--- /dev/null
+From af3c55e6083e14aa3a33418f39f9f08621aba542 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 11:34:18 -0700
+Subject: ACPI: NFIT: fix a potential deadlock during NFIT teardown
+
+From: Vishal Verma <vishal.l.verma@intel.com>
+
+[ Upstream commit fb6df4366f86dd252bfa3049edffa52d17e7b895 ]
+
+Lockdep reports that acpi_nfit_shutdown() may deadlock against an
+opportune acpi_nfit_scrub(). acpi_nfit_scrub () is run from inside a
+'work' and therefore has already acquired workqueue-internal locks. It
+also acquiires acpi_desc->init_mutex. acpi_nfit_shutdown() first
+acquires init_mutex, and was subsequently attempting to cancel any
+pending workqueue items. This reversed locking order causes a potential
+deadlock:
+
+ ======================================================
+ WARNING: possible circular locking dependency detected
+ 6.2.0-rc3 #116 Tainted: G O N
+ ------------------------------------------------------
+ libndctl/1958 is trying to acquire lock:
+ ffff888129b461c0 ((work_completion)(&(&acpi_desc->dwork)->work)){+.+.}-{0:0}, at: __flush_work+0x43/0x450
+
+ but task is already holding lock:
+ ffff888129b460e8 (&acpi_desc->init_mutex){+.+.}-{3:3}, at: acpi_nfit_shutdown+0x87/0xd0 [nfit]
+
+ which lock already depends on the new lock.
+
+ ...
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(&acpi_desc->init_mutex);
+ lock((work_completion)(&(&acpi_desc->dwork)->work));
+ lock(&acpi_desc->init_mutex);
+ lock((work_completion)(&(&acpi_desc->dwork)->work));
+
+ *** DEADLOCK ***
+
+Since the workqueue manipulation is protected by its own internal locking,
+the cancellation of pending work doesn't need to be done under
+acpi_desc->init_mutex. Move cancel_delayed_work_sync() outside the
+init_mutex to fix the deadlock. Any work that starts after
+acpi_nfit_shutdown() drops the lock will see ARS_CANCEL, and the
+cancel_delayed_work_sync() will safely flush it out.
+
+Reported-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Vishal Verma <vishal.l.verma@intel.com>
+Link: https://lore.kernel.org/r/20230112-acpi_nfit_lockdep-v1-1-660be4dd10be@intel.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/nfit/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index ae5f4acf26753..6d4ac934cd499 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -3297,8 +3297,8 @@ void acpi_nfit_shutdown(void *data)
+
+ mutex_lock(&acpi_desc->init_mutex);
+ set_bit(ARS_CANCEL, &acpi_desc->scrub_flags);
+- cancel_delayed_work_sync(&acpi_desc->dwork);
+ mutex_unlock(&acpi_desc->init_mutex);
++ cancel_delayed_work_sync(&acpi_desc->dwork);
+
+ /*
+ * Bounce the nvdimm bus lock to make sure any in-flight
+--
+2.39.0
+
--- /dev/null
+From c87e895dfaeaf204134d87405fcd285099c94ae5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Dec 2022 21:17:32 +0100
+Subject: ARM: dts: rockchip: add power-domains property to dp node on rk3288
+
+From: Johan Jonker <jbx6244@gmail.com>
+
+[ Upstream commit 80422339a75088322b4d3884bd12fa0fe5d11050 ]
+
+The clocks in the Rockchip rk3288 DisplayPort node are
+included in the power-domain@RK3288_PD_VIO logic, but the
+power-domains property in the dp node is missing, so fix it.
+
+Signed-off-by: Johan Jonker <jbx6244@gmail.com>
+Link: https://lore.kernel.org/r/dab85bfb-9f55-86a1-5cd5-7388c43e0ec5@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3288.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi
+index 487b0e03d4b43..2ca76b69add78 100644
+--- a/arch/arm/boot/dts/rk3288.dtsi
++++ b/arch/arm/boot/dts/rk3288.dtsi
+@@ -1181,6 +1181,7 @@ edp: dp@ff970000 {
+ clock-names = "dp", "pclk";
+ phys = <&edp_phy>;
+ phy-names = "dp";
++ power-domains = <&power RK3288_PD_VIO>;
+ resets = <&cru SRST_EDP>;
+ reset-names = "dp";
+ rockchip,grf = <&grf>;
+--
+2.39.0
+
--- /dev/null
+From c654204d94af7b24f12e023fed5ba590756034e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Sep 2022 09:00:41 -0700
+Subject: ARM: dts: stihxxx-b2120: fix polarity of reset line of tsin0 port
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit 4722dd4029c63f10414ffd8d3ffdd6c748391cd7 ]
+
+According to c8sectpfe driver code we first drive reset line low and
+then high to reset the port, therefore the reset line is supposed to
+be annotated as "active low". This will be important when we convert
+the driver to gpiod API.
