--- /dev/null
+From 0f34167e2873f19818d315638f92f977b93b5e04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Nov 2022 17:11:59 +0800
+Subject: 9p/fd: Use P9_HDRSZ for header size
+
+From: GUO Zihua <guozihua@huawei.com>
+
+[ Upstream commit 6854fadbeee10891ed74246bdc05031906b6c8cf ]
+
+Cleanup hardcoded header sizes to use P9_HDRSZ instead of '7'
+
+Link: https://lkml.kernel.org/r/20221117091159.31533-4-guozihua@huawei.com
+Signed-off-by: GUO Zihua <guozihua@huawei.com>
+Reviewed-by: Christian Schoenebeck <linux_oss@crudebyte.com>
+[Dominique: commit message adjusted to make sense after offset size
+adjustment got removed]
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/9p/trans_fd.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
+index 3e056fb043bb..080b5de3e1ed 100644
+--- a/net/9p/trans_fd.c
++++ b/net/9p/trans_fd.c
+@@ -120,7 +120,7 @@ struct p9_conn {
+ struct list_head unsent_req_list;
+ struct p9_req_t *rreq;
+ struct p9_req_t *wreq;
+- char tmp_buf[7];
++ char tmp_buf[P9_HDRSZ];
+ struct p9_fcall rc;
+ int wpos;
+ int wsize;
+@@ -293,7 +293,7 @@ static void p9_read_work(struct work_struct *work)
+ if (!m->rc.sdata) {
+ m->rc.sdata = m->tmp_buf;
+ m->rc.offset = 0;
+- m->rc.capacity = 7; /* start by reading header */
++ m->rc.capacity = P9_HDRSZ; /* start by reading header */
+ }
+
+ clear_bit(Rpending, &m->wsched);
+@@ -316,7 +316,7 @@ static void p9_read_work(struct work_struct *work)
+ p9_debug(P9_DEBUG_TRANS, "got new header\n");
+
+ /* Header size */
+- m->rc.size = 7;
++ m->rc.size = P9_HDRSZ;
+ err = p9_parse_header(&m->rc, &m->rc.size, NULL, NULL, 0);
+ if (err) {
+ p9_debug(P9_DEBUG_ERROR,
+--
+2.35.1
+
--- /dev/null
+From 4b875faf4dbc160cdade3b01f5050b91a942a919 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Nov 2022 22:44:41 +0900
+Subject: 9p/xen: check logical size for buffer size
+
+From: Dominique Martinet <asmadeus@codewreck.org>
+
+[ Upstream commit 391c18cf776eb4569ecda1f7794f360fe0a45a26 ]
+
+trans_xen did not check the data fits into the buffer before copying
+from the xen ring, but we probably should.
+Add a check that just skips the request and return an error to
+userspace if it did not fit
+
+Tested-by: Stefano Stabellini <sstabellini@kernel.org>
+Reviewed-by: Christian Schoenebeck <linux_oss@crudebyte.com>
+Link: https://lkml.kernel.org/r/20221118135542.63400-1-asmadeus@codewreck.org
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/9p/trans_xen.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
+index 227f89cc7237..0f862d5a5960 100644
+--- a/net/9p/trans_xen.c
++++ b/net/9p/trans_xen.c
+@@ -208,6 +208,14 @@ static void p9_xen_response(struct work_struct *work)
+ continue;
+ }
+
++ if (h.size > req->rc.capacity) {
++ dev_warn(&priv->dev->dev,
++ "requested packet size too big: %d for tag %d with capacity %zd\n",
++ h.size, h.tag, req->rc.capacity);
++ req->status = REQ_STATUS_ERROR;
++ goto recv_error;
++ }
++
+ memcpy(&req->rc, &h, sizeof(h));
+ req->rc.offset = 0;
+
+@@ -217,6 +225,7 @@ static void p9_xen_response(struct work_struct *work)
+ masked_prod, &masked_cons,
+ XEN_9PFS_RING_SIZE(ring));
+
++recv_error:
+ virt_mb();
+ cons += h.size;
+ ring->intf->in_cons = cons;
+--
+2.35.1
+
--- /dev/null
+From 066b7c7660d8b7e597b482f1156f3b170003daca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Sep 2022 10:48:10 +0200
+Subject: ALSA: hda/realtek: More robust component matching for CS35L41
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 35a1744423743247026668e2323d1b932583fc2a ]
+
+As the previous commit implies, a system may have a different SPI bus
+number that is embedded in the device string. And, assuming the fixed
+bus number is rather fragile; it may be assigned differently depending
+on the configuration or on the boot environment. Once when a bus
+number change happens, the binding fails, resulting in the silence.
+
+This patch tries to make the matching a bit more relaxed, allowing to
+bind with a different bus number (or without it). So the previous
+fix, the introduction of ALC245_FIXUP_CS35L41_SPI1_2 fixup became
+superfluous, and this is unified to ALC245_FIXUP_CS35L41_SPI_2.
+
+Fixes: 225f6e1bc151 ("ALSA: hda/realtek: Add quirk for HP Zbook Firefly 14 G9 model")
+Link: https://lore.kernel.org/r/20220930084810.10435-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 62 +++++++++++++++++++++--------------
+ 1 file changed, 37 insertions(+), 25 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index bf58e98c7a69..d8c6af9e43ad 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -18,6 +18,7 @@
+ #include <linux/module.h>
+ #include <linux/input.h>
+ #include <linux/leds.h>
++#include <linux/ctype.h>
+ #include <sound/core.h>
+ #include <sound/jack.h>
+ #include <sound/hda_codec.h>
+@@ -6704,23 +6705,51 @@ static void comp_generic_playback_hook(struct hda_pcm_stream *hinfo, struct hda_
+ }
+ }
+
++struct cs35l41_dev_name {
++ const char *bus;
++ const char *hid;
++ int index;
++};
++
++/* match the device name in a slightly relaxed manner */
++static int comp_match_cs35l41_dev_name(struct device *dev, void *data)
++{
++ struct cs35l41_dev_name *p = data;
++ const char *d = dev_name(dev);
++ int n = strlen(p->bus);
++ char tmp[32];
++
++ /* check the bus name */
++ if (strncmp(d, p->bus, n))
++ return 0;
++ /* skip the bus number */
++ if (isdigit(d[n]))
++ n++;
++ /* the rest must be exact matching */
++ snprintf(tmp, sizeof(tmp), "-%s:00-cs35l41-hda.%d", p->hid, p->index);
++ return !strcmp(d + n, tmp);
++}
++
+ static void cs35l41_generic_fixup(struct hda_codec *cdc, int action, const char *bus,
+ const char *hid, int count)
+ {
+ struct device *dev = hda_codec_dev(cdc);
+ struct alc_spec *spec = cdc->spec;
+- char *name;
++ struct cs35l41_dev_name *rec;
+ int ret, i;
+
+ switch (action) {
+ case HDA_FIXUP_ACT_PRE_PROBE:
+ for (i = 0; i < count; i++) {
+- name = devm_kasprintf(dev, GFP_KERNEL,
+- "%s-%s:00-cs35l41-hda.%d", bus, hid, i);
+- if (!name)
++ rec = devm_kmalloc(dev, sizeof(*rec), GFP_KERNEL);
++ if (!rec)
+ return;
++ rec->bus = bus;
++ rec->hid = hid;
++ rec->index = i;
+ spec->comps[i].codec = cdc;
+- component_match_add(dev, &spec->match, component_compare_dev_name, name);
++ component_match_add(dev, &spec->match,
++ comp_match_cs35l41_dev_name, rec);
+ }
+ ret = component_master_add_with_match(dev, &comp_master_ops, spec->match);
+ if (ret)
+@@ -6738,17 +6767,12 @@ static void cs35l41_fixup_i2c_two(struct hda_codec *cdc, const struct hda_fixup
+
+ static void cs35l41_fixup_spi_two(struct hda_codec *codec, const struct hda_fixup *fix, int action)
+ {
+- cs35l41_generic_fixup(codec, action, "spi0", "CSC3551", 2);
+-}
+-
+-static void cs35l41_fixup_spi1_two(struct hda_codec *codec, const struct hda_fixup *fix, int action)
+-{
+- cs35l41_generic_fixup(codec, action, "spi1", "CSC3551", 2);
++ cs35l41_generic_fixup(codec, action, "spi", "CSC3551", 2);
+ }
+
+ static void cs35l41_fixup_spi_four(struct hda_codec *codec, const struct hda_fixup *fix, int action)
+ {
+- cs35l41_generic_fixup(codec, action, "spi0", "CSC3551", 4);
++ cs35l41_generic_fixup(codec, action, "spi", "CSC3551", 4);
+ }
+
+ static void alc287_fixup_legion_16achg6_speakers(struct hda_codec *cdc, const struct hda_fixup *fix,
+@@ -7137,8 +7161,6 @@ enum {
+ ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED,
+ ALC245_FIXUP_CS35L41_SPI_2,
+ ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED,
+- ALC245_FIXUP_CS35L41_SPI1_2,
+- ALC245_FIXUP_CS35L41_SPI1_2_HP_GPIO_LED,
+ ALC245_FIXUP_CS35L41_SPI_4,
+ ALC245_FIXUP_CS35L41_SPI_4_HP_GPIO_LED,
+ ALC285_FIXUP_HP_SPEAKERS_MICMUTE_LED,
+@@ -8988,16 +9010,6 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC285_FIXUP_HP_GPIO_LED,
+ },
+- [ALC245_FIXUP_CS35L41_SPI1_2] = {
+- .type = HDA_FIXUP_FUNC,
+- .v.func = cs35l41_fixup_spi1_two,
+- },
+- [ALC245_FIXUP_CS35L41_SPI1_2_HP_GPIO_LED] = {
+- .type = HDA_FIXUP_FUNC,
+- .v.func = cs35l41_fixup_spi1_two,
+- .chained = true,
+- .chain_id = ALC285_FIXUP_HP_GPIO_LED,
+- },
+ [ALC245_FIXUP_CS35L41_SPI_4] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = cs35l41_fixup_spi_four,
+@@ -9361,7 +9373,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x8aa3, "HP ProBook 450 G9 (MB 8AA1)", ALC236_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8aa8, "HP EliteBook 640 G9 (MB 8AA6)", ALC236_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8aab, "HP EliteBook 650 G9 (MB 8AA9)", ALC236_FIXUP_HP_GPIO_LED),
+- SND_PCI_QUIRK(0x103c, 0x8abb, "HP ZBook Firefly 14 G9", ALC245_FIXUP_CS35L41_SPI1_2_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x8abb, "HP ZBook Firefly 14 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8ad1, "HP EliteBook 840 14 inch G9 Notebook PC", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8ad2, "HP EliteBook 860 16 inch G9 Notebook PC", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+--
+2.35.1
+
--- /dev/null
+From e21d1be8fc43081c83e0a44699a6ef6696f9fd51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Nov 2022 15:23:50 -0800
+Subject: ALSA: seq: Fix function prototype mismatch in
+ snd_seq_expand_var_event
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 05530ef7cf7c7d700f6753f058999b1b5099a026 ]
+
+With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG),
+indirect call targets are validated against the expected function
+pointer prototype to make sure the call target is valid to help mitigate
+ROP attacks. If they are not identical, there is a failure at run time,
+which manifests as either a kernel panic or thread getting killed.
+
+seq_copy_in_user() and seq_copy_in_kernel() did not have prototypes
+matching snd_seq_dump_func_t. Adjust this and remove the casts. There
+are not resulting binary output differences.
+
+This was found as a result of Clang's new -Wcast-function-type-strict
+flag, which is more sensitive than the simpler -Wcast-function-type,
+which only checks for type width mismatches.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Link: https://lore.kernel.org/lkml/202211041527.HD8TLSE1-lkp@intel.com
+Cc: Jaroslav Kysela <perex@perex.cz>
+Cc: Takashi Iwai <tiwai@suse.com>
+Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org>
+Cc: alsa-devel@alsa-project.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20221118232346.never.380-kees@kernel.org
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/seq/seq_memory.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
+index b7aee23fc387..47ef6bc30c0e 100644
+--- a/sound/core/seq/seq_memory.c
++++ b/sound/core/seq/seq_memory.c
+@@ -113,15 +113,19 @@ EXPORT_SYMBOL(snd_seq_dump_var_event);
+ * expand the variable length event to linear buffer space.
+ */
+
+-static int seq_copy_in_kernel(char **bufptr, const void *src, int size)
++static int seq_copy_in_kernel(void *ptr, void *src, int size)
+ {
++ char **bufptr = ptr;
++
+ memcpy(*bufptr, src, size);
+ *bufptr += size;
+ return 0;
+ }
+
+-static int seq_copy_in_user(char __user **bufptr, const void *src, int size)
++static int seq_copy_in_user(void *ptr, void *src, int size)
+ {
++ char __user **bufptr = ptr;
++
+ if (copy_to_user(*bufptr, src, size))
+ return -EFAULT;
+ *bufptr += size;
+@@ -151,8 +155,7 @@ int snd_seq_expand_var_event(const struct snd_seq_event *event, int count, char
+ return newlen;
+ }
+ err = snd_seq_dump_var_event(event,
+- in_kernel ? (snd_seq_dump_func_t)seq_copy_in_kernel :
+- (snd_seq_dump_func_t)seq_copy_in_user,
++ in_kernel ? seq_copy_in_kernel : seq_copy_in_user,
+ &buf);
+ return err < 0 ? err : newlen;
+ }
+--
+2.35.1
+
--- /dev/null
+From 88b5f18330ce607685278ef1caa88232a8966bec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Sep 2022 16:09:12 +0100
+Subject: ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2
+ kernels
+
+From: Tomislav Novak <tnovak@fb.com>
+
+[ Upstream commit 612695bccfdbd52004551308a55bae410e7cd22f ]
+
+Store the frame address where arm_get_current_stackframe() looks for it
+(ARM_r7 instead of ARM_fp if CONFIG_THUMB2_KERNEL=y). Otherwise frame->fp
+gets set to 0, causing unwind_frame() to fail.
+
+ # bpftrace -e 't:sched:sched_switch { @[kstack] = count(); exit(); }'
+ Attaching 1 probe...
+ @[
+ __schedule+1059
+ ]: 1
+
+A typical first unwind instruction is 0x97 (SP = R7), so after executing
+it SP ends up being 0 and -URC_FAILURE is returned.
+
+ unwind_frame(pc = ac9da7d7 lr = 00000000 sp = c69bdda0 fp = 00000000)
+ unwind_find_idx(ac9da7d7)
+ unwind_exec_insn: insn = 00000097
+ unwind_exec_insn: fp = 00000000 sp = 00000000 lr = 00000000 pc = 00000000
+
+With this patch:
+
+ # bpftrace -e 't:sched:sched_switch { @[kstack] = count(); exit(); }'
+ Attaching 1 probe...
+ @[
+ __schedule+1059
+ __schedule+1059
+ schedule+79
+ schedule_hrtimeout_range_clock+163
+ schedule_hrtimeout_range+17
+ ep_poll+471
+ SyS_epoll_wait+111
+ sys_epoll_pwait+231
+ __ret_fast_syscall+1
+ ]: 1
+
+Link: https://lore.kernel.org/r/20220920230728.2617421-1-tnovak@fb.com/
+
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Tomislav Novak <tnovak@fb.com>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/perf_event.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/include/asm/perf_event.h b/arch/arm/include/asm/perf_event.h
+index fe87397c3d8c..bdbc1e590891 100644
+--- a/arch/arm/include/asm/perf_event.h
++++ b/arch/arm/include/asm/perf_event.h
+@@ -17,7 +17,7 @@ extern unsigned long perf_misc_flags(struct pt_regs *regs);
+
+ #define perf_arch_fetch_caller_regs(regs, __ip) { \
+ (regs)->ARM_pc = (__ip); \
+- (regs)->ARM_fp = (unsigned long) __builtin_frame_address(0); \
++ frame_pointer((regs)) = (unsigned long) __builtin_frame_address(0); \
+ (regs)->ARM_sp = current_stack_pointer; \
+ (regs)->ARM_cpsr = SVC_MODE; \
+ }
+--
+2.35.1
+
--- /dev/null
+From 859cc79f36c6f2b8d7d867d67a785a28823b06f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Nov 2022 21:46:18 +0100
+Subject: ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation
+
+From: Giulio Benetti <giulio.benetti@benettiengineering.com>
+
+[ Upstream commit 340a982825f76f1cff0daa605970fe47321b5ee7 ]
+
+Actually in no-MMU SoCs(i.e. i.MXRT) ZERO_PAGE(vaddr) expands to
+```
+virt_to_page(0)
+```
+that in order expands to:
+```
+pfn_to_page(virt_to_pfn(0))
+```
+and then virt_to_pfn(0) to:
+```
+ ((((unsigned long)(0) - PAGE_OFFSET) >> PAGE_SHIFT) +
+ PHYS_PFN_OFFSET)
+```
+where PAGE_OFFSET and PHYS_PFN_OFFSET are the DRAM offset(0x80000000) and
+PAGE_SHIFT is 12. This way we obtain 16MB(0x01000000) summed to the base of
+DRAM(0x80000000).
+When ZERO_PAGE(0) is then used, for example in bio_add_page(), the page
+gets an address that is out of DRAM bounds.
+So instead of using fake virtual page 0 let's allocate a dedicated
+zero_page during paging_init() and assign it to a global 'struct page *
+empty_zero_page' the same way mmu.c does and it's the same approach used
+in m68k with commit dc068f462179 as discussed here[0]. Then let's move
+ZERO_PAGE() definition to the top of pgtable.h to be in common between
+mmu.c and nommu.c.
+
+[0]: https://lore.kernel.org/linux-m68k/2a462b23-5b8e-bbf4-ec7d-778434a3b9d7@google.com/T/#m1266ceb63
+ad140743174d6b3070364d3c9a5179b
+
+Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/pgtable-nommu.h | 6 ------
+ arch/arm/include/asm/pgtable.h | 16 +++++++++-------
+ arch/arm/mm/nommu.c | 19 +++++++++++++++++++
+ 3 files changed, 28 insertions(+), 13 deletions(-)
+
+diff --git a/arch/arm/include/asm/pgtable-nommu.h b/arch/arm/include/asm/pgtable-nommu.h
+index d16aba48fa0a..090011394477 100644
+--- a/arch/arm/include/asm/pgtable-nommu.h
++++ b/arch/arm/include/asm/pgtable-nommu.h
+@@ -44,12 +44,6 @@
+
+ typedef pte_t *pte_addr_t;
+
+-/*
+- * ZERO_PAGE is a global shared page that is always zero: used
+- * for zero-mapped memory areas etc..
+- */
+-#define ZERO_PAGE(vaddr) (virt_to_page(0))
+-
+ /*
+ * Mark the prot value as uncacheable and unbufferable.
+ */
+diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
+index 78a532068fec..ef48a55e9af8 100644
+--- a/arch/arm/include/asm/pgtable.h
++++ b/arch/arm/include/asm/pgtable.h
+@@ -10,6 +10,15 @@
+ #include <linux/const.h>
+ #include <asm/proc-fns.h>
+
++#ifndef __ASSEMBLY__
++/*
++ * ZERO_PAGE is a global shared page that is always zero: used
++ * for zero-mapped memory areas etc..
++ */
++extern struct page *empty_zero_page;
++#define ZERO_PAGE(vaddr) (empty_zero_page)
++#endif
++
+ #ifndef CONFIG_MMU
+
+ #include <asm-generic/pgtable-nopud.h>
+@@ -139,13 +148,6 @@ extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
+ */
+
+ #ifndef __ASSEMBLY__
+-/*
+- * ZERO_PAGE is a global shared page that is always zero: used
+- * for zero-mapped memory areas etc..
+- */
+-extern struct page *empty_zero_page;
+-#define ZERO_PAGE(vaddr) (empty_zero_page)
+-
+
+ extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
+
+diff --git a/arch/arm/mm/nommu.c b/arch/arm/mm/nommu.c
+index c42debaded95..c1494a4dee25 100644
+--- a/arch/arm/mm/nommu.c
++++ b/arch/arm/mm/nommu.c
+@@ -26,6 +26,13 @@
+
+ unsigned long vectors_base;
+
++/*
++ * empty_zero_page is a special page that is used for
++ * zero-initialized data and COW.
++ */
++struct page *empty_zero_page;
++EXPORT_SYMBOL(empty_zero_page);
++
+ #ifdef CONFIG_ARM_MPU
+ struct mpu_rgn_info mpu_rgn_info;
+ #endif
+@@ -148,9 +155,21 @@ void __init adjust_lowmem_bounds(void)
+ */
+ void __init paging_init(const struct machine_desc *mdesc)
+ {
++ void *zero_page;
++
+ early_trap_init((void *)vectors_base);
+ mpu_setup();
++
++ /* allocate the zero page. */
++ zero_page = memblock_alloc(PAGE_SIZE, PAGE_SIZE);
++ if (!zero_page)
++ panic("%s: Failed to allocate %lu bytes align=0x%lx\n",
++ __func__, PAGE_SIZE, PAGE_SIZE);
++
+ bootmem_init();
++
++ empty_zero_page = virt_to_page(zero_page);
++ flush_dcache_page(empty_zero_page);
+ }
+
+ /*
+--
+2.35.1
+
--- /dev/null
+From 26af365c554b51b922e108e7fc6970d8659e57f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Oct 2022 21:56:29 +0100
+Subject: ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188
+
+From: Johan Jonker <jbx6244@gmail.com>
+
+[ Upstream commit da74858a475782a3f16470907814c8cc5950ad68 ]
+
+The clock source and the sched_clock provided by the arm_global_timer
+on Rockchip rk3066a/rk3188 are quite unstable because their rates
+depend on the CPU frequency.
+
+Recent changes to the arm_global_timer driver makes it impossible to use.
+
+On the other side, the arm_global_timer has a higher rating than the
+ROCKCHIP_TIMER, it will be selected by default by the time framework
+while we want to use the stable Rockchip clock source.
+
+Keep the arm_global_timer disabled in order to have the
+DW_APB_TIMER (rk3066a) or ROCKCHIP_TIMER (rk3188) selected by default.
+
+Signed-off-by: Johan Jonker <jbx6244@gmail.com>
+Link: https://lore.kernel.org/r/f275ca8d-fd0a-26e5-b978-b7f3df815e0a@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3188.dtsi | 1 -
+ arch/arm/boot/dts/rk3xxx.dtsi | 7 +++++++
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/rk3188.dtsi b/arch/arm/boot/dts/rk3188.dtsi
+index b8f34bef0efa..44b54af0bbf9 100644
+--- a/arch/arm/boot/dts/rk3188.dtsi
++++ b/arch/arm/boot/dts/rk3188.dtsi
+@@ -607,7 +607,6 @@
+
+ &global_timer {
+ interrupts = <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>;
+- status = "disabled";
+ };
+
+ &local_timer {
+diff --git a/arch/arm/boot/dts/rk3xxx.dtsi b/arch/arm/boot/dts/rk3xxx.dtsi
+index 616a828e0c6e..17e89d30de78 100644
+--- a/arch/arm/boot/dts/rk3xxx.dtsi
++++ b/arch/arm/boot/dts/rk3xxx.dtsi
+@@ -76,6 +76,13 @@
+ reg = <0x1013c200 0x20>;
+ interrupts = <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(2) | IRQ_TYPE_EDGE_RISING)>;
+ clocks = <&cru CORE_PERI>;
++ status = "disabled";
++ /* The clock source and the sched_clock provided by the arm_global_timer
++ * on Rockchip rk3066a/rk3188 are quite unstable because their rates
++ * depend on the CPU frequency.
++ * Keep the arm_global_timer disabled in order to have the
++ * DW_APB_TIMER (rk3066a) or ROCKCHIP_TIMER (rk3188) selected by default.
++ */
+ };
+
+ local_timer: local-timer@1013c600 {
+--
+2.35.1
+
--- /dev/null
+From 0d1b0e73ea7c21372c1c97b453aabb739063a1a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Oct 2022 10:37:32 +0200
+Subject: ARM: dts: rockchip: fix adc-keys sub node names
+
+From: Johan Jonker <jbx6244@gmail.com>
+
+[ Upstream commit 942b35de22efeb4f9ded83f1ea7747f3fe5a3bb2 ]
+
+Fix adc-keys sub node names on Rockchip boards,
+so that they match with regex: '^button-'
+
+Signed-off-by: Johan Jonker <jbx6244@gmail.com>
+Link: https://lore.kernel.org/r/7a0013b1-3a55-a344-e9ea-eacb4b49433c@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3066a-mk808.dts | 2 +-
+ arch/arm/boot/dts/rk3288-evb.dtsi | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/rk3066a-mk808.dts b/arch/arm/boot/dts/rk3066a-mk808.dts
+index cfa318a506eb..2db5ba706208 100644
+--- a/arch/arm/boot/dts/rk3066a-mk808.dts
++++ b/arch/arm/boot/dts/rk3066a-mk808.dts
+@@ -32,7 +32,7 @@
+ keyup-threshold-microvolt = <2500000>;
+ poll-interval = <100>;
+
+- recovery {
++ button-recovery {
+ label = "recovery";
+ linux,code = <KEY_VENDOR>;
+ press-threshold-microvolt = <0>;
+diff --git a/arch/arm/boot/dts/rk3288-evb.dtsi b/arch/arm/boot/dts/rk3288-evb.dtsi
+index 399d6b9c5fd4..382d2839cf47 100644
+--- a/arch/arm/boot/dts/rk3288-evb.dtsi
++++ b/arch/arm/boot/dts/rk3288-evb.dtsi
+@@ -28,19 +28,19 @@
+ press-threshold-microvolt = <300000>;
+ };
+
+- menu {
++ button-menu {
+ label = "Menu";
+ linux,code = <KEY_MENU>;
+ press-threshold-microvolt = <640000>;
+ };
+
+- esc {
++ button-esc {
+ label = "Esc";
+ linux,code = <KEY_ESC>;
+ press-threshold-microvolt = <1000000>;
+ };
+
+- home {
++ button-home {
+ label = "Home";
+ linux,code = <KEY_HOME>;
+ press-threshold-microvolt = <1300000>;
+--
+2.35.1
+
--- /dev/null
+From 035e044db6316c4cc8d529de80695cee88c73b2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Oct 2022 10:58:22 +0200
+Subject: ARM: dts: rockchip: fix ir-receiver node names
+
+From: Johan Jonker <jbx6244@gmail.com>
+
+[ Upstream commit dd847fe34cdf1e89afed1af24986359f13082bfb ]
+
+Fix ir-receiver node names on Rockchip boards,
+so that they match with regex: '^ir(-receiver)?(@[a-f0-9]+)?$'
+
+Signed-off-by: Johan Jonker <jbx6244@gmail.com>
+Link: https://lore.kernel.org/r/ea5af279-f44c-afea-023d-bb37f5a0d58d@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3188-radxarock.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/rk3188-radxarock.dts b/arch/arm/boot/dts/rk3188-radxarock.dts
+index a9ed3cd2c2da..239d2ec37fdc 100644
+--- a/arch/arm/boot/dts/rk3188-radxarock.dts
++++ b/arch/arm/boot/dts/rk3188-radxarock.dts
+@@ -71,7 +71,7 @@
+ #sound-dai-cells = <0>;
+ };
+
+- ir_recv: gpio-ir-receiver {
++ ir_recv: ir-receiver {
+ compatible = "gpio-ir-receiver";
+ gpios = <&gpio0 RK_PB2 GPIO_ACTIVE_LOW>;
+ pinctrl-names = "default";
+--
+2.35.1
+
--- /dev/null
+From e781e2b017c187d72dd639ecbda305d39ffd2b93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Oct 2022 18:55:46 +0200
+Subject: arm: dts: rockchip: fix node name for hym8563 rtc
+
+From: Sebastian Reichel <sebastian.reichel@collabora.com>
+
+[ Upstream commit 17b57beafccb4569accbfc8c11390744cf59c021 ]
+
+Fix the node name for hym8563 in all arm rockchip devicetrees.
