--- /dev/null
+From baced3ee4d94dfd739cd7960df046b9d3734c56b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Nov 2024 09:44:41 +0800
+Subject: ALSA: hda/conexant: fix Z60MR100 startup pop issue
+
+From: bo liu <bo.liu@senarytech.com>
+
+[ Upstream commit 947c4012f8f03a8bb946beb6e5294d5e32817d67 ]
+
+When Z60MR100 startup, speaker will output a pop. To fix this issue,
+we mute codec by init verbs in bios when system startup, and set GPIO
+to low to unmute codec in codec driver when it loaded .
+
+[ white space fixes and compile warning fix by tiwai ]
+
+Signed-off-by: bo liu <bo.liu@senarytech.com>
+Link: https://patch.msgid.link/20241129014441.437205-1-bo.liu@senarytech.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_conexant.c | 28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index b3208b068dd8..989ce0fb6291 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -311,6 +311,7 @@ enum {
+ CXT_FIXUP_HP_MIC_NO_PRESENCE,
+ CXT_PINCFG_SWS_JS201D,
+ CXT_PINCFG_TOP_SPEAKER,
++ CXT_FIXUP_HP_A_U,
+ };
+
+ /* for hda_fixup_thinkpad_acpi() */
+@@ -778,6 +779,18 @@ static void cxt_setup_mute_led(struct hda_codec *codec,
+ }
+ }
+
++static void cxt_setup_gpio_unmute(struct hda_codec *codec,
++ unsigned int gpio_mute_mask)
++{
++ if (gpio_mute_mask) {
++ // set gpio data to 0.
++ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DATA, 0);
++ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_MASK, gpio_mute_mask);
++ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DIRECTION, gpio_mute_mask);
++ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_STICKY_MASK, 0);
++ }
++}
++
+ static void cxt_fixup_mute_led_gpio(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+ {
+@@ -792,6 +805,15 @@ static void cxt_fixup_hp_zbook_mute_led(struct hda_codec *codec,
+ cxt_setup_mute_led(codec, 0x10, 0x20);
+ }
+
++static void cxt_fixup_hp_a_u(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ // Init vers in BIOS mute the spk/hp by set gpio high to avoid pop noise,
++ // so need to unmute once by clearing the gpio data when runs into the system.
++ if (action == HDA_FIXUP_ACT_INIT)
++ cxt_setup_gpio_unmute(codec, 0x2);
++}
++
+ /* ThinkPad X200 & co with cxt5051 */
+ static const struct hda_pintbl cxt_pincfg_lenovo_x200[] = {
+ { 0x16, 0x042140ff }, /* HP (seq# overridden) */
+@@ -1002,6 +1024,10 @@ static const struct hda_fixup cxt_fixups[] = {
+ { }
+ },
+ },
++ [CXT_FIXUP_HP_A_U] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = cxt_fixup_hp_a_u,
++ },
+ };
+
+ static const struct hda_quirk cxt5045_fixups[] = {
+@@ -1076,6 +1102,7 @@ static const struct hda_quirk cxt5066_fixups[] = {
+ SND_PCI_QUIRK(0x103c, 0x8457, "HP Z2 G4 mini", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x8458, "HP Z2 G4 mini premium", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN),
++ SND_PCI_QUIRK(0x14f1, 0x0252, "MBX-Z60MR100", CXT_FIXUP_HP_A_U),
+ SND_PCI_QUIRK(0x14f1, 0x0265, "SWS JS201D", CXT_PINCFG_SWS_JS201D),
+ SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO),
+ SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
+@@ -1121,6 +1148,7 @@ static const struct hda_model_fixup cxt5066_fixup_models[] = {
+ { .id = CXT_PINCFG_LENOVO_NOTEBOOK, .name = "lenovo-20149" },
+ { .id = CXT_PINCFG_SWS_JS201D, .name = "sws-js201d" },
+ { .id = CXT_PINCFG_TOP_SPEAKER, .name = "sirius-top-speaker" },
++ { .id = CXT_FIXUP_HP_A_U, .name = "HP-U-support" },
+ {}
+ };
+
+--
+2.39.5
+
--- /dev/null
+From be4c3ec5c576b2a4a33efdedbfd08d277cf54776 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Nov 2024 11:49:38 +0100
+Subject: ALSA: sh: Use standard helper for buffer accesses
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 9b5f8ee43e48c25fbe1a10163ec04343d750acd0 ]
+
+The SH DAC audio driver uses the kmalloc'ed buffer as the main PCM
+buffer, and the data is transferred via hrtimer callbacks manually
+from there to the hardware. Meanwhile, some of its code are written
+as if the buffer is on iomem and use the special helpers for the iomem
+(e.g. copy_from_iter_toio() or memset_io()). Those are rather useless
+and the standard helpers should be used.
+
+Similarly, the PCM mmap callback is set to a special one with
+snd_pcm_lib_mmap_iomem, but this is also nonsense, because SH
+architecture doesn't support this function, hence it leads just to
+NULL -- the fallback to the standard helper.
+
+This patch replaces those special setups with the standard ones.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202411281337.I4M07b7i-lkp@intel.com/
+Link: https://patch.msgid.link/20241128104939.13755-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/sh/sh_dac_audio.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/sound/sh/sh_dac_audio.c b/sound/sh/sh_dac_audio.c
+index 95ba3abd4e47..36a973d1c46d 100644
+--- a/sound/sh/sh_dac_audio.c
++++ b/sound/sh/sh_dac_audio.c
+@@ -163,7 +163,7 @@ static int snd_sh_dac_pcm_copy(struct snd_pcm_substream *substream,
+ /* channel is not used (interleaved data) */
+ struct snd_sh_dac *chip = snd_pcm_substream_chip(substream);
+
+- if (copy_from_iter_toio(chip->data_buffer + pos, src, count))
++ if (copy_from_iter(chip->data_buffer + pos, src, count) != count)
+ return -EFAULT;
+ chip->buffer_end = chip->data_buffer + pos + count;
+
+@@ -182,7 +182,7 @@ static int snd_sh_dac_pcm_silence(struct snd_pcm_substream *substream,
+ /* channel is not used (interleaved data) */
+ struct snd_sh_dac *chip = snd_pcm_substream_chip(substream);
+
+- memset_io(chip->data_buffer + pos, 0, count);
++ memset(chip->data_buffer + pos, 0, count);
+ chip->buffer_end = chip->data_buffer + pos + count;
+
+ if (chip->empty) {
+@@ -211,7 +211,6 @@ static const struct snd_pcm_ops snd_sh_dac_pcm_ops = {
+ .pointer = snd_sh_dac_pcm_pointer,
+ .copy = snd_sh_dac_pcm_copy,
+ .fill_silence = snd_sh_dac_pcm_silence,
+- .mmap = snd_pcm_lib_mmap_iomem,
+ };
+
+ static int snd_sh_dac_pcm(struct snd_sh_dac *chip, int device)
+--
+2.39.5
+
--- /dev/null
+From 6a971dfc9e563f6ffb2cda79c75bdaa0224e5461 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2024 19:16:07 +0800
+Subject: blk-mq: move cpuhp callback registering out of q->sysfs_lock
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 22465bbac53c821319089016f268a2437de9b00a ]
+
+Registering and unregistering cpuhp callback requires global cpu hotplug lock,
+which is used everywhere. Meantime q->sysfs_lock is used in block layer
+almost everywhere.
+
+It is easy to trigger lockdep warning[1] by connecting the two locks.
+
+Fix the warning by moving blk-mq's cpuhp callback registering out of
+q->sysfs_lock. Add one dedicated global lock for covering registering &
+unregistering hctx's cpuhp, and it is safe to do so because hctx is
+guaranteed to be live if our request_queue is live.