+
+Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Patrice Chotard <patrice.chotard@foss.st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stihxxx-b2120.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/stihxxx-b2120.dtsi b/arch/arm/boot/dts/stihxxx-b2120.dtsi
+index 2aa94605d3d47..d52a7aaa10743 100644
+--- a/arch/arm/boot/dts/stihxxx-b2120.dtsi
++++ b/arch/arm/boot/dts/stihxxx-b2120.dtsi
+@@ -178,7 +178,7 @@ tsin0: port {
+ tsin-num = <0>;
+ serial-not-parallel;
+ i2c-bus = <&ssc2>;
+- reset-gpios = <&pio15 4 GPIO_ACTIVE_HIGH>;
++ reset-gpios = <&pio15 4 GPIO_ACTIVE_LOW>;
+ dvb-card = <STV0367_TDA18212_NIMA_1>;
+ };
+ };
+--
+2.39.0
+
--- /dev/null
+From c199aba262ff6ae3adb725e18370dab7bbb8aac0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jan 2023 14:44:57 +0800
+Subject: arm64: dts: rockchip: add missing #interrupt-cells to rk356x pcie2x1
+
+From: Jensen Huang <jensenhuang@friendlyarm.com>
+
+[ Upstream commit a323e6b5737bb6e3d3946369b97099abb7dde695 ]
+
+This fixes the following issue:
+ pcieport 0000:00:00.0: of_irq_parse_pci: failed with rc=-22
+
+Signed-off-by: Jensen Huang <jensenhuang@friendlyarm.com>
+Link: https://lore.kernel.org/r/20230113064457.7105-1-jensenhuang@friendlyarm.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk356x.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk356x.dtsi b/arch/arm64/boot/dts/rockchip/rk356x.dtsi
+index 164708f1eb674..1d423daae971b 100644
+--- a/arch/arm64/boot/dts/rockchip/rk356x.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk356x.dtsi
+@@ -966,6 +966,7 @@ pcie2x1: pcie@fe260000 {
+ clock-names = "aclk_mst", "aclk_slv",
+ "aclk_dbi", "pclk", "aux";
+ device_type = "pci";
++ #interrupt-cells = <1>;
+ interrupt-map-mask = <0 0 0 7>;
+ interrupt-map = <0 0 0 1 &pcie_intc 0>,
+ <0 0 0 2 &pcie_intc 1>,
+--
+2.39.0
+
--- /dev/null
+From 771e8282adc9f49889c3d246ed1cf586353a9e3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 13:46:31 +0100
+Subject: arm64: dts: rockchip: align rk3399 DMC OPP table with bindings
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit b67b09733d8a41eec33d5d37be2f8cff8af82a5e ]
+
+Bindings expect certain pattern for OPP table node name and underscores
+are not allowed:
+
+ rk3399-rock-pi-4a-plus.dtb: dmc_opp_table: $nodename:0: 'dmc_opp_table' does not match '^opp-table(-[a-z0-9]+)?$'
+
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20230119124631.91080-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-op1-opp.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-op1-opp.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-op1-opp.dtsi
+index 6e29e74f6fc68..783120e9cebeb 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-op1-opp.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-op1-opp.dtsi
+@@ -111,7 +111,7 @@ opp05 {
+ };
+ };
+
+- dmc_opp_table: dmc_opp_table {
++ dmc_opp_table: opp-table-3 {
+ compatible = "operating-points-v2";
+
+ opp00 {
+--
+2.39.0
+
--- /dev/null
+From a709a0c9653343098c9c13605ee6a75e6b0787b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Nov 2022 15:41:34 +0100
+Subject: arm64: dts: rockchip: drop unused LED mode property from
+ rk3328-roc-cc
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 1692bffec674551163a7a4be32f59fdde04ecd27 ]
+
+GPIO LEDs do not have a 'mode' property:
+
+ rockchip/rk3328-roc-pc.dtb: leds: led-0: Unevaluated properties are not allowed ('mode' was unexpected)
+
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20221125144135.477144-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
+index aa22a0c222655..5d5d9574088ca 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
+@@ -96,7 +96,6 @@ power_led: led-0 {
+ linux,default-trigger = "heartbeat";
+ gpios = <&rk805 1 GPIO_ACTIVE_LOW>;
+ default-state = "on";
+- mode = <0x23>;
+ };
+
+ user_led: led-1 {
+@@ -104,7 +103,6 @@ user_led: led-1 {
+ linux,default-trigger = "mmc1";
+ gpios = <&rk805 0 GPIO_ACTIVE_LOW>;
+ default-state = "off";
+- mode = <0x05>;
+ };
+ };
+ };
+--
+2.39.0
+
--- /dev/null
+From 7d4f6e006ef5c51664bcd5f0a19cd2609b4d1f92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Jan 2023 21:15:56 +0000
+Subject: arm64: dts: rockchip: fix probe of analog sound card on rock-3a
+
+From: Jonas Karlman <jonas@kwiboo.se>
+
+[ Upstream commit 1104693cdfcd337e73ab585a225f05445ff7a864 ]
+
+The following was observed on my Radxa ROCK 3 Model A board:
+
+ rockchip-pinctrl pinctrl: pin gpio1-9 already requested by vcc-cam-regulator; cannot claim for fe410000.i2s
+ ...
+ platform rk809-sound: deferred probe pending
+
+Fix this by supplying a board specific pinctrl with the i2s1 pins used
+by pmic codec according to the schematic [1].
+
+[1] https://dl.radxa.com/rock3/docs/hw/3a/ROCK-3A-V1.3-SCH.pdf
+
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Acked-by: Michael Riesch <michael.riesch@wolfvision.net>
+Link: https://lore.kernel.org/r/20230115211553.445007-1-jonas@kwiboo.se
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts b/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts
+index 44313a18e484e..bab46db2b18cd 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3568-rock-3a.dts
+@@ -521,6 +521,8 @@ &i2s0_8ch {
+ };
+
+ &i2s1_8ch {
++ pinctrl-names = "default";
++ pinctrl-0 = <&i2s1m0_sclktx &i2s1m0_lrcktx &i2s1m0_sdi0 &i2s1m0_sdo0>;
+ rockchip,trcm-sync-tx-only;
+ status = "okay";
+ };
+--
+2.39.0
+
--- /dev/null
+From e8254b1224a3afbf8970895cdb59a20e0e75c295 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Dec 2022 11:32:13 +0000
+Subject: arm64: dts: rockchip: reduce thermal limits on rk3399-pinephone-pro
+
+From: Jarrah Gosbell <kernel@undef.tools>
+
+[ Upstream commit 33e24f0738b922b6f5f4118dbdc26cac8400d7b9 ]
+
+While this device uses the rk3399 it is also enclosed in a tight package
+and cooled through the screen and back case. The default rk3399 thermal
+limits can result in a burnt screen.
+
+These lower limits have resulted in the existing burn not expanding and
+will hopefully result in future devices not experiencing the issue.
+
+Signed-off-by: Jarrah Gosbell <kernel@undef.tools>
+Link: https://lore.kernel.org/r/20221207113212.8216-1-kernel@undef.tools
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts b/arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts
+index 2e058c3150256..fccc2b2f327df 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-pinephone-pro.dts
+@@ -83,6 +83,13 @@ vcc1v8_codec: vcc1v8-codec-regulator {
+ };
+ };
+
++&cpu_alert0 {
++ temperature = <65000>;
++};
++&cpu_alert1 {
++ temperature = <68000>;
++};
++
+ &cpu_l0 {
+ cpu-supply = <&vdd_cpu_l>;
+ };
+--
+2.39.0
+
--- /dev/null
+From ad8cfbad21144b4c3a59ed0e7d7ade4d587ab009 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Feb 2023 22:51:06 +0300
+Subject: ASoC: codecs: es8326: Fix DTS properties reading
+
+From: Alexey Firago <a.firago@yadro.com>
+
+[ Upstream commit fe1e7e8ce2c47bd8fd9885eab63fca0a522e94c9 ]
+
+Seems like properties parsing and reading was copy-pasted,
+so "everest,interrupt-src" and "everest,interrupt-clk" are saved into
+the es8326->jack_pol variable. This might lead to wrong settings
+being saved into the reg 57 (ES8326_HP_DET).
+
+Fix this by using proper variables while reading properties.