+
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Link: https://lore.kernel.org/r/20221024165549.74574-4-sebastian.reichel@collabora.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3036-evb.dts | 2 +-
+ arch/arm/boot/dts/rk3288-evb-act8846.dts | 2 +-
+ arch/arm/boot/dts/rk3288-firefly.dtsi | 2 +-
+ arch/arm/boot/dts/rk3288-miqi.dts | 2 +-
+ arch/arm/boot/dts/rk3288-rock2-square.dts | 2 +-
+ 5 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/rk3036-evb.dts b/arch/arm/boot/dts/rk3036-evb.dts
+index 2a7e6624efb9..ea23ba98625e 100644
+--- a/arch/arm/boot/dts/rk3036-evb.dts
++++ b/arch/arm/boot/dts/rk3036-evb.dts
+@@ -31,7 +31,7 @@
+ &i2c1 {
+ status = "okay";
+
+- hym8563: hym8563@51 {
++ hym8563: rtc@51 {
+ compatible = "haoyu,hym8563";
+ reg = <0x51>;
+ #clock-cells = <0>;
+diff --git a/arch/arm/boot/dts/rk3288-evb-act8846.dts b/arch/arm/boot/dts/rk3288-evb-act8846.dts
+index be695b8c1f67..8a635c243127 100644
+--- a/arch/arm/boot/dts/rk3288-evb-act8846.dts
++++ b/arch/arm/boot/dts/rk3288-evb-act8846.dts
+@@ -54,7 +54,7 @@
+ vin-supply = <&vcc_sys>;
+ };
+
+- hym8563@51 {
++ rtc@51 {
+ compatible = "haoyu,hym8563";
+ reg = <0x51>;
+
+diff --git a/arch/arm/boot/dts/rk3288-firefly.dtsi b/arch/arm/boot/dts/rk3288-firefly.dtsi
+index 052afe5543e2..9267857beccb 100644
+--- a/arch/arm/boot/dts/rk3288-firefly.dtsi
++++ b/arch/arm/boot/dts/rk3288-firefly.dtsi
+@@ -233,7 +233,7 @@
+ vin-supply = <&vcc_sys>;
+ };
+
+- hym8563: hym8563@51 {
++ hym8563: rtc@51 {
+ compatible = "haoyu,hym8563";
+ reg = <0x51>;
+ #clock-cells = <0>;
+diff --git a/arch/arm/boot/dts/rk3288-miqi.dts b/arch/arm/boot/dts/rk3288-miqi.dts
+index 713f55e143c6..e3d5644f2915 100644
+--- a/arch/arm/boot/dts/rk3288-miqi.dts
++++ b/arch/arm/boot/dts/rk3288-miqi.dts
+@@ -162,7 +162,7 @@
+ vin-supply = <&vcc_sys>;
+ };
+
+- hym8563: hym8563@51 {
++ hym8563: rtc@51 {
+ compatible = "haoyu,hym8563";
+ reg = <0x51>;
+ #clock-cells = <0>;
+diff --git a/arch/arm/boot/dts/rk3288-rock2-square.dts b/arch/arm/boot/dts/rk3288-rock2-square.dts
+index 80e0f07c8e87..07a3a52753d2 100644
+--- a/arch/arm/boot/dts/rk3288-rock2-square.dts
++++ b/arch/arm/boot/dts/rk3288-rock2-square.dts
+@@ -165,7 +165,7 @@
+ };
+
+ &i2c0 {
+- hym8563: hym8563@51 {
++ hym8563: rtc@51 {
+ compatible = "haoyu,hym8563";
+ reg = <0x51>;
+ #clock-cells = <0>;
+--
+2.35.1
+
--- /dev/null
+From 7b169b6db2766b026157792613f91a3709723818 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Oct 2022 18:55:47 +0200
+Subject: arm: dts: rockchip: remove clock-frequency from rtc
+
+From: Sebastian Reichel <sebastian.reichel@collabora.com>
+
+[ Upstream commit 6122f3be70d90a1b2a1188d8910256fc218376a9 ]
+
+'clock-frequency' is not part of the DT binding and not supported by the
+Linux driver.
+
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Link: https://lore.kernel.org/r/20221024165549.74574-5-sebastian.reichel@collabora.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3036-evb.dts | 1 -
+ arch/arm/boot/dts/rk3288-firefly.dtsi | 1 -
+ arch/arm/boot/dts/rk3288-miqi.dts | 1 -
+ arch/arm/boot/dts/rk3288-rock2-square.dts | 1 -
+ arch/arm/boot/dts/rk3288-vmarc-som.dtsi | 1 -
+ 5 files changed, 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/rk3036-evb.dts b/arch/arm/boot/dts/rk3036-evb.dts
+index ea23ba98625e..94216f870b57 100644
+--- a/arch/arm/boot/dts/rk3036-evb.dts
++++ b/arch/arm/boot/dts/rk3036-evb.dts
+@@ -35,7 +35,6 @@
+ compatible = "haoyu,hym8563";
+ reg = <0x51>;
+ #clock-cells = <0>;
+- clock-frequency = <32768>;
+ clock-output-names = "xin32k";
+ };
+ };
+diff --git a/arch/arm/boot/dts/rk3288-firefly.dtsi b/arch/arm/boot/dts/rk3288-firefly.dtsi
+index 9267857beccb..3836c61cfb76 100644
+--- a/arch/arm/boot/dts/rk3288-firefly.dtsi
++++ b/arch/arm/boot/dts/rk3288-firefly.dtsi
+@@ -237,7 +237,6 @@
+ compatible = "haoyu,hym8563";
+ reg = <0x51>;
+ #clock-cells = <0>;
+- clock-frequency = <32768>;
+ clock-output-names = "xin32k";
+ interrupt-parent = <&gpio7>;
+ interrupts = <RK_PA4 IRQ_TYPE_EDGE_FALLING>;
+diff --git a/arch/arm/boot/dts/rk3288-miqi.dts b/arch/arm/boot/dts/rk3288-miqi.dts
+index e3d5644f2915..db1eb648e0e1 100644
+--- a/arch/arm/boot/dts/rk3288-miqi.dts
++++ b/arch/arm/boot/dts/rk3288-miqi.dts
+@@ -166,7 +166,6 @@
+ compatible = "haoyu,hym8563";
+ reg = <0x51>;
+ #clock-cells = <0>;
+- clock-frequency = <32768>;
+ clock-output-names = "xin32k";
+ };
+
+diff --git a/arch/arm/boot/dts/rk3288-rock2-square.dts b/arch/arm/boot/dts/rk3288-rock2-square.dts
+index 07a3a52753d2..13cfdaa95cc7 100644
+--- a/arch/arm/boot/dts/rk3288-rock2-square.dts
++++ b/arch/arm/boot/dts/rk3288-rock2-square.dts
+@@ -169,7 +169,6 @@
+ compatible = "haoyu,hym8563";
+ reg = <0x51>;
+ #clock-cells = <0>;
+- clock-frequency = <32768>;
+ clock-output-names = "xin32k";
+ interrupt-parent = <&gpio0>;
+ interrupts = <RK_PA4 IRQ_TYPE_EDGE_FALLING>;
+diff --git a/arch/arm/boot/dts/rk3288-vmarc-som.dtsi b/arch/arm/boot/dts/rk3288-vmarc-som.dtsi
+index 0ae2bd150e37..793951655b73 100644
+--- a/arch/arm/boot/dts/rk3288-vmarc-som.dtsi
++++ b/arch/arm/boot/dts/rk3288-vmarc-som.dtsi
+@@ -241,7 +241,6 @@
+ interrupt-parent = <&gpio5>;
+ interrupts = <RK_PC3 IRQ_TYPE_LEVEL_LOW>;
+ #clock-cells = <0>;
+- clock-frequency = <32768>;
+ clock-output-names = "hym8563";
+ pinctrl-names = "default";
+ pinctrl-0 = <&hym8563_int>;
+--
+2.35.1
+
--- /dev/null
+From 55e1533292bd0b2fa2fec8a68193b676bec2cae6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Oct 2022 01:31:37 +0200
+Subject: ARM: dts: rockchip: rk3188: fix lcdc1-rgb24 node name
+
+From: Johan Jonker <jbx6244@gmail.com>
+
+[ Upstream commit 11871e20bcb23c00966e785a124fb72bc8340af4 ]
+
+The lcdc1-rgb24 node name is out of line with the rest
+of the rk3188 lcdc1 node, so fix it.
+
+Signed-off-by: Johan Jonker <jbx6244@gmail.com>
+Link: https://lore.kernel.org/r/7b9c0a6f-626b-07e8-ae74-7e0f08b8d241@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3188.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/rk3188.dtsi b/arch/arm/boot/dts/rk3188.dtsi
+index cdd4a0bd5133..b8f34bef0efa 100644
+--- a/arch/arm/boot/dts/rk3188.dtsi
++++ b/arch/arm/boot/dts/rk3188.dtsi
+@@ -379,7 +379,7 @@
+ rockchip,pins = <2 RK_PD3 1 &pcfg_pull_none>;
+ };
+
+- lcdc1_rgb24: ldcd1-rgb24 {
++ lcdc1_rgb24: lcdc1-rgb24 {
+ rockchip,pins = <2 RK_PA0 1 &pcfg_pull_none>,
+ <2 RK_PA1 1 &pcfg_pull_none>,
+ <2 RK_PA2 1 &pcfg_pull_none>,
+--
+2.35.1
+
--- /dev/null
+From a87240c4f2317fd841852453092d21190b0c7149 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Oct 2022 10:38:35 +0200
+Subject: arm64: dts: rockchip: fix adc-keys sub node names
+
+From: Johan Jonker <jbx6244@gmail.com>
+
+[ Upstream commit f2bd2e76d6ea13e12849975adae46145375532a4 ]
+
+Fix adc-keys sub node names on Rockchip boards,
+so that they match with regex: '^button-'
+
+Signed-off-by: Johan Jonker <jbx6244@gmail.com>
+Link: https://lore.kernel.org/r/6a6a3603-5540-cacc-2672-c015af1ec684@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/px30-evb.dts | 10 +++++-----
+ arch/arm64/boot/dts/rockchip/rk3308-evb.dts | 12 ++++++------
+ arch/arm64/boot/dts/rockchip/rk3318-a95x-z2.dts | 2 +-
+ arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi | 2 +-
+ arch/arm64/boot/dts/rockchip/rk3399-nanopc-t4.dts | 2 +-
+ arch/arm64/boot/dts/rockchip/rk3399-nanopi-m4b.dts | 2 +-
+ arch/arm64/boot/dts/rockchip/rk3399-orangepi.dts | 4 ++--
+ arch/arm64/boot/dts/rockchip/rk3399-roc-pc.dtsi | 2 +-
+ .../boot/dts/rockchip/rk3399-sapphire-excavator.dts | 4 ++--
+ arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi | 2 +-
+ 10 files changed, 21 insertions(+), 21 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/px30-evb.dts b/arch/arm64/boot/dts/rockchip/px30-evb.dts
+index 848bc39cf86a..4249b42843da 100644
+--- a/arch/arm64/boot/dts/rockchip/px30-evb.dts
++++ b/arch/arm64/boot/dts/rockchip/px30-evb.dts
+@@ -30,31 +30,31 @@
+ keyup-threshold-microvolt = <1800000>;
+ poll-interval = <100>;
+
+- esc-key {
++ button-esc {
+ label = "esc";
+ linux,code = <KEY_ESC>;
+ press-threshold-microvolt = <1310000>;
+ };
+
+- home-key {
++ button-home {
+ label = "home";
+ linux,code = <KEY_HOME>;
+ press-threshold-microvolt = <624000>;
+ };
+
+- menu-key {
++ button-menu {
+ label = "menu";
+ linux,code = <KEY_MENU>;
+ press-threshold-microvolt = <987000>;
+ };
+
+- vol-down-key {
++ button-down {
+ label = "volume down";
+ linux,code = <KEY_VOLUMEDOWN>;
+ press-threshold-microvolt = <300000>;
+ };
+
+- vol-up-key {
++ button-up {
+ label = "volume up";
+ linux,code = <KEY_VOLUMEUP>;
+ press-threshold-microvolt = <17000>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3308-evb.dts b/arch/arm64/boot/dts/rockchip/rk3308-evb.dts
+index 9fe9b0d11003..184b84fdde07 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3308-evb.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3308-evb.dts
+@@ -23,7 +23,7 @@
+ poll-interval = <100>;
+ keyup-threshold-microvolt = <1800000>;
+
+- func-key {
++ button-func {
+ linux,code = <KEY_FN>;
+ label = "function";
+ press-threshold-microvolt = <18000>;
+@@ -37,31 +37,31 @@
+ poll-interval = <100>;
+ keyup-threshold-microvolt = <1800000>;
+
+- esc-key {
++ button-esc {
+ linux,code = <KEY_MICMUTE>;
+ label = "micmute";
+ press-threshold-microvolt = <1130000>;
+ };
+
+- home-key {
++ button-home {
+ linux,code = <KEY_MODE>;
+ label = "mode";
+ press-threshold-microvolt = <901000>;
+ };
+
+- menu-key {
++ button-menu {
+ linux,code = <KEY_PLAY>;
+ label = "play";
+ press-threshold-microvolt = <624000>;
+ };
+
+- vol-down-key {
++ button-down {
+ linux,code = <KEY_VOLUMEDOWN>;
+ label = "volume down";
+ press-threshold-microvolt = <300000>;
+ };
+
+- vol-up-key {
++ button-up {
+ linux,code = <KEY_VOLUMEUP>;
+ label = "volume up";
+ press-threshold-microvolt = <18000>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3318-a95x-z2.dts b/arch/arm64/boot/dts/rockchip/rk3318-a95x-z2.dts
+index 43c928ac98f0..1deef53a4c94 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3318-a95x-z2.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3318-a95x-z2.dts
+@@ -25,7 +25,7 @@
+ keyup-threshold-microvolt = <1800000>;
+ poll-interval = <100>;
+
+- recovery {
++ button-recovery {
+ label = "recovery";
+ linux,code = <KEY_VENDOR>;
+ press-threshold-microvolt = <17000>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi
+index 2a332763c35c..9d9297bc5f04 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi
+@@ -123,7 +123,7 @@
+ keyup-threshold-microvolt = <1800000>;
+ poll-interval = <100>;
+
+- recovery {
++ button-recovery {
+ label = "Recovery";
+ linux,code = <KEY_VENDOR>;
+ press-threshold-microvolt = <18000>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-nanopc-t4.dts b/arch/arm64/boot/dts/rockchip/rk3399-nanopc-t4.dts
+index 452728b82e42..3bf8f959e42c 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-nanopc-t4.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-nanopc-t4.dts
+@@ -39,7 +39,7 @@
+ keyup-threshold-microvolt = <1800000>;
+ poll-interval = <100>;
+
+- recovery {
++ button-recovery {
+ label = "Recovery";
+ linux,code = <KEY_VENDOR>;
+ press-threshold-microvolt = <18000>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-nanopi-m4b.dts b/arch/arm64/boot/dts/rockchip/rk3399-nanopi-m4b.dts
+index 72182c58cc46..65cb21837b0c 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-nanopi-m4b.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-nanopi-m4b.dts
+@@ -19,7 +19,7 @@
+ keyup-threshold-microvolt = <1500000>;
+ poll-interval = <100>;
+
+- recovery {
++ button-recovery {
+ label = "Recovery";
+ linux,code = <KEY_VENDOR>;
+ press-threshold-microvolt = <18000>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-orangepi.dts b/arch/arm64/boot/dts/rockchip/rk3399-orangepi.dts
+index 9e2e246e0bab..dba4d03bfc2b 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-orangepi.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-orangepi.dts
+@@ -52,13 +52,13 @@
+ press-threshold-microvolt = <300000>;
+ };
+
+- back {
++ button-back {
+ label = "Back";
+ linux,code = <KEY_BACK>;
+ press-threshold-microvolt = <985000>;
+ };
+
+- menu {
++ button-menu {
+ label = "Menu";
+ linux,code = <KEY_MENU>;
+ press-threshold-microvolt = <1314000>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-roc-pc.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-roc-pc.dtsi
+index acb174d3a8c5..4f3dd107e83e 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-roc-pc.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-roc-pc.dtsi
+@@ -41,7 +41,7 @@
+ keyup-threshold-microvolt = <1500000>;
+ poll-interval = <100>;
+
+- recovery {
++ button-recovery {
+ label = "Recovery";
+ linux,code = <KEY_VENDOR>;
+ press-threshold-microvolt = <18000>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts b/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts
+index 13927e7d0724..dbec2b7173a0 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts
+@@ -33,13 +33,13 @@
+ press-threshold-microvolt = <300000>;
+ };
+
+- back {
++ button-back {
+ label = "Back";
+ linux,code = <KEY_BACK>;
+ press-threshold-microvolt = <985000>;
+ };
+
+- menu {
++ button-menu {
+ label = "Menu";
+ linux,code = <KEY_MENU>;
+ press-threshold-microvolt = <1314000>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi b/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi
+index 0d45868132b9..8d61f824c12d 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3566-pinenote.dtsi
+@@ -23,7 +23,7 @@
+ io-channel-names = "buttons";
+ keyup-threshold-microvolt = <1750000>;
+
+- recovery {
++ button-recovery {
+ label = "recovery";
+ linux,code = <KEY_VENDOR>;
+ press-threshold-microvolt = <0>;
+--
+2.35.1
+
--- /dev/null
+From a4c479583032d5fea7c929a5da2c9fc15f5b150b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Oct 2022 22:01:40 +0300
+Subject: arm64: dts: rockchip: Fix gmac failure of rgmii-id from rk3566-roc-pc
+
+From: Furkan Kardame <f.kardame@manjaro.org>
+
+[ Upstream commit adbab347ec8861aa80d850693df3cd005ec65a99 ]
+
+Lan does not work on rgmii-id, most rk356x devices lan
+is being switched to rgmii.
+
+Signed-off-by: Furkan Kardame <f.kardame@manjaro.org>
+Link: https://lore.kernel.org/r/20221010190142.18340-2-f.kardame@manjaro.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts b/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts
+index 57759b66d44d..8db83088ae4e 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts
+@@ -130,7 +130,7 @@
+ assigned-clocks = <&cru SCLK_GMAC1_RX_TX>, <&cru SCLK_GMAC1_RGMII_SPEED>, <&cru SCLK_GMAC1>;
+ assigned-clock-parents = <&cru SCLK_GMAC1_RGMII_SPEED>, <&cru SCLK_GMAC1>, <&gmac1_clkin>;
+ clock_in_out = "input";
+- phy-mode = "rgmii-id";
++ phy-mode = "rgmii";
+ phy-supply = <&vcc_3v3>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&gmac1m0_miim
+--
+2.35.1
+
--- /dev/null
+From a198dad7814a6a6671673dff5daeb7a32f888958 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Oct 2022 22:01:41 +0300
+Subject: arm64: dts: rockchip: Fix i2c3 pinctrl on rk3566-roc-pc
+
+From: Furkan Kardame <f.kardame@manjaro.org>
+
+[ Upstream commit 2440ad0d851e404adcd1b9ad758f28bd59365bae ]
+
+As per device schematic i2c3 pinctrl is connected to m0 instead of m1
+
+Signed-off-by: Furkan Kardame <f.kardame@manjaro.org>
+Link: https://lore.kernel.org/r/20221010190142.18340-3-f.kardame@manjaro.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts b/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts
+index 8db83088ae4e..b8ed215ab8fb 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts
+@@ -397,7 +397,7 @@
+
+ &i2c3 {
+ pinctrl-names = "default";
+- pinctrl-0 = <&i2c3m1_xfer>;
++ pinctrl-0 = <&i2c3m0_xfer>;
+ status = "okay";
+ };
+
+--
+2.35.1
+
--- /dev/null
+From 056d9cb9cd1d6c1b25af1c29296e8061d262236d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Oct 2022 10:59:10 +0200
+Subject: arm64: dts: rockchip: fix ir-receiver node names
+
+From: Johan Jonker <jbx6244@gmail.com>
+
+[ Upstream commit de0d04b9780a23eb928aedfb6f981285f78d58e5 ]
+
+Fix ir-receiver node names on Rockchip boards,
+so that they match with regex: '^ir(-receiver)?(@[a-f0-9]+)?$'
+
+Signed-off-by: Johan Jonker <jbx6244@gmail.com>
+Link: https://lore.kernel.org/r/e9764253-8ce8-150b-4820-41f03f845469@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts
+index ea6820902ede..7ea48167747c 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3308-roc-cc.dts
+@@ -19,7 +19,7 @@
+ stdout-path = "serial2:1500000n8";
+ };
+
+- ir_rx {
++ ir-receiver {
+ compatible = "gpio-ir-receiver";
+ gpios = <&gpio0 RK_PC0 GPIO_ACTIVE_HIGH>;
+ pinctrl-names = "default";
+--
+2.35.1
+
--- /dev/null
+From 800a002aef4e37d49c7c392659f7b2057ea1f282 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Oct 2022 18:55:44 +0200
+Subject: arm64: dts: rockchip: fix node name for hym8563 rtc
+
+From: Sebastian Reichel <sebastian.reichel@collabora.com>
+
+[ Upstream commit 67a9aeef44e42b1ac2becf5e61eae0880f48d9db ]
+
+Fix the node name for hym8563 in all arm64 rockchip devicetrees.
+
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Link: https://lore.kernel.org/r/20221024165549.74574-2-sebastian.reichel@collabora.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3368-orion-r68-meta.dts | 2 +-
+ arch/arm64/boot/dts/rockchip/rk3368-r88.dts | 2 +-
+ arch/arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts | 2 +-
+ arch/arm64/boot/dts/rockchip/rk3399pro-vmarc-som.dtsi | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3368-orion-r68-meta.dts b/arch/arm64/boot/dts/rockchip/rk3368-orion-r68-meta.dts
+index 7f5bba0c6001..0e88e9592c1c 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3368-orion-r68-meta.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3368-orion-r68-meta.dts
+@@ -208,7 +208,7 @@
+ vin-supply = <&vcc_sys>;
+ };
+
+- hym8563: hym8563@51 {
++ hym8563: rtc@51 {
+ compatible = "haoyu,hym8563";
+ reg = <0x51>;
+ #clock-cells = <0>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3368-r88.dts b/arch/arm64/boot/dts/rockchip/rk3368-r88.dts
+index 38d757c00548..e147d6f8b43e 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3368-r88.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3368-r88.dts
+@@ -192,7 +192,7 @@
+ vin-supply = <&vcc_sys>;
+ };
+
+- hym8563: hym8563@51 {
++ hym8563: rtc@51 {
+ compatible = "haoyu,hym8563";
+ reg = <0x51>;
+ #clock-cells = <0>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts b/arch/arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts
+index 5a2661ae0131..18b5050c6cd3 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-roc-pc-plus.dts
+@@ -98,7 +98,7 @@
+ };
+
+ &i2c0 {
+- hym8563: hym8563@51 {
++ hym8563: rtc@51 {
+ compatible = "haoyu,hym8563";
+ reg = <0x51>;
+ interrupt-parent = <&gpio0>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399pro-vmarc-som.dtsi b/arch/arm64/boot/dts/rockchip/rk3399pro-vmarc-som.dtsi
+index 935b8c68a71d..6c168566321b 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399pro-vmarc-som.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399pro-vmarc-som.dtsi
+@@ -297,7 +297,7 @@
+ clock-frequency = <400000>;
+ status = "okay";
+
+- hym8563: hym8563@51 {
++ hym8563: rtc@51 {
+ compatible = "haoyu,hym8563";
+ reg = <0x51>;
+ #clock-cells = <0>;
+--
+2.35.1
+
--- /dev/null
+From bc2c798b344ac7698731087004b7521ee282dec1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Sep 2022 11:28:12 +0000
+Subject: arm64: dts: rockchip: keep I2S1 disabled for GPIO function on ROCK Pi
+ 4 series
+
+From: FUKAUMI Naoki <naoki@radxa.com>
+
+[ Upstream commit 849c19d14940b87332d5d59c7fc581d73f2099fd ]
+
+I2S1 pins are exposed on 40-pin header on Radxa ROCK Pi 4 series.
+their default function is GPIO, so I2S1 need to be disabled.
+
+Signed-off-by: FUKAUMI Naoki <naoki@radxa.com>
+Link: https://lore.kernel.org/r/20220924112812.1219-1-naoki@radxa.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
+index 401e1ae9d944..b045f74071e4 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
+@@ -491,7 +491,6 @@
+ &i2s1 {
+ rockchip,playback-channels = <2>;
+ rockchip,capture-channels = <2>;
+- status = "okay";
+ };
+
+ &i2s2 {
+--
+2.35.1
+
--- /dev/null
+From 03df4a3b8f241f71dd985efa3b78768953d1c050 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Oct 2022 22:01:42 +0300
+Subject: arm64: dts: rockchip: remove i2c5 from rk3566-roc-pc
+
+From: Furkan Kardame <f.kardame@manjaro.org>
+
+[ Upstream commit b44bc59d0d279fa4f3dc11b895f2c8f77719885d ]
+
+i2c5 is owned by hdmi port
+
+Signed-off-by: Furkan Kardame <f.kardame@manjaro.org>
+Link: https://lore.kernel.org/r/20221010190142.18340-4-f.kardame@manjaro.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts b/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts
+index b8ed215ab8fb..ab1abf0bb749 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3566-roc-pc.dts
+@@ -401,10 +401,6 @@
+ status = "okay";
+ };
+
+-&i2c5 {
+- status = "okay";
+-};
+-
+ &mdio1 {
+ rgmii_phy1: ethernet-phy@0 {
+ compatible = "ethernet-phy-ieee802.3-c22";
+--
+2.35.1
+
--- /dev/null
+From f7d1a3b5c6654217f5f93578d4fceb4d62073964 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Nov 2022 17:03:18 +0800
+Subject: ASoC: rt711-sdca: fix the latency time of clock stop prepare state
+ machine transitions
+
+From: Shuming Fan <shumingf@realtek.com>
+
+[ Upstream commit c7d7d4e7bb1290cc473610b0bb96d9fa606d00e7 ]
+
+Due to the hardware behavior, it takes some time for CBJ detection/impedance sensing/de-bounce.