+
+[1] https://lore.kernel.org/lkml/Z04pz3AlvI4o0Mr8@agluck-desk3/
+
+Cc: Reinette Chatre <reinette.chatre@intel.com>
+Cc: Fenghua Yu <fenghua.yu@intel.com>
+Cc: Peter Newman <peternewman@google.com>
+Cc: Babu Moger <babu.moger@amd.com>
+Reported-by: Luck Tony <tony.luck@intel.com>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Tested-by: Tony Luck <tony.luck@intel.com>
+Link: https://lore.kernel.org/r/20241206111611.978870-3-ming.lei@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq.c | 103 +++++++++++++++++++++++++++++++++++++++++++------
+ 1 file changed, 92 insertions(+), 11 deletions(-)
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index f4a9eed1b977..9efc2fd3e4c4 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -43,6 +43,7 @@
+
+ static DEFINE_PER_CPU(struct llist_head, blk_cpu_done);
+ static DEFINE_PER_CPU(call_single_data_t, blk_cpu_csd);
++static DEFINE_MUTEX(blk_mq_cpuhp_lock);
+
+ static void blk_mq_insert_request(struct request *rq, blk_insert_t flags);
+ static void blk_mq_request_bypass_insert(struct request *rq,
+@@ -3623,13 +3624,91 @@ static int blk_mq_hctx_notify_dead(unsigned int cpu, struct hlist_node *node)
+ return 0;
+ }
+
+-static void blk_mq_remove_cpuhp(struct blk_mq_hw_ctx *hctx)
++static void __blk_mq_remove_cpuhp(struct blk_mq_hw_ctx *hctx)
+ {
+- if (!(hctx->flags & BLK_MQ_F_STACKING))
++ lockdep_assert_held(&blk_mq_cpuhp_lock);
++
++ if (!(hctx->flags & BLK_MQ_F_STACKING) &&
++ !hlist_unhashed(&hctx->cpuhp_online)) {
+ cpuhp_state_remove_instance_nocalls(CPUHP_AP_BLK_MQ_ONLINE,
+ &hctx->cpuhp_online);
+- cpuhp_state_remove_instance_nocalls(CPUHP_BLK_MQ_DEAD,
+- &hctx->cpuhp_dead);
++ INIT_HLIST_NODE(&hctx->cpuhp_online);
++ }
++
++ if (!hlist_unhashed(&hctx->cpuhp_dead)) {
++ cpuhp_state_remove_instance_nocalls(CPUHP_BLK_MQ_DEAD,
++ &hctx->cpuhp_dead);
++ INIT_HLIST_NODE(&hctx->cpuhp_dead);
++ }
++}
++
++static void blk_mq_remove_cpuhp(struct blk_mq_hw_ctx *hctx)
++{
++ mutex_lock(&blk_mq_cpuhp_lock);
++ __blk_mq_remove_cpuhp(hctx);
++ mutex_unlock(&blk_mq_cpuhp_lock);
++}
++
++static void __blk_mq_add_cpuhp(struct blk_mq_hw_ctx *hctx)
++{
++ lockdep_assert_held(&blk_mq_cpuhp_lock);
++
++ if (!(hctx->flags & BLK_MQ_F_STACKING) &&
++ hlist_unhashed(&hctx->cpuhp_online))
++ cpuhp_state_add_instance_nocalls(CPUHP_AP_BLK_MQ_ONLINE,
++ &hctx->cpuhp_online);
++
++ if (hlist_unhashed(&hctx->cpuhp_dead))
++ cpuhp_state_add_instance_nocalls(CPUHP_BLK_MQ_DEAD,
++ &hctx->cpuhp_dead);
++}
++
++static void __blk_mq_remove_cpuhp_list(struct list_head *head)
++{
++ struct blk_mq_hw_ctx *hctx;
++
++ lockdep_assert_held(&blk_mq_cpuhp_lock);
++
++ list_for_each_entry(hctx, head, hctx_list)
++ __blk_mq_remove_cpuhp(hctx);
++}
++
++/*
++ * Unregister cpuhp callbacks from exited hw queues
++ *
++ * Safe to call if this `request_queue` is live
++ */
++static void blk_mq_remove_hw_queues_cpuhp(struct request_queue *q)
++{
++ LIST_HEAD(hctx_list);
++
++ spin_lock(&q->unused_hctx_lock);
++ list_splice_init(&q->unused_hctx_list, &hctx_list);
++ spin_unlock(&q->unused_hctx_lock);
++
++ mutex_lock(&blk_mq_cpuhp_lock);
++ __blk_mq_remove_cpuhp_list(&hctx_list);
++ mutex_unlock(&blk_mq_cpuhp_lock);
++
++ spin_lock(&q->unused_hctx_lock);
++ list_splice(&hctx_list, &q->unused_hctx_list);
++ spin_unlock(&q->unused_hctx_lock);
++}
++
++/*
++ * Register cpuhp callbacks from all hw queues
++ *
++ * Safe to call if this `request_queue` is live
++ */
++static void blk_mq_add_hw_queues_cpuhp(struct request_queue *q)
++{
++ struct blk_mq_hw_ctx *hctx;
++ unsigned long i;
++
++ mutex_lock(&blk_mq_cpuhp_lock);
++ queue_for_each_hw_ctx(q, hctx, i)
++ __blk_mq_add_cpuhp(hctx);
++ mutex_unlock(&blk_mq_cpuhp_lock);
+ }
+
+ /*
+@@ -3680,8 +3759,6 @@ static void blk_mq_exit_hctx(struct request_queue *q,
+ if (set->ops->exit_hctx)
+ set->ops->exit_hctx(hctx, hctx_idx);
+
+- blk_mq_remove_cpuhp(hctx);
+-
+ xa_erase(&q->hctx_table, hctx_idx);
+
+ spin_lock(&q->unused_hctx_lock);
+@@ -3698,6 +3775,7 @@ static void blk_mq_exit_hw_queues(struct request_queue *q,
+ queue_for_each_hw_ctx(q, hctx, i) {
+ if (i == nr_queue)
+ break;
++ blk_mq_remove_cpuhp(hctx);
+ blk_mq_exit_hctx(q, set, hctx, i);
+ }
+ }
+@@ -3721,11 +3799,6 @@ static int blk_mq_init_hctx(struct request_queue *q,
+ if (xa_insert(&q->hctx_table, hctx_idx, hctx, GFP_KERNEL))
+ goto exit_flush_rq;
+
+- if (!(hctx->flags & BLK_MQ_F_STACKING))
+- cpuhp_state_add_instance_nocalls(CPUHP_AP_BLK_MQ_ONLINE,
+- &hctx->cpuhp_online);
+- cpuhp_state_add_instance_nocalls(CPUHP_BLK_MQ_DEAD, &hctx->cpuhp_dead);
+-
+ return 0;
+
+ exit_flush_rq:
+@@ -3760,6 +3833,8 @@ blk_mq_alloc_hctx(struct request_queue *q, struct blk_mq_tag_set *set,
+ INIT_DELAYED_WORK(&hctx->run_work, blk_mq_run_work_fn);
+ spin_lock_init(&hctx->lock);
+ INIT_LIST_HEAD(&hctx->dispatch);
++ INIT_HLIST_NODE(&hctx->cpuhp_dead);
++ INIT_HLIST_NODE(&hctx->cpuhp_online);
+ hctx->queue = q;
+ hctx->flags = set->flags & ~BLK_MQ_F_TAG_QUEUE_SHARED;
+
+@@ -4278,6 +4353,12 @@ static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set,
+ xa_for_each_start(&q->hctx_table, j, hctx, j)
+ blk_mq_exit_hctx(q, set, hctx, j);
+ mutex_unlock(&q->sysfs_lock);
++
++ /* unregister cpuhp callbacks for exited hctxs */
++ blk_mq_remove_hw_queues_cpuhp(q);
++
++ /* register cpuhp for new initialized hctxs */
++ blk_mq_add_hw_queues_cpuhp(q);
+ }
+
+ static void blk_mq_update_poll_flag(struct request_queue *q)
+--
+2.39.5
+
--- /dev/null
+From 6c16535877f053a6a4493459513b69a2c20192be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2024 19:16:06 +0800
+Subject: blk-mq: register cpuhp callback after hctx is added to xarray table
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 4bf485a7db5d82ddd0f3ad2b299893199090375e ]
+
+We need to retrieve 'hctx' from xarray table in the cpuhp callback, so the
+callback should be registered after this 'hctx' is added to xarray table.
+
+Cc: Reinette Chatre <reinette.chatre@intel.com>
+Cc: Fenghua Yu <fenghua.yu@intel.com>
+Cc: Peter Newman <peternewman@google.com>
+Cc: Babu Moger <babu.moger@amd.com>
+Cc: Luck Tony <tony.luck@intel.com>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Tested-by: Tony Luck <tony.luck@intel.com>
+Link: https://lore.kernel.org/r/20241206111611.978870-2-ming.lei@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 6c71add013bf..f4a9eed1b977 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -3708,16 +3708,11 @@ static int blk_mq_init_hctx(struct request_queue *q,
+ {
+ hctx->queue_num = hctx_idx;
+
+- if (!(hctx->flags & BLK_MQ_F_STACKING))
+- cpuhp_state_add_instance_nocalls(CPUHP_AP_BLK_MQ_ONLINE,
+- &hctx->cpuhp_online);
+- cpuhp_state_add_instance_nocalls(CPUHP_BLK_MQ_DEAD, &hctx->cpuhp_dead);
+-
+ hctx->tags = set->tags[hctx_idx];
+
+ if (set->ops->init_hctx &&
+ set->ops->init_hctx(hctx, set->driver_data, hctx_idx))
+- goto unregister_cpu_notifier;
++ goto fail;
+
+ if (blk_mq_init_request(set, hctx->fq->flush_rq, hctx_idx,
+ hctx->numa_node))
+@@ -3726,6 +3721,11 @@ static int blk_mq_init_hctx(struct request_queue *q,
+ if (xa_insert(&q->hctx_table, hctx_idx, hctx, GFP_KERNEL))
+ goto exit_flush_rq;
+
++ if (!(hctx->flags & BLK_MQ_F_STACKING))
++ cpuhp_state_add_instance_nocalls(CPUHP_AP_BLK_MQ_ONLINE,
++ &hctx->cpuhp_online);
++ cpuhp_state_add_instance_nocalls(CPUHP_BLK_MQ_DEAD, &hctx->cpuhp_dead);
++
+ return 0;
+
+ exit_flush_rq:
+@@ -3734,8 +3734,7 @@ static int blk_mq_init_hctx(struct request_queue *q,
+ exit_hctx:
+ if (set->ops->exit_hctx)
+ set->ops->exit_hctx(hctx, hctx_idx);
+- unregister_cpu_notifier:
+- blk_mq_remove_cpuhp(hctx);
++ fail:
+ return -1;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From a64387937534ebe992d2f1abfbed03cbcae0e410 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2024 15:20:07 +0200
+Subject: drm/dp_mst: Ensure mst_primary pointer is valid in
+ drm_dp_mst_handle_up_req()
+
+From: Imre Deak <imre.deak@intel.com>
+
+[ Upstream commit e54b00086f7473dbda1a7d6fc47720ced157c6a8 ]
+
+While receiving an MST up request message from one thread in
+drm_dp_mst_handle_up_req(), the MST topology could be removed from
+another thread via drm_dp_mst_topology_mgr_set_mst(false), freeing
+mst_primary and setting drm_dp_mst_topology_mgr::mst_primary to NULL.