+
+Signed-off-by: Alexey Firago <a.firago@yadro.com>
+Reviewed-by: Yang Yingliang <yangyingliang@huawei.com
+Link: https://lore.kernel.org/r/20230204195106.46539-1-a.firago@yadro.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/es8326.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/es8326.c b/sound/soc/codecs/es8326.c
+index 87c1cc16592bb..555125efd9ad3 100644
+--- a/sound/soc/codecs/es8326.c
++++ b/sound/soc/codecs/es8326.c
+@@ -729,14 +729,16 @@ static int es8326_probe(struct snd_soc_component *component)
+ }
+ dev_dbg(component->dev, "jack-pol %x", es8326->jack_pol);
+
+- ret = device_property_read_u8(component->dev, "everest,interrupt-src", &es8326->jack_pol);
++ ret = device_property_read_u8(component->dev, "everest,interrupt-src",
++ &es8326->interrupt_src);
+ if (ret != 0) {
+ dev_dbg(component->dev, "interrupt-src return %d", ret);
+ es8326->interrupt_src = ES8326_HP_DET_SRC_PIN9;
+ }
+ dev_dbg(component->dev, "interrupt-src %x", es8326->interrupt_src);
+
+- ret = device_property_read_u8(component->dev, "everest,interrupt-clk", &es8326->jack_pol);
++ ret = device_property_read_u8(component->dev, "everest,interrupt-clk",
++ &es8326->interrupt_clk);
+ if (ret != 0) {
+ dev_dbg(component->dev, "interrupt-clk return %d", ret);
+ es8326->interrupt_clk = 0x45;
+--
+2.39.0
+
--- /dev/null
+From a7680e8fbe467485794829c461ded430bd9b8c00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 02:43:25 +0000
+Subject: ASoC: rt715-sdca: fix clock stop prepare timeout issue
+
+From: Jack Yu <jack.yu@realtek.com>
+
+[ Upstream commit 2036890282d56bcbf7f915ba9e04bf77967ab231 ]
+
+Modify clock_stop_timeout value for rt715-sdca according to
+the requirement of internal clock trimming.
+
+Signed-off-by: Jack Yu <jack.yu@realtek.com>
+Link: https://lore.kernel.org/r/574b6586267a458cac78c5ac4d5b10bd@realtek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt715-sdca-sdw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/rt715-sdca-sdw.c b/sound/soc/codecs/rt715-sdca-sdw.c
+index 3f981a9e7fb67..c54ecf3e69879 100644
+--- a/sound/soc/codecs/rt715-sdca-sdw.c
++++ b/sound/soc/codecs/rt715-sdca-sdw.c
+@@ -167,7 +167,7 @@ static int rt715_sdca_read_prop(struct sdw_slave *slave)
+ }
+
+ /* set the timeout values */
+- prop->clk_stop_timeout = 20;
++ prop->clk_stop_timeout = 200;
+
+ return 0;
+ }
+--
+2.39.0
+
--- /dev/null
+From 82bab5681078eb2970c0e6744ebb0a311e9190e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Feb 2023 18:02:52 +0530
+Subject: ASoC: SOF: amd: Fix for handling spurious interrupts from DSP
+
+From: V sujith kumar Reddy <Vsujithkumar.Reddy@amd.com>
+
+[ Upstream commit 2e7c6652f9b86c01cbd4e988057a746a3a461969 ]
+
+As interrupts are Level-triggered,unless and until we deassert the register
+the interrupts are generated which causes spurious interrupts unhandled.
+
+Now we deasserted the interrupt at top half which solved the below
+"nobody cared" warning.
+
+warning reported in dmesg:
+ irq 80: nobody cared (try booting with the "irqpoll" option)
+ CPU: 5 PID: 2735 Comm: irq/80-AudioDSP
+ Not tainted 5.15.86-15817-g4c19f3e06d49 #1 1bd3fd932cf58caacc95b0504d6ea1e3eab22289
+ Hardware name: Google Skyrim/Skyrim, BIOS Google_Skyrim.15303.0.0 01/03/2023
+ Call Trace:
+ <IRQ>
+ dump_stack_lvl+0x69/0x97
+ __report_bad_irq+0x3a/0xae
+ note_interrupt+0x1a9/0x1e3
+ handle_irq_event_percpu+0x4b/0x6e
+ handle_irq_event+0x36/0x5b
+ handle_fasteoi_irq+0xae/0x171
+ __common_interrupt+0x48/0xc4
+ </IRQ>
+
+ handlers:
+ acp_irq_handler [snd_sof_amd_acp] threaded [<000000007e089f34>] acp_irq_thread [snd_sof_amd_acp]
+ Disabling IRQ #80
+
+Signed-off-by: V sujith kumar Reddy <Vsujithkumar.Reddy@amd.com>
+Link: https://lore.kernel.org/r/20230203123254.1898794-1-Vsujithkumar.Reddy@amd.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/amd/acp.c | 36 +++++++++++++++---------------------
+ 1 file changed, 15 insertions(+), 21 deletions(-)
+
+diff --git a/sound/soc/sof/amd/acp.c b/sound/soc/sof/amd/acp.c
+index 36966643e36ab..8afd67ba1e5a3 100644
+--- a/sound/soc/sof/amd/acp.c
++++ b/sound/soc/sof/amd/acp.c
+@@ -316,7 +316,6 @@ static irqreturn_t acp_irq_thread(int irq, void *context)
+ {
+ struct snd_sof_dev *sdev = context;
+ const struct sof_amd_acp_desc *desc = get_chip_info(sdev->pdata);
+- unsigned int base = desc->dsp_intr_base;
+ unsigned int val, count = ACP_HW_SEM_RETRY_COUNT;
+
+ val = snd_sof_dsp_read(sdev, ACP_DSP_BAR, desc->ext_intr_stat);
+@@ -326,28 +325,20 @@ static irqreturn_t acp_irq_thread(int irq, void *context)
+ return IRQ_HANDLED;
+ }
+
+- val = snd_sof_dsp_read(sdev, ACP_DSP_BAR, base + DSP_SW_INTR_STAT_OFFSET);
+- if (val & ACP_DSP_TO_HOST_IRQ) {
+- while (snd_sof_dsp_read(sdev, ACP_DSP_BAR, desc->hw_semaphore_offset)) {
+- /* Wait until acquired HW Semaphore lock or timeout */
+- count--;
+- if (!count) {
+- dev_err(sdev->dev, "%s: Failed to acquire HW lock\n", __func__);
+- return IRQ_NONE;
+- }
++ while (snd_sof_dsp_read(sdev, ACP_DSP_BAR, desc->hw_semaphore_offset)) {
++ /* Wait until acquired HW Semaphore lock or timeout */
++ count--;
++ if (!count) {
++ dev_err(sdev->dev, "%s: Failed to acquire HW lock\n", __func__);
++ return IRQ_NONE;
+ }
+-
+- sof_ops(sdev)->irq_thread(irq, sdev);
+- val |= ACP_DSP_TO_HOST_IRQ;
+- snd_sof_dsp_write(sdev, ACP_DSP_BAR, base + DSP_SW_INTR_STAT_OFFSET, val);
+-
+- /* Unlock or Release HW Semaphore */
+- snd_sof_dsp_write(sdev, ACP_DSP_BAR, desc->hw_semaphore_offset, 0x0);
+-
+- return IRQ_HANDLED;
+ }
+
+- return IRQ_NONE;
++ sof_ops(sdev)->irq_thread(irq, sdev);
++ /* Unlock or Release HW Semaphore */
++ snd_sof_dsp_write(sdev, ACP_DSP_BAR, desc->hw_semaphore_offset, 0x0);
++
++ return IRQ_HANDLED;
+ };
+
+ static irqreturn_t acp_irq_handler(int irq, void *dev_id)
+@@ -358,8 +349,11 @@ static irqreturn_t acp_irq_handler(int irq, void *dev_id)
+ unsigned int val;
+
+ val = snd_sof_dsp_read(sdev, ACP_DSP_BAR, base + DSP_SW_INTR_STAT_OFFSET);
+- if (val)
++ if (val) {
++ val |= ACP_DSP_TO_HOST_IRQ;
++ snd_sof_dsp_write(sdev, ACP_DSP_BAR, base + DSP_SW_INTR_STAT_OFFSET, val);
+ return IRQ_WAKE_THREAD;
++ }
+
+ return IRQ_NONE;
+ }
+--
+2.39.0
+
--- /dev/null
+From c853ef438e2e2941bb50c9affc3614a2c18817a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 20:32:10 +0100
+Subject: btrfs: send: limit number of clones and allocated memory size
+
+From: David Sterba <dsterba@suse.com>
+
+[ Upstream commit 33e17b3f5ab74af12aca58c515bc8424ff69a343 ]
+
+The arg->clone_sources_count is u64 and can trigger a warning when a
+huge value is passed from user space and a huge array is allocated.
