commit 62b19b564504d027296502e0e30baf5fe0ef080a
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Sat Jan 20 11:51:49 2024 +0100

    Linux 6.6.13
    
    Link: https://lore.kernel.org/r/20240118104320.029537060@linuxfoundation.org
    Tested-by: Allen Pais <apais@linux.microsoft.com>
    Tested-by: Salvatore Bonaccorso <carnil@debian.org>
    Tested-by: Shuah Khan <skhan@linuxfoundation.org>
    Tested-by: Bagas Sanjaya <bagasdotme@gmail.com>
    Tested-by: Takeshi Ogasawara <takeshi.ogasawara@futuring-girl.com>
    Tested-by: Jon Hunter <jonathanh@nvidia.com>
    Tested-by: Ron Economos <re@w6rz.net>
    Tested-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
    Tested-by: Justin M. Forbes <jforbes@fedoraproject.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9584c8d658c08ce13df22d070e7f373d9d6696bd
Author: Sumanth Korikkar <sumanthk@linux.ibm.com>
Date:   Wed Jan 10 15:01:27 2024 +0100

    mm/memory_hotplug: fix memmap_on_memory sysfs value retrieval
    
    commit 11684134140bb708b6e6de969a060535630b1b53 upstream.
    
    set_memmap_mode() stores the kernel parameter memmap mode as an integer.
    However, the get_memmap_mode() function utilizes param_get_bool() to fetch
    the value as a boolean, leading to potential endianness issue.  On
    Big-endian architectures, the memmap_on_memory is consistently displayed
    as 'N' regardless of its actual status.
    
    To address this endianness problem, the solution involves obtaining the
    mode as an integer.  This adjustment ensures the proper display of the
    memmap_on_memory parameter, presenting it as one of the following options:
    Force, Y, or N.
    
    Link: https://lkml.kernel.org/r/20240110140127.241451-1-sumanthk@linux.ibm.com
    Fixes: 2d1f649c7c08 ("mm/memory_hotplug: support memmap_on_memory when memmap is not aligned to pageblocks")
    Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
    Suggested-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
    Acked-by: David Hildenbrand <david@redhat.com>
    Cc: Alexander Gordeev <agordeev@linux.ibm.com>
    Cc: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
    Cc: Heiko Carstens <hca@linux.ibm.com>
    Cc: Michal Hocko <mhocko@suse.com>
    Cc: Oscar Salvador <osalvador@suse.de>
    Cc: Vasily Gorbik <gor@linux.ibm.com>
    Cc: <stable@vger.kernel.org>    [6.6+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f54708e4a26d795f372545edf1f9d3f14056d2b5
Author: Carlos Llamas <cmllamas@google.com>
Date:   Fri Sep 29 03:48:17 2023 +0000

    scripts/decode_stacktrace.sh: optionally use LLVM utilities
    
    commit efbd6398353315b7018e6943e41fee9ec35e875f upstream.
    
    GNU's addr2line can have problems parsing a vmlinux built with LLVM,
    particularly when LTO was used.  In order to decode the traces correctly
    this patch adds the ability to switch to LLVM's utilities readelf and
    addr2line.  The same approach is followed by Will in [1].
    
    Before:
      $ scripts/decode_stacktrace.sh vmlinux < kernel.log
      [17716.240635] Call trace:
      [17716.240646] skb_cow_data (??:?)
      [17716.240654] esp6_input (ld-temp.o:?)
      [17716.240666] xfrm_input (ld-temp.o:?)
      [17716.240674] xfrm6_rcv (??:?)
      [...]
    
    After:
      $ LLVM=1 scripts/decode_stacktrace.sh vmlinux < kernel.log
      [17716.240635] Call trace:
      [17716.240646] skb_cow_data (include/linux/skbuff.h:2172 net/core/skbuff.c:4503)
      [17716.240654] esp6_input (net/ipv6/esp6.c:977)
      [17716.240666] xfrm_input (net/xfrm/xfrm_input.c:659)
      [17716.240674] xfrm6_rcv (net/ipv6/xfrm6_input.c:172)
      [...]
    
    Note that one could set CROSS_COMPILE=llvm- instead to hack around this
    issue.  However, doing so can break the decodecode routine as it will
    force the selection of other LLVM utilities down the line e.g.  llvm-as.
    
    [1] https://lore.kernel.org/all/20230914131225.13415-3-will@kernel.org/
    
    Link: https://lkml.kernel.org/r/20230929034836.403735-1-cmllamas@google.com
    Signed-off-by: Carlos Llamas <cmllamas@google.com>
    Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
    Reviewed-by: Elliot Berman <quic_eberman@quicinc.com>
    Tested-by: Justin Stitt <justinstitt@google.com>
    Cc: Will Deacon <will@kernel.org>
    Cc: John Stultz <jstultz@google.com>
    Cc: Masahiro Yamada <masahiroy@kernel.org>
    Cc: Nathan Chancellor <nathan@kernel.org>
    Cc: Tom Rix <trix@redhat.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 09f222d40fae087a3bc5b0990790cb9622e9a0a0
Author: James Clark <james.clark@arm.com>
Date:   Wed Nov 1 11:52:06 2023 +0000

    coresight: etm4x: Fix width of CCITMIN field
    
    commit cc0271a339cc70cae914c3ec20edc2a8058407da upstream.
    
    CCITMIN is a 12 bit field and doesn't fit in a u8, so extend it to u16.
    This probably wasn't an issue previously because values higher than 255
    never occurred.
    
    But since commit 4aff040bcc8d ("coresight: etm: Override TRCIDR3.CCITMIN
    on errata affected cpus"), a comparison with 256 was done to enable the
    errata, generating the following W=1 build error:
    
      coresight-etm4x-core.c:1188:24: error: result of comparison of
      constant 256 with expression of type 'u8' (aka 'unsigned char') is
      always false [-Werror,-Wtautological-constant-out-of-range-compare]
    
       if (drvdata->ccitmin == 256)
    
    Cc: stable@vger.kernel.org
    Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver")
    Reported-by: kernel test robot <lkp@intel.com>
    Closes: https://lore.kernel.org/oe-kbuild-all/202310302043.as36UFED-lkp@intel.com/
    Reviewed-by: Mike Leach <mike.leach@linaro.org>
    Signed-off-by: James Clark <james.clark@arm.com>
    Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
    Link: https://lore.kernel.org/r/20231101115206.70810-1-james.clark@arm.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d6d19c3d1792aaf7e04ebecb79e81bfdc6baab54
Author: LeoLiuoc <LeoLiu-oc@zhaoxin.com>
Date:   Mon Dec 11 17:15:43 2023 +0800

    PCI: Add ACS quirk for more Zhaoxin Root Ports
    
    commit e367e3c765f5477b2e79da0f1399aed49e2d1e37 upstream.
    
    Add more Root Port Device IDs to pci_quirk_zhaoxin_pcie_ports_acs() for
    some new Zhaoxin platforms.
    
    Fixes: 299bd044a6f3 ("PCI: Add ACS quirk for Zhaoxin Root/Downstream Ports")
    Link: https://lore.kernel.org/r/20231211091543.735903-1-LeoLiu-oc@zhaoxin.com
    Signed-off-by: LeoLiuoc <LeoLiu-oc@zhaoxin.com>
    [bhelgaas: update subject, drop changelog, add Fixes, add stable tag, fix
    whitespace, wrap code comment]
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    Cc: <stable@vger.kernel.org>    # 5.7
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7db7504a3e4134b403dbc94fba807529b64ae55a
Author: Florian Eckert <fe@dev.tdt.de>
Date:   Mon Nov 27 09:16:21 2023 +0100

    leds: ledtrig-tty: Free allocated ttyname buffer on deactivate
    
    commit 25054b232681c286fca9c678854f56494d1352cc upstream.
    
    The ttyname buffer for the ledtrig_tty_data struct is allocated in the
    sysfs ttyname_store() function. This buffer must be released on trigger
    deactivation. This was missing and is thus a memory leak.
    
    While we are at it, the TTY handler in the ledtrig_tty_data struct should
    also be returned in case of the trigger deactivation call.
    
    Cc: stable@vger.kernel.org
    Fixes: fd4a641ac88f ("leds: trigger: implement a tty trigger")
    Signed-off-by: Florian Eckert <fe@dev.tdt.de>
    Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
    Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Link: https://lore.kernel.org/r/20231127081621.774866-1-fe@dev.tdt.de
    Signed-off-by: Lee Jones <lee@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 12786872b26a81fadd3895368d9289a2c7bd9129
Author: Cameron Williams <cang1@live.co.uk>
Date:   Thu Nov 2 21:07:06 2023 +0000

    parport: parport_serial: Add Brainboxes device IDs and geometry
    
    commit 6aa1fc5a8085bbc01687aa708dcf2dbe637a5ee3 upstream.
    
    Add device IDs for the Brainboxes UC-203, UC-257, UC-414, UC-475,
    IS-300/IS-500 and PX-263/PX-295 and define the relevant "geometry"
    for the cards.
    This patch requires part 1 of this series.
    
    Cc:  <stable@vger.kernel.org>
    Signed-off-by: Cameron Williams <cang1@live.co.uk>
    Acked-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
    Link: https://lore.kernel.org/r/AS4PR02MB7903A4094564BE28F1F926A6C4A6A@AS4PR02MB7903.eurprd02.prod.outlook.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 03427e7f2a56df2049a4ea46aed5656cd7d88d21
Author: Cameron Williams <cang1@live.co.uk>
Date:   Thu Nov 2 21:07:05 2023 +0000

    parport: parport_serial: Add Brainboxes BAR details
    
    commit 65fde134b0a4ffe838729f9ee11b459a2f6f2815 upstream.
    
    Add BAR/enum entries for Brainboxes serial/parallel cards.
    
    Cc:  <stable@vger.kernel.org>
    Signed-off-by: Cameron Williams <cang1@live.co.uk>
    Acked-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
    Link: https://lore.kernel.org/r/AS4PR02MB79035155C2D5C3333AE6FA52C4A6A@AS4PR02MB7903.eurprd02.prod.outlook.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 35f102607054faafe78d2a6994b18d5d9d6e92ad
Author: Guanghui Feng <guanghuifeng@linux.alibaba.com>
Date:   Thu Dec 21 17:57:43 2023 +0800

    uio: Fix use-after-free in uio_open
    
    commit 0c9ae0b8605078eafc3bea053cc78791e97ba2e2 upstream.
    
    core-1                          core-2
    -------------------------------------------------------
    uio_unregister_device           uio_open
                                    idev = idr_find()
    device_unregister(&idev->dev)
    put_device(&idev->dev)
    uio_device_release
                                    get_device(&idev->dev)
    kfree(idev)
    uio_free_minor(minor)
                                    uio_release
                                    put_device(&idev->dev)
                                    kfree(idev)
    -------------------------------------------------------
    
    In the core-1 uio_unregister_device(), the device_unregister will kfree
    idev when the idev->dev kobject ref is 1. But after core-1
    device_unregister, put_device and before doing kfree, the core-2 may
    get_device. Then:
    1. After core-1 kfree idev, the core-2 will do use-after-free for idev.
    2. When core-2 do uio_release and put_device, the idev will be double
       freed.
    
    To address this issue, we can get idev atomic & inc idev reference with
    minor_lock.
    
    Fixes: 57c5f4df0a5a ("uio: fix crash after the device is unregistered")
    Cc: stable <stable@kernel.org>
    Signed-off-by: Guanghui Feng <guanghuifeng@linux.alibaba.com>
    Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
    Link: https://lore.kernel.org/r/1703152663-59949-1-git-send-email-guanghuifeng@linux.alibaba.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f4d6dbaa437617d41c2c5c3b746cd9a0c42f414b
Author: Carlos Llamas <cmllamas@google.com>
Date:   Fri Dec 1 17:21:36 2023 +0000

    binder: fix comment on binder_alloc_new_buf() return value
    
    commit e1090371e02b601cbfcea175c2a6cc7c955fa830 upstream.
    
    Update the comments of binder_alloc_new_buf() to reflect that the return
    value of the function is now ERR_PTR(-errno) on failure.
    
    No functional changes in this patch.
    
    Cc: stable@vger.kernel.org
    Fixes: 57ada2fb2250 ("binder: add log information for binder transaction failures")
    Reviewed-by: Alice Ryhl <aliceryhl@google.com>
    Signed-off-by: Carlos Llamas <cmllamas@google.com>
    Link: https://lore.kernel.org/r/20231201172212.1813387-8-cmllamas@google.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8040d704adce53d8ad5b37937caa4dc5b9edeb45
Author: Carlos Llamas <cmllamas@google.com>
Date:   Fri Dec 1 17:21:35 2023 +0000

    binder: fix trivial typo of binder_free_buf_locked()
    
    commit 122a3c1cb0ff304c2b8934584fcfea4edb2fe5e3 upstream.
    
    Fix minor misspelling of the function in the comment section.
    
    No functional changes in this patch.
    
    Cc: stable@vger.kernel.org
    Fixes: 0f966cba95c7 ("binder: add flag to clear buffer on txn complete")
    Reviewed-by: Alice Ryhl <aliceryhl@google.com>
    Signed-off-by: Carlos Llamas <cmllamas@google.com>
    Link: https://lore.kernel.org/r/20231201172212.1813387-7-cmllamas@google.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a49087ab93508b60d9b8add91707a22dda832869
Author: Carlos Llamas <cmllamas@google.com>
Date:   Fri Dec 1 17:21:31 2023 +0000

    binder: fix use-after-free in shinker's callback
    
    commit 3f489c2067c5824528212b0fc18b28d51332d906 upstream.
    
    The mmap read lock is used during the shrinker's callback, which means
    that using alloc->vma pointer isn't safe as it can race with munmap().
    As of commit dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in
    munmap") the mmap lock is downgraded after the vma has been isolated.
    
    I was able to reproduce this issue by manually adding some delays and
    triggering page reclaiming through the shrinker's debug sysfs. The
    following KASAN report confirms the UAF:
    
      ==================================================================
      BUG: KASAN: slab-use-after-free in zap_page_range_single+0x470/0x4b8
      Read of size 8 at addr ffff356ed50e50f0 by task bash/478
    
      CPU: 1 PID: 478 Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70
      Hardware name: linux,dummy-virt (DT)
      Call trace:
       zap_page_range_single+0x470/0x4b8
       binder_alloc_free_page+0x608/0xadc
       __list_lru_walk_one+0x130/0x3b0
       list_lru_walk_node+0xc4/0x22c
       binder_shrink_scan+0x108/0x1dc
       shrinker_debugfs_scan_write+0x2b4/0x500
       full_proxy_write+0xd4/0x140
       vfs_write+0x1ac/0x758
       ksys_write+0xf0/0x1dc
       __arm64_sys_write+0x6c/0x9c
    
      Allocated by task 492:
       kmem_cache_alloc+0x130/0x368
       vm_area_alloc+0x2c/0x190
       mmap_region+0x258/0x18bc
       do_mmap+0x694/0xa60
       vm_mmap_pgoff+0x170/0x29c
       ksys_mmap_pgoff+0x290/0x3a0
       __arm64_sys_mmap+0xcc/0x144
    
      Freed by task 491:
       kmem_cache_free+0x17c/0x3c8
       vm_area_free_rcu_cb+0x74/0x98
       rcu_core+0xa38/0x26d4
       rcu_core_si+0x10/0x1c
       __do_softirq+0x2fc/0xd24
    
      Last potentially related work creation:
       __call_rcu_common.constprop.0+0x6c/0xba0
       call_rcu+0x10/0x1c
       vm_area_free+0x18/0x24
       remove_vma+0xe4/0x118
       do_vmi_align_munmap.isra.0+0x718/0xb5c
       do_vmi_munmap+0xdc/0x1fc
       __vm_munmap+0x10c/0x278
       __arm64_sys_munmap+0x58/0x7c
    
    Fix this issue by performing instead a vma_lookup() which will fail to
    find the vma that was isolated before the mmap lock downgrade. Note that
    this option has better performance than upgrading to a mmap write lock
    which would increase contention. Plus, mmap_write_trylock() has been
    recently removed anyway.
    
    Fixes: dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap")
    Cc: stable@vger.kernel.org
    Cc: Liam Howlett <liam.howlett@oracle.com>
    Cc: Minchan Kim <minchan@kernel.org>
    Reviewed-by: Alice Ryhl <aliceryhl@google.com>
    Signed-off-by: Carlos Llamas <cmllamas@google.com>
    Link: https://lore.kernel.org/r/20231201172212.1813387-3-cmllamas@google.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 802c61319ec246b537d7ca36f04af9f8a1a5ee25
Author: Carlos Llamas <cmllamas@google.com>
Date:   Fri Dec 1 17:21:30 2023 +0000

    binder: use EPOLLERR from eventpoll.h
    
    commit 6ac061db9c58ca5b9270b1b3940d2464fb3ff183 upstream.
    
    Use EPOLLERR instead of POLLERR to make sure it is cast to the correct
    __poll_t type. This fixes the following sparse issue:
    
      drivers/android/binder.c:5030:24: warning: incorrect type in return expression (different base types)
      drivers/android/binder.c:5030:24:    expected restricted __poll_t
      drivers/android/binder.c:5030:24:    got int
    
    Fixes: f88982679f54 ("binder: check for binder_thread allocation failure in binder_poll()")
    Cc: stable@vger.kernel.org
    Cc: Eric Biggers <ebiggers@google.com>
    Reviewed-by: Alice Ryhl <aliceryhl@google.com>
    Signed-off-by: Carlos Llamas <cmllamas@google.com>
    Link: https://lore.kernel.org/r/20231201172212.1813387-2-cmllamas@google.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e16a0bbdb7e590a6607b0d82915add738c03c069
Author: Junxiao Bi <junxiao.bi@oracle.com>
Date:   Wed Nov 8 10:22:16 2023 -0800

    Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
    
    commit bed9e27baf52a09b7ba2a3714f1e24e17ced386d upstream.
    
    This reverts commit 5e2cf333b7bd5d3e62595a44d598a254c697cd74.
    
    That commit introduced the following race and can cause system hung.
    
     md_write_start:             raid5d:
     // mddev->in_sync == 1
     set "MD_SB_CHANGE_PENDING"
                                // running before md_write_start wakeup it
                                 waiting "MD_SB_CHANGE_PENDING" cleared
                                 >>>>>>>>> hung
     wakeup mddev->thread
     ...
     waiting "MD_SB_CHANGE_PENDING" cleared
     >>>> hung, raid5d should clear this flag
     but get hung by same flag.
    
    The issue reverted commit fixing is fixed by last patch in a new way.
    
    Fixes: 5e2cf333b7bd ("md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d")
    Cc: stable@vger.kernel.org # v5.19+
    Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
    Reviewed-by: Yu Kuai <yukuai3@huawei.com>
    Signed-off-by: Song Liu <song@kernel.org>
    Link: https://lore.kernel.org/r/20231108182216.73611-2-junxiao.bi@oracle.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 76a10fc65ab96efd7845ebd32af1890b5a5f313c
Author: Fedor Pchelkin <pchelkin@ispras.ru>
Date:   Tue Jan 9 17:14:44 2024 +0300

    ksmbd: free ppace array on error in parse_dacl
    
    commit 8cf9bedfc3c47d24bb0de386f808f925dc52863e upstream.
    
