+ sed -e 's/+/ /' | cut -d "=" -f 2)
+
+ check_libs $test $test_libs
+ }
+
+-# Use same parsing used for l2__tests and pick libraries this time.
++# Use same parsing used for l2_tests and pick libraries this time.
+ l2_test()
+ {
+ test_libs=$(grep --include=Makefile ": LDLIBS" $test | \
+- grep -v "VAR_LDLIBS" | \
++ grep -v "$filter" | \
+ sed -e 's/\:/ /' | sed -e 's/+/ /' | \
+ cut -d "=" -f 2)
+
+@@ -197,6 +232,24 @@ l3_test()
+ check_libs $test $test_libs
+ }
+
++l4_test()
++{
++ test_libs=$(grep --include=Makefile "^VAR_LDLIBS\|^LDLIBS" $test | \
++ grep "\(pkg-config\|PKG_CONFIG\).*|| echo " | \
++ sed -e 's/.*|| echo //' | sed -e 's/)$//')
++
++ check_libs $test $test_libs
++}
++
++l5_test()
++{
++ tests=$(find $(dirname "$test") -type f -name "*.mk")
++ test_libs=$(grep "^IOURING_EXTRA_LIBS +\?=" $tests | \
++ cut -d "=" -f 2)
++
++ check_libs $test $test_libs
++}
++
+ check_libs()
+ {
+
+--
+2.40.1
+
--- /dev/null
+From 67e52613d91b0ea3e2787cb5b8001e555003f8e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jun 2023 08:11:44 +0800
+Subject: selftests/ftrace: Correctly enable event in instance-event.tc
+
+From: Zheng Yejian <zhengyejian1@huawei.com>
+
+[ Upstream commit f4e4ada586995b17f828c6d147d1800eb1471450 ]
+
+Function instance_set() expects to enable event 'sched_switch', so we
+should set 1 to its 'enable' file.
+
+Testcase passed after this patch:
+ # ./ftracetest test.d/instances/instance-event.tc
+ === Ftrace unit tests ===
+ [1] Test creation and deletion of trace instances while setting an event
+ [PASS]
+
+ # of passed: 1
+ # of failed: 0
+ # of unresolved: 0
+ # of untested: 0
+ # of unsupported: 0
+ # of xfailed: 0
+ # of undefined(test bug): 0
+
+Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../testing/selftests/ftrace/test.d/instances/instance-event.tc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc b/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc
+index 0eb47fbb3f44d..42422e4251078 100644
+--- a/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc
++++ b/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc
+@@ -39,7 +39,7 @@ instance_read() {
+
+ instance_set() {
+ while :; do
+- echo 1 > foo/events/sched/sched_switch
++ echo 1 > foo/events/sched/sched_switch/enable
+ done 2> /dev/null
+ }
+
+--
+2.40.1
+
firmware-arm_ffa-don-t-set-the-memory-region-attribu.patch
gpio-pmic-eic-sprd-add-can_sleep-flag-for-pmic-eic-c.patch
i2c-npcm7xx-fix-callback-completion-ordering.patch
+x86-reboot-vmclear-active-vmcses-before-emergency-re.patch
+ceph-drop-messages-from-mds-when-unmounting.patch
+dma-debug-don-t-call-__dma_entry_alloc_check_leak-un.patch
+bpf-annotate-bpf_long_memcpy-with-data_race.patch
+spi-sun6i-reduce-dma-rx-transfer-width-to-single-byt.patch
+spi-sun6i-fix-race-between-dma-rx-transfer-completio.patch
+nvme-fc-prevent-null-pointer-dereference-in-nvme_fc_.patch
+parisc-sba-fix-compile-warning-wrt-list-of-sba-devic.patch
+parisc-iosapic.c-fix-sparse-warnings.patch
+parisc-drivers-fix-sparse-warning.patch
+parisc-irq-make-irq_stack_union-static-to-avoid-spar.patch
+scsi-qedf-add-synchronization-between-i-o-completion.patch
+scsi-ufs-core-move-__ufshcd_send_uic_cmd-outside-hos.patch
+scsi-ufs-core-poll-hcs.ucrdy-before-issuing-a-uic-co.patch
+selftests-ftrace-correctly-enable-event-in-instance-.patch
+ring-buffer-avoid-softlockup-in-ring_buffer_resize.patch
+btrfs-assert-delayed-node-locked-when-removing-delay.patch
+selftests-fix-dependency-checker-script.patch
+ring-buffer-do-not-attempt-to-read-past-commit.patch
+net-smc-bugfix-for-smcr-v2-server-connect-success-st.patch
+ata-sata_mv-fix-incorrect-string-length-computation-.patch