+This could lead to a NULL deref/use-after-free of mst_primary in
+drm_dp_mst_handle_up_req().
+
+Avoid the above by holding a reference for mst_primary in
+drm_dp_mst_handle_up_req() while it's used.
+
+v2: Fix kfreeing the request if getting an mst_primary reference fails.
+
+Cc: Lyude Paul <lyude@redhat.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com> (v1)
+Signed-off-by: Imre Deak <imre.deak@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241204132007.3132494-1-imre.deak@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/display/drm_dp_mst_topology.c | 24 ++++++++++++++-----
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+index 90bfb1e988fb..d6c5de190c27 100644
+--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+@@ -4033,9 +4033,10 @@ static void drm_dp_mst_up_req_work(struct work_struct *work)
+ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr)
+ {
+ struct drm_dp_pending_up_req *up_req;
++ struct drm_dp_mst_branch *mst_primary;
+
+ if (!drm_dp_get_one_sb_msg(mgr, true, NULL))
+- goto out;
++ goto out_clear_reply;
+
+ if (!mgr->up_req_recv.have_eomt)
+ return 0;
+@@ -4053,10 +4054,19 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr)
+ drm_dbg_kms(mgr->dev, "Received unknown up req type, ignoring: %x\n",
+ up_req->msg.req_type);
+ kfree(up_req);
+- goto out;
++ goto out_clear_reply;
++ }
++
++ mutex_lock(&mgr->lock);
++ mst_primary = mgr->mst_primary;
++ if (!mst_primary || !drm_dp_mst_topology_try_get_mstb(mst_primary)) {
++ mutex_unlock(&mgr->lock);
++ kfree(up_req);
++ goto out_clear_reply;
+ }
++ mutex_unlock(&mgr->lock);
+
+- drm_dp_send_up_ack_reply(mgr, mgr->mst_primary, up_req->msg.req_type,
++ drm_dp_send_up_ack_reply(mgr, mst_primary, up_req->msg.req_type,
+ false);
+
+ if (up_req->msg.req_type == DP_CONNECTION_STATUS_NOTIFY) {
+@@ -4073,13 +4083,13 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr)
+ conn_stat->peer_device_type);
+
+ mutex_lock(&mgr->probe_lock);
+- handle_csn = mgr->mst_primary->link_address_sent;
++ handle_csn = mst_primary->link_address_sent;
+ mutex_unlock(&mgr->probe_lock);
+
+ if (!handle_csn) {
+ drm_dbg_kms(mgr->dev, "Got CSN before finish topology probing. Skip it.");
+ kfree(up_req);
+- goto out;
++ goto out_put_primary;
+ }
+ } else if (up_req->msg.req_type == DP_RESOURCE_STATUS_NOTIFY) {
+ const struct drm_dp_resource_status_notify *res_stat =
+@@ -4096,7 +4106,9 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr)
+ mutex_unlock(&mgr->up_req_lock);
+ queue_work(system_long_wq, &mgr->up_req_work);
+
+-out:
++out_put_primary:
++ drm_dp_mst_topology_put_mstb(mst_primary);
++out_clear_reply:
+ memset(&mgr->up_req_recv, 0, sizeof(struct drm_dp_sideband_msg_rx));
+ return 0;
+ }
+--
+2.39.5
+
--- /dev/null
+From 2b79bd3e5332d80faf7cce4e7c73861ae45e7fcc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Dec 2024 16:42:08 +0800
+Subject: LoongArch: BPF: Adjust the parameter of emit_jirl()
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit c1474bb0b7cff4e8481095bd0618b8f6c2f0aeb4 ]
+
+The branch instructions beq, bne, blt, bge, bltu, bgeu and jirl belong
+to the format reg2i16, but the sequence of oprand is different for the
+instruction jirl. So adjust the parameter order of emit_jirl() to make
+it more readable correspond with the Instruction Set Architecture manual.
+
+Here are the instruction formats:
+
+ beq rj, rd, offs16
+ bne rj, rd, offs16
+ blt rj, rd, offs16
+ bge rj, rd, offs16
+ bltu rj, rd, offs16
+ bgeu rj, rd, offs16
+ jirl rd, rj, offs16
+
+Link: https://loongson.github.io/LoongArch-Documentation/LoongArch-Vol1-EN.html#branch-instructions
+Suggested-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/include/asm/inst.h | 12 +++++++++++-
+ arch/loongarch/kernel/inst.c | 2 +-
+ arch/loongarch/net/bpf_jit.c | 6 +++---
+ 3 files changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/arch/loongarch/include/asm/inst.h b/arch/loongarch/include/asm/inst.h
+index 71e1ed4165c8..4fa53ad82efb 100644
+--- a/arch/loongarch/include/asm/inst.h
++++ b/arch/loongarch/include/asm/inst.h
+@@ -655,7 +655,17 @@ DEF_EMIT_REG2I16_FORMAT(blt, blt_op)
+ DEF_EMIT_REG2I16_FORMAT(bge, bge_op)
+ DEF_EMIT_REG2I16_FORMAT(bltu, bltu_op)
+ DEF_EMIT_REG2I16_FORMAT(bgeu, bgeu_op)
+-DEF_EMIT_REG2I16_FORMAT(jirl, jirl_op)
++
++static inline void emit_jirl(union loongarch_instruction *insn,
++ enum loongarch_gpr rd,
++ enum loongarch_gpr rj,
++ int offset)
++{
++ insn->reg2i16_format.opcode = jirl_op;
++ insn->reg2i16_format.immediate = offset;
++ insn->reg2i16_format.rd = rd;
++ insn->reg2i16_format.rj = rj;
++}
+
+ #define DEF_EMIT_REG2BSTRD_FORMAT(NAME, OP) \
+ static inline void emit_##NAME(union loongarch_instruction *insn, \
+diff --git a/arch/loongarch/kernel/inst.c b/arch/loongarch/kernel/inst.c
+index 3050329556d1..14d7d700bcb9 100644
+--- a/arch/loongarch/kernel/inst.c
++++ b/arch/loongarch/kernel/inst.c
+@@ -332,7 +332,7 @@ u32 larch_insn_gen_jirl(enum loongarch_gpr rd, enum loongarch_gpr rj, int imm)
+ return INSN_BREAK;
+ }
+
+- emit_jirl(&insn, rj, rd, imm >> 2);
++ emit_jirl(&insn, rd, rj, imm >> 2);
+
+ return insn.word;
+ }
+diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
+index 497f8b0a5f1e..6595e992fda8 100644
+--- a/arch/loongarch/net/bpf_jit.c
++++ b/arch/loongarch/net/bpf_jit.c
+@@ -181,13 +181,13 @@ static void __build_epilogue(struct jit_ctx *ctx, bool is_tail_call)
+ /* Set return value */
+ emit_insn(ctx, addiw, LOONGARCH_GPR_A0, regmap[BPF_REG_0], 0);
+ /* Return to the caller */
+- emit_insn(ctx, jirl, LOONGARCH_GPR_RA, LOONGARCH_GPR_ZERO, 0);
++ emit_insn(ctx, jirl, LOONGARCH_GPR_ZERO, LOONGARCH_GPR_RA, 0);
+ } else {
+ /*
+ * Call the next bpf prog and skip the first instruction
+ * of TCC initialization.
+ */
+- emit_insn(ctx, jirl, LOONGARCH_GPR_T3, LOONGARCH_GPR_ZERO, 1);
++ emit_insn(ctx, jirl, LOONGARCH_GPR_ZERO, LOONGARCH_GPR_T3, 1);
+ }
+ }
+
+@@ -841,7 +841,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext
+ return ret;
+
+ move_addr(ctx, t1, func_addr);
+- emit_insn(ctx, jirl, t1, LOONGARCH_GPR_RA, 0);
++ emit_insn(ctx, jirl, LOONGARCH_GPR_RA, t1, 0);
+ move_reg(ctx, regmap[BPF_REG_0], LOONGARCH_GPR_A0);
+ break;
+
+--
+2.39.5
+
--- /dev/null
+From c4ccd32490a5e310d673409306fe663eafe6b245 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Dec 2024 16:42:07 +0800
+Subject: LoongArch: Fix reserving screen info memory for above-4G firmware
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit 55dc2f8f263448f1e6c7ef135d08e640d5a4826e ]
+
+Since screen_info.lfb_base is a __u32 type, an above-4G address need an
+ext_lfb_base to present its higher 32bits. In init_screen_info() we can
+use __screen_info_lfb_base() to handle this case for reserving screen
+info memory.