+Limit the allocated memory to 8MiB (can be increased if needed), which
+in turn limits the number of clone sources to 8M / sizeof(struct
+clone_root) = 8M / 40 = 209715. Real world number of clones is from
+tens to hundreds, so this is future proof.
+
+Reported-by: syzbot+4376a9a073770c173269@syzkaller.appspotmail.com
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/send.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
+index 1c4b693ee4a3a..937b60ae576e0 100644
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -7839,10 +7839,10 @@ long btrfs_ioctl_send(struct inode *inode, struct btrfs_ioctl_send_args *arg)
+ /*
+ * Check that we don't overflow at later allocations, we request
+ * clone_sources_count + 1 items, and compare to unsigned long inside
+- * access_ok.
++ * access_ok. Also set an upper limit for allocation size so this can't
++ * easily exhaust memory. Max number of clone sources is about 200K.
+ */
+- if (arg->clone_sources_count >
+- ULONG_MAX / sizeof(struct clone_root) - 1) {
++ if (arg->clone_sources_count > SZ_8M / sizeof(struct clone_root)) {
+ ret = -EINVAL;
+ goto out;
+ }
+--
+2.39.0
+
--- /dev/null
+From 4876a136930169aff0b0eed672d1a0ae08e2fbcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 09:57:27 -0500
+Subject: drm/amd/display: disable S/G display on DCN 3.1.2/3
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 077e9659581acab70f2dcc04b5bc799aca3a056b ]
+
+Causes flickering or white screens in some configurations.
+Disable it for now until we can fix the issue.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2352
+Cc: roman.li@amd.com
+Cc: yifan1.zhang@amd.com
+Reviewed-by: Yifan Zhang <yifan1.zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index e9c4f22696c5c..d39f77b960458 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1524,8 +1524,6 @@ static int amdgpu_dm_init(struct amdgpu_device *adev)
+ break;
+ case IP_VERSION(2, 1, 0):
+ case IP_VERSION(3, 0, 1):
+- case IP_VERSION(3, 1, 2):
+- case IP_VERSION(3, 1, 3):
+ case IP_VERSION(3, 1, 6):
+ init_data.flags.gpu_vm_support = true;
+ break;
+--
+2.39.0
+
--- /dev/null
+From 574a4a230257db9cb5cd3782592987ebab610f2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Jan 2023 21:28:12 +0000
+Subject: Fix XFRM-I support for nested ESP tunnels
+
+From: Benedict Wong <benedictwong@google.com>
+
+[ Upstream commit b0355dbbf13c0052931dd14c38c789efed64d3de ]
+
+This change adds support for nested IPsec tunnels by ensuring that
+XFRM-I verifies existing policies before decapsulating a subsequent
+policies. Addtionally, this clears the secpath entries after policies
+are verified, ensuring that previous tunnels with no-longer-valid
+do not pollute subsequent policy checks.
+
+This is necessary especially for nested tunnels, as the IP addresses,
+protocol and ports may all change, thus not matching the previous
+policies. In order to ensure that packets match the relevant inbound
+templates, the xfrm_policy_check should be done before handing off to
+the inner XFRM protocol to decrypt and decapsulate.
+
+Notably, raw ESP/AH packets did not perform policy checks inherently,
+whereas all other encapsulated packets (UDP, TCP encapsulated) do policy
+checks after calling xfrm_input handling in the respective encapsulation
+layer.
