--- /dev/null
+From b18a456330e1c1ca207b57b45872f10336741388 Mon Sep 17 00:00:00 2001
+From: Emil Flink <emil.flink@gmail.com>
+Date: Tue, 15 Nov 2022 15:45:01 +0100
+Subject: ALSA: hda/realtek: fix speakers for Samsung Galaxy Book Pro
+
+From: Emil Flink <emil.flink@gmail.com>
+
+commit b18a456330e1c1ca207b57b45872f10336741388 upstream.
+
+The Samsung Galaxy Book Pro seems to have the same issue as a few
+other Samsung laptops, detailed in kernel bug report 207423. Sound from
+headphone jack works, but not the built-in speakers.
+
+alsa-info: http://alsa-project.org/db/?f=b40ba609dc6ae28dc84ad404a0d8a4bbcd8bea6d
+
+Signed-off-by: Emil Flink <emil.flink@gmail.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20221115144500.7782-1-emil.flink@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9446,6 +9446,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x144d, 0xc176, "Samsung Notebook 9 Pro (NP930MBE-K04US)", ALC298_FIXUP_SAMSUNG_AMP),
+ SND_PCI_QUIRK(0x144d, 0xc189, "Samsung Galaxy Flex Book (NT950QCG-X716)", ALC298_FIXUP_SAMSUNG_AMP),
+ SND_PCI_QUIRK(0x144d, 0xc18a, "Samsung Galaxy Book Ion (NP930XCJ-K01US)", ALC298_FIXUP_SAMSUNG_AMP),
++ SND_PCI_QUIRK(0x144d, 0xc1a3, "Samsung Galaxy Book Pro (NP935XDB-KC1SE)", ALC298_FIXUP_SAMSUNG_AMP),
+ SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8),
+ SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", ALC298_FIXUP_SAMSUNG_AMP),
+ SND_PCI_QUIRK(0x144d, 0xc830, "Samsung Galaxy Book Ion (NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_AMP),
--- /dev/null
+From 1abfd71ee8f3ed99c5d0df5d9843a360541d6808 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 15 Nov 2022 18:02:35 +0100
+Subject: ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 1abfd71ee8f3ed99c5d0df5d9843a360541d6808 upstream.
+
+Samsung Galaxy Book Pro 360 (13" 2021 NP930QBD-ke1US) with codec SSID
+144d:c1a6 requires the same workaround for enabling the speaker amp
+like other Samsung models with ALC298 codec.
+
+Link: https://bugzilla.opensuse.org/show_bug.cgi?id=1205100
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20221115170235.18875-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9447,6 +9447,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x144d, 0xc189, "Samsung Galaxy Flex Book (NT950QCG-X716)", ALC298_FIXUP_SAMSUNG_AMP),
+ SND_PCI_QUIRK(0x144d, 0xc18a, "Samsung Galaxy Book Ion (NP930XCJ-K01US)", ALC298_FIXUP_SAMSUNG_AMP),
+ SND_PCI_QUIRK(0x144d, 0xc1a3, "Samsung Galaxy Book Pro (NP935XDB-KC1SE)", ALC298_FIXUP_SAMSUNG_AMP),
++ SND_PCI_QUIRK(0x144d, 0xc1a6, "Samsung Galaxy Book Pro 360 (NP930QBD)", ALC298_FIXUP_SAMSUNG_AMP),
+ SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8),
+ SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", ALC298_FIXUP_SAMSUNG_AMP),
+ SND_PCI_QUIRK(0x144d, 0xc830, "Samsung Galaxy Book Ion (NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_AMP),
--- /dev/null
+From ad72c3c3f6eb81d2cb189ec71e888316adada5df Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sat, 12 Nov 2022 15:12:23 +0100
+Subject: ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit ad72c3c3f6eb81d2cb189ec71e888316adada5df upstream.
+
+snd_usbmidi_output_open() has a check of the NULL port with
+snd_BUG_ON(). snd_BUG_ON() was used as this shouldn't have happened,
+but in reality, the NULL port may be seen when the device gives an
+invalid endpoint setup at the descriptor, hence the driver skips the
+allocation. That is, the check itself is valid and snd_BUG_ON()
+should be dropped from there. Otherwise it's confusing as if it were
+a real bug, as recently syzbot stumbled on it.
+
+Reported-by: syzbot+9abda841d636d86c41da@syzkaller.appspotmail.com
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/syzbot+9abda841d636d86c41da@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/r/20221112141223.6144-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/midi.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/sound/usb/midi.c
++++ b/sound/usb/midi.c
+@@ -1133,10 +1133,8 @@ static int snd_usbmidi_output_open(struc
+ port = &umidi->endpoints[i].out->ports[j];
+ break;
+ }
+- if (!port) {
+- snd_BUG();
++ if (!port)
+ return -ENXIO;
+- }
+
+ substream->runtime->private_data = port;
+ port->state = STATE_UNKNOWN;
--- /dev/null
+From 7af87fc1ba136143314c870059b8f60180247cbd Mon Sep 17 00:00:00 2001
+From: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Date: Mon, 31 Oct 2022 14:58:12 -0400
+Subject: drm/amd/display: Add HUBP surface flip interrupt handler
+
+From: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+
+commit 7af87fc1ba136143314c870059b8f60180247cbd upstream.
+
+On IGT, there is a test named amd_hotplug, and when the subtest basic is
+executed on DCN31, we get the following error:
+
+[drm] *ERROR* [CRTC:71:crtc-0] flip_done timed out
+[drm] *ERROR* flip_done timed out
+[drm] *ERROR* [CRTC:71:crtc-0] commit wait timed out
+[drm] *ERROR* flip_done timed out
+[drm] *ERROR* [CONNECTOR:88:DP-1] commit wait timed out
+[drm] *ERROR* flip_done timed out
+[drm] *ERROR* [PLANE:59:plane-3] commit wait timed out
+
+After enable the page flip log with the below command:
+
+ echo -n 'format "[PFLIP]" +p' > /sys/kernel/debug/dynamic_debug/control
+
+It is possible to see that the flip was submitted, but DC never replied
+back, which generates time-out issues. This is an indication that the
+HUBP surface flip is missing. This commit fixes this issue by adding
+hubp1_set_flip_int to DCN31.
+
+Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
+Acked-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hubp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hubp.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hubp.c
+@@ -87,6 +87,7 @@ static struct hubp_funcs dcn31_hubp_func
+ .hubp_init = hubp3_init,
+ .set_unbounded_requesting = hubp31_set_unbounded_requesting,
+ .hubp_soft_reset = hubp31_soft_reset,
++ .hubp_set_flip_int = hubp1_set_flip_int,
+ .hubp_in_blank = hubp1_in_blank,
+ .program_extended_blank = hubp31_program_extended_blank,
+ };
--- /dev/null
+From 0e444a4de6b38c4593a07e4cfb5bf54c40cc79b6 Mon Sep 17 00:00:00 2001
+From: Melissa Wen <mwen@igalia.com>
+Date: Thu, 3 Nov 2022 17:45:00 -0100
+Subject: drm/amd/display: don't enable DRM CRTC degamma property for DCE
+
+From: Melissa Wen <mwen@igalia.com>
+
+commit 0e444a4de6b38c4593a07e4cfb5bf54c40cc79b6 upstream.
+
+DM maps DRM CRTC degamma to DPP (pre-blending) degamma block, but DCE doesn't
+support programmable degamma curve anywhere. Currently, a custom degamma is
+accepted by DM but just ignored by DCE driver and degamma correction isn't
+actually applied. There is no way to map custom degamma in DCE, therefore, DRM
+CRTC degamma property shouldn't be enabled for DCE drivers.
+
+Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Melissa Wen <mwen@igalia.com>
+Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
+@@ -412,7 +412,7 @@ int amdgpu_dm_crtc_init(struct amdgpu_di
+ {
+ struct amdgpu_crtc *acrtc = NULL;
+ struct drm_plane *cursor_plane;
+-
++ bool is_dcn;
+ int res = -ENOMEM;
+
+ cursor_plane = kzalloc(sizeof(*cursor_plane), GFP_KERNEL);
+@@ -450,8 +450,14 @@ int amdgpu_dm_crtc_init(struct amdgpu_di
+ acrtc->otg_inst = -1;
+
+ dm->adev->mode_info.crtcs[crtc_index] = acrtc;
+- drm_crtc_enable_color_mgmt(&acrtc->base, MAX_COLOR_LUT_ENTRIES,
++
++ /* Don't enable DRM CRTC degamma property for DCE since it doesn't
++ * support programmable degamma anywhere.
++ */
++ is_dcn = dm->adev->dm.dc->caps.color.dpp.dcn_arch;
++ drm_crtc_enable_color_mgmt(&acrtc->base, is_dcn ? MAX_COLOR_LUT_ENTRIES : 0,
+ true, MAX_COLOR_LUT_ENTRIES);
++
+ drm_mode_crtc_set_gamma_size(&acrtc->base, MAX_COLOR_LEGACY_LUT_ENTRIES);
+
+ return 0;
--- /dev/null
+From 0d502ef8898b3983eef9e40f50dfe100a0de5d93 Mon Sep 17 00:00:00 2001
+From: Stylon Wang <stylon.wang@amd.com>
+Date: Mon, 24 Oct 2022 15:36:16 +0800
+Subject: drm/amd/display: Fix access timeout to DPIA AUX at boot time
+
+From: Stylon Wang <stylon.wang@amd.com>
+
+commit 0d502ef8898b3983eef9e40f50dfe100a0de5d93 upstream.
+
+[Why]
+Since introduction of patch "Query DPIA HPD status.", link detection at
+boot could be accessing DPIA AUX, which will not succeed until
+DMUB outbox messaging is enabled and results in below dmesg logs:
+
+[ 160.840227] [drm:amdgpu_dm_process_dmub_aux_transfer_sync [amdgpu]] *ERROR* wait_for_completion_timeout timeout!
+
+[How]
+Enable DMUB outbox messaging before link detection at boot time.
+
+Reviewed-by: Wayne Lin <Wayne.Lin@amd.com>
+Acked-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Stylon Wang <stylon.wang@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 6.0.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1645,12 +1645,6 @@ static int amdgpu_dm_init(struct amdgpu_
+ }
+ }
+
+- if (amdgpu_dm_initialize_drm_device(adev)) {
+- DRM_ERROR(
+- "amdgpu: failed to initialize sw for display support.\n");
+- goto error;
+- }
+-
+ /* Enable outbox notification only after IRQ handlers are registered and DMUB is alive.
+ * It is expected that DMUB will resend any pending notifications at this point, for
+ * example HPD from DPIA.
+@@ -1658,6 +1652,12 @@ static int amdgpu_dm_init(struct amdgpu_
+ if (dc_is_dmub_outbox_supported(adev->dm.dc))
+ dc_enable_dmub_outbox(adev->dm.dc);
+
++ if (amdgpu_dm_initialize_drm_device(adev)) {
++ DRM_ERROR(
++ "amdgpu: failed to initialize sw for display support.\n");
++ goto error;
++ }
++
+ /* create fake encoders for MST */
+ dm_dp_create_fake_mst_encoders(adev);
+
--- /dev/null
+From 8d8494c3467d366eb0f7c8198dab80be8bdc47d2 Mon Sep 17 00:00:00 2001
+From: Stylon Wang <stylon.wang@amd.com>
+Date: Wed, 26 Oct 2022 21:00:40 +0800
+Subject: drm/amd/display: Fix invalid DPIA AUX reply causing system hang
+
+From: Stylon Wang <stylon.wang@amd.com>
+
+commit 8d8494c3467d366eb0f7c8198dab80be8bdc47d2 upstream.