+The ClockStop_NotFinished flag will be raised until these functions are completed.
+In ClockStopMode0 mode case, the SdW controller might check this flag from D3 to D0 when the
+jack detection interrupt happened.
+
+Signed-off-by: Shuming Fan <shumingf@realtek.com>
+Link: https://lore.kernel.org/r/20221116090318.5017-1-shumingf@realtek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt711-sdca-sdw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/rt711-sdca-sdw.c b/sound/soc/codecs/rt711-sdca-sdw.c
+index a085b2f530aa..31e77d462ef3 100644
+--- a/sound/soc/codecs/rt711-sdca-sdw.c
++++ b/sound/soc/codecs/rt711-sdca-sdw.c
+@@ -230,7 +230,7 @@ static int rt711_sdca_read_prop(struct sdw_slave *slave)
+ }
+
+ /* set the timeout values */
+- prop->clk_stop_timeout = 20;
++ prop->clk_stop_timeout = 700;
+
+ /* wake-up event */
+ prop->wake_capable = 1;
+--
+2.35.1
+
--- /dev/null
+From 48404b3e9309975c8c86026c1af2d428caeb4689 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Nov 2022 12:01:13 +0530
+Subject: ASoC: soc-pcm: Add NULL check in BE reparenting
+
+From: Srinivasa Rao Mandadapu <quic_srivasam@quicinc.com>
+
+[ Upstream commit db8f91d424fe0ea6db337aca8bc05908bbce1498 ]
+
+Add NULL check in dpcm_be_reparent API, to handle
+kernel NULL pointer dereference error.
+The issue occurred in fuzzing test.
+
+Signed-off-by: Srinivasa Rao Mandadapu <quic_srivasam@quicinc.com>
+Link: https://lore.kernel.org/r/1669098673-29703-1-git-send-email-quic_srivasam@quicinc.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-pcm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index f6a996f0f9c7..f000a7168afc 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -1242,6 +1242,8 @@ static void dpcm_be_reparent(struct snd_soc_pcm_runtime *fe,
+ return;
+
+ be_substream = snd_soc_dpcm_get_substream(be, stream);
++ if (!be_substream)
++ return;
+
+ for_each_dpcm_fe(be, stream, dpcm) {
+ if (dpcm->fe == fe)
+--
+2.35.1
+
--- /dev/null
+From 3f009a610fc78016ced546918f88c47d6733be11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Nov 2022 20:13:54 +0800
+Subject: ASoC: wm8962: Wait for updated value of WM8962_CLOCKING1 register
+
+From: Chancel Liu <chancel.liu@nxp.com>
+
+[ Upstream commit 3ca507bf99611c82dafced73e921c1b10ee12869 ]
+
+DSPCLK_DIV field in WM8962_CLOCKING1 register is used to generate
+correct frequency of LRCLK and BCLK. Sometimes the read-only value
+can't be updated timely after enabling SYSCLK. This results in wrong
+calculation values. Delay is introduced here to wait for newest value
+from register. The time of the delay should be at least 500~1000us
+according to test.
+
+Signed-off-by: Chancel Liu <chancel.liu@nxp.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20221109121354.123958-1-chancel.liu@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8962.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index 6df06fba4377..ee1cad5af535 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -2503,6 +2503,14 @@ static void wm8962_configure_bclk(struct snd_soc_component *component)
+ snd_soc_component_update_bits(component, WM8962_CLOCKING2,
+ WM8962_SYSCLK_ENA_MASK, WM8962_SYSCLK_ENA);
+
++ /* DSPCLK_DIV field in WM8962_CLOCKING1 register is used to generate
++ * correct frequency of LRCLK and BCLK. Sometimes the read-only value
++ * can't be updated timely after enabling SYSCLK. This results in wrong
++ * calculation values. Delay is introduced here to wait for newest
++ * value from register. The time of the delay should be at least
++ * 500~1000us according to test.
++ */
++ usleep_range(500, 1000);
+ dspclk = snd_soc_component_read(component, WM8962_CLOCKING1);
+
+ if (snd_soc_component_get_bias_level(component) != SND_SOC_BIAS_ON)
+--
+2.35.1
+
--- /dev/null
+From b85137aa42a24d287986bc2b7bf4b416d00549d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Nov 2022 16:29:44 +0000
+Subject: btrfs: send: avoid unaligned encoded writes when attempting to clone
+ range
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit a11452a3709e217492798cf3686ac2cc8eb3fb51 ]
+
+When trying to see if we can clone a file range, there are cases where we
+end up sending two write operations in case the inode from the source root
+has an i_size that is not sector size aligned and the length from the
+current offset to its i_size is less than the remaining length we are
+trying to clone.
+
+Issuing two write operations when we could instead issue a single write
+operation is not incorrect. However it is not optimal, specially if the
+extents are compressed and the flag BTRFS_SEND_FLAG_COMPRESSED was passed
+to the send ioctl. In that case we can end up sending an encoded write
+with an offset that is not sector size aligned, which makes the receiver
+fallback to decompressing the data and writing it using regular buffered
+IO (so re-compressing the data in case the fs is mounted with compression
+enabled), because encoded writes fail with -EINVAL when an offset is not
+sector size aligned.
+
+The following example, which triggered a bug in the receiver code for the
+fallback logic of decompressing + regular buffer IO and is fixed by the
+patchset referred in a Link at the bottom of this changelog, is an example
+where we have the non-optimal behaviour due to an unaligned encoded write:
+
+ $ cat test.sh
+ #!/bin/bash
+
+ DEV=/dev/sdj
+ MNT=/mnt/sdj
+
+ mkfs.btrfs -f $DEV > /dev/null
+ mount -o compress $DEV $MNT
+
+ # File foo has a size of 33K, not aligned to the sector size.
+ xfs_io -f -c "pwrite -S 0xab 0 33K" $MNT/foo
+
+ xfs_io -f -c "pwrite -S 0xcd 0 64K" $MNT/bar
+
+ # Now clone the first 32K of file bar into foo at offset 0.
+ xfs_io -c "reflink $MNT/bar 0 0 32K" $MNT/foo
+
+ # Snapshot the default subvolume and create a full send stream (v2).
+ btrfs subvolume snapshot -r $MNT $MNT/snap
+
+ btrfs send --compressed-data -f /tmp/test.send $MNT/snap
+
+ echo -e "\nFile bar in the original filesystem:"
+ od -A d -t x1 $MNT/snap/bar
+
+ umount $MNT
+ mkfs.btrfs -f $DEV > /dev/null
+ mount $DEV $MNT
+
+ echo -e "\nReceiving stream in a new filesystem..."
+ btrfs receive -f /tmp/test.send $MNT
+
+ echo -e "\nFile bar in the new filesystem:"
+ od -A d -t x1 $MNT/snap/bar
+
+ umount $MNT
+
+Before this patch, the send stream included one regular write and one
+encoded write for file 'bar', with the later being not sector size aligned
+and causing the receiver to fallback to decompression + buffered writes.
+The output of the btrfs receive command in verbose mode (-vvv):
+
+ (...)
+ mkfile o258-7-0
+ rename o258-7-0 -> bar
+ utimes
+ clone bar - source=foo source offset=0 offset=0 length=32768
+ write bar - offset=32768 length=1024
+ encoded_write bar - offset=33792, len=4096, unencoded_offset=33792, unencoded_file_len=31744, unencoded_len=65536, compression=1, encryption=0
+ encoded_write bar - falling back to decompress and write due to errno 22 ("Invalid argument")
+ (...)
+
+This patch avoids the regular write followed by an unaligned encoded write
+so that we end up sending a single encoded write that is aligned. So after
+this patch the stream content is (output of btrfs receive -vvv):
+
+ (...)
+ mkfile o258-7-0
+ rename o258-7-0 -> bar
+ utimes
+ clone bar - source=foo source offset=0 offset=0 length=32768
+ encoded_write bar - offset=32768, len=4096, unencoded_offset=32768, unencoded_file_len=32768, unencoded_len=65536, compression=1, encryption=0
+ (...)
+
+So we get more optimal behaviour and avoid the silent data loss bug in
+versions of btrfs-progs affected by the bug referred by the Link tag
+below (btrfs-progs v5.19, v5.19.1, v6.0 and v6.0.1).
+
+Link: https://lore.kernel.org/linux-btrfs/cover.1668529099.git.fdmanana@suse.com/
+Reviewed-by: Boris Burkov <boris@bur.io>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/send.c | 24 +++++++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
+index e7671afcee4f..8cc038460bed 100644
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -5615,6 +5615,7 @@ static int clone_range(struct send_ctx *sctx, struct btrfs_path *dst_path,
+ u64 ext_len;
+ u64 clone_len;
+ u64 clone_data_offset;
++ bool crossed_src_i_size = false;
+
+ if (slot >= btrfs_header_nritems(leaf)) {
+ ret = btrfs_next_leaf(clone_root->root, path);
+@@ -5672,8 +5673,10 @@ static int clone_range(struct send_ctx *sctx, struct btrfs_path *dst_path,
+ if (key.offset >= clone_src_i_size)
+ break;
+
+- if (key.offset + ext_len > clone_src_i_size)
++ if (key.offset + ext_len > clone_src_i_size) {
+ ext_len = clone_src_i_size - key.offset;
++ crossed_src_i_size = true;
++ }
+
+ clone_data_offset = btrfs_file_extent_offset(leaf, ei);
+ if (btrfs_file_extent_disk_bytenr(leaf, ei) == disk_byte) {
+@@ -5734,6 +5737,25 @@ static int clone_range(struct send_ctx *sctx, struct btrfs_path *dst_path,
+ ret = send_clone(sctx, offset, clone_len,
+ clone_root);
+ }
++ } else if (crossed_src_i_size && clone_len < len) {
++ /*
++ * If we are at i_size of the clone source inode and we
++ * can not clone from it, terminate the loop. This is
++ * to avoid sending two write operations, one with a
++ * length matching clone_len and the final one after
++ * this loop with a length of len - clone_len.
++ *
++ * When using encoded writes (BTRFS_SEND_FLAG_COMPRESSED
++ * was passed to the send ioctl), this helps avoid
++ * sending an encoded write for an offset that is not
++ * sector size aligned, in case the i_size of the source
++ * inode is not sector size aligned. That will make the
++ * receiver fallback to decompression of the data and
++ * writing it using regular buffered IO, therefore while
++ * not incorrect, it's not optimal due decompression and
++ * possible re-compression at the receiver.
++ */
++ break;
+ } else {
+ ret = send_extent_data(sctx, dst_path, offset,
+ clone_len);
+--
+2.35.1
+
--- /dev/null
+From 0db59ee0bef2dee52c0186a98758a522e0f1d820 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Aug 2022 01:49:15 +0300
+Subject: crypto: ccp - Add a quirk to firmware update
+
+From: Jarkko Sakkinen <jarkko@profian.com>
+
+[ Upstream commit b3b9fdf1a9be4266b01a2063b1f37cdc20806e3b ]
+
+A quirk for fixing the committed TCB version, when upgrading from a
+firmware version earlier than 1.50. This is a known issue, and the
+documented workaround is to load the firmware twice.
+
+Currently, this issue requires the following workaround:
+
+sudo modprobe -r kvm_amd
+sudo modprobe -r ccp
+sudo modprobe ccp
+sudo modprobe kvm_amd
+
+Implement this workaround inside kernel by checking whether the API
+version is less than 1.50, and if so, download the firmware twice.
+This addresses the TCB version issue.
+
+Link: https://lore.kernel.org/all/de02389f-249d-f565-1136-4af3655fab2a@profian.com/
+Reported-by: Harald Hoyer <harald@profian.com>
+Signed-off-by: Jarkko Sakkinen <jarkko@profian.com>
+Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/sev-dev.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
+index 6c49e6d06114..034a74196a82 100644
+--- a/drivers/crypto/ccp/sev-dev.c
++++ b/drivers/crypto/ccp/sev-dev.c
+@@ -748,6 +748,11 @@ static int sev_update_firmware(struct device *dev)
+ struct page *p;
+ u64 data_size;
+
++ if (!sev_version_greater_or_equal(0, 15)) {
++ dev_dbg(dev, "DOWNLOAD_FIRMWARE not supported\n");
++ return -1;
++ }
++
+ if (sev_get_firmware(dev, &firmware) == -ENOENT) {
+ dev_dbg(dev, "No SEV firmware file present\n");
+ return -1;
+@@ -780,6 +785,14 @@ static int sev_update_firmware(struct device *dev)
+ data->len = firmware->size;
+
+ ret = sev_do_cmd(SEV_CMD_DOWNLOAD_FIRMWARE, data, &error);
++
++ /*
++ * A quirk for fixing the committed TCB version, when upgrading from
++ * earlier firmware version than 1.50.
++ */
++ if (!ret && !sev_version_greater_or_equal(1, 50))
++ ret = sev_do_cmd(SEV_CMD_DOWNLOAD_FIRMWARE, data, &error);
++
+ if (ret)
+ dev_dbg(dev, "Failed to update SEV firmware: %#x\n", error);
+ else
+@@ -1289,8 +1302,7 @@ void sev_pci_init(void)
+ if (sev_get_api_version())
+ goto err;
+
+- if (sev_version_greater_or_equal(0, 15) &&
+- sev_update_firmware(sev->dev) == 0)
++ if (sev_update_firmware(sev->dev) == 0)
+ sev_get_api_version();
+
+ /* If an init_ex_path is provided rely on INIT_EX for PSP initialization
+--
+2.35.1
+
--- /dev/null
+From 728d666aed0dc53488c1f1f73a0e223b54e710d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Nov 2022 14:11:00 -0500
+Subject: drm/amd/display: Avoid setting pixel rate divider to N/A
+
+From: Taimur Hassan <Syed.Hassan@amd.com>
+
+[ Upstream commit 2a5dd86a69ea5435f1a837bdb7fafcda609a7c91 ]
+
+[Why]
+Pixel rate divider values should never be set to N/A (0xF) as the K1/K2
+field is only 1/2 bits wide.
+
+[How]
+Set valid divider values for virtual and FRL/DP2 cases.
+
+Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
+Acked-by: Brian Chang <Brian.Chang@amd.com>
+Signed-off-by: Taimur Hassan <Syed.Hassan@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c | 7 +++++++
+ drivers/gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.c | 3 ++-
+ drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.c | 4 +++-
+ drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c | 1 +
+ 4 files changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c
+index fb729674953b..de9fa534b77a 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c
+@@ -96,6 +96,13 @@ static void dccg314_set_pixel_rate_div(
+ struct dcn_dccg *dccg_dcn = TO_DCN_DCCG(dccg);
+ enum pixel_rate_div cur_k1 = PIXEL_RATE_DIV_NA, cur_k2 = PIXEL_RATE_DIV_NA;
+
++ // Don't program 0xF into the register field. Not valid since
++ // K1 / K2 field is only 1 / 2 bits wide
++ if (k1 == PIXEL_RATE_DIV_NA || k2 == PIXEL_RATE_DIV_NA) {
++ BREAK_TO_DEBUGGER();
++ return;
++ }
++
+ dccg314_get_pixel_rate_div(dccg, otg_inst, &cur_k1, &cur_k2);
+ if (k1 == PIXEL_RATE_DIV_NA || k2 == PIXEL_RATE_DIV_NA || (k1 == cur_k1 && k2 == cur_k2))
+ return;
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.c
+index f4d1b83979fe..a0741794db62 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_hwseq.c
+@@ -349,6 +349,7 @@ unsigned int dcn314_calculate_dccg_k1_k2_values(struct pipe_ctx *pipe_ctx, unsig
+ odm_combine_factor = get_odm_config(pipe_ctx, NULL);
+
+ if (is_dp_128b_132b_signal(pipe_ctx)) {
++ *k1_div = PIXEL_RATE_DIV_BY_1;
+ *k2_div = PIXEL_RATE_DIV_BY_1;
+ } else if (dc_is_hdmi_tmds_signal(pipe_ctx->stream->signal) || dc_is_dvi_signal(pipe_ctx->stream->signal)) {
+ *k1_div = PIXEL_RATE_DIV_BY_1;
+@@ -356,7 +357,7 @@ unsigned int dcn314_calculate_dccg_k1_k2_values(struct pipe_ctx *pipe_ctx, unsig
+ *k2_div = PIXEL_RATE_DIV_BY_2;
+ else
+ *k2_div = PIXEL_RATE_DIV_BY_4;
+- } else if (dc_is_dp_signal(pipe_ctx->stream->signal)) {
++ } else if (dc_is_dp_signal(pipe_ctx->stream->signal) || dc_is_virtual_signal(pipe_ctx->stream->signal)) {
+ if (two_pix_per_container) {
+ *k1_div = PIXEL_RATE_DIV_BY_1;
+ *k2_div = PIXEL_RATE_DIV_BY_2;
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.c
+index 6640d0ac4304..6dd8dadd68a5 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.c
+@@ -96,8 +96,10 @@ static void dccg32_set_pixel_rate_div(
+
+ // Don't program 0xF into the register field. Not valid since
+ // K1 / K2 field is only 1 / 2 bits wide
+- if (k1 == PIXEL_RATE_DIV_NA || k2 == PIXEL_RATE_DIV_NA)
++ if (k1 == PIXEL_RATE_DIV_NA || k2 == PIXEL_RATE_DIV_NA) {
++ BREAK_TO_DEBUGGER();
+ return;
++ }
+
+ dccg32_get_pixel_rate_div(dccg, otg_inst, &cur_k1, &cur_k2);
+ if (k1 == cur_k1 && k2 == cur_k2)
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
+index bbc0bfbec6c4..3128c111c619 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c
+@@ -1171,6 +1171,7 @@ unsigned int dcn32_calculate_dccg_k1_k2_values(struct pipe_ctx *pipe_ctx, unsign
+ odm_combine_factor = get_odm_config(pipe_ctx, NULL);
+
+ if (is_dp_128b_132b_signal(pipe_ctx)) {
++ *k1_div = PIXEL_RATE_DIV_BY_1;
+ *k2_div = PIXEL_RATE_DIV_BY_1;
+ } else if (dc_is_hdmi_tmds_signal(pipe_ctx->stream->signal) || dc_is_dvi_signal(pipe_ctx->stream->signal)) {
+ *k1_div = PIXEL_RATE_DIV_BY_1;
+--
+2.35.1
+
--- /dev/null
+From c2bce682e2150a23eb0eb877b87c56b827299339 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Nov 2022 14:06:58 -0500
+Subject: drm/amd/display: Use new num clk levels struct for max mclk index
+
+From: Dillon Varone <Dillon.Varone@amd.com>
+
+[ Upstream commit e667ee3b0c049bf0c69426879586a2572bb28d26 ]
+
+[WHY?]
+When calculating watermark and dlg values, the max mclk level index and
+associated speed are needed to find the correlated dummy latency value.
+Currently the incorrect index is given due to a clock manager refactor.
+
+[HOW?]
+Use num_memclk_level from num_entries_per_clk struct for getting the correct max
+mem speed.
+
+Reviewed-by: Jun Lei <Jun.Lei@amd.com>
+Acked-by: Brian Chang <Brian.Chang@amd.com>
+Signed-off-by: Dillon Varone <Dillon.Varone@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
+index 2f996fdaa70d..07c56e231b04 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c
+@@ -1803,7 +1803,7 @@ void dcn32_calculate_wm_and_dlg_fpu(struct dc *dc, struct dc_state *context,
+
+ if (context->bw_ctx.dml.vba.DRAMClockChangeSupport[vlevel][maxMpcComb] ==
+ dm_dram_clock_change_unsupported) {
+- int min_dram_speed_mts_offset = dc->clk_mgr->bw_params->clk_table.num_entries - 1;
++ int min_dram_speed_mts_offset = dc->clk_mgr->bw_params->clk_table.num_entries_per_clk.num_memclk_levels - 1;
+
+ min_dram_speed_mts =
+ dc->clk_mgr->bw_params->clk_table.entries[min_dram_speed_mts_offset].memclk_mhz * 16;
+--
+2.35.1
+
--- /dev/null
+From 690e344ff9c5fcba60442f65e4ab11ae89c49be0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Nov 2022 12:13:47 -0500
+Subject: drm/amd/display: Use viewport height for subvp mall allocation size
+
+From: Dillon Varone <Dillon.Varone@amd.com>
+
+[ Upstream commit dd2c028c1395d622df7ddd6837f8ab2dc94008ee ]
+
+[WHY?]
+MALL allocation size depends on the viewport height, not the addressable
+vertical lines, which will not match when scaling.
+
+[HOW?]
+Base MALL allocation size calculations off viewport height.
+
+Reviewed-by: Alvin Lee <Alvin.Lee2@amd.com>
+Reviewed-by: Martin Leung <Martin.Leung@amd.com>
+Acked-by: Brian Chang <Brian.Chang@amd.com>
+Signed-off-by: Dillon Varone <Dillon.Varone@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c
+index 7c37575d69c7..0ef11fb338e9 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource_helpers.c
+@@ -103,7 +103,7 @@ uint32_t dcn32_helper_calculate_num_ways_for_subvp(struct dc *dc, struct dc_stat
+ mall_alloc_width_blk_aligned = full_vp_width_blk_aligned;
+
+ /* mall_alloc_height_blk_aligned_l/c = CEILING(sub_vp_height_l/c - 1, blk_height_l/c) + blk_height_l/c */
+- mall_alloc_height_blk_aligned = (pipe->stream->timing.v_addressable - 1 + mblk_height - 1) /
++ mall_alloc_height_blk_aligned = (pipe->plane_res.scl_data.viewport.height - 1 + mblk_height - 1) /
+ mblk_height * mblk_height + mblk_height;
+
+ /* full_mblk_width_ub_l/c = mall_alloc_width_blk_aligned_l/c;
+--
+2.35.1
+
--- /dev/null
+From ece2880603406e6fbd2531ad6a823db6517e2d08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Nov 2022 17:08:22 +0800
+Subject: drm/amdgpu: fix use-after-free during gpu recovery
+
+From: Stanley.Yang <Stanley.Yang@amd.com>
+
+[ Upstream commit 3cb93f390453cde4d6afda1587aaa00e75e09617 ]
+
+[Why]
+ [ 754.862560] refcount_t: underflow; use-after-free.
+ [ 754.862898] Call Trace:
+ [ 754.862903] <TASK>
+ [ 754.862913] amdgpu_job_free_cb+0xc2/0xe1 [amdgpu]
+ [ 754.863543] drm_sched_main.cold+0x34/0x39 [amd_sched]
+
+[How]
+ The fw_fence may be not init, check whether dma_fence_init
+ is performed before job free
+
+Signed-off-by: Stanley.Yang <Stanley.Yang@amd.com>
+Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+index 3b025aace283..eb4c0523e42d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+@@ -167,7 +167,11 @@ static void amdgpu_job_free_cb(struct drm_sched_job *s_job)
+ amdgpu_sync_free(&job->sync);
+ amdgpu_sync_free(&job->sched_sync);
+
+- dma_fence_put(&job->hw_fence);
++ /* only put the hw fence if has embedded fence */
++ if (!job->hw_fence.ops)
++ kfree(job);
++ else
++ dma_fence_put(&job->hw_fence);
+ }
+
+ void amdgpu_job_free(struct amdgpu_job *job)
+--
+2.35.1
+
--- /dev/null
+From 2963ac9ab0c729c482e21f7e41abed6bfbe3bc2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Nov 2022 20:52:01 +0200
+Subject: drm/i915: Remove non-existent pipes from bigjoiner pipe mask
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+[ Upstream commit 3c1ea6a5f4f55d4e376675dda16945eb5d9bb4de ]
+
+bigjoiner_pipes() doesn't consider that:
+- RKL only has three pipes
+- some pipes may be fused off
+
+This means that intel_atomic_check_bigjoiner() won't reject
+all configurations that would need a non-existent pipe.
+Instead we just keep on rolling witout actually having
+reserved the slave pipe we need.
+
+It's possible that we don't outright explode anywhere due to
+this since eg. for_each_intel_crtc_in_pipe_mask() will only
+walk the crtcs we've registered even though the passed in
+pipe_mask asks for more of them. But clearly the thing won't
+do what is expected of it when the required pipes are not
+present.
+
+Fix the problem by consulting the device info pipe_mask already
+in bigjoiner_pipes().
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221118185201.10469-1-ville.syrjala@linux.intel.com
+Reviewed-by: Arun R Murthy <arun.r.murthy@intel.com>
+(cherry picked from commit f1c87a94a1087a26f41007ee83264033007421b5)
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/display/intel_display.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
+index fc5d94862ef3..d0f20bd0e51a 100644
+--- a/drivers/gpu/drm/i915/display/intel_display.c
++++ b/drivers/gpu/drm/i915/display/intel_display.c
+@@ -3717,12 +3717,16 @@ static bool ilk_get_pipe_config(struct intel_crtc *crtc,
+
+ static u8 bigjoiner_pipes(struct drm_i915_private *i915)
+ {
++ u8 pipes;
++
+ if (DISPLAY_VER(i915) >= 12)
+- return BIT(PIPE_A) | BIT(PIPE_B) | BIT(PIPE_C) | BIT(PIPE_D);
++ pipes = BIT(PIPE_A) | BIT(PIPE_B) | BIT(PIPE_C) | BIT(PIPE_D);
+ else if (DISPLAY_VER(i915) >= 11)
+- return BIT(PIPE_B) | BIT(PIPE_C);
++ pipes = BIT(PIPE_B) | BIT(PIPE_C);
+ else
+- return 0;
++ pipes = 0;
++
++ return pipes & INTEL_INFO(i915)->display.pipe_mask;
+ }
+
+ static bool transcoder_ddi_func_is_enabled(struct drm_i915_private *dev_priv,
+--
+2.35.1
+
--- /dev/null
+From d8c8532ca9ab9c86b3971a1bc65f63b7d8d3f5c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Nov 2022 00:27:58 +0900
+Subject: fbcon: Use kzalloc() in fbcon_prepare_logo()
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit a6a00d7e8ffd78d1cdb7a43f1278f081038c638f ]
+
+A kernel built with syzbot's config file reported that
+
+ scr_memcpyw(q, save, array3_size(logo_lines, new_cols, 2))
+
+causes uninitialized "save" to be copied.
+
+ ----------
+ [drm] Initialized vgem 1.0.0 20120112 for vgem on minor 0
+ [drm] Initialized vkms 1.0.0 20180514 for vkms on minor 1
+ Console: switching to colour frame buffer device 128x48
+ =====================================================
+ BUG: KMSAN: uninit-value in do_update_region+0x4b8/0xba0
+ do_update_region+0x4b8/0xba0
+ update_region+0x40d/0x840
+ fbcon_switch+0x3364/0x35e0
+ redraw_screen+0xae3/0x18a0
+ do_bind_con_driver+0x1cb3/0x1df0
+ do_take_over_console+0x11cb/0x13f0
+ fbcon_fb_registered+0xacc/0xfd0
+ register_framebuffer+0x1179/0x1320
+ __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40
+ drm_fbdev_client_hotplug+0xbea/0xda0
+ drm_fbdev_generic_setup+0x65e/0x9d0
+ vkms_init+0x9f3/0xc76
+ (...snipped...)