+
+Test: Verified with additional Android Kernel Unit tests
+Signed-off-by: Benedict Wong <benedictwong@google.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_interface.c | 54 ++++++++++++++++++++++++++++++++++++---
+ net/xfrm/xfrm_policy.c | 3 +++
+ 2 files changed, 53 insertions(+), 4 deletions(-)
+
+diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
+index 5a67b120c4dbd..94a3609548b11 100644
+--- a/net/xfrm/xfrm_interface.c
++++ b/net/xfrm/xfrm_interface.c
+@@ -310,6 +310,52 @@ static void xfrmi_scrub_packet(struct sk_buff *skb, bool xnet)
+ skb->mark = 0;
+ }
+
++static int xfrmi_input(struct sk_buff *skb, int nexthdr, __be32 spi,
++ int encap_type, unsigned short family)
++{
++ struct sec_path *sp;
++
++ sp = skb_sec_path(skb);
++ if (sp && (sp->len || sp->olen) &&
++ !xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family))
++ goto discard;
++
++ XFRM_SPI_SKB_CB(skb)->family = family;
++ if (family == AF_INET) {
++ XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
++ XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
++ } else {
++ XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr);
++ XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = NULL;
++ }
++
++ return xfrm_input(skb, nexthdr, spi, encap_type);
++discard:
++ kfree_skb(skb);
++ return 0;
++}
++
++static int xfrmi4_rcv(struct sk_buff *skb)
++{
++ return xfrmi_input(skb, ip_hdr(skb)->protocol, 0, 0, AF_INET);
++}
++
++static int xfrmi6_rcv(struct sk_buff *skb)
++{
++ return xfrmi_input(skb, skb_network_header(skb)[IP6CB(skb)->nhoff],
++ 0, 0, AF_INET6);
++}
++
++static int xfrmi4_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
++{
++ return xfrmi_input(skb, nexthdr, spi, encap_type, AF_INET);
++}
++
++static int xfrmi6_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
++{
++ return xfrmi_input(skb, nexthdr, spi, encap_type, AF_INET6);
++}
++
+ static int xfrmi_rcv_cb(struct sk_buff *skb, int err)
+ {
+ const struct xfrm_mode *inner_mode;
+@@ -937,8 +983,8 @@ static struct pernet_operations xfrmi_net_ops = {
+ };
+
+ static struct xfrm6_protocol xfrmi_esp6_protocol __read_mostly = {
+- .handler = xfrm6_rcv,
+- .input_handler = xfrm_input,
++ .handler = xfrmi6_rcv,
++ .input_handler = xfrmi6_input,
+ .cb_handler = xfrmi_rcv_cb,
+ .err_handler = xfrmi6_err,
+ .priority = 10,
+@@ -988,8 +1034,8 @@ static struct xfrm6_tunnel xfrmi_ip6ip_handler __read_mostly = {
+ #endif
+
+ static struct xfrm4_protocol xfrmi_esp4_protocol __read_mostly = {
+- .handler = xfrm4_rcv,
+- .input_handler = xfrm_input,
++ .handler = xfrmi4_rcv,
++ .input_handler = xfrmi4_input,
+ .cb_handler = xfrmi_rcv_cb,
+ .err_handler = xfrmi4_err,
+ .priority = 10,
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 52538d5360673..7f49dab3b6b59 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -3670,6 +3670,9 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
+ goto reject;
+ }
+
++ if (if_id)
++ secpath_reset(skb);
++
+ xfrm_pols_put(pols, npols);
+ return 1;
+ }
+--
+2.39.0
+
--- /dev/null
+From e62786f92bb2c971c7475378cc82376a3b0676ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jan 2023 21:29:47 +0000
+Subject: HID: core: Fix deadloop in hid_apply_multiplier.
+
+From: Xin Zhao <xnzhao@google.com>
+
+[ Upstream commit ea427a222d8bdf2bc1a8a6da3ebe247f7dced70c ]
+
+The initial value of hid->collection[].parent_idx if 0. When
+Report descriptor doesn't contain "HID Collection", the value
+remains as 0.
+
+In the meanwhile, when the Report descriptor fullfill
+all following conditions, it will trigger hid_apply_multiplier
+function call.
+1. Usage page is Generic Desktop Ctrls (0x01)
+2. Usage is RESOLUTION_MULTIPLIER (0x48)
+3. Contain any FEATURE items
+
+The while loop in hid_apply_multiplier will search the top-most
+collection by searching parent_idx == -1. Because all parent_idx
+is 0. The loop will run forever.
+
+There is a Report Descriptor triggerring the deadloop
+0x05, 0x01, // Usage Page (Generic Desktop Ctrls)
+0x09, 0x48, // Usage (0x48)
+0x95, 0x01, // Report Count (1)
+0x75, 0x08, // Report Size (8)
+0xB1, 0x01, // Feature
+
+Signed-off-by: Xin Zhao <xnzhao@google.com>
+Link: https://lore.kernel.org/r/20230130212947.1315941-1-xnzhao@google.com
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 3e1803592bd4a..5c72aef3d3dd5 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1202,6 +1202,7 @@ int hid_open_report(struct hid_device *device)
+ __u8 *end;
+ __u8 *next;
+ int ret;
++ int i;
+ static int (*dispatch_type[])(struct hid_parser *parser,
+ struct hid_item *item) = {
+ hid_parser_main,
+@@ -1252,6 +1253,8 @@ int hid_open_report(struct hid_device *device)
+ goto err;
+ }
+ device->collection_size = HID_DEFAULT_NUM_COLLECTIONS;
++ for (i = 0; i < HID_DEFAULT_NUM_COLLECTIONS; i++)
++ device->collection[i].parent_idx = -1;
+
+ ret = -EINVAL;
+ while ((next = fetch_item(start, end, &item)) != NULL) {
+--
+2.39.0
+
--- /dev/null
+From f7fcea1e4615e3bcd62235b70deba719a691ba77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 03:30:02 +0900
+Subject: HID: elecom: add support for TrackBall 056E:011C
+
+From: Takahiro Fujii <fujii@xaxxi.net>
+
+[ Upstream commit 29f316a1d7e0a570be9a47fa283ece53a67cebb7 ]
+
+Make function buttons on ELECOM M-HT1DRBK trackball mouse work. This model
+has two devices with different device IDs (010D and 011C). Both of
+them misreports the number of buttons as 5 in the report descriptor, even
+though they have 8 buttons. hid-elecom overwrites the report to fix them,
+but supports only on 010D and does not work on 011C. This patch fixes
+011C in the similar way but with specialized position parameters.
+In fact, it is sufficient to rewrite only 17th byte (05 -> 08). However I
+followed the existing way.