+
+[Why]
+Some DPIA AUX replies have incorrect data length from original request.
+This could lead to overwriting of destination buffer if reply length is
+larger, which could cause invalid access to stack since many destination
+buffers are declared as local variables.
+
+[How]
+Check for invalid length from DPIA AUX replies and trigger a retry if
+reply length is not the same as original request. A DRM_WARN() dmesg log
+is also produced.
+
+Reviewed-by: Roman Li <Roman.Li@amd.com>
+Acked-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Stylon Wang <stylon.wang@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 6.0.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 20 ++++++++++++++++++++
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 6 ------
+ 2 files changed, 20 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -146,6 +146,14 @@ MODULE_FIRMWARE(FIRMWARE_NAVI12_DMCU);
+ /* Number of bytes in PSP footer for firmware. */
+ #define PSP_FOOTER_BYTES 0x100
+
++/*
++ * DMUB Async to Sync Mechanism Status
++ */
++#define DMUB_ASYNC_TO_SYNC_ACCESS_FAIL 1
++#define DMUB_ASYNC_TO_SYNC_ACCESS_TIMEOUT 2
++#define DMUB_ASYNC_TO_SYNC_ACCESS_SUCCESS 3
++#define DMUB_ASYNC_TO_SYNC_ACCESS_INVALID 4
++
+ /**
+ * DOC: overview
+ *
+@@ -10149,6 +10157,8 @@ static int amdgpu_dm_set_dmub_async_sync
+ *operation_result = AUX_RET_ERROR_TIMEOUT;
+ } else if (status_type == DMUB_ASYNC_TO_SYNC_ACCESS_FAIL) {
+ *operation_result = AUX_RET_ERROR_ENGINE_ACQUIRE;
++ } else if (status_type == DMUB_ASYNC_TO_SYNC_ACCESS_INVALID) {
++ *operation_result = AUX_RET_ERROR_INVALID_REPLY;
+ } else {
+ *operation_result = AUX_RET_ERROR_UNKNOWN;
+ }
+@@ -10196,6 +10206,16 @@ int amdgpu_dm_process_dmub_aux_transfer_
+ payload->reply[0] = adev->dm.dmub_notify->aux_reply.command;
+ if (!payload->write && adev->dm.dmub_notify->aux_reply.length &&
+ payload->reply[0] == AUX_TRANSACTION_REPLY_AUX_ACK) {
++
++ if (payload->length != adev->dm.dmub_notify->aux_reply.length) {
++ DRM_WARN("invalid read from DPIA AUX %x(%d) got length %d!\n",
++ payload->address, payload->length,
++ adev->dm.dmub_notify->aux_reply.length);
++ return amdgpu_dm_set_dmub_async_sync_status(is_cmd_aux, ctx,
++ DMUB_ASYNC_TO_SYNC_ACCESS_INVALID,
++ (uint32_t *)operation_result);
++ }
++
+ memcpy(payload->data, adev->dm.dmub_notify->aux_reply.data,
+ adev->dm.dmub_notify->aux_reply.length);
+ }
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+@@ -51,12 +51,6 @@
+ #define AMDGPU_DMUB_NOTIFICATION_MAX 5
+
+ /*
+- * DMUB Async to Sync Mechanism Status
+- */
+-#define DMUB_ASYNC_TO_SYNC_ACCESS_FAIL 1
+-#define DMUB_ASYNC_TO_SYNC_ACCESS_TIMEOUT 2
+-#define DMUB_ASYNC_TO_SYNC_ACCESS_SUCCESS 3
+-/*
+ #include "include/amdgpu_dal_power_if.h"
+ #include "amdgpu_dm_irq.h"
+ */
--- /dev/null
+From e7e4f77c991c9abf90924929a9d55f90b0bb78de Mon Sep 17 00:00:00 2001
+From: Roman Li <roman.li@amd.com>
+Date: Thu, 3 Nov 2022 17:33:07 -0400
+Subject: drm/amd/display: Fix optc2_configure warning on dcn314
+
+From: Roman Li <roman.li@amd.com>
+
+commit e7e4f77c991c9abf90924929a9d55f90b0bb78de upstream.
+
+[Why]
+dcn314 uses optc2_configure_crc() that wraps
+optc1_configure_crc() + set additional registers
+not applicable to dcn314.
+It's not critical but when used leads to warning like:
+WARNING: drivers/gpu/drm/amd/amdgpu/../display/dc/dc_helper.c
+Call Trace:
+<TASK>
+generic_reg_set_ex+0x6d/0xe0 [amdgpu]
+optc2_configure_crc+0x60/0x80 [amdgpu]
+dc_stream_configure_crc+0x129/0x150 [amdgpu]
+amdgpu_dm_crtc_configure_crc_source+0x5d/0xe0 [amdgpu]
+
+[How]
+Use optc1_configure_crc() directly
+
+Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
+Acked-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Roman Li <roman.li@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 6.0.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn314/dcn314_optc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_optc.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_optc.c
+@@ -237,7 +237,7 @@ static struct timing_generator_funcs dcn
+ .clear_optc_underflow = optc1_clear_optc_underflow,
+ .setup_global_swap_lock = NULL,
+ .get_crc = optc1_get_crc,
+- .configure_crc = optc2_configure_crc,
++ .configure_crc = optc1_configure_crc,
+ .set_dsc_config = optc3_set_dsc_config,
+ .get_dsc_status = optc2_get_dsc_status,
+ .set_dwb_source = NULL,
--- /dev/null
+From 246e667079e8d0fc85f842bceca8c5a3c5da5905 Mon Sep 17 00:00:00 2001
+From: Dillon Varone <Dillon.Varone@amd.com>
+Date: Thu, 3 Nov 2022 18:33:38 -0400
+Subject: drm/amd/display: Fix prefetch calculations for dcn32
+
+From: Dillon Varone <Dillon.Varone@amd.com>
+
+commit 246e667079e8d0fc85f842bceca8c5a3c5da5905 upstream.
+
+[Description]
+Prefetch calculation loop was not exiting until utilizing all of vstartup if it
+failed once. Locals need to be reset on each iteration of the loop.
+
+Reviewed-by: Jun Lei <Jun.Lei@amd.com>
+Acked-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Dillon Varone <Dillon.Varone@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 6.0.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c
+@@ -718,6 +718,8 @@ static void DISPCLKDPPCLKDCFCLKDeepSleep
+
+ do {
+ MaxTotalRDBandwidth = 0;
++ DestinationLineTimesForPrefetchLessThan2 = false;
++ VRatioPrefetchMoreThanMax = false;
+ #ifdef __DML_VBA_DEBUG__
+ dml_print("DML::%s: Start loop: VStartup = %d\n", __func__, mode_lib->vba.VStartupLines);
+ #endif
--- /dev/null
+From 7e952a18eb978a3e51fc1704b752378be66226b2 Mon Sep 17 00:00:00 2001
+From: George Shen <george.shen@amd.com>
+Date: Wed, 2 Nov 2022 15:06:48 -0400
+Subject: drm/amd/display: Support parsing VRAM info v3.0 from VBIOS
+
+From: George Shen <george.shen@amd.com>
+
+commit 7e952a18eb978a3e51fc1704b752378be66226b2 upstream.
+
+[Why]
+For DCN3.2 and DCN3.21, VBIOS has switch to using v3.0 of the VRAM
+info struct. We should read and override the VRAM info in driver with
+values provided by VBIOS to support memory downbin cases.
+
+Reviewed-by: Alvin Lee <Alvin.Lee2@amd.com>
+Acked-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: George Shen <george.shen@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 6.0.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 30 +++++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
++++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
+@@ -2392,6 +2392,26 @@ static enum bp_result get_vram_info_v25(
+ return result;
+ }
+
++static enum bp_result get_vram_info_v30(
++ struct bios_parser *bp,
++ struct dc_vram_info *info)
++{
++ struct atom_vram_info_header_v3_0 *info_v30;
++ enum bp_result result = BP_RESULT_OK;
++
++ info_v30 = GET_IMAGE(struct atom_vram_info_header_v3_0,
++ DATA_TABLES(vram_info));
++
++ if (info_v30 == NULL)
++ return BP_RESULT_BADBIOSTABLE;
++
++ info->num_chans = info_v30->channel_num;
++ info->dram_channel_width_bytes = (1 << info_v30->channel_width) / 8;
++
++ return result;
++}
++
++
+ /*
+ * get_integrated_info_v11
+ *
+@@ -3022,6 +3042,16 @@ static enum bp_result bios_parser_get_vr
+ break;
+ default:
+ break;
++ }
++ break;
++
++ case 3:
++ switch (revision.minor) {
++ case 0:
++ result = get_vram_info_v30(bp, info);
++ break;
++ default:
++ break;
+ }
+ break;
+
--- /dev/null
+From 8652da45d09abe1b3174dbb80dc5176b8c3fa08e Mon Sep 17 00:00:00 2001
+From: Evan Quan <evan.quan@amd.com>
+Date: Tue, 8 Nov 2022 15:44:46 +0800
+Subject: drm/amd/pm: enable runpm support over BACO for SMU13.0.0
+
+From: Evan Quan <evan.quan@amd.com>
+
+commit 8652da45d09abe1b3174dbb80dc5176b8c3fa08e upstream.
+
+Enable SMU13.0.0 runpm support.