+
+ Uninit was stored to memory at:
+ fbcon_prepare_logo+0x143b/0x1940
+ fbcon_init+0x2c1b/0x31c0
+ visual_init+0x3e7/0x820
+ do_bind_con_driver+0x14a4/0x1df0
+ do_take_over_console+0x11cb/0x13f0
+ fbcon_fb_registered+0xacc/0xfd0
+ register_framebuffer+0x1179/0x1320
+ __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40
+ drm_fbdev_client_hotplug+0xbea/0xda0
+ drm_fbdev_generic_setup+0x65e/0x9d0
+ vkms_init+0x9f3/0xc76
+ (...snipped...)
+
+ Uninit was created at:
+ __kmem_cache_alloc_node+0xb69/0x1020
+ __kmalloc+0x379/0x680
+ fbcon_prepare_logo+0x704/0x1940
+ fbcon_init+0x2c1b/0x31c0
+ visual_init+0x3e7/0x820
+ do_bind_con_driver+0x14a4/0x1df0
+ do_take_over_console+0x11cb/0x13f0
+ fbcon_fb_registered+0xacc/0xfd0
+ register_framebuffer+0x1179/0x1320
+ __drm_fb_helper_initial_config_and_unlock+0x23ad/0x2b40
+ drm_fbdev_client_hotplug+0xbea/0xda0
+ drm_fbdev_generic_setup+0x65e/0x9d0
+ vkms_init+0x9f3/0xc76
+ (...snipped...)
+
+ CPU: 2 PID: 1 Comm: swapper/0 Not tainted 6.1.0-rc4-00356-g8f2975c2bb4c #924
+ Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
+ ----------
+
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/cad03d25-0ea0-32c4-8173-fd1895314bce@I-love.SAKURA.ne.jp
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/core/fbcon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
+index 098b62f7b701..c0143d38df83 100644
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -577,7 +577,7 @@ static void fbcon_prepare_logo(struct vc_data *vc, struct fb_info *info,
+ if (scr_readw(r) != vc->vc_video_erase_char)
+ break;
+ if (r != q && new_rows >= rows + logo_lines) {
+- save = kmalloc(array3_size(logo_lines, new_cols, 2),
++ save = kzalloc(array3_size(logo_lines, new_cols, 2),
+ GFP_KERNEL);
+ if (save) {
+ int i = min(cols, new_cols);
+--
+2.35.1
+
--- /dev/null
+From a8487750046d4db36d58938e1b2a4fc805761be9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Oct 2022 18:52:56 +0100
+Subject: fs: use acquire ordering in __fget_light()
+
+From: Jann Horn <jannh@google.com>
+
+[ Upstream commit 7ee47dcfff1835ff75a794d1075b6b5f5462cfed ]
+
+We must prevent the CPU from reordering the files->count read with the
+FD table access like this, on architectures where read-read reordering is
+possible:
+
+ files_lookup_fd_raw()
+ close_fd()
+ put_files_struct()
+ atomic_read(&files->count)
+
+I would like to mark this for stable, but the stable rules explicitly say
+"no theoretical races", and given that the FD table pointer and
+files->count are explicitly stored in the same cacheline, this sort of
+reordering seems quite unlikely in practice...
+
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/file.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/fs/file.c b/fs/file.c
+index 3bcc1ecc314a..57af5f8375fd 100644
+--- a/fs/file.c
++++ b/fs/file.c
+@@ -1002,7 +1002,16 @@ static unsigned long __fget_light(unsigned int fd, fmode_t mask)
+ struct files_struct *files = current->files;
+ struct file *file;
+
+- if (atomic_read(&files->count) == 1) {
++ /*
++ * If another thread is concurrently calling close_fd() followed
++ * by put_files_struct(), we must not observe the old table
++ * entry combined with the new refcount - otherwise we could
++ * return a file that is concurrently being freed.
++ *
++ * atomic_read_acquire() pairs with atomic_dec_and_test() in
++ * put_files_struct().
++ */
++ if (atomic_read_acquire(&files->count) == 1) {
+ file = files_lookup_fd_raw(files, fd);
+ if (!file || unlikely(file->f_mode & mask))
+ return 0;
+--
+2.35.1
+
--- /dev/null
+From b6532b09c657f35948fa0f2bb82e15c9bf6e1596 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 13:49:15 +0000
+Subject: fscache: Fix oops due to race with cookie_lru and use_cookie
+
+From: Dave Wysochanski <dwysocha@redhat.com>
+
+[ Upstream commit b5b52de3214a29911f949459a79f6640969b5487 ]
+
+If a cookie expires from the LRU and the LRU_DISCARD flag is set, but
+the state machine has not run yet, it's possible another thread can call
+fscache_use_cookie and begin to use it.
+
+When the cookie_worker finally runs, it will see the LRU_DISCARD flag
+set, transition the cookie->state to LRU_DISCARDING, which will then
+withdraw the cookie. Once the cookie is withdrawn the object is removed
+the below oops will occur because the object associated with the cookie
+is now NULL.
+
+Fix the oops by clearing the LRU_DISCARD bit if another thread uses the
+cookie before the cookie_worker runs.
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000008
+ ...
+ CPU: 31 PID: 44773 Comm: kworker/u130:1 Tainted: G E 6.0.0-5.dneg.x86_64 #1
+ Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
+ Workqueue: events_unbound netfs_rreq_write_to_cache_work [netfs]
+ RIP: 0010:cachefiles_prepare_write+0x28/0x90 [cachefiles]
+ ...
+ Call Trace:
+ netfs_rreq_write_to_cache_work+0x11c/0x320 [netfs]
+ process_one_work+0x217/0x3e0
+ worker_thread+0x4a/0x3b0
+ kthread+0xd6/0x100
+
+Fixes: 12bb21a29c19 ("fscache: Implement cookie user counting and resource pinning")
+Reported-by: Daire Byrne <daire.byrne@gmail.com>
+Signed-off-by: Dave Wysochanski <dwysocha@redhat.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Tested-by: Daire Byrne <daire@dneg.com>
+Link: https://lore.kernel.org/r/20221117115023.1350181-1-dwysocha@redhat.com/ # v1
+Link: https://lore.kernel.org/r/20221117142915.1366990-1-dwysocha@redhat.com/ # v2
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fscache/cookie.c | 8 ++++++++
+ include/trace/events/fscache.h | 2 ++
+ 2 files changed, 10 insertions(+)
+
+diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
+index 451d8a077e12..bce2492186d0 100644
+--- a/fs/fscache/cookie.c
++++ b/fs/fscache/cookie.c
+@@ -605,6 +605,14 @@ void __fscache_use_cookie(struct fscache_cookie *cookie, bool will_modify)
+ set_bit(FSCACHE_COOKIE_DO_PREP_TO_WRITE, &cookie->flags);
+ queue = true;
+ }
++ /*
++ * We could race with cookie_lru which may set LRU_DISCARD bit
++ * but has yet to run the cookie state machine. If this happens
++ * and another thread tries to use the cookie, clear LRU_DISCARD
++ * so we don't end up withdrawing the cookie while in use.
++ */
++ if (test_and_clear_bit(FSCACHE_COOKIE_DO_LRU_DISCARD, &cookie->flags))
++ fscache_see_cookie(cookie, fscache_cookie_see_lru_discard_clear);
+ break;
+
+ case FSCACHE_COOKIE_STATE_FAILED:
+diff --git a/include/trace/events/fscache.h b/include/trace/events/fscache.h
+index c078c48a8e6d..a6190aa1b406 100644
+--- a/include/trace/events/fscache.h
++++ b/include/trace/events/fscache.h
+@@ -66,6 +66,7 @@ enum fscache_cookie_trace {
+ fscache_cookie_put_work,
+ fscache_cookie_see_active,
+ fscache_cookie_see_lru_discard,
++ fscache_cookie_see_lru_discard_clear,
+ fscache_cookie_see_lru_do_one,
+ fscache_cookie_see_relinquish,
+ fscache_cookie_see_withdraw,
+@@ -149,6 +150,7 @@ enum fscache_access_trace {
+ EM(fscache_cookie_put_work, "PQ work ") \
+ EM(fscache_cookie_see_active, "- activ") \
+ EM(fscache_cookie_see_lru_discard, "- x-lru") \
++ EM(fscache_cookie_see_lru_discard_clear,"- lrudc") \
+ EM(fscache_cookie_see_lru_do_one, "- lrudo") \
+ EM(fscache_cookie_see_relinquish, "- x-rlq") \
+ EM(fscache_cookie_see_withdraw, "- x-wth") \
+--
+2.35.1
+
--- /dev/null
+From 24b34a0da7b139f9154b57866cffe564f498e24d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Nov 2022 15:55:06 -0800
+Subject: hugetlb: don't delete vma_lock in hugetlb MADV_DONTNEED processing
+
+From: Mike Kravetz <mike.kravetz@oracle.com>
+
+commit 04ada095dcfc4ae359418053c0be94453bdf1e84 upstream.
+
+madvise(MADV_DONTNEED) ends up calling zap_page_range() to clear page
+tables associated with the address range. For hugetlb vmas,
+zap_page_range will call __unmap_hugepage_range_final. However,
+__unmap_hugepage_range_final assumes the passed vma is about to be removed
+and deletes the vma_lock to prevent pmd sharing as the vma is on the way
+out. In the case of madvise(MADV_DONTNEED) the vma remains, but the
+missing vma_lock prevents pmd sharing and could potentially lead to issues
+with truncation/fault races.
+
+This issue was originally reported here [1] as a BUG triggered in
+page_try_dup_anon_rmap. Prior to the introduction of the hugetlb
+vma_lock, __unmap_hugepage_range_final cleared the VM_MAYSHARE flag to
+prevent pmd sharing. Subsequent faults on this vma were confused as
+VM_MAYSHARE indicates a sharable vma, but was not set so page_mapping was
+not set in new pages added to the page table. This resulted in pages that
+appeared anonymous in a VM_SHARED vma and triggered the BUG.
+
+Address issue by adding a new zap flag ZAP_FLAG_UNMAP to indicate an unmap
+call from unmap_vmas(). This is used to indicate the 'final' unmapping of
+a hugetlb vma. When called via MADV_DONTNEED, this flag is not set and
+the vm_lock is not deleted.
+
+NOTE - Prior to the introduction of the huegtlb vma_lock in v6.1, this
+ issue is addressed by not clearing the VM_MAYSHARE flag when
+ __unmap_hugepage_range_final is called in the MADV_DONTNEED case.
+
+[1] https://lore.kernel.org/lkml/CAO4mrfdLMXsao9RF4fUE8-Wfde8xmjsKrTNMNC9wjUb6JudD0g@mail.gmail.com/
+
+Link: https://lkml.kernel.org/r/20221114235507.294320-3-mike.kravetz@oracle.com
+Fixes: 90e7e7f5ef3f ("mm: enable MADV_DONTNEED for hugetlb mappings")
+Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
+Reported-by: Wei Chen <harperchen1110@gmail.com>
+Cc: Axel Rasmussen <axelrasmussen@google.com>
+Cc: David Hildenbrand <david@redhat.com>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Mina Almasry <almasrymina@google.com>
+Cc: Nadav Amit <nadav.amit@gmail.com>
+Cc: Naoya Horiguchi <naoya.horiguchi@linux.dev>
+Cc: Peter Xu <peterx@redhat.com>
+Cc: Rik van Riel <riel@surriel.com>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mm.h | 2 ++
+ mm/hugetlb.c | 25 ++++++++++++++-----------
+ mm/memory.c | 2 +-
+ 3 files changed, 17 insertions(+), 12 deletions(-)
+
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index df804bf5f4a5..4ff52127a6b8 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -1794,6 +1794,8 @@ struct zap_details {
+ * default, the flag is not set.
+ */
+ #define ZAP_FLAG_DROP_MARKER ((__force zap_flags_t) BIT(0))
++/* Set in unmap_vmas() to indicate a final unmap call. Only used by hugetlb */
++#define ZAP_FLAG_UNMAP ((__force zap_flags_t) BIT(1))
+
+ #ifdef CONFIG_MMU
+ extern bool can_do_mlock(void);
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index dbb558e71e9e..022a3bfafec4 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -5145,17 +5145,20 @@ void __unmap_hugepage_range_final(struct mmu_gather *tlb,
+ {
+ __unmap_hugepage_range(tlb, vma, start, end, ref_page, zap_flags);
+
+- /*
+- * Clear this flag so that x86's huge_pmd_share page_table_shareable
+- * test will fail on a vma being torn down, and not grab a page table
+- * on its way out. We're lucky that the flag has such an appropriate
+- * name, and can in fact be safely cleared here. We could clear it
+- * before the __unmap_hugepage_range above, but all that's necessary
+- * is to clear it before releasing the i_mmap_rwsem. This works
+- * because in the context this is called, the VMA is about to be
+- * destroyed and the i_mmap_rwsem is held.
+- */
+- vma->vm_flags &= ~VM_MAYSHARE;
++ if (zap_flags & ZAP_FLAG_UNMAP) { /* final unmap */
++ /*
++ * Clear this flag so that x86's huge_pmd_share
++ * page_table_shareable test will fail on a vma being torn
++ * down, and not grab a page table on its way out. We're lucky
++ * that the flag has such an appropriate name, and can in fact
++ * be safely cleared here. We could clear it before the
++ * __unmap_hugepage_range above, but all that's necessary
++ * is to clear it before releasing the i_mmap_rwsem. This works
++ * because in the context this is called, the VMA is about to
++ * be destroyed and the i_mmap_rwsem is held.
++ */
++ vma->vm_flags &= ~VM_MAYSHARE;
++ }
+ }
+
+ void unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start,
+diff --git a/mm/memory.c b/mm/memory.c
+index 68d5b3dcec2e..a0fdaa74091f 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1712,7 +1712,7 @@ void unmap_vmas(struct mmu_gather *tlb,
+ {
+ struct mmu_notifier_range range;
+ struct zap_details details = {
+- .zap_flags = ZAP_FLAG_DROP_MARKER,
++ .zap_flags = ZAP_FLAG_DROP_MARKER | ZAP_FLAG_UNMAP,
+ /* Careful - we need to zap private pages too! */
+ .even_cows = true,
+ };
+--
+2.35.1
+
--- /dev/null
+From 0b9814f7fafa63c6c5d99e6b7d3ce16dbbf112cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Nov 2022 19:02:57 +0800
+Subject: LoongArch: Combine acpi_boot_table_init() and acpi_boot_init()
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit 538eafc6deae12fbac5f277b89aa139b812bca49 ]
+
+Combine acpi_boot_table_init() and acpi_boot_init() since they are very
+simple, and we don't need to check the return value of acpi_boot_init().
+
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/kernel/acpi.c | 31 ++++++++++---------------------
+ arch/loongarch/kernel/setup.c | 1 -
+ 2 files changed, 10 insertions(+), 22 deletions(-)
+
+diff --git a/arch/loongarch/kernel/acpi.c b/arch/loongarch/kernel/acpi.c
+index 335398482038..8319cc409009 100644
+--- a/arch/loongarch/kernel/acpi.c
++++ b/arch/loongarch/kernel/acpi.c
+@@ -56,23 +56,6 @@ void __iomem *acpi_os_ioremap(acpi_physical_address phys, acpi_size size)
+ return ioremap_cache(phys, size);
+ }
+
+-void __init acpi_boot_table_init(void)
+-{
+- /*
+- * If acpi_disabled, bail out
+- */
+- if (acpi_disabled)
+- return;
+-
+- /*
+- * Initialize the ACPI boot-time table parser.
+- */
+- if (acpi_table_init()) {
+- disable_acpi();
+- return;
+- }
+-}
+-
+ #ifdef CONFIG_SMP
+ static int set_processor_mask(u32 id, u32 flags)
+ {
+@@ -156,13 +139,21 @@ static void __init acpi_process_madt(void)
+ loongson_sysconf.nr_cpus = num_processors;
+ }
+
+-int __init acpi_boot_init(void)
++void __init acpi_boot_table_init(void)
+ {
+ /*
+ * If acpi_disabled, bail out
+ */
+ if (acpi_disabled)
+- return -1;
++ return;
++
++ /*
++ * Initialize the ACPI boot-time table parser.
++ */
++ if (acpi_table_init()) {
++ disable_acpi();
++ return;
++ }
+
+ loongson_sysconf.boot_cpu_id = read_csr_cpuid();
+
+@@ -173,8 +164,6 @@ int __init acpi_boot_init(void)
+
+ /* Do not enable ACPI SPCR console by default */
+ acpi_parse_spcr(earlycon_acpi_spcr_enable, false);
+-
+- return 0;
+ }
+
+ #ifdef CONFIG_ACPI_NUMA
+diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c
+index 8f5c2f9a1a83..574647e3483d 100644
+--- a/arch/loongarch/kernel/setup.c
++++ b/arch/loongarch/kernel/setup.c
+@@ -203,7 +203,6 @@ void __init platform_init(void)
+ #ifdef CONFIG_ACPI
+ acpi_gbl_use_default_register_widths = false;
+ acpi_boot_table_init();
+- acpi_boot_init();
+ #endif
+
+ #ifdef CONFIG_NUMA
+--
+2.35.1
+
--- /dev/null
+From 68f01d8a76368ef99415560bdc238c3d8fae6860 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Nov 2022 19:02:57 +0800
+Subject: LoongArch: Fix unsigned comparison with less than zero
+
+From: KaiLong Wang <wangkailong@jari.cn>
+
+[ Upstream commit b96e74bb439f096168c78ba3ba1599e0b85cfd73 ]
+
+Eliminate the following coccicheck warning:
+
+./arch/loongarch/kernel/unwind_prologue.c:84:5-13: WARNING: Unsigned
+expression compared with zero: frame_ra < 0
+
+Signed-off-by: KaiLong Wang <wangkailong@jari.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/kernel/unwind_prologue.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/loongarch/kernel/unwind_prologue.c b/arch/loongarch/kernel/unwind_prologue.c
+index b206d9159205..4571c3c87cd4 100644
+--- a/arch/loongarch/kernel/unwind_prologue.c
++++ b/arch/loongarch/kernel/unwind_prologue.c
+@@ -43,7 +43,8 @@ static bool unwind_by_prologue(struct unwind_state *state)
+ {
+ struct stack_info *info = &state->stack_info;
+ union loongarch_instruction *ip, *ip_end;
+- unsigned long frame_size = 0, frame_ra = -1;
++ long frame_ra = -1;
++ unsigned long frame_size = 0;
+ unsigned long size, offset, pc = state->pc;
+
+ if (state->sp >= info->end || state->sp < info->begin)
+--
+2.35.1
+
--- /dev/null
+From d532bed988fcd5d3316add83e55a1f78cfbb4acc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Nov 2022 19:02:57 +0800
+Subject: LoongArch: Makefile: Use "grep -E" instead of "egrep"
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 83f638bca0ccd94942bc3c4eb9bcec24dd8a1cf9 ]
+
+The latest version of grep claims the egrep is now obsolete so the build
+now contains warnings that look like:
+ egrep: warning: egrep is obsolescent; using grep -E
+
+Fix this up by changing the LoongArch Makefile to use "grep -E" instead.
+
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/loongarch/Makefile b/arch/loongarch/Makefile
+index ec3de6191276..9123feb69854 100644
+--- a/arch/loongarch/Makefile
++++ b/arch/loongarch/Makefile
+@@ -68,7 +68,7 @@ KBUILD_LDFLAGS += -m $(ld-emul)
+
+ ifdef CONFIG_LOONGARCH
+ CHECKFLAGS += $(shell $(CC) $(KBUILD_CFLAGS) -dM -E -x c /dev/null | \
+- egrep -vw '__GNUC_(MINOR_|PATCHLEVEL_)?_' | \
++ grep -E -vw '__GNUC_(MINOR_|PATCHLEVEL_)?_' | \
+ sed -e "s/^\#define /-D'/" -e "s/ /'='/" -e "s/$$/'/" -e 's/\$$/&&/g')
+ endif
+
+--
+2.35.1
+
--- /dev/null
+From 6f121e53ea506a1a369c7c472f03ac37fa3b1d8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Nov 2022 19:02:57 +0800
+Subject: LoongArch: Set _PAGE_DIRTY only if _PAGE_MODIFIED is set in
+ {pmd,pte}_mkwrite()
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit 54e6cd42a183b602e3627ad3aaeeed44f7443e67 ]
+
+Set _PAGE_DIRTY only if _PAGE_MODIFIED is set in {pmd,pte}_mkwrite().
+Otherwise, _PAGE_DIRTY silences the TLB modify exception and make us
+have no chance to mark a pmd/pte dirty (_PAGE_MODIFIED) for software.
+
+Reviewed-by: Guo Ren <guoren@kernel.org>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/include/asm/pgtable.h | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/arch/loongarch/include/asm/pgtable.h b/arch/loongarch/include/asm/pgtable.h
+index cc0674d1b8f0..645e24ebec68 100644
+--- a/arch/loongarch/include/asm/pgtable.h
++++ b/arch/loongarch/include/asm/pgtable.h
+@@ -357,7 +357,9 @@ static inline pte_t pte_mkdirty(pte_t pte)
+
+ static inline pte_t pte_mkwrite(pte_t pte)
+ {
+- pte_val(pte) |= (_PAGE_WRITE | _PAGE_DIRTY);
++ pte_val(pte) |= _PAGE_WRITE;
++ if (pte_val(pte) & _PAGE_MODIFIED)
++ pte_val(pte) |= _PAGE_DIRTY;
+ return pte;
+ }
+
+@@ -454,7 +456,9 @@ static inline int pmd_write(pmd_t pmd)
+
+ static inline pmd_t pmd_mkwrite(pmd_t pmd)
+ {
+- pmd_val(pmd) |= (_PAGE_WRITE | _PAGE_DIRTY);
++ pmd_val(pmd) |= _PAGE_WRITE;
++ if (pmd_val(pmd) & _PAGE_MODIFIED)
++ pmd_val(pmd) |= _PAGE_DIRTY;
+ return pmd;
+ }
+
+--
+2.35.1
+
--- /dev/null
+From 1a001e4b6c105fac9bf920d1021d78f821097cb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Nov 2022 15:55:05 -0800
+Subject: madvise: use zap_page_range_single for madvise dontneed
+
+From: Mike Kravetz <mike.kravetz@oracle.com>
+
+[ Upstream commit 21b85b09527c28e242db55c1b751f7f7549b830c ]
+
+This series addresses the issue first reported in [1], and fully described
+in patch 2. Patches 1 and 2 address the user visible issue and are tagged
+for stable backports.
+
+While exploring solutions to this issue, related problems with mmu
+notification calls were discovered. This is addressed in the patch
+"hugetlb: remove duplicate mmu notifications:". Since there are no user
+visible effects, this third is not tagged for stable backports.
+
+Previous discussions suggested further cleanup by removing the
+routine zap_page_range. This is possible because zap_page_range_single
+is now exported, and all callers of zap_page_range pass ranges entirely
+within a single vma. This work will be done in a later patch so as not
+to distract from this bug fix.
+
+[1] https://lore.kernel.org/lkml/CAO4mrfdLMXsao9RF4fUE8-Wfde8xmjsKrTNMNC9wjUb6JudD0g@mail.gmail.com/
+
+This patch (of 2):
+
+Expose the routine zap_page_range_single to zap a range within a single
+vma. The madvise routine madvise_dontneed_single_vma can use this routine
+as it explicitly operates on a single vma. Also, update the mmu
+notification range in zap_page_range_single to take hugetlb pmd sharing
+into account. This is required as MADV_DONTNEED supports hugetlb vmas.
+
+Link: https://lkml.kernel.org/r/20221114235507.294320-1-mike.kravetz@oracle.com
+Link: https://lkml.kernel.org/r/20221114235507.294320-2-mike.kravetz@oracle.com
+Fixes: 90e7e7f5ef3f ("mm: enable MADV_DONTNEED for hugetlb mappings")
+Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
+Reported-by: Wei Chen <harperchen1110@gmail.com>
+Cc: Axel Rasmussen <axelrasmussen@google.com>
+Cc: David Hildenbrand <david@redhat.com>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Mina Almasry <almasrymina@google.com>
+Cc: Nadav Amit <nadav.amit@gmail.com>
+Cc: Naoya Horiguchi <naoya.horiguchi@linux.dev>
+Cc: Peter Xu <peterx@redhat.com>
+Cc: Rik van Riel <riel@surriel.com>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mm.h | 27 +++++++++++++++++++--------
+ mm/madvise.c | 6 +++---
+ mm/memory.c | 23 +++++++++++------------
+ 3 files changed, 33 insertions(+), 23 deletions(-)
+
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index 21f8b27bd9fd..df804bf5f4a5 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -1778,6 +1778,23 @@ extern void pagefault_out_of_memory(void);
+
+ extern void show_free_areas(unsigned int flags, nodemask_t *nodemask);
+
++/*
++ * Parameter block passed down to zap_pte_range in exceptional cases.
++ */
++struct zap_details {
++ struct folio *single_folio; /* Locked folio to be unmapped */
++ bool even_cows; /* Zap COWed private pages too? */
++ zap_flags_t zap_flags; /* Extra flags for zapping */
++};
++
++/*
++ * Whether to drop the pte markers, for example, the uffd-wp information for
++ * file-backed memory. This should only be specified when we will completely
++ * drop the page in the mm, either by truncation or unmapping of the vma. By
++ * default, the flag is not set.
++ */
++#define ZAP_FLAG_DROP_MARKER ((__force zap_flags_t) BIT(0))
++
+ #ifdef CONFIG_MMU
+ extern bool can_do_mlock(void);
+ #else
+@@ -1797,6 +1814,8 @@ void zap_page_range(struct vm_area_struct *vma, unsigned long address,
+ unsigned long size);
+ void unmap_vmas(struct mmu_gather *tlb, struct vm_area_struct *start_vma,
+ unsigned long start, unsigned long end);
++void zap_page_range_single(struct vm_area_struct *vma, unsigned long address,
++ unsigned long size, struct zap_details *details);
+
+ struct mmu_notifier_range;
+
+@@ -3386,12 +3405,4 @@ madvise_set_anon_name(struct mm_struct *mm, unsigned long start,
+ }
+ #endif
+
+-/*
+- * Whether to drop the pte markers, for example, the uffd-wp information for
+- * file-backed memory. This should only be specified when we will completely
+- * drop the page in the mm, either by truncation or unmapping of the vma. By
+- * default, the flag is not set.