+platform-mellanox-mlxbf-bootctl-add-net-dependency-i.patch
+platform-x86-asus-wmi-support-2023-rog-x16-tablet-mo.patch
+thermal-of-add-missing-of_node_put.patch
+drm-amd-display-don-t-check-registers-if-using-aux-b.patch
+drm-amdgpu-soc21-don-t-remap-hdp-registers-for-sr-io.patch
+drm-amdgpu-nbio4.3-set-proper-rmmio_remap.reg_offset.patch
+drm-amdgpu-handle-null-atom-context-in-vbios-info-io.patch
+riscv-errata-fix-t-head-dcache.cva-encoding.patch
+scsi-pm80xx-use-phy-specific-sas-address-when-sendin.patch
+scsi-pm80xx-avoid-leaking-tags-when-processing-opc_i.patch
+smb3-correct-places-where-enotsupp-is-used-instead-o.patch
+ata-libata-eh-do-not-clear-ata_pflag_eh_pending-in-a.patch
+spi-nxp-fspi-reset-the-flshxcr1-registers.patch
+spi-stm32-add-a-delay-before-spi-disable.patch
+asoc-fsl-imx-pcm-rpmsg-add-sndrv_pcm_info_batch-flag.patch
+spi-intel-pci-add-support-for-granite-rapids-spi-ser.patch
+bpf-ensure-unit_size-is-matched-with-slab-cache-obje.patch
+bpf-clarify-error-expectations-from-bpf_clone_redire.patch
+alsa-hda-intel-sdw-acpi-use-u8-type-for-link-index.patch
+asoc-cs42l42-ensure-a-reset-pulse-meets-minimum-puls.patch
+asoc-cs42l42-don-t-rely-on-gpiod_out_low-to-set-rese.patch
+firmware-cirrus-cs_dsp-only-log-list-of-algorithms-i.patch
+memblock-tests-fix-warning-__align_kernel-redefined.patch
+memblock-tests-fix-warning-struct-seq_file-declared-.patch
+asoc-imx-rpmsg-set-ignore_pmdown_time-for-dai_link.patch
+media-vb2-frame_vector.c-replace-warn_once-with-a-co.patch
+nfsv4.1-fix-zero-value-filehandle-in-post-open-getat.patch
+asoc-sof-intel-mtl-reduce-the-dsp-init-timeout.patch
+powerpc-watchpoints-disable-preemption-in-thread_cha.patch
+powerpc-watchpoint-disable-pagefaults-when-getting-u.patch
+powerpc-watchpoints-annotate-atomic-context-in-more-.patch
+ncsi-propagate-carrier-gain-loss-events-to-the-ncsi-.patch
+net-hsr-add-__packed-to-struct-hsr_sup_tlv.patch
+tsnep-fix-napi-scheduling.patch
+tsnep-fix-napi-polling-with-budget-0.patch
+loongarch-set-all-reserved-memblocks-on-node-0-at-in.patch
+fbdev-sh7760fb-depend-on-fb-y.patch
--- /dev/null
+From 4af5c372421288043ad640b7104e3cb81682443c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Sep 2023 01:10:40 -0500
+Subject: smb3: correct places where ENOTSUPP is used instead of preferred
+ EOPNOTSUPP
+
+From: Steve French <stfrench@microsoft.com>
+
+[ Upstream commit ebc3d4e44a7e05457825e03d0560153687265523 ]
+
+checkpatch flagged a few places with:
+ WARNING: ENOTSUPP is not a SUSV4 error code, prefer EOPNOTSUPP
+Also fixed minor typo
+
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/inode.c | 2 +-
+ fs/smb/client/smb2ops.c | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c
+index 92c1ed9304be7..9531ea2430899 100644
+--- a/fs/smb/client/inode.c
++++ b/fs/smb/client/inode.c
+@@ -2605,7 +2605,7 @@ int cifs_fiemap(struct inode *inode, struct fiemap_extent_info *fei, u64 start,
+ }
+
+ cifsFileInfo_put(cfile);
+- return -ENOTSUPP;
++ return -EOPNOTSUPP;
+ }
+
+ int cifs_truncate_page(struct address_space *mapping, loff_t from)
+diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c
+index 1387d5126f53b..efff7137412b4 100644
+--- a/fs/smb/client/smb2ops.c
++++ b/fs/smb/client/smb2ops.c
+@@ -292,7 +292,7 @@ smb2_adjust_credits(struct TCP_Server_Info *server,
+ cifs_server_dbg(VFS, "request has less credits (%d) than required (%d)",
+ credits->value, new_val);
+
+- return -ENOTSUPP;
++ return -EOPNOTSUPP;
+ }
+
+ spin_lock(&server->req_lock);
+@@ -1155,7 +1155,7 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon,
+ /* Use a fudge factor of 256 bytes in case we collide
+ * with a different set_EAs command.