+
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Reviewed-by: Feifei Xu <Feifei.Xu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 6.0.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h | 8 +++++
+ drivers/gpu/drm/amd/pm/swsmu/inc/smu_v11_0.h | 10 ------
+ drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h | 11 +-----
+ drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 2 -
+ drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 9 +++++
+ drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 30 +++++++++++++++++--
+ 6 files changed, 50 insertions(+), 20 deletions(-)
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
++++ b/drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h
+@@ -1372,6 +1372,14 @@ enum smu_cmn2asic_mapping_type {
+ CMN2ASIC_MAPPING_WORKLOAD,
+ };
+
++enum smu_baco_seq {
++ BACO_SEQ_BACO = 0,
++ BACO_SEQ_MSR,
++ BACO_SEQ_BAMACO,
++ BACO_SEQ_ULPS,
++ BACO_SEQ_COUNT,
++};
++
+ #define MSG_MAP(msg, index, valid_in_vf) \
+ [SMU_MSG_##msg] = {1, (index), (valid_in_vf)}
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v11_0.h
++++ b/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v11_0.h
+@@ -147,14 +147,6 @@ struct smu_11_5_power_context {
+ uint32_t max_fast_ppt_limit;
+ };
+
+-enum smu_v11_0_baco_seq {
+- BACO_SEQ_BACO = 0,
+- BACO_SEQ_MSR,
+- BACO_SEQ_BAMACO,
+- BACO_SEQ_ULPS,
+- BACO_SEQ_COUNT,
+-};
+-
+ #if defined(SWSMU_CODE_LAYER_L2) || defined(SWSMU_CODE_LAYER_L3)
+
+ int smu_v11_0_init_microcode(struct smu_context *smu);
+@@ -257,7 +249,7 @@ int smu_v11_0_baco_enter(struct smu_cont
+ int smu_v11_0_baco_exit(struct smu_context *smu);
+
+ int smu_v11_0_baco_set_armd3_sequence(struct smu_context *smu,
+- enum smu_v11_0_baco_seq baco_seq);
++ enum smu_baco_seq baco_seq);
+
+ int smu_v11_0_mode1_reset(struct smu_context *smu);
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h
++++ b/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h
+@@ -123,14 +123,6 @@ struct smu_13_0_power_context {
+ enum smu_13_0_power_state power_state;
+ };
+
+-enum smu_v13_0_baco_seq {
+- BACO_SEQ_BACO = 0,
+- BACO_SEQ_MSR,
+- BACO_SEQ_BAMACO,
+- BACO_SEQ_ULPS,
+- BACO_SEQ_COUNT,
+-};
+-
+ #if defined(SWSMU_CODE_LAYER_L2) || defined(SWSMU_CODE_LAYER_L3)
+
+ int smu_v13_0_init_microcode(struct smu_context *smu);
+@@ -217,6 +209,9 @@ int smu_v13_0_set_azalia_d3_pme(struct s
+ int smu_v13_0_get_max_sustainable_clocks_by_dc(struct smu_context *smu,
+ struct pp_smu_nv_clock_table *max_clocks);
+
++int smu_v13_0_baco_set_armd3_sequence(struct smu_context *smu,
++ enum smu_baco_seq baco_seq);
++
+ bool smu_v13_0_baco_is_support(struct smu_context *smu);
+
+ enum smu_baco_state smu_v13_0_baco_get_state(struct smu_context *smu);
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
+@@ -1576,7 +1576,7 @@ int smu_v11_0_set_azalia_d3_pme(struct s
+ }
+
+ int smu_v11_0_baco_set_armd3_sequence(struct smu_context *smu,
+- enum smu_v11_0_baco_seq baco_seq)
++ enum smu_baco_seq baco_seq)
+ {
+ return smu_cmn_send_smc_msg_with_param(smu, SMU_MSG_ArmD3, baco_seq, NULL);
+ }
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
+@@ -2219,6 +2219,15 @@ int smu_v13_0_gfx_ulv_control(struct smu
+ return ret;
+ }
+
++int smu_v13_0_baco_set_armd3_sequence(struct smu_context *smu,
++ enum smu_baco_seq baco_seq)
++{
++ return smu_cmn_send_smc_msg_with_param(smu,
++ SMU_MSG_ArmD3,
++ baco_seq,
++ NULL);
++}
++
+ bool smu_v13_0_baco_is_support(struct smu_context *smu)
+ {
+ struct smu_baco_context *smu_baco = &smu->smu_baco;
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
+@@ -120,6 +120,7 @@ static struct cmn2asic_msg_mapping smu_v
+ MSG_MAP(Mode1Reset, PPSMC_MSG_Mode1Reset, 0),
+ MSG_MAP(PrepareMp1ForUnload, PPSMC_MSG_PrepareMp1ForUnload, 0),
+ MSG_MAP(DFCstateControl, PPSMC_MSG_SetExternalClientDfCstateAllow, 0),
++ MSG_MAP(ArmD3, PPSMC_MSG_ArmD3, 0),
+ };
+
+ static struct cmn2asic_mapping smu_v13_0_0_clk_map[SMU_CLK_COUNT] = {
+@@ -1566,6 +1567,31 @@ static int smu_v13_0_0_set_power_profile
+ NULL);
+ }
+
++static int smu_v13_0_0_baco_enter(struct smu_context *smu)
++{
++ struct smu_baco_context *smu_baco = &smu->smu_baco;
++ struct amdgpu_device *adev = smu->adev;
++
++ if (adev->in_runpm && smu_cmn_is_audio_func_enabled(adev))
++ return smu_v13_0_baco_set_armd3_sequence(smu,
++ smu_baco->maco_support ? BACO_SEQ_BAMACO : BACO_SEQ_BACO);
++ else
++ return smu_v13_0_baco_enter(smu);
++}
++
++static int smu_v13_0_0_baco_exit(struct smu_context *smu)
++{
++ struct amdgpu_device *adev = smu->adev;
++
++ if (adev->in_runpm && smu_cmn_is_audio_func_enabled(adev)) {
++ /* Wait for PMFW handling for the Dstate change */
++ usleep_range(10000, 11000);
++ return smu_v13_0_baco_set_armd3_sequence(smu, BACO_SEQ_ULPS);
++ } else {
++ return smu_v13_0_baco_exit(smu);
++ }
++}
++
+ static bool smu_v13_0_0_is_mode1_reset_supported(struct smu_context *smu)
+ {
+ struct amdgpu_device *adev = smu->adev;
+@@ -1827,8 +1853,8 @@ static const struct pptable_funcs smu_v1
+ .baco_is_support = smu_v13_0_baco_is_support,
+ .baco_get_state = smu_v13_0_baco_get_state,
+ .baco_set_state = smu_v13_0_baco_set_state,
+- .baco_enter = smu_v13_0_baco_enter,
+- .baco_exit = smu_v13_0_baco_exit,
++ .baco_enter = smu_v13_0_0_baco_enter,
++ .baco_exit = smu_v13_0_0_baco_exit,
+ .mode1_reset_is_support = smu_v13_0_0_is_mode1_reset_supported,
+ .mode1_reset = smu_v13_0_mode1_reset,
+ .set_mp1_state = smu_v13_0_0_set_mp1_state,
--- /dev/null
+From df7c013efc1a0da8861099802b2d6ab2aacaeb1b Mon Sep 17 00:00:00 2001
+From: Evan Quan <evan.quan@amd.com>
+Date: Tue, 8 Nov 2022 16:07:39 +0800
+Subject: drm/amd/pm: enable runpm support over BACO for SMU13.0.7
+
+From: Evan Quan <evan.quan@amd.com>
+
+commit df7c013efc1a0da8861099802b2d6ab2aacaeb1b upstream.
+
+Enable SMU13.0.7 runpm support.
+
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Reviewed-by: Feifei Xu <Feifei.Xu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 6.0.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ .../drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 30 +++++++++++++++++--
+ 1 file changed, 28 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
+index c4102cfb734c..d74debc584f8 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
+@@ -122,6 +122,7 @@ static struct cmn2asic_msg_mapping smu_v13_0_7_message_map[SMU_MSG_MAX_COUNT] =
+ MSG_MAP(PrepareMp1ForUnload, PPSMC_MSG_PrepareMp1ForUnload, 0),
+ MSG_MAP(SetMGpuFanBoostLimitRpm, PPSMC_MSG_SetMGpuFanBoostLimitRpm, 0),
+ MSG_MAP(DFCstateControl, PPSMC_MSG_SetExternalClientDfCstateAllow, 0),
++ MSG_MAP(ArmD3, PPSMC_MSG_ArmD3, 0),
+ };
+
+ static struct cmn2asic_mapping smu_v13_0_7_clk_map[SMU_CLK_COUNT] = {
+@@ -1578,6 +1579,31 @@ static int smu_v13_0_7_set_mp1_state(struct smu_context *smu,
+ return ret;
+ }
+
++static int smu_v13_0_7_baco_enter(struct smu_context *smu)
++{
++ struct smu_baco_context *smu_baco = &smu->smu_baco;
++ struct amdgpu_device *adev = smu->adev;
++
++ if (adev->in_runpm && smu_cmn_is_audio_func_enabled(adev))
++ return smu_v13_0_baco_set_armd3_sequence(smu,
++ smu_baco->maco_support ? BACO_SEQ_BAMACO : BACO_SEQ_BACO);
++ else
++ return smu_v13_0_baco_enter(smu);
++}
++
++static int smu_v13_0_7_baco_exit(struct smu_context *smu)
++{
++ struct amdgpu_device *adev = smu->adev;
++
++ if (adev->in_runpm && smu_cmn_is_audio_func_enabled(adev)) {
++ /* Wait for PMFW handling for the Dstate change */
++ usleep_range(10000, 11000);
++ return smu_v13_0_baco_set_armd3_sequence(smu, BACO_SEQ_ULPS);
++ } else {
++ return smu_v13_0_baco_exit(smu);
++ }
++}
++
+ static bool smu_v13_0_7_is_mode1_reset_supported(struct smu_context *smu)
+ {
+ struct amdgpu_device *adev = smu->adev;
+@@ -1655,8 +1681,8 @@ static const struct pptable_funcs smu_v13_0_7_ppt_funcs = {
+ .baco_is_support = smu_v13_0_baco_is_support,
+ .baco_get_state = smu_v13_0_baco_get_state,
+ .baco_set_state = smu_v13_0_baco_set_state,
+- .baco_enter = smu_v13_0_baco_enter,
+- .baco_exit = smu_v13_0_baco_exit,
++ .baco_enter = smu_v13_0_7_baco_enter,
++ .baco_exit = smu_v13_0_7_baco_exit,
+ .mode1_reset_is_support = smu_v13_0_7_is_mode1_reset_supported,
+ .mode1_reset = smu_v13_0_mode1_reset,
+ .set_mp1_state = smu_v13_0_7_set_mp1_state,
+--
+2.38.1
+
--- /dev/null
+From 4b14841c9a820e484bc8c4c3f5a6fed1bc528cbc Mon Sep 17 00:00:00 2001
+From: Evan Quan <evan.quan@amd.com>
+Date: Tue, 8 Nov 2022 15:52:20 +0800
+Subject: drm/amd/pm: fix SMU13 runpm hang due to unintentional workaround
+
+From: Evan Quan <evan.quan@amd.com>
+
+commit 4b14841c9a820e484bc8c4c3f5a6fed1bc528cbc upstream.
+
+The workaround designed for some specific ASICs is wrongly applied
+to SMU13 ASICs. That leads to some runpm hang.
+
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Reviewed-by: Feifei Xu <Feifei.Xu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 23 +++++++++++------------
+ 1 file changed, 11 insertions(+), 12 deletions(-)
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+@@ -1131,22 +1131,21 @@ static int smu_smc_hw_setup(struct smu_c
+ uint64_t features_supported;
+ int ret = 0;
+
+- if (adev->in_suspend && smu_is_dpm_running(smu)) {
+- dev_info(adev->dev, "dpm has been enabled\n");
+- /* this is needed specifically */
+- switch (adev->ip_versions[MP1_HWIP][0]) {
+- case IP_VERSION(11, 0, 7):
+- case IP_VERSION(11, 0, 11):
+- case IP_VERSION(11, 5, 0):
+- case IP_VERSION(11, 0, 12):
++ switch (adev->ip_versions[MP1_HWIP][0]) {
++ case IP_VERSION(11, 0, 7):
++ case IP_VERSION(11, 0, 11):
++ case IP_VERSION(11, 5, 0):
++ case IP_VERSION(11, 0, 12):
++ if (adev->in_suspend && smu_is_dpm_running(smu)) {
++ dev_info(adev->dev, "dpm has been enabled\n");
+ ret = smu_system_features_control(smu, true);
+ if (ret)
+ dev_err(adev->dev, "Failed system features control!\n");
+- break;
+- default:
+- break;
++ return ret;
+ }
+- return ret;
++ break;
++ default:
++ break;
+ }
+
+ ret = smu_init_display_count(smu, 0);
--- /dev/null
+From 5954acbacbd1946b96ce8ee799d309cb0cd3cb9d Mon Sep 17 00:00:00 2001
+From: Simon Rettberg <simon.rettberg@rz.uni-freiburg.de>
+Date: Thu, 6 Oct 2022 11:33:14 +0200
+Subject: drm/display: Don't assume dual mode adaptors support i2c sub-addressing
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Simon Rettberg <simon.rettberg@rz.uni-freiburg.de>
+
+commit 5954acbacbd1946b96ce8ee799d309cb0cd3cb9d upstream.