    The ppace array is not freed if one of the init_acl_state() calls inside
    parse_dacl() fails. At the moment the function may fail only due to the
    memory allocation errors so it's highly unlikely in this case but
    nevertheless a fix is needed.
    
    Move ppace allocation after the init_acl_state() calls with proper error
    handling.
    
    Found by Linux Verification Center (linuxtesting.org).
    
    Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
    Cc: stable@vger.kernel.org
    Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
    Acked-by: Namjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ab5c25b6988f5b0227a80ae69420a2f8ab1b96e7
Author: Namjae Jeon <linkinjeon@kernel.org>
Date:   Sun Jan 7 21:24:07 2024 +0900

    ksmbd: don't allow O_TRUNC open on read-only share
    
    commit d592a9158a112d419f341f035d18d02f8d232def upstream.
    
    When file is changed using notepad on read-only share(read_only = yes in
    ksmbd.conf), There is a problem where existing data is truncated.
    notepad in windows try to O_TRUNC open(FILE_OVERWRITE_IF) and all data
    in file is truncated. This patch don't allow  O_TRUNC open on read-only
    share and add KSMBD_TREE_CONN_FLAG_WRITABLE check in smb2_set_info().
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 71be0f674070a5ad54a1c4fb112bb2923b28ea50
Author: Lewis Huang <lewis.huang@amd.com>
Date:   Fri Dec 1 06:25:02 2023 -0700

    drm/amd/display: Pass pwrseq inst for backlight and ABM
    
    commit b17ef04bf3a4346d66404454d6a646343ddc9749 upstream.
    
    [Why]
    OTG inst and pwrseq inst mapping is not align therefore we cannot use
    otg_inst as pwrseq inst to get DCIO register.
    
    [How]
    1. Pass the correct pwrseq instance to dmub when set abm pipe.
    2. LVTMA control index change from panel_inst to pwrseq_inst.
    
    Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
    Reviewed-by: Phil Hsieh <phil.hsieh@amd.com>
    Acked-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com>
    Signed-off-by: Lewis Huang <lewis.huang@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6d4295d61579956bc1c61f2664d980e6e6a02eb6
Author: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Date:   Thu Dec 7 11:54:25 2023 +0200

    ASoC: SOF: Intel: hda-codec: Delay the codec device registration
    
    commit c344ef36dbc2fe920ec7291b68b11fe867a2c8f6 upstream.
    
    The current code flow is:
    1. snd_hdac_device_register()
    2. set parameters needed by the hdac driver
    3. request_codec_module()
       the hdac driver is probed at this point
    
    During boot the codec drivers are not loaded when the hdac device is
    registered, it is going to be probed later when loading the codec module,
    which point the parameters are set.
    
    On module remove/insert
    rmmod snd_sof_pci_intel_tgl
    modprobe snd_sof_pci_intel_tgl
    
    The codec module remains loaded and the driver will be probed when the
    hdac device is created right away, before the parameters for the driver
    has been configured:
    
    1. snd_hdac_device_register()
       the hdac driver is probed at this point
    2. set parameters needed by the hdac driver
    3. request_codec_module()
       will be a NOP as the module is already loaded
    
    Move the snd_hdac_device_register() later, to be done right before
    requesting the codec module to make sure that the parameters are all set
    before the device is created:
    
    1. set parameters needed by the hdac driver
    2. snd_hdac_device_register()
    3. request_codec_module()
    
    This way at the hdac driver probe all parameters will be set in all cases.
    
    Link: https://github.com/thesofproject/linux/issues/4731
    Fixes: a0575b4add21 ("ASoC: hdac_hda: Conditionally register dais for HDMI and Analog")
    Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
    Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
    Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    Link: https://lore.kernel.org/r/20231207095425.19597-1-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Link: https://lore.kernel.org/r/ZYvUIxtrqBQZbNlC@shine.dominikbrodowski.net
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=218304
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 08a2ae1d04029e6e21147aa3a187d2e2de69e320
Author: Sjoerd Simons <sjoerd@collabora.com>
Date:   Tue Nov 28 22:35:05 2023 +0100

    bus: moxtet: Add spi device table
    
    commit aaafe88d5500ba18b33be72458439367ef878788 upstream.
    
    The moxtet module fails to auto-load on. Add a SPI id table to
    allow it to do so.
    
    Signed-off-by: Sjoerd Simons <sjoerd@collabora.com>
    Cc:  <stable@vger.kernel.org>
    Reviewed-by: Marek Behún <kabel@kernel.org>
    Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b0ce6ddc1ca2619c005751bb84e880a27be7df3b
Author: Sjoerd Simons <sjoerd@collabora.com>
Date:   Tue Nov 28 22:35:04 2023 +0100

    bus: moxtet: Mark the irq as shared
    
    commit e7830f5a83e96d8cb8efc0412902a03008f8fbe3 upstream.
    
    The Turris Mox shares the moxtet IRQ with various devices on the board,
    so mark the IRQ as shared in the driver as well.
    
    Without this loading the module will fail with:
      genirq: Flags mismatch irq 40. 00002002 (moxtet) vs. 00002080 (mcp7940x)
    
    Signed-off-by: Sjoerd Simons <sjoerd@collabora.com>
    Cc:  <stable@vger.kernel.org> # v6.2+
    Reviewed-by: Marek Behún <kabel@kernel.org>
    Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2cd4362faa9e234976fbb6e0ca9bbd2c1537a804
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Sat Dec 23 15:57:06 2023 +0100

    ACPI: resource: Add another DMI match for the TongFang GMxXGxx
    
    commit df0cced74159c79e36ce7971f0bf250673296d93 upstream.
    
    The TongFang GMxXGxx, which needs IRQ overriding for the keyboard to work,
    is also sold as the Eluktronics RP-15 which does not use the standard
    TongFang GMxXGxx DMI board_name.
    
    Add an entry for this laptop to the irq1_edge_low_force_override[] DMI
    table to make the internal keyboard functional.
    
    Reported-by: Luis Acuna <ldacuna@gmail.com>
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Cc: All applicable <stable@vger.kernel.org>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3642b5a624967826694ba70c51f2399b8cac5f7a
Author: Tom Jason Schwanke <tom@catboys.cloud>
Date:   Mon Jan 8 16:15:21 2024 +0100

    ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360 13-ay0xxx
    
    commit 6b3d14b7f9b1acaf7303d8499836bf78ee9c470c upstream.
    
    This enables the mute and mic-mute LEDs on the HP Envy X360 13-ay0xxx
    convertibles.
    The quirk 'ALC245_FIXUP_HP_X360_MUTE_LEDS' already exists and is now
    enabled for this device.
    
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=216197
    Signed-off-by: Tom Jason Schwanke <tom@catboys.cloud>
    Cc: <stable@vger.kernel.org>
    Link: https://lore.kernel.org/r/651b26e9-e86b-45dd-aa90-3e43d6b99823@catboys.cloud
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d86c51e956449a57ff201ae495c42a39dd878d9f
Author: Paolo Bonzini <pbonzini@redhat.com>
Date:   Mon Jan 15 11:22:02 2024 +0100

    x86/microcode: do not cache microcode if it will not be used
    
    No relevant upstream kernel due to refactoring in 6.7
    
    Builtin/initrd microcode will not be used the ucode loader is disabled.
    But currently, save_microcode_in_initrd is always performed and it
    accesses MSR_IA32_UCODE_REV even if dis_ucode_ldr is true, and in
    particular even if X86_FEATURE_HYPERVISOR is set; the TDX module does not
    implement the MSR and the result is a call trace at boot for TDX guests.
    
    Mainline Linux fixed this as part of a more complex rework of microcode
    caching that went into 6.7 (see in particular commits dd5e3e3ca6,
    "x86/microcode/intel: Simplify early loading"; and a7939f0167203,
    "x86/microcode/amd: Cache builtin/initrd microcode early").  Do the bare
    minimum in stable kernels, setting initrd_gone just like mainline Linux
    does in mark_initrd_gone().
    
    Note that save_microcode_in_initrd() is not in the microcode application
    path, which runs with paging disabled on 32-bit systems, so it can (and
    has to) use dis_ucode_ldr instead of check_loader_disabled_ap().
    
    Cc: stable@vger.kernel.org # v6.6+
    Cc: x86@kernel.org # v6.6+
    Cc: Dave Hansen <dave.hansen@linux.intel.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Acked-by: Borislav Petkov (AMD) <bp@alien8.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7e881af7fb3c2ddc0c29b249250606fbe004f353
Author: Jani Nikula <jani.nikula@intel.com>
Date:   Fri Dec 8 15:12:38 2023 +0200

    drm/crtc: fix uninitialized variable use
    
    [ Upstream commit 6e455f5dcdd15fa28edf0ffb5b44d3508512dccf ]
    
    Commit 3823119b9c2b ("drm/crtc: Fix uninit-value bug in
    drm_mode_setcrtc") was supposed to fix use of an uninitialized variable,
    but introduced another.
    
    num_connectors is only initialized if crtc_req->count_connectors > 0,
    but it's used regardless. Fix it.
    
    Fixes: 3823119b9c2b ("drm/crtc: Fix uninit-value bug in drm_mode_setcrtc")
    Cc: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com
    Cc: Ziqi Zhao <astrajoan@yahoo.com>
    Cc: Maxime Ripard <mripard@kernel.org>
    Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
    Cc: Thomas Zimmermann <tzimmermann@suse.de>
    Signed-off-by: Jani Nikula <jani.nikula@intel.com>
    Signed-off-by: Maxime Ripard <mripard@kernel.org>
    Link: https://patchwork.freedesktop.org/patch/msgid/20231208131238.2924571-1-jani.nikula@intel.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 2f09679b8ac17288b1b126c6c865ddeb79c6b0f6
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Jun 27 13:55:32 2023 -0700

    x86/csum: clean up `csum_partial' further
    
    [ Upstream commit a476aae3f1dc78a162a0d2e7945feea7d2b29401 ]
    
    Commit 688eb8191b47 ("x86/csum: Improve performance of `csum_partial`")
    ended up improving the code generation for the IP csum calculations, and
    in particular special-casing the 40-byte case that is a hot case for
    IPv6 headers.
    
    It then had _another_ special case for the 64-byte unrolled loop, which
    did two chains of 32-byte blocks, which allows modern CPU's to improve
    performance by doing the chains in parallel thanks to renaming the carry
    flag.
    
    This just unifies the special cases and combines them into just one
    single helper the 40-byte csum case, and replaces the 64-byte case by a
    80-byte case that just does that single helper twice.  It avoids having
    all these different versions of inline assembly, and actually improved
    performance further in my tests.
    
    There was never anything magical about the 64-byte unrolled case, even
    though it happens to be a common size (and typically is the cacheline
    size).
    
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 1078f257eb3ac68b149031747dd8f896b418d881
Author: Noah Goldstein <goldstein.w.n@gmail.com>
Date:   Sun Sep 24 09:35:49 2023 -0500

    x86/csum: Remove unnecessary odd handling
    
    [ Upstream commit 5d4acb62853abac1da2deebcb1c1c5b79219bf3b ]
    
    The special case for odd aligned buffers is unnecessary and mostly
    just adds overhead. Aligned buffers is the expectations, and even for
    unaligned buffer, the only case that was helped is if the buffer was
    1-byte from word aligned which is ~1/7 of the cases. Overall it seems
    highly unlikely to be worth to extra branch.
    
    It was left in the previous perf improvement patch because I was
    erroneously comparing the exact output of `csum_partial(...)`, but
    really we only need `csum_fold(csum_partial(...))` to match so its
    safe to remove.
    
    All csum kunit tests pass.
    
    Signed-off-by: Noah Goldstein <goldstein.w.n@gmail.com>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Reviewed-by: David Laight <david.laight@aculab.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit f99b7b22c0af0e3f093d1ff88afa23271bf0b08a
Author: Stefan Wahren <wahrenst@gmx.net>
Date:   Thu Dec 28 20:39:03 2023 +0100

    ARM: sun9i: smp: fix return code check of of_property_match_string
    
    [ Upstream commit 643fe70e7bcdcc9e2d96952f7fc2bab56385cce5 ]
    
    of_property_match_string returns an int; either an index from 0 or
    greater if successful or negative on failure. Even it's very
    unlikely that the DT CPU node contains multiple enable-methods
    these checks should be fixed.
    
    This patch was inspired by the work of Nick Desaulniers.
    
    Link: https://lore.kernel.org/lkml/20230516-sunxi-v1-1-ac4b9651a8c1@google.com/T/
    Cc: Nick Desaulniers <ndesaulniers@google.com>
    Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
    Link: https://lore.kernel.org/r/20231228193903.9078-2-wahrenst@gmx.net
    Reviewed-by: Chen-Yu Tsai <wens@csie.org>
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 1e6b9bc8cc36474c8cefac57f2503b2a0170ce61
Author: wangkeqi <wangkeqiwang@didiglobal.com>
Date:   Sat Dec 23 14:50:32 2023 +0800

    connector: Fix proc_event_num_listeners count not cleared
    
    [ Upstream commit c46bfba1337d301661dbb23cfd905d4cb51f27ca ]
    
    When we register a cn_proc listening event, the proc_event_num_listener
    variable will be incremented by one, but if PROC_CN_MCAST_IGNORE is
    not called, the count will not decrease.
    This will cause the proc_*_connector function to take the wrong path.
    It will reappear when the forkstat tool exits via ctrl + c.
    We solve this problem by determining whether
    there are still listeners to clear proc_event_num_listener.
    
    Signed-off-by: wangkeqi <wangkeqiwang@didiglobal.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 6a186b28c4fcfbcd9d50f26224457c8fe1dc47d0
Author: Sarannya S <quic_sarannya@quicinc.com>
Date:   Thu Dec 21 15:36:51 2023 +0530

    net: qrtr: ns: Return 0 if server port is not present
    
    [ Upstream commit 9bf2e9165f90dc9f416af53c902be7e33930f728 ]
    
    When a 'DEL_CLIENT' message is received from the remote, the corresponding
    server port gets deleted. A DEL_SERVER message is then announced for this
    server. As part of handling the subsequent DEL_SERVER message, the name-
    server attempts to delete the server port which results in a '-ENOENT' error.
    The return value from server_del() is then propagated back to qrtr_ns_worker,
    causing excessive error prints.
    To address this, return 0 from control_cmd_del_server() without checking the
    return value of server_del(), since the above scenario is not an error case
    and hence server_del() doesn't have any other error return value.
    
    Signed-off-by: Sarannya Sasikumar <quic_sarannya@quicinc.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit e79e7c3aa5222d6ca24a9986c489256e36dec56a
Author: Siddh Raman Pant <code@siddh.me>
Date:   Tue Dec 19 23:19:44 2023 +0530

    nfc: Do not send datagram if socket state isn't LLCP_BOUND
    
    [ Upstream commit 6ec0d7527c4287369b52df3bcefd21a0c4fb2b7c ]
    
    As we know we cannot send the datagram (state can be set to LLCP_CLOSED
    by nfc_llcp_socket_release()), there is no need to proceed further.
    
    Thus, bail out early from llcp_sock_sendmsg().
    
    Signed-off-by: Siddh Raman Pant <code@siddh.me>
    Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Reviewed-by: Suman Ghosh <sumang@marvell.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 79aa992c80381ee8cf96eb2e43659779903c2177
Author: Stefan Hajnoczi <stefanha@redhat.com>
Date:   Mon Dec 4 09:07:43 2023 -0500

    virtio_blk: fix snprintf truncation compiler warning
    
    [ Upstream commit b8e0792449928943c15d1af9f63816911d139267 ]
    
    Commit 4e0400525691 ("virtio-blk: support polling I/O") triggers the
    following gcc 13 W=1 warnings:
    
    drivers/block/virtio_blk.c: In function ‘init_vq’:
    drivers/block/virtio_blk.c:1077:68: warning: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 7 [-Wformat-truncation=]
     1077 |                 snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req_poll.%d", i);
          |                                                                    ^~
    drivers/block/virtio_blk.c:1077:58: note: directive argument in the range [-2147483648, 65534]
     1077 |                 snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req_poll.%d", i);
          |                                                          ^~~~~~~~~~~~~
    drivers/block/virtio_blk.c:1077:17: note: ‘snprintf’ output between 11 and 21 bytes into a destination of size 16
     1077 |                 snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req_poll.%d", i);
          |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    
    This is a false positive because the lower bound -2147483648 is
    incorrect. The true range of i is [0, num_vqs - 1] where 0 < num_vqs <
    65536.
    
    The code mixes int, unsigned short, and unsigned int types in addition
    to using "%d" for an unsigned value. Use unsigned short and "%u"
    consistently to solve the compiler warning.
    
    Cc: Suwan Kim <suwan.kim027@gmail.com>
    Reported-by: kernel test robot <lkp@intel.com>
    Closes: https://lore.kernel.org/oe-kbuild-all/202312041509.DIyvEt9h-lkp@intel.com/
    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
    Message-Id: <20231204140743.1487843-1-stefanha@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit ffcaafdb8be64555e9928d943a3655c755dba92b
Author: Matthew Wilcox (Oracle) <willy@infradead.org>
Date:   Thu Dec 21 16:53:57 2023 +0000

    ida: Fix crash in ida_free when the bitmap is empty
    
    [ Upstream commit af73483f4e8b6f5c68c9aa63257bdd929a9c194a ]
    
    The IDA usually detects double-frees, but that detection failed to
    consider the case when there are no nearby IDs allocated and so we have a
    NULL bitmap rather than simply having a clear bit.  Add some tests to the
    test-suite to be sure we don't inadvertently reintroduce this problem.
    Unfortunately they're quite noisy so include a message to disregard
    the warnings.
    
    Reported-by: Zhenghan Wang <wzhmmmmm@gmail.com>
    Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 766c6c1dd1403a5212888c74647532800169345c
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Dec 19 15:26:59 2023 -0800

    posix-timers: Get rid of [COMPAT_]SYS_NI() uses
    
    [ Upstream commit a4aebe936554dac6a91e5d091179c934f8325708 ]
    
    Only the posix timer system calls use this (when the posix timer support
    is disabled, which does not actually happen in any normal case), because
    they had debug code to print out a warning about missing system calls.
    
    Get rid of that special case, and just use the standard COND_SYSCALL
    interface that creates weak system call stubs that return -ENOSYS for
    when the system call does not exist.
    
    This fixes a kCFI issue with the SYS_NI() hackery:
    
      CFI failure at int80_emulation+0x67/0xb0 (target: sys_ni_posix_timers+0x0/0x70; expected type: 0xb02b34d9)
      WARNING: CPU: 0 PID: 48 at int80_emulation+0x67/0xb0
    
    Reported-by: kernel test robot <oliver.sang@intel.com>
    Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
    Tested-by: Sami Tolvanen <samitolvanen@google.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Dave Hansen <dave.hansen@linux.intel.com>
    Cc: Borislav Petkov <bp@alien8.de>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 406cea6443b6b9276c227db16e768f3c7230ff89
Author: Patrick Rudolph <patrick.rudolph@9elements.com>
Date:   Tue Dec 19 13:51:18 2023 +0100

    pinctrl: cy8c95x0: Fix get_pincfg
    
    [ Upstream commit 94c71705cc49092cef60ece13a28680809096fd4 ]
    
    Invert the register value for PIN_CONFIG_OUTPUT_ENABLE to return
    the opposite of PIN_CONFIG_INPUT_ENABLE.
    
    Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
    Link: https://lore.kernel.org/r/20231219125120.4028862-3-patrick.rudolph@9elements.com
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 5f0a16617f709608b1d208912f2db7c4cade8901
Author: Patrick Rudolph <patrick.rudolph@9elements.com>
Date:   Tue Dec 19 13:51:17 2023 +0100

    pinctrl: cy8c95x0: Fix regression
    
    [ Upstream commit 04dfca968cf7349773126340991b68a83378aca2 ]
    
    Commit 1fa3df901f2c ("pinctrl: cy8c95x0: Remove custom ->set_config()")
    removed support for PIN_CONFIG_INPUT_ENABLE and
    PIN_CONFIG_OUTPUT.
    
    Add the following options to restore functionality:
    - PIN_CONFIG_INPUT_ENABLE
    - PIN_CONFIG_OUTPUT_ENABLE
    
    Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
    Link: https://lore.kernel.org/r/20231219125120.4028862-2-patrick.rudolph@9elements.com
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 3d5729d5cee25c7abdc2470762741dc47d25cacf
Author: Patrick Rudolph <patrick.rudolph@9elements.com>
Date:   Tue Dec 19 13:51:16 2023 +0100

    pinctrl: cy8c95x0: Fix typo
    
    [ Upstream commit 47b1fa48116238208c1b1198dba10f56fc1b6eb2 ]
    
    Fix typo to make pinctrl-cy8c95x compile again.
    
    Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
    Link: https://lore.kernel.org/r/20231219125120.4028862-1-patrick.rudolph@9elements.com
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit a5ba95c226b5c25cd5c8b9df29a1953c85a1531e
Author: Charlene Liu <charlene.liu@amd.com>
Date:   Wed Dec 6 17:14:48 2023 -0500

    drm/amd/display: get dprefclk ss info from integration info table
    
    [ Upstream commit 51e7b64690776a9981355428b537af9048308a95 ]
    
    [why & how]
    we have two SSC_En:
    we get ssc_info from dce_info for MPLL_SSC_EN.
    we used to call VBIOS cmdtbl's smu_info's SS persentage for DPRECLK SS info,
    is used for DP AUDIO and VBIOS' smu_info table was from systemIntegrationInfoTable.
    
    since dcn35 VBIOS removed smu_info, driver need to use integrationInfotable directly.
    
    Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
    Acked-by: Wayne Lin <wayne.lin@amd.com>
    Signed-off-by: Charlene Liu <charlene.liu@amd.com>
    Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 18562b1691e2280858f291d00678468cf70bda5a
Author: Wayne Lin <wayne.lin@amd.com>
Date:   Tue Dec 5 14:55:31 2023 +0800

    drm/amd/display: Add case for dcn35 to support usb4 dmub hpd event
    
    [ Upstream commit 989824589f793120833bef13aa4e21f5a836a707 ]
    
    [Why & how]
    Refactor dc_is_dmub_outbox_supported() a bit and add case for dcn35 to
    register dmub outbox notification irq to handle usb4 relevant hpd event.
    
    Reviewed-by: Roman Li <roman.li@amd.com>
    Reviewed-by: Jun Lei <jun.lei@amd.com>
    Signed-off-by: Wayne Lin <wayne.lin@amd.com>
    Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit bd443910debf71a1c0140c148ffb4f048fff3c2b
Author: Philip Yang <Philip.Yang@amd.com>
Date:   Thu Dec 14 09:42:03 2023 -0500

    drm/amdkfd: svm range always mapped flag not working on APU
    
    [ Upstream commit ebab8c3eb6a6515dc14cd93fc29dd287709da6d3 ]
    
    On gfx943 APU there is no VRAM and page migration, queue CWSR area, svm
    range with always mapped flag, is not mapped to GPU correctly. This
    works fine if retry fault on CWSR area can be recovered, but could cause
    deadlock if there is another retry fault recover waiting for CWSR to
    finish.
    
    Fix this by mapping svm range with always mapped flag to GPU with ACCESS
    attribute if XNACK ON.
    
    There is side effect, because all GPUs have ACCESS attribute by default
    on new svm range with XNACK on, the CWSR area will be mapped to all GPUs
    after this change. This side effect will be fixed with Thunk change to
    set CWSR svm range with ACCESS_IN_PLACE attribute on the GPU that user
    queue is created.
    
    Signed-off-by: Philip Yang <Philip.Yang@amd.com>
    Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 5a358b978618fbda598ccd30aae2243f5f08b206
Author: Jensen Huang <jensenhuang@friendlyarm.com>
Date:   Thu Dec 7 16:21:59 2023 +0800

    i2c: rk3x: fix potential spinlock recursion on poll
    
    [ Upstream commit 19cde9c92b8d3b7ee555d0da3bcb0232d3a784f4 ]
    
    Possible deadlock scenario (on reboot):
    rk3x_i2c_xfer_common(polling)
        -> rk3x_i2c_wait_xfer_poll()
            -> rk3x_i2c_irq(0, i2c);
                --> spin_lock(&i2c->lock);
                ...
            <rk3x i2c interrupt>
            -> rk3x_i2c_irq(0, i2c);
                --> spin_lock(&i2c->lock); (deadlock here)
    
    Store the IRQ number and disable/enable it around the polling transfer.
    This patch has been tested on NanoPC-T4.
    
    Signed-off-by: Jensen Huang <jensenhuang@friendlyarm.com>
    Reviewed-by: Heiko Stuebner <heiko@sntech.de>
    Reviewed-by: Andi Shyti <andi.shyti@kernel.org>
    Signed-off-by: Wolfram Sang <wsa@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit c5e0ed716c52fddea5e625668e75658c3b81d3fc
Author: Paulo Alcantara <pc@manguebit.com>
Date:   Tue Dec 19 13:10:31 2023 -0300

    smb: client: fix potential OOB in smb2_dump_detail()
    
    [ Upstream commit 567320c46a60a3c39b69aa1df802d753817a3f86 ]
    
    Validate SMB message with ->check_message() before calling
    ->calc_smb_size().
    
    This fixes CVE-2023-6610.
    
    Reported-by: j51569436@gmail.com
    Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218219
    Cc; stable@vger.kernel.org
    Signed-off-by: Paulo Alcantara <pc@manguebit.com>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 00e66f948abef3b092598f4f885ecf2fe7b54090
Author: Guilherme G. Piccoli <gpiccoli@igalia.com>
Date:   Tue Dec 5 18:15:51 2023 -0300

    HID: nintendo: Prevent divide-by-zero on code
    
    [ Upstream commit 6eb04ca8c52e3f8c8ea7102ade81d642eee87f4a ]
    
    It was reported [0] that adding a generic joycon to the system caused
    a kernel crash on Steam Deck, with the below panic spew:
    
    divide error: 0000 [#1] PREEMPT SMP NOPTI
    [...]
    Hardware name: Valve Jupiter/Jupiter, BIOS F7A0119 10/24/2023
    RIP: 0010:nintendo_hid_event+0x340/0xcc1 [hid_nintendo]
    [...]
    Call Trace:
     [...]
     ? exc_divide_error+0x38/0x50
     ? nintendo_hid_event+0x340/0xcc1 [hid_nintendo]
     ? asm_exc_divide_error+0x1a/0x20
     ? nintendo_hid_event+0x307/0xcc1 [hid_nintendo]
     hid_input_report+0x143/0x160
     hidp_session_run+0x1ce/0x700 [hidp]
    
    Since it's a divide-by-0 error, by tracking the code for potential
    denominator issues, we've spotted 2 places in which this could happen;
    so let's guard against the possibility and log in the kernel if the
    condition happens. This is specially useful since some data that
    fills some denominators are read from the joycon HW in some cases,
    increasing the potential for flaws.
    
    [0] https://github.com/ValveSoftware/SteamOS/issues/1070
    
    Signed-off-by: Guilherme G. Piccoli <gpiccoli@igalia.com>
    Tested-by: Sam Lantinga <slouken@libsdl.org>
    Signed-off-by: Jiri Kosina <jkosina@suse.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 8d6bda0f95c1a12cd11bbd60d15e75bd938bf9c7
Author: Mike Snitzer <snitzer@kernel.org>
Date:   Wed Dec 13 14:46:19 2023 -0500

    dm audit: fix Kconfig so DM_AUDIT depends on BLK_DEV_DM
    
    [ Upstream commit 6849302fdff126997765d16df355b73231f130d4 ]
    
    Signed-off-by: Mike Snitzer <snitzer@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 5e0e2cb4a1ce925da6663d8a444b43a687e0e4f1
Author: Stefan Binding <sbinding@opensource.cirrus.com>
Date:   Mon Dec 18 15:12:19 2023 +0000

    ALSA: hda/realtek: Add quirks for ASUS Zenbook 2022 Models
    
    [ Upstream commit 51d976079976c800ef19ed1b542602fcf63f0edb ]
    
    These models use 2xCS35L41amps with HDA using SPI and I2C.
    Models use internal and external boost.
    All models require DSD support to be added inside
    cs35l41_hda_property.c
    
    Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com>
    Link: https://lore.kernel.org/r/20231218151221.388745-6-sbinding@opensource.cirrus.com
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 4818174fd58a8de48d88270b059d343c9714a735
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Sun Dec 17 22:32:21 2023 +0100

    ASoC: Intel: bytcr_rt5640: Add new swapped-speakers quirk
    
    [ Upstream commit b1b6131bca35a55a69fadc39d51577968fa2ee97 ]
    
    Some BYTCR x86 tablets with a rt5640 codec have the left and right channels
    of their speakers swapped.
    
    Add a new BYT_RT5640_SWAPPED_SPEAKERS quirk for this which sets
    cfg-spk:swapped in the components string to let userspace know
    about the swapping so that the UCM profile can configure the mixer
    to correct this.
    
    Enable this new quirk on the Medion Lifetab S10346 which has its
    speakers swapped.
    
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    Link: https://msgid.link/r/20231217213221.49424-2-hdegoede@redhat.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit ed1310b53b6fc4ec5f889c4ccde389fba5006435
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Sun Dec 17 22:32:20 2023 +0100

    ASoC: Intel: bytcr_rt5640: Add quirk for the Medion Lifetab S10346
    
    [ Upstream commit 99c7bb44f5749373bc01b73af02b50b69bcbf43d ]
    
    Add a quirk for the Medion Lifetab S10346, this BYTCR tablet has no CHAN
    package in its ACPI tables and uses SSP0-AIF1 rather then SSP0-AIF2 which
    is the default for BYTCR devices.
    
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    Link: https://msgid.link/r/20231217213221.49424-1-hdegoede@redhat.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 1339559bb6dd6550f0ab1252e28427ba8a4b58e0
Author: Mario Limonciello <mario.limonciello@amd.com>
Date:   Mon Dec 11 22:50:06 2023 -0600

    platform/x86/amd/pmc: Disable keyboard wakeup on AMD Framework 13
    
    [ Upstream commit a55bdad5dfd1efd4ed9ffe518897a21ca8e4e193 ]
    
    The Laptop 13 (AMD Ryzen 7040Series) BIOS 03.03 has a workaround
    included in the EC firmware that will cause the EC to emit a "spurious"
    keypress during the resume from s0i3 [1].
    
    This series of keypress events can be observed in the kernel log on
    resume.
    
    ```
    atkbd serio0: Unknown key pressed (translated set 2, code 0x6b on isa0060/serio0).
    atkbd serio0: Use 'setkeycodes 6b <keycode>' to make it known.
    atkbd serio0: Unknown key released (translated set 2, code 0x6b on isa0060/serio0).
    atkbd serio0: Use 'setkeycodes 6b <keycode>' to make it known.
    ```
    
    In some user flows this is harmless, but if a user has specifically
    suspended the laptop and then closed the lid it will cause the laptop
    to wakeup. The laptop wakes up because the ACPI SCI triggers when
    the lid is closed and when the kernel sees that IRQ1 is "also" active.
    The kernel can't distinguish from a real keyboard keypress and wakes the
    system.
    
    Add the model into the list of quirks to disable keyboard wakeup source.
    This is intentionally only matching the production BIOS version in hopes
    that a newer EC firmware included in a newer BIOS can avoid this behavior.
    
    Cc: Kieran Levin <ktl@framework.net>
    Link: https://github.com/FrameworkComputer/EmbeddedController/blob/lotus-zephyr/zephyr/program/lotus/azalea/src/power_sequence.c#L313 [1]
    Link: https://community.frame.work/t/amd-wont-sleep-properly/41755
    Link: https://community.frame.work/t/tracking-framework-amd-ryzen-7040-series-lid-wakeup-behavior-feedback/39128
    Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
    Link: https://lore.kernel.org/r/20231212045006.97581-5-mario.limonciello@amd.com
    Reviewed-by: Hans de Goede <hdegoede@redhat.com>
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 5b235bbc27069bf1466d747555038b5526c563c4
Author: Mario Limonciello <mario.limonciello@amd.com>
Date:   Mon Dec 11 22:50:05 2023 -0600

    platform/x86/amd/pmc: Move keyboard wakeup disablement detection to pmc-quirks
    
    [ Upstream commit b614a4bd73efeddc2b20d9e6deb6c2710373802b ]
    
    Other platforms may need to disable keyboard wakeup besides Cezanne,
    so move the detection into amd_pmc_quirks_init() where it may be applied
    to multiple platforms.
    
    Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
    Link: https://lore.kernel.org/r/20231212045006.97581-4-mario.limonciello@amd.com
    Reviewed-by: Hans de Goede <hdegoede@redhat.com>
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit a7edb661bb85d9e944ede51554b54f74a07af8d9
Author: Mario Limonciello <mario.limonciello@amd.com>
Date:   Mon Dec 11 22:50:04 2023 -0600

    platform/x86/amd/pmc: Only run IRQ1 firmware version check on Cezanne
    
    [ Upstream commit 2d53c0ab61e62302d7b62d660fe76de2bff6bf45 ]
    
    amd_pmc_wa_czn_irq1() only runs on Cezanne platforms currently but
    may be extended to other platforms in the future.  Rename the function
    and only check platform firmware version when it's called for a Cezanne
    based platform.
    
    Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
    Link: https://lore.kernel.org/r/20231212045006.97581-3-mario.limonciello@amd.com
    Reviewed-by: Hans de Goede <hdegoede@redhat.com>
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit f4fb4b9f1364cc6e46c9ab9a21225ace82e4f3bb
Author: Mario Limonciello <mario.limonciello@amd.com>
Date:   Mon Dec 11 22:50:03 2023 -0600

    platform/x86/amd/pmc: Move platform defines to header
    
    [ Upstream commit 85980669a863514dd47761efd6c1bc4677a2ae08 ]
    
    The platform defines will be used by the quirks in the future,
    so move them to the common header to allow use by both source
    files.
    
    Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
    Link: https://lore.kernel.org/r/20231212045006.97581-2-mario.limonciello@amd.com
    Reviewed-by: Hans de Goede <hdegoede@redhat.com>
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 64954dd2eef16908f72f934cd2a29e648f9313df
Author: Vishnu Sankar <vishnuocv@gmail.com>
Date:   Thu Dec 14 22:47:02 2023 +0900

    platform/x86: thinkpad_acpi: fix for incorrect fan reporting on some ThinkPad systems
    
    [ Upstream commit 66e92e23a72761f5b53f970aeb1badc5fd92fc74 ]
    
    Some ThinkPad systems ECFW use non-standard addresses for fan control
    and reporting. This patch adds support for such ECFW so that it can report
    the correct fan values.
    Tested on Thinkpads L13 Yoga Gen 2 and X13 Yoga Gen 2.
    
    Suggested-by: Mark Pearson <mpearson-lenovo@squebb.ca>
    Signed-off-by: Vishnu Sankar <vishnuocv@gmail.com>
    Reviewed-by: Hans de Goede <hdegoede@redhat.com>
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Link: https://lore.kernel.org/r/20231214134702.166464-1-vishnuocv@gmail.com
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 8e2609cbdee283a66a6261278afe57046d810b9f
Author: Ryan McClelland <rymcclel@gmail.com>
Date:   Thu Dec 14 09:25:41 2023 -0800

    HID: nintendo: fix initializer element is not constant error
    
    [ Upstream commit 0b7dd38c1c520b650a889a81919838671b689eb9 ]
    
    With gcc-7 builds, an error happens with the controller button values being
    defined as const. Change to a define.
    
    Reported-by: kernel test robot <lkp@intel.com>
    Closes: https://lore.kernel.org/oe-kbuild-all/202312141227.C2h1IzfI-lkp@intel.com/
    
    Signed-off-by: Ryan McClelland <rymcclel@gmail.com>
    Reviewed-by: Daniel J. Ogorchock <djogorchock@gmail.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 3e0e4a900fcb1ec96fbf13672132735f99d508e6
Author: Ghanshyam Agrawal <ghanshyam1898@gmail.com>
Date:   Sun Dec 17 13:30:19 2023 +0530

    kselftest: alsa: fixed a print formatting warning
    
    [ Upstream commit 13d605e32e4cfdedcecdf3d98d21710ffe887708 ]
    
    A statement used %d print formatter where %s should have
    been used. The same has been fixed in this commit.
    
    Signed-off-by: Ghanshyam Agrawal <ghanshyam1898@gmail.com>
    Link: 5aaf9efffc57 ("kselftest: alsa: Add simplistic test for ALSA mixer controls kselftest")
    Link: https://lore.kernel.org/r/20231217080019.1063476-1-ghanshyam1898@gmail.com
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 60e916d4b838ff7975012517be307461ec7b48fa
Author: Dan Williams <dan.j.williams@intel.com>
Date:   Wed Dec 13 15:02:35 2023 -0800

    driver core: Add a guard() definition for the device_lock()
    
    [ Upstream commit 134c6eaa6087d78c0e289931ca15ae7a5007670d ]
    
    At present there are ~200 usages of device_lock() in the kernel. Some of
    those usages lead to "goto unlock;" patterns which have proven to be
    error prone. Define a "device" guard() definition to allow for those to
    be cleaned up and prevent new ones from appearing.
    
    Link: http://lore.kernel.org/r/657897453dda8_269bd29492@dwillia2-mobl3.amr.corp.intel.com.notmuch
    Link: http://lore.kernel.org/r/6577b0c2a02df_a04c5294bb@dwillia2-xfh.jf.intel.com.notmuch
    Cc: Vishal Verma <vishal.l.verma@intel.com>
    Cc: Ira Weiny <ira.weiny@intel.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Dan Williams <dan.j.williams@intel.com>
    Reviewed-by: Ira Weiny <ira.weiny@intel.com>
    Reviewed-by: Dave Jiang <dave.jiang@intel.com>
    Reviewed-by: Vishal Verma <vishal.l.verma@intel.com>
    Link: https://lore.kernel.org/r/170250854466.1522182.17555361077409628655.stgit@dwillia2-xfh.jf.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 1488b369267e61e45ad1d43e0c29023d72b53bc7
Author: Luca Weiss <luca@z3ntu.xyz>
Date:   Sat Nov 25 17:22:15 2023 +0100

    Input: xpad - add Razer Wolverine V2 support
    
    [ Upstream commit c3d1610345b79cbe29ef6ca04a4780eff0d360c7 ]
    
    Add the VID and PID of Razer Wolverine V2 to xpad_device.
    