+ */
+- if(CIFSMaxBufSize - MAX_SMB2_CREATE_RESPONSE_SIZE -
++ if (CIFSMaxBufSize - MAX_SMB2_CREATE_RESPONSE_SIZE -
+ MAX_SMB2_CLOSE_RESPONSE_SIZE - 256 <
+ used_len + ea_name_len + ea_value_len + 1) {
+ rc = -ENOSPC;
+@@ -4721,7 +4721,7 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid,
+
+ if (shdr->Command != SMB2_READ) {
+ cifs_server_dbg(VFS, "only big read responses are supported\n");
+- return -ENOTSUPP;
++ return -EOPNOTSUPP;
+ }
+
+ if (server->ops->is_session_expired &&
+--
+2.40.1
+
--- /dev/null
+From 8173c55d565f1608d6ce90ee1a3838e8e29242eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Sep 2023 10:46:16 +0300
+Subject: spi: intel-pci: Add support for Granite Rapids SPI serial flash
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+[ Upstream commit 9855d60cfc720ff32355484c119acafd3c4dc806 ]
+
+Intel Granite Rapids has a flash controller that is compatible with the
+other Cannon Lake derivatives. Add Granite Rapids PCI ID to the driver
+list of supported devices.
+
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Link: https://lore.kernel.org/r/20230911074616.3473347-1-mika.westerberg@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-intel-pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/spi/spi-intel-pci.c b/drivers/spi/spi-intel-pci.c
+index f0d532ea40e82..b718a74fa3edc 100644
+--- a/drivers/spi/spi-intel-pci.c
++++ b/drivers/spi/spi-intel-pci.c
+@@ -72,6 +72,7 @@ static const struct pci_device_id intel_spi_pci_ids[] = {
+ { PCI_VDEVICE(INTEL, 0x4da4), (unsigned long)&bxt_info },
+ { PCI_VDEVICE(INTEL, 0x51a4), (unsigned long)&cnl_info },
+ { PCI_VDEVICE(INTEL, 0x54a4), (unsigned long)&cnl_info },
++ { PCI_VDEVICE(INTEL, 0x5794), (unsigned long)&cnl_info },
+ { PCI_VDEVICE(INTEL, 0x7a24), (unsigned long)&cnl_info },
+ { PCI_VDEVICE(INTEL, 0x7aa4), (unsigned long)&cnl_info },
+ { PCI_VDEVICE(INTEL, 0x7e23), (unsigned long)&cnl_info },
+--
+2.40.1
+
--- /dev/null
+From fd0931dced7755d7d27ba9dd63269448dcb004c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Sep 2023 13:32:54 -0500
+Subject: spi: nxp-fspi: reset the FLSHxCR1 registers
+
+From: Han Xu <han.xu@nxp.com>
+
+[ Upstream commit 18495676f7886e105133f1dc06c1d5e8d5436f32 ]
+
+Reset the FLSHxCR1 registers to default value. ROM may set the register
+value and it affects the SPI NAND normal functions.
+
+Signed-off-by: Han Xu <han.xu@nxp.com>
+Link: https://lore.kernel.org/r/20230906183254.235847-1-han.xu@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-nxp-fspi.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/spi/spi-nxp-fspi.c b/drivers/spi/spi-nxp-fspi.c
+index d6a65a989ef80..c7a4a3606547e 100644
+--- a/drivers/spi/spi-nxp-fspi.c
++++ b/drivers/spi/spi-nxp-fspi.c
+@@ -1029,6 +1029,13 @@ static int nxp_fspi_default_setup(struct nxp_fspi *f)
+ fspi_writel(f, FSPI_AHBCR_PREF_EN | FSPI_AHBCR_RDADDROPT,
+ base + FSPI_AHBCR);
+
++ /* Reset the FLSHxCR1 registers. */
++ reg = FSPI_FLSHXCR1_TCSH(0x3) | FSPI_FLSHXCR1_TCSS(0x3);
++ fspi_writel(f, reg, base + FSPI_FLSHA1CR1);
++ fspi_writel(f, reg, base + FSPI_FLSHA2CR1);
++ fspi_writel(f, reg, base + FSPI_FLSHB1CR1);
++ fspi_writel(f, reg, base + FSPI_FLSHB2CR1);
++
+ /* AHB Read - Set lut sequence ID for all CS. */
+ fspi_writel(f, SEQID_LUT, base + FSPI_FLSHA1CR2);
+ fspi_writel(f, SEQID_LUT, base + FSPI_FLSHA2CR2);
+--
+2.40.1
+
--- /dev/null
+From 83c263f18be95faf37d90ff24fd6351f3942c76c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Sep 2023 15:27:35 +0200
+Subject: spi: stm32: add a delay before SPI disable
+
+From: Valentin Caron <valentin.caron@foss.st.com>
+
+[ Upstream commit 6de8a70c84ee0586fdde4e671626b9caca6aed74 ]
+
+As explained in errata sheet, in section "2.14.5 Truncation of SPI output
+signals after EOT event":
+On STM32MP1x, EOT interrupt can be thrown before the true end of
+communication.