+
+Current dual mode adaptor ("DP++") detection code assumes that all
+adaptors support i2c sub-addressing for read operations from the
+DP-HDMI adaptor ID buffer. It has been observed that multiple
+adaptors do not in fact support this, and always return data starting
+at register 0. On affected adaptors, the code fails to read the proper
+registers that would identify the device as a type 2 adaptor, and
+handles those as type 1, limiting the TMDS clock to 165MHz, even if
+the according register would announce a higher TMDS clock.
+Fix this by always reading the ID buffer starting from offset 0, and
+discarding any bytes before the actual offset of interest.
+
+We tried finding authoritative documentation on whether or not this is
+allowed behaviour, but since all the official VESA docs are paywalled,
+the best we could come up with was the spec sheet for Texas Instruments'
+SNx5DP149 chip family.[1] It explicitly mentions that sub-addressing is
+supported for register writes, but *not* for reads (See NOTE in
+section 8.5.3). Unless TI openly decided to violate the VESA spec, one
+could take that as a hint that sub-addressing is in fact not mandated
+by VESA.
+The other two adaptors affected used the PS8409(A) and the LT8611,
+according to the data returned from their ID buffers.
+
+[1] https://www.ti.com/lit/ds/symlink/sn75dp149.pdf
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Simon Rettberg <simon.rettberg@rz.uni-freiburg.de>
+Reviewed-by: Rafael Gieschke <rafael.gieschke@rz.uni-freiburg.de>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221006113314.41101987@computer
+Acked-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/display/drm_dp_dual_mode_helper.c | 51 ++++++++++++----------
+ 1 file changed, 29 insertions(+), 22 deletions(-)
+
+--- a/drivers/gpu/drm/display/drm_dp_dual_mode_helper.c
++++ b/drivers/gpu/drm/display/drm_dp_dual_mode_helper.c
+@@ -63,23 +63,45 @@
+ ssize_t drm_dp_dual_mode_read(struct i2c_adapter *adapter,
+ u8 offset, void *buffer, size_t size)
+ {
++ u8 zero = 0;
++ char *tmpbuf = NULL;
++ /*
++ * As sub-addressing is not supported by all adaptors,
++ * always explicitly read from the start and discard
++ * any bytes that come before the requested offset.
++ * This way, no matter whether the adaptor supports it
++ * or not, we'll end up reading the proper data.
++ */
+ struct i2c_msg msgs[] = {
+ {
+ .addr = DP_DUAL_MODE_SLAVE_ADDRESS,
+ .flags = 0,
+ .len = 1,
+- .buf = &offset,
++ .buf = &zero,
+ },
+ {
+ .addr = DP_DUAL_MODE_SLAVE_ADDRESS,
+ .flags = I2C_M_RD,
+- .len = size,
++ .len = size + offset,
+ .buf = buffer,
+ },
+ };
+ int ret;
+
++ if (offset) {
++ tmpbuf = kmalloc(size + offset, GFP_KERNEL);
++ if (!tmpbuf)
++ return -ENOMEM;
++
++ msgs[1].buf = tmpbuf;
++ }
++
+ ret = i2c_transfer(adapter, msgs, ARRAY_SIZE(msgs));
++ if (tmpbuf)
++ memcpy(buffer, tmpbuf + offset, size);
++
++ kfree(tmpbuf);
++
+ if (ret < 0)
+ return ret;
+ if (ret != ARRAY_SIZE(msgs))
+@@ -208,18 +230,6 @@ enum drm_dp_dual_mode_type drm_dp_dual_m
+ if (ret)
+ return DRM_DP_DUAL_MODE_UNKNOWN;
+
+- /*
+- * Sigh. Some (maybe all?) type 1 adaptors are broken and ack
+- * the offset but ignore it, and instead they just always return
+- * data from the start of the HDMI ID buffer. So for a broken
+- * type 1 HDMI adaptor a single byte read will always give us
+- * 0x44, and for a type 1 DVI adaptor it should give 0x00
+- * (assuming it implements any registers). Fortunately neither
+- * of those values will match the type 2 signature of the
+- * DP_DUAL_MODE_ADAPTOR_ID register so we can proceed with
+- * the type 2 adaptor detection safely even in the presence
+- * of broken type 1 adaptors.
+- */
+ ret = drm_dp_dual_mode_read(adapter, DP_DUAL_MODE_ADAPTOR_ID,
+ &adaptor_id, sizeof(adaptor_id));
+ drm_dbg_kms(dev, "DP dual mode adaptor ID: %02x (err %zd)\n", adaptor_id, ret);
+@@ -233,11 +243,10 @@ enum drm_dp_dual_mode_type drm_dp_dual_m
+ return DRM_DP_DUAL_MODE_TYPE2_DVI;
+ }
+ /*
+- * If neither a proper type 1 ID nor a broken type 1 adaptor
+- * as described above, assume type 1, but let the user know
+- * that we may have misdetected the type.
++ * If not a proper type 1 ID, still assume type 1, but let
++ * the user know that we may have misdetected the type.
+ */
+- if (!is_type1_adaptor(adaptor_id) && adaptor_id != hdmi_id[0])
++ if (!is_type1_adaptor(adaptor_id))
+ drm_err(dev, "Unexpected DP dual mode adaptor ID %02x\n", adaptor_id);
+
+ }
+@@ -343,10 +352,8 @@ EXPORT_SYMBOL(drm_dp_dual_mode_get_tmds_
+ * @enable: enable (as opposed to disable) the TMDS output buffers
+ *
+ * Set the state of the TMDS output buffers in the adaptor. For
+- * type2 this is set via the DP_DUAL_MODE_TMDS_OEN register. As
+- * some type 1 adaptors have problems with registers (see comments
+- * in drm_dp_dual_mode_detect()) we avoid touching the register,
+- * making this function a no-op on type 1 adaptors.
++ * type2 this is set via the DP_DUAL_MODE_TMDS_OEN register.
++ * Type1 adaptors do not support any register writes.
+ *
+ * Returns:
+ * 0 on success, negative error code on failure
--- /dev/null
+From 19ba6c8af9382c4c05dc6a0a79af3013b9a35cd0 Mon Sep 17 00:00:00 2001
+From: Xiu Jianfeng <xiujianfeng@huawei.com>
+Date: Wed, 16 Nov 2022 09:52:07 +0800
+Subject: ftrace: Fix null pointer dereference in ftrace_add_mod()
+
+From: Xiu Jianfeng <xiujianfeng@huawei.com>
+
+commit 19ba6c8af9382c4c05dc6a0a79af3013b9a35cd0 upstream.
+
+The @ftrace_mod is allocated by kzalloc(), so both the members {prev,next}
+of @ftrace_mode->list are NULL, it's not a valid state to call list_del().
+If kstrdup() for @ftrace_mod->{func|module} fails, it goes to @out_free
+tag and calls free_ftrace_mod() to destroy @ftrace_mod, then list_del()
+will write prev->next and next->prev, where null pointer dereference
+happens.
+
+BUG: kernel NULL pointer dereference, address: 0000000000000008
+Oops: 0002 [#1] PREEMPT SMP NOPTI
+Call Trace:
+ <TASK>
+ ftrace_mod_callback+0x20d/0x220
+ ? do_filp_open+0xd9/0x140
+ ftrace_process_regex.isra.51+0xbf/0x130
+ ftrace_regex_write.isra.52.part.53+0x6e/0x90
+ vfs_write+0xee/0x3a0
+ ? __audit_filter_op+0xb1/0x100
+ ? auditd_test_task+0x38/0x50
+ ksys_write+0xa5/0xe0
+ do_syscall_64+0x3a/0x90
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+Kernel panic - not syncing: Fatal exception
+
+So call INIT_LIST_HEAD() to initialize the list member to fix this issue.
+
+Link: https://lkml.kernel.org/r/20221116015207.30858-1-xiujianfeng@huawei.com
+
+Cc: stable@vger.kernel.org
+Fixes: 673feb9d76ab ("ftrace: Add :mod: caching infrastructure to trace_array")
+Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/ftrace.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -1289,6 +1289,7 @@ static int ftrace_add_mod(struct trace_a
+ if (!ftrace_mod)
+ return -ENOMEM;
+
++ INIT_LIST_HEAD(&ftrace_mod->list);
+ ftrace_mod->func = kstrdup(func, GFP_KERNEL);
+ ftrace_mod->module = kstrdup(module, GFP_KERNEL);
+ ftrace_mod->enable = enable;
--- /dev/null
+From 08948caebe93482db1adfd2154eba124f66d161d Mon Sep 17 00:00:00 2001
+From: Wang Wensheng <wangwensheng4@huawei.com>
+Date: Wed, 9 Nov 2022 09:44:32 +0000
+Subject: ftrace: Fix the possible incorrect kernel message
+
+From: Wang Wensheng <wangwensheng4@huawei.com>
+
+commit 08948caebe93482db1adfd2154eba124f66d161d upstream.
+
+If the number of mcount entries is an integer multiple of
+ENTRIES_PER_PAGE, the page count showing on the console would be wrong.
+
+Link: https://lkml.kernel.org/r/20221109094434.84046-2-wangwensheng4@huawei.com
+
+Cc: <mhiramat@kernel.org>
+Cc: <mark.rutland@arm.com>
+Cc: stable@vger.kernel.org
+Fixes: 5821e1b74f0d0 ("function tracing: fix wrong pos computing when read buffer has been fulfilled")
+Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/ftrace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -7394,7 +7394,7 @@ void __init ftrace_init(void)
+ }
+
+ pr_info("ftrace: allocating %ld entries in %ld pages\n",
+- count, count / ENTRIES_PER_PAGE + 1);
++ count, DIV_ROUND_UP(count, ENTRIES_PER_PAGE));
+
+ ret = ftrace_process_locs(NULL,
+ __start_mcount_loc,
--- /dev/null
+From bcea02b096333dc74af987cb9685a4dbdd820840 Mon Sep 17 00:00:00 2001
+From: Wang Wensheng <wangwensheng4@huawei.com>
+Date: Wed, 9 Nov 2022 09:44:33 +0000
+Subject: ftrace: Optimize the allocation for mcount entries
+
+From: Wang Wensheng <wangwensheng4@huawei.com>
+
+commit bcea02b096333dc74af987cb9685a4dbdd820840 upstream.
+
+If we can't allocate this size, try something smaller with half of the
+size. Its order should be decreased by one instead of divided by two.
+
+Link: https://lkml.kernel.org/r/20221109094434.84046-3-wangwensheng4@huawei.com
+
+Cc: <mhiramat@kernel.org>
+Cc: <mark.rutland@arm.com>
+Cc: stable@vger.kernel.org
+Fixes: a79008755497d ("ftrace: Allocate the mcount record pages as groups")
+Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/ftrace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -3193,7 +3193,7 @@ static int ftrace_allocate_records(struc
+ /* if we can't allocate this size, try something smaller */
+ if (!order)
+ return -ENOMEM;
+- order >>= 1;
++ order--;
+ goto again;
+ }
+
--- /dev/null
+From b98186aee22fa593bc8c6b2c5d839c2ee518bc8c Mon Sep 17 00:00:00 2001
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Thu, 17 Nov 2022 18:40:14 +0000
+Subject: io_uring: update res mask in io_poll_check_events
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+commit b98186aee22fa593bc8c6b2c5d839c2ee518bc8c upstream.
