Pull iommu fixes from Joerg Roedel:

 - Intel VT-d fixes from Lu Baolu:
     - Boot kdump kernels with VT-d scalable mode on
     - Calculate the right page table levels
     - Fix two recursive locking issues
     - Fix a lockdep splat issue

 - AMD IOMMU fixes:
     - Fix for completion-wait command to use full 64 bits of data
     - Fix PASID related issue where GPU sound devices failed to
       initialize

 - Fix for Virtio-IOMMU to report correct caching behavior, needed for
   use with VFIO

* tag 'iommu-fixes-v6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
  iommu: Fix false ownership failure on AMD systems with PASID activated
  iommu/vt-d: Fix possible recursive locking in intel_iommu_init()
  iommu/virtio: Fix interaction with VFIO
  iommu/vt-d: Fix lockdep splat due to klist iteration in atomic context
  iommu/vt-d: Fix recursive lock issue in iommu_flush_dev_iotlb()
  iommu/vt-d: Correctly calculate sagaw value of IOMMU
  iommu/vt-d: Fix kdump kernels boot failure with scalable mode
  iommu/amd: use full 64-bit value in build_completion_wait()

The AMD IOMMU driver cannot activate PASID mode on a RID without the RID's
translation being set to IDENTITY. Further it requires changing the RID's
page table layout from the normal v1 IOMMU_DOMAIN_IDENTITY layout to a
different v2 layout.

It does this by creating a new iommu_domain, configuring that domain for
v2 identity operation and then attaching it to the group, from within the
driver. This logic assumes the group is already set to the IDENTITY domain
and is being used by the DMA API.

However, since the ownership logic is based on the group's domain pointer
equaling the default domain to detect DMA API ownership, this causes it to
look like the group is not attached to the DMA API any more. This blocks
attaching drivers to any other devices in the group.

In a real system this manifests itself as the HD-audio devices on some AMD
platforms losing their device drivers.

Work around this unique behavior of the AMD driver by checking for
equality of IDENTITY domains based on their type, not their pointer
value. This allows the AMD driver to have two IDENTITY domains for
internal purposes without breaking the check.

Have the AMD driver properly declare that the special domain it created is
actually an IDENTITY domain.

Cc: Robin Murphy <robin.murphy@arm.com>
Cc: stable@vger.kernel.org
Fixes: 512881eacfa7 ("bus: platform,amba,fsl-mc,PCI: Add device DMA ownership management")
Reported-by: Takashi Iwai <tiwai@suse.de>
Tested-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Link: https://lore.kernel.org/r/0-v1-ea566e16b06b+811-amd_owner_jgg@nvidia.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>

The global rwsem dmar_global_lock was introduced by commit 3a5670e8ac932
("iommu/vt-d: Introduce a rwsem to protect global data structures"). It
is used to protect DMAR related global data from DMAR hotplug operations.

The dmar_global_lock used in the intel_iommu_init() might cause recursive
locking issue, for example, intel_iommu_get_resv_regions() is taking the
dmar_global_lock from within a section where intel_iommu_init() already
holds it via probe_acpi_namespace_devices().

Using dmar_global_lock in intel_iommu_init() could be relaxed since it is
unlikely that any IO board must be hot added before the IOMMU subsystem is
initialized. This eliminates the possible recursive locking issue by moving
down DMAR hotplug support after the IOMMU is initialized and removing the
uses of dmar_global_lock in intel_iommu_init().

Fixes: d5692d4af08cd ("iommu/vt-d: Fix suspicious RCU usage in probe_acpi_namespace_devices()")
Reported-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Link: https://lore.kernel.org/r/894db0ccae854b35c73814485569b634237b5538.1657034828.git.robin.murphy@arm.com
Link: https://lore.kernel.org/r/20220718235325.3952426-1-baolu.lu@linux.intel.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>

Pull hwmon fixes from Guenter Roeck:

 - Fix severe regression in asus-ec-sensors driver
   which resulted in EC driver failures