+
+So we add a delay of a half period to wait the real end of the
+transmission.
+
+Link: https://www.st.com/resource/en/errata_sheet/es0539-stm32mp131x3x5x-device-errata-stmicroelectronics.pdf
+Signed-off-by: Valentin Caron <valentin.caron@foss.st.com>
+Link: https://lore.kernel.org/r/20230906132735.748174-1-valentin.caron@foss.st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index def09cf0dc147..12241815510d4 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -268,6 +268,7 @@ struct stm32_spi_cfg {
+ * @fifo_size: size of the embedded fifo in bytes
+ * @cur_midi: master inter-data idleness in ns
+ * @cur_speed: speed configured in Hz
++ * @cur_half_period: time of a half bit in us
+ * @cur_bpw: number of bits in a single SPI data frame
+ * @cur_fthlv: fifo threshold level (data frames in a single data packet)
+ * @cur_comm: SPI communication mode
+@@ -294,6 +295,7 @@ struct stm32_spi {
+
+ unsigned int cur_midi;
+ unsigned int cur_speed;
++ unsigned int cur_half_period;
+ unsigned int cur_bpw;
+ unsigned int cur_fthlv;
+ unsigned int cur_comm;
+@@ -454,6 +456,8 @@ static int stm32_spi_prepare_mbr(struct stm32_spi *spi, u32 speed_hz,
+
+ spi->cur_speed = spi->clk_rate / (1 << mbrdiv);
+
++ spi->cur_half_period = DIV_ROUND_CLOSEST(USEC_PER_SEC, 2 * spi->cur_speed);
++
+ return mbrdiv - 1;
+ }
+
+@@ -695,6 +699,10 @@ static void stm32h7_spi_disable(struct stm32_spi *spi)
+ return;
+ }
+
++ /* Add a delay to make sure that transmission is ended. */
++ if (spi->cur_half_period)
++ udelay(spi->cur_half_period);
++
+ if (spi->cur_usedma && spi->dma_tx)
+ dmaengine_terminate_all(spi->dma_tx);
+ if (spi->cur_usedma && spi->dma_rx)
+--
+2.40.1
+
--- /dev/null
+From 0231204cc03815f499d68b7d3af970895038cb02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Aug 2023 17:25:58 +0200
+Subject: spi: sun6i: fix race between DMA RX transfer completion and RX FIFO
+ drain
+
+From: Tobias Schramm <t.schramm@manjaro.org>
+
+[ Upstream commit 1f11f4202caf5710204d334fe63392052783876d ]
+
+Previously the transfer complete IRQ immediately drained to RX FIFO to
+read any data remaining in FIFO to the RX buffer. This behaviour is
+correct when dealing with SPI in interrupt mode. However in DMA mode the
+transfer complete interrupt still fires as soon as all bytes to be
+transferred have been stored in the FIFO. At that point data in the FIFO
+still needs to be picked up by the DMA engine. Thus the drain procedure
+and DMA engine end up racing to read from RX FIFO, corrupting any data
+read. Additionally the RX buffer pointer is never adjusted according to
+DMA progress in DMA mode, thus calling the RX FIFO drain procedure in DMA
+mode is a bug.
+Fix corruptions in DMA RX mode by draining RX FIFO only in interrupt mode.
+Also wait for completion of RX DMA when in DMA mode before returning to
+ensure all data has been copied to the supplied memory buffer.