+
+When io_poll_check_events() collides with someone attempting to queue a
+task work, it'll spin for one more time. However, it'll continue to use
+the mask from the first iteration instead of updating it. For example,
+if the first wake up was a EPOLLIN and the second EPOLLOUT, the
+userspace will not get EPOLLOUT in time.
+
+Clear the mask for all subsequent iterations to force vfs_poll().
+
+Cc: stable@vger.kernel.org
+Fixes: aa43477b04025 ("io_uring: poll rework")
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Link: https://lore.kernel.org/r/2dac97e8f691231049cb259c4ae57e79e40b537c.1668710222.git.asml.silence@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/poll.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/io_uring/poll.c
++++ b/io_uring/poll.c
+@@ -256,6 +256,9 @@ static int io_poll_check_events(struct i
+ return ret;
+ }
+
++ /* force the next iteration to vfs_poll() */
++ req->cqe.res = 0;
++
+ /*
+ * Release all references, retry if someone tried to restart
+ * task_work while we were executing it.
--- /dev/null
+From 6412518f5cb953cbd84b6746db9741bfc92be40a Mon Sep 17 00:00:00 2001
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Date: Wed, 9 Nov 2022 14:03:46 +0530
+Subject: platform/x86/amd: pmc: Add new ACPI ID AMDI0009
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+commit 6412518f5cb953cbd84b6746db9741bfc92be40a upstream.
+
+Add new a new ACPI ID AMDI0009 used by upcoming AMD platform to the pmc
+supported list of devices.
+
+Cc: stable@vger.kernel.org # 6.0
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://lore.kernel.org/r/20221109083346.361603-1-Shyam-sundar.S-k@amd.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/amd/pmc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/platform/x86/amd/pmc.c
++++ b/drivers/platform/x86/amd/pmc.c
+@@ -918,6 +918,7 @@ static const struct acpi_device_id amd_p
+ {"AMDI0006", 0},
+ {"AMDI0007", 0},
+ {"AMDI0008", 0},
++ {"AMDI0009", 0},
+ {"AMD0004", 0},
+ {"AMD0005", 0},
+ { }
--- /dev/null
+From a5b5fb0fc47ddc7d1ed6a0365197639a01bc1f3a Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@amd.com>
+Date: Mon, 7 Nov 2022 20:33:23 -0600
+Subject: platform/x86/amd: pmc: Remove more CONFIG_DEBUG_FS checks
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+commit a5b5fb0fc47ddc7d1ed6a0365197639a01bc1f3a upstream.
+
+commit b37fe34c8309 ("platform/x86/amd: pmc: remove CONFIG_DEBUG_FS
+checks") removed most CONFIG_DEBUG_FS checks, but there were some
+left that were reported to cause compile test failures.
+
+Remove the remaining checks, and also the unnecessary CONFIG_SUSPEND
+used in the same place.
+
+Reported-by: liyupeng@zbhlos.com
+Fixes: b37fe34c8309 ("platform/x86/amd: pmc: remove CONFIG_DEBUG_FS checks")
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=216679
+Link: https://lore.kernel.org/r/20221108023323.19304-1-mario.limonciello@amd.com
+Cc: stable@vger.kernel.org
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/amd/pmc.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/platform/x86/amd/pmc.c
++++ b/drivers/platform/x86/amd/pmc.c
+@@ -274,7 +274,6 @@ static const struct file_operations amd_
+ .release = amd_pmc_stb_debugfs_release_v2,
+ };
+
+-#if defined(CONFIG_SUSPEND) || defined(CONFIG_DEBUG_FS)
+ static int amd_pmc_setup_smu_logging(struct amd_pmc_dev *dev)
+ {
+ if (dev->cpu_id == AMD_CPU_ID_PCO) {
+@@ -349,7 +348,6 @@ static int get_metrics_table(struct amd_
+ memcpy_fromio(table, pdev->smu_virt_addr, sizeof(struct smu_metrics));
+ return 0;
+ }
+-#endif /* CONFIG_SUSPEND || CONFIG_DEBUG_FS */
+
+ #ifdef CONFIG_SUSPEND
+ static void amd_pmc_validate_deepest(struct amd_pmc_dev *pdev)
--- /dev/null
+From 0a1ebe35cb3b7aa1f4b26b37e2a0b9ae68dc4ffb Mon Sep 17 00:00:00 2001
+From: Yi Yang <yiyang13@huawei.com>
+Date: Fri, 18 Nov 2022 10:15:34 +0900
+Subject: rethook: fix a potential memleak in rethook_alloc()
+
+From: Yi Yang <yiyang13@huawei.com>
+
+commit 0a1ebe35cb3b7aa1f4b26b37e2a0b9ae68dc4ffb upstream.
+
+In rethook_alloc(), the variable rh is not freed or passed out
+if handler is NULL, which could lead to a memleak, fix it.
+
+Link: https://lore.kernel.org/all/20221110104438.88099-1-yiyang13@huawei.com/
+[Masami: Add "rethook:" tag to the title.]
+
+Fixes: 54ecbe6f1ed5 ("rethook: Add a generic return hook")
+Cc: stable@vger.kernel.org
+Signed-off-by: Yi Yang <yiyang13@huawei.com>
+Acke-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/rethook.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/kernel/trace/rethook.c
++++ b/kernel/trace/rethook.c
+@@ -83,8 +83,10 @@ struct rethook *rethook_alloc(void *data
+ {
+ struct rethook *rh = kzalloc(sizeof(struct rethook), GFP_KERNEL);
+
+- if (!rh || !handler)
++ if (!rh || !handler) {
++ kfree(rh);
+ return NULL;
++ }
+
+ rh->data = data;
+ rh->handler = handler;
--- /dev/null
+From 5c294de36e7fb3e0cba0c4e1ef9a5f57bc080d0f Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Thu, 3 Nov 2022 15:46:48 +0100
+Subject: Revert "usb: dwc3: disable USB core PHY management"
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 5c294de36e7fb3e0cba0c4e1ef9a5f57bc080d0f upstream.
+
+This reverts commit 6000b8d900cd5f52fbcd0776d0cc396e88c8c2ea.
+
+The offending commit disabled the USB core PHY management as the dwc3
+already manages the PHYs in question.
+
+Unfortunately some platforms have started relying on having USB core
+also controlling the PHY and this is specifically currently needed on
+some Exynos platforms for PHY calibration or connected device may fail
+to enumerate.
+
+The PHY calibration was previously handled in the dwc3 driver, but to
+work around some issues related to how the dwc3 driver interacts with
+xhci (e.g. using multiple drivers) this was moved to USB core by commits
+34c7ed72f4f0 ("usb: core: phy: add support for PHY calibration") and
+a0a465569b45 ("usb: dwc3: remove generic PHY calibrate() calls").
+
+The same PHY obviously should not be controlled from two different
+places, which for example do no agree on the PHY mode or power state
+during suspend, but as the offending patch was backported to stable,
+let's revert it for now.
+
+Reported-by: Stefan Agner <stefan@agner.ch>
+Link: https://lore.kernel.org/lkml/808bdba846bb60456adf10a3016911ee@agner.ch/
+Fixes: 6000b8d900cd ("usb: dwc3: disable USB core PHY management")
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/20221103144648.14197-1-johan+linaro@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/host.c | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+--- a/drivers/usb/dwc3/host.c
++++ b/drivers/usb/dwc3/host.c
+@@ -11,13 +11,8 @@
+ #include <linux/of.h>
+ #include <linux/platform_device.h>
+
+-#include "../host/xhci-plat.h"
+ #include "core.h"
+
+-static const struct xhci_plat_priv dwc3_xhci_plat_priv = {
+- .quirks = XHCI_SKIP_PHY_INIT,
+-};
+-
+ static void dwc3_host_fill_xhci_irq_res(struct dwc3 *dwc,
+ int irq, char *name)
+ {
+@@ -97,11 +92,6 @@ int dwc3_host_init(struct dwc3 *dwc)
+ goto err;
+ }
+
+- ret = platform_device_add_data(xhci, &dwc3_xhci_plat_priv,
+- sizeof(dwc3_xhci_plat_priv));
+- if (ret)
+- goto err;
+-
+ memset(props, 0, sizeof(struct property_entry) * ARRAY_SIZE(props));
+
+ if (dwc->usb3_lpm_capable)
--- /dev/null
+From 56f4ca0a79a9f1af98f26c54b9b89ba1f9bcc6bd Mon Sep 17 00:00:00 2001
+From: Daniil Tatianin <d-tatianin@yandex-team.ru>
+Date: Mon, 14 Nov 2022 17:31:29 +0300
+Subject: ring_buffer: Do not deactivate non-existant pages
+
+From: Daniil Tatianin <d-tatianin@yandex-team.ru>
+
+commit 56f4ca0a79a9f1af98f26c54b9b89ba1f9bcc6bd upstream.
+
+rb_head_page_deactivate() expects cpu_buffer to contain a valid list of
+->pages, so verify that the list is actually present before calling it.
+
+Found by Linux Verification Center (linuxtesting.org) with the SVACE
+static analysis tool.
+
+Link: https://lkml.kernel.org/r/20221114143129.3534443-1-d-tatianin@yandex-team.ru
+
+Cc: stable@vger.kernel.org
+Fixes: 77ae365eca895 ("ring-buffer: make lockless")
+Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/ring_buffer.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -1769,9 +1769,9 @@ static void rb_free_cpu_buffer(struct ri
+
+ free_buffer_page(cpu_buffer->reader_page);
+
+- rb_head_page_deactivate(cpu_buffer);
+-
+ if (head) {
++ rb_head_page_deactivate(cpu_buffer);
++
+ list_for_each_entry_safe(bpage, tmp, head, list) {
+ list_del_init(&bpage->list);
+ free_buffer_page(bpage);
netdevsim-fix-memory-leak-of-nsim_dev-fa_cookie.patch
block-make-dma_alignment-a-stacking-queue_limit.patch
dm-crypt-provide-dma_alignment-limit-in-io_hints.patch
+ftrace-fix-the-possible-incorrect-kernel-message.patch
+ftrace-optimize-the-allocation-for-mcount-entries.patch
+ftrace-fix-null-pointer-dereference-in-ftrace_add_mod.patch
+ring_buffer-do-not-deactivate-non-existant-pages.patch
+tracing-fix-memory-leak-in-tracing_read_pipe.patch
+tracing-ring-buffer-have-polling-block-on-watermark.patch
+tracing-fix-memory-leak-in-test_gen_synth_cmd-and-test_empty_synth_event.patch
+tracing-fix-wild-memory-access-in-register_synth_event.patch
+tracing-fix-race-where-eprobes-can-be-called-before-the-event.patch
+tracing-kprobe-fix-potential-null-ptr-deref-on-trace_event_file-in-kprobe_event_gen_test_exit.patch
+tracing-kprobe-fix-potential-null-ptr-deref-on-trace_array-in-kprobe_event_gen_test_exit.patch
+rethook-fix-a-potential-memleak-in-rethook_alloc.patch
+platform-x86-amd-pmc-remove-more-config_debug_fs-checks.patch
+platform-x86-amd-pmc-add-new-acpi-id-amdi0009.patch
+drm-amd-pm-enable-runpm-support-over-baco-for-smu13.0.7.patch
+drm-amd-pm-enable-runpm-support-over-baco-for-smu13.0.0.patch
+drm-amd-pm-fix-smu13-runpm-hang-due-to-unintentional-workaround.patch
+drm-display-don-t-assume-dual-mode-adaptors-support-i2c-sub-addressing.patch
+drm-amd-display-fix-invalid-dpia-aux-reply-causing-system-hang.patch
+drm-amd-display-add-hubp-surface-flip-interrupt-handler.patch
+drm-amd-display-fix-access-timeout-to-dpia-aux-at-boot-time.patch
+drm-amd-display-support-parsing-vram-info-v3.0-from-vbios.patch
+drm-amd-display-fix-optc2_configure-warning-on-dcn314.patch
+drm-amd-display-don-t-enable-drm-crtc-degamma-property-for-dce.patch
+drm-amd-display-fix-prefetch-calculations-for-dcn32.patch
+alsa-usb-audio-drop-snd_bug_on-from-snd_usbmidi_output_open.patch
+alsa-hda-realtek-fix-speakers-for-samsung-galaxy-book-pro.patch
+alsa-hda-realtek-fix-the-speaker-output-on-samsung-galaxy-book-pro-360.patch
+revert-usb-dwc3-disable-usb-core-phy-management.patch
+usb-dwc3-do-not-get-extcon-device-when-usb-role-switch-is-used.patch
+io_uring-update-res-mask-in-io_poll_check_events.patch
--- /dev/null
+From a4527fef9afe5c903c718d0cd24609fe9c754250 Mon Sep 17 00:00:00 2001
+From: Shang XiaoJing <shangxiaojing@huawei.com>
+Date: Thu, 17 Nov 2022 09:23:45 +0800
+Subject: tracing: Fix memory leak in test_gen_synth_cmd() and test_empty_synth_event()
+
+From: Shang XiaoJing <shangxiaojing@huawei.com>
+
+commit a4527fef9afe5c903c718d0cd24609fe9c754250 upstream.