+
+Signed-off-by: Takahiro Fujii <fujii@xaxxi.net>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-elecom.c | 16 ++++++++++++++--
+ drivers/hid/hid-ids.h | 3 ++-
+ drivers/hid/hid-quirks.c | 3 ++-
+ 3 files changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c
+index e59e9911fc370..4fa45ee77503b 100644
+--- a/drivers/hid/hid-elecom.c
++++ b/drivers/hid/hid-elecom.c
+@@ -12,6 +12,7 @@
+ * Copyright (c) 2017 Alex Manoussakis <amanou@gnu.org>
+ * Copyright (c) 2017 Tomasz Kramkowski <tk@the-tk.com>
+ * Copyright (c) 2020 YOSHIOKA Takuma <lo48576@hard-wi.red>
++ * Copyright (c) 2022 Takahiro Fujii <fujii@xaxxi.net>
+ */
+
+ /*
+@@ -89,7 +90,7 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ case USB_DEVICE_ID_ELECOM_M_DT1URBK:
+ case USB_DEVICE_ID_ELECOM_M_DT1DRBK:
+ case USB_DEVICE_ID_ELECOM_M_HT1URBK:
+- case USB_DEVICE_ID_ELECOM_M_HT1DRBK:
++ case USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D:
+ /*
+ * Report descriptor format:
+ * 12: button bit count
+@@ -99,6 +100,16 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ */
+ mouse_button_fixup(hdev, rdesc, *rsize, 12, 30, 14, 20, 8);
+ break;
++ case USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C:
++ /*
++ * Report descriptor format:
++ * 22: button bit count
++ * 30: padding bit count
++ * 24: button report size
++ * 16: button usage maximum
++ */
++ mouse_button_fixup(hdev, rdesc, *rsize, 22, 30, 24, 16, 8);
++ break;
+ }
+ return rdesc;
+ }
+@@ -112,7 +123,8 @@ static const struct hid_device_id elecom_devices[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1DRBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, elecom_devices);
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 0f8c11842a3a5..d01d798ebedca 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -428,7 +428,8 @@
+ #define USB_DEVICE_ID_ELECOM_M_DT1URBK 0x00fe
+ #define USB_DEVICE_ID_ELECOM_M_DT1DRBK 0x00ff
+ #define USB_DEVICE_ID_ELECOM_M_HT1URBK 0x010c
+-#define USB_DEVICE_ID_ELECOM_M_HT1DRBK 0x010d
++#define USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D 0x010d
++#define USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C 0x011c
+
+ #define USB_VENDOR_ID_DREAM_CHEEKY 0x1d34
+ #define USB_DEVICE_ID_DREAM_CHEEKY_WN 0x0004
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index be3ad02573de8..5bc91f68b3747 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -393,7 +393,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1DRBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) },
+ #endif
+ #if IS_ENABLED(CONFIG_HID_ELO)
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) },
+--
+2.39.0
+
--- /dev/null
+From d52bd964bfe2b5cf92fff6f8f873c5f997777f28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Jan 2023 23:37:41 +0100
+Subject: HID: Ignore battery for ELAN touchscreen 29DF on HP
+
+From: Luka Guzenko <l.guzenko@web.de>
+
+[ Upstream commit ebebf05a4b06a1be49788ca0edf990de01c4b0d0 ]
+
+The touchscreen reports a battery status of 0% and jumps to 1% when a
+stylus is used. The device ID was added and the battery ignore quirk was
+enabled for it.
+
+Signed-off-by: Luka Guzenko <l.guzenko@web.de>
+Link: https://lore.kernel.org/r/20230120223741.3007-1-l.guzenko@web.de
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-input.c | 2 ++
+ 2 files changed, 3 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 46c0ce4203c08..9e36b4cd905ee 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -413,6 +413,7 @@
+ #define I2C_DEVICE_ID_HP_ENVY_X360_15T_DR100 0x29CF
+ #define I2C_DEVICE_ID_HP_ENVY_X360_EU0009NV 0x2CF9
+ #define I2C_DEVICE_ID_HP_SPECTRE_X360_15 0x2817
++#define I2C_DEVICE_ID_HP_SPECTRE_X360_13_AW0020NG 0x29DF
+ #define I2C_DEVICE_ID_ASUS_TP420IA_TOUCHSCREEN 0x2BC8
+ #define USB_DEVICE_ID_ASUS_UX550VE_TOUCHSCREEN 0x2544
+ #define USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN 0x2706
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 3736b0afbff73..7e94ca1822afb 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -386,6 +386,8 @@ static const struct hid_device_id hid_battery_quirks[] = {
+ HID_BATTERY_QUIRK_IGNORE },
+ { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_SPECTRE_X360_15),
+ HID_BATTERY_QUIRK_IGNORE },
++ { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_SPECTRE_X360_13_AW0020NG),
++ HID_BATTERY_QUIRK_IGNORE },
+ { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_SURFACE_GO_TOUCHSCREEN),
+ HID_BATTERY_QUIRK_IGNORE },
+ { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_SURFACE_GO2_TOUCHSCREEN),
+--
+2.39.0
+
--- /dev/null
+From e9aee363c6b1def4e47b214c753bb43ffadc90c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jan 2023 15:54:26 +0100
+Subject: HID: Ignore battery for Elan touchscreen on Asus TP420IA
+
+From: marco.rodolfi@tuta.io <marco.rodolfi@tuta.io>
+
+[ Upstream commit cb963b2c011a62838852c902eccb3f72e5d3dbb6 ]
+
+This device has a touchscreen thats report a battery even if it doesn't
+have one.
+Ask Linux to ignore the battery so it will not always report it as low.
+
+[jkosina@suse.cz: fix whitespace damage]
+Signed-off-by: Marco Rodolfi <marco.rodolfi@tuta.io>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-input.c | 2 ++
+ 2 files changed, 3 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index d01d798ebedca..46c0ce4203c08 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -413,6 +413,7 @@
+ #define I2C_DEVICE_ID_HP_ENVY_X360_15T_DR100 0x29CF
+ #define I2C_DEVICE_ID_HP_ENVY_X360_EU0009NV 0x2CF9
+ #define I2C_DEVICE_ID_HP_SPECTRE_X360_15 0x2817
++#define I2C_DEVICE_ID_ASUS_TP420IA_TOUCHSCREEN 0x2BC8
+ #define USB_DEVICE_ID_ASUS_UX550VE_TOUCHSCREEN 0x2544
+ #define USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN 0x2706
+ #define I2C_DEVICE_ID_SURFACE_GO_TOUCHSCREEN 0x261A
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 3ee5a9fea20e6..3736b0afbff73 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -370,6 +370,8 @@ static const struct hid_device_id hid_battery_quirks[] = {
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH,
+ USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD),
+ HID_BATTERY_QUIRK_IGNORE },
++ { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_ASUS_TP420IA_TOUCHSCREEN),
++ HID_BATTERY_QUIRK_IGNORE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN),
+ HID_BATTERY_QUIRK_IGNORE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ASUS_UX550VE_TOUCHSCREEN),
+--
+2.39.0
+
--- /dev/null
+From 2051ef55577406201dfa60b6fff6f73d70c19019 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jan 2023 14:04:08 -0500
+Subject: IB/hfi1: Assign npages earlier
+
+From: Dean Luick <dean.luick@cornelisnetworks.com>
+
+[ Upstream commit f9c47b2caa7ffc903ec950b454b59c209afe3182 ]
+
+Improve code clarity and enable earlier use of
+tidbuf->npages by moving its assignment to
+structure creation time.