+
+Signed-off-by: Tobias Schramm <t.schramm@manjaro.org>
+Link: https://lore.kernel.org/r/20230827152558.5368-3-t.schramm@manjaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-sun6i.c | 29 ++++++++++++++++++++++++++++-
+ 1 file changed, 28 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-sun6i.c b/drivers/spi/spi-sun6i.c
+index 2bfe87873edb3..d79853ba7792a 100644
+--- a/drivers/spi/spi-sun6i.c
++++ b/drivers/spi/spi-sun6i.c
+@@ -95,6 +95,7 @@ struct sun6i_spi {
+ struct reset_control *rstc;
+
+ struct completion done;
++ struct completion dma_rx_done;
+
+ const u8 *tx_buf;
+ u8 *rx_buf;
+@@ -189,6 +190,13 @@ static size_t sun6i_spi_max_transfer_size(struct spi_device *spi)
+ return SUN6I_MAX_XFER_SIZE - 1;
+ }
+
++static void sun6i_spi_dma_rx_cb(void *param)
++{
++ struct sun6i_spi *sspi = param;
++
++ complete(&sspi->dma_rx_done);
++}
++
+ static int sun6i_spi_prepare_dma(struct sun6i_spi *sspi,
+ struct spi_transfer *tfr)
+ {
+@@ -213,6 +221,8 @@ static int sun6i_spi_prepare_dma(struct sun6i_spi *sspi,
+ DMA_PREP_INTERRUPT);
+ if (!rxdesc)
+ return -EINVAL;
++ rxdesc->callback_param = sspi;
++ rxdesc->callback = sun6i_spi_dma_rx_cb;
+ }
+
+ txdesc = NULL;
+@@ -268,6 +278,7 @@ static int sun6i_spi_transfer_one(struct spi_master *master,
+ return -EINVAL;
+
+ reinit_completion(&sspi->done);
++ reinit_completion(&sspi->dma_rx_done);
+ sspi->tx_buf = tfr->tx_buf;
+ sspi->rx_buf = tfr->rx_buf;
+ sspi->len = tfr->len;
+@@ -426,6 +437,22 @@ static int sun6i_spi_transfer_one(struct spi_master *master,
+ start = jiffies;
+ timeout = wait_for_completion_timeout(&sspi->done,
+ msecs_to_jiffies(tx_time));
++
++ if (!use_dma) {
++ sun6i_spi_drain_fifo(sspi);
++ } else {
++ if (timeout && rx_len) {
++ /*
++ * Even though RX on the peripheral side has finished
++ * RX DMA might still be in flight
++ */
++ timeout = wait_for_completion_timeout(&sspi->dma_rx_done,
++ timeout);
++ if (!timeout)
++ dev_warn(&master->dev, "RX DMA timeout\n");
++ }
++ }
++
+ end = jiffies;
+ if (!timeout) {
+ dev_warn(&master->dev,
+@@ -453,7 +480,6 @@ static irqreturn_t sun6i_spi_handler(int irq, void *dev_id)
+ /* Transfer complete */
+ if (status & SUN6I_INT_CTL_TC) {
+ sun6i_spi_write(sspi, SUN6I_INT_STA_REG, SUN6I_INT_CTL_TC);
+- sun6i_spi_drain_fifo(sspi);
+ complete(&sspi->done);
+ return IRQ_HANDLED;
+ }
+@@ -611,6 +637,7 @@ static int sun6i_spi_probe(struct platform_device *pdev)
+ }
+
+ init_completion(&sspi->done);
++ init_completion(&sspi->dma_rx_done);
+
+ sspi->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL);
+ if (IS_ERR(sspi->rstc)) {
+--
+2.40.1
+
--- /dev/null
+From eab8236049c5ac7eea9ff7d50ac627acda68c94c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Aug 2023 17:25:57 +0200
+Subject: spi: sun6i: reduce DMA RX transfer width to single byte
+
+From: Tobias Schramm <t.schramm@manjaro.org>
+
+[ Upstream commit 171f8a49f212e87a8b04087568e1b3d132e36a18 ]
+
+Through empirical testing it has been determined that sometimes RX SPI
+transfers with DMA enabled return corrupted data. This is down to single
+or even multiple bytes lost during DMA transfer from SPI peripheral to
+memory. It seems the RX FIFO within the SPI peripheral can become
+confused when performing bus read accesses wider than a single byte to it
+during an active SPI transfer.
+
+This patch reduces the width of individual DMA read accesses to the
+RX FIFO to a single byte to mitigate that issue.
+
+Signed-off-by: Tobias Schramm <t.schramm@manjaro.org>
+Link: https://lore.kernel.org/r/20230827152558.5368-2-t.schramm@manjaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-sun6i.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-sun6i.c b/drivers/spi/spi-sun6i.c
+index 23ad052528dbe..2bfe87873edb3 100644
+--- a/drivers/spi/spi-sun6i.c
++++ b/drivers/spi/spi-sun6i.c
+@@ -200,7 +200,7 @@ static int sun6i_spi_prepare_dma(struct sun6i_spi *sspi,
+ struct dma_slave_config rxconf = {
+ .direction = DMA_DEV_TO_MEM,
+ .src_addr = sspi->dma_addr_rx,
+- .src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES,
++ .src_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE,
+ .src_maxburst = 8,
+ };
+
+--
+2.40.1
+
--- /dev/null
+From 90a23c2b4cb71b020be4e786835df2d6c833f16c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Sep 2023 11:55:18 +0200
+Subject: thermal/of: add missing of_node_put()
+
+From: Julia Lawall <Julia.Lawall@inria.fr>
+
+[ Upstream commit 8a81cf96f5510aaf9a65d103f7405079a7b0fcc5 ]
+
+for_each_child_of_node performs an of_node_get on each
+iteration, so a break out of the loop requires an
+of_node_put.