 - Fix various bugs in mr75203 driver

 - Fix byte order bug in tps23861 driver

* tag 'hwmon-for-v6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (asus-ec-sensors) autoload module via DMI data
  hwmon: (mr75203) enable polling for all VM channels
  hwmon: (mr75203) fix multi-channel voltage reading
  hwmon: (mr75203) fix voltage equation for negative source input
  hwmon: (mr75203) update pvt->v_num and vm_num to the actual number of used sensors
  hwmon: (mr75203) fix VM sensor allocation when "intel,vm-map" not defined
  dt-bindings: hwmon: (mr75203) fix "intel,vm-map" property to be optional
  hwmon: (tps23861) fix byte order in resistance register

Pull SCSI fixes from James Bottomley:
 "Eight patches which looks like quite a large core change, but most of
  the diffstat is reverting the attempt to rejig reference counting
  introduced in the last merge window which caused issues with device
  and module removal.

  Of the remaining four patches, only the fix use-after-free is
  substantial"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: mpt3sas: Fix use-after-free warning
  scsi: core: Fix a use-after-free
  scsi: core: Revert "Make sure that targets outlive devices"
  scsi: core: Revert "Make sure that hosts outlive targets"
  scsi: core: Revert "Simplify LLD module reference counting"
  scsi: core: Revert "Call blk_mq_free_tag_set() earlier"
  scsi: lpfc: Add missing destroy_workqueue() in error path
  scsi: lpfc: Return DID_TRANSPORT_DISRUPTED instead of DID_REQUEUE

Pull driver core fixes from Greg KH:
 "Here are some small driver core and debugfs fixes for 6.0-rc5.

  Included in here are:

   - multiple attempts to get the arch_topology code to work properly on
     non-cluster SMT systems. First attempt caused build breakages in
     linux-next and 0-day, second try worked.

   - debugfs fixes for a long-suffering memory leak. The pattern of
     debugfs_remove(debugfs_lookup(...)) turns out to leak dentries, so
     add debugfs_lookup_and_remove() to fix this problem. Also fix up
     the scheduler debug code that highlighted this problem. Fixes for
     other subsystems will be trickling in over the next few months for
     this same issue once the debugfs function is merged.

  All of these have been in linux-next since Wednesday with no reported
  problems"

* tag 'driver-core-6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
  arch_topology: Make cluster topology span at least SMT CPUs
  sched/debug: fix dentry leak in update_sched_domain_debugfs
  debugfs: add debugfs_lookup_and_remove()
  driver core: fix driver_set_override() issue with empty strings
  Revert "arch_topology: Make cluster topology span at least SMT CPUs"
  arch_topology: Make cluster topology span at least SMT CPUs

Pull block fixes from Jens Axboe:

 - NVMe pull via Christoph:
      - fix a use after free in nvmet (Bart Van Assche)
      - fix a use after free when detecting digest errors
        (Sagi Grimberg)
      - fix regression that causes sporadic TCP requests to time out
        (Sagi Grimberg)
      - fix two off by ones errors in the nvmet ZNS support
        (Dennis Maisenbacher)
      - requeue aen after firmware activation (Keith Busch)

 - Fix missing request flags in debugfs code (me)

 - Partition scan fix (Ming)

* tag 'block-6.0-2022-09-09' of git://git.kernel.dk/linux-block:
  block: add missing request flags to debugfs code
  nvme: requeue aen after firmware activation
  nvmet: fix mar and mor off-by-one errors
  nvme-tcp: fix regression that causes sporadic requests to time out
  nvme-tcp: fix UAF when detecting digest errors
  nvmet: fix a use-after-free
  block: don't add partitions if GD_SUPPRESS_PART_SCAN is set

Pull rdma fixes from Jason Gunthorpe:
 "Many bug fixes in several drivers:

   - Fix misuse of the DMA API in rtrs

   - Several irdma issues: hung task due to SQ flushing, incorrect
     capability reporting to userspace, improper error handling for MW
     corners, touching an uninitialized SGL for during invalidation.

   - hns was using the wrong page size limits for the HW, an incorrect
     calculation of wqe_shift causing WQE corruption, and mis computed a
     timer id.