+
+Signed-off-by: Dean Luick <dean.luick@cornelisnetworks.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
+Link: https://lore.kernel.org/r/167329104884.1472990.4639750192433251493.stgit@awfm-02.cornelisnetworks.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/user_exp_rcv.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
+index b02f2f0809c81..350884d5f0896 100644
+--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c
++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
+@@ -160,16 +160,11 @@ static void unpin_rcv_pages(struct hfi1_filedata *fd,
+ static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf)
+ {
+ int pinned;
+- unsigned int npages;
++ unsigned int npages = tidbuf->npages;
+ unsigned long vaddr = tidbuf->vaddr;
+ struct page **pages = NULL;
+ struct hfi1_devdata *dd = fd->uctxt->dd;
+
+- /* Get the number of pages the user buffer spans */
+- npages = num_user_pages(vaddr, tidbuf->length);
+- if (!npages)
+- return -EINVAL;
+-
+ if (npages > fd->uctxt->expected_count) {
+ dd_dev_err(dd, "Expected buffer too big\n");
+ return -EINVAL;
+@@ -196,7 +191,6 @@ static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf)
+ return pinned;
+ }
+ tidbuf->pages = pages;
+- tidbuf->npages = npages;
+ fd->tid_n_pinned += pinned;
+ return pinned;
+ }
+@@ -274,6 +268,7 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd,
+ mutex_init(&tidbuf->cover_mutex);
+ tidbuf->vaddr = tinfo->vaddr;
+ tidbuf->length = tinfo->length;
++ tidbuf->npages = num_user_pages(tidbuf->vaddr, tidbuf->length);
+ tidbuf->psets = kcalloc(uctxt->expected_count, sizeof(*tidbuf->psets),
+ GFP_KERNEL);
+ if (!tidbuf->psets) {
+--
+2.39.0
+
--- /dev/null
+From 7c91c059210f9400eab6b0bb70a7ff1269414ccf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 17:25:51 +0200
+Subject: neigh: make sure used and confirmed times are valid
+
+From: Julian Anastasov <ja@ssi.bg>
+
+[ Upstream commit c1d2ecdf5e38e3489ce8328238b558b3b2866fe1 ]
+
+Entries can linger in cache without timer for days, thanks to
+the gc_thresh1 limit. As result, without traffic, the confirmed
+time can be outdated and to appear to be in the future. Later,
+on traffic, NUD_STALE entries can switch to NUD_DELAY and start
+the timer which can see the invalid confirmed time and wrongly
+switch to NUD_REACHABLE state instead of NUD_PROBE. As result,
+timer is set many days in the future. This is more visible on
+32-bit platforms, with higher HZ value.
+
+Why this is a problem? While we expect unused entries to expire,
+such entries stay in REACHABLE state for too long, locked in
+cache. They are not expired normally, only when cache is full.
+
+Problem and the wrong state change reported by Zhang Changzhong:
+
+172.16.1.18 dev bond0 lladdr 0a:0e:0f:01:12:01 ref 1 used 350521/15994171/350520 probes 4 REACHABLE
+
+350520 seconds have elapsed since this entry was last updated, but it is
+still in the REACHABLE state (base_reachable_time_ms is 30000),
+preventing lladdr from being updated through probe.
+
+Fix it by ensuring timer is started with valid used/confirmed
+times. Considering the valid time range is LONG_MAX jiffies,
+we try not to go too much in the past while we are in
+DELAY/PROBE state. There are also places that need
+used/updated times to be validated while timer is not running.
+
+Reported-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Signed-off-by: Julian Anastasov <ja@ssi.bg>
+Tested-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/neighbour.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 952a54763358e..bf081f62ae58b 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -269,7 +269,7 @@ static int neigh_forced_gc(struct neigh_table *tbl)
+ (n->nud_state == NUD_NOARP) ||
+ (tbl->is_multicast &&
+ tbl->is_multicast(n->primary_key)) ||
+- time_after(tref, n->updated))
++ !time_in_range(n->updated, tref, jiffies))
+ remove = true;
+ write_unlock(&n->lock);
+
+@@ -289,7 +289,17 @@ static int neigh_forced_gc(struct neigh_table *tbl)
+
+ static void neigh_add_timer(struct neighbour *n, unsigned long when)
+ {
++ /* Use safe distance from the jiffies - LONG_MAX point while timer
++ * is running in DELAY/PROBE state but still show to user space
++ * large times in the past.
++ */
++ unsigned long mint = jiffies - (LONG_MAX - 86400 * HZ);
++
+ neigh_hold(n);
++ if (!time_in_range(n->confirmed, mint, jiffies))
++ n->confirmed = mint;
++ if (time_before(n->used, n->confirmed))
++ n->used = n->confirmed;
+ if (unlikely(mod_timer(&n->timer, when))) {
+ printk("NEIGH: BUG, double timer add, state is %x\n",
+ n->nud_state);
+@@ -1001,12 +1011,14 @@ static void neigh_periodic_work(struct work_struct *work)
+ goto next_elt;
+ }
+
+- if (time_before(n->used, n->confirmed))
++ if (time_before(n->used, n->confirmed) &&
++ time_is_before_eq_jiffies(n->confirmed))
+ n->used = n->confirmed;
+
+ if (refcount_read(&n->refcnt) == 1 &&
+ (state == NUD_FAILED ||
+- time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
++ !time_in_range_open(jiffies, n->used,
++ n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
+ *np = n->next;
+ neigh_mark_dead(n);
+ write_unlock(&n->lock);
+--
+2.39.0
+
--- /dev/null
+From 7c9cfc31f24b1b92d95e95b2faa683aaa7897198 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Jan 2023 07:48:10 -0600
+Subject: pinctrl: amd: Fix debug output for debounce time
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit c6e0679b8381bf03315e6660cf5370f916c1a1c6 ]
+
+If one GPIO has debounce enabled but future GPIOs in the list don't
+have debounce the time never gets reset and shows wrong value.
+
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/20230121134812.16637-2-mario.limonciello@amd.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-amd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
+index 9bc6e3922e78e..32c3edaf90385 100644
+--- a/drivers/pinctrl/pinctrl-amd.c
++++ b/drivers/pinctrl/pinctrl-amd.c
+@@ -365,6 +365,7 @@ static void amd_gpio_dbg_show(struct seq_file *s, struct gpio_chip *gc)
+
+ } else {
+ debounce_enable = " ∅";
++ time = 0;
+ }
+ snprintf(debounce_value, sizeof(debounce_value), "%u", time * unit);
+ seq_printf(s, "debounce %s (🕑 %sus)| ", debounce_enable, debounce_value);
+--
+2.39.0
+
--- /dev/null
+From 576df3005b36595b5ded85fd8900b6ff26b89adf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 21:27:35 +1100
+Subject: powerpc: Don't select ARCH_WANTS_NO_INSTR
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit e33416fca8a2313b8650bd5807aaf34354d39a4c ]
+
+Commit 41b7a347bf14 ("powerpc: Book3S 64-bit outline-only KASAN
+support") added a select of ARCH_WANTS_NO_INSTR, because it also added
+some uses of noinstr. However noinstr is always defined, regardless of
+ARCH_WANTS_NO_INSTR, so there's no need to select it just for that.
+
+As PeterZ says [1]:
+ Note that by selecting ARCH_WANTS_NO_INSTR you effectively state to
+ abide by its rules.