+- */
+-#define ZAP_FLAG_DROP_MARKER ((__force zap_flags_t) BIT(0))
+-
+ #endif /* _LINUX_MM_H */
+diff --git a/mm/madvise.c b/mm/madvise.c
+index 98ed17a4471a..b2831b57aef8 100644
+--- a/mm/madvise.c
++++ b/mm/madvise.c
+@@ -770,8 +770,8 @@ static int madvise_free_single_vma(struct vm_area_struct *vma,
+ * Application no longer needs these pages. If the pages are dirty,
+ * it's OK to just throw them away. The app will be more careful about
+ * data it wants to keep. Be sure to free swap resources too. The
+- * zap_page_range call sets things up for shrink_active_list to actually free
+- * these pages later if no one else has touched them in the meantime,
++ * zap_page_range_single call sets things up for shrink_active_list to actually
++ * free these pages later if no one else has touched them in the meantime,
+ * although we could add these pages to a global reuse list for
+ * shrink_active_list to pick up before reclaiming other pages.
+ *
+@@ -788,7 +788,7 @@ static int madvise_free_single_vma(struct vm_area_struct *vma,
+ static long madvise_dontneed_single_vma(struct vm_area_struct *vma,
+ unsigned long start, unsigned long end)
+ {
+- zap_page_range(vma, start, end - start);
++ zap_page_range_single(vma, start, end - start, NULL);
+ return 0;
+ }
+
+diff --git a/mm/memory.c b/mm/memory.c
+index de0dbe09b013..68d5b3dcec2e 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1341,15 +1341,6 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)
+ return ret;
+ }
+
+-/*
+- * Parameter block passed down to zap_pte_range in exceptional cases.
+- */
+-struct zap_details {
+- struct folio *single_folio; /* Locked folio to be unmapped */
+- bool even_cows; /* Zap COWed private pages too? */
+- zap_flags_t zap_flags; /* Extra flags for zapping */
+-};
+-
+ /* Whether we should zap all COWed (private) pages too */
+ static inline bool should_zap_cows(struct zap_details *details)
+ {
+@@ -1769,19 +1760,27 @@ void zap_page_range(struct vm_area_struct *vma, unsigned long start,
+ *
+ * The range must fit into one VMA.
+ */
+-static void zap_page_range_single(struct vm_area_struct *vma, unsigned long address,
++void zap_page_range_single(struct vm_area_struct *vma, unsigned long address,
+ unsigned long size, struct zap_details *details)
+ {
++ const unsigned long end = address + size;
+ struct mmu_notifier_range range;
+ struct mmu_gather tlb;
+
+ lru_add_drain();
+ mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, vma, vma->vm_mm,
+- address, address + size);
++ address, end);
++ if (is_vm_hugetlb_page(vma))
++ adjust_range_if_pmd_sharing_possible(vma, &range.start,
++ &range.end);
+ tlb_gather_mmu(&tlb, vma->vm_mm);
+ update_hiwater_rss(vma->vm_mm);
+ mmu_notifier_invalidate_range_start(&range);
+- unmap_single_vma(&tlb, vma, address, range.end, details);
++ /*
++ * unmap 'address-end' not 'range.start-range.end' as range
++ * could have been expanded for hugetlb pmd sharing.
++ */
++ unmap_single_vma(&tlb, vma, address, end, details);
+ mmu_notifier_invalidate_range_end(&range);
+ tlb_finish_mmu(&tlb);
+ }
+--
+2.35.1
+
--- /dev/null
+From 90e5db7dc1a06d74415a37bf8a9e15d5ea59ff75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 13:04:34 +0000
+Subject: media: videobuf2-core: take mmap_lock in vb2_get_unmapped_area()
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 098e5edc5d048a8df8691fd9fde895af100be42b ]
+
+While vb2_mmap took the mmap_lock mutex, vb2_get_unmapped_area didn't.
+Add this.
+
+Also take this opportunity to move the 'q->memory != VB2_MEMORY_MMAP'
+check and vb2_fileio_is_active() check into __find_plane_by_offset() so
+both vb2_mmap and vb2_get_unmapped_area do the same checks.
+
+Since q->memory is checked while mmap_lock is held, also take that lock
+in reqbufs and create_bufs when it is set, and set it back to
+MEMORY_UNKNOWN on error.
+
+Fixes: f035eb4e976e ("[media] videobuf2: fix lockdep warning")
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Acked-by: Tomasz Figa <tfiga@chromium.org>
+Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../media/common/videobuf2/videobuf2-core.c | 102 +++++++++++++-----
+ 1 file changed, 73 insertions(+), 29 deletions(-)
+
+diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
+index b203c1e26353..4eac35c4ea3b 100644
+--- a/drivers/media/common/videobuf2/videobuf2-core.c
++++ b/drivers/media/common/videobuf2/videobuf2-core.c
+@@ -813,7 +813,13 @@ int vb2_core_reqbufs(struct vb2_queue *q, enum vb2_memory memory,
+ num_buffers = max_t(unsigned int, *count, q->min_buffers_needed);
+ num_buffers = min_t(unsigned int, num_buffers, VB2_MAX_FRAME);
+ memset(q->alloc_devs, 0, sizeof(q->alloc_devs));
++ /*
++ * Set this now to ensure that drivers see the correct q->memory value
++ * in the queue_setup op.
++ */
++ mutex_lock(&q->mmap_lock);
+ q->memory = memory;
++ mutex_unlock(&q->mmap_lock);
+ set_queue_coherency(q, non_coherent_mem);
+
+ /*
+@@ -823,22 +829,27 @@ int vb2_core_reqbufs(struct vb2_queue *q, enum vb2_memory memory,
+ ret = call_qop(q, queue_setup, q, &num_buffers, &num_planes,
+ plane_sizes, q->alloc_devs);
+ if (ret)
+- return ret;
++ goto error;
+
+ /* Check that driver has set sane values */
+- if (WARN_ON(!num_planes))
+- return -EINVAL;
++ if (WARN_ON(!num_planes)) {
++ ret = -EINVAL;
++ goto error;
++ }
+
+ for (i = 0; i < num_planes; i++)
+- if (WARN_ON(!plane_sizes[i]))
+- return -EINVAL;
++ if (WARN_ON(!plane_sizes[i])) {
++ ret = -EINVAL;
++ goto error;
++ }
+
+ /* Finally, allocate buffers and video memory */
+ allocated_buffers =
+ __vb2_queue_alloc(q, memory, num_buffers, num_planes, plane_sizes);
+ if (allocated_buffers == 0) {
+ dprintk(q, 1, "memory allocation failed\n");
+- return -ENOMEM;
++ ret = -ENOMEM;
++ goto error;
+ }
+
+ /*
+@@ -879,7 +890,8 @@ int vb2_core_reqbufs(struct vb2_queue *q, enum vb2_memory memory,
+ if (ret < 0) {
+ /*
+ * Note: __vb2_queue_free() will subtract 'allocated_buffers'
+- * from q->num_buffers.
++ * from q->num_buffers and it will reset q->memory to
++ * VB2_MEMORY_UNKNOWN.
+ */
+ __vb2_queue_free(q, allocated_buffers);
+ mutex_unlock(&q->mmap_lock);
+@@ -895,6 +907,12 @@ int vb2_core_reqbufs(struct vb2_queue *q, enum vb2_memory memory,
+ q->waiting_for_buffers = !q->is_output;
+
+ return 0;
++
++error:
++ mutex_lock(&q->mmap_lock);
++ q->memory = VB2_MEMORY_UNKNOWN;
++ mutex_unlock(&q->mmap_lock);
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(vb2_core_reqbufs);
+
+@@ -906,6 +924,7 @@ int vb2_core_create_bufs(struct vb2_queue *q, enum vb2_memory memory,
+ unsigned int num_planes = 0, num_buffers, allocated_buffers;
+ unsigned plane_sizes[VB2_MAX_PLANES] = { };
+ bool non_coherent_mem = flags & V4L2_MEMORY_FLAG_NON_COHERENT;
++ bool no_previous_buffers = !q->num_buffers;
+ int ret;
+
+ if (q->num_buffers == VB2_MAX_FRAME) {
+@@ -913,13 +932,19 @@ int vb2_core_create_bufs(struct vb2_queue *q, enum vb2_memory memory,
+ return -ENOBUFS;
+ }
+
+- if (!q->num_buffers) {
++ if (no_previous_buffers) {
+ if (q->waiting_in_dqbuf && *count) {
+ dprintk(q, 1, "another dup()ped fd is waiting for a buffer\n");
+ return -EBUSY;
+ }
+ memset(q->alloc_devs, 0, sizeof(q->alloc_devs));
++ /*
++ * Set this now to ensure that drivers see the correct q->memory
++ * value in the queue_setup op.
++ */
++ mutex_lock(&q->mmap_lock);
+ q->memory = memory;
++ mutex_unlock(&q->mmap_lock);
+ q->waiting_for_buffers = !q->is_output;
+ set_queue_coherency(q, non_coherent_mem);
+ } else {
+@@ -945,14 +970,15 @@ int vb2_core_create_bufs(struct vb2_queue *q, enum vb2_memory memory,
+ ret = call_qop(q, queue_setup, q, &num_buffers,
+ &num_planes, plane_sizes, q->alloc_devs);
+ if (ret)
+- return ret;
++ goto error;
+
+ /* Finally, allocate buffers and video memory */
+ allocated_buffers = __vb2_queue_alloc(q, memory, num_buffers,
+ num_planes, plane_sizes);
+ if (allocated_buffers == 0) {
+ dprintk(q, 1, "memory allocation failed\n");
+- return -ENOMEM;
++ ret = -ENOMEM;
++ goto error;
+ }
+
+ /*
+@@ -983,7 +1009,8 @@ int vb2_core_create_bufs(struct vb2_queue *q, enum vb2_memory memory,
+ if (ret < 0) {
+ /*
+ * Note: __vb2_queue_free() will subtract 'allocated_buffers'
+- * from q->num_buffers.
++ * from q->num_buffers and it will reset q->memory to
++ * VB2_MEMORY_UNKNOWN.
+ */
+ __vb2_queue_free(q, allocated_buffers);
+ mutex_unlock(&q->mmap_lock);
+@@ -998,6 +1025,14 @@ int vb2_core_create_bufs(struct vb2_queue *q, enum vb2_memory memory,
+ *count = allocated_buffers;
+
+ return 0;
++
++error:
++ if (no_previous_buffers) {
++ mutex_lock(&q->mmap_lock);
++ q->memory = VB2_MEMORY_UNKNOWN;
++ mutex_unlock(&q->mmap_lock);
++ }
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(vb2_core_create_bufs);
+
+@@ -2164,6 +2199,22 @@ static int __find_plane_by_offset(struct vb2_queue *q, unsigned long off,
+ struct vb2_buffer *vb;
+ unsigned int buffer, plane;
+
++ /*
++ * Sanity checks to ensure the lock is held, MEMORY_MMAP is
++ * used and fileio isn't active.
++ */
++ lockdep_assert_held(&q->mmap_lock);
++
++ if (q->memory != VB2_MEMORY_MMAP) {
++ dprintk(q, 1, "queue is not currently set up for mmap\n");
++ return -EINVAL;
++ }
++
++ if (vb2_fileio_is_active(q)) {
++ dprintk(q, 1, "file io in progress\n");
++ return -EBUSY;
++ }
++
+ /*
+ * Go over all buffers and their planes, comparing the given offset
+ * with an offset assigned to each plane. If a match is found,
+@@ -2265,11 +2316,6 @@ int vb2_mmap(struct vb2_queue *q, struct vm_area_struct *vma)
+ int ret;
+ unsigned long length;
+
+- if (q->memory != VB2_MEMORY_MMAP) {
+- dprintk(q, 1, "queue is not currently set up for mmap\n");
+- return -EINVAL;
+- }
+-
+ /*
+ * Check memory area access mode.
+ */
+@@ -2291,14 +2337,9 @@ int vb2_mmap(struct vb2_queue *q, struct vm_area_struct *vma)
+
+ mutex_lock(&q->mmap_lock);
+
+- if (vb2_fileio_is_active(q)) {
+- dprintk(q, 1, "mmap: file io in progress\n");
+- ret = -EBUSY;
+- goto unlock;
+- }
+-
+ /*
+- * Find the plane corresponding to the offset passed by userspace.
++ * Find the plane corresponding to the offset passed by userspace. This
++ * will return an error if not MEMORY_MMAP or file I/O is in progress.
+ */
+ ret = __find_plane_by_offset(q, off, &buffer, &plane);
+ if (ret)
+@@ -2351,22 +2392,25 @@ unsigned long vb2_get_unmapped_area(struct vb2_queue *q,
+ void *vaddr;
+ int ret;
+
+- if (q->memory != VB2_MEMORY_MMAP) {
+- dprintk(q, 1, "queue is not currently set up for mmap\n");
+- return -EINVAL;
+- }
++ mutex_lock(&q->mmap_lock);
+
+ /*
+- * Find the plane corresponding to the offset passed by userspace.
++ * Find the plane corresponding to the offset passed by userspace. This
++ * will return an error if not MEMORY_MMAP or file I/O is in progress.
+ */
+ ret = __find_plane_by_offset(q, off, &buffer, &plane);
+ if (ret)
+- return ret;
++ goto unlock;
+
+ vb = q->bufs[buffer];
+
+ vaddr = vb2_plane_vaddr(vb, plane);
++ mutex_unlock(&q->mmap_lock);
+ return vaddr ? (unsigned long)vaddr : -EINVAL;
++
++unlock:
++ mutex_unlock(&q->mmap_lock);
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(vb2_get_unmapped_area);
+ #endif
+--
+2.35.1
+
--- /dev/null
+From 31b4616788a392b94f0d7b3d6daeff020542e805 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Dec 2022 18:16:12 +0100
+Subject: mm/khugepaged: fix GUP-fast interaction by sending IPI
+
+From: Jann Horn <jannh@google.com>
+
+commit 2ba99c5e08812494bc57f319fb562f527d9bacd8 upstream.
+
+Since commit 70cbc3cc78a99 ("mm: gup: fix the fast GUP race against THP
+collapse"), the lockless_pages_from_mm() fastpath rechecks the pmd_t to
+ensure that the page table was not removed by khugepaged in between.
+
+However, lockless_pages_from_mm() still requires that the page table is
+not concurrently freed. Fix it by sending IPIs (if the architecture uses
+semi-RCU-style page table freeing) before freeing/reusing page tables.
+
+Link: https://lkml.kernel.org/r/20221129154730.2274278-2-jannh@google.com
+Link: https://lkml.kernel.org/r/20221128180252.1684965-2-jannh@google.com
+Link: https://lkml.kernel.org/r/20221125213714.4115729-2-jannh@google.com
+Fixes: ba76149f47d8 ("thp: khugepaged")
+Signed-off-by: Jann Horn <jannh@google.com>
+Reviewed-by: Yang Shi <shy828301@gmail.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Cc: John Hubbard <jhubbard@nvidia.com>
+Cc: Peter Xu <peterx@redhat.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+[backported, no changes necessary]
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/tlb.h | 4 ++++
+ mm/khugepaged.c | 2 ++
+ mm/mmu_gather.c | 4 +---
+ 3 files changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h
+index 492dce43236e..cab7cfebf40b 100644
+--- a/include/asm-generic/tlb.h
++++ b/include/asm-generic/tlb.h
+@@ -222,12 +222,16 @@ extern void tlb_remove_table(struct mmu_gather *tlb, void *table);
+ #define tlb_needs_table_invalidate() (true)
+ #endif
+
++void tlb_remove_table_sync_one(void);
++
+ #else
+
+ #ifdef tlb_needs_table_invalidate
+ #error tlb_needs_table_invalidate() requires MMU_GATHER_RCU_TABLE_FREE
+ #endif
+
++static inline void tlb_remove_table_sync_one(void) { }
++
+ #endif /* CONFIG_MMU_GATHER_RCU_TABLE_FREE */
+
+
+diff --git a/mm/khugepaged.c b/mm/khugepaged.c
+index 28d8459d7aae..1155d356d3ac 100644
+--- a/mm/khugepaged.c
++++ b/mm/khugepaged.c
+@@ -1093,6 +1093,7 @@ static void collapse_huge_page(struct mm_struct *mm,
+ _pmd = pmdp_collapse_flush(vma, address, pmd);
+ spin_unlock(pmd_ptl);
+ mmu_notifier_invalidate_range_end(&range);
++ tlb_remove_table_sync_one();
+
+ spin_lock(pte_ptl);
+ isolated = __collapse_huge_page_isolate(vma, address, pte,
+@@ -1391,6 +1392,7 @@ static void collapse_and_free_pmd(struct mm_struct *mm, struct vm_area_struct *v
+ lockdep_assert_held_write(&vma->anon_vma->root->rwsem);
+
+ pmd = pmdp_collapse_flush(vma, addr, pmdp);
++ tlb_remove_table_sync_one();
+ mm_dec_nr_ptes(mm);
+ page_table_check_pte_clear_range(mm, addr, pmd);
+ pte_free(mm, pmd_pgtable(pmd));
+diff --git a/mm/mmu_gather.c b/mm/mmu_gather.c
+index a71924bd38c0..ba7d26a291dd 100644
+--- a/mm/mmu_gather.c
++++ b/mm/mmu_gather.c
+@@ -152,7 +152,7 @@ static void tlb_remove_table_smp_sync(void *arg)
+ /* Simply deliver the interrupt */
+ }
+
+-static void tlb_remove_table_sync_one(void)
++void tlb_remove_table_sync_one(void)
+ {
+ /*
+ * This isn't an RCU grace period and hence the page-tables cannot be
+@@ -176,8 +176,6 @@ static void tlb_remove_table_free(struct mmu_table_batch *batch)
+
+ #else /* !CONFIG_MMU_GATHER_RCU_TABLE_FREE */
+
+-static void tlb_remove_table_sync_one(void) { }
+-
+ static void tlb_remove_table_free(struct mmu_table_batch *batch)
+ {
+ __tlb_remove_table_free(batch);
+--
+2.35.1
+
--- /dev/null
+From fce04dd1f4ad5a5844d5256e1202c3ed45369940 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Dec 2022 18:16:13 +0100
+Subject: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
+
+From: Jann Horn <jannh@google.com>
+
+commit f268f6cf875f3220afc77bdd0bf1bb136eb54db9 upstream.
+
+Any codepath that zaps page table entries must invoke MMU notifiers to
+ensure that secondary MMUs (like KVM) don't keep accessing pages which
+aren't mapped anymore. Secondary MMUs don't hold their own references to
+pages that are mirrored over, so failing to notify them can lead to page
+use-after-free.
+
+I'm marking this as addressing an issue introduced in commit f3f0e1d2150b
+("khugepaged: add support of collapse for tmpfs/shmem pages"), but most of
+the security impact of this only came in commit 27e1f8273113 ("khugepaged:
+enable collapse pmd for pte-mapped THP"), which actually omitted flushes
+for the removal of present PTEs, not just for the removal of empty page
+tables.
+
+Link: https://lkml.kernel.org/r/20221129154730.2274278-3-jannh@google.com
+Link: https://lkml.kernel.org/r/20221128180252.1684965-3-jannh@google.com
+Link: https://lkml.kernel.org/r/20221125213714.4115729-3-jannh@google.com
+Fixes: f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages")
+Signed-off-by: Jann Horn <jannh@google.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Yang Shi <shy828301@gmail.com>
+Cc: John Hubbard <jhubbard@nvidia.com>
+Cc: Peter Xu <peterx@redhat.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+[backported, no changes necessary]
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/khugepaged.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/mm/khugepaged.c b/mm/khugepaged.c
+index 1155d356d3ac..5935765bcb33 100644
+--- a/mm/khugepaged.c
++++ b/mm/khugepaged.c
+@@ -1380,6 +1380,7 @@ static void collapse_and_free_pmd(struct mm_struct *mm, struct vm_area_struct *v
+ unsigned long addr, pmd_t *pmdp)
+ {
+ pmd_t pmd;
++ struct mmu_notifier_range range;
+
+ mmap_assert_write_locked(mm);
+ if (vma->vm_file)
+@@ -1391,8 +1392,12 @@ static void collapse_and_free_pmd(struct mm_struct *mm, struct vm_area_struct *v
+ if (vma->anon_vma)
+ lockdep_assert_held_write(&vma->anon_vma->root->rwsem);
+
++ mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, NULL, mm, addr,
++ addr + HPAGE_PMD_SIZE);
++ mmu_notifier_invalidate_range_start(&range);
+ pmd = pmdp_collapse_flush(vma, addr, pmdp);
+ tlb_remove_table_sync_one();
++ mmu_notifier_invalidate_range_end(&range);
+ mm_dec_nr_ptes(mm);
+ page_table_check_pte_clear_range(mm, addr, pmd);
+ pte_free(mm, pmd_pgtable(pmd));
+--
+2.35.1
+
--- /dev/null
+From a668aaf8bedd71660f6ea91b4783e9ed593f802a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Dec 2022 18:16:14 +0100
+Subject: mm/khugepaged: take the right locks for page table retraction
+
+From: Jann Horn <jannh@google.com>
+
+commit 8d3c106e19e8d251da31ff4cc7462e4565d65084 upstream.
+
+pagetable walks on address ranges mapped by VMAs can be done under the
+mmap lock, the lock of an anon_vma attached to the VMA, or the lock of the
+VMA's address_space. Only one of these needs to be held, and it does not
+need to be held in exclusive mode.
+
+Under those circumstances, the rules for concurrent access to page table
+entries are:
+
+ - Terminal page table entries (entries that don't point to another page
+ table) can be arbitrarily changed under the page table lock, with the
+ exception that they always need to be consistent for
+ hardware page table walks and lockless_pages_from_mm().
+ This includes that they can be changed into non-terminal entries.
+ - Non-terminal page table entries (which point to another page table)
+ can not be modified; readers are allowed to READ_ONCE() an entry, verify
+ that it is non-terminal, and then assume that its value will stay as-is.
+
+Retracting a page table involves modifying a non-terminal entry, so
+page-table-level locks are insufficient to protect against concurrent page
+table traversal; it requires taking all the higher-level locks under which
+it is possible to start a page walk in the relevant range in exclusive
+mode.
+
+The collapse_huge_page() path for anonymous THP already follows this rule,
+but the shmem/file THP path was getting it wrong, making it possible for
+concurrent rmap-based operations to cause corruption.
+
+Link: https://lkml.kernel.org/r/20221129154730.2274278-1-jannh@google.com
+Link: https://lkml.kernel.org/r/20221128180252.1684965-1-jannh@google.com
+Link: https://lkml.kernel.org/r/20221125213714.4115729-1-jannh@google.com
+Fixes: 27e1f8273113 ("khugepaged: enable collapse pmd for pte-mapped THP")
+Signed-off-by: Jann Horn <jannh@google.com>
+Reviewed-by: Yang Shi <shy828301@gmail.com>
+Acked-by: David Hildenbrand <david@redhat.com>
+Cc: John Hubbard <jhubbard@nvidia.com>
+Cc: Peter Xu <peterx@redhat.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+[backport fixed up manually: collapse_pte_mapped_thp returns different
+type]
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/khugepaged.c | 56 +++++++++++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 52 insertions(+), 4 deletions(-)
+
+diff --git a/mm/khugepaged.c b/mm/khugepaged.c
+index 70b7ac66411c..28d8459d7aae 100644
+--- a/mm/khugepaged.c
++++ b/mm/khugepaged.c
+@@ -1360,16 +1360,37 @@ static void khugepaged_add_pte_mapped_thp(struct mm_struct *mm,
+ spin_unlock(&khugepaged_mm_lock);
+ }
+
++/*
++ * A note about locking:
++ * Trying to take the page table spinlocks would be useless here because those
++ * are only used to synchronize:
++ *
++ * - modifying terminal entries (ones that point to a data page, not to another
++ * page table)
++ * - installing *new* non-terminal entries
++ *
++ * Instead, we need roughly the same kind of protection as free_pgtables() or
++ * mm_take_all_locks() (but only for a single VMA):
++ * The mmap lock together with this VMA's rmap locks covers all paths towards
++ * the page table entries we're messing with here, except for hardware page
++ * table walks and lockless_pages_from_mm().
++ */
+ static void collapse_and_free_pmd(struct mm_struct *mm, struct vm_area_struct *vma,
+ unsigned long addr, pmd_t *pmdp)
+ {
+- spinlock_t *ptl;
+ pmd_t pmd;
+
+ mmap_assert_write_locked(mm);
+- ptl = pmd_lock(vma->vm_mm, pmdp);
++ if (vma->vm_file)
++ lockdep_assert_held_write(&vma->vm_file->f_mapping->i_mmap_rwsem);
++ /*
++ * All anon_vmas attached to the VMA have the same root and are
++ * therefore locked by the same lock.
++ */
++ if (vma->anon_vma)
++ lockdep_assert_held_write(&vma->anon_vma->root->rwsem);
++
+ pmd = pmdp_collapse_flush(vma, addr, pmdp);
+- spin_unlock(ptl);
+ mm_dec_nr_ptes(mm);
+ page_table_check_pte_clear_range(mm, addr, pmd);
+ pte_free(mm, pmd_pgtable(pmd));
+@@ -1410,6 +1431,14 @@ void collapse_pte_mapped_thp(struct mm_struct *mm, unsigned long addr)
+ if (!hugepage_vma_check(vma, vma->vm_flags | VM_HUGEPAGE, false, false))
+ return;
+
++ /*
++ * Symmetry with retract_page_tables(): Exclude MAP_PRIVATE mappings
++ * that got written to. Without this, we'd have to also lock the
++ * anon_vma if one exists.
++ */
++ if (vma->anon_vma)
++ return;
++
+ /* Keep pmd pgtable for uffd-wp; see comment in retract_page_tables() */
+ if (userfaultfd_wp(vma))
+ return;
+@@ -1426,6 +1455,20 @@ void collapse_pte_mapped_thp(struct mm_struct *mm, unsigned long addr)
+ if (!pmd)
+ goto drop_hpage;
+
++ /*
++ * We need to lock the mapping so that from here on, only GUP-fast and
++ * hardware page walks can access the parts of the page tables that
++ * we're operating on.
++ * See collapse_and_free_pmd().
++ */
++ i_mmap_lock_write(vma->vm_file->f_mapping);
++
++ /*
++ * This spinlock should be unnecessary: Nobody else should be accessing
++ * the page tables under spinlock protection here, only
++ * lockless_pages_from_mm() and the hardware page walker can access page
++ * tables while all the high-level locks are held in write mode.
++ */
+ start_pte = pte_offset_map_lock(mm, pmd, haddr, &ptl);
+
+ /* step 1: check all mapped PTEs are to the right huge page */
+@@ -1476,6 +1519,9 @@ void collapse_pte_mapped_thp(struct mm_struct *mm, unsigned long addr)
+
+ /* step 4: collapse pmd */
+ collapse_and_free_pmd(mm, vma, haddr, pmd);
++
++ i_mmap_unlock_write(vma->vm_file->f_mapping);
++
+ drop_hpage:
+ unlock_page(hpage);
+ put_page(hpage);
+@@ -1483,6 +1529,7 @@ void collapse_pte_mapped_thp(struct mm_struct *mm, unsigned long addr)
+
+ abort:
+ pte_unmap_unlock(start_pte, ptl);
++ i_mmap_unlock_write(vma->vm_file->f_mapping);
+ goto drop_hpage;
+ }
+
+@@ -1531,7 +1578,8 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff)
+ * An alternative would be drop the check, but check that page
+ * table is clear before calling pmdp_collapse_flush() under
+ * ptl. It has higher chance to recover THP for the VMA, but
+- * has higher cost too.