   - Fix a crash in SRP triggered by blktests

   - Fix compiler errors by calling virt_to_page() with the proper type
     in siw

   - Userspace triggerable deadlock in ODP

   - mlx5 could use the wrong profile due to some driver loading races,
     counters were not working in some device configurations, and a
     crash on error unwind"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  RDMA/irdma: Report RNR NAK generation in device caps
  RDMA/irdma: Use s/g array in post send only when its valid
  RDMA/irdma: Return correct WC error for bind operation failure
  RDMA/irdma: Return error on MR deregister CQP failure
  RDMA/irdma: Report the correct max cqes from query device
  MAINTAINERS: Update maintainers of HiSilicon RoCE
  RDMA/mlx5: Fix UMR cleanup on error flow of driver init
  RDMA/mlx5: Set local port to one when accessing counters
  RDMA/mlx5: Rely on RoCE fw cap instead of devlink when setting profile
  IB/core: Fix a nested dead lock as part of ODP flow
  RDMA/siw: Pass a pointer to virt_to_page()
  RDMA/srp: Set scmnd->result only when scmnd is not NULL
  RDMA/hns: Remove the num_qpc_timer variable
  RDMA/hns: Fix wrong fixed value of qp->rq.wqe_shift
  RDMA/hns: Fix supported page size
  RDMA/cma: Fix arguments order in net device validation
  RDMA/irdma: Fix drain SQ hang with no completion
  RDMA/rtrs-srv: Pass the correct number of entries for dma mapped SGL
  RDMA/rtrs-clt: Use the right sg_cnt after ib_dma_map_sg

Pull drm fixes from Dave Airlie:
 "From a train in the Irish countryside, regular drm fixes for 6.0-rc5.

  This is mostly amdgpu/amdkfd and i915 fixes, then one panfrost, one
  ttm and one edid fix. Nothing too major going on. Hopefully a quiet
  week next week for LPC.

  edid:
   - Fix EDID 1.4 range-descriptor parsing

  ttm:
   - Fix ghost-object bulk moves

  i915:
   - Fix MIPI sequence block copy from BIOS' table
   - Fix PCODE min freq setup when GuC's SLPC is in use
   - Implement Workaround for eDP
   - Fix has_flat_ccs selection for DG1

  amdgpu:
   - Firmware header fix
   - SMU 13.x fix
   - Debugfs memory leak fix
   - NBIO 7.7 fix
   - Firmware memory leak fix

  amdkfd:
   - Debug output fix

  panfrost:
   - Fix devfreq OPP"

* tag 'drm-fixes-2022-09-10' of git://anongit.freedesktop.org/drm/drm:
  drm/panfrost: devfreq: set opp to the recommended one to configure regulator
  drm/ttm: cleanup the resource of ghost objects after locking them
  drm/amdgpu: prevent toc firmware memory leak
  drm/amdgpu: correct doorbell range/size value for CSDMA_DOORBELL_RANGE
  drm/amdkfd: print address in hex format rather than decimal
  drm/amd/display: fix memory leak when using debugfs_lookup()
  drm/amd/pm: add missing SetMGpuFanBoostLimitRpm mapping for SMU 13.0.7
  drm/amd/amdgpu: add rlc_firmware_header_v2_4 to amdgpu_firmware_header
  drm/i915: consider HAS_FLAT_CCS() in needs_ccs_pages
  drm/i915: Implement WaEdpLinkRateDataReload
  drm/i915/slpc: Let's fix the PCODE min freq table setup for SLPC
  drm/i915/bios: Copy the whole MIPI sequence block
  drm/ttm: update bulk move object of ghost BO
  drm/edid: Handle EDID 1.4 range descriptor h/vfreq offsets

Pull KUnit fixes from Shuah Khan:
 "Two fixes to test build and a fix for incorrect taint reason reporting"

* tag 'linux-kselftest-kunit-fixes-6.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
  tools: Add new "test" taint to kernel-chktaint
  kunit: fix Kconfig for build-in tests USB4 and Nitro Enclaves
  kunit: fix assert_type for comparison macros