+
+test_gen_synth_cmd() only free buf in fail path, hence buf will leak
+when there is no failure. Add kfree(buf) to prevent the memleak. The
+same reason and solution in test_empty_synth_event().
+
+unreferenced object 0xffff8881127de000 (size 2048):
+ comm "modprobe", pid 247, jiffies 4294972316 (age 78.756s)
+ hex dump (first 32 bytes):
+ 20 67 65 6e 5f 73 79 6e 74 68 5f 74 65 73 74 20 gen_synth_test
+ 20 70 69 64 5f 74 20 6e 65 78 74 5f 70 69 64 5f pid_t next_pid_
+ backtrace:
+ [<000000004254801a>] kmalloc_trace+0x26/0x100
+ [<0000000039eb1cf5>] 0xffffffffa00083cd
+ [<000000000e8c3bc8>] 0xffffffffa00086ba
+ [<00000000c293d1ea>] do_one_initcall+0xdb/0x480
+ [<00000000aa189e6d>] do_init_module+0x1cf/0x680
+ [<00000000d513222b>] load_module+0x6a50/0x70a0
+ [<000000001fd4d529>] __do_sys_finit_module+0x12f/0x1c0
+ [<00000000b36c4c0f>] do_syscall_64+0x3f/0x90
+ [<00000000bbf20cf3>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
+unreferenced object 0xffff8881127df000 (size 2048):
+ comm "modprobe", pid 247, jiffies 4294972324 (age 78.728s)
+ hex dump (first 32 bytes):
+ 20 65 6d 70 74 79 5f 73 79 6e 74 68 5f 74 65 73 empty_synth_tes
+ 74 20 20 70 69 64 5f 74 20 6e 65 78 74 5f 70 69 t pid_t next_pi
+ backtrace:
+ [<000000004254801a>] kmalloc_trace+0x26/0x100
+ [<00000000d4db9a3d>] 0xffffffffa0008071
+ [<00000000c31354a5>] 0xffffffffa00086ce
+ [<00000000c293d1ea>] do_one_initcall+0xdb/0x480
+ [<00000000aa189e6d>] do_init_module+0x1cf/0x680
+ [<00000000d513222b>] load_module+0x6a50/0x70a0
+ [<000000001fd4d529>] __do_sys_finit_module+0x12f/0x1c0
+ [<00000000b36c4c0f>] do_syscall_64+0x3f/0x90
+ [<00000000bbf20cf3>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Link: https://lkml.kernel.org/r/20221117012346.22647-2-shangxiaojing@huawei.com
+
+Cc: <mhiramat@kernel.org>
+Cc: <zanussi@kernel.org>
+Cc: <fengguang.wu@intel.com>
+Cc: stable@vger.kernel.org
+Fixes: 9fe41efaca08 ("tracing: Add synth event generation test module")
+Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/synth_event_gen_test.c | 16 ++++++----------
+ 1 file changed, 6 insertions(+), 10 deletions(-)
+
+--- a/kernel/trace/synth_event_gen_test.c
++++ b/kernel/trace/synth_event_gen_test.c
+@@ -120,15 +120,13 @@ static int __init test_gen_synth_cmd(voi
+
+ /* Now generate a gen_synth_test event */
+ ret = synth_event_trace_array(gen_synth_test, vals, ARRAY_SIZE(vals));
+- out:
++ free:
++ kfree(buf);
+ return ret;
+ delete:
+ /* We got an error after creating the event, delete it */
+ synth_event_delete("gen_synth_test");
+- free:
+- kfree(buf);
+-
+- goto out;
++ goto free;
+ }
+
+ /*
+@@ -227,15 +225,13 @@ static int __init test_empty_synth_event
+
+ /* Now trace an empty_synth_test event */
+ ret = synth_event_trace_array(empty_synth_test, vals, ARRAY_SIZE(vals));
+- out:
++ free:
++ kfree(buf);
+ return ret;
+ delete:
+ /* We got an error after creating the event, delete it */
+ synth_event_delete("empty_synth_test");
+- free:
+- kfree(buf);
+-
+- goto out;
++ goto free;
+ }
+
+ static struct synth_field_desc create_synth_test_fields[] = {
--- /dev/null
+From 649e72070cbbb8600eb823833e4748f5a0815116 Mon Sep 17 00:00:00 2001
+From: Wang Yufen <wangyufen@huawei.com>
+Date: Mon, 7 Nov 2022 19:04:50 +0800
+Subject: tracing: Fix memory leak in tracing_read_pipe()
+
+From: Wang Yufen <wangyufen@huawei.com>
+
+commit 649e72070cbbb8600eb823833e4748f5a0815116 upstream.
+
+kmemleak reports this issue:
+
+unreferenced object 0xffff888105a18900 (size 128):
+ comm "test_progs", pid 18933, jiffies 4336275356 (age 22801.766s)
+ hex dump (first 32 bytes):
+ 25 73 00 90 81 88 ff ff 26 05 00 00 42 01 58 04 %s......&...B.X.
+ 03 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<00000000560143a1>] __kmalloc_node_track_caller+0x4a/0x140
+ [<000000006af00822>] krealloc+0x8d/0xf0
+ [<00000000c309be6a>] trace_iter_expand_format+0x99/0x150
+ [<000000005a53bdb6>] trace_check_vprintf+0x1e0/0x11d0
+ [<0000000065629d9d>] trace_event_printf+0xb6/0xf0
+ [<000000009a690dc7>] trace_raw_output_bpf_trace_printk+0x89/0xc0
+ [<00000000d22db172>] print_trace_line+0x73c/0x1480
+ [<00000000cdba76ba>] tracing_read_pipe+0x45c/0x9f0
+ [<0000000015b58459>] vfs_read+0x17b/0x7c0
+ [<000000004aeee8ed>] ksys_read+0xed/0x1c0
+ [<0000000063d3d898>] do_syscall_64+0x3b/0x90
+ [<00000000a06dda7f>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+iter->fmt alloced in
+ tracing_read_pipe() -> .. ->trace_iter_expand_format(), but not
+freed, to fix, add free in tracing_release_pipe()
+
+Link: https://lkml.kernel.org/r/1667819090-4643-1-git-send-email-wangyufen@huawei.com
+
+Cc: stable@vger.kernel.org
+Fixes: efbbdaa22bb7 ("tracing: Show real address for trace event arguments")
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Wang Yufen <wangyufen@huawei.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -6657,6 +6657,7 @@ static int tracing_release_pipe(struct i
+ mutex_unlock(&trace_types_lock);
+
+ free_cpumask_var(iter->started);
++ kfree(iter->fmt);
+ mutex_destroy(&iter->mutex);
+ kfree(iter);
+
--- /dev/null
+From 94eedf3dded5fb472ce97bfaf3ac1c6c29c35d26 Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
+Date: Thu, 17 Nov 2022 21:42:49 -0500
+Subject: tracing: Fix race where eprobes can be called before the event
+
+From: Steven Rostedt (Google) <rostedt@goodmis.org>
+
+commit 94eedf3dded5fb472ce97bfaf3ac1c6c29c35d26 upstream.
+
+The flag that tells the event to call its triggers after reading the event
+is set for eprobes after the eprobe is enabled. This leads to a race where
+the eprobe may be triggered at the beginning of the event where the record
+information is NULL. The eprobe then dereferences the NULL record causing
+a NULL kernel pointer bug.
+
+Test for a NULL record to keep this from happening.
+
+Link: https://lore.kernel.org/linux-trace-kernel/20221116192552.1066630-1-rafaelmendsr@gmail.com/
+Link: https://lore.kernel.org/linux-trace-kernel/20221117214249.2addbe10@gandalf.local.home
+
+Cc: Linux Trace Kernel <linux-trace-kernel@vger.kernel.org>
+Cc: Tzvetomir Stoyanov <tz.stoyanov@gmail.com>
+Cc: Tom Zanussi <zanussi@kernel.org>
+Cc: stable@vger.kernel.org
+Fixes: 7491e2c442781 ("tracing: Add a probe that attaches to trace events")
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Reported-by: Rafael Mendonca <rafaelmendsr@gmail.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace_eprobe.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/kernel/trace/trace_eprobe.c
++++ b/kernel/trace/trace_eprobe.c
+@@ -560,6 +560,9 @@ static void eprobe_trigger_func(struct e
+ {
+ struct eprobe_data *edata = data->private_data;
+
++ if (unlikely(!rec))
++ return;
++
+ __eprobe_trace_func(edata, rec);
+ }
+
--- /dev/null
+From 1b5f1c34d3f5a664a57a5a7557a50e4e3cc2505c Mon Sep 17 00:00:00 2001
+From: Shang XiaoJing <shangxiaojing@huawei.com>
+Date: Thu, 17 Nov 2022 09:23:46 +0800
+Subject: tracing: Fix wild-memory-access in register_synth_event()
+
+From: Shang XiaoJing <shangxiaojing@huawei.com>
+
+commit 1b5f1c34d3f5a664a57a5a7557a50e4e3cc2505c upstream.
+
+In register_synth_event(), if set_synth_event_print_fmt() failed, then
+both trace_remove_event_call() and unregister_trace_event() will be
+called, which means the trace_event_call will call
+__unregister_trace_event() twice. As the result, the second unregister
+will causes the wild-memory-access.
+
+register_synth_event
+ set_synth_event_print_fmt failed
+ trace_remove_event_call
+ event_remove
+ if call->event.funcs then
+ __unregister_trace_event (first call)
+ unregister_trace_event
+ __unregister_trace_event (second call)
+
+Fix the bug by avoiding to call the second __unregister_trace_event() by
+checking if the first one is called.