++ * has higher cost too. It would also probably require locking
++ * the anon_vma.
+ */
+ if (vma->anon_vma)
+ continue;
+--
+2.35.1
+
--- /dev/null
+From 79fa2706673cb69ca91e02ec0618c1deb7d4bed2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Aug 2022 11:25:26 +0300
+Subject: net/mlx5: Lag, avoid lockdep warnings
+
+From: Eli Cohen <elic@nvidia.com>
+
+[ Upstream commit 0d4e8ed139d871fcb2844dd71075997753baeec8 ]
+
+ldev->lock is used to serialize lag change operations. Since multiport
+eswtich functionality was added, we now change the mode dynamically.
+However, acquiring ldev->lock is not allowed as it could possibly lead
+to a deadlock as reported by the lockdep mechanism.
+
+[ 836.154963] WARNING: possible circular locking dependency detected
+[ 836.155850] 5.19.0-rc5_net_56b7df2 #1 Not tainted
+[ 836.156549] ------------------------------------------------------
+[ 836.157418] handler1/12198 is trying to acquire lock:
+[ 836.158178] ffff888187d52b58 (&ldev->lock){+.+.}-{3:3}, at: mlx5_lag_do_mirred+0x3b/0x70 [mlx5_core]
+[ 836.159575]
+[ 836.159575] but task is already holding lock:
+[ 836.160474] ffff8881d4de2930 (&block->cb_lock){++++}-{3:3}, at: tc_setup_cb_add+0x5b/0x200
+[ 836.161669] which lock already depends on the new lock.
+[ 836.162905]
+[ 836.162905] the existing dependency chain (in reverse order) is:
+[ 836.164008] -> #3 (&block->cb_lock){++++}-{3:3}:
+[ 836.164946] down_write+0x25/0x60
+[ 836.165548] tcf_block_get_ext+0x1c6/0x5d0
+[ 836.166253] ingress_init+0x74/0xa0 [sch_ingress]
+[ 836.167028] qdisc_create.constprop.0+0x130/0x5e0
+[ 836.167805] tc_modify_qdisc+0x481/0x9f0
+[ 836.168490] rtnetlink_rcv_msg+0x16e/0x5a0
+[ 836.169189] netlink_rcv_skb+0x4e/0xf0
+[ 836.169861] netlink_unicast+0x190/0x250
+[ 836.170543] netlink_sendmsg+0x243/0x4b0
+[ 836.171226] sock_sendmsg+0x33/0x40
+[ 836.171860] ____sys_sendmsg+0x1d1/0x1f0
+[ 836.172535] ___sys_sendmsg+0xab/0xf0
+[ 836.173183] __sys_sendmsg+0x51/0x90
+[ 836.173836] do_syscall_64+0x3d/0x90
+[ 836.174471] entry_SYSCALL_64_after_hwframe+0x46/0xb0
+[ 836.175282]
+
+[ 836.175282] -> #2 (rtnl_mutex){+.+.}-{3:3}:
+[ 836.176190] __mutex_lock+0x6b/0xf80
+[ 836.176830] register_netdevice_notifier+0x21/0x120
+[ 836.177631] rtnetlink_init+0x2d/0x1e9
+[ 836.178289] netlink_proto_init+0x163/0x179
+[ 836.178994] do_one_initcall+0x63/0x300
+[ 836.179672] kernel_init_freeable+0x2cb/0x31b
+[ 836.180403] kernel_init+0x17/0x140
+[ 836.181035] ret_from_fork+0x1f/0x30
+
+ [ 836.181687] -> #1 (pernet_ops_rwsem){+.+.}-{3:3}:
+[ 836.182628] down_write+0x25/0x60
+[ 836.183235] unregister_netdevice_notifier+0x1c/0xb0
+[ 836.184029] mlx5_ib_roce_cleanup+0x94/0x120 [mlx5_ib]
+[ 836.184855] __mlx5_ib_remove+0x35/0x60 [mlx5_ib]
+[ 836.185637] mlx5_eswitch_unregister_vport_reps+0x22f/0x440 [mlx5_core]
+[ 836.186698] auxiliary_bus_remove+0x18/0x30
+[ 836.187409] device_release_driver_internal+0x1f6/0x270
+[ 836.188253] bus_remove_device+0xef/0x160
+[ 836.188939] device_del+0x18b/0x3f0
+[ 836.189562] mlx5_rescan_drivers_locked+0xd6/0x2d0 [mlx5_core]
+[ 836.190516] mlx5_lag_remove_devices+0x69/0xe0 [mlx5_core]
+[ 836.191414] mlx5_do_bond_work+0x441/0x620 [mlx5_core]
+[ 836.192278] process_one_work+0x25c/0x590
+[ 836.192963] worker_thread+0x4f/0x3d0
+[ 836.193609] kthread+0xcb/0xf0
+[ 836.194189] ret_from_fork+0x1f/0x30
+
+[ 836.194826] -> #0 (&ldev->lock){+.+.}-{3:3}:
+[ 836.195734] __lock_acquire+0x15b8/0x2a10
+[ 836.196426] lock_acquire+0xce/0x2d0
+[ 836.197057] __mutex_lock+0x6b/0xf80
+[ 836.197708] mlx5_lag_do_mirred+0x3b/0x70 [mlx5_core]
+[ 836.198575] tc_act_parse_mirred+0x25b/0x800 [mlx5_core]
+[ 836.199467] parse_tc_actions+0x168/0x5a0 [mlx5_core]
+[ 836.200340] __mlx5e_add_fdb_flow+0x263/0x480 [mlx5_core]
+[ 836.201241] mlx5e_configure_flower+0x8a0/0x1820 [mlx5_core]
+[ 836.202187] tc_setup_cb_add+0xd7/0x200
+[ 836.202856] fl_hw_replace_filter+0x14c/0x1f0 [cls_flower]
+[ 836.203739] fl_change+0xbbe/0x1730 [cls_flower]
+[ 836.204501] tc_new_tfilter+0x407/0xd90
+[ 836.205168] rtnetlink_rcv_msg+0x406/0x5a0
+[ 836.205877] netlink_rcv_skb+0x4e/0xf0
+[ 836.206535] netlink_unicast+0x190/0x250
+[ 836.207217] netlink_sendmsg+0x243/0x4b0
+[ 836.207915] sock_sendmsg+0x33/0x40
+[ 836.208538] ____sys_sendmsg+0x1d1/0x1f0
+[ 836.209219] ___sys_sendmsg+0xab/0xf0
+[ 836.209878] __sys_sendmsg+0x51/0x90
+[ 836.210510] do_syscall_64+0x3d/0x90
+[ 836.211137] entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+[ 836.211954] other info that might help us debug this:
+[ 836.213174] Chain exists of:
+[ 836.213174] &ldev->lock --> rtnl_mutex --> &block->cb_lock
+ 836.214650] Possible unsafe locking scenario:
+[ 836.214650]
+[ 836.215574] CPU0 CPU1
+[ 836.216255] ---- ----
+[ 836.216943] lock(&block->cb_lock);
+[ 836.217518] lock(rtnl_mutex);
+[ 836.218348] lock(&block->cb_lock);
+[ 836.219212] lock(&ldev->lock);
+[ 836.219758]
+[ 836.219758] *** DEADLOCK ***
+[ 836.219758]
+ [ 836.220747] 2 locks held by handler1/12198:
+[ 836.221390] #0: ffff8881d4de2930 (&block->cb_lock){++++}-{3:3}, at: tc_setup_cb_add+0x5b/0x200
+[ 836.222646] #1: ffff88810c9a92c0 (&esw->mode_lock){++++}-{3:3}, at: mlx5_esw_hold+0x39/0x50 [mlx5_core]
+
+[ 836.224063] stack backtrace:
+[ 836.224799] CPU: 6 PID: 12198 Comm: handler1 Not tainted 5.19.0-rc5_net_56b7df2 #1
+[ 836.225923] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+[ 836.227476] Call Trace:
+[ 836.227929] <TASK>
+[ 836.228332] dump_stack_lvl+0x57/0x7d
+[ 836.228924] check_noncircular+0x104/0x120
+[ 836.229562] __lock_acquire+0x15b8/0x2a10
+[ 836.230201] lock_acquire+0xce/0x2d0
+[ 836.230776] ? mlx5_lag_do_mirred+0x3b/0x70 [mlx5_core]
+[ 836.231614] ? find_held_lock+0x2b/0x80
+[ 836.232221] __mutex_lock+0x6b/0xf80
+[ 836.232799] ? mlx5_lag_do_mirred+0x3b/0x70 [mlx5_core]
+[ 836.233636] ? mlx5_lag_do_mirred+0x3b/0x70 [mlx5_core]
+[ 836.234451] ? xa_load+0xc3/0x190
+[ 836.234995] mlx5_lag_do_mirred+0x3b/0x70 [mlx5_core]
+[ 836.235803] tc_act_parse_mirred+0x25b/0x800 [mlx5_core]
+[ 836.236636] ? tc_act_can_offload_mirred+0x135/0x210 [mlx5_core]
+[ 836.237550] parse_tc_actions+0x168/0x5a0 [mlx5_core]
+[ 836.238364] __mlx5e_add_fdb_flow+0x263/0x480 [mlx5_core]
+[ 836.239202] mlx5e_configure_flower+0x8a0/0x1820 [mlx5_core]
+[ 836.240076] ? lock_acquire+0xce/0x2d0
+[ 836.240668] ? tc_setup_cb_add+0x5b/0x200
+[ 836.241294] tc_setup_cb_add+0xd7/0x200
+[ 836.241917] fl_hw_replace_filter+0x14c/0x1f0 [cls_flower]
+[ 836.242709] fl_change+0xbbe/0x1730 [cls_flower]
+[ 836.243408] tc_new_tfilter+0x407/0xd90
+[ 836.244043] ? tc_del_tfilter+0x880/0x880
+[ 836.244672] rtnetlink_rcv_msg+0x406/0x5a0
+[ 836.245310] ? netlink_deliver_tap+0x7a/0x4b0
+[ 836.245991] ? if_nlmsg_stats_size+0x2b0/0x2b0
+[ 836.246675] netlink_rcv_skb+0x4e/0xf0
+[ 836.258046] netlink_unicast+0x190/0x250
+[ 836.258669] netlink_sendmsg+0x243/0x4b0
+[ 836.259288] sock_sendmsg+0x33/0x40
+[ 836.259857] ____sys_sendmsg+0x1d1/0x1f0
+[ 836.260473] ___sys_sendmsg+0xab/0xf0
+[ 836.261064] ? lock_acquire+0xce/0x2d0
+[ 836.261669] ? find_held_lock+0x2b/0x80
+[ 836.262272] ? __fget_files+0xb9/0x190
+[ 836.262871] ? __fget_files+0xd3/0x190
+[ 836.263462] __sys_sendmsg+0x51/0x90
+[ 836.264064] do_syscall_64+0x3d/0x90
+[ 836.264652] entry_SYSCALL_64_after_hwframe+0x46/0xb0
+[ 836.265425] RIP: 0033:0x7fdbe5e2677d
+
+[ 836.266012] Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 ba ee
+ff ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f
+05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 ee ee ff ff 48
+[ 836.268485] RSP: 002b:00007fdbe48a75a0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e
+[ 836.269598] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fdbe5e2677d
+[ 836.270576] RDX: 0000000000000000 RSI: 00007fdbe48a7640 RDI: 000000000000003c
+[ 836.271565] RBP: 00007fdbe48a8368 R08: 0000000000000000 R09: 0000000000000000
+[ 836.272546] R10: 00007fdbe48a84b0 R11: 0000000000000293 R12: 0000557bd17dc860
+[ 836.273527] R13: 0000000000000000 R14: 0000557bd17dc860 R15: 00007fdbe48a7640
+
+[ 836.274521] </TASK>
+
+To avoid using mode holding ldev->lock in the configure flow, we queue a
+work to the lag workqueue and cease wait on a completion object.
+
+In addition, we remove the lock from mlx5_lag_do_mirred() since it is
+not really protecting anything.
+
+It should be noted that an actual deadlock has not been observed.
+
+Signed-off-by: Eli Cohen <elic@nvidia.com>
+Reviewed-by: Mark Bloch <mbloch@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlx5/core/lag/lag.c | 3 +-
+ .../net/ethernet/mellanox/mlx5/core/lag/lag.h | 14 ++-
+ .../ethernet/mellanox/mlx5/core/lag/mpesw.c | 100 +++++++++++-------
+ .../ethernet/mellanox/mlx5/core/lag/mpesw.h | 1 -
+ 4 files changed, 78 insertions(+), 40 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
+index 48f86e12f5c0..bbe810f3b373 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c
+@@ -201,9 +201,8 @@ static void mlx5_ldev_free(struct kref *ref)
+ if (ldev->nb.notifier_call)
+ unregister_netdevice_notifier_net(&init_net, &ldev->nb);
+ mlx5_lag_mp_cleanup(ldev);
+- mlx5_lag_mpesw_cleanup(ldev);
+- cancel_work_sync(&ldev->mpesw_work);
+ destroy_workqueue(ldev->wq);
++ mlx5_lag_mpesw_cleanup(ldev);
+ mutex_destroy(&ldev->lock);
+ kfree(ldev);
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.h b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.h
+index ce2ce8ccbd70..f30ac2de639f 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.h
+@@ -50,6 +50,19 @@ struct lag_tracker {
+ enum netdev_lag_hash hash_type;
+ };
+
++enum mpesw_op {
++ MLX5_MPESW_OP_ENABLE,
++ MLX5_MPESW_OP_DISABLE,
++};
++
++struct mlx5_mpesw_work_st {
++ struct work_struct work;
++ struct mlx5_lag *lag;
++ enum mpesw_op op;
++ struct completion comp;
++ int result;
++};
++
+ /* LAG data of a ConnectX card.
+ * It serves both its phys functions.
+ */
+@@ -66,7 +79,6 @@ struct mlx5_lag {
+ struct lag_tracker tracker;
+ struct workqueue_struct *wq;
+ struct delayed_work bond_work;
+- struct work_struct mpesw_work;
+ struct notifier_block nb;
+ struct lag_mp lag_mp;
+ struct mlx5_lag_port_sel port_sel;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c
+index f643202b29c6..c17e8f1ec914 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c
+@@ -7,63 +7,95 @@
+ #include "eswitch.h"
+ #include "lib/mlx5.h"
+
+-void mlx5_mpesw_work(struct work_struct *work)
++static int add_mpesw_rule(struct mlx5_lag *ldev)
+ {
+- struct mlx5_lag *ldev = container_of(work, struct mlx5_lag, mpesw_work);
++ struct mlx5_core_dev *dev = ldev->pf[MLX5_LAG_P1].dev;
++ int err;
+
+- mutex_lock(&ldev->lock);
+- mlx5_disable_lag(ldev);
+- mutex_unlock(&ldev->lock);
+-}
++ if (atomic_add_return(1, &ldev->lag_mpesw.mpesw_rule_count) != 1)
++ return 0;
+
+-static void mlx5_lag_disable_mpesw(struct mlx5_core_dev *dev)
+-{
+- struct mlx5_lag *ldev = dev->priv.lag;
++ if (ldev->mode != MLX5_LAG_MODE_NONE) {
++ err = -EINVAL;
++ goto out_err;
++ }
+
+- if (!queue_work(ldev->wq, &ldev->mpesw_work))
+- mlx5_core_warn(dev, "failed to queue work\n");
++ err = mlx5_activate_lag(ldev, NULL, MLX5_LAG_MODE_MPESW, false);
++ if (err) {
++ mlx5_core_warn(dev, "Failed to create LAG in MPESW mode (%d)\n", err);
++ goto out_err;
++ }
++
++ return 0;
++
++out_err:
++ atomic_dec(&ldev->lag_mpesw.mpesw_rule_count);
++ return err;
+ }
+
+-void mlx5_lag_del_mpesw_rule(struct mlx5_core_dev *dev)
++static void del_mpesw_rule(struct mlx5_lag *ldev)
+ {
+- struct mlx5_lag *ldev = dev->priv.lag;
++ if (!atomic_dec_return(&ldev->lag_mpesw.mpesw_rule_count) &&
++ ldev->mode == MLX5_LAG_MODE_MPESW)
++ mlx5_disable_lag(ldev);
++}
+
+- if (!ldev)
+- return;
++static void mlx5_mpesw_work(struct work_struct *work)
++{
++ struct mlx5_mpesw_work_st *mpesww = container_of(work, struct mlx5_mpesw_work_st, work);
++ struct mlx5_lag *ldev = mpesww->lag;
+
+ mutex_lock(&ldev->lock);
+- if (!atomic_dec_return(&ldev->lag_mpesw.mpesw_rule_count) &&
+- ldev->mode == MLX5_LAG_MODE_MPESW)
+- mlx5_lag_disable_mpesw(dev);
++ if (mpesww->op == MLX5_MPESW_OP_ENABLE)
++ mpesww->result = add_mpesw_rule(ldev);
++ else if (mpesww->op == MLX5_MPESW_OP_DISABLE)
++ del_mpesw_rule(ldev);
+ mutex_unlock(&ldev->lock);
++
++ complete(&mpesww->comp);
+ }
+
+-int mlx5_lag_add_mpesw_rule(struct mlx5_core_dev *dev)
++static int mlx5_lag_mpesw_queue_work(struct mlx5_core_dev *dev,
++ enum mpesw_op op)
+ {
+ struct mlx5_lag *ldev = dev->priv.lag;
++ struct mlx5_mpesw_work_st *work;
+ int err = 0;
+
+ if (!ldev)
+ return 0;
+
+- mutex_lock(&ldev->lock);
+- if (atomic_add_return(1, &ldev->lag_mpesw.mpesw_rule_count) != 1)
+- goto out;
++ work = kzalloc(sizeof(*work), GFP_KERNEL);
++ if (!work)
++ return -ENOMEM;
+
+- if (ldev->mode != MLX5_LAG_MODE_NONE) {
++ INIT_WORK(&work->work, mlx5_mpesw_work);
++ init_completion(&work->comp);
++ work->op = op;
++ work->lag = ldev;
++
++ if (!queue_work(ldev->wq, &work->work)) {
++ mlx5_core_warn(dev, "failed to queue mpesw work\n");
+ err = -EINVAL;
+ goto out;
+ }
+-
+- err = mlx5_activate_lag(ldev, NULL, MLX5_LAG_MODE_MPESW, false);
+- if (err)
+- mlx5_core_warn(dev, "Failed to create LAG in MPESW mode (%d)\n", err);
+-
++ wait_for_completion(&work->comp);
++ err = work->result;
+ out:
+- mutex_unlock(&ldev->lock);
++ kfree(work);
+ return err;
+ }
+
++void mlx5_lag_del_mpesw_rule(struct mlx5_core_dev *dev)
++{
++ mlx5_lag_mpesw_queue_work(dev, MLX5_MPESW_OP_DISABLE);
++}
++
++int mlx5_lag_add_mpesw_rule(struct mlx5_core_dev *dev)
++{
++ return mlx5_lag_mpesw_queue_work(dev, MLX5_MPESW_OP_ENABLE);
++}
++
+ int mlx5_lag_do_mirred(struct mlx5_core_dev *mdev, struct net_device *out_dev)
+ {
+ struct mlx5_lag *ldev = mdev->priv.lag;
+@@ -71,12 +103,9 @@ int mlx5_lag_do_mirred(struct mlx5_core_dev *mdev, struct net_device *out_dev)
+ if (!netif_is_bond_master(out_dev) || !ldev)
+ return 0;
+
+- mutex_lock(&ldev->lock);
+- if (ldev->mode == MLX5_LAG_MODE_MPESW) {
+- mutex_unlock(&ldev->lock);
++ if (ldev->mode == MLX5_LAG_MODE_MPESW)
+ return -EOPNOTSUPP;
+- }
+- mutex_unlock(&ldev->lock);
++
+ return 0;
+ }
+
+@@ -90,11 +119,10 @@ bool mlx5_lag_mpesw_is_activated(struct mlx5_core_dev *dev)
+
+ void mlx5_lag_mpesw_init(struct mlx5_lag *ldev)
+ {
+- INIT_WORK(&ldev->mpesw_work, mlx5_mpesw_work);
+ atomic_set(&ldev->lag_mpesw.mpesw_rule_count, 0);
+ }
+
+ void mlx5_lag_mpesw_cleanup(struct mlx5_lag *ldev)
+ {
+- cancel_delayed_work_sync(&ldev->bond_work);
++ WARN_ON(atomic_read(&ldev->lag_mpesw.mpesw_rule_count));
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.h b/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.h
+index be4abcb8fcd5..88e8daffcf92 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.h
+@@ -12,7 +12,6 @@ struct lag_mpesw {
+ atomic_t mpesw_rule_count;
+ };
+
+-void mlx5_mpesw_work(struct work_struct *work);
+ int mlx5_lag_do_mirred(struct mlx5_core_dev *mdev, struct net_device *out_dev);
+ bool mlx5_lag_mpesw_is_activated(struct mlx5_core_dev *dev);
+ #if IS_ENABLED(CONFIG_MLX5_ESWITCH)
+--
+2.35.1
+
--- /dev/null
+From a48c0b2e5a296e24be87e73cf20f2b4803a4c209 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Nov 2022 13:54:55 +0100
+Subject: net: usb: qmi_wwan: add u-blox 0x1342 composition
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Davide Tronchin <davide.tronchin.94@gmail.com>
+
+[ Upstream commit a487069e11b6527373f7c6f435d8998051d0b5d9 ]
+
+Add RmNet support for LARA-L6.
+
+LARA-L6 module can be configured (by AT interface) in three different
+USB modes:
+* Default mode (Vendor ID: 0x1546 Product ID: 0x1341) with 4 serial
+interfaces
+* RmNet mode (Vendor ID: 0x1546 Product ID: 0x1342) with 4 serial
+interfaces and 1 RmNet virtual network interface
+* CDC-ECM mode (Vendor ID: 0x1546 Product ID: 0x1343) with 4 serial
+interface and 1 CDC-ECM virtual network interface
+
+In RmNet mode LARA-L6 exposes the following interfaces:
+If 0: Diagnostic
+If 1: AT parser
+If 2: AT parser
+If 3: AT parset/alternative functions
+If 4: RMNET interface
+
+Signed-off-by: Davide Tronchin <davide.tronchin.94@gmail.com>
+Acked-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/qmi_wwan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index afd6faa4c2ec..554d4e2a84a4 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1423,6 +1423,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x0489, 0xe0b4, 0)}, /* Foxconn T77W968 LTE */
+ {QMI_FIXED_INTF(0x0489, 0xe0b5, 0)}, /* Foxconn T77W968 LTE with eSIM support*/
+ {QMI_FIXED_INTF(0x2692, 0x9025, 4)}, /* Cellient MPL200 (rebranded Qualcomm 05c6:9025) */
++ {QMI_QUIRK_SET_DTR(0x1546, 0x1342, 4)}, /* u-blox LARA-L6 */
+
+ /* 4. Gobi 1000 devices */
+ {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */
+--
+2.35.1
+
--- /dev/null
+From 8a7f61a0712c766462df741423569dafcf0e8b6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Aug 2022 21:27:53 +1200
+Subject: platform/x86: asus-wmi: Add support for ROG X13 tablet mode
+
+From: Luke D. Jones <luke@ljones.dev>
+
+[ Upstream commit e397c3c460bf3849384f2f55516d1887617cfca9 ]
+
+Add quirk for ASUS ROG X13 Flow 2-in-1 to enable tablet mode with
+lid flip (all screen rotations).