    Signed-off-by: Luca Weiss <luca@z3ntu.xyz>
    Link: https://lore.kernel.org/r/20231125-razer-wolverine-v2-v1-1-979fe9f9288e@z3ntu.xyz
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 015cfa30b39c517eea226a41349b1ec41efffada
Author: Avraham Stern <avraham.stern@intel.com>
Date:   Thu Dec 7 04:50:17 2023 +0200

    wifi: iwlwifi: pcie: avoid a NULL pointer dereference
    
    [ Upstream commit ce038edfce43fb345f8dfdca0f7b17f535896701 ]
    
    It possible that while the rx rb is being handled, the transport has
    been stopped and re-started. In this case the tx queue pointer is not
    yet initialized, which will lead to a NULL pointer dereference.
    Fix it.
    
    Signed-off-by: Avraham Stern <avraham.stern@intel.com>
    Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
    Link: https://msgid.link/20231207044813.cd0898cafd89.I0b84daae753ba9612092bf383f5c6f761446e964@changeid
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 544ce65cb52a668c442e4756711909a2a878054f
Author: Vineet Gupta <vgupta@kernel.org>
Date:   Fri Dec 8 16:25:23 2023 -0800

    ARC: fix smatch warning
    
    [ Upstream commit 4eb69d00fe967699b9d93f7e74a990fe813e8d2b ]
    
    Reported-by: kernel test robot <lkp@intel.com>
    Reported-by: Dan Carpenter <error27@gmail.com>
    Closes: https://lore.kernel.org/r/202311280906.VAIwEAfT-lkp@intel.com/
    Signed-off-by: Vineet Gupta <vgupta@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 358bca0bb1b4a3f479cba48ee8454dc0d6344ef3
Author: Vineet Gupta <vgupta@kernel.org>
Date:   Fri Dec 8 15:57:07 2023 -0800

    ARC: fix spare error
    
    [ Upstream commit aca02d933f63ba8bc84258bf35f9ffaf6b664336 ]
    
    Reported-by: kernel test robot <lkp@intel.com>
    Closes: https://lore.kernel.org/oe-kbuild-all/202312082320.VDN5A9hb-lkp@intel.com/
    Signed-off-by: Vineet Gupta <vgupta@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit c754028a068f197770a6c3b867eb78b3cf6dc03a
Author: Vineeth Vijayan <vneethv@linux.ibm.com>
Date:   Thu Nov 23 22:52:53 2023 +0100

    s390/scm: fix virtual vs physical address confusion
    
    [ Upstream commit b1a6a1a77f0666a5a6dc0893ab6ec8fcae46f24c ]
    
    Fix virtual vs physical address confusion (which currently are the same).
    
    Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
    Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
    Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
    Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 4361e15ac24b4f928cbdcc18683e282ab8ddbf4c
Author: Ricardo Rivera-Matos <rriveram@opensource.cirrus.com>
Date:   Wed Dec 6 10:03:18 2023 -0600

    ASoC: cs35l45: Prevents spinning during runtime suspend
    
    [ Upstream commit a0ffa8115e1ea9786b03edc3f431d2f4ef3e7a2e ]
    
    Masks the "DSP Virtual Mailbox 2 write" interrupt when before
    issuing the hibernate command to the DSP. The interrupt is
    unmasked when exiting runtime suspend as it is required for
    DSP operation.
    
    Without this change the DSP fires an interrupt when hibernating
    causing the system spin between runtime suspend and runtime
    resume.
    
    Signed-off-by: Ricardo Rivera-Matos <rriveram@opensource.cirrus.com>
    Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
    Link: https://lore.kernel.org/r/20231206160318.1255034-4-rriveram@opensource.cirrus.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit ab65d383a57b5149060bad0e157f357283b1b62a
Author: Ricardo Rivera-Matos <rriveram@opensource.cirrus.com>
Date:   Wed Dec 6 10:03:17 2023 -0600

    ASoC: cs35l45: Prevent IRQ handling when suspending/resuming
    
    [ Upstream commit c3c8b088949b9ccb88da2f84d3c3cc06580a6a43 ]
    
    Use the SYSTEM_SLEEP_PM_OPS handlers to prevent handling an IRQ
    when the system is in the middle of suspending or resuming.
    
    Signed-off-by: Ricardo Rivera-Matos <rriveram@opensource.cirrus.com>
    Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
    Link: https://lore.kernel.org/r/20231206160318.1255034-3-rriveram@opensource.cirrus.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 296e487dd2155282bf48938664d351a5d239f3f2
Author: Ricardo Rivera-Matos <rriveram@opensource.cirrus.com>
Date:   Wed Dec 6 10:03:16 2023 -0600

    ASoC: cs35l45: Use modern pm_ops
    
    [ Upstream commit 12e102b1bd22ee00361559d57a5876445bcb2407 ]
    
    Make use of the recently introduced EXPORT_GPL_DEV_PM_OPS() macro, to
    conditionally export the runtime/system PM functions.
    
    Replace the old SET_{RUNTIME,SYSTEM_SLEEP,NOIRQ_SYSTEM_SLEEP}_PM_OPS()
    helpers with their modern alternatives and get rid of the now
    unnecessary '__maybe_unused' annotations on all PM functions.
    
    Additionally, use the pm_ptr() macro to fix the following errors when
    building with CONFIG_PM disabled:
    
    Signed-off-by: Ricardo Rivera-Matos <rriveram@opensource.cirrus.com>
    Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
    Link: https://lore.kernel.org/r/20231206160318.1255034-2-rriveram@opensource.cirrus.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit a2af708bb197b0efe10c65685defa510f308b663
Author: Mario Limonciello <mario.limonciello@amd.com>
Date:   Sat Dec 2 21:24:31 2023 -0600

    pinctrl: amd: Mask non-wake source pins with interrupt enabled at suspend
    
    [ Upstream commit 2fff0b5e1a6b9c577b4dd4958902c877159c856b ]
    
    If a pin isn't marked as a wake source processing any interrupts is
    just going to destroy battery life.  The APU may wake up from a hardware
    sleep state to process the interrupt but not return control to the OS.
    
    Mask interrupt for all non-wake source pins at suspend. They'll be
    re-enabled at resume.
    
    Reported-and-tested-by: Marcus Aram <marcus+oss@oxar.nl>
    Reported-and-tested-by: Mark Herbert <mark.herbert42@gmail.com>
    Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2812
    Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
    Link: https://lore.kernel.org/r/20231203032431.30277-3-mario.limonciello@amd.com
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 0a4a682b502f1dae2db793415a75f564719fdb3f
Author: Esther Shimanovich <eshimanovich@chromium.org>
Date:   Thu Nov 30 19:56:19 2023 +0000

    Input: i8042 - add nomux quirk for Acer P459-G2-M
    
    [ Upstream commit 335fe00319e030d481a54d5e0e68d50c5e672c0e ]
    
    After the laptop lid is opened, and the device resumes from S3 deep
    sleep, if the user presses a keyboard key while the screen is still black,
    the mouse and keyboard become unusable.
    
    Enabling this quirk prevents this behavior from occurring.
    
    Signed-off-by: Esther Shimanovich <eshimanovich@chromium.org>
    Link: https://lore.kernel.org/r/20231130195615.v2.1.Ibe78a9df97ecd18dc227a5cff67d3029631d9c11@changeid
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 274333f82597a78e884fea359e87c08f8cfd5612
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Fri Nov 24 19:59:24 2023 -0800

    Input: atkbd - skip ATKBD_CMD_GETID in translated mode
    
    [ Upstream commit 936e4d49ecbc8c404790504386e1422b599dec39 ]
    
    There have been multiple reports of keyboard issues on recent laptop models
    which can be worked around by setting i8042.dumbkbd, with the downside
    being this breaks the capslock LED.
    
    It seems that these issues are caused by recent laptops getting confused by
    ATKBD_CMD_GETID. Rather then adding and endless growing list of quirks for
    this, just skip ATKBD_CMD_GETID alltogether on laptops in translated mode.
    
    The main goal of sending ATKBD_CMD_GETID is to skip binding to ps/2
    mice/touchpads and those are never used in translated mode.
    
    Examples of laptop models which benefit from skipping ATKBD_CMD_GETID:
    
    * "HP Laptop 15s-fq2xxx", "HP laptop 15s-fq4xxx" and "HP Laptop 15-dy2xxx"
      models the kbd stops working for the first 2 - 5 minutes after boot
      (waiting for EC watchdog reset?)
    
    * On "HP Spectre x360 13-aw2xxx" atkbd fails to probe the keyboard
    
    * At least 9 different Lenovo models have issues with ATKBD_CMD_GETID, see:
      https://github.com/yescallop/atkbd-nogetid
    
    This has been tested on:
    
    1. A MSI B550M PRO-VDH WIFI desktop, where the i8042 controller is not
       in translated mode when no keyboard is plugged in and with a ps/2 kbd
       a "AT Translated Set 2 keyboard" /dev/input/event# node shows up
    
    2. A Lenovo ThinkPad X1 Yoga gen 8 (always has a translated set 2 keyboard)
    
    Reported-by: Shang Ye <yesh25@mail2.sysu.edu.cn>
    Closes: https://lore.kernel.org/linux-input/886D6167733841AE+20231017135318.11142-1-yesh25@mail2.sysu.edu.cn/
    Closes: https://github.com/yescallop/atkbd-nogetid
    Reported-by: gurevitch <mail@gurevit.ch>
    Closes: https://lore.kernel.org/linux-input/2iAJTwqZV6lQs26cTb38RNYqxvsink6SRmrZ5h0cBUSuf9NT0tZTsf9fEAbbto2maavHJEOP8GA1evlKa6xjKOsaskDhtJWxjcnrgPigzVo=@gurevit.ch/
    Reported-by: Egor Ignatov <egori@altlinux.org>
    Closes: https://lore.kernel.org/all/20210609073333.8425-1-egori@altlinux.org/
    Reported-by: Anton Zhilyaev <anton@cpp.in>
    Closes: https://lore.kernel.org/linux-input/20210201160336.16008-1-anton@cpp.in/
    Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2086156
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Link: https://lore.kernel.org/r/20231115174625.7462-1-hdegoede@redhat.com
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 88c38fd2f3e6b7897d0d5829aaee16b4da361e20
Author: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Date:   Thu Aug 10 11:13:00 2023 +0200

    reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning
    
    [ Upstream commit b5ec294472794ed9ecba0cb4b8208372842e7e0d ]
    
    'type' is an enum, thus cast of pointer on 64-bit compile test with W=1
    causes:
    
      hi6220_reset.c:166:9: error: cast to smaller integer type 'enum hi6220_reset_ctrl_type' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast]
    
    Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Link: https://lore.kernel.org/r/20230810091300.70197-1-krzysztof.kozlowski@linaro.org
    Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit ad2347d78d7b20fa25eb497790c463a783add129
Author: José Pekkarinen <jose.pekkarinen@foxhound.fi>
Date:   Wed Nov 15 16:50:23 2023 +0000

    Input: psmouse - enable Synaptics InterTouch for ThinkPad L14 G1
    
    [ Upstream commit c1f342f35f820b33390571293498c3e2e9bc77ec ]
    
    Observed on dmesg of my laptop I see the following
    output:
    
    [   19.898700] psmouse serio1: synaptics: queried max coordinates: x [..5678], y [..4694]
    [   19.936057] psmouse serio1: synaptics: queried min coordinates: x [1266..], y [1162..]
    [   19.936076] psmouse serio1: synaptics: Your touchpad (PNP: LEN0411 PNP0f13) says it can support a different bus. If i2c-hid and hid-rmi are not used, you might want to try setting psmouse.synaptics_intertouch to 1 and report this to linux-input@vger.kernel.org.
    [   20.008901] psmouse serio1: synaptics: Touchpad model: 1, fw: 10.32, id: 0x1e2a1, caps: 0xf014a3/0x940300/0x12e800/0x500000, board id: 3471, fw id: 2909640
    [   20.008925] psmouse serio1: synaptics: serio: Synaptics pass-through port at isa0060/serio1/input0
    [   20.053344] input: SynPS/2 Synaptics TouchPad as /devices/platform/i8042/serio1/input/input7
    [   20.397608] mousedev: PS/2 mouse device common for all mice
    
    This patch will add its pnp id to the smbus list to
    produce the setup of intertouch for the device.
    
    Signed-off-by: José Pekkarinen <jose.pekkarinen@foxhound.fi>
    Link: https://lore.kernel.org/r/20231114063607.71772-1-jose.pekkarinen@foxhound.fi
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 33e42861eb9568e24710af1a03cd91a92ba94432
Author: Steven Rostedt (Google) <rostedt@goodmis.org>
Date:   Wed Dec 13 17:54:03 2023 -0500

    ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI
    
    [ Upstream commit 712292308af2265cd9b126aedfa987f10f452a33 ]
    
    As the ring buffer recording requires cmpxchg() to work, if the
    architecture does not support cmpxchg in NMI, then do not do any recording
    within an NMI.
    
    Link: https://lore.kernel.org/linux-trace-kernel/20231213175403.6fc18540@gandalf.local.home
    
    Cc: Masami Hiramatsu <mhiramat@kernel.org>
    Cc: Mark Rutland <mark.rutland@arm.com>
    Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
    Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit d9a6029ddee5e792379a604f5c72cc8b632d9944
Author: Zheng Yejian <zhengyejian1@huawei.com>
Date:   Thu Dec 14 09:21:53 2023 +0800

    tracing: Fix uaf issue when open the hist or hist_debug file
    
    [ Upstream commit 1cc111b9cddc71ce161cd388f11f0e9048edffdb ]
    
    KASAN report following issue. The root cause is when opening 'hist'
    file of an instance and accessing 'trace_event_file' in hist_show(),
    but 'trace_event_file' has been freed due to the instance being removed.
    'hist_debug' file has the same problem. To fix it, call
    tracing_{open,release}_file_tr() in file_operations callback to have
    the ref count and avoid 'trace_event_file' being freed.
    
      BUG: KASAN: slab-use-after-free in hist_show+0x11e0/0x1278
      Read of size 8 at addr ffff242541e336b8 by task head/190
    
      CPU: 4 PID: 190 Comm: head Not tainted 6.7.0-rc5-g26aff849438c #133
      Hardware name: linux,dummy-virt (DT)
      Call trace:
       dump_backtrace+0x98/0xf8
       show_stack+0x1c/0x30
       dump_stack_lvl+0x44/0x58
       print_report+0xf0/0x5a0
       kasan_report+0x80/0xc0
       __asan_report_load8_noabort+0x1c/0x28
       hist_show+0x11e0/0x1278
       seq_read_iter+0x344/0xd78
       seq_read+0x128/0x1c0
       vfs_read+0x198/0x6c8
       ksys_read+0xf4/0x1e0
       __arm64_sys_read+0x70/0xa8
       invoke_syscall+0x70/0x260
       el0_svc_common.constprop.0+0xb0/0x280
       do_el0_svc+0x44/0x60
       el0_svc+0x34/0x68
       el0t_64_sync_handler+0xb8/0xc0
       el0t_64_sync+0x168/0x170
    
      Allocated by task 188:
       kasan_save_stack+0x28/0x50
       kasan_set_track+0x28/0x38
       kasan_save_alloc_info+0x20/0x30
       __kasan_slab_alloc+0x6c/0x80
       kmem_cache_alloc+0x15c/0x4a8
       trace_create_new_event+0x84/0x348
       __trace_add_new_event+0x18/0x88
       event_trace_add_tracer+0xc4/0x1a0
       trace_array_create_dir+0x6c/0x100
       trace_array_create+0x2e8/0x568
       instance_mkdir+0x48/0x80
       tracefs_syscall_mkdir+0x90/0xe8
       vfs_mkdir+0x3c4/0x610
       do_mkdirat+0x144/0x200
       __arm64_sys_mkdirat+0x8c/0xc0
       invoke_syscall+0x70/0x260
       el0_svc_common.constprop.0+0xb0/0x280
       do_el0_svc+0x44/0x60
       el0_svc+0x34/0x68
       el0t_64_sync_handler+0xb8/0xc0
       el0t_64_sync+0x168/0x170
    
      Freed by task 191:
       kasan_save_stack+0x28/0x50
       kasan_set_track+0x28/0x38
       kasan_save_free_info+0x34/0x58
       __kasan_slab_free+0xe4/0x158
       kmem_cache_free+0x19c/0x508
       event_file_put+0xa0/0x120
       remove_event_file_dir+0x180/0x320
       event_trace_del_tracer+0xb0/0x180
       __remove_instance+0x224/0x508
       instance_rmdir+0x44/0x78
       tracefs_syscall_rmdir+0xbc/0x140
       vfs_rmdir+0x1cc/0x4c8
       do_rmdir+0x220/0x2b8
       __arm64_sys_unlinkat+0xc0/0x100
       invoke_syscall+0x70/0x260
       el0_svc_common.constprop.0+0xb0/0x280
       do_el0_svc+0x44/0x60
       el0_svc+0x34/0x68
       el0t_64_sync_handler+0xb8/0xc0
       el0t_64_sync+0x168/0x170
    
    Link: https://lore.kernel.org/linux-trace-kernel/20231214012153.676155-1-zhengyejian1@huawei.com
    
    Suggested-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
    Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 0e73f1ba602d953ee8ceda5cea3a381bf212b80b
Author: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Date:   Mon Dec 11 18:33:54 2023 +0800

    MIPS: dts: loongson: drop incorrect dwmac fallback compatible
    
    [ Upstream commit 4907a3f54b12b8209864572a312cf967befcae80 ]
    
    Device binds to proper PCI ID (LOONGSON, 0x7a03), already listed in DTS,
    so checking for some other compatible does not make sense.  It cannot be
    bound to unsupported platform.
    
    Drop useless, incorrect (space in between) and undocumented compatible.
    
    Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Signed-off-by: Yanteng Si <siyanteng@loongson.cn>
    Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
    Acked-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 98707906c64e8c37aa4adb6d1fbde6cdbffc9c43
Author: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Date:   Mon Dec 11 18:33:53 2023 +0800

    stmmac: dwmac-loongson: drop useless check for compatible fallback
    
    [ Upstream commit 31fea092c6f9f8fb2c40a08137907f5fbeae55dd ]
    
    Device binds to proper PCI ID (LOONGSON, 0x7a03), already listed in DTS,
    so checking for some other compatible does not make sense.  It cannot be
    bound to unsupported platform.
    
    Drop useless, incorrect (space in between) and undocumented compatible.
    
    Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Signed-off-by: Yanteng Si <siyanteng@loongson.cn>
    Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
    Acked-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 0df76142ca21ced0eeae57b995315041d356d7de
Author: Steven Rostedt (Google) <rostedt@goodmis.org>
Date:   Tue Dec 12 08:44:44 2023 -0500

    tracing: Add size check when printing trace_marker output
    
    [ Upstream commit 60be76eeabb3d83858cc6577fc65c7d0f36ffd42 ]
    
    If for some reason the trace_marker write does not have a nul byte for the
    string, it will overflow the print:
    
      trace_seq_printf(s, ": %s", field->buf);
    
    The field->buf could be missing the nul byte. To prevent overflow, add the
    max size that the buf can be by using the event size and the field
    location.
    
      int max = iter->ent_size - offsetof(struct print_entry, buf);
    
      trace_seq_printf(s, ": %*.s", max, field->buf);
    
    Link: https://lore.kernel.org/linux-trace-kernel/20231212084444.4619b8ce@gandalf.local.home
    
    Cc: Mark Rutland <mark.rutland@arm.com>
    Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
    Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
    Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit f3dc260cd5f20ff2a5abc01f28da4afc92fb9ea2
Author: Steven Rostedt (Google) <rostedt@goodmis.org>
Date:   Sat Dec 9 17:10:58 2023 -0500

    tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing
    
    [ Upstream commit b55b0a0d7c4aa2dac3579aa7e6802d1f57445096 ]
    
    If a large event was added to the ring buffer that is larger than what the
    trace_seq can handle, it just drops the output:
    
     ~# cat /sys/kernel/tracing/trace
     # tracer: nop
     #
     # entries-in-buffer/entries-written: 2/2   #P:8
     #
     #                                _-----=> irqs-off/BH-disabled
     #                               / _----=> need-resched
     #                              | / _---=> hardirq/softirq
     #                              || / _--=> preempt-depth
     #                              ||| / _-=> migrate-disable
     #                              |||| /     delay
     #           TASK-PID     CPU#  |||||  TIMESTAMP  FUNCTION
     #              | |         |   |||||     |         |
                <...>-859     [001] .....   141.118951: tracing_mark_write           <...>-859     [001] .....   141.148201: tracing_mark_write: 78901234
    
    Instead, catch this case and add some context:
    
     ~# cat /sys/kernel/tracing/trace
     # tracer: nop
     #
     # entries-in-buffer/entries-written: 2/2   #P:8
     #
     #                                _-----=> irqs-off/BH-disabled
     #                               / _----=> need-resched
     #                              | / _---=> hardirq/softirq
     #                              || / _--=> preempt-depth
     #                              ||| / _-=> migrate-disable
     #                              |||| /     delay
     #           TASK-PID     CPU#  |||||  TIMESTAMP  FUNCTION
     #              | |         |   |||||     |         |
                <...>-852     [001] .....   121.550551: tracing_mark_write[LINE TOO BIG]
                <...>-852     [001] .....   121.550581: tracing_mark_write: 78901234
    
    This now emulates the same output as trace_pipe.
    
    Link: https://lore.kernel.org/linux-trace-kernel/20231209171058.78c1a026@gandalf.local.home
    
    Cc: Mark Rutland <mark.rutland@arm.com>
    Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
    Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
    Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit cd70be63167ab3a5821eba586802cea3207ba383
Author: Ye Bin <yebin10@huawei.com>
Date:   Mon Dec 11 19:25:44 2023 +0800

    jbd2: fix soft lockup in journal_finish_inode_data_buffers()
    
    [ Upstream commit 6c02757c936063f0631b4e43fe156f8c8f1f351f ]
    
    There's issue when do io test:
    WARN: soft lockup - CPU#45 stuck for 11s! [jbd2/dm-2-8:4170]
    CPU: 45 PID: 4170 Comm: jbd2/dm-2-8 Kdump: loaded Tainted: G  OE
    Call trace:
     dump_backtrace+0x0/0x1a0
     show_stack+0x24/0x30
     dump_stack+0xb0/0x100
     watchdog_timer_fn+0x254/0x3f8
     __hrtimer_run_queues+0x11c/0x380
     hrtimer_interrupt+0xfc/0x2f8
     arch_timer_handler_phys+0x38/0x58
     handle_percpu_devid_irq+0x90/0x248
     generic_handle_irq+0x3c/0x58
     __handle_domain_irq+0x68/0xc0
     gic_handle_irq+0x90/0x320
     el1_irq+0xcc/0x180
     queued_spin_lock_slowpath+0x1d8/0x320
     jbd2_journal_commit_transaction+0x10f4/0x1c78 [jbd2]
     kjournald2+0xec/0x2f0 [jbd2]
     kthread+0x134/0x138
     ret_from_fork+0x10/0x18
    
    Analyzed informations from vmcore as follows:
    (1) There are about 5k+ jbd2_inode in 'commit_transaction->t_inode_list';
    (2) Now is processing the 855th jbd2_inode;
    (3) JBD2 task has TIF_NEED_RESCHED flag;
    (4) There's no pags in address_space around the 855th jbd2_inode;
    (5) There are some process is doing drop caches;
    (6) Mounted with 'nodioread_nolock' option;
    (7) 128 CPUs;
    
    According to informations from vmcore we know 'journal->j_list_lock' spin lock
    competition is fierce. So journal_finish_inode_data_buffers() maybe process
    slowly. Theoretically, there is scheduling point in the filemap_fdatawait_range_keep_errors().
    However, if inode's address_space has no pages which taged with PAGECACHE_TAG_WRITEBACK,
    will not call cond_resched(). So may lead to soft lockup.
    journal_finish_inode_data_buffers
      filemap_fdatawait_range_keep_errors
        __filemap_fdatawait_range
          while (index <= end)
            nr_pages = pagevec_lookup_range_tag(&pvec, mapping, &index, end, PAGECACHE_TAG_WRITEBACK);
            if (!nr_pages)
               break;    --> If 'nr_pages' is equal zero will break, then will not call cond_resched()
            for (i = 0; i < nr_pages; i++)
              wait_on_page_writeback(page);
            cond_resched();
    
    To solve above issue, add scheduling point in the journal_finish_inode_data_buffers();
    
    Signed-off-by: Ye Bin <yebin10@huawei.com>
    Reviewed-by: Jan Kara <jack@suse.cz>
    Link: https://lore.kernel.org/r/20231211112544.3879780-1-yebin10@huawei.com
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 6e567410d6d376d599e1cd219c8701510fa84aa5
Author: Wang Yao <wangyao@lemote.com>
Date:   Wed Dec 6 08:24:27 2023 +0800

    efi/loongarch: Use load address to calculate kernel entry address
    
    [ Upstream commit 271f2a4a9576b87ed1f8584909d6d270039e52ea ]
    
    The efi_relocate_kernel() may load the PIE kernel to anywhere, the
    loaded address may not be equal to link address or
    EFI_KIMG_PREFERRED_ADDRESS.
    
    Acked-by: Huacai Chen <chenhuacai@loongson.cn>
    Signed-off-by: Wang Yao <wangyao@lemote.com>
    Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 4dceffd823b7371d1ec246827500f90032f02f5e
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Mon Dec 4 16:06:01 2023 +0100

    platform/x86: intel-vbtn: Fix missing tablet-mode-switch events
    
    [ Upstream commit 14c200b7ca46b9a9f4af9e81d258a58274320b6f ]
    
    2 issues have been reported on the Dell Inspiron 7352:
    
    1. Sometimes the tablet-mode-switch stops reporting tablet-mode
       change events.
    
       Add a "VBDL" call to notify_handler() to work around this.
    
    2. Sometimes the tablet-mode is incorrect after suspend/resume
    
       Add a detect_tablet_mode() to resume() to fix this.
    
    Reported-by: Arnold Gozum <arngozum@gmail.com>
    Closes: https://lore.kernel.org/platform-driver-x86/87271a74-c831-4eec-b7a4-1371d0e42471@gmail.com/
    Tested-by: Arnold Gozum <arngozum@gmail.com>
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Reviewed-by: Andy Shevchenko <andy@kernel.org>
    Link: https://lore.kernel.org/r/20231204150601.46976-1-hdegoede@redhat.com
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit cdd8512a5574dba9ca5e84480a1b6f67c0214e80
Author: Judy Hsiao <judyhsiao@chromium.org>
Date:   Wed Dec 6 03:38:33 2023 +0000

    neighbour: Don't let neigh_forced_gc() disable preemption for long
    
    [ Upstream commit e5dc5afff62f3e97e86c3643ec9fcad23de4f2d3 ]
    
    We are seeing cases where neigh_cleanup_and_release() is called by
    neigh_forced_gc() many times in a row with preemption turned off.
    When running on a low powered CPU at a low CPU frequency, this has
    been measured to keep preemption off for ~10 ms. That's not great on a
    system with HZ=1000 which expects tasks to be able to schedule in
    with ~1ms latency.
    
    Suggested-by: Douglas Anderson <dianders@chromium.org>
    Signed-off-by: Judy Hsiao <judyhsiao@chromium.org>
    Reviewed-by: David Ahern <dsahern@kernel.org>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Reviewed-by: Douglas Anderson <dianders@chromium.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit ff89e507b231a3afbddc2972a850947b73247a3b
Author: Ziqi Zhao <astrajoan@yahoo.com>
Date:   Fri Jul 21 09:14:46 2023 -0700

    drm/crtc: Fix uninit-value bug in drm_mode_setcrtc
    
    [ Upstream commit 3823119b9c2b5f9e9b760336f75bc989b805cde6 ]
    
    The connector_set contains uninitialized values when allocated with
    kmalloc_array. However, in the "out" branch, the logic assumes that any
    element in connector_set would be equal to NULL if failed to
    initialize, which causes the bug reported by Syzbot. The fix is to use
    an extra variable to keep track of how many connectors are initialized
    indeed, and use that variable to decrease any refcounts in the "out"
    branch.
    
    Reported-by: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com
    Signed-off-by: Ziqi Zhao <astrajoan@yahoo.com>
    Reported-and-tested-by: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com
    Tested-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
    Link: https://lore.kernel.org/r/20230721161446.8602-1-astrajoan@yahoo.com
    Signed-off-by: Maxime Ripard <mripard@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 5c480a6966c5a2f8a96c8440b10a4acc0fc57624
Author: Zhang Yi <yi.zhang@huawei.com>
Date:   Wed Nov 29 19:47:40 2023 +0800

    jbd2: increase the journal IO's priority
    
    [ Upstream commit 6a3afb6ac6dfab158ebdd4b87941178f58c8939f ]
    
    Current jbd2 only add REQ_SYNC for descriptor block, metadata log
    buffer, commit buffer and superblock buffer, the submitted IO could be
    throttled by writeback throttle in block layer, that could lead to
    priority inversion in some cases. The log IO looks like a kind of high
    priority metadata IO, so it should not be throttled by WBT like QOS
    policies in block layer, let's add REQ_SYNC | REQ_IDLE to exempt from
    writeback throttle, and also add REQ_META together indicates it's a
    metadata IO.
    
    Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
    Reviewed-by: Jan Kara <jack@suse.cz>
    Link: https://lore.kernel.org/r/20231129114740.2686201-2-yi.zhang@huaweicloud.com
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 6459656095e43782e665b398d880c519bba2d77d
Author: Zhang Yi <yi.zhang@huawei.com>
Date:   Wed Nov 29 19:47:39 2023 +0800

    jbd2: correct the printing of write_flags in jbd2_write_superblock()
    
    [ Upstream commit 85559227211020b270728104c3b89918f7af27ac ]
    
    The write_flags print in the trace of jbd2_write_superblock() is not
    real, so move the modification before the trace.
    
    Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
    Reviewed-by: Jan Kara <jack@suse.cz>
    Link: https://lore.kernel.org/r/20231129114740.2686201-1-yi.zhang@huaweicloud.com
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 262853dc685b6af6bfe51f75759de49b93947f95
Author: Chao Song <chao.song@linux.intel.com>
Date:   Mon Nov 27 20:47:35 2023 +0800

    soundwire: intel_ace2x: fix AC timing setting for ACE2.x
    
    [ Upstream commit 393cae5f32d640b9798903702018a48c7a45e59f ]
    
    Start from ACE1.x, DOAISE is added to AC timing control
    register bit 5, it combines with DOAIS to get effective
    timing, and has the default value 1.
    
    The current code fills DOAIS, DACTQE and DODS bits to a
    variable initialized to zero, and updates the variable
    to AC timing control register. With this operation, We
    change DOAISE to 0, and force a much more aggressive
    timing. The timing is even unable to form a working
    waveform on SDA pin.
    
    This patch uses read-modify-write operation for the AC
    timing control register access, thus makes sure those
    bits not supposed and intended to change are not touched.
    
    Signed-off-by: Chao Song <chao.song@linux.intel.com>
    Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
    Link: https://lore.kernel.org/r/20231127124735.2080562-1-yung-chuan.liao@linux.intel.com
    Signed-off-by: Vinod Koul <vkoul@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 8c834312773597b5a293ad5889e3a4e4dfdf143d
Author: Weihao Li <cn.liweihao@gmail.com>
Date:   Tue Oct 31 19:18:16 2023 +0800

    clk: rockchip: rk3128: Fix HCLK_OTG gate register
    
    [ Upstream commit c6c5a5580dcb6631aa6369dabe12ef3ce784d1d2 ]
    
    The HCLK_OTG gate control is in CRU_CLKGATE5_CON, not CRU_CLKGATE3_CON.
    
    Signed-off-by: Weihao Li <cn.liweihao@gmail.com>
    Link: https://lore.kernel.org/r/20231031111816.8777-1-cn.liweihao@gmail.com
    Signed-off-by: Heiko Stuebner <heiko@sntech.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 351bcf3a3772fceebd12c700b534c4f8d2523041
Author: Chris Morgan <macromorgan@hotmail.com>
Date:   Wed Oct 18 10:33:55 2023 -0500

    clk: rockchip: rk3568: Add PLL rate for 292.5MHz
    
    [ Upstream commit 1af27671f62ce919f1fb76082ed81f71cb090989 ]
    
    Add support for a PLL rate of 292.5MHz so that the Powkiddy RGB30 panel
    can run at a requested 60hz (59.96, close enough).
    
    I have confirmed this rate fits with all the constraints
    listed in the TRM for the VPLL (as an integer PLL) in Part 1 "Chapter
    2 Clock & Reset Unit (CRU)."
    
    Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
    Link: https://lore.kernel.org/r/20231018153357.343142-2-macroalpha82@gmail.com
    Signed-off-by: Heiko Stuebner <heiko@sntech.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 4dd2d87c88fdde05ad564bc9e228b18859ec22ff
Author: Hengqi Chen <hengqi.chen@gmail.com>
Date:   Sat Dec 9 15:49:15 2023 +0800

    LoongArch: Preserve syscall nr across execve()
    
    [ Upstream commit d6c5f06e46a836e6a70c7cfd95bb38a67d9252ec ]
    
    Currently, we store syscall nr in pt_regs::regs[11] and syscall execve()
    accidentally overrides it during its execution:
    
        sys_execve()
          -> do_execve()
            -> do_execveat_common()
              -> bprm_execve()
                -> exec_binprm()
                  -> search_binary_handler()
                    -> load_elf_binary()
                      -> ELF_PLAT_INIT()
    
    ELF_PLAT_INIT() reset regs[11] to 0, so in syscall_exit_to_user_mode()
    we later get a wrong syscall nr. This breaks tools like execsnoop since
    it relies on execve() tracepoints.
    
    Skip pt_regs::regs[11] reset in ELF_PLAT_INIT() to fix the issue.
    
    Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com>
    Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 4d8121aa13fd14a5cb02ee200710b995971a0ad4
Author: Jinyang He <hejinyang@loongson.cn>
Date:   Sat Dec 9 15:49:15 2023 +0800

    LoongArch: Set unwind stack type to unknown rather than set error flag
    
    [ Upstream commit 97ceddbc9404a7d1e2c4049435bff29427d762cc ]
    
    During unwinding, unwind_done() is used as an end condition. Normally it
    unwind to the user stack and then set the stack type to unknown, which
    is a normal exit. When something unexpected happens in unwind process
    and we cannot unwind anymore, we should set the error flag, and also set
    the stack type to unknown to indicate that the unwind process can not
    continue. The error flag emphasizes that the unwind process produce an
    unexpected error. There is no unexpected things when we unwind the PT_REGS
    in the top of IRQ stack and find out that is an user mode PT_REGS. Thus,
    we should not set error flag and just set stack type to unknown.
    
    Reported-by: Hengqi Chen <hengqi.chen@gmail.com>
    Acked-by: Hengqi Chen <hengqi.chen@gmail.com>
    Signed-off-by: Jinyang He <hejinyang@loongson.cn>
    Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 10d9f8ed6dafb0ed8da77670b7b6098c8304ab1b
Author: WANG Rui <wangrui@loongson.cn>
Date:   Sat Dec 9 15:49:15 2023 +0800

    LoongArch: Apply dynamic relocations for LLD
    
    [ Upstream commit eea673e9d5ea994c60b550ffb684413d3759b3f4 ]
    
    For the following assembly code:
    
         .text
         .global func
     func:
         nop
    
         .data
     var:
         .dword func
    
    When linked with `-pie`, GNU LD populates the `var` variable with the
    pre-relocated value of `func`. However, LLVM LLD does not exhibit the
    same behavior. This issue also arises with the `kernel_entry` in arch/
    loongarch/kernel/head.S:
    
     _head:
         .word   MZ_MAGIC                /* "MZ", MS-DOS header */
         .org    0x8
         .dword  kernel_entry            /* Kernel entry point */
    
    The correct kernel entry from the MS-DOS header is crucial for jumping
    to vmlinux from zboot. This necessity is why the compressed relocatable
    kernel compiled by Clang encounters difficulties in booting.
    
    To address this problem, it is proposed to apply dynamic relocations to
    place with `--apply-dynamic-relocs`.
    
    Link: https://github.com/ClangBuiltLinux/linux/issues/1962
    Signed-off-by: WANG Rui <wangrui@loongson.cn>
    Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 3584858bfd34706b3dc60f2b83ef135ead1ffefa
Author: Armin Wolf <W_Armin@gmx.de>
Date:   Thu Dec 7 22:07:23 2023 +0100

    hwmon: (corsair-psu) Fix probe when built-in
    
    [ Upstream commit 307004e8b254ad28e150b63f299ab9caa4bc7c3e ]
    
    It seems that when the driver is built-in, the HID bus is
    initialized after the driver is loaded, which whould cause
    module_hid_driver() to fail.
    Fix this by registering the driver after the HID bus using
    late_initcall() in accordance with other hwmon HID drivers.
    
    Signed-off-by: Armin Wolf <W_Armin@gmx.de>
    Link: https://lore.kernel.org/r/20231207210723.222552-1-W_Armin@gmx.de
    [groeck: Dropped "compile tested" comment; the patch has been tested
     but the tester did not provide a Tested-by: tag]
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 3f7109ec1fa540288f760d89d9baf2795bcb2614
Author: Ivan Orlov <ivan.orlov0322@gmail.com>
Date:   Wed Dec 6 22:32:11 2023 +0000

    ALSA: pcmtest: stop timer before buffer is released
    
    [ Upstream commit eb99b1b72a424a79f56c972e0fd7ad01fe93a008 ]
    
    Stop timer in the 'trigger' and 'sync_stop' callbacks since we want
    the timer to be stopped before the DMA buffer is released. Otherwise,
    it could trigger a kernel panic in some circumstances, for instance
    when the DMA buffer is already released but the timer callback is
    still running.
    