+
+As of now the powerpc code does not abide by those rules, and trips some
+new warnings added by Peter in linux-next.
+
+So until the code can be fixed to avoid those warnings, disable
+ARCH_WANTS_NO_INSTR.
+
+Note that ARCH_WANTS_NO_INSTR is also used to gate building KCOV and
+parts of KCSAN. However none of the noinstr annotations in powerpc were
+added for KCOV or KCSAN, instead instrumentation is blocked at the file
+level using KCOV_INSTRUMENT_foo.o := n.
+
+[1]: https://lore.kernel.org/linuxppc-dev/Y9t6yoafrO5YqVgM@hirez.programming.kicks-ass.net
+
+Reported-by: Sachin Sant <sachinp@linux.ibm.com>
+Suggested-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
+index 2ca5418457ed2..2b1141645d9e1 100644
+--- a/arch/powerpc/Kconfig
++++ b/arch/powerpc/Kconfig
+@@ -161,7 +161,6 @@ config PPC
+ select ARCH_WANT_IRQS_OFF_ACTIVATE_MM
+ select ARCH_WANT_LD_ORPHAN_WARN
+ select ARCH_WANTS_MODULES_DATA_IN_VMALLOC if PPC_BOOK3S_32 || PPC_8xx
+- select ARCH_WANTS_NO_INSTR
+ select ARCH_WEAK_RELEASE_ACQUIRE
+ select BINFMT_ELF
+ select BUILDTIME_TABLE_SORT
+--
+2.39.0
+
--- /dev/null
+From 701d7709d3daa85909a152b9c12e7d64338a99b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Feb 2023 21:24:09 +0200
+Subject: selftests: ocelot: tc_flower_chains: make test_vlan_ingress_modify()
+ more comprehensive
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit bbb253b206b9c417928a6c827d038e457f3012e9 ]
+
+We have two IS1 filters of the OCELOT_VCAP_KEY_ANY key type (the one with
+"action vlan pop" and the one with "action vlan modify") and one of the
+OCELOT_VCAP_KEY_IPV4 key type (the one with "action skbedit priority").
+But we have no IS1 filter with the OCELOT_VCAP_KEY_ETYPE key type, and
+there was an uncaught breakage there.
+
+To increase test coverage, convert one of the OCELOT_VCAP_KEY_ANY
+filters to OCELOT_VCAP_KEY_ETYPE, by making the filter also match on the
+MAC SA of the traffic sent by mausezahn, $h1_mac.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://lore.kernel.org/r/20230205192409.1796428-2-vladimir.oltean@nxp.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/drivers/net/ocelot/tc_flower_chains.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/drivers/net/ocelot/tc_flower_chains.sh b/tools/testing/selftests/drivers/net/ocelot/tc_flower_chains.sh
+index 9c79bbcce5a87..aff0a59f92d9a 100755
+--- a/tools/testing/selftests/drivers/net/ocelot/tc_flower_chains.sh
++++ b/tools/testing/selftests/drivers/net/ocelot/tc_flower_chains.sh
+@@ -246,7 +246,7 @@ test_vlan_ingress_modify()
+ bridge vlan add dev $swp2 vid 300
+
+ tc filter add dev $swp1 ingress chain $(IS1 2) pref 3 \
+- protocol 802.1Q flower skip_sw vlan_id 200 \
++ protocol 802.1Q flower skip_sw vlan_id 200 src_mac $h1_mac \
+ action vlan modify id 300 \
+ action goto chain $(IS2 0 0)
+
+--
+2.39.0
+
--- /dev/null
+fix-xfrm-i-support-for-nested-esp-tunnels.patch
+arm64-dts-rockchip-reduce-thermal-limits-on-rk3399-p.patch
+arm64-dts-rockchip-drop-unused-led-mode-property-fro.patch
+arm-dts-rockchip-add-power-domains-property-to-dp-no.patch
+arm64-dts-rockchip-add-missing-interrupt-cells-to-rk.patch
+arm64-dts-rockchip-fix-probe-of-analog-sound-card-on.patch
+hid-elecom-add-support-for-trackball-056e-011c.patch
+hid-ignore-battery-for-elan-touchscreen-on-asus-tp42.patch
+acpi-nfit-fix-a-potential-deadlock-during-nfit-teard.patch
+pinctrl-amd-fix-debug-output-for-debounce-time.patch
+btrfs-send-limit-number-of-clones-and-allocated-memo.patch
+arm64-dts-rockchip-align-rk3399-dmc-opp-table-with-b.patch
+asoc-rt715-sdca-fix-clock-stop-prepare-timeout-issue.patch
+ib-hfi1-assign-npages-earlier.patch
+powerpc-don-t-select-arch_wants_no_instr.patch
+asoc-sof-amd-fix-for-handling-spurious-interrupts-fr.patch
+arm-dts-stihxxx-b2120-fix-polarity-of-reset-line-of-.patch
+neigh-make-sure-used-and-confirmed-times-are-valid.patch
+hid-core-fix-deadloop-in-hid_apply_multiplier.patch
+asoc-codecs-es8326-fix-dts-properties-reading.patch
+hid-ignore-battery-for-elan-touchscreen-29df-on-hp.patch
+selftests-ocelot-tc_flower_chains-make-test_vlan_ing.patch
+x86-cpu-add-lunar-lake-m.patch
+drm-amd-display-disable-s-g-display-on-dcn-3.1.2-3.patch
--- /dev/null
+From ddaafb59325d07b7c66c1aebdc049b1f782020a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Feb 2023 09:23:40 -0800
+Subject: x86/cpu: Add Lunar Lake M
+
+From: Kan Liang <kan.liang@linux.intel.com>
+
+[ Upstream commit f545e8831e70065e127f903fc7aca09aa50422c7 ]
+
+Intel confirmed the existence of this CPU in Q4'2022
+earnings presentation.
+
+Add the CPU model number.
+
+[ dhansen: Merging these as soon as possible makes it easier
+ on all the folks developing model-specific features. ]
+
+Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Link: https://lore.kernel.org/all/20230208172340.158548-1-tony.luck%40intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/intel-family.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h
+index 347707d459c67..cbaf174d8efd9 100644
+--- a/arch/x86/include/asm/intel-family.h
++++ b/arch/x86/include/asm/intel-family.h
+@@ -123,6 +123,8 @@
+ #define INTEL_FAM6_METEORLAKE 0xAC
+ #define INTEL_FAM6_METEORLAKE_L 0xAA
+
++#define INTEL_FAM6_LUNARLAKE_M 0xBD
++
+ /* "Small Core" Processors (Atom/E-Core) */
+
+ #define INTEL_FAM6_ATOM_BONNELL 0x1C /* Diamondville, Pineview */
+--
+2.39.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