+
+general protection fault, probably for non-canonical address
+ 0xfbd59c0000000024: 0000 [#1] SMP KASAN PTI
+KASAN: maybe wild-memory-access in range
+[0xdead000000000120-0xdead000000000127]
+CPU: 0 PID: 3807 Comm: modprobe Not tainted
+6.1.0-rc1-00186-g76f33a7eedb4 #299
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
+rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
+RIP: 0010:unregister_trace_event+0x6e/0x280
+Code: 00 fc ff df 4c 89 ea 48 c1 ea 03 80 3c 02 00 0f 85 0e 02 00 00 48
+b8 00 00 00 00 00 fc ff df 4c 8b 63 08 4c 89 e2 48 c1 ea 03 <80> 3c 02
+00 0f 85 e2 01 00 00 49 89 2c 24 48 85 ed 74 28 e8 7a 9b
+RSP: 0018:ffff88810413f370 EFLAGS: 00010a06
+RAX: dffffc0000000000 RBX: ffff888105d050b0 RCX: 0000000000000000
+RDX: 1bd5a00000000024 RSI: ffff888119e276e0 RDI: ffffffff835a8b20
+RBP: dead000000000100 R08: 0000000000000000 R09: fffffbfff0913481
+R10: ffffffff8489a407 R11: fffffbfff0913480 R12: dead000000000122
+R13: ffff888105d050b8 R14: 0000000000000000 R15: ffff888105d05028
+FS: 00007f7823e8d540(0000) GS:ffff888119e00000(0000)
+knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007f7823e7ebec CR3: 000000010a058002 CR4: 0000000000330ef0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ <TASK>
+ __create_synth_event+0x1e37/0x1eb0
+ create_or_delete_synth_event+0x110/0x250
+ synth_event_run_command+0x2f/0x110
+ test_gen_synth_cmd+0x170/0x2eb [synth_event_gen_test]
+ synth_event_gen_test_init+0x76/0x9bc [synth_event_gen_test]
+ do_one_initcall+0xdb/0x480
+ do_init_module+0x1cf/0x680
+ load_module+0x6a50/0x70a0
+ __do_sys_finit_module+0x12f/0x1c0
+ do_syscall_64+0x3f/0x90
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Link: https://lkml.kernel.org/r/20221117012346.22647-3-shangxiaojing@huawei.com
+
+Fixes: 4b147936fa50 ("tracing: Add support for 'synthetic' events")
+Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>
+Cc: stable@vger.kernel.org
+Cc: <mhiramat@kernel.org>
+Cc: <zanussi@kernel.org>
+Cc: <fengguang.wu@intel.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace_events_synth.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/kernel/trace/trace_events_synth.c
++++ b/kernel/trace/trace_events_synth.c
+@@ -828,10 +828,9 @@ static int register_synth_event(struct s
+ }
+
+ ret = set_synth_event_print_fmt(call);
+- if (ret < 0) {
++ /* unregister_trace_event() will be called inside */
++ if (ret < 0)
+ trace_remove_event_call(call);
+- goto err;
+- }
+ out:
+ return ret;
+ err:
--- /dev/null
+From 22ea4ca9631eb137e64e5ab899e9c89cb6670959 Mon Sep 17 00:00:00 2001
+From: Shang XiaoJing <shangxiaojing@huawei.com>
+Date: Fri, 18 Nov 2022 10:15:34 +0900
+Subject: tracing: kprobe: Fix potential null-ptr-deref on trace_array in kprobe_event_gen_test_exit()
+
+From: Shang XiaoJing <shangxiaojing@huawei.com>
+
+commit 22ea4ca9631eb137e64e5ab899e9c89cb6670959 upstream.
+
+When test_gen_kprobe_cmd() failed after kprobe_event_gen_cmd_end(), it
+will goto delete, which will call kprobe_event_delete() and release the
+corresponding resource. However, the trace_array in gen_kretprobe_test
+will point to the invalid resource. Set gen_kretprobe_test to NULL
+after called kprobe_event_delete() to prevent null-ptr-deref.
+
+BUG: kernel NULL pointer dereference, address: 0000000000000070
+PGD 0 P4D 0
+Oops: 0000 [#1] SMP PTI
+CPU: 0 PID: 246 Comm: modprobe Tainted: G W
+6.1.0-rc1-00174-g9522dc5c87da-dirty #248
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
+rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
+RIP: 0010:__ftrace_set_clr_event_nolock+0x53/0x1b0
+Code: e8 82 26 fc ff 49 8b 1e c7 44 24 0c ea ff ff ff 49 39 de 0f 84 3c
+01 00 00 c7 44 24 18 00 00 00 00 e8 61 26 fc ff 48 8b 6b 10 <44> 8b 65
+70 4c 8b 6d 18 41 f7 c4 00 02 00 00 75 2f
+RSP: 0018:ffffc9000159fe00 EFLAGS: 00010293
+RAX: 0000000000000000 RBX: ffff88810971d268 RCX: 0000000000000000
+RDX: ffff8881080be600 RSI: ffffffff811b48ff RDI: ffff88810971d058
+RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001
+R10: ffffc9000159fe58 R11: 0000000000000001 R12: ffffffffa0001064
+R13: ffffffffa000106c R14: ffff88810971d238 R15: 0000000000000000
+FS: 00007f89eeff6540(0000) GS:ffff88813b600000(0000)
+knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000000000070 CR3: 000000010599e004 CR4: 0000000000330ef0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ <TASK>
+ __ftrace_set_clr_event+0x3e/0x60
+ trace_array_set_clr_event+0x35/0x50
+ ? 0xffffffffa0000000
+ kprobe_event_gen_test_exit+0xcd/0x10b [kprobe_event_gen_test]
+ __x64_sys_delete_module+0x206/0x380
+ ? lockdep_hardirqs_on_prepare+0xd8/0x190
+ ? syscall_enter_from_user_mode+0x1c/0x50
+ do_syscall_64+0x3f/0x90
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+RIP: 0033:0x7f89eeb061b7
+
+Link: https://lore.kernel.org/all/20221108015130.28326-3-shangxiaojing@huawei.com/
+
+Fixes: 64836248dda2 ("tracing: Add kprobe event command generation test module")
+Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>
+Cc: stable@vger.kernel.org
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/kprobe_event_gen_test.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/kernel/trace/kprobe_event_gen_test.c
++++ b/kernel/trace/kprobe_event_gen_test.c
+@@ -143,6 +143,8 @@ static int __init test_gen_kprobe_cmd(vo
+ kfree(buf);
+ return ret;
+ delete:
++ if (trace_event_file_is_valid(gen_kprobe_test))
++ gen_kprobe_test = NULL;
+ /* We got an error after creating the event, delete it */
+ ret = kprobe_event_delete("gen_kprobe_test");
+ goto out;
+@@ -206,6 +208,8 @@ static int __init test_gen_kretprobe_cmd
+ kfree(buf);
+ return ret;
+ delete:
++ if (trace_event_file_is_valid(gen_kretprobe_test))
++ gen_kretprobe_test = NULL;
+ /* We got an error after creating the event, delete it */
+ ret = kprobe_event_delete("gen_kretprobe_test");
+ goto out;
--- /dev/null
+From e0d75267f59d7084e0468bd68beeb1bf9c71d7c0 Mon Sep 17 00:00:00 2001
+From: Shang XiaoJing <shangxiaojing@huawei.com>
+Date: Fri, 18 Nov 2022 10:15:33 +0900
+Subject: tracing: kprobe: Fix potential null-ptr-deref on trace_event_file in kprobe_event_gen_test_exit()
+
+From: Shang XiaoJing <shangxiaojing@huawei.com>
+
+commit e0d75267f59d7084e0468bd68beeb1bf9c71d7c0 upstream.
+
+When trace_get_event_file() failed, gen_kretprobe_test will be assigned
+as the error code. If module kprobe_event_gen_test is removed now, the
+null pointer dereference will happen in kprobe_event_gen_test_exit().
+Check if gen_kprobe_test or gen_kretprobe_test is error code or NULL
+before dereference them.
+
+BUG: kernel NULL pointer dereference, address: 0000000000000012
+PGD 0 P4D 0
+Oops: 0000 [#1] SMP PTI
+CPU: 3 PID: 2210 Comm: modprobe Not tainted
+6.1.0-rc1-00171-g2159299a3b74-dirty #217
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
+rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
+RIP: 0010:kprobe_event_gen_test_exit+0x1c/0xb5 [kprobe_event_gen_test]
+Code: Unable to access opcode bytes at 0xffffffff9ffffff2.
+RSP: 0018:ffffc900015bfeb8 EFLAGS: 00010246
+RAX: ffffffffffffffea RBX: ffffffffa0002080 RCX: 0000000000000000
+RDX: ffffffffa0001054 RSI: ffffffffa0001064 RDI: ffffffffdfc6349c
+RBP: ffffffffa0000000 R08: 0000000000000004 R09: 00000000001e95c0
+R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000800
+R13: ffffffffa0002420 R14: 0000000000000000 R15: 0000000000000000
+FS: 00007f56b75be540(0000) GS:ffff88813bc00000(0000)
+knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: ffffffff9ffffff2 CR3: 000000010874a006 CR4: 0000000000330ee0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ <TASK>
+ __x64_sys_delete_module+0x206/0x380
+ ? lockdep_hardirqs_on_prepare+0xd8/0x190
+ ? syscall_enter_from_user_mode+0x1c/0x50
+ do_syscall_64+0x3f/0x90
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Link: https://lore.kernel.org/all/20221108015130.28326-2-shangxiaojing@huawei.com/
+
+Fixes: 64836248dda2 ("tracing: Add kprobe event command generation test module")
+Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/kprobe_event_gen_test.c | 44 ++++++++++++++++++++++-------------
+ 1 file changed, 28 insertions(+), 16 deletions(-)
+
+--- a/kernel/trace/kprobe_event_gen_test.c
++++ b/kernel/trace/kprobe_event_gen_test.c
+@@ -73,6 +73,10 @@ static struct trace_event_file *gen_kret
+ #define KPROBE_GEN_TEST_ARG3 NULL
+ #endif
+
++static bool trace_event_file_is_valid(struct trace_event_file *input)
++{
++ return input && !IS_ERR(input);
++}
+
+ /*
+ * Test to make sure we can create a kprobe event, then add more
+@@ -217,10 +221,12 @@ static int __init kprobe_event_gen_test_
+
+ ret = test_gen_kretprobe_cmd();
+ if (ret) {
+- WARN_ON(trace_array_set_clr_event(gen_kretprobe_test->tr,
+- "kprobes",
+- "gen_kretprobe_test", false));
+- trace_put_event_file(gen_kretprobe_test);
++ if (trace_event_file_is_valid(gen_kretprobe_test)) {
++ WARN_ON(trace_array_set_clr_event(gen_kretprobe_test->tr,
++ "kprobes",
++ "gen_kretprobe_test", false));
++ trace_put_event_file(gen_kretprobe_test);
++ }
+ WARN_ON(kprobe_event_delete("gen_kretprobe_test"));
+ }
+
+@@ -229,24 +235,30 @@ static int __init kprobe_event_gen_test_
+
+ static void __exit kprobe_event_gen_test_exit(void)
+ {
+- /* Disable the event or you can't remove it */
+- WARN_ON(trace_array_set_clr_event(gen_kprobe_test->tr,
+- "kprobes",
+- "gen_kprobe_test", false));
++ if (trace_event_file_is_valid(gen_kprobe_test)) {
++ /* Disable the event or you can't remove it */
++ WARN_ON(trace_array_set_clr_event(gen_kprobe_test->tr,
++ "kprobes",
++ "gen_kprobe_test", false));
++
++ /* Now give the file and instance back */
++ trace_put_event_file(gen_kprobe_test);
++ }
+
+- /* Now give the file and instance back */
+- trace_put_event_file(gen_kprobe_test);
+
+ /* Now unregister and free the event */
+ WARN_ON(kprobe_event_delete("gen_kprobe_test"));
+
+- /* Disable the event or you can't remove it */
+- WARN_ON(trace_array_set_clr_event(gen_kretprobe_test->tr,
+- "kprobes",
+- "gen_kretprobe_test", false));
++ if (trace_event_file_is_valid(gen_kretprobe_test)) {
++ /* Disable the event or you can't remove it */
++ WARN_ON(trace_array_set_clr_event(gen_kretprobe_test->tr,
++ "kprobes",
++ "gen_kretprobe_test", false));
++
++ /* Now give the file and instance back */
++ trace_put_event_file(gen_kretprobe_test);
++ }
+
+- /* Now give the file and instance back */
+- trace_put_event_file(gen_kretprobe_test);
+
+ /* Now unregister and free the event */
+ WARN_ON(kprobe_event_delete("gen_kretprobe_test"));
--- /dev/null
+From 42fb0a1e84ff525ebe560e2baf9451ab69127e2b Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
+Date: Thu, 20 Oct 2022 23:14:27 -0400
+Subject: tracing/ring-buffer: Have polling block on watermark
+
+From: Steven Rostedt (Google) <rostedt@goodmis.org>
+
+commit 42fb0a1e84ff525ebe560e2baf9451ab69127e2b upstream.