+
+Signed-off-by: Xuefeng Zhao <zhaoxuefeng@loongson.cn>
+Signed-off-by: Jianmin Lv <lvjianmin@loongson.cn>
+Signed-off-by: Tianyang Zhang <zhangtianyang@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/kernel/efi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/loongarch/kernel/efi.c b/arch/loongarch/kernel/efi.c
+index de4f3def4af0..4ae77e9300d5 100644
+--- a/arch/loongarch/kernel/efi.c
++++ b/arch/loongarch/kernel/efi.c
+@@ -90,7 +90,7 @@ static void __init init_screen_info(void)
+ memset(si, 0, sizeof(*si));
+ early_memunmap(si, sizeof(*si));
+
+- memblock_reserve(screen_info.lfb_base, screen_info.lfb_size);
++ memblock_reserve(__screen_info_lfb_base(&screen_info), screen_info.lfb_size);
+ }
+
+ void __init efi_init(void)
+--
+2.39.5
+
--- /dev/null
+From a60392f2291eab5ad1dfe15ae5d9aa2001606266 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Nov 2024 23:47:00 +0100
+Subject: platform/x86: asus-nb-wmi: Ignore unknown event 0xCF
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit e9fba20c29e27dc99e55e1c550573a114561bf8c ]
+
+On the Asus X541UAK an unknown event 0xCF is emited when the charger
+is plugged in. This is caused by the following AML code:
+
+ If (ACPS ())
+ {
+ ACPF = One
+ Local0 = 0x58
+ If (ATKP)
+ {
+ ^^^^ATKD.IANE (0xCF)
+ }
+ }
+ Else
+ {
+ ACPF = Zero
+ Local0 = 0x57
+ }
+
+ Notify (AC0, 0x80) // Status Change
+ If (ATKP)
+ {
+ ^^^^ATKD.IANE (Local0)
+ }
+
+ Sleep (0x64)
+ PNOT ()
+ Sleep (0x0A)
+ NBAT (0x80)
+
+Ignore the 0xCF event to silence the unknown event warning.
+
+Reported-by: Pau Espin Pedrol <pespin@espeweb.net>
+Closes: https://lore.kernel.org/platform-driver-x86/54d4860b-ec9c-4992-acf6-db3f90388293@espeweb.net
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20241123224700.18530-1-W_Armin@gmx.de
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/asus-nb-wmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
+index af3da303e2b1..cba515ce3444 100644
+--- a/drivers/platform/x86/asus-nb-wmi.c
++++ b/drivers/platform/x86/asus-nb-wmi.c
+@@ -590,6 +590,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = {
+ { KE_KEY, 0xC4, { KEY_KBDILLUMUP } },
+ { KE_KEY, 0xC5, { KEY_KBDILLUMDOWN } },
+ { KE_IGNORE, 0xC6, }, /* Ambient Light Sensor notification */
++ { KE_IGNORE, 0xCF, }, /* AC mode */
+ { KE_KEY, 0xFA, { KEY_PROG2 } }, /* Lid flip action */
+ { KE_KEY, 0xBD, { KEY_PROG2 } }, /* Lid flip action on ROG xflow laptops */
+ { KE_END, 0},
+--
+2.39.5
+
--- /dev/null
+From 560b14523c3b412442838791835eb3ab1a4f1379 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2024 21:17:58 -0800
+Subject: powerpc/pseries/vas: Add close() callback in vas_vm_ops struct
+
+From: Haren Myneni <haren@linux.ibm.com>
+
+[ Upstream commit 05aa156e156ef3168e7ab8a68721945196495c17 ]
+
+The mapping VMA address is saved in VAS window struct when the
+paste address is mapped. This VMA address is used during migration
+to unmap the paste address if the window is active. The paste
+address mapping will be removed when the window is closed or with
+the munmap(). But the VMA address in the VAS window is not updated
+with munmap() which is causing invalid access during migration.
+
+The KASAN report shows:
+[16386.254991] BUG: KASAN: slab-use-after-free in reconfig_close_windows+0x1a0/0x4e8
+[16386.255043] Read of size 8 at addr c00000014a819670 by task drmgr/696928
+
+[16386.255096] CPU: 29 UID: 0 PID: 696928 Comm: drmgr Kdump: loaded Tainted: G B 6.11.0-rc5-nxgzip #2
+[16386.255128] Tainted: [B]=BAD_PAGE
+[16386.255148] Hardware name: IBM,9080-HEX Power11 (architected) 0x820200 0xf000007 of:IBM,FW1110.00 (NH1110_016) hv:phyp pSeries
+[16386.255181] Call Trace:
+[16386.255202] [c00000016b297660] [c0000000018ad0ac] dump_stack_lvl+0x84/0xe8 (unreliable)
+[16386.255246] [c00000016b297690] [c0000000006e8a90] print_report+0x19c/0x764
+[16386.255285] [c00000016b297760] [c0000000006e9490] kasan_report+0x128/0x1f8
+[16386.255309] [c00000016b297880] [c0000000006eb5c8] __asan_load8+0xac/0xe0
+[16386.255326] [c00000016b2978a0] [c00000000013f898] reconfig_close_windows+0x1a0/0x4e8
+[16386.255343] [c00000016b297990] [c000000000140e58] vas_migration_handler+0x3a4/0x3fc
+[16386.255368] [c00000016b297a90] [c000000000128848] pseries_migrate_partition+0x4c/0x4c4
+...
+
+[16386.256136] Allocated by task 696554 on cpu 31 at 16377.277618s:
+[16386.256149] kasan_save_stack+0x34/0x68
+[16386.256163] kasan_save_track+0x34/0x80
+[16386.256175] kasan_save_alloc_info+0x58/0x74
+[16386.256196] __kasan_slab_alloc+0xb8/0xdc
+[16386.256209] kmem_cache_alloc_noprof+0x200/0x3d0
+[16386.256225] vm_area_alloc+0x44/0x150
+[16386.256245] mmap_region+0x214/0x10c4
+[16386.256265] do_mmap+0x5fc/0x750
+[16386.256277] vm_mmap_pgoff+0x14c/0x24c
+[16386.256292] ksys_mmap_pgoff+0x20c/0x348
+[16386.256303] sys_mmap+0xd0/0x160
+...
+
+[16386.256350] Freed by task 0 on cpu 31 at 16386.204848s:
+[16386.256363] kasan_save_stack+0x34/0x68
+[16386.256374] kasan_save_track+0x34/0x80
+[16386.256384] kasan_save_free_info+0x64/0x10c
+[16386.256396] __kasan_slab_free+0x120/0x204
+[16386.256415] kmem_cache_free+0x128/0x450
+[16386.256428] vm_area_free_rcu_cb+0xa8/0xd8
+[16386.256441] rcu_do_batch+0x2c8/0xcf0
+[16386.256458] rcu_core+0x378/0x3c4
+[16386.256473] handle_softirqs+0x20c/0x60c
+[16386.256495] do_softirq_own_stack+0x6c/0x88
+[16386.256509] do_softirq_own_stack+0x58/0x88
+[16386.256521] __irq_exit_rcu+0x1a4/0x20c
+[16386.256533] irq_exit+0x20/0x38
+[16386.256544] interrupt_async_exit_prepare.constprop.0+0x18/0x2c
+...
+
+[16386.256717] Last potentially related work creation:
+[16386.256729] kasan_save_stack+0x34/0x68
+[16386.256741] __kasan_record_aux_stack+0xcc/0x12c
+[16386.256753] __call_rcu_common.constprop.0+0x94/0xd04
+[16386.256766] vm_area_free+0x28/0x3c
+[16386.256778] remove_vma+0xf4/0x114
+[16386.256797] do_vmi_align_munmap.constprop.0+0x684/0x870
+[16386.256811] __vm_munmap+0xe0/0x1f8
+[16386.256821] sys_munmap+0x54/0x6c
+[16386.256830] system_call_exception+0x1a0/0x4a0
+[16386.256841] system_call_vectored_common+0x15c/0x2ec
+
+[16386.256868] The buggy address belongs to the object at c00000014a819670
+ which belongs to the cache vm_area_struct of size 168
+[16386.256887] The buggy address is located 0 bytes inside of
+ freed 168-byte region [c00000014a819670, c00000014a819718)
+
+[16386.256915] The buggy address belongs to the physical page:
+[16386.256928] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14a81
+[16386.256950] memcg:c0000000ba430001
+[16386.256961] anon flags: 0x43ffff800000000(node=4|zone=0|lastcpupid=0x7ffff)
+[16386.256975] page_type: 0xfdffffff(slab)
+[16386.256990] raw: 043ffff800000000 c00000000501c080 0000000000000000 5deadbee00000001
+[16386.257003] raw: 0000000000000000 00000000011a011a 00000001fdffffff c0000000ba430001
+[16386.257018] page dumped because: kasan: bad access detected
+
+This patch adds close() callback in vas_vm_ops vm_operations_struct
+which will be executed during munmap() before freeing VMA. The VMA
+address in the VAS window is set to NULL after holding the window
+mmap_mutex.