+
+This was done using the Coccinelle semantic patch
+iterators/for_each_child.cocci
+
+Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/thermal_of.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/thermal/thermal_of.c b/drivers/thermal/thermal_of.c
+index 762d1990180bf..4104743dbc17e 100644
+--- a/drivers/thermal/thermal_of.c
++++ b/drivers/thermal/thermal_of.c
+@@ -149,8 +149,10 @@ static int of_find_trip_id(struct device_node *np, struct device_node *trip)
+ */
+ for_each_child_of_node(trips, t) {
+
+- if (t == trip)
++ if (t == trip) {
++ of_node_put(t);
+ goto out;
++ }
+ i++;
+ }
+
+@@ -519,8 +521,10 @@ static int thermal_of_for_each_cooling_maps(struct thermal_zone_device *tz,
+
+ for_each_child_of_node(cm_np, child) {
+ ret = thermal_of_for_each_cooling_device(tz_np, child, tz, cdev, action);
+- if (ret)
++ if (ret) {
++ of_node_put(child);
+ break;
++ }
+ }
+
+ of_node_put(cm_np);
+--
+2.40.1
+
--- /dev/null
+From a5172eec2a53cb9b7811a7ef73e03a69f7a35d78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Sep 2023 23:01:26 +0200
+Subject: tsnep: Fix NAPI polling with budget 0
+
+From: Gerhard Engleder <gerhard@engleder-embedded.com>
+
+[ Upstream commit 46589db3817bd8b523701274885984b5a5dda7d1 ]
+
+According to the NAPI documentation networking/napi.rst, Rx specific
+APIs like page pool and XDP cannot be used at all when budget is 0.
+skb Tx processing should happen regardless of the budget.
+
+Stop NAPI polling after Tx processing and skip Rx processing if budget
+is 0.
+
+Signed-off-by: Gerhard Engleder <gerhard@engleder-embedded.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/engleder/tsnep_main.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/engleder/tsnep_main.c b/drivers/net/ethernet/engleder/tsnep_main.c
+index 00436a6f785e8..2be518db04270 100644
+--- a/drivers/net/ethernet/engleder/tsnep_main.c
++++ b/drivers/net/ethernet/engleder/tsnep_main.c
+@@ -930,6 +930,10 @@ static int tsnep_poll(struct napi_struct *napi, int budget)
+ if (queue->tx)
+ complete = tsnep_tx_poll(queue->tx, budget);
+
++ /* handle case where we are called by netpoll with a budget of 0 */
++ if (unlikely(budget <= 0))
++ return budget;
++
+ if (queue->rx) {
+ done = tsnep_rx_poll(queue->rx, napi, budget);
+ if (done >= budget)
+--
+2.40.1
+
--- /dev/null
+From e22bd8bcd41452700dc4aa91caf2ccbc7214bbf9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Sep 2023 23:01:24 +0200
+Subject: tsnep: Fix NAPI scheduling
+
+From: Gerhard Engleder <gerhard@engleder-embedded.com>
+
+[ Upstream commit ea852c17f5382a0a52041cfbd9a4451ae0fa1a38 ]
+
+According to the NAPI documentation networking/napi.rst, drivers which
+have to mask interrupts explicitly should use the napi_schedule_prep()
+and __napi_schedule() calls.
+
+No problem seen so far with current implementation. Nevertheless, let's
+align the implementation with documentation.