    Signed-off-by: Ivan Orlov <ivan.orlov0322@gmail.com>
    Link: https://lore.kernel.org/r/20231206223211.12761-1-ivan.orlov0322@gmail.com
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit b92ad44a1b32356d4713da79348db7a3f78f4beb
Author: Inki Dae <inki.dae@samsung.com>
Date:   Wed Nov 1 18:36:51 2023 +0900

    drm/exynos: fix a wrong error checking
    
    [ Upstream commit 8d1b7809684c688005706125b804e1f9792d2b1b ]
    
    Fix a wrong error checking in exynos_drm_dma.c module.
    
    In the exynos_drm_register_dma function, both arm_iommu_create_mapping()
    and iommu_get_domain_for_dev() functions are expected to return NULL as
    an error.
    
    However, the error checking is performed using the statement
    if(IS_ERR(mapping)), which doesn't provide a suitable error value.
    So check if 'mapping' is NULL, and if it is, return -ENODEV.
    
    This issue[1] was reported by Dan.
    
    Changelog v1:
    - fix build warning.
    
    [1] https://lore.kernel.org/all/33e52277-1349-472b-a55b-ab5c3462bfcf@moroto.mountain/
    
    Reported-by : Dan Carpenter <dan.carpenter@linaro.org>
    Signed-off-by: Inki Dae <inki.dae@samsung.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 2debe511c1d28dfc73e2e352de70fdec9a503833
Author: Xiang Yang <xiangyang3@huawei.com>
Date:   Sat Aug 12 14:27:48 2023 +0800

    drm/exynos: fix a potential error pointer dereference
    
    [ Upstream commit 73bf1c9ae6c054c53b8e84452c5e46f86dd28246 ]
    
    Smatch reports the warning below:
    drivers/gpu/drm/exynos/exynos_hdmi.c:1864 hdmi_bind()
    error: 'crtc' dereferencing possible ERR_PTR()
    
    The return value of exynos_drm_crtc_get_by_type maybe ERR_PTR(-ENODEV),
    which can not be used directly. Fix this by checking the return value
    before using it.
    
    Signed-off-by: Xiang Yang <xiangyang3@huawei.com>
    Signed-off-by: Inki Dae <inki.dae@samsung.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit fb26de4a86e19711880e7e845505505f01d2eb82
Author: Lijo Lazar <lijo.lazar@amd.com>
Date:   Wed Nov 29 12:37:34 2023 +0530

    drm/amdgpu: Add NULL checks for function pointers
    
    [ Upstream commit 81577503efb49f4ad76af22f9941d72900ef4aab ]
    
    Check if function is implemented before making the call.
    
    Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
    Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
    Acked-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 7fc3d8ea1a675eae9ee57dca894a9c4fb0e0d8b5
Author: Ivan Lipski <ivlipski@amd.com>
Date:   Fri Dec 1 06:25:16 2023 -0700

    drm/amd/display: Add monitor patch for specific eDP
    
    [ Upstream commit 3d71a8726e05a35beb9de394e86ce896d69e563f ]
    
    [WHY]
    Some eDP panels's ext caps don't write initial value cause the value of
    dpcd_addr(0x317) is random.  It means that sometimes the eDP will
    clarify it is OLED, miniLED...etc cause the backlight control interface
    is incorrect.
    
    [HOW]
    Add a new panel patch to remove sink ext caps(HDR,OLED...etc)
    
    Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
    Reviewed-by: Sun peng Li <sunpeng.li@amd.com>
    Acked-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com>
    Signed-off-by: Ivan Lipski <ivlipski@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit a0827b9172eecec516aa41eb22dd4f47d192d8ba
Author: Rob Herring <robh@kernel.org>
Date:   Thu Nov 30 13:18:29 2023 -0600

    arm64: dts: rockchip: Fix PCI node addresses on rk3399-gru
    
    [ Upstream commit c13c823a78b77ea0e5f1f73112d910e259911101 ]
    
    The rk3399-gru PCI node addresses are wrong.
    
    In rk3399-gru-scarlet, the bus number in the address should be 0. This is
    because bus number assignment is dynamic and not known up front. For FDT,
    the bus number is simply ignored.
    
    In rk3399-gru-chromebook, the addresses are simply invalid. The first
    "reg" entry must be the configuration space for the device. The entry
    should be all 0s except for device/slot and function numbers. The existing
    64-bit memory space (0x83000000) entries are not valid because they must
    have the BAR address in the lower byte of the first cell.
    
    Warnings for these are enabled by adding the missing 'device_type = "pci"'
    for the root port node.
    
    Signed-off-by: Rob Herring <robh@kernel.org>
    Link: https://lore.kernel.org/r/20231130191830.2424361-1-robh@kernel.org
    Signed-off-by: Heiko Stuebner <heiko@sntech.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit c52d545c1e3128958953d7ebc782b5e8a22dc299
Author: Bitao Hu <yaoma@linux.alibaba.com>
Date:   Thu Nov 30 10:13:37 2023 +0800

    nvme: fix deadlock between reset and scan
    
    [ Upstream commit 839a40d1e730977d4448d141fa653517c2959a88 ]
    
    If controller reset occurs when allocating namespace, both
    nvme_reset_work and nvme_scan_work will hang, as shown below.
    
    Test Scripts:
    
        for ((t=1;t<=128;t++))
        do
        nsid=`nvme create-ns /dev/nvme1 -s 14537724 -c 14537724 -f 0 -m 0 \
        -d 0 | awk -F: '{print($NF);}'`
        nvme attach-ns /dev/nvme1 -n $nsid -c 0
        done
        nvme reset /dev/nvme1
    
    We will find that both nvme_reset_work and nvme_scan_work hung:
    
        INFO: task kworker/u249:4:17848 blocked for more than 120 seconds.
        "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this
        message.
        task:kworker/u249:4  state:D stack:    0 pid:17848 ppid:     2
        flags:0x00000028
        Workqueue: nvme-reset-wq nvme_reset_work [nvme]
        Call trace:
        __switch_to+0xb4/0xfc
        __schedule+0x22c/0x670
        schedule+0x4c/0xd0
        blk_mq_freeze_queue_wait+0x84/0xc0
        nvme_wait_freeze+0x40/0x64 [nvme_core]
        nvme_reset_work+0x1c0/0x5cc [nvme]
        process_one_work+0x1d8/0x4b0
        worker_thread+0x230/0x440
        kthread+0x114/0x120
        INFO: task kworker/u249:3:22404 blocked for more than 120 seconds.
        "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this
        message.
        task:kworker/u249:3  state:D stack:    0 pid:22404 ppid:     2
        flags:0x00000028
        Workqueue: nvme-wq nvme_scan_work [nvme_core]
        Call trace:
        __switch_to+0xb4/0xfc
        __schedule+0x22c/0x670
        schedule+0x4c/0xd0
        rwsem_down_write_slowpath+0x32c/0x98c
        down_write+0x70/0x80
        nvme_alloc_ns+0x1ac/0x38c [nvme_core]
        nvme_validate_or_alloc_ns+0xbc/0x150 [nvme_core]
        nvme_scan_ns_list+0xe8/0x2e4 [nvme_core]
        nvme_scan_work+0x60/0x500 [nvme_core]
        process_one_work+0x1d8/0x4b0
        worker_thread+0x260/0x440
        kthread+0x114/0x120
        INFO: task nvme:28428 blocked for more than 120 seconds.
        "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this
        message.
        task:nvme            state:D stack:    0 pid:28428 ppid: 27119
        flags:0x00000000
        Call trace:
        __switch_to+0xb4/0xfc
        __schedule+0x22c/0x670
        schedule+0x4c/0xd0
        schedule_timeout+0x160/0x194
        do_wait_for_common+0xac/0x1d0
        __wait_for_common+0x78/0x100
        wait_for_completion+0x24/0x30
        __flush_work.isra.0+0x74/0x90
        flush_work+0x14/0x20
        nvme_reset_ctrl_sync+0x50/0x74 [nvme_core]
        nvme_dev_ioctl+0x1b0/0x250 [nvme_core]
        __arm64_sys_ioctl+0xa8/0xf0
        el0_svc_common+0x88/0x234
        do_el0_svc+0x7c/0x90
        el0_svc+0x1c/0x30
        el0_sync_handler+0xa8/0xb0
        el0_sync+0x148/0x180
    
    The reason for the hang is that nvme_reset_work occurs while nvme_scan_work
    is still running. nvme_scan_work may add new ns into ctrl->namespaces
    list after nvme_reset_work frozen all ns->q in ctrl->namespaces list.
    The newly added ns is not frozen, so nvme_wait_freeze will wait forever.
    Unfortunately, ctrl->namespaces_rwsem is held by nvme_reset_work, so
    nvme_scan_work will also wait forever. Now we are deadlocked!
    
    PROCESS1                         PROCESS2
    ==============                   ==============
    nvme_scan_work
      ...                            nvme_reset_work
      nvme_validate_or_alloc_ns        nvme_dev_disable
        nvme_alloc_ns                    nvme_start_freeze
         down_write                      ...
         nvme_ns_add_to_ctrl_list        ...
         up_write                      nvme_wait_freeze
        ...                              down_read
        nvme_alloc_ns                    blk_mq_freeze_queue_wait
         down_write
    
    Fix by marking the ctrl with say NVME_CTRL_FROZEN flag set in
    nvme_start_freeze and cleared in nvme_unfreeze. Then the scan can check
    it before adding the new namespace (under the namespaces_rwsem).
    
    Signed-off-by: Bitao Hu <yaoma@linux.alibaba.com>
    Reviewed-by: Guixin Liu <kanie@linux.alibaba.com>
    Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Keith Busch <kbusch@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 946fd64ba361e500582787cb9b6342d9f11b0b29
Author: Nitesh Shetty <nj.shetty@samsung.com>
Date:   Tue Nov 28 17:59:57 2023 +0530

    nvme: prevent potential spectre v1 gadget
    
    [ Upstream commit 20dc66f2d76b4a410df14e4675e373b718babc34 ]
    
    This patch fixes the smatch warning, "nvmet_ns_ana_grpid_store() warn:
    potential spectre issue 'nvmet_ana_group_enabled' [w] (local cap)"
    Prevent the contents of kernel memory from being leaked to  user space
    via speculative execution by using array_index_nospec.
    
    Signed-off-by: Nitesh Shetty <nj.shetty@samsung.com>
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
    Signed-off-by: Keith Busch <kbusch@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 8b2a6a3692e2c0b06125741181fda9aa8a7f3a49
Author: Keith Busch <kbusch@kernel.org>
Date:   Tue May 2 11:43:41 2023 -0700

    nvme-ioctl: move capable() admin check to the end
    
    [ Upstream commit 7be866b1cf0bf1dfa74480fe8097daeceda68622 ]
    
    This can be an expensive call on some kernel configs. Move it to the end
    after checking the cheaper ways to determine if the command is allowed.
    
    Reviewed-by: Jens Axboe <axboe@kernel.dk>
    Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Keith Busch <kbusch@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 8884a56d2154365e2f51b74a174f23501c6fe97e
Author: Keith Busch <kbusch@kernel.org>
Date:   Fri Oct 27 10:58:12 2023 -0700

    nvme: ensure reset state check ordering
    
    [ Upstream commit e6e7f7ac03e40795346f1b2994a05f507ad8d345 ]
    
    A different CPU may be setting the ctrl->state value, so ensure proper
    barriers to prevent optimizing to a stale state. Normally it isn't a
    problem to observe the wrong state as it is merely advisory to take a
    quicker path during initialization and error recovery, but seeing an old
    state can report unexpected ENETRESET errors when a reset request was in
    fact successful.
    
    Reported-by: Minh Hoang <mh2022@meta.com>
    Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
    Signed-off-by: Keith Busch <kbusch@kernel.org>
    Signed-off-by: Hannes Reinecke <hare@suse.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit cc5b051eeb486eddd2700e9eee07ccccbce71463
Author: Keith Busch <kbusch@kernel.org>
Date:   Mon Oct 30 08:13:09 2023 -0700

    nvme: introduce helper function to get ctrl state
    
    [ Upstream commit 5c687c287c46fadb14644091823298875a5216aa ]
    
    The controller state is typically written by another CPU, so reading it
    should ensure no optimizations are taken. This is a repeated pattern in
    the driver, so start with adding a convenience function that returns the
    controller state with READ_ONCE().
    
    Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
    Signed-off-by: Keith Busch <kbusch@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 8392d323472116d3ea430657fc66de51698a010d
Author: David Rau <David.Rau.opensource@dm.renesas.com>
Date:   Fri Dec 1 12:29:33 2023 +0800

    ASoC: da7219: Support low DC impedance headset
    
    [ Upstream commit 5f44de697383fcc9a9a1a78f99e09d1838704b90 ]
    
    Change the default MIC detection impedance threshold to 200ohm
    to support low mic DC impedance headset.
    
    Signed-off-by: David Rau <David.Rau.opensource@dm.renesas.com>
    Link: https://lore.kernel.org/r/20231201042933.26392-1-David.Rau.opensource@dm.renesas.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 55aba82746bdd790ba6e5487622e3ed58fe35c89
Author: Thinh Tran <thinhtr@linux.vnet.ibm.com>
Date:   Thu Nov 30 18:19:11 2023 -0600

    net/tg3: fix race condition in tg3_reset_task()
    
    [ Upstream commit 16b55b1f2269962fb6b5154b8bf43f37c9a96637 ]
    
    When an EEH error is encountered by a PCI adapter, the EEH driver
    modifies the PCI channel's state as shown below:
    
       enum {
          /* I/O channel is in normal state */
          pci_channel_io_normal = (__force pci_channel_state_t) 1,
    
          /* I/O to channel is blocked */
          pci_channel_io_frozen = (__force pci_channel_state_t) 2,
    
          /* PCI card is dead */
          pci_channel_io_perm_failure = (__force pci_channel_state_t) 3,
       };
    
    If the same EEH error then causes the tg3 driver's transmit timeout
    logic to execute, the tg3_tx_timeout() function schedules a reset
    task via tg3_reset_task_schedule(), which may cause a race condition
    between the tg3 and EEH driver as both attempt to recover the HW via
    a reset action.
    
    EEH driver gets error event
    --> eeh_set_channel_state()
        and set device to one of
        error state above           scheduler: tg3_reset_task() get
                                    returned error from tg3_init_hw()
                                 --> dev_close() shuts down the interface
    tg3_io_slot_reset() and
    tg3_io_resume() fail to
    reset/resume the device
    
    To resolve this issue, we avoid the race condition by checking the PCI
    channel state in the tg3_reset_task() function and skip the tg3 driver
    initiated reset when the PCI channel is not in the normal state.  (The
    driver has no access to tg3 device registers at this point and cannot
    even complete the reset task successfully without external assistance.)
    We'll leave the reset procedure to be managed by the EEH driver which
    calls the tg3_io_error_detected(), tg3_io_slot_reset() and
    tg3_io_resume() functions as appropriate.
    
    Adding the same checking in tg3_dump_state() to avoid dumping all
    device registers when the PCI channel is not in the normal state.
    
    Signed-off-by: Thinh Tran <thinhtr@linux.vnet.ibm.com>
    Tested-by: Venkata Sai Duggi <venkata.sai.duggi@ibm.com>
    Reviewed-by: David Christensen <drc@linux.vnet.ibm.com>
    Reviewed-by: Michael Chan <michael.chan@broadcom.com>
    Link: https://lore.kernel.org/r/20231201001911.656-1-thinhtr@linux.vnet.ibm.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 06cb2064b0bf2ec5214124e3832636d2a2ad8d00
Author: Shannon Nelson <shannon.nelson@amd.com>
Date:   Fri Nov 10 14:18:02 2023 -0800

    pds_vdpa: set features order
    
    [ Upstream commit cefc9ba6aed48a3aa085888e3262ac2aa975714b ]
    
    Fix up the order that the device and negotiated features
    are checked to get a more reliable difference when things
    get changed.
    
    Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
    Message-Id: <20231110221802.46841-4-shannon.nelson@amd.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Acked-by: Jason Wang <jasowang@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit d3bb92beda4af03bb0779f89d2efdadf6ca74b10
Author: Shannon Nelson <shannon.nelson@amd.com>
Date:   Fri Nov 10 14:18:01 2023 -0800

    pds_vdpa: clear config callback when status goes to 0
    
    [ Upstream commit dd3b8de16e90c5594eddd29aeeb99e97c6f863be ]
    
    If the client driver is setting status to 0, something is
    getting shutdown and possibly removed.  Make sure we clear
    the config_cb so that it doesn't end up crashing when
    trying to call a bogus callback.
    
    Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
    Message-Id: <20231110221802.46841-3-shannon.nelson@amd.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Acked-by: Jason Wang <jasowang@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 53fff954e77c9bd0c186e46f396807da630c4765
Author: Shannon Nelson <shannon.nelson@amd.com>
Date:   Fri Nov 10 14:18:00 2023 -0800

    pds_vdpa: fix up format-truncation complaint
    
    [ Upstream commit 4f317d6529d7fc3ab7769ef89645d43fc7eec61b ]
    
    Our friendly kernel test robot has recently been pointing out
    some format-truncation issues.  Here's a fix for one of them.
    
    Reported-by: kernel test robot <lkp@intel.com>
    Closes: https://lore.kernel.org/oe-kbuild-all/202311040109.RfgJoE7L-lkp@intel.com/
    Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
    Message-Id: <20231110221802.46841-2-shannon.nelson@amd.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Acked-by: Jason Wang <jasowang@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 3ad7bf5e57c98511a2e6e18918d020c3f396dc0b
Author: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Date:   Wed Nov 29 15:14:11 2023 +0200

    ASoC: SOF: ipc4-topology: Correct data structures for the GAIN module
    
    [ Upstream commit e238b68e6dc89ddab52bd98216fe5623e94792b1 ]
    
    Move the base_cfg to struct sof_ipc4_gain_data. This struct
    describes the message payload passed to the firmware via the mailbox.
    
    It is not wise to be 'clever' and try to use the first part of a struct
    as IPC message without marking the message section as packed and aligned.
    
    Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
    Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
    Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
    Link: https://lore.kernel.org/r/20231129131411.27516-3-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 330c0f19b393fee0359997e9aa8a65c2fdc08b53
Author: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Date:   Wed Nov 29 15:14:10 2023 +0200

    ASoC: SOF: ipc4-topology: Correct data structures for the SRC module
    
    [ Upstream commit c447636970e3409ac39f0bb8c2dcff6b726f36b0 ]
    
    Separate the IPC message part as struct sof_ipc4_src_data. This struct
    describes the message payload passed to the firmware via the mailbox.
    
    It is not wise to be 'clever' and try to use the first part of a struct
    as IPC message without marking the message section as packed and aligned.
    
    Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
    Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
    Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
    Link: https://lore.kernel.org/r/20231129131411.27516-2-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 5713ab41ace4359fa8b251a86689d760980ecdb2
Author: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Date:   Tue Nov 28 14:39:14 2023 +0200

    ASoC: hdac_hda: Conditionally register dais for HDMI and Analog
    
    [ Upstream commit a0575b4add21a243cc3257e75ad913cd5377d5f2 ]
    
    The current driver is registering the same dais for each hdev found in the
    system which results duplicated widgets to be registered and the kernel
    log contains similar prints:
    snd_hda_codec_realtek ehdaudio0D0: ASoC: sink widget AIF1TX overwritten
    snd_hda_codec_realtek ehdaudio0D0: ASoC: source widget AIF1RX overwritten
    skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget hifi3 overwritten
    skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget hifi2 overwritten
    skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget hifi1 overwritten
    skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: source widget Codec Output Pin1 overwritten
    skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget Codec Input Pin1 overwritten
    skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget Analog Codec Playback overwritten
    skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget Digital Codec Playback overwritten
    skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: sink widget Alt Analog Codec Playback overwritten
    skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: source widget Analog Codec Capture overwritten
    skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: source widget Digital Codec Capture overwritten
    skl_hda_dsp_generic skl_hda_dsp_generic: ASoC: source widget Alt Analog Codec Capture overwritten
    
    To avoid such issue, split the dai array into HDMI and non HDMI array and
    register them conditionally:
    for HDMI hdev only register the dais needed for HDMI
    for non HDMI hdev do not  register the HDMI dais.
    