+
+Fixes: 37e6764895ef ("powerpc/pseries/vas: Add VAS migration handler")
+Signed-off-by: Haren Myneni <haren@linux.ibm.com>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/20241214051758.997759-1-haren@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/book3s/vas-api.c | 36 +++++++++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+
+diff --git a/arch/powerpc/platforms/book3s/vas-api.c b/arch/powerpc/platforms/book3s/vas-api.c
+index f381b177ea06..0b6365d85d11 100644
+--- a/arch/powerpc/platforms/book3s/vas-api.c
++++ b/arch/powerpc/platforms/book3s/vas-api.c
+@@ -464,7 +464,43 @@ static vm_fault_t vas_mmap_fault(struct vm_fault *vmf)
+ return VM_FAULT_SIGBUS;
+ }
+
++/*
++ * During mmap() paste address, mapping VMA is saved in VAS window
++ * struct which is used to unmap during migration if the window is
++ * still open. But the user space can remove this mapping with
++ * munmap() before closing the window and the VMA address will
++ * be invalid. Set VAS window VMA to NULL in this function which
++ * is called before VMA free.
++ */
++static void vas_mmap_close(struct vm_area_struct *vma)
++{
++ struct file *fp = vma->vm_file;
++ struct coproc_instance *cp_inst = fp->private_data;
++ struct vas_window *txwin;
++
++ /* Should not happen */
++ if (!cp_inst || !cp_inst->txwin) {
++ pr_err("No attached VAS window for the paste address mmap\n");
++ return;
++ }
++
++ txwin = cp_inst->txwin;
++ /*
++ * task_ref.vma is set in coproc_mmap() during mmap paste
++ * address. So it has to be the same VMA that is getting freed.
++ */
++ if (WARN_ON(txwin->task_ref.vma != vma)) {
++ pr_err("Invalid paste address mmaping\n");
++ return;
++ }
++
++ mutex_lock(&txwin->task_ref.mmap_mutex);
++ txwin->task_ref.vma = NULL;
++ mutex_unlock(&txwin->task_ref.mmap_mutex);
++}
++
+ static const struct vm_operations_struct vas_vm_ops = {
++ .close = vas_mmap_close,
+ .fault = vas_mmap_fault,
+ };
+
+--
+2.39.5
+
--- /dev/null
+From 81b32bfc080cf8845e38023d8aafee042efa7a06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2024 13:35:06 +0000
+Subject: regmap: Use correct format specifier for logging range errors
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 3f1aa0c533d9dd8a835caf9a6824449c463ee7e2 ]
+
+The register addresses are unsigned ints so we should use %u not %d to
+log them.
+
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Link: https://patch.msgid.link/20241127-regmap-test-high-addr-v1-1-74a48a9e0dc5@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regmap.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index 1db04886def6..3011f7f9381b 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -1062,13 +1062,13 @@ struct regmap *__regmap_init(struct device *dev,
+
+ /* Sanity check */
+ if (range_cfg->range_max < range_cfg->range_min) {
+- dev_err(map->dev, "Invalid range %d: %d < %d\n", i,
++ dev_err(map->dev, "Invalid range %d: %u < %u\n", i,
+ range_cfg->range_max, range_cfg->range_min);
+ goto err_range;
+ }
+
+ if (range_cfg->range_max > map->max_register) {
+- dev_err(map->dev, "Invalid range %d: %d > %d\n", i,
++ dev_err(map->dev, "Invalid range %d: %u > %u\n", i,
+ range_cfg->range_max, map->max_register);
+ goto err_range;
+ }
+--
+2.39.5
+
--- /dev/null
+From d2f712ca618a85613ecc469e43eb9dcb0003be6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2024 19:48:33 +0200
+Subject: scsi: megaraid_sas: Fix for a potential deadlock
+
+From: Tomas Henzl <thenzl@redhat.com>
+
+[ Upstream commit 50740f4dc78b41dec7c8e39772619d5ba841ddd7 ]
+
+This fixes a 'possible circular locking dependency detected' warning
+ CPU0 CPU1
+ ---- ----
+ lock(&instance->reset_mutex);
+ lock(&shost->scan_mutex);
+ lock(&instance->reset_mutex);
+ lock(&shost->scan_mutex);
+
+Fix this by temporarily releasing the reset_mutex.
+
+Signed-off-by: Tomas Henzl <thenzl@redhat.com>
+Link: https://lore.kernel.org/r/20240923174833.45345-1-thenzl@redhat.com
+Acked-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/megaraid/megaraid_sas_base.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 3d4f13da1ae8..4cc93cb79b8b 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -8904,8 +8904,11 @@ megasas_aen_polling(struct work_struct *work)
+ (ld_target_id / MEGASAS_MAX_DEV_PER_CHANNEL),
+ (ld_target_id % MEGASAS_MAX_DEV_PER_CHANNEL),
+ 0);
+- if (sdev1)
++ if (sdev1) {
++ mutex_unlock(&instance->reset_mutex);
+ megasas_remove_scsi_device(sdev1);
++ mutex_lock(&instance->reset_mutex);
++ }
+
+ event_type = SCAN_VD_CHANNEL;
+ break;
+--
+2.39.5
+
--- /dev/null
+From bb925ad20ab14ea28603b6e8036e3d05cda9ec70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Nov 2024 23:03:40 +0530
+Subject: scsi: mpt3sas: Diag-Reset when Doorbell-In-Use bit is set during
+ driver load time
+
+From: Ranjan Kumar <ranjan.kumar@broadcom.com>
+
+[ Upstream commit 3f5eb062e8aa335643181c480e6c590c6cedfd22 ]
+
+Issue a Diag-Reset when the "Doorbell-In-Use" bit is set during the
+driver load/initialization.
+
+Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
+Link: https://lore.kernel.org/r/20241110173341.11595-2-ranjan.kumar@broadcom.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_base.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
+index 8acf586dc8b2..a5d12b95fbd0 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -7050,11 +7050,12 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes,
+ int i;
+ u8 failed;
+ __le32 *mfp;
++ int ret_val;
+
+ /* make sure doorbell is not in use */
+ if ((ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) {
+ ioc_err(ioc, "doorbell is in use (line=%d)\n", __LINE__);
+- return -EFAULT;
++ goto doorbell_diag_reset;
+ }
+
+ /* clear pending doorbell interrupts from previous state changes */
+@@ -7144,6 +7145,10 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes,
+ le32_to_cpu(mfp[i]));
+ }
+ return 0;
++
++doorbell_diag_reset:
++ ret_val = _base_diag_reset(ioc);
++ return ret_val;
+ }
+
+ /**
+--
+2.39.5
+
--- /dev/null
+From b6257d5d2c10b8d432222ba1b186987e9fecda05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2024 23:51:49 +0100
+Subject: scsi: qla1280: Fix hw revision numbering for ISP1020/1040
+
+From: Magnus Lindholm <linmag7@gmail.com>
+
+[ Upstream commit c064de86d2a3909222d5996c5047f64c7a8f791b ]
+
+Fix the hardware revision numbering for Qlogic ISP1020/1040 boards. HWMASK
+suggests that the revision number only needs four bits, this is consistent
+with how NetBSD does things in their ISP driver. Verified on a IPS1040B
+which is seen as rev 5 not as BIT_4.
+
+Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
+Link: https://lore.kernel.org/r/20241113225636.2276-1-linmag7@gmail.com
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla1280.h | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/scsi/qla1280.h b/drivers/scsi/qla1280.h
+index d309e2ca14de..dea2290b37d4 100644
+--- a/drivers/scsi/qla1280.h
++++ b/drivers/scsi/qla1280.h
+@@ -116,12 +116,12 @@ struct device_reg {
+ uint16_t id_h; /* ID high */
+ uint16_t cfg_0; /* Configuration 0 */
+ #define ISP_CFG0_HWMSK 0x000f /* Hardware revision mask */
+-#define ISP_CFG0_1020 BIT_0 /* ISP1020 */
+-#define ISP_CFG0_1020A BIT_1 /* ISP1020A */
+-#define ISP_CFG0_1040 BIT_2 /* ISP1040 */
+-#define ISP_CFG0_1040A BIT_3 /* ISP1040A */
+-#define ISP_CFG0_1040B BIT_4 /* ISP1040B */
+-#define ISP_CFG0_1040C BIT_5 /* ISP1040C */
++#define ISP_CFG0_1020 1 /* ISP1020 */
++#define ISP_CFG0_1020A 2 /* ISP1020A */
++#define ISP_CFG0_1040 3 /* ISP1040 */
++#define ISP_CFG0_1040A 4 /* ISP1040A */
++#define ISP_CFG0_1040B 5 /* ISP1040B */
++#define ISP_CFG0_1040C 6 /* ISP1040C */
+ uint16_t cfg_1; /* Configuration 1 */
+ #define ISP_CFG1_F128 BIT_6 /* 128-byte FIFO threshold */
+ #define ISP_CFG1_F64 BIT_4|BIT_5 /* 128-byte FIFO threshold */
+--
+2.39.5
+
--- /dev/null
+From dcf3cb4f5cb8f1d4b8137d4087cc691374c3e026 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2024 13:13:24 -0500
+Subject: scsi: storvsc: Do not flag MAINTENANCE_IN return of
+ SRB_STATUS_DATA_OVERRUN as an error
+
+From: Cathy Avery <cavery@redhat.com>
+
+[ Upstream commit b1aee7f034615b6824d2c70ddb37ef9fc23493b7 ]
+
+This partially reverts commit 812fe6420a6e ("scsi: storvsc: Handle
+additional SRB status values").