+
+Currently the way polling works on the ring buffer is broken. It will
+return immediately if there's any data in the ring buffer whereas a read
+will block until the watermark (defined by the tracefs buffer_percent file)
+is hit.
+
+That is, a select() or poll() will return as if there's data available,
+but then the following read will block. This is broken for the way
+select()s and poll()s are supposed to work.
+
+Have the polling on the ring buffer also block the same way reads and
+splice does on the ring buffer.
+
+Link: https://lkml.kernel.org/r/20221020231427.41be3f26@gandalf.local.home
+
+Cc: Linux Trace Kernel <linux-trace-kernel@vger.kernel.org>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Cc: Primiano Tucci <primiano@google.com>
+Cc: stable@vger.kernel.org
+Fixes: 1e0d6714aceb7 ("ring-buffer: Do not wake up a splice waiter when page is not full")
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/ring_buffer.h | 2 -
+ kernel/trace/ring_buffer.c | 55 ++++++++++++++++++++++++++++----------------
+ kernel/trace/trace.c | 2 -
+ 3 files changed, 38 insertions(+), 21 deletions(-)
+
+--- a/include/linux/ring_buffer.h
++++ b/include/linux/ring_buffer.h
+@@ -100,7 +100,7 @@ __ring_buffer_alloc(unsigned long size,
+
+ int ring_buffer_wait(struct trace_buffer *buffer, int cpu, int full);
+ __poll_t ring_buffer_poll_wait(struct trace_buffer *buffer, int cpu,
+- struct file *filp, poll_table *poll_table);
++ struct file *filp, poll_table *poll_table, int full);
+ void ring_buffer_wake_waiters(struct trace_buffer *buffer, int cpu);
+
+ #define RING_BUFFER_ALL_CPUS -1
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -907,6 +907,21 @@ size_t ring_buffer_nr_dirty_pages(struct
+ return cnt - read;
+ }
+
++static __always_inline bool full_hit(struct trace_buffer *buffer, int cpu, int full)
++{
++ struct ring_buffer_per_cpu *cpu_buffer = buffer->buffers[cpu];
++ size_t nr_pages;
++ size_t dirty;
++
++ nr_pages = cpu_buffer->nr_pages;
++ if (!nr_pages || !full)
++ return true;
++
++ dirty = ring_buffer_nr_dirty_pages(buffer, cpu);
++
++ return (dirty * 100) > (full * nr_pages);
++}
++
+ /*
+ * rb_wake_up_waiters - wake up tasks waiting for ring buffer input
+ *
+@@ -1046,22 +1061,20 @@ int ring_buffer_wait(struct trace_buffer
+ !ring_buffer_empty_cpu(buffer, cpu)) {
+ unsigned long flags;
+ bool pagebusy;
+- size_t nr_pages;
+- size_t dirty;
++ bool done;
+
+ if (!full)
+ break;
+
+ raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
+ pagebusy = cpu_buffer->reader_page == cpu_buffer->commit_page;
+- nr_pages = cpu_buffer->nr_pages;
+- dirty = ring_buffer_nr_dirty_pages(buffer, cpu);
++ done = !pagebusy && full_hit(buffer, cpu, full);
++
+ if (!cpu_buffer->shortest_full ||
+ cpu_buffer->shortest_full > full)
+ cpu_buffer->shortest_full = full;
+ raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
+- if (!pagebusy &&
+- (!nr_pages || (dirty * 100) > full * nr_pages))
++ if (done)
+ break;
+ }
+
+@@ -1087,6 +1100,7 @@ int ring_buffer_wait(struct trace_buffer
+ * @cpu: the cpu buffer to wait on
+ * @filp: the file descriptor
+ * @poll_table: The poll descriptor
++ * @full: wait until the percentage of pages are available, if @cpu != RING_BUFFER_ALL_CPUS
+ *
+ * If @cpu == RING_BUFFER_ALL_CPUS then the task will wake up as soon
+ * as data is added to any of the @buffer's cpu buffers. Otherwise
+@@ -1096,14 +1110,15 @@ int ring_buffer_wait(struct trace_buffer
+ * zero otherwise.
+ */
+ __poll_t ring_buffer_poll_wait(struct trace_buffer *buffer, int cpu,
+- struct file *filp, poll_table *poll_table)
++ struct file *filp, poll_table *poll_table, int full)
+ {
+ struct ring_buffer_per_cpu *cpu_buffer;
+ struct rb_irq_work *work;
+
+- if (cpu == RING_BUFFER_ALL_CPUS)
++ if (cpu == RING_BUFFER_ALL_CPUS) {
+ work = &buffer->irq_work;
+- else {
++ full = 0;
++ } else {
+ if (!cpumask_test_cpu(cpu, buffer->cpumask))
+ return -EINVAL;
+
+@@ -1111,8 +1126,14 @@ __poll_t ring_buffer_poll_wait(struct tr
+ work = &cpu_buffer->irq_work;
+ }
+
+- poll_wait(filp, &work->waiters, poll_table);
+- work->waiters_pending = true;
++ if (full) {
++ poll_wait(filp, &work->full_waiters, poll_table);
++ work->full_waiters_pending = true;
++ } else {
++ poll_wait(filp, &work->waiters, poll_table);
++ work->waiters_pending = true;
++ }
++
+ /*
+ * There's a tight race between setting the waiters_pending and
+ * checking if the ring buffer is empty. Once the waiters_pending bit
+@@ -1128,6 +1149,9 @@ __poll_t ring_buffer_poll_wait(struct tr
+ */
+ smp_mb();
+
++ if (full)
++ return full_hit(buffer, cpu, full) ? EPOLLIN | EPOLLRDNORM : 0;
++
+ if ((cpu == RING_BUFFER_ALL_CPUS && !ring_buffer_empty(buffer)) ||
+ (cpu != RING_BUFFER_ALL_CPUS && !ring_buffer_empty_cpu(buffer, cpu)))
+ return EPOLLIN | EPOLLRDNORM;
+@@ -3155,10 +3179,6 @@ static void rb_commit(struct ring_buffer
+ static __always_inline void
+ rb_wakeups(struct trace_buffer *buffer, struct ring_buffer_per_cpu *cpu_buffer)
+ {
+- size_t nr_pages;
+- size_t dirty;
+- size_t full;
+-
+ if (buffer->irq_work.waiters_pending) {
+ buffer->irq_work.waiters_pending = false;
+ /* irq_work_queue() supplies it's own memory barriers */
+@@ -3182,10 +3202,7 @@ rb_wakeups(struct trace_buffer *buffer,
+
+ cpu_buffer->last_pages_touch = local_read(&cpu_buffer->pages_touched);
+
+- full = cpu_buffer->shortest_full;
+- nr_pages = cpu_buffer->nr_pages;
+- dirty = ring_buffer_nr_dirty_pages(buffer, cpu_buffer->cpu);
+- if (full && nr_pages && (dirty * 100) <= full * nr_pages)
++ if (!full_hit(buffer, cpu_buffer->cpu, cpu_buffer->shortest_full))
+ return;
+
+ cpu_buffer->irq_work.wakeup_full = true;
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -6682,7 +6682,7 @@ trace_poll(struct trace_iterator *iter,
+ return EPOLLIN | EPOLLRDNORM;
+ else
+ return ring_buffer_poll_wait(iter->array_buffer->buffer, iter->cpu_file,
+- filp, poll_table);
++ filp, poll_table, iter->tr->buffer_percent);
+ }
+
+ static __poll_t
--- /dev/null
+From d68cc25b7c7fb3034c5a5b5f350a0b858c6d5a45 Mon Sep 17 00:00:00 2001
+From: Janne Grunau <j@jannau.net>
+Date: Sun, 6 Nov 2022 22:48:04 +0100
+Subject: usb: dwc3: Do not get extcon device when usb-role-switch is used
+
+From: Janne Grunau <j@jannau.net>
+
+commit d68cc25b7c7fb3034c5a5b5f350a0b858c6d5a45 upstream.
+
+The change breaks device tree based platforms with PHY device and use
+usb-role-switch instead of an extcon switch. extcon_find_edev_by_node()
+will return EPROBE_DEFER if it can not find a device so probing without
+an extcon device will be deferred indefinitely. Fix this by
+explicitly checking for usb-role-switch.
+At least the out-of-tree USB3 support on Apple silicon based platforms
+using dwc3 with tipd USB Type-C and PD controller is affected by this
+issue.
+
+Fixes: d182c2e1bc92 ("usb: dwc3: Don't switch OTG -> peripheral if extcon is present")
+Cc: stable@kernel.org
+Signed-off-by: Janne Grunau <j@jannau.net>
+Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Reviewed-by: Sven Peter <sven@svenpeter.dev>
+Link: https://lore.kernel.org/r/20221106214804.2814-1-j@jannau.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/core.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1711,6 +1711,16 @@ static struct extcon_dev *dwc3_get_extco
+ return extcon_get_extcon_dev(name);
+
+ /*
++ * Check explicitly if "usb-role-switch" is used since
++ * extcon_find_edev_by_node() can not be used to check the absence of
++ * an extcon device. In the absence of an device it will always return
++ * EPROBE_DEFER.
++ */
++ if (IS_ENABLED(CONFIG_USB_ROLE_SWITCH) &&
++ device_property_read_bool(dev, "usb-role-switch"))
++ return NULL;
++
++ /*
+ * Try to get an extcon device from the USB PHY controller's "port"
+ * node. Check if it has the "port" node first, to avoid printing the
+ * error message from underlying code, as it's a valid case: extcon
projects / thirdparty / kernel / stable-queue.git / commitdiff