+
+Signed-off-by: Luke D. Jones <luke@ljones.dev>
+Link: https://lore.kernel.org/r/20220813092753.6635-2-luke@ljones.dev
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/asus-nb-wmi.c | 15 +++++++++
+ drivers/platform/x86/asus-wmi.c | 37 ++++++++++++++++++++++
+ drivers/platform/x86/asus-wmi.h | 1 +
+ include/linux/platform_data/x86/asus-wmi.h | 1 +
+ 4 files changed, 54 insertions(+)
+
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
+index 4672a2b8322e..d9e7cf6e4a0e 100644
+--- a/drivers/platform/x86/asus-nb-wmi.c
++++ b/drivers/platform/x86/asus-nb-wmi.c
+@@ -123,6 +123,11 @@ static struct quirk_entry quirk_asus_use_lid_flip_devid = {
+ .tablet_switch_mode = asus_wmi_lid_flip_devid,
+ };
+
++static struct quirk_entry quirk_asus_tablet_mode = {
++ .wmi_backlight_set_devstate = true,
++ .tablet_switch_mode = asus_wmi_lid_flip_rog_devid,
++};
++
+ static int dmi_matched(const struct dmi_system_id *dmi)
+ {
+ pr_info("Identified laptop model '%s'\n", dmi->ident);
+@@ -471,6 +476,15 @@ static const struct dmi_system_id asus_quirks[] = {
+ },
+ .driver_data = &quirk_asus_use_lid_flip_devid,
+ },
++ {
++ .callback = dmi_matched,
++ .ident = "ASUS ROG FLOW X13",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "GV301Q"),
++ },
++ .driver_data = &quirk_asus_tablet_mode,
++ },
+ {},
+ };
+
+@@ -578,6 +592,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = {
+ { KE_KEY, 0xC5, { KEY_KBDILLUMDOWN } },
+ { KE_IGNORE, 0xC6, }, /* Ambient Light Sensor notification */
+ { KE_KEY, 0xFA, { KEY_PROG2 } }, /* Lid flip action */
++ { KE_KEY, 0xBD, { KEY_PROG2 } }, /* Lid flip action on ROG xflow laptops */
+ { KE_END, 0},
+ };
+
+diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
+index 26f75c984448..dce93187e11f 100644
+--- a/drivers/platform/x86/asus-wmi.c
++++ b/drivers/platform/x86/asus-wmi.c
+@@ -68,6 +68,7 @@ module_param(fnlock_default, bool, 0444);
+ #define NOTIFY_KBD_FBM 0x99
+ #define NOTIFY_KBD_TTP 0xae
+ #define NOTIFY_LID_FLIP 0xfa
++#define NOTIFY_LID_FLIP_ROG 0xbd
+
+ #define ASUS_WMI_FNLOCK_BIOS_DISABLED BIT(0)
+
+@@ -533,6 +534,19 @@ static int asus_wmi_input_init(struct asus_wmi *asus)
+ dev_err(dev, "Error checking for lid-flip: %d\n", result);
+ }
+ break;
++ case asus_wmi_lid_flip_rog_devid:
++ result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP_ROG);
++ if (result < 0)
++ asus->driver->quirks->tablet_switch_mode = asus_wmi_no_tablet_switch;
++ if (result >= 0) {
++ input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE);
++ input_report_switch(asus->inputdev, SW_TABLET_MODE, result);
++ } else if (result == -ENODEV) {
++ dev_err(dev, "This device has lid-flip-rog quirk but got ENODEV checking it. This is a bug.");
++ } else {
++ dev_err(dev, "Error checking for lid-flip: %d\n", result);
++ }
++ break;
+ }
+
+ err = input_register_device(asus->inputdev);
+@@ -567,6 +581,17 @@ static void lid_flip_tablet_mode_get_state(struct asus_wmi *asus)
+ }
+ }
+
++static void lid_flip_rog_tablet_mode_get_state(struct asus_wmi *asus)
++{
++ int result;
++
++ result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP_ROG);
++ if (result >= 0) {
++ input_report_switch(asus->inputdev, SW_TABLET_MODE, result);
++ input_sync(asus->inputdev);
++ }
++}
++
+ /* dGPU ********************************************************************/
+ static int dgpu_disable_check_present(struct asus_wmi *asus)
+ {
+@@ -3134,6 +3159,12 @@ static void asus_wmi_handle_event_code(int code, struct asus_wmi *asus)
+ return;
+ }
+
++ if (asus->driver->quirks->tablet_switch_mode == asus_wmi_lid_flip_rog_devid &&
++ code == NOTIFY_LID_FLIP_ROG) {
++ lid_flip_rog_tablet_mode_get_state(asus);
++ return;
++ }
++
+ if (asus->fan_boost_mode_available && code == NOTIFY_KBD_FBM) {
+ fan_boost_mode_switch_next(asus);
+ return;
+@@ -3773,6 +3804,9 @@ static int asus_hotk_resume(struct device *device)
+ case asus_wmi_lid_flip_devid:
+ lid_flip_tablet_mode_get_state(asus);
+ break;
++ case asus_wmi_lid_flip_rog_devid:
++ lid_flip_rog_tablet_mode_get_state(asus);
++ break;
+ }
+
+ return 0;
+@@ -3821,6 +3855,9 @@ static int asus_hotk_restore(struct device *device)
+ case asus_wmi_lid_flip_devid:
+ lid_flip_tablet_mode_get_state(asus);
+ break;
++ case asus_wmi_lid_flip_rog_devid:
++ lid_flip_rog_tablet_mode_get_state(asus);
++ break;
+ }
+
+ return 0;
+diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h
+index 413920bad0c6..0187f13d2414 100644
+--- a/drivers/platform/x86/asus-wmi.h
++++ b/drivers/platform/x86/asus-wmi.h
+@@ -29,6 +29,7 @@ enum asus_wmi_tablet_switch_mode {
+ asus_wmi_no_tablet_switch,
+ asus_wmi_kbd_dock_devid,
+ asus_wmi_lid_flip_devid,
++ asus_wmi_lid_flip_rog_devid,
+ };
+
+ struct quirk_entry {
+diff --git a/include/linux/platform_data/x86/asus-wmi.h b/include/linux/platform_data/x86/asus-wmi.h
+index 98f2b2f20f3e..7c96db7f3060 100644
+--- a/include/linux/platform_data/x86/asus-wmi.h
++++ b/include/linux/platform_data/x86/asus-wmi.h
+@@ -65,6 +65,7 @@
+ #define ASUS_WMI_DEVID_PANEL_OD 0x00050019
+ #define ASUS_WMI_DEVID_CAMERA 0x00060013
+ #define ASUS_WMI_DEVID_LID_FLIP 0x00060062
++#define ASUS_WMI_DEVID_LID_FLIP_ROG 0x00060077
+
+ /* Storage */
+ #define ASUS_WMI_DEVID_CARDREADER 0x00080013
+--
+2.35.1
+
--- /dev/null
+From 95cfe2982e75b8301b6406e38f76775a5ea6456d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Aug 2022 21:27:52 +1200
+Subject: platform/x86: asus-wmi: Adjust tablet/lidflip handling to use enum
+
+From: Luke D. Jones <luke@ljones.dev>
+
+[ Upstream commit 00aa846955fbfb04f7bc0c26c49febfe5395eca1 ]
+
+Due to multiple types of tablet/lidflip, the existing code for
+handling these events is refactored to use an enum for each type.
+
+Signed-off-by: Luke D. Jones <luke@ljones.dev>
+Link: https://lore.kernel.org/r/20220813092753.6635-1-luke@ljones.dev
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Stable-dep-of: e397c3c460bf ("platform/x86: asus-wmi: Add support for ROG X13 tablet mode")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/asus-nb-wmi.c | 13 +++-----
+ drivers/platform/x86/asus-wmi.c | 49 +++++++++++++++++++++---------
+ drivers/platform/x86/asus-wmi.h | 9 ++++--
+ 3 files changed, 47 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
+index 478dd300b9c9..4672a2b8322e 100644
+--- a/drivers/platform/x86/asus-nb-wmi.c
++++ b/drivers/platform/x86/asus-nb-wmi.c
+@@ -115,12 +115,12 @@ static struct quirk_entry quirk_asus_forceals = {
+ };
+
+ static struct quirk_entry quirk_asus_use_kbd_dock_devid = {
+- .use_kbd_dock_devid = true,
++ .tablet_switch_mode = asus_wmi_kbd_dock_devid,
+ };
+
+ static struct quirk_entry quirk_asus_use_lid_flip_devid = {
+ .wmi_backlight_set_devstate = true,
+- .use_lid_flip_devid = true,
++ .tablet_switch_mode = asus_wmi_lid_flip_devid,
+ };
+
+ static int dmi_matched(const struct dmi_system_id *dmi)
+@@ -492,16 +492,13 @@ static void asus_nb_wmi_quirks(struct asus_wmi_driver *driver)
+
+ switch (tablet_mode_sw) {
+ case 0:
+- quirks->use_kbd_dock_devid = false;
+- quirks->use_lid_flip_devid = false;
++ quirks->tablet_switch_mode = asus_wmi_no_tablet_switch;
+ break;
+ case 1:
+- quirks->use_kbd_dock_devid = true;
+- quirks->use_lid_flip_devid = false;
++ quirks->tablet_switch_mode = asus_wmi_kbd_dock_devid;
+ break;
+ case 2:
+- quirks->use_kbd_dock_devid = false;
+- quirks->use_lid_flip_devid = true;
++ quirks->tablet_switch_mode = asus_wmi_lid_flip_devid;
+ break;
+ }
+
+diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
+index 8e1979b477a7..26f75c984448 100644
+--- a/drivers/platform/x86/asus-wmi.c
++++ b/drivers/platform/x86/asus-wmi.c
+@@ -489,8 +489,11 @@ static bool asus_wmi_dev_is_present(struct asus_wmi *asus, u32 dev_id)
+
+ static int asus_wmi_input_init(struct asus_wmi *asus)
+ {
++ struct device *dev;
+ int err, result;
+
++ dev = &asus->platform_device->dev;
++
+ asus->inputdev = input_allocate_device();
+ if (!asus->inputdev)
+ return -ENOMEM;
+@@ -498,35 +501,38 @@ static int asus_wmi_input_init(struct asus_wmi *asus)
+ asus->inputdev->name = asus->driver->input_name;
+ asus->inputdev->phys = asus->driver->input_phys;
+ asus->inputdev->id.bustype = BUS_HOST;
+- asus->inputdev->dev.parent = &asus->platform_device->dev;
++ asus->inputdev->dev.parent = dev;
+ set_bit(EV_REP, asus->inputdev->evbit);
+
+ err = sparse_keymap_setup(asus->inputdev, asus->driver->keymap, NULL);
+ if (err)
+ goto err_free_dev;
+
+- if (asus->driver->quirks->use_kbd_dock_devid) {
++ switch (asus->driver->quirks->tablet_switch_mode) {
++ case asus_wmi_no_tablet_switch:
++ break;
++ case asus_wmi_kbd_dock_devid:
+ result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_KBD_DOCK);
+ if (result >= 0) {
+ input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE);
+ input_report_switch(asus->inputdev, SW_TABLET_MODE, !result);
+ } else if (result != -ENODEV) {
+- pr_err("Error checking for keyboard-dock: %d\n", result);
++ dev_err(dev, "Error checking for keyboard-dock: %d\n", result);
+ }
+- }
+-
+- if (asus->driver->quirks->use_lid_flip_devid) {
++ break;
++ case asus_wmi_lid_flip_devid:
+ result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP);
+ if (result < 0)
+- asus->driver->quirks->use_lid_flip_devid = 0;
++ asus->driver->quirks->tablet_switch_mode = asus_wmi_no_tablet_switch;
+ if (result >= 0) {
+ input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE);
+ input_report_switch(asus->inputdev, SW_TABLET_MODE, result);
+ } else if (result == -ENODEV) {
+- pr_err("This device has lid_flip quirk but got ENODEV checking it. This is a bug.");
++ dev_err(dev, "This device has lid_flip quirk but got ENODEV checking it. This is a bug.");
+ } else {
+- pr_err("Error checking for lid-flip: %d\n", result);
++ dev_err(dev, "Error checking for lid-flip: %d\n", result);
+ }
++ break;
+ }
+
+ err = input_register_device(asus->inputdev);
+@@ -552,8 +558,9 @@ static void asus_wmi_input_exit(struct asus_wmi *asus)
+
+ static void lid_flip_tablet_mode_get_state(struct asus_wmi *asus)
+ {
+- int result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP);
++ int result;
+
++ result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_LID_FLIP);
+ if (result >= 0) {
+ input_report_switch(asus->inputdev, SW_TABLET_MODE, result);
+ input_sync(asus->inputdev);
+@@ -3109,7 +3116,8 @@ static void asus_wmi_handle_event_code(int code, struct asus_wmi *asus)
+ return;
+ }
+
+- if (asus->driver->quirks->use_kbd_dock_devid && code == NOTIFY_KBD_DOCK_CHANGE) {
++ if (asus->driver->quirks->tablet_switch_mode == asus_wmi_kbd_dock_devid &&
++ code == NOTIFY_KBD_DOCK_CHANGE) {
+ result = asus_wmi_get_devstate_simple(asus,
+ ASUS_WMI_DEVID_KBD_DOCK);
+ if (result >= 0) {
+@@ -3120,7 +3128,8 @@ static void asus_wmi_handle_event_code(int code, struct asus_wmi *asus)
+ return;
+ }
+
+- if (asus->driver->quirks->use_lid_flip_devid && code == NOTIFY_LID_FLIP) {
++ if (asus->driver->quirks->tablet_switch_mode == asus_wmi_lid_flip_devid &&
++ code == NOTIFY_LID_FLIP) {
+ lid_flip_tablet_mode_get_state(asus);
+ return;
+ }
+@@ -3757,8 +3766,14 @@ static int asus_hotk_resume(struct device *device)
+ if (asus_wmi_has_fnlock_key(asus))
+ asus_wmi_fnlock_update(asus);
+
+- if (asus->driver->quirks->use_lid_flip_devid)
++ switch (asus->driver->quirks->tablet_switch_mode) {
++ case asus_wmi_no_tablet_switch:
++ case asus_wmi_kbd_dock_devid:
++ break;
++ case asus_wmi_lid_flip_devid:
+ lid_flip_tablet_mode_get_state(asus);
++ break;
++ }
+
+ return 0;
+ }
+@@ -3799,8 +3814,14 @@ static int asus_hotk_restore(struct device *device)
+ if (asus_wmi_has_fnlock_key(asus))
+ asus_wmi_fnlock_update(asus);
+
+- if (asus->driver->quirks->use_lid_flip_devid)
++ switch (asus->driver->quirks->tablet_switch_mode) {
++ case asus_wmi_no_tablet_switch:
++ case asus_wmi_kbd_dock_devid:
++ break;
++ case asus_wmi_lid_flip_devid:
+ lid_flip_tablet_mode_get_state(asus);
++ break;
++ }
+
+ return 0;
+ }
+diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h
+index b302415bf1d9..413920bad0c6 100644
+--- a/drivers/platform/x86/asus-wmi.h
++++ b/drivers/platform/x86/asus-wmi.h
+@@ -25,6 +25,12 @@ struct module;
+ struct key_entry;
+ struct asus_wmi;
+
++enum asus_wmi_tablet_switch_mode {
++ asus_wmi_no_tablet_switch,
++ asus_wmi_kbd_dock_devid,
++ asus_wmi_lid_flip_devid,
++};
++
+ struct quirk_entry {
+ bool hotplug_wireless;
+ bool scalar_panel_brightness;
+@@ -33,8 +39,7 @@ struct quirk_entry {
+ bool wmi_backlight_native;
+ bool wmi_backlight_set_devstate;
+ bool wmi_force_als_set;
+- bool use_kbd_dock_devid;
+- bool use_lid_flip_devid;
++ enum asus_wmi_tablet_switch_mode tablet_switch_mode;
+ int wapf;
+ /*
+ * For machines with AMD graphic chips, it will send out WMI event
+--
+2.35.1
+
--- /dev/null
+From 7c9bb18a4a4b2f5082660c8a16089f9cef4206bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Nov 2022 14:10:35 +0100
+Subject: regulator: slg51000: Wait after asserting CS pin
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 0b24dfa587c6cc7484cfb170da5c7dd73451f670 ]
+
+Sony's downstream driver [1], among some other changes, adds a
+seemingly random 10ms usleep_range, which turned out to be necessary
+for the hardware to function properly on at least Sony Xperia 1 IV.
+Without this, I2C transactions with the SLG51000 straight up fail.
+
+Relax (10-10ms -> 10-11ms) and add the aforementioned sleep to make
+sure the hardware has some time to wake up.
+
+(nagara-2.0.0-mlc/vendor/semc/hardware/camera-kernel-module/)
+[1] https://developer.sony.com/file/download/open-source-archive-for-64-0-m-4-29/
+
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20221118131035.54874-1-konrad.dybcio@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/slg51000-regulator.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/regulator/slg51000-regulator.c b/drivers/regulator/slg51000-regulator.c
+index 75a941fb3c2b..1b2eee95ad3f 100644
+--- a/drivers/regulator/slg51000-regulator.c
++++ b/drivers/regulator/slg51000-regulator.c
+@@ -457,6 +457,8 @@ static int slg51000_i2c_probe(struct i2c_client *client)
+ chip->cs_gpiod = cs_gpiod;
+ }
+
++ usleep_range(10000, 11000);
++
+ i2c_set_clientdata(client, chip);
+ chip->chip_irq = client->irq;
+ chip->dev = dev;
+--
+2.35.1
+
--- /dev/null
+From cb7f0ca578a68e9b17cfd602b30a90f215d7d7dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Nov 2022 23:12:08 +0100
+Subject: regulator: twl6030: fix get status of twl6032 regulators
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit 31a6297b89aabc81b274c093a308a7f5b55081a7 ]
+
+Status is reported as always off in the 6032 case. Status
+reporting now matches the logic in the setters. Once of
+the differences to the 6030 is that there are no groups,
+therefore the state needs to be read out in the lower bits.
+
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Link: https://lore.kernel.org/r/20221120221208.3093727-3-andreas@kemnade.info
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/twl6030-regulator.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/regulator/twl6030-regulator.c b/drivers/regulator/twl6030-regulator.c
+index 7c7e3648ea4b..f3856750944f 100644
+--- a/drivers/regulator/twl6030-regulator.c
++++ b/drivers/regulator/twl6030-regulator.c
+@@ -67,6 +67,7 @@ struct twlreg_info {
+ #define TWL6030_CFG_STATE_SLEEP 0x03
+ #define TWL6030_CFG_STATE_GRP_SHIFT 5
+ #define TWL6030_CFG_STATE_APP_SHIFT 2
++#define TWL6030_CFG_STATE_MASK 0x03
+ #define TWL6030_CFG_STATE_APP_MASK (0x03 << TWL6030_CFG_STATE_APP_SHIFT)
+ #define TWL6030_CFG_STATE_APP(v) (((v) & TWL6030_CFG_STATE_APP_MASK) >>\
+ TWL6030_CFG_STATE_APP_SHIFT)
+@@ -128,13 +129,14 @@ static int twl6030reg_is_enabled(struct regulator_dev *rdev)
+ if (grp < 0)
+ return grp;
+ grp &= P1_GRP_6030;
++ val = twlreg_read(info, TWL_MODULE_PM_RECEIVER, VREG_STATE);
++ val = TWL6030_CFG_STATE_APP(val);
+ } else {
++ val = twlreg_read(info, TWL_MODULE_PM_RECEIVER, VREG_STATE);
++ val &= TWL6030_CFG_STATE_MASK;
+ grp = 1;
+ }
+
+- val = twlreg_read(info, TWL_MODULE_PM_RECEIVER, VREG_STATE);
+- val = TWL6030_CFG_STATE_APP(val);
+-
+ return grp && (val == TWL6030_CFG_STATE_ON);
+ }
+
+@@ -187,7 +189,12 @@ static int twl6030reg_get_status(struct regulator_dev *rdev)
+
+ val = twlreg_read(info, TWL_MODULE_PM_RECEIVER, VREG_STATE);
+
+- switch (TWL6030_CFG_STATE_APP(val)) {
++ if (info->features & TWL6032_SUBCLASS)
++ val &= TWL6030_CFG_STATE_MASK;
++ else
++ val = TWL6030_CFG_STATE_APP(val);
++
++ switch (val) {
+ case TWL6030_CFG_STATE_ON:
+ return REGULATOR_STATUS_NORMAL;
+
+--
+2.35.1
+
--- /dev/null
+From 3a2f7fc63430e869b49c05738eb23e7b95f6bfff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Oct 2022 08:32:39 +0200
+Subject: Revert "coresight: cti: Fix hang in cti_disable_hw()"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit d76308f03ee1574b0deffde45604252a51c77f6d ]
+
+This reverts commit 665c157e0204176023860b51a46528ba0ba62c33.
+
+It causes reported build warnings:
+
+drivers/hwtracing/coresight/coresight-cti-core.c: In functio
+n 'cti_enable_hw':
+drivers/hwtracing/coresight/coresight-cti-core.c:93:24: warning: unused variable 'dev' [-Wunused-variable]
+ 93 | struct device *dev = &drvdata->csdev->dev;
+ | ^~~
+drivers/hwtracing/coresight/coresight-cti-core.c: In function 'cti_disable_hw':
+drivers/hwtracing/coresight/coresight-cti-core.c:154:24: warning: unused variable 'dev' [-Wunused-variable]
+ 154 | struct device *dev = &drvdata->csdev->dev;
+ | ^~~
+
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Cc: Aishwarya TCV <Aishwarya.TCV@arm.com>
+Cc: Cristian Marussi <Cristian.Marussi@arm.com>
+Cc: Suzuki Poulose <Suzuki.Poulose@arm.com>
+Cc: James Clark <james.clark@arm.com>
+Cc: Mike Leach <mike.leach@linaro.org>
+Cc: Mike Leach <mike.leach@linaro.org>
+Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
+Fixes: 665c157e0204 ("coresight: cti: Fix hang in cti_disable_hw()")
+Link: https://lore.kernel.org/r/20221024135752.2b83af97@canb.auug.org.au
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-cti-core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/hwtracing/coresight/coresight-cti-core.c b/drivers/hwtracing/coresight/coresight-cti-core.c
+index dcd607a0c41a..5c2ebb5323a5 100644
+--- a/drivers/hwtracing/coresight/coresight-cti-core.c
++++ b/drivers/hwtracing/coresight/coresight-cti-core.c
+@@ -93,6 +93,7 @@ static int cti_enable_hw(struct cti_drvdata *drvdata)
+ unsigned long flags;
+ int rc = 0;
+
++ pm_runtime_get_sync(dev->parent);
+ spin_lock_irqsave(&drvdata->spinlock, flags);
+
+ /* no need to do anything if enabled or unpowered*/
+@@ -117,6 +118,7 @@ static int cti_enable_hw(struct cti_drvdata *drvdata)
+ /* cannot enable due to error */
+ cti_err_not_enabled:
+ spin_unlock_irqrestore(&drvdata->spinlock, flags);
++ pm_runtime_put(dev->parent);
+ return rc;
+ }
+
+@@ -171,6 +173,7 @@ static int cti_disable_hw(struct cti_drvdata *drvdata)
+ coresight_disclaim_device_unlocked(csdev);
+ CS_LOCK(drvdata->base);
+ spin_unlock(&drvdata->spinlock);
++ pm_runtime_put(dev->parent);
+ return 0;
+
+ /* not disabled this call */
+--
+2.35.1
+
--- /dev/null
+From 7323df77893c5cd5a5400b5dfca8512b9487b960 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Nov 2022 21:44:21 -0600
+Subject: selftests/net: Find nettest in current directory
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel DÃaz <daniel.diaz@linaro.org>
+
+[ Upstream commit bd5e1e42826f18147afb0ba07e6a815f52cf8bcb ]
+
+The `nettest` binary, built from `selftests/net/nettest.c`,
+was expected to be found in the path during test execution of
+`fcnal-test.sh` and `pmtu.sh`, leading to tests getting
+skipped when the binary is not installed in the system, as can
+be seen in these logs found in the wild [1]:
+
+ # TEST: vti4: PMTU exceptions [SKIP]
+ [ 350.600250] IPv6: ADDRCONF(NETDEV_CHANGE): veth_b: link becomes ready
+ [ 350.607421] IPv6: ADDRCONF(NETDEV_CHANGE): veth_a: link becomes ready
+ # 'nettest' command not found; skipping tests
+ # xfrm6udp not supported
+ # TEST: vti6: PMTU exceptions (ESP-in-UDP) [SKIP]
+ [ 351.605102] IPv6: ADDRCONF(NETDEV_CHANGE): veth_b: link becomes ready
+ [ 351.612243] IPv6: ADDRCONF(NETDEV_CHANGE): veth_a: link becomes ready
+ # 'nettest' command not found; skipping tests
+ # xfrm4udp not supported
+
+The `unicast_extensions.sh` tests also rely on `nettest`, but
+it runs fine there because it looks for the binary in the
+current working directory [2]:
+
+The same mechanism that works for the Unicast extensions tests
+is here copied over to the PMTU and functional tests.
+
+[1] https://lkft.validation.linaro.org/scheduler/job/5839508#L6221
+[2] https://lkft.validation.linaro.org/scheduler/job/5839508#L7958
+
+Signed-off-by: Daniel DÃaz <daniel.diaz@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fcnal-test.sh | 11 +++++++----
+ tools/testing/selftests/net/pmtu.sh | 10 ++++++----
+ 2 files changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
+index 31c3b6ebd388..21ca91473c09 100755
+--- a/tools/testing/selftests/net/fcnal-test.sh
++++ b/tools/testing/selftests/net/fcnal-test.sh
+@@ -4196,10 +4196,13 @@ elif [ "$TESTS" = "ipv6" ]; then
+ TESTS="$TESTS_IPV6"
+ fi
+
+-which nettest >/dev/null
+-if [ $? -ne 0 ]; then
+- echo "'nettest' command not found; skipping tests"
+- exit $ksft_skip
++# nettest can be run from PATH or from same directory as this selftest
++if ! which nettest >/dev/null; then
++ PATH=$PWD:$PATH
++ if ! which nettest >/dev/null; then
++ echo "'nettest' command not found; skipping tests"
++ exit $ksft_skip
++ fi
+ fi
+
+ declare -i nfail=0
+diff --git a/tools/testing/selftests/net/pmtu.sh b/tools/testing/selftests/net/pmtu.sh
+index 736e358dc549..dfe3d287f01d 100755
+--- a/tools/testing/selftests/net/pmtu.sh
++++ b/tools/testing/selftests/net/pmtu.sh
+@@ -686,10 +686,12 @@ setup_xfrm() {
+ }
+
+ setup_nettest_xfrm() {
+- which nettest >/dev/null
+- if [ $? -ne 0 ]; then
+- echo "'nettest' command not found; skipping tests"
+- return 1
++ if ! which nettest >/dev/null; then
++ PATH=$PWD:$PATH
++ if ! which nettest >/dev/null; then
++ echo "'nettest' command not found; skipping tests"
++ return 1
++ fi
+ fi
+
+ [ ${1} -eq 6 ] && proto="-6" || proto=""
+--
+2.35.1
+
--- /dev/null
+madvise-use-zap_page_range_single-for-madvise-dontne.patch
+drm-i915-remove-non-existent-pipes-from-bigjoiner-pi.patch
+arm64-dts-rockchip-fix-gmac-failure-of-rgmii-id-from.patch
+arm64-dts-rockchip-fix-i2c3-pinctrl-on-rk3566-roc-pc.patch
+arm64-dts-rockchip-remove-i2c5-from-rk3566-roc-pc.patch
+arm64-dts-rockchip-keep-i2s1-disabled-for-gpio-funct.patch
+arm64-dts-rockchip-fix-node-name-for-hym8563-rtc.patch
+arm-dts-rockchip-fix-node-name-for-hym8563-rtc.patch
+arm-dts-rockchip-remove-clock-frequency-from-rtc.patch
+arm-dts-rockchip-fix-adc-keys-sub-node-names.patch
+arm64-dts-rockchip-fix-adc-keys-sub-node-names.patch
+arm-dts-rockchip-fix-ir-receiver-node-names.patch
+arm64-dts-rockchip-fix-ir-receiver-node-names.patch
+arm-dts-rockchip-rk3188-fix-lcdc1-rgb24-node-name.patch
+fs-use-acquire-ordering-in-__fget_light.patch
+arm-9251-1-perf-fix-stacktraces-for-tracepoint-event.patch
+arm-9266-1-mm-fix-no-mmu-zero_page-implementation.patch
+asoc-wm8962-wait-for-updated-value-of-wm8962_clockin.patch
+spi-mediatek-fix-devapc-violation-at-ko-remove.patch
+arm-dts-rockchip-disable-arm_global_timer-on-rk3066-.patch
+asoc-rt711-sdca-fix-the-latency-time-of-clock-stop-p.patch
+9p-fd-use-p9_hdrsz-for-header-size.patch
+regulator-slg51000-wait-after-asserting-cs-pin.patch
+alsa-seq-fix-function-prototype-mismatch-in-snd_seq_.patch
+loongarch-makefile-use-grep-e-instead-of-egrep.patch
+loongarch-combine-acpi_boot_table_init-and-acpi_boot.patch
+loongarch-set-_page_dirty-only-if-_page_modified-is-.patch
+loongarch-fix-unsigned-comparison-with-less-than-zer.patch
+selftests-net-find-nettest-in-current-directory.patch
+btrfs-send-avoid-unaligned-encoded-writes-when-attem.patch
+net-mlx5-lag-avoid-lockdep-warnings.patch
+asoc-soc-pcm-add-null-check-in-be-reparenting.patch
+regulator-twl6030-fix-get-status-of-twl6032-regulato.patch
+fbcon-use-kzalloc-in-fbcon_prepare_logo.patch
+usb-dwc3-gadget-disable-gusb2phycfg.susphy-for-end-t.patch
+9p-xen-check-logical-size-for-buffer-size.patch
+net-usb-qmi_wwan-add-u-blox-0x1342-composition.patch
+drm-amd-display-use-viewport-height-for-subvp-mall-a.patch
+drm-amd-display-avoid-setting-pixel-rate-divider-to-.patch
+drm-amd-display-use-new-num-clk-levels-struct-for-ma.patch
+drm-amdgpu-fix-use-after-free-during-gpu-recovery.patch
+mm-khugepaged-take-the-right-locks-for-page-table-re.patch
+mm-khugepaged-fix-gup-fast-interaction-by-sending-ip.patch
+mm-khugepaged-invoke-mmu-notifiers-in-shmem-file-col.patch
+hugetlb-don-t-delete-vma_lock-in-hugetlb-madv_dontne.patch
+alsa-hda-realtek-more-robust-component-matching-for-.patch
+crypto-ccp-add-a-quirk-to-firmware-update.patch
+soundwire-dmi-quirks-add-remapping-for-hp-omen-16-k0.patch
+platform-x86-asus-wmi-adjust-tablet-lidflip-handling.patch
+platform-x86-asus-wmi-add-support-for-rog-x13-tablet.patch
+revert-coresight-cti-fix-hang-in-cti_disable_hw.patch
+xen-netback-ensure-protocol-headers-don-t-fall-in-th.patch
+xen-netback-don-t-call-kfree_skb-with-interrupts-dis.patch
+media-videobuf2-core-take-mmap_lock-in-vb2_get_unmap.patch
+fscache-fix-oops-due-to-race-with-cookie_lru-and-use.patch
--- /dev/null
+From be2c08999c7fa70afd1db67abde8f75237bbaeb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Aug 2022 11:09:19 +0800
+Subject: soundwire: dmi-quirks: add remapping for HP Omen 16-k0005TX
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit df55100551a34bddab02dff48d0296bda0659c02 ]
+
+The DSDT for this device has a number of problems:
+a) it lists rt711 on link0 and link1, but link1 is disabled
+b) the rt711 entry on link0 uses the wrong v2 instead of v3 (SDCA)
+c) the rt1316 amplifier on link3 is not listed.