+
+HyperV does not support MAINTENANCE_IN resulting in FC passthrough
+returning the SRB_STATUS_DATA_OVERRUN value. Now that
+SRB_STATUS_DATA_OVERRUN is treated as an error, multipath ALUA paths go
+into a faulty state as multipath ALUA submits RTPG commands via
+MAINTENANCE_IN.
+
+[ 3.215560] hv_storvsc 1d69d403-9692-4460-89f9-a8cbcc0f94f3:
+tag#230 cmd 0xa3 status: scsi 0x0 srb 0x12 hv 0xc0000001
+[ 3.215572] scsi 1:0:0:32: alua: rtpg failed, result 458752
+
+Make MAINTENANCE_IN return success to avoid the error path as is
+currently done with INQUIRY and MODE_SENSE.
+
+Suggested-by: Michael Kelley <mhklinux@outlook.com>
+Signed-off-by: Cathy Avery <cavery@redhat.com>
+Link: https://lore.kernel.org/r/20241127181324.3318443-1-cavery@redhat.com
+Reviewed-by: Michael Kelley <mhklinux@outlook.com>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/storvsc_drv.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
+index 7ceb982040a5..d0b55c1fa908 100644
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -149,6 +149,8 @@ struct hv_fc_wwn_packet {
+ */
+ static int vmstor_proto_version;
+
++static bool hv_dev_is_fc(struct hv_device *hv_dev);
++
+ #define STORVSC_LOGGING_NONE 0
+ #define STORVSC_LOGGING_ERROR 1
+ #define STORVSC_LOGGING_WARN 2
+@@ -1138,6 +1140,7 @@ static void storvsc_on_io_completion(struct storvsc_device *stor_device,
+ * not correctly handle:
+ * INQUIRY command with page code parameter set to 0x80
+ * MODE_SENSE command with cmd[2] == 0x1c
++ * MAINTENANCE_IN is not supported by HyperV FC passthrough
+ *
+ * Setup srb and scsi status so this won't be fatal.
+ * We do this so we can distinguish truly fatal failues
+@@ -1145,7 +1148,9 @@ static void storvsc_on_io_completion(struct storvsc_device *stor_device,
+ */
+
+ if ((stor_pkt->vm_srb.cdb[0] == INQUIRY) ||
+- (stor_pkt->vm_srb.cdb[0] == MODE_SENSE)) {
++ (stor_pkt->vm_srb.cdb[0] == MODE_SENSE) ||
++ (stor_pkt->vm_srb.cdb[0] == MAINTENANCE_IN &&
++ hv_dev_is_fc(device))) {
+ vstor_packet->vm_srb.scsi_status = 0;
+ vstor_packet->vm_srb.srb_status = SRB_STATUS_SUCCESS;
+ }
+--
+2.39.5
+
dmaengine-apple-admac-avoid-accessing-registers-in-probe.patch
dmaengine-at_xdmac-avoid-null_prt_deref-in-at_xdmac_prep_dma_memset.patch
mtd-rawnand-fix-double-free-in-atmel_pmecc_create_user.patch
+powerpc-pseries-vas-add-close-callback-in-vas_vm_ops.patch
+stddef-make-__struct_group-uapi-c-friendly.patch
+tracing-kprobe-make-trace_kprobe-s-module-callback-c.patch
+watchdog-it87_wdt-add-pwrgd-enable-quirk-for-qotom-q.patch
+watchdog-mediatek-add-support-for-mt6735-toprgu-wdt.patch
+scsi-qla1280-fix-hw-revision-numbering-for-isp1020-1.patch
+scsi-megaraid_sas-fix-for-a-potential-deadlock.patch
+udf-skip-parent-dir-link-count-update-if-corrupted.patch
+alsa-hda-conexant-fix-z60mr100-startup-pop-issue.patch
+alsa-sh-use-standard-helper-for-buffer-accesses.patch
+smb-server-fix-building-with-gcc-15.patch
+regmap-use-correct-format-specifier-for-logging-rang.patch
+loongarch-fix-reserving-screen-info-memory-for-above.patch
+loongarch-bpf-adjust-the-parameter-of-emit_jirl.patch
+platform-x86-asus-nb-wmi-ignore-unknown-event-0xcf.patch
+spi-intel-add-panther-lake-spi-controller-support.patch
+scsi-mpt3sas-diag-reset-when-doorbell-in-use-bit-is-.patch
+scsi-storvsc-do-not-flag-maintenance_in-return-of-sr.patch
+spi-omap2-mcspi-fix-the-is_err-bug-for-devm_clk_get_.patch
+drm-dp_mst-ensure-mst_primary-pointer-is-valid-in-dr.patch
+virtio-blk-don-t-keep-queue-frozen-during-system-sus.patch
+blk-mq-register-cpuhp-callback-after-hctx-is-added-t.patch
+blk-mq-move-cpuhp-callback-registering-out-of-q-sysf.patch
--- /dev/null
+From 897f1261c093a3d1f0456da110528d739625c734 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Nov 2024 11:41:35 +0530
+Subject: smb: server: Fix building with GCC 15
+
+From: Brahmajit Das <brahmajit.xyz@gmail.com>
+
+[ Upstream commit e18655cf35a5958fbf4ae9ca3ebf28871a3a1801 ]
+
+GCC 15 introduces -Werror=unterminated-string-initialization by default,
+this results in the following build error
+
+fs/smb/server/smb_common.c:21:35: error: initializer-string for array of 'char' is too long [-Werror=unterminated-string-ini
+tialization]
+ 21 | static const char basechars[43] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_-!@#$%";
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+cc1: all warnings being treated as errors
+
+To this we are replacing char basechars[43] with a character pointer
+and then using strlen to get the length.
+
+Signed-off-by: Brahmajit Das <brahmajit.xyz@gmail.com>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/smb_common.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/smb/server/smb_common.c b/fs/smb/server/smb_common.c
+index 663b014b9d18..23537e1b3468 100644
+--- a/fs/smb/server/smb_common.c
++++ b/fs/smb/server/smb_common.c
+@@ -18,8 +18,8 @@
+ #include "mgmt/share_config.h"
+
+ /*for shortname implementation */
+-static const char basechars[43] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_-!@#$%";
+-#define MANGLE_BASE (sizeof(basechars) / sizeof(char) - 1)
++static const char *basechars = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_-!@#$%";
++#define MANGLE_BASE (strlen(basechars) - 1)
+ #define MAGIC_CHAR '~'
+ #define PERIOD '.'
+ #define mangle(V) ((char)(basechars[(V) % MANGLE_BASE]))
+--
+2.39.5
+
--- /dev/null
+From fa6e24b34180d995e5623e11301c9e6b26aafb3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2024 10:02:08 +0200
+Subject: spi: intel: Add Panther Lake SPI controller support
+
+From: Aapo Vienamo <aapo.vienamo@iki.fi>
+
+[ Upstream commit ceb259e43bf572ba7d766e1679ba73861d16203a ]
+
+The Panther Lake SPI controllers are compatible with the Cannon Lake
+controllers. Add support for following SPI controller device IDs:
+ - H-series: 0xe323
+ - P-series: 0xe423
+ - U-series: 0xe423
+
+Signed-off-by: Aapo Vienamo <aapo.vienamo@iki.fi>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Link: https://patch.msgid.link/20241204080208.1036537-1-mika.westerberg@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-intel-pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-intel-pci.c b/drivers/spi/spi-intel-pci.c
+index 4337ca51d7aa..5c0dec90eec1 100644
+--- a/drivers/spi/spi-intel-pci.c
++++ b/drivers/spi/spi-intel-pci.c
+@@ -86,6 +86,8 @@ static const struct pci_device_id intel_spi_pci_ids[] = {
+ { PCI_VDEVICE(INTEL, 0xa324), (unsigned long)&cnl_info },
+ { PCI_VDEVICE(INTEL, 0xa3a4), (unsigned long)&cnl_info },
+ { PCI_VDEVICE(INTEL, 0xa823), (unsigned long)&cnl_info },
++ { PCI_VDEVICE(INTEL, 0xe323), (unsigned long)&cnl_info },
++ { PCI_VDEVICE(INTEL, 0xe423), (unsigned long)&cnl_info },
+ { },
+ };
+ MODULE_DEVICE_TABLE(pci, intel_spi_pci_ids);
+--
+2.39.5
+
--- /dev/null
+From 246fd29c8a48ebf4ca9389d032e076aca9bf20a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2024 12:34:26 +0530
+Subject: spi: omap2-mcspi: Fix the IS_ERR() bug for
+ devm_clk_get_optional_enabled()
+
+From: Purushothama Siddaiah <psiddaiah@mvista.com>
+
+[ Upstream commit 4c6ac5446d060f0bf435ccc8bc3aa7b7b5f718ad ]
+
+The devm_clk_get_optional_enabled() function returns error
+pointers(PTR_ERR()). So use IS_ERR() to check it.