    Depends-on: 3d1dc8b1030d ("ASoC: Intel: skl_hda_dsp_generic: Drop HDMI routes when HDMI is not available")
    Link: https://github.com/thesofproject/linux/issues/4509
    Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
    Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
    Link: https://lore.kernel.org/r/20231128123914.3986-1-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 8fa6210539957591839e1b7b63af6e7f0e0f4a5b
Author: Jeremy Soller <jeremy@system76.com>
Date:   Mon Nov 27 11:42:38 2023 -0700

    ASoC: amd: yc: Add DMI entry to support System76 Pangolin 13
    
    [ Upstream commit 19650c0f402f53abe48a55a1c49c8ed9576a088c ]
    
    Add pang13 quirk to enable the internal microphone.
    
    Signed-off-by: Jeremy Soller <jeremy@system76.com>
    Signed-off-by: Tim Crawford <tcrawford@system76.com>
    Link: https://lore.kernel.org/r/20231127184237.32077-2-tcrawford@system76.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit fa60f8fac63705c68b790757313480b8cd97e4cf
Author: Dave Airlie <airlied@redhat.com>
Date:   Thu Nov 30 11:08:52 2023 +1000

    nouveau/tu102: flush all pdbs on vmm flush
    
    [ Upstream commit cb9c919364653eeafb49e7ff5cd32f1ad64063ac ]
    
    This is a hack around a bug exposed with the GSP code, I'm not sure
    what is happening exactly, but it appears some of our flushes don't
    result in proper tlb invalidation for out BAR2 and we get a BAR2
    fault from GSP and it all dies.
    
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Danilo Krummrich <dakr@redhat.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20231130010852.4034774-1-airlied@gmail.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 3c124f09b7ff0434b076a8dec1ed446a6170b549
Author: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Date:   Fri Nov 24 15:57:43 2023 +0200

    ASoC: SOF: sof-audio: Modify logic for enabling/disabling topology cores
    
    [ Upstream commit 31ed8da1c8e5e504710bb36863700e3389f8fc81 ]
    
    In the current code, we enable a widget core when it is set up and
    disable it when it is freed. This is problematic with IPC4 because
    widget free is essentially a NOP and all widgets are freed in the
    firmware when the pipeline is deleted. This results in a crash during
    pipeline deletion when one of it's widgets is scheduled to run on a
    secondary core and is powered off when widget is freed. So, change the
    logic to enable all cores needed by all the modules in a pipeline when
    the pipeline widget is set up and disable them after the pipeline
    widget is freed.
    
    Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
    Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
    Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
    Link: https://lore.kernel.org/r/20231124135743.24674-3-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit e8879e7a7b4e880d6c9b9a12a0ef13247c5c0b33
Author: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Date:   Fri Nov 24 15:57:42 2023 +0200

    ASoC: SOF: ipc4-topology: Add core_mask in struct snd_sof_pipeline
    
    [ Upstream commit 0376b995bb7a65fb0c056f3adc5e9695ad0c1805 ]
    
    With IPC4, a pipeline may contain multiple modules in the data
    processing domain and they can be scheduled to run on different cores.
    Add a new field in struct snd_sof_pipeline to keep track of all the
    cores that are associated with the modules in the pipeline. Set the
    pipeline core mask for IPC3 when initializing the pipeline widget IPC
    structure. For IPC4, set the core mark when initializing the pipeline
    widget and initializing processing modules in the data processing domain.
    
    Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
    Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
    Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
    Link: https://lore.kernel.org/r/20231124135743.24674-2-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit e1d391310724e0353ed302e57cf55f1bc056b81c
Author: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Date:   Fri Nov 24 14:40:15 2023 +0200

    ASoC: Intel: skl_hda_dsp_generic: Drop HDMI routes when HDMI is not available
    
    [ Upstream commit 3d1dc8b1030df8ca0fdfd4905c88ee10db943bf8 ]
    
    When the HDMI is not present due to disabled display support
    we will use dummy codec and the HDMI routes will refer to non existent
    DAPM widgets.
    
    Trim the route list from the HDMI routes to be able to probe the card even
    if the HDMI dais are not registered.
    
    Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
    Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
    Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
    Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    Link: https://lore.kernel.org/r/20231124124015.15878-1-peter.ujfalusi@linux.intel.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit f369cf7e94b404d9e874942d7369548403a473ef
Author: Shengjiu Wang <shengjiu.wang@nxp.com>
Date:   Thu Nov 23 09:14:53 2023 +0800

    ASoC: fsl_xcvr: refine the requested phy clock frequency
    
    [ Upstream commit 347ecf29a68cc8958fbcbd26ef410d07fe9d82f4 ]
    
    As the input phy clock frequency will divided by 2 by default
    on i.MX8MP with the implementation of clk-imx8mp-audiomix driver,
    So the requested frequency need to be updated.
    
    The relation of phy clock is:
        sai_pll_ref_sel
           sai_pll
              sai_pll_bypass
                 sai_pll_out
                    sai_pll_out_div2
                       earc_phy_cg
    
    Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
    Reviewed-by: Iuliana Prodan <iuliana.prodan@nxp.com>
    Link: https://lore.kernel.org/r/1700702093-8008-1-git-send-email-shengjiu.wang@nxp.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 8f82f2e4d9c4966282e494ae67b0bc05a6c2b904
Author: Shuming Fan <shumingf@realtek.com>
Date:   Wed Nov 22 18:01:23 2023 +0800

    ASoC: rt5650: add mutex to avoid the jack detection failure
    
    [ Upstream commit cdba4301adda7c60a2064bf808e48fccd352aaa9 ]
    
    This patch adds the jd_mutex to protect the jack detection control flow.
    And only the headset type could check the button status.
    
    Signed-off-by: Shuming Fan <shumingf@realtek.com>
    Link: https://lore.kernel.org/r/20231122100123.2831753-1-shumingf@realtek.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit d568aed978dabf2e4257eaa0b1ec35cd99cab423
Author: Shengjiu Wang <shengjiu.wang@nxp.com>
Date:   Wed Nov 22 09:42:53 2023 +0800

    ASoC: fsl_xcvr: Enable 2 * TX bit clock for spdif only case
    
    [ Upstream commit c33fd110424dfcb544cf55a1b312f43fe1918235 ]
    
    The bit 10 in TX_DPTH_CTRL register controls the TX clock rate.
    If this bit is set, TX datapath clock should be = 2* TX bit rate.
    If this bit is not set, TX datapath clock should be 10* TX bit rate.
    
    As the spdif only case, we always use 2 * TX bit clock, so
    this bit need to be set.
    
    Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
    Link: https://lore.kernel.org/r/1700617373-6472-1-git-send-email-shengjiu.wang@nxp.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 193d4bbe81fe596df0b4e1cbf93158abeb2c6957
Author: Maciej Strozek <mstrozek@opensource.cirrus.com>
Date:   Fri Nov 17 14:13:39 2023 +0000

    ASoC: cs43130: Fix incorrect frame delay configuration
    
    [ Upstream commit aa7e8e5e4011571022dc06e4d7a2f108feb53d1a ]
    
    Signed-off-by: Maciej Strozek <mstrozek@opensource.cirrus.com>
    Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
    Link: https://lore.kernel.org/r/20231117141344.64320-3-mstrozek@opensource.cirrus.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 655e69056d0957b2364f04421789e6847433dd3b
Author: Maciej Strozek <mstrozek@opensource.cirrus.com>
Date:   Fri Nov 17 14:13:38 2023 +0000

    ASoC: cs43130: Fix the position of const qualifier
    
    [ Upstream commit e7f289a59e76a5890a57bc27b198f69f175f75d9 ]
    
    Signed-off-by: Maciej Strozek <mstrozek@opensource.cirrus.com>
    Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
    Link: https://lore.kernel.org/r/20231117141344.64320-2-mstrozek@opensource.cirrus.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit ab10ac2621562cf50846b4148540f550061b5116
Author: Kamil Duljas <kamil.duljas@gmail.com>
Date:   Thu Nov 16 23:41:13 2023 +0100

    ASoC: Intel: Skylake: mem leak in skl register function
    
    [ Upstream commit f8ba14b780273fd290ddf7ee0d7d7decb44cc365 ]
    
    skl_platform_register() uses krealloc. When krealloc is fail,
    then previous memory is not freed. The leak is also when soc
    component registration failed.
    
    Signed-off-by: Kamil Duljas <kamil.duljas@gmail.com>
    Reviewed-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
    Link: https://lore.kernel.org/r/20231116224112.2209-2-kamil.duljas@gmail.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit d7368ad5313eba49c5c88b75b6e762ddc5c93d39
Author: Kamil Duljas <kamil.duljas@gmail.com>
Date:   Thu Nov 16 22:39:17 2023 +0100

    ASoC: SOF: topology: Fix mem leak in sof_dai_load()
    
    [ Upstream commit 31e721fbd194d5723722eaa21df1d14cee7e12b5 ]
    
    The function has multiple return points at which it is not released
    previously allocated memory.
    
    Signed-off-by: Kamil Duljas <kamil.duljas@gmail.com>
    Acked-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
    Link: https://lore.kernel.org/r/20231116213926.2034-2-kamil.duljas@gmail.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 5a8bceaeaad03c8ced46482005c3c1a1474ba1c3
Author: David Lin <CTLIN0@nuvoton.com>
Date:   Fri Nov 17 12:30:12 2023 +0800

    ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16
    
    [ Upstream commit c1501f2597dd08601acd42256a4b0a0fc36bf302 ]
    
    This issue is reproduced when W=1 build in compiler gcc-12.
    The following are sparse warnings:
    
    sound/soc/codecs/nau8822.c:199:25: sparse: sparse: incorrect type in assignment
    sound/soc/codecs/nau8822.c:199:25: sparse: expected unsigned short
    sound/soc/codecs/nau8822.c:199:25: sparse: got restricted __be16
    sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16
    sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16
    sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16
    sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16
    
    Reported-by: kernel test robot <lkp@intel.com>
    Closes: https://lore.kernel.org/oe-kbuild-all/202311122320.T1opZVkP-lkp@intel.com/
    Signed-off-by: David Lin <CTLIN0@nuvoton.com>
    Link: https://lore.kernel.org/r/20231117043011.1747594-1-CTLIN0@nuvoton.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 07c7fd07b5310b7a2be72aff18b5f89e4e161f9d
Author: Kamil Duljas <kamil.duljas@gmail.com>
Date:   Thu Nov 16 13:51:50 2023 +0100

    ASoC: Intel: Skylake: Fix mem leak in few functions
    
    [ Upstream commit d5c65be34df73fa01ed05611aafb73b440d89e29 ]
    
    The resources should be freed when function return error.
    
    Signed-off-by: Kamil Duljas <kamil.duljas@gmail.com>
    Reviewed-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
    Link: https://lore.kernel.org/r/20231116125150.1436-1-kamil.duljas@gmail.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 8dada1d452ca8c51f3c315a4ebc9efa48257bd89
Author: Heiko Stuebner <heiko@sntech.de>
Date:   Tue Nov 14 16:38:34 2023 +0100

    arm64: dts: rockchip: fix rk356x pcie msg interrupt name
    
    [ Upstream commit 3cee9c635f27d1003d46f624d816f3455698b625 ]
    
    The expected name by the binding at this position is "msg" and the SoC's
    manual also calls the interrupt in question "msg", so fix the rk356x dtsi
    to use the correct name.
    
    Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
    Signed-off-by: Heiko Stuebner <heiko@sntech.de>
    Link: https://lore.kernel.org/r/20231114153834.934978-1-heiko@sntech.de
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 73ed4a6ea7d30a48fd5cac58b0da5288f8bc0c14
Author: Charles Keepax <ckeepax@opensource.cirrus.com>
Date:   Mon Nov 13 15:59:16 2023 +0000

    ASoC: wm8974: Correct boost mixer inputs
    
    [ Upstream commit 37e6fd0cebf0b9f71afb38fd95b10408799d1f0b ]
    
    Bit 6 of INPPGA (INPPGAMUTE) does not control the Aux path, it controls
    the input PGA path, as can been seen from Figure 8 Input Boost Stage in
    the datasheet. Update the naming of things in the driver to match this
    and update the routing to also reflect this.
    
    Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
    Link: https://lore.kernel.org/r/20231113155916.1741027-1-ckeepax@opensource.cirrus.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 3290bb89e74d905b3776ea9c96e795e327c073e3
Author: Matus Malych <matus@malych.org>
Date:   Sun Nov 12 17:54:04 2023 +0100

    ASoC: amd: yc: Add HP 255 G10 into quirk table
    
    [ Upstream commit 0c6498a59fbbcbf3d0a58c282dd6f0bca0eed92a ]
    
    HP 255 G10's internal microphone array can be made
    to work by adding it to the quirk table.
    
    Signed-off-by: Matus Malych <matus@malych.org>
    Link: https://lore.kernel.org/r/20231112165403.3221-1-matus@malych.org
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit bade0c1e7569f8efc9cfa1b29112f41e89e13835
Author: Yicong Yang <yangyicong@hisilicon.com>
Date:   Tue Oct 10 16:47:30 2023 +0800

    hwtracing: hisi_ptt: Don't try to attach a task
    
    [ Upstream commit aff787f64ad7cbb54614b51b82c682fe06411ef3 ]
    
    PTT is an uncore PMU and shouldn't be attached to any task. Block
    the usage in pmu::event_init().
    
    Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
    Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
    Link: https://lore.kernel.org/r/20231010084731.30450-5-yangyicong@huawei.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 5e67b92b8b2b9b5bdd126bdfed49f7bdad09329a
Author: Yicong Yang <yangyicong@hisilicon.com>
Date:   Tue Oct 10 16:47:28 2023 +0800

    hwtracing: hisi_ptt: Handle the interrupt in hardirq context
    
    [ Upstream commit e0dd27ad8af00f147ac3c9de88e0687986afc3ea ]
    
    Handle the trace interrupt in the hardirq context, make sure the irq
    core won't threaded it by declaring IRQF_NO_THREAD and userspace won't
    balance it by declaring IRQF_NOBALANCING. Otherwise we may violate the
    synchronization requirements of the perf core, referenced to the
    change of arm-ccn PMU
      commit 0811ef7e2f54 ("bus: arm-ccn: fix PMU interrupt flags").
    
    In the interrupt handler we mainly doing 2 things:
    - Copy the data from the local DMA buffer to the AUX buffer
    - Commit the data in the AUX buffer
    
    Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
    Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
    [ Fixed commit description to suppress checkpatch warning ]
    Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
    Link: https://lore.kernel.org/r/20231010084731.30450-3-yangyicong@huawei.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit a4848c45a3f01d6af48ce0101b103fcb3f251ba1
Author: Keith Busch <kbusch@kernel.org>
Date:   Tue Nov 28 09:36:04 2023 -0800

    nvme-core: check for too small lba shift
    
    [ Upstream commit 74fbc88e161424b3b96a22b23a8e3e1edab9d05c ]
    
    The block layer doesn't support logical block sizes smaller than 512
    bytes. The nvme spec doesn't support that small either, but the driver
    isn't checking to make sure the device responded with usable data.
    Failing to catch this will result in a kernel bug, either from a
    division by zero when stacking, or a zero length bio.
    
    Reviewed-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Keith Busch <kbusch@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 511f602527ac10344428518f4ffe78acc290529c
Author: Ming Lei <ming.lei@redhat.com>
Date:   Fri Dec 1 16:56:05 2023 +0800

    blk-mq: don't count completed flush data request as inflight in case of quiesce
    
    [ Upstream commit 0e4237ae8d159e3d28f3cd83146a46f576ffb586 ]
    
    Request queue quiesce may interrupt flush sequence, and the original request
    may have been marked as COMPLETE, but can't get finished because of
    queue quiesce.
    
    This way is fine from driver viewpoint, because flush sequence is block
    layer concept, and it isn't related with driver.
    
    However, driver(such as dm-rq) can call blk_mq_queue_inflight() to count &
    drain inflight requests, then the wait & drain never gets done because
    the completed & not-finished flush request is counted as inflight.
    
    Fix this issue by not counting completed flush data request as inflight in
    case of quiesce.
    
    Cc: Mike Snitzer <snitzer@kernel.org>
    Cc: David Jeffery <djeffery@redhat.com>
    Cc: John Pittman <jpittman@redhat.com>
    Signed-off-by: Ming Lei <ming.lei@redhat.com>
    Link: https://lore.kernel.org/r/20231201085605.577730-1-ming.lei@redhat.com
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 379af079c42738fa3f33de5912931a7865887c62
Author: Felix Kuehling <Felix.Kuehling@amd.com>
Date:   Fri Nov 17 16:44:17 2023 -0500

    Revert "drm/prime: Unexport helpers for fd/handle conversion"
    
    [ Upstream commit 0514f63cfff38a0dcb7ba9c5f245827edc0c5107 ]
    
    This reverts commit 71a7974ac7019afeec105a54447ae1dc7216cbb3.
    
    These helper functions are needed for KFD to export and import DMABufs
    the right way without duplicating the tracking of DMABufs associated with
    GEM objects while ensuring that move notifier callbacks are working as
    intended.
    