+
+Signed-off-by: Gerhard Engleder <gerhard@engleder-embedded.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/engleder/tsnep_main.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/engleder/tsnep_main.c b/drivers/net/ethernet/engleder/tsnep_main.c
+index 6bf3cc11d2121..00436a6f785e8 100644
+--- a/drivers/net/ethernet/engleder/tsnep_main.c
++++ b/drivers/net/ethernet/engleder/tsnep_main.c
+@@ -65,8 +65,11 @@ static irqreturn_t tsnep_irq(int irq, void *arg)
+
+ /* handle TX/RX queue 0 interrupt */
+ if ((active & adapter->queue[0].irq_mask) != 0) {
+- tsnep_disable_irq(adapter, adapter->queue[0].irq_mask);
+- napi_schedule(&adapter->queue[0].napi);
++ if (napi_schedule_prep(&adapter->queue[0].napi)) {
++ tsnep_disable_irq(adapter, adapter->queue[0].irq_mask);
++ /* schedule after masking to avoid races */
++ __napi_schedule(&adapter->queue[0].napi);
++ }
+ }
+
+ return IRQ_HANDLED;
+@@ -77,8 +80,11 @@ static irqreturn_t tsnep_irq_txrx(int irq, void *arg)
+ struct tsnep_queue *queue = arg;
+
+ /* handle TX/RX queue interrupt */
+- tsnep_disable_irq(queue->adapter, queue->irq_mask);
+- napi_schedule(&queue->napi);
++ if (napi_schedule_prep(&queue->napi)) {
++ tsnep_disable_irq(queue->adapter, queue->irq_mask);
++ /* schedule after masking to avoid races */
++ __napi_schedule(&queue->napi);
++ }
+
+ return IRQ_HANDLED;
+ }
+--
+2.40.1
+
--- /dev/null
+From 40c93d46bbedee464f72e884f6af0c5a227c53c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jul 2023 13:18:41 -0700
+Subject: x86/reboot: VMCLEAR active VMCSes before emergency reboot
+
+From: Sean Christopherson <seanjc@google.com>
+
+[ Upstream commit b23c83ad2c638420ec0608a9de354507c41bec29 ]
+
+VMCLEAR active VMCSes before any emergency reboot, not just if the kernel
+may kexec into a new kernel after a crash. Per Intel's SDM, the VMX
+architecture doesn't require the CPU to flush the VMCS cache on INIT. If
+an emergency reboot doesn't RESET CPUs, cached VMCSes could theoretically
+be kept and only be written back to memory after the new kernel is booted,
+i.e. could effectively corrupt memory after reboot.
+
+Opportunistically remove the setting of the global pointer to NULL to make
+checkpatch happy.
+
+Cc: Andrew Cooper <Andrew.Cooper3@citrix.com>
+Link: https://lore.kernel.org/r/20230721201859.2307736-2-seanjc@google.com
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/kexec.h | 2 --
+ arch/x86/include/asm/reboot.h | 2 ++
+ arch/x86/kernel/crash.c | 31 -------------------------------
+ arch/x86/kernel/reboot.c | 22 ++++++++++++++++++++++
+ arch/x86/kvm/vmx/vmx.c | 10 +++-------
+ 5 files changed, 27 insertions(+), 40 deletions(-)
+
+diff --git a/arch/x86/include/asm/kexec.h b/arch/x86/include/asm/kexec.h
+index a3760ca796aa2..256eee99afc8f 100644
+--- a/arch/x86/include/asm/kexec.h
++++ b/arch/x86/include/asm/kexec.h
+@@ -208,8 +208,6 @@ int arch_kimage_file_post_load_cleanup(struct kimage *image);
+ #endif
+ #endif
+
+-typedef void crash_vmclear_fn(void);
+-extern crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss;
+ extern void kdump_nmi_shootdown_cpus(void);
+
+ #endif /* __ASSEMBLY__ */
+diff --git a/arch/x86/include/asm/reboot.h b/arch/x86/include/asm/reboot.h
+index bc5b4d788c08d..2551baec927d2 100644
+--- a/arch/x86/include/asm/reboot.h
++++ b/arch/x86/include/asm/reboot.h
+@@ -25,6 +25,8 @@ void __noreturn machine_real_restart(unsigned int type);
+ #define MRR_BIOS 0
+ #define MRR_APM 1
+
++typedef void crash_vmclear_fn(void);
++extern crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss;
+ void cpu_emergency_disable_virtualization(void);
+
+ typedef void (*nmi_shootdown_cb)(int, struct pt_regs*);
+diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
+index cdd92ab43cda4..54cd959cb3160 100644
+--- a/arch/x86/kernel/crash.c
++++ b/arch/x86/kernel/crash.c
+@@ -48,38 +48,12 @@ struct crash_memmap_data {
+ unsigned int type;
+ };
+
+-/*
+- * This is used to VMCLEAR all VMCSs loaded on the
+- * processor. And when loading kvm_intel module, the
+- * callback function pointer will be assigned.
+- *
+- * protected by rcu.