+
+Verified on K3-J7200 EVM board, without clock node mentioned
+in the device tree.
+
+Signed-off-by: Purushothama Siddaiah <psiddaiah@mvista.com>
+Reviewed-by: Corey Minyard <cminyard@mvista.com>
+Link: https://patch.msgid.link/20241205070426.1861048-1-psiddaiah@mvista.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-omap2-mcspi.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c
+index ddf1c684bcc7..3cfd262c1abc 100644
+--- a/drivers/spi/spi-omap2-mcspi.c
++++ b/drivers/spi/spi-omap2-mcspi.c
+@@ -1521,10 +1521,10 @@ static int omap2_mcspi_probe(struct platform_device *pdev)
+ }
+
+ mcspi->ref_clk = devm_clk_get_optional_enabled(&pdev->dev, NULL);
+- if (mcspi->ref_clk)
+- mcspi->ref_clk_hz = clk_get_rate(mcspi->ref_clk);
+- else
++ if (IS_ERR(mcspi->ref_clk))
+ mcspi->ref_clk_hz = OMAP2_MCSPI_MAX_FREQ;
++ else
++ mcspi->ref_clk_hz = clk_get_rate(mcspi->ref_clk);
+ ctlr->max_speed_hz = mcspi->ref_clk_hz;
+ ctlr->min_speed_hz = mcspi->ref_clk_hz >> 15;
+
+--
+2.39.5
+
--- /dev/null
+From 12707e3649a0f3ece54cae38e897b079294f646b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2024 14:57:34 +0100
+Subject: stddef: make __struct_group() UAPI C++-friendly
+
+From: Alexander Lobakin <aleksander.lobakin@intel.com>
+
+[ Upstream commit 724c6ce38bbaeb4b3f109b0e066d6c0ecd15446c ]
+
+For the most part of the C++ history, it couldn't have type
+declarations inside anonymous unions for different reasons. At the
+same time, __struct_group() relies on the latters, so when the @TAG
+argument is not empty, C++ code doesn't want to build (even under
+`extern "C"`):
+
+../linux/include/uapi/linux/pkt_cls.h:25:24: error:
+'struct tc_u32_sel::<unnamed union>::tc_u32_sel_hdr,' invalid;
+an anonymous union may only have public non-static data members
+[-fpermissive]
+
+The safest way to fix this without trying to switch standards (which
+is impossible in UAPI anyway) etc., is to disable tag declaration
+for that language. This won't break anything since for now it's not
+buildable at all.
+Use a separate definition for __struct_group() when __cplusplus is
+defined to mitigate the error, including the version from tools/.
+
+Fixes: 50d7bd38c3aa ("stddef: Introduce struct_group() helper macro")
+Reported-by: Christopher Ferris <cferris@google.com>
+Closes: https://lore.kernel.org/linux-hardening/Z1HZpe3WE5As8UAz@google.com
+Suggested-by: Kees Cook <kees@kernel.org> # __struct_group_tag()
+Signed-off-by: Alexander Lobakin <aleksander.lobakin@intel.com>
+Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Link: https://lore.kernel.org/r/20241219135734.2130002-1-aleksander.lobakin@intel.com
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/stddef.h | 13 ++++++++++---
+ tools/include/uapi/linux/stddef.h | 15 +++++++++++----
+ 2 files changed, 21 insertions(+), 7 deletions(-)
+
+diff --git a/include/uapi/linux/stddef.h b/include/uapi/linux/stddef.h
+index 2ec6f35cda32..473ad86706d8 100644
+--- a/include/uapi/linux/stddef.h
++++ b/include/uapi/linux/stddef.h
+@@ -8,6 +8,13 @@
+ #define __always_inline inline
+ #endif
+
++/* Not all C++ standards support type declarations inside an anonymous union */
++#ifndef __cplusplus
++#define __struct_group_tag(TAG) TAG
++#else
++#define __struct_group_tag(TAG)
++#endif
++
+ /**
+ * __struct_group() - Create a mirrored named and anonyomous struct
+ *
+@@ -20,13 +27,13 @@
+ * and size: one anonymous and one named. The former's members can be used
+ * normally without sub-struct naming, and the latter can be used to
+ * reason about the start, end, and size of the group of struct members.
+- * The named struct can also be explicitly tagged for layer reuse, as well
+- * as both having struct attributes appended.
++ * The named struct can also be explicitly tagged for layer reuse (C only),
++ * as well as both having struct attributes appended.
+ */
+ #define __struct_group(TAG, NAME, ATTRS, MEMBERS...) \
+ union { \
+ struct { MEMBERS } ATTRS; \
+- struct TAG { MEMBERS } ATTRS NAME; \
++ struct __struct_group_tag(TAG) { MEMBERS } ATTRS NAME; \
+ } ATTRS
+
+ #ifdef __cplusplus
+diff --git a/tools/include/uapi/linux/stddef.h b/tools/include/uapi/linux/stddef.h
+index bb6ea517efb5..c53cde425406 100644
+--- a/tools/include/uapi/linux/stddef.h
++++ b/tools/include/uapi/linux/stddef.h
+@@ -8,6 +8,13 @@
+ #define __always_inline __inline__
+ #endif
+
++/* Not all C++ standards support type declarations inside an anonymous union */
++#ifndef __cplusplus
++#define __struct_group_tag(TAG) TAG
++#else
++#define __struct_group_tag(TAG)
++#endif
++
+ /**
+ * __struct_group() - Create a mirrored named and anonyomous struct
+ *
+@@ -20,14 +27,14 @@
+ * and size: one anonymous and one named. The former's members can be used
+ * normally without sub-struct naming, and the latter can be used to
+ * reason about the start, end, and size of the group of struct members.
+- * The named struct can also be explicitly tagged for layer reuse, as well
+- * as both having struct attributes appended.
++ * The named struct can also be explicitly tagged for layer reuse (C only),
++ * as well as both having struct attributes appended.
+ */
+ #define __struct_group(TAG, NAME, ATTRS, MEMBERS...) \
+ union { \
+ struct { MEMBERS } ATTRS; \
+- struct TAG { MEMBERS } ATTRS NAME; \
+- }
++ struct __struct_group_tag(TAG) { MEMBERS } ATTRS NAME; \
++ } ATTRS
+
+ /**
+ * __DECLARE_FLEX_ARRAY() - Declare a flexible array usable in a union
+--
+2.39.5
+
--- /dev/null
+From 7ad3b21a048242b9c8c7bdd9570f0224936de14f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2024 09:10:55 +0900
+Subject: tracing/kprobe: Make trace_kprobe's module callback called after
+ jump_label update
+
+From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+
+[ Upstream commit d685d55dfc86b1a4bdcec77c3c1f8a83f181264e ]
+
+Make sure the trace_kprobe's module notifer callback function is called
+after jump_label's callback is called. Since the trace_kprobe's callback
+eventually checks jump_label address during registering new kprobe on
+the loading module, jump_label must be updated before this registration
+happens.
+
+Link: https://lore.kernel.org/all/173387585556.995044.3157941002975446119.stgit@devnote2/
+
+Fixes: 614243181050 ("tracing/kprobes: Support module init function probing")
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_kprobe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
+index 94cb09d44115..508c10414a93 100644
+--- a/kernel/trace/trace_kprobe.c
++++ b/kernel/trace/trace_kprobe.c
+@@ -702,7 +702,7 @@ static int trace_kprobe_module_callback(struct notifier_block *nb,
+
+ static struct notifier_block trace_kprobe_module_nb = {
+ .notifier_call = trace_kprobe_module_callback,
+- .priority = 1 /* Invoked after kprobe module callback */
++ .priority = 2 /* Invoked after kprobe and jump_label module callback */
+ };
+
+ static int count_symbols(void *data, unsigned long unused)
+--
+2.39.5
+
--- /dev/null
+From 5f5434426d4e1e3e3017bd83f1e0574519d4ae9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Nov 2024 12:46:00 +0100
+Subject: udf: Skip parent dir link count update if corrupted
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit c5566903af56dd1abb092f18dcb0c770d6cd8dcb ]
+
+If the parent directory link count is too low (likely directory inode
+corruption), just skip updating its link count as if it goes to 0 too
+early it can cause unexpected issues.
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/udf/namei.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/udf/namei.c b/fs/udf/namei.c
+index 605f182da42c..b3f57ad2b869 100644
+--- a/fs/udf/namei.c
++++ b/fs/udf/namei.c
+@@ -521,7 +521,11 @@ static int udf_rmdir(struct inode *dir, struct dentry *dentry)
+ inode->i_nlink);
+ clear_nlink(inode);
+ inode->i_size = 0;
+- inode_dec_link_count(dir);
++ if (dir->i_nlink >= 3)
++ inode_dec_link_count(dir);
++ else
++ udf_warn(inode->i_sb, "parent dir link count too low (%u)\n",
++ dir->i_nlink);
+ udf_add_fid_counter(dir->i_sb, true, -1);
+ dir->i_mtime = inode_set_ctime_to_ts(dir,
+ inode_set_ctime_current(inode));
+--
+2.39.5
+
--- /dev/null
+From c8491114f84b7a6436266b025c0d5c3aec53e034 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Nov 2024 20:58:21 +0800
+Subject: virtio-blk: don't keep queue frozen during system suspend
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 7678abee0867e6b7fb89aa40f6e9f575f755fb37 ]
+
+Commit 4ce6e2db00de ("virtio-blk: Ensure no requests in virtqueues before
+deleting vqs.") replaces queue quiesce with queue freeze in virtio-blk's
+PM callbacks. And the motivation is to drain inflight IOs before suspending.