    CC: Christian König <christian.koenig@amd.com>
    CC: Thomas Zimmermann <tzimmermann@suse.de>
    Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
    Acked-by: Daniel Vetter <daniel@ffwll.ch>
    Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 5ca518149d46475e508b8cf81225dc48b0d41ddd
Author: Dmitry Antipov <dmantipov@yandex.ru>
Date:   Tue Nov 28 13:53:47 2023 +0300

    smb: client, common: fix fortify warnings
    
    [ Upstream commit 0015eb6e12384ff1c589928e84deac2ad1ceb236 ]
    
    When compiling with gcc version 14.0.0 20231126 (experimental)
    and CONFIG_FORTIFY_SOURCE=y, I've noticed the following:
    
    In file included from ./include/linux/string.h:295,
                     from ./include/linux/bitmap.h:12,
                     from ./include/linux/cpumask.h:12,
                     from ./arch/x86/include/asm/paravirt.h:17,
                     from ./arch/x86/include/asm/cpuid.h:62,
                     from ./arch/x86/include/asm/processor.h:19,
                     from ./arch/x86/include/asm/cpufeature.h:5,
                     from ./arch/x86/include/asm/thread_info.h:53,
                     from ./include/linux/thread_info.h:60,
                     from ./arch/x86/include/asm/preempt.h:9,
                     from ./include/linux/preempt.h:79,
                     from ./include/linux/spinlock.h:56,
                     from ./include/linux/wait.h:9,
                     from ./include/linux/wait_bit.h:8,
                     from ./include/linux/fs.h:6,
                     from fs/smb/client/smb2pdu.c:18:
    In function 'fortify_memcpy_chk',
        inlined from '__SMB2_close' at fs/smb/client/smb2pdu.c:3480:4:
    ./include/linux/fortify-string.h:588:25: warning: call to '__read_overflow2_field'
    declared with attribute warning: detected read beyond size of field (2nd parameter);
    maybe use struct_group()? [-Wattribute-warning]
      588 |                         __read_overflow2_field(q_size_field, size);
          |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    
    and:
    
    In file included from ./include/linux/string.h:295,
                     from ./include/linux/bitmap.h:12,
                     from ./include/linux/cpumask.h:12,
                     from ./arch/x86/include/asm/paravirt.h:17,
                     from ./arch/x86/include/asm/cpuid.h:62,
                     from ./arch/x86/include/asm/processor.h:19,
                     from ./arch/x86/include/asm/cpufeature.h:5,
                     from ./arch/x86/include/asm/thread_info.h:53,
                     from ./include/linux/thread_info.h:60,
                     from ./arch/x86/include/asm/preempt.h:9,
                     from ./include/linux/preempt.h:79,
                     from ./include/linux/spinlock.h:56,
                     from ./include/linux/wait.h:9,
                     from ./include/linux/wait_bit.h:8,
                     from ./include/linux/fs.h:6,
                     from fs/smb/client/cifssmb.c:17:
    In function 'fortify_memcpy_chk',
        inlined from 'CIFS_open' at fs/smb/client/cifssmb.c:1248:3:
    ./include/linux/fortify-string.h:588:25: warning: call to '__read_overflow2_field'
    declared with attribute warning: detected read beyond size of field (2nd parameter);
    maybe use struct_group()? [-Wattribute-warning]
      588 |                         __read_overflow2_field(q_size_field, size);
          |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    
    In both cases, the fortification logic inteprets calls to 'memcpy()' as an
    attempts to copy an amount of data which exceeds the size of the specified
    field (i.e. more than 8 bytes from __le64 value) and thus issues an overread
    warning. Both of these warnings may be silenced by using the convenient
    'struct_group()' quirk.
    
    Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
    Acked-by: Namjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 941887dc5ed4ef85ad06f3e76bcd444d9d5bc839
Author: Lijo Lazar <lijo.lazar@amd.com>
Date:   Tue Nov 28 16:47:14 2023 +0530

    drm/amdgpu: Use another offset for GC 9.4.3 remap
    
    [ Upstream commit ed6e4f0a27ebafffbd12bf3878ab004787685d8a ]
    
    The legacy region at 0x7F000 maps to valid registers in GC 9.4.3 SOCs.
    Use 0x1A000 offset instead as MMIO register remap region.
    
    Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
    Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit ccba042816400a82ed5d3d2f7b4ed79403d20c4c
Author: ZhenGuo Yin <zhenguo.yin@amd.com>
Date:   Mon Nov 6 18:07:51 2023 +0800

    drm/amdkfd: Free gang_ctx_bo and wptr_bo in pqm_uninit
    
    [ Upstream commit 72838777aa38352e20301e123b97110c456cd38e ]
    
    [Why]
    Memory leaks of gang_ctx_bo and wptr_bo.
    
    [How]
    Free gang_ctx_bo and wptr_bo in pqm_uninit.
    
    v2: add a common function pqm_clean_queue_resource to
    free queue's resources.
    v3: reset pdd->pqd.num_gws when destorying GWS queue.
    
    Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
    Signed-off-by: ZhenGuo Yin <zhenguo.yin@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 61dfdb779048332546358ac1847f0bbb07367162
Author: Lu Yao <yaolu@kylinos.cn>
Date:   Thu Nov 23 09:22:34 2023 +0800

    drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
    
    [ Upstream commit 2161e09cd05a50d80736fe397145340d2e8f6c05 ]
    
    For 'AMDGPU_FAMILY_SI' family cards, in 'si_common_early_init' func, init
    'didt_rreg' and 'didt_wreg' to 'NULL'. But in func
    'amdgpu_debugfs_regs_didt_read/write', using 'RREG32_DIDT' 'WREG32_DIDT'
    lacks of relevant judgment. And other 'amdgpu_ip_block_version' that use
    these two definitions won't be added for 'AMDGPU_FAMILY_SI'.
    
    So, add null pointer judgment before calling.
    
    Reviewed-by: Christian König <christian.koenig@amd.com>
    Signed-off-by: Lu Yao <yaolu@kylinos.cn>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 6396b551f28668aa376e281993ff0790bc8e7b9e
Author: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com>
Date:   Fri Nov 3 14:55:37 2023 -0400

    drm/amd/display: update dcn315 lpddr pstate latency
    
    [ Upstream commit c92da0403d373c03ea5c65c0260c7db6762013b0 ]
    
    [WHY/HOW]
    Increase the pstate latency to improve ac/dc transition
    
    Reviewed-by: Charlene Liu <charlene.liu@amd.com>
    Acked-by: Tom Chung <chiahsuan.chung@amd.com>
    Signed-off-by: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com>
    Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 867ecd8970d33ae4e269a7f24d037c35dcc79290
Author: Mukul Joshi <mukul.joshi@amd.com>
Date:   Wed Nov 22 15:17:22 2023 -0500

    drm/amdkfd: Use common function for IP version check
    
    [ Upstream commit 2f86bf79b63dbe6963ebc647b77a5f576a906b40 ]
    
    KFD_GC_VERSION was recently updated to use a new function
    for IP version checks. As a result, use KFD_GC_VERSION as
    the common function for all IP version checks in KFD.
    
    Signed-off-by: Mukul Joshi <mukul.joshi@amd.com>
    Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 541cb7618a15674ccad4d6878f65fa3241009cb6
Author: Hawking Zhang <Hawking.Zhang@amd.com>
Date:   Mon Nov 20 10:14:21 2023 +0800

    drm/amdgpu: Do not issue gpu reset from nbio v7_9 bif interrupt
    
    [ Upstream commit 884e9b0827e889a8742e203ccd052101fb0b945d ]
    
    In nbio v7_9, host driver should not issu gpu reset
    
    Signed-off-by: Hawking Zhang <Hawking.Zhang@amd.com>
    Reviewed-by: Stanley Yang <Stanley.Yang@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit da29e4012f4133a68dca8012b38970ea9212e9f0
Author: Yu Kuai <yukuai3@huawei.com>
Date:   Tue Nov 28 20:30:27 2023 +0800

    block: warn once for each partition in bio_check_ro()
    
    [ Upstream commit 67d995e069535c32829f5d368d919063492cec6e ]
    
    Commit 1b0a151c10a6 ("blk-core: use pr_warn_ratelimited() in
    bio_check_ro()") fix message storm by limit the rate, however, there
    will still be lots of message in the long term. Fix it better by warn
    once for each partition.
    
    Signed-off-by: Yu Kuai <yukuai3@huawei.com>
    Signed-off-by: Christoph Hellwig <hch@lst.de>
    Link: https://lore.kernel.org/r/20231128123027.971610-3-yukuai1@huaweicloud.com
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 0c7df8c241ff066b19782100f6bfc288144d7a38
Author: Jens Axboe <axboe@kernel.dk>
Date:   Tue Nov 28 10:29:58 2023 -0700

    io_uring: use fget/fput consistently
    
    [ Upstream commit 73363c262d6a7d26063da96610f61baf69a70f7c ]
    
    Normally within a syscall it's fine to use fdget/fdput for grabbing a
    file from the file table, and it's fine within io_uring as well. We do
    that via io_uring_enter(2), io_uring_register(2), and then also for
    cancel which is invoked from the latter. io_uring cannot close its own
    file descriptors as that is explicitly rejected, and for the cancel
    side of things, the file itself is just used as a lookup cookie.
    
    However, it is more prudent to ensure that full references are always
    grabbed. For anything threaded, either explicitly in the application
    itself or through use of the io-wq worker threads, this is what happens
    anyway. Generalize it and use fget/fput throughout.
    
    Also see the below link for more details.
    
    Link: https://lore.kernel.org/io-uring/CAG48ez1htVSO3TqmrF8QcX2WFuYTRM-VZ_N10i-VZgbtg=NNqw@mail.gmail.com/
    Suggested-by: Jann Horn <jannh@google.com>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 75cc56afb28b0f113f79d8906f7fed9100cea288
Author: Maurizio Lombardi <mlombard@redhat.com>
Date:   Thu Nov 23 15:07:41 2023 +0100

    nvme-core: fix a memory leak in nvme_ns_info_from_identify()
    
    [ Upstream commit e3139cef8257fcab1725441e2fd5fd0ccb5481b1 ]
    
    In case of error, free the nvme_id_ns structure that was allocated
    by nvme_identify_ns().
    
    Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
    Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
    Reviewed-by: Kanchan Joshi <joshi.k@samsung.com>
    Signed-off-by: Keith Busch <kbusch@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit a47f3a83411f37077f3c3b47ee982af1fab8f909
Author: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Date:   Mon Nov 27 13:16:58 2023 +0200

    ALSA: hda: intel-nhlt: Ignore vbps when looking for DMIC 32 bps format
    
    [ Upstream commit 7b4c93a50a2ebbbaf656cc4fa6aca74a6166d85b ]
    
    When looking up DMIC blob from the NHLT table and the format is 32 bits,
    ignore the vbps matching for 32 bps for DMIC since some NHLT table have
    the vbps as 24, some have it as 32.
    The DMIC hardware supports only one type of 32 bit sample size, which is
    24 bit sampling on the MSB side and bits[1:0] is used for indicating the
    channel number.
    
    Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
    Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
    Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
    Link: https://lore.kernel.org/r/20231127111658.17275-1-peter.ujfalusi@linux.intel.com
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit c455b17aff82f65b72e86ba6b8f85f9f61fd6bbc
Author: Johannes Berg <johannes.berg@intel.com>
Date:   Fri Nov 24 17:25:24 2023 +0100

    debugfs: fix automount d_fsdata usage
    
    [ Upstream commit 0ed04a1847a10297595ac24dc7d46b35fb35f90a ]
    
    debugfs_create_automount() stores a function pointer in d_fsdata,
    but since commit 7c8d469877b1 ("debugfs: add support for more
    elaborate ->d_fsdata") debugfs_release_dentry() will free it, now
    conditionally on DEBUGFS_FSDATA_IS_REAL_FOPS_BIT, but that's not
    set for the function pointer in automount. As a result, removing
    an automount dentry would attempt to free the function pointer.
    Luckily, the only user of this (tracing) never removes it.
    
    Nevertheless, it's safer if we just handle the fsdata in one way,
    namely either DEBUGFS_FSDATA_IS_REAL_FOPS_BIT or allocated. Thus,
    change the automount to allocate it, and use the real_fops in the
    data to indicate whether or not automount is filled, rather than
    adding a type tag. At least for now this isn't actually needed,
    but the next changes will require it.
    
    Also check in debugfs_file_get() that it gets only called
    on regular files, just to make things clearer.
    
    Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 0e25eac37f7abe131b97d732e50de6eb21928d24
Author: Ben Greear <greearb@candelatech.com>
Date:   Thu Nov 9 10:22:01 2023 -0800

    wifi: mac80211: handle 320 MHz in ieee80211_ht_cap_ie_to_sta_ht_cap
    
    [ Upstream commit 00f7d153f3358a7c7e35aef66fcd9ceb95d90430 ]
    
    The new 320 MHz channel width wasn't handled, so connecting
    a station to a 320 MHz AP would limit the station to 20 MHz
    (on HT) after a warning, handle 320 MHz to fix that.
    
    Signed-off-by: Ben Greear <greearb@candelatech.com>
    Link: https://lore.kernel.org/r/20231109182201.495381-1-greearb@candelatech.com
    [write a proper commit message]
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 3f7af987d55b9dcb03b023bbcba2e60fc02db944
Author: Michael-CY Lee <michael-cy.lee@mediatek.com>
Date:   Wed Nov 22 11:02:37 2023 +0800

    wifi: avoid offset calculation on NULL pointer
    
    [ Upstream commit ef5828805842204dd0259ecfc132b5916c8a77ae ]
    
    ieee80211_he_6ghz_oper() can be passed a NULL pointer
    and checks for that, but already did the calculation
    to inside of it before. Move it after the check.
    
    Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
    Link: https://lore.kernel.org/r/20231122030237.31276-1-michael-cy.lee@mediatek.com
    [rewrite commit message]
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 35a59d349ab0112cd002157104c9dbe296a5ddf5
Author: Johannes Berg <johannes.berg@intel.com>
Date:   Wed Nov 8 13:41:25 2023 +0100

    wifi: cfg80211: lock wiphy mutex for rfkill poll
    
    [ Upstream commit 8e2f6f2366219b3304b227bdd2f04b64c92e3e12 ]
    
    We want to guarantee the mutex is held for pretty much
    all operations, so ensure that here as well.
    
    Reported-by: syzbot+7e59a5bfc7a897247e18@syzkaller.appspotmail.com
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 5814deb5a5b0b0072bab91eb3ec9c9a799290514
Author: Edward Adam Davis <eadavis@qq.com>
Date:   Thu Nov 23 09:23:39 2023 +0800

    mptcp: fix uninit-value in mptcp_incoming_options
    
    [ Upstream commit 237ff253f2d4f6307b7b20434d7cbcc67693298b ]
    
    Added initialization use_ack to mptcp_parse_option().
    
    Reported-by: syzbot+b834a6b2decad004cfa1@syzkaller.appspotmail.com
    Signed-off-by: Edward Adam Davis <eadavis@qq.com>
    Acked-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 948cb8b2d5d0dfee5a692c880e88f8e249bb6c36
Author: Vasiliy Kovalev <kovalev@altlinux.org>
Date:   Fri Nov 17 20:09:23 2023 +0300

    ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro
    
    [ Upstream commit 7c9caa299335df94ad1c58f70a22f16a540eab60 ]
    
    This patch corrected the speaker and headset mic pin config to the more
    appropriate values.
    
    Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
    Link: https://lore.kernel.org/r/20231117170923.106822-1-kovalev@altlinux.org
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit d273f33bb1e3ffc87023495021a72e392d4f27dd
Author: Charles Keepax <ckeepax@opensource.cirrus.com>
Date:   Wed Nov 15 16:28:53 2023 +0000

    pinctrl: lochnagar: Don't build on MIPS
    
    [ Upstream commit 6588732445ff19f6183f0fa72ddedf67e5a5be32 ]
    
    MIPS appears to define a RST symbol at a high level, which clashes
    with some register naming in the driver. Since there is currently
    no case for running this driver on MIPS devices simply cut off the
    build of this driver on MIPS.
    
    Reported-by: kernel test robot <lkp@intel.com>
    Closes: https://lore.kernel.org/oe-kbuild-all/202311071303.JJMAOjy4-lkp@intel.com/
    Suggested-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
    Link: https://lore.kernel.org/r/20231115162853.1891940-1-ckeepax@opensource.cirrus.com
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit b12a331178d4c7dcc3d1a2323f86f5de33c5ba9c
Author: Michal Wajdeczko <michal.wajdeczko@intel.com>
Date:   Wed Oct 4 22:57:00 2023 +0200

    kunit: Reset suite counter right before running tests
    
    [ Upstream commit 2e3c94aed51eabbe9c1c0ee515371ea5441c2fa7 ]
    
    Today we reset the suite counter as part of the suite cleanup,
    called from the module exit callback, but it might not work that
    well as one can try to collect results without unloading a previous
    test (either unintentionally or due to dependencies).
    
    For easy reproduction try to load the kunit-test.ko and then
    collect and parse results from the kunit-example-test.ko load.
    Parser will complain about mismatch of expected test number:
    
    [ ] KTAP version 1
    [ ] 1..1
    [ ]     # example: initializing suite
    [ ]     KTAP version 1
    [ ]     # Subtest: example
    ..
    [ ] # example: pass:5 fail:0 skip:4 total:9
    [ ] # Totals: pass:6 fail:0 skip:6 total:12
    [ ] ok 7 example
    
    [ ] [ERROR] Test: example: Expected test number 1 but found 7
    [ ] ===================== [PASSED] example =====================
    [ ] ============================================================
    [ ] Testing complete. Ran 12 tests: passed: 6, skipped: 6, errors: 1
    
    Since we are now printing suite test plan on every module load,
    right before running suite tests, we should make sure that suite
    counter will also start from 1. Easiest solution seems to be move
    counter reset to the __kunit_test_suites_init() function.
    
    Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
    Cc: David Gow <davidgow@google.com>
    Cc: Rae Moar <rmoar@google.com>
    Reviewed-by: David Gow <davidgow@google.com>
    Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 858c0840ef02e9f49dba3860a6c6d06d181de43d
Author: Maxime Ripard <mripard@kernel.org>
Date:   Thu Oct 26 10:59:31 2023 +0200

    kunit: Warn if tests are slow
    
    [ Upstream commit f8f2847f739dc899d0e563eac01299dadefa64ff ]
    
    Kunit recently gained support to setup attributes, the first one being
    the speed of a given test, then allowing to filter out slow tests.
    
    A slow test is defined in the documentation as taking more than one
    second. There's an another speed attribute called "super slow" but whose
    definition is less clear.
    
    Add support to the test runner to check the test execution time, and
    report tests that should be marked as slow but aren't.
    
    Signed-off-by: Maxime Ripard <mripard@kernel.org>
    Reviewed-by: David Gow <davidgow@google.com>
    Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit f88c602fd0ab289d03e0e279ce83ddf01c24ec22
Author: Chester Lin <chester62515@gmail.com>
Date:   Tue Nov 7 22:10:44 2023 +0800

    pinctrl: s32cc: Avoid possible string truncation
    
    [ Upstream commit 08e8734d877a9a0fb8af1254a4ce58734fbef296 ]
    
    With "W=1" and "-Wformat-truncation" build options, the kernel test robot
    found a possible string truncation warning in pinctrl-s32cc.c, which uses
    an 8-byte char array to hold a memory region name "map%u". Since the
    maximum number of digits that a u32 value can present is 10, and the "map"
    string occupies 3 bytes with a termination '\0', which means the rest 4
    bytes cannot fully present the integer "X" that exceeds 4 digits.
    
    Here we check if the number >= 10000, which is the lowest value that
    contains more than 4 digits.
    
    Reported-by: kernel test robot <lkp@intel.com>
    Closes: https://lore.kernel.org/oe-kbuild-all/202311030159.iyUGjNGF-lkp@intel.com/
    Signed-off-by: Chester Lin <clin@suse.com>
    Link: https://lore.kernel.org/r/20231107141044.24058-1-clin@suse.com
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

commit 2525d1ba225b5c167162fa344013c408e8b4de36
Author: Eric Biggers <ebiggers@google.com>
Date:   Mon Nov 6 20:44:34 2023 -0800

    f2fs: explicitly null-terminate the xattr list
    
    commit e26b6d39270f5eab0087453d9b544189a38c8564 upstream.
    
    When setting an xattr, explicitly null-terminate the xattr list.  This
    eliminates the fragile assumption that the unused xattr space is always
    zeroed.
    
    Signed-off-by: Eric Biggers <ebiggers@google.com>
    Reviewed-by: Chao Yu <chao@kernel.org>
    Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>