+- */
+-crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss = NULL;
+-EXPORT_SYMBOL_GPL(crash_vmclear_loaded_vmcss);
+-
+-static inline void cpu_crash_vmclear_loaded_vmcss(void)
+-{
+- crash_vmclear_fn *do_vmclear_operation = NULL;
+-
+- rcu_read_lock();
+- do_vmclear_operation = rcu_dereference(crash_vmclear_loaded_vmcss);
+- if (do_vmclear_operation)
+- do_vmclear_operation();
+- rcu_read_unlock();
+-}
+-
+ #if defined(CONFIG_SMP) && defined(CONFIG_X86_LOCAL_APIC)
+
+ static void kdump_nmi_callback(int cpu, struct pt_regs *regs)
+ {
+ crash_save_cpu(regs, cpu);
+
+- /*
+- * VMCLEAR VMCSs loaded on all cpus if needed.
+- */
+- cpu_crash_vmclear_loaded_vmcss();
+-
+ /*
+ * Disable Intel PT to stop its logging
+ */
+@@ -133,11 +107,6 @@ void native_machine_crash_shutdown(struct pt_regs *regs)
+
+ crash_smp_send_stop();
+
+- /*
+- * VMCLEAR VMCSs loaded on this cpu if needed.
+- */
+- cpu_crash_vmclear_loaded_vmcss();
+-
+ cpu_emergency_disable_virtualization();
+
+ /*
+diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
+index d03c551defccf..299b970e5f829 100644
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -787,6 +787,26 @@ void machine_crash_shutdown(struct pt_regs *regs)
+ }
+ #endif
+
++/*
++ * This is used to VMCLEAR all VMCSs loaded on the
++ * processor. And when loading kvm_intel module, the
++ * callback function pointer will be assigned.
++ *
++ * protected by rcu.
++ */
++crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss;
++EXPORT_SYMBOL_GPL(crash_vmclear_loaded_vmcss);
++
++static inline void cpu_crash_vmclear_loaded_vmcss(void)
++{
++ crash_vmclear_fn *do_vmclear_operation = NULL;
++
++ rcu_read_lock();
++ do_vmclear_operation = rcu_dereference(crash_vmclear_loaded_vmcss);
++ if (do_vmclear_operation)
++ do_vmclear_operation();
++ rcu_read_unlock();
++}
+
+ /* This is the CPU performing the emergency shutdown work. */
+ int crashing_cpu = -1;
+@@ -798,6 +818,8 @@ int crashing_cpu = -1;
+ */
+ void cpu_emergency_disable_virtualization(void)
+ {
++ cpu_crash_vmclear_loaded_vmcss();
++
+ cpu_emergency_vmxoff();
+ cpu_emergency_svm_disable();
+ }
+diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
+index 4e972b9b68e59..31a10d774df6d 100644
+--- a/arch/x86/kvm/vmx/vmx.c
++++ b/arch/x86/kvm/vmx/vmx.c
+@@ -40,7 +40,7 @@
+ #include <asm/idtentry.h>
+ #include <asm/io.h>
+ #include <asm/irq_remapping.h>
+-#include <asm/kexec.h>
++#include <asm/reboot.h>
+ #include <asm/perf_event.h>
+ #include <asm/mmu_context.h>
+ #include <asm/mshyperv.h>
+@@ -702,7 +702,6 @@ static int vmx_set_guest_uret_msr(struct vcpu_vmx *vmx,
+ return ret;
+ }
+
+-#ifdef CONFIG_KEXEC_CORE
+ static void crash_vmclear_local_loaded_vmcss(void)
+ {
+ int cpu = raw_smp_processor_id();
+@@ -712,7 +711,6 @@ static void crash_vmclear_local_loaded_vmcss(void)
+ loaded_vmcss_on_cpu_link)
+ vmcs_clear(v->vmcs);
+ }
+-#endif /* CONFIG_KEXEC_CORE */
+
+ static void __loaded_vmcs_clear(void *arg)
+ {
+@@ -8522,10 +8520,9 @@ static void __vmx_exit(void)
+ {
+ allow_smaller_maxphyaddr = false;
+
+-#ifdef CONFIG_KEXEC_CORE
+ RCU_INIT_POINTER(crash_vmclear_loaded_vmcss, NULL);
+ synchronize_rcu();
+-#endif
++
+ vmx_cleanup_l1d_flush();
+ }
+
+@@ -8598,10 +8595,9 @@ static int __init vmx_init(void)
+ pi_init_cpu(cpu);
+ }
+
+-#ifdef CONFIG_KEXEC_CORE
+ rcu_assign_pointer(crash_vmclear_loaded_vmcss,
+ crash_vmclear_local_loaded_vmcss);
+-#endif
++
+ vmx_check_vmcs12_offsets();
+
+ /*
+--
+2.40.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