+
+block layer's queue freeze looks very handy, but it is also easy to cause
+deadlock, such as, any attempt to call into bio_queue_enter() may run into
+deadlock if the queue is frozen in current context. There are all kinds
+of ->suspend() called in suspend context, so keeping queue frozen in the
+whole suspend context isn't one good idea. And Marek reported lockdep
+warning[1] caused by virtio-blk's freeze queue in virtblk_freeze().
+
+[1] https://lore.kernel.org/linux-block/ca16370e-d646-4eee-b9cc-87277c89c43c@samsung.com/
+
+Given the motivation is to drain in-flight IOs, it can be done by calling
+freeze & unfreeze, meantime restore to previous behavior by keeping queue
+quiesced during suspend.
+
+Cc: Yi Sun <yi.sun@unisoc.com>
+Cc: Michael S. Tsirkin <mst@redhat.com>
+Cc: Jason Wang <jasowang@redhat.com>
+Cc: Stefan Hajnoczi <stefanha@redhat.com>
+Cc: virtualization@lists.linux.dev
+Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+Link: https://lore.kernel.org/r/20241112125821.1475793-1-ming.lei@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/virtio_blk.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index 997106fe73e4..65a1f1576e55 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -1624,9 +1624,12 @@ static void virtblk_remove(struct virtio_device *vdev)
+ static int virtblk_freeze(struct virtio_device *vdev)
+ {
+ struct virtio_blk *vblk = vdev->priv;
++ struct request_queue *q = vblk->disk->queue;
+
+ /* Ensure no requests in virtqueues before deleting vqs. */
+- blk_mq_freeze_queue(vblk->disk->queue);
++ blk_mq_freeze_queue(q);
++ blk_mq_quiesce_queue_nowait(q);
++ blk_mq_unfreeze_queue(q);
+
+ /* Ensure we don't receive any more interrupts */
+ virtio_reset_device(vdev);
+@@ -1650,8 +1653,8 @@ static int virtblk_restore(struct virtio_device *vdev)
+ return ret;
+
+ virtio_device_ready(vdev);
++ blk_mq_unquiesce_queue(vblk->disk->queue);
+
+- blk_mq_unfreeze_queue(vblk->disk->queue);
+ return 0;
+ }
+ #endif
+--
+2.39.5
+
--- /dev/null
+From be70d7e9272abeb9a1f42157a167395bef19083a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2024 00:34:40 -0600
+Subject: watchdog: it87_wdt: add PWRGD enable quirk for Qotom QCML04
+
+From: James Hilliard <james.hilliard1@gmail.com>
+
+[ Upstream commit 43439076383a7611300334d1357c0f8883f40816 ]
+
+For the watchdog timer to work properly on the QCML04 board we need to
+set PWRGD enable in the Environment Controller Configuration Registers
+Special Configuration Register 1 when it is not already set, this may
+be the case when the watchdog is not enabled from within the BIOS.
+
+Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20241025063441.3494837-1-james.hilliard1@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/it87_wdt.c | 39 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 39 insertions(+)
+
+diff --git a/drivers/watchdog/it87_wdt.c b/drivers/watchdog/it87_wdt.c
+index 843f9f8e3917..239947df613d 100644
+--- a/drivers/watchdog/it87_wdt.c
++++ b/drivers/watchdog/it87_wdt.c
+@@ -20,6 +20,8 @@
+
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
++#include <linux/bits.h>
++#include <linux/dmi.h>
+ #include <linux/init.h>
+ #include <linux/io.h>
+ #include <linux/kernel.h>
+@@ -40,6 +42,7 @@
+ #define VAL 0x2f
+
+ /* Logical device Numbers LDN */
++#define EC 0x04
+ #define GPIO 0x07
+
+ /* Configuration Registers and Functions */
+@@ -71,6 +74,12 @@
+ #define IT8784_ID 0x8784
+ #define IT8786_ID 0x8786
+
++/* Environment Controller Configuration Registers LDN=0x04 */
++#define SCR1 0xfa
++
++/* Environment Controller Bits SCR1 */
++#define WDT_PWRGD 0x20
++
+ /* GPIO Configuration Registers LDN=0x07 */
+ #define WDTCTRL 0x71
+ #define WDTCFG 0x72
+@@ -233,6 +242,21 @@ static int wdt_set_timeout(struct watchdog_device *wdd, unsigned int t)
+ return ret;
+ }
+
++enum {
++ IT87_WDT_OUTPUT_THROUGH_PWRGD = BIT(0),
++};
++
++static const struct dmi_system_id it87_quirks[] = {
++ {
++ /* Qotom Q30900P (IT8786) */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "QCML04"),
++ },
++ .driver_data = (void *)IT87_WDT_OUTPUT_THROUGH_PWRGD,
++ },
++ {}
++};
++
+ static const struct watchdog_info ident = {
+ .options = WDIOF_SETTIMEOUT | WDIOF_MAGICCLOSE | WDIOF_KEEPALIVEPING,
+ .firmware_version = 1,
+@@ -254,8 +278,10 @@ static struct watchdog_device wdt_dev = {
+
+ static int __init it87_wdt_init(void)
+ {
++ const struct dmi_system_id *dmi_id;
+ u8 chip_rev;
+ u8 ctrl;
++ int quirks = 0;
+ int rc;
+
+ rc = superio_enter();
+@@ -266,6 +292,10 @@ static int __init it87_wdt_init(void)
+ chip_rev = superio_inb(CHIPREV) & 0x0f;
+ superio_exit();
+
++ dmi_id = dmi_first_match(it87_quirks);
++ if (dmi_id)
++ quirks = (long)dmi_id->driver_data;
++
+ switch (chip_type) {
+ case IT8702_ID:
+ max_units = 255;
+@@ -326,6 +356,15 @@ static int __init it87_wdt_init(void)
+ superio_outb(0x00, WDTCTRL);
+ }
+
++ if (quirks & IT87_WDT_OUTPUT_THROUGH_PWRGD) {
++ superio_select(EC);
++ ctrl = superio_inb(SCR1);
++ if (!(ctrl & WDT_PWRGD)) {
++ ctrl |= WDT_PWRGD;
++ superio_outb(ctrl, SCR1);
++ }
++ }
++
+ superio_exit();
+
+ if (timeout < 1 || timeout > max_units * 60) {
+--
+2.39.5
+
--- /dev/null
+From 923d50eca9ba2894a26d2adfd2930d3ff715b423 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2024 10:47:55 +0000
+Subject: watchdog: mediatek: Add support for MT6735 TOPRGU/WDT
+
+From: Yassine Oudjana <y.oudjana@protonmail.com>
+
+[ Upstream commit 15ddf704f56f8c95ff74dfd1157ed8646b322fa1 ]
+
+Add support for the Top Reset Generation Unit/Watchdog Timer found on
+MT6735.
+
+Signed-off-by: Yassine Oudjana <y.oudjana@protonmail.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20241106104738.195968-3-y.oudjana@protonmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/mtk_wdt.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/watchdog/mtk_wdt.c b/drivers/watchdog/mtk_wdt.c
+index 0559d9f2d97b..66bb68ceb14c 100644
+--- a/drivers/watchdog/mtk_wdt.c
++++ b/drivers/watchdog/mtk_wdt.c
+@@ -10,6 +10,7 @@
+ */
+
+ #include <dt-bindings/reset/mt2712-resets.h>
++#include <dt-bindings/reset/mediatek,mt6735-wdt.h>
+ #include <dt-bindings/reset/mediatek,mt6795-resets.h>
+ #include <dt-bindings/reset/mt7986-resets.h>
+ #include <dt-bindings/reset/mt8183-resets.h>
+@@ -81,6 +82,10 @@ static const struct mtk_wdt_data mt2712_data = {
+ .toprgu_sw_rst_num = MT2712_TOPRGU_SW_RST_NUM,
+ };
+
++static const struct mtk_wdt_data mt6735_data = {
++ .toprgu_sw_rst_num = MT6735_TOPRGU_RST_NUM,
++};
++
+ static const struct mtk_wdt_data mt6795_data = {
+ .toprgu_sw_rst_num = MT6795_TOPRGU_SW_RST_NUM,
+ };
+@@ -448,6 +453,7 @@ static int mtk_wdt_resume(struct device *dev)
+ static const struct of_device_id mtk_wdt_dt_ids[] = {
+ { .compatible = "mediatek,mt2712-wdt", .data = &mt2712_data },
+ { .compatible = "mediatek,mt6589-wdt" },
++ { .compatible = "mediatek,mt6735-wdt", .data = &mt6735_data },
+ { .compatible = "mediatek,mt6795-wdt", .data = &mt6795_data },
+ { .compatible = "mediatek,mt7986-wdt", .data = &mt7986_data },
+ { .compatible = "mediatek,mt8183-wdt", .data = &mt8183_data },
+--
+2.39.5
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