+
+Add a remapping table to work-around these BIOS shenanigans.
+
+BugLink: https://github.com/thesofproject/sof/issues/5955
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://lore.kernel.org/r/20220823030919.2346629-1-yung-chuan.liao@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/dmi-quirks.c | 27 +++++++++++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+diff --git a/drivers/soundwire/dmi-quirks.c b/drivers/soundwire/dmi-quirks.c
+index 747983743a14..f81cdd83ec26 100644
+--- a/drivers/soundwire/dmi-quirks.c
++++ b/drivers/soundwire/dmi-quirks.c
+@@ -55,7 +55,26 @@ static const struct adr_remap dell_sku_0A3E[] = {
+ {}
+ };
+
++/*
++ * The HP Omen 16-k0005TX does not expose the correct version of RT711 on link0
++ * and does not expose a RT1316 on link3
++ */
++static const struct adr_remap hp_omen_16[] = {
++ /* rt711-sdca on link0 */
++ {
++ 0x000020025d071100ull,
++ 0x000030025d071101ull
++ },
++ /* rt1316-sdca on link3 */
++ {
++ 0x000120025d071100ull,
++ 0x000330025d131601ull
++ },
++ {}
++};
++
+ static const struct dmi_system_id adr_remap_quirk_table[] = {
++ /* TGL devices */
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "HP"),
+@@ -78,6 +97,14 @@ static const struct dmi_system_id adr_remap_quirk_table[] = {
+ },
+ .driver_data = (void *)dell_sku_0A3E,
+ },
++ /* ADL devices */
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "HP"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "OMEN by HP Gaming Laptop 16-k0xxx"),
++ },
++ .driver_data = (void *)hp_omen_16,
++ },
+ {}
+ };
+
+--
+2.35.1
+
--- /dev/null
+From be30cae9f7c1b24f49d3b77d563e4c677710bec3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Nov 2022 15:28:39 +0800
+Subject: spi: mediatek: Fix DEVAPC Violation at KO Remove
+
+From: Zhichao Liu <zhichao.liu@mediatek.com>
+
+[ Upstream commit 0d10e90cee9eb57882b0f7e19fd699033722e226 ]
+
+A DEVAPC violation occurs when removing the module
+due to accessing HW registers without base clock.
+To fix this bug, the correct method is:
+1. Call the runtime resume function to enable the
+ clock;
+2. Operate the registers to reset the HW;
+3. Turn off the clocks and disable the device
+ RPM mechanism.
+
+Signed-off-by: Zhichao Liu <zhichao.liu@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20221110072839.30961-1-zhichao.liu@mediatek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-mt65xx.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c
+index cd9dc358d396..a7cc96aeb590 100644
+--- a/drivers/spi/spi-mt65xx.c
++++ b/drivers/spi/spi-mt65xx.c
+@@ -1268,8 +1268,11 @@ static int mtk_spi_remove(struct platform_device *pdev)
+ {
+ struct spi_master *master = platform_get_drvdata(pdev);
+ struct mtk_spi *mdata = spi_master_get_devdata(master);
++ int ret;
+
+- pm_runtime_disable(&pdev->dev);
++ ret = pm_runtime_resume_and_get(&pdev->dev);
++ if (ret < 0)
++ return ret;
+
+ mtk_spi_reset(mdata);
+
+@@ -1278,6 +1281,9 @@ static int mtk_spi_remove(struct platform_device *pdev)
+ clk_unprepare(mdata->spi_hclk);
+ }
+
++ pm_runtime_put_noidle(&pdev->dev);
++ pm_runtime_disable(&pdev->dev);
++
+ return 0;
+ }
+
+--
+2.35.1
+
--- /dev/null
+From ed149c970acc9676b5e42d4d832be036d284d223 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Nov 2022 17:58:50 -0800
+Subject: usb: dwc3: gadget: Disable GUSB2PHYCFG.SUSPHY for End Transfer
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+[ Upstream commit 3aa07f72894d209fcf922ad686cbb28cf005aaad ]
+
+If there's a disconnection while operating in eSS, there may be a delay
+in VBUS drop response from the connector. In that case, the internal
+link state may drop to operate in usb2 speed while the controller thinks
+the VBUS is still high. The driver must make sure to disable
+GUSB2PHYCFG.SUSPHY when sending endpoint command while in usb2 speed.
+The End Transfer command may be called, and only that command needs to
+go through at this point. Let's keep it simple and unconditionally
+disable GUSB2PHYCFG.SUSPHY whenever we issue the command.
+
+This scenario is not seen in real hardware. In a rare case, our
+prototype type-c controller/interface may have a slow response
+triggerring this issue.
+
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/5651117207803c26e2f22ddf4e5ce9e865dcf7c7.1668045468.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/gadget.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 6f61a288073b..c2075b90f3df 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -291,7 +291,8 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned int cmd,
+ *
+ * DWC_usb3 3.30a and DWC_usb31 1.90a programming guide section 3.2.2
+ */
+- if (dwc->gadget->speed <= USB_SPEED_HIGH) {
++ if (dwc->gadget->speed <= USB_SPEED_HIGH ||
++ DWC3_DEPCMD_CMD(cmd) == DWC3_DEPCMD_ENDTRANSFER) {
+ reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
+ if (unlikely(reg & DWC3_GUSB2PHYCFG_SUSPHY)) {
+ saved_config |= DWC3_GUSB2PHYCFG_SUSPHY;
+--
+2.35.1
+
--- /dev/null
+From ce6e015e332e2e1531d86807ca128a7d18eea852 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Dec 2022 08:54:24 +0100
+Subject: xen/netback: don't call kfree_skb() with interrupts disabled
+
+From: Juergen Gross <jgross@suse.com>
+
+[ Upstream commit 74e7e1efdad45580cc3839f2a155174cf158f9b5 ]
+
+It is not allowed to call kfree_skb() from hardware interrupt
+context or with interrupts being disabled. So remove kfree_skb()
+from the spin_lock_irqsave() section and use the already existing
+"drop" label in xenvif_start_xmit() for dropping the SKB. At the
+same time replace the dev_kfree_skb() call there with a call of
+dev_kfree_skb_any(), as xenvif_start_xmit() can be called with
+disabled interrupts.
+
+This is XSA-424 / CVE-2022-42328 / CVE-2022-42329.
+
+Fixes: be81992f9086 ("xen/netback: don't queue unlimited number of packages")
+Reported-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/xen-netback/common.h | 2 +-
+ drivers/net/xen-netback/interface.c | 6 ++++--
+ drivers/net/xen-netback/rx.c | 8 +++++---
+ 3 files changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
+index 8174d7b2966c..adfd21aa5b6a 100644
+--- a/drivers/net/xen-netback/common.h
++++ b/drivers/net/xen-netback/common.h
+@@ -386,7 +386,7 @@ int xenvif_dealloc_kthread(void *data);
+ irqreturn_t xenvif_ctrl_irq_fn(int irq, void *data);
+
+ bool xenvif_have_rx_work(struct xenvif_queue *queue, bool test_kthread);
+-void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb);
++bool xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb);
+
+ void xenvif_carrier_on(struct xenvif *vif);
+
+diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
+index fb32ae82d9b0..d048a5cc918b 100644
+--- a/drivers/net/xen-netback/interface.c
++++ b/drivers/net/xen-netback/interface.c
+@@ -254,14 +254,16 @@ xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ if (vif->hash.alg == XEN_NETIF_CTRL_HASH_ALGORITHM_NONE)
+ skb_clear_hash(skb);
+
+- xenvif_rx_queue_tail(queue, skb);
++ if (!xenvif_rx_queue_tail(queue, skb))
++ goto drop;
++
+ xenvif_kick_thread(queue);
+
+ return NETDEV_TX_OK;
+
+ drop:
+ vif->dev->stats.tx_dropped++;
+- dev_kfree_skb(skb);
++ dev_kfree_skb_any(skb);
+ return NETDEV_TX_OK;
+ }
+
+diff --git a/drivers/net/xen-netback/rx.c b/drivers/net/xen-netback/rx.c
+index 932762177110..0ba754ebc5ba 100644
+--- a/drivers/net/xen-netback/rx.c
++++ b/drivers/net/xen-netback/rx.c
+@@ -82,9 +82,10 @@ static bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue)
+ return false;
+ }
+
+-void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb)
++bool xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb)
+ {
+ unsigned long flags;
++ bool ret = true;
+
+ spin_lock_irqsave(&queue->rx_queue.lock, flags);
+
+@@ -92,8 +93,7 @@ void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb)
+ struct net_device *dev = queue->vif->dev;
+
+ netif_tx_stop_queue(netdev_get_tx_queue(dev, queue->id));
+- kfree_skb(skb);
+- queue->vif->dev->stats.rx_dropped++;
++ ret = false;
+ } else {
+ if (skb_queue_empty(&queue->rx_queue))
+ xenvif_update_needed_slots(queue, skb);
+@@ -104,6 +104,8 @@ void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb)
+ }
+
+ spin_unlock_irqrestore(&queue->rx_queue.lock, flags);
++
++ return ret;
+ }
+
+ static struct sk_buff *xenvif_rx_dequeue(struct xenvif_queue *queue)
+--
+2.35.1
+
--- /dev/null
+From bb3442ef329aac4f76aba7acd27a13ce3bde81f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Nov 2022 09:16:59 +0000
+Subject: xen/netback: Ensure protocol headers don't fall in the non-linear
+ area
+
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+
+[ Upstream commit ad7f402ae4f466647c3a669b8a6f3e5d4271c84a ]
+
+In some cases, the frontend may send a packet where the protocol headers
+are spread across multiple slots. This would result in netback creating
+an skb where the protocol headers spill over into the non-linear area.
+Some drivers and NICs don't handle this properly resulting in an
+interface reset or worse.
+
+This issue was introduced by the removal of an unconditional skb pull in
+the tx path to improve performance. Fix this without reintroducing the
+pull by setting up grant copy ops for as many slots as needed to reach
+the XEN_NETBACK_TX_COPY_LEN size. Adjust the rest of the code to handle
+multiple copy operations per skb.
+
+This is XSA-423 / CVE-2022-3643.
+
+Fixes: 7e5d7753956b ("xen-netback: remove unconditional __pskb_pull_tail() in guest Tx path")
+Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
+Reviewed-by: Paul Durrant <paul@xen.org>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/xen-netback/netback.c | 223 ++++++++++++++++--------------
+ 1 file changed, 123 insertions(+), 100 deletions(-)
+
+diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
+index a256695fc89e..4962ff8b1534 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -332,10 +332,13 @@ static int xenvif_count_requests(struct xenvif_queue *queue,
+
+
+ struct xenvif_tx_cb {
+- u16 pending_idx;
++ u16 copy_pending_idx[XEN_NETBK_LEGACY_SLOTS_MAX + 1];
++ u8 copy_count;
+ };
+
+ #define XENVIF_TX_CB(skb) ((struct xenvif_tx_cb *)(skb)->cb)
++#define copy_pending_idx(skb, i) (XENVIF_TX_CB(skb)->copy_pending_idx[i])
++#define copy_count(skb) (XENVIF_TX_CB(skb)->copy_count)
+
+ static inline void xenvif_tx_create_map_op(struct xenvif_queue *queue,
+ u16 pending_idx,
+@@ -370,31 +373,93 @@ static inline struct sk_buff *xenvif_alloc_skb(unsigned int size)
+ return skb;
+ }
+
+-static struct gnttab_map_grant_ref *xenvif_get_requests(struct xenvif_queue *queue,
+- struct sk_buff *skb,
+- struct xen_netif_tx_request *txp,
+- struct gnttab_map_grant_ref *gop,
+- unsigned int frag_overflow,
+- struct sk_buff *nskb)
++static void xenvif_get_requests(struct xenvif_queue *queue,
++ struct sk_buff *skb,
++ struct xen_netif_tx_request *first,
++ struct xen_netif_tx_request *txfrags,
++ unsigned *copy_ops,
++ unsigned *map_ops,
++ unsigned int frag_overflow,
++ struct sk_buff *nskb,
++ unsigned int extra_count,
++ unsigned int data_len)
+ {
+ struct skb_shared_info *shinfo = skb_shinfo(skb);
+ skb_frag_t *frags = shinfo->frags;
+- u16 pending_idx = XENVIF_TX_CB(skb)->pending_idx;
+- int start;
++ u16 pending_idx;
+ pending_ring_idx_t index;
+ unsigned int nr_slots;
++ struct gnttab_copy *cop = queue->tx_copy_ops + *copy_ops;
++ struct gnttab_map_grant_ref *gop = queue->tx_map_ops + *map_ops;
++ struct xen_netif_tx_request *txp = first;
++
++ nr_slots = shinfo->nr_frags + 1;
++
++ copy_count(skb) = 0;
++
++ /* Create copy ops for exactly data_len bytes into the skb head. */
++ __skb_put(skb, data_len);
++ while (data_len > 0) {
++ int amount = data_len > txp->size ? txp->size : data_len;
++
++ cop->source.u.ref = txp->gref;
++ cop->source.domid = queue->vif->domid;
++ cop->source.offset = txp->offset;
++
++ cop->dest.domid = DOMID_SELF;
++ cop->dest.offset = (offset_in_page(skb->data +
++ skb_headlen(skb) -
++ data_len)) & ~XEN_PAGE_MASK;
++ cop->dest.u.gmfn = virt_to_gfn(skb->data + skb_headlen(skb)
++ - data_len);
++
++ cop->len = amount;
++ cop->flags = GNTCOPY_source_gref;
+
+- nr_slots = shinfo->nr_frags;
++ index = pending_index(queue->pending_cons);
++ pending_idx = queue->pending_ring[index];
++ callback_param(queue, pending_idx).ctx = NULL;
++ copy_pending_idx(skb, copy_count(skb)) = pending_idx;
++ copy_count(skb)++;
++
++ cop++;
++ data_len -= amount;
+
+- /* Skip first skb fragment if it is on same page as header fragment. */
+- start = (frag_get_pending_idx(&shinfo->frags[0]) == pending_idx);
++ if (amount == txp->size) {
++ /* The copy op covered the full tx_request */
++
++ memcpy(&queue->pending_tx_info[pending_idx].req,
++ txp, sizeof(*txp));
++ queue->pending_tx_info[pending_idx].extra_count =
++ (txp == first) ? extra_count : 0;
++
++ if (txp == first)
++ txp = txfrags;
++ else
++ txp++;
++ queue->pending_cons++;
++ nr_slots--;
++ } else {
++ /* The copy op partially covered the tx_request.
++ * The remainder will be mapped.
++ */
++ txp->offset += amount;
++ txp->size -= amount;
++ }
++ }
+
+- for (shinfo->nr_frags = start; shinfo->nr_frags < nr_slots;
+- shinfo->nr_frags++, txp++, gop++) {
++ for (shinfo->nr_frags = 0; shinfo->nr_frags < nr_slots;
++ shinfo->nr_frags++, gop++) {
+ index = pending_index(queue->pending_cons++);
+ pending_idx = queue->pending_ring[index];
+- xenvif_tx_create_map_op(queue, pending_idx, txp, 0, gop);
++ xenvif_tx_create_map_op(queue, pending_idx, txp,
++ txp == first ? extra_count : 0, gop);
+ frag_set_pending_idx(&frags[shinfo->nr_frags], pending_idx);
++
++ if (txp == first)
++ txp = txfrags;
++ else
++ txp++;
+ }
+
+ if (frag_overflow) {
+@@ -415,7 +480,8 @@ static struct gnttab_map_grant_ref *xenvif_get_requests(struct xenvif_queue *que
+ skb_shinfo(skb)->frag_list = nskb;
+ }
+
+- return gop;
++ (*copy_ops) = cop - queue->tx_copy_ops;
++ (*map_ops) = gop - queue->tx_map_ops;
+ }
+
+ static inline void xenvif_grant_handle_set(struct xenvif_queue *queue,
+@@ -451,7 +517,7 @@ static int xenvif_tx_check_gop(struct xenvif_queue *queue,
+ struct gnttab_copy **gopp_copy)
+ {
+ struct gnttab_map_grant_ref *gop_map = *gopp_map;
+- u16 pending_idx = XENVIF_TX_CB(skb)->pending_idx;
++ u16 pending_idx;
+ /* This always points to the shinfo of the skb being checked, which
+ * could be either the first or the one on the frag_list
+ */
+@@ -462,24 +528,37 @@ static int xenvif_tx_check_gop(struct xenvif_queue *queue,
+ struct skb_shared_info *first_shinfo = NULL;
+ int nr_frags = shinfo->nr_frags;
+ const bool sharedslot = nr_frags &&
+- frag_get_pending_idx(&shinfo->frags[0]) == pending_idx;
++ frag_get_pending_idx(&shinfo->frags[0]) ==
++ copy_pending_idx(skb, copy_count(skb) - 1);
+ int i, err;
+
+- /* Check status of header. */
+- err = (*gopp_copy)->status;
+- if (unlikely(err)) {
+- if (net_ratelimit())
+- netdev_dbg(queue->vif->dev,
+- "Grant copy of header failed! status: %d pending_idx: %u ref: %u\n",
+- (*gopp_copy)->status,
+- pending_idx,
+- (*gopp_copy)->source.u.ref);
+- /* The first frag might still have this slot mapped */
+- if (!sharedslot)
+- xenvif_idx_release(queue, pending_idx,
+- XEN_NETIF_RSP_ERROR);
++ for (i = 0; i < copy_count(skb); i++) {
++ int newerr;
++
++ /* Check status of header. */
++ pending_idx = copy_pending_idx(skb, i);
++
++ newerr = (*gopp_copy)->status;
++ if (likely(!newerr)) {
++ /* The first frag might still have this slot mapped */
++ if (i < copy_count(skb) - 1 || !sharedslot)
++ xenvif_idx_release(queue, pending_idx,
++ XEN_NETIF_RSP_OKAY);
++ } else {
++ err = newerr;
++ if (net_ratelimit())
++ netdev_dbg(queue->vif->dev,
++ "Grant copy of header failed! status: %d pending_idx: %u ref: %u\n",
++ (*gopp_copy)->status,
++ pending_idx,
++ (*gopp_copy)->source.u.ref);
++ /* The first frag might still have this slot mapped */
++ if (i < copy_count(skb) - 1 || !sharedslot)
++ xenvif_idx_release(queue, pending_idx,
++ XEN_NETIF_RSP_ERROR);
++ }
++ (*gopp_copy)++;
+ }
+- (*gopp_copy)++;
+
+ check_frags:
+ for (i = 0; i < nr_frags; i++, gop_map++) {
+@@ -526,14 +605,6 @@ static int xenvif_tx_check_gop(struct xenvif_queue *queue,
+ if (err)
+ continue;
+
+- /* First error: if the header haven't shared a slot with the
+- * first frag, release it as well.
+- */
+- if (!sharedslot)
+- xenvif_idx_release(queue,
+- XENVIF_TX_CB(skb)->pending_idx,
+- XEN_NETIF_RSP_OKAY);
+-
+ /* Invalidate preceding fragments of this skb. */
+ for (j = 0; j < i; j++) {
+ pending_idx = frag_get_pending_idx(&shinfo->frags[j]);
+@@ -803,7 +874,6 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
+ unsigned *copy_ops,
+ unsigned *map_ops)
+ {
+- struct gnttab_map_grant_ref *gop = queue->tx_map_ops;
+ struct sk_buff *skb, *nskb;
+ int ret;
+ unsigned int frag_overflow;
+@@ -885,8 +955,12 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
+ continue;
+ }
+
++ data_len = (txreq.size > XEN_NETBACK_TX_COPY_LEN) ?
++ XEN_NETBACK_TX_COPY_LEN : txreq.size;
++
+ ret = xenvif_count_requests(queue, &txreq, extra_count,
+ txfrags, work_to_do);
++
+ if (unlikely(ret < 0))
+ break;
+
+@@ -912,9 +986,8 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
+ index = pending_index(queue->pending_cons);
+ pending_idx = queue->pending_ring[index];
+
+- data_len = (txreq.size > XEN_NETBACK_TX_COPY_LEN &&
+- ret < XEN_NETBK_LEGACY_SLOTS_MAX) ?
+- XEN_NETBACK_TX_COPY_LEN : txreq.size;
++ if (ret >= XEN_NETBK_LEGACY_SLOTS_MAX - 1 && data_len < txreq.size)
++ data_len = txreq.size;
+
+ skb = xenvif_alloc_skb(data_len);
+ if (unlikely(skb == NULL)) {
+@@ -925,8 +998,6 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
+ }
+
+ skb_shinfo(skb)->nr_frags = ret;
+- if (data_len < txreq.size)
+- skb_shinfo(skb)->nr_frags++;
+ /* At this point shinfo->nr_frags is in fact the number of
+ * slots, which can be as large as XEN_NETBK_LEGACY_SLOTS_MAX.
+ */
+@@ -988,54 +1059,19 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
+ type);
+ }
+
+- XENVIF_TX_CB(skb)->pending_idx = pending_idx;
+-
+- __skb_put(skb, data_len);
+- queue->tx_copy_ops[*copy_ops].source.u.ref = txreq.gref;
+- queue->tx_copy_ops[*copy_ops].source.domid = queue->vif->domid;
+- queue->tx_copy_ops[*copy_ops].source.offset = txreq.offset;
+-
+- queue->tx_copy_ops[*copy_ops].dest.u.gmfn =
+- virt_to_gfn(skb->data);
+- queue->tx_copy_ops[*copy_ops].dest.domid = DOMID_SELF;
+- queue->tx_copy_ops[*copy_ops].dest.offset =
+- offset_in_page(skb->data) & ~XEN_PAGE_MASK;
+-
+- queue->tx_copy_ops[*copy_ops].len = data_len;
+- queue->tx_copy_ops[*copy_ops].flags = GNTCOPY_source_gref;
+-
+- (*copy_ops)++;
+-
+- if (data_len < txreq.size) {
+- frag_set_pending_idx(&skb_shinfo(skb)->frags[0],
+- pending_idx);
+- xenvif_tx_create_map_op(queue, pending_idx, &txreq,
+- extra_count, gop);
+- gop++;
+- } else {
+- frag_set_pending_idx(&skb_shinfo(skb)->frags[0],
+- INVALID_PENDING_IDX);
+- memcpy(&queue->pending_tx_info[pending_idx].req,
+- &txreq, sizeof(txreq));
+- queue->pending_tx_info[pending_idx].extra_count =
+- extra_count;
+- }
+-
+- queue->pending_cons++;
+-
+- gop = xenvif_get_requests(queue, skb, txfrags, gop,
+- frag_overflow, nskb);
++ xenvif_get_requests(queue, skb, &txreq, txfrags, copy_ops,
++ map_ops, frag_overflow, nskb, extra_count,
++ data_len);
+
+ __skb_queue_tail(&queue->tx_queue, skb);
+
+ queue->tx.req_cons = idx;
+
+- if (((gop-queue->tx_map_ops) >= ARRAY_SIZE(queue->tx_map_ops)) ||
++ if ((*map_ops >= ARRAY_SIZE(queue->tx_map_ops)) ||
+ (*copy_ops >= ARRAY_SIZE(queue->tx_copy_ops)))
+ break;
+ }
+
+- (*map_ops) = gop - queue->tx_map_ops;
+ return;
+ }
+
+@@ -1114,9 +1150,8 @@ static int xenvif_tx_submit(struct xenvif_queue *queue)
+ while ((skb = __skb_dequeue(&queue->tx_queue)) != NULL) {
+ struct xen_netif_tx_request *txp;
+ u16 pending_idx;
+- unsigned data_len;
+
+- pending_idx = XENVIF_TX_CB(skb)->pending_idx;
++ pending_idx = copy_pending_idx(skb, 0);
+ txp = &queue->pending_tx_info[pending_idx].req;
+
+ /* Check the remap error code. */
+@@ -1135,18 +1170,6 @@ static int xenvif_tx_submit(struct xenvif_queue *queue)
+ continue;
+ }
+
+- data_len = skb->len;
+- callback_param(queue, pending_idx).ctx = NULL;
+- if (data_len < txp->size) {
+- /* Append the packet payload as a fragment. */
+- txp->offset += data_len;
+- txp->size -= data_len;
+- } else {
+- /* Schedule a response immediately. */
+- xenvif_idx_release(queue, pending_idx,
+- XEN_NETIF_RSP_OKAY);
+- }
+-
+ if (txp->flags & XEN_NETTXF_csum_blank)
+ skb->ip_summed = CHECKSUM_PARTIAL;
+ else if (txp->flags & XEN_NETTXF_data_validated)
+@@ -1331,7 +1354,7 @@ static inline void xenvif_tx_dealloc_action(struct xenvif_queue *queue)
+ /* Called after netfront has transmitted */
+ int xenvif_tx_action(struct xenvif_queue *queue, int budget)
+ {
+- unsigned nr_mops, nr_cops = 0;
++ unsigned nr_mops = 0, nr_cops = 0;
+ int work_done, ret;
+
+ if (unlikely(!tx_work_todo(queue)))
+--
+2.35.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
