--- /dev/null
+From eaf7b0d00629819e5e691578f8fb21507a9b9906 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Aug 2022 16:14:32 -0700
+Subject: Bluetooth: MGMT: Fix Get Device Flags
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 23b72814da1a094b4c065e0bb598249f310c5577 ]
+
+Get Device Flags don't check if device does actually use an RPA in which
+case it shall only set HCI_CONN_FLAG_REMOTE_WAKEUP if LL Privacy is
+enabled.
+
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/mgmt.c | 71 ++++++++++++++++++++++++++------------------
+ 1 file changed, 42 insertions(+), 29 deletions(-)
+
+diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
+index cbdf0e2bc5ae0..d0fb74b0db1d5 100644
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -4420,6 +4420,22 @@ static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
+ MGMT_STATUS_NOT_SUPPORTED);
+ }
+
++static u32 get_params_flags(struct hci_dev *hdev,
++ struct hci_conn_params *params)
++{
++ u32 flags = hdev->conn_flags;
++
++ /* Devices using RPAs can only be programmed in the acceptlist if
++ * LL Privacy has been enable otherwise they cannot mark
++ * HCI_CONN_FLAG_REMOTE_WAKEUP.
++ */
++ if ((flags & HCI_CONN_FLAG_REMOTE_WAKEUP) && !use_ll_privacy(hdev) &&
++ hci_find_irk_by_addr(hdev, ¶ms->addr, params->addr_type))
++ flags &= ~HCI_CONN_FLAG_REMOTE_WAKEUP;
++
++ return flags;
++}
++
+ static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
+ u16 data_len)
+ {
+@@ -4451,10 +4467,10 @@ static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
+ } else {
+ params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
+ le_addr_type(cp->addr.type));
+-
+ if (!params)
+ goto done;
+
++ supported_flags = get_params_flags(hdev, params);
+ current_flags = params->flags;
+ }
+
+@@ -4523,38 +4539,35 @@ static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
+ bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
+ &cp->addr.bdaddr, cp->addr.type);
+ }
+- } else {
+- params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
+- le_addr_type(cp->addr.type));
+- if (params) {
+- /* Devices using RPAs can only be programmed in the
+- * acceptlist LL Privacy has been enable otherwise they
+- * cannot mark HCI_CONN_FLAG_REMOTE_WAKEUP.
+- */
+- if ((current_flags & HCI_CONN_FLAG_REMOTE_WAKEUP) &&
+- !use_ll_privacy(hdev) &&
+- hci_find_irk_by_addr(hdev, ¶ms->addr,
+- params->addr_type)) {
+- bt_dev_warn(hdev,
+- "Cannot set wakeable for RPA");
+- goto unlock;
+- }
+
+- params->flags = current_flags;
+- status = MGMT_STATUS_SUCCESS;
++ goto unlock;
++ }
+
+- /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY
+- * has been set.
+- */
+- if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY)
+- hci_update_passive_scan(hdev);
+- } else {
+- bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
+- &cp->addr.bdaddr,
+- le_addr_type(cp->addr.type));
+- }
++ params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
++ le_addr_type(cp->addr.type));
++ if (!params) {
++ bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
++ &cp->addr.bdaddr, le_addr_type(cp->addr.type));
++ goto unlock;
++ }
++
++ supported_flags = get_params_flags(hdev, params);
++
++ if ((supported_flags | current_flags) != supported_flags) {
++ bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
++ current_flags, supported_flags);
++ goto unlock;
+ }
+
++ params->flags = current_flags;
++ status = MGMT_STATUS_SUCCESS;
++
++ /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY
++ * has been set.
++ */
++ if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY)
++ hci_update_passive_scan(hdev);
++
+ unlock:
+ hci_dev_unlock(hdev);
+
+--
+2.35.1
+
--- /dev/null
+From 5ce4fd68976ff430f20a114a89efdf70047823e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Aug 2022 16:33:01 +0800
+Subject: drm/amd/amdgpu: skip ucode loading if ucode_size == 0
+
+From: Chengming Gui <Jack.Gui@amd.com>
+
+[ Upstream commit 39c84b8e929dbd4f63be7e04bf1a2bcd92b44177 ]
+
+Restrict the ucode loading check to avoid frontdoor loading error.
+
+Signed-off-by: Chengming Gui <Jack.Gui@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index 2b00f8fe15a89..b19bf0c3f3737 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -2372,7 +2372,7 @@ static int psp_load_smu_fw(struct psp_context *psp)
+ static bool fw_load_skip_check(struct psp_context *psp,
+ struct amdgpu_firmware_info *ucode)
+ {
+- if (!ucode->fw)
++ if (!ucode->fw || !ucode->ucode_size)
+ return true;
+
+ if (ucode->ucode_id == AMDGPU_UCODE_ID_SMC &&
+--
+2.35.1
+
--- /dev/null
+From caab6ac2ab4faabec1a2460ba2cd141caa1d222c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Aug 2022 16:07:18 +0800
+Subject: drm/amd/pm: use vbios carried pptable for all SMU13.0.7 SKUs
+
+From: Evan Quan <evan.quan@amd.com>
+
+[ Upstream commit b023053592646b1da9477b0b598f2cdd5d3f89d8 ]
+
+For those SMU13.0.7 unsecure SKUs, the vbios carried pptable is ready to go.
+Use that one instead of hardcoded softpptable.
+
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 35 ++++++++++++-------
+ 1 file changed, 22 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
+index 9cde13b07dd26..d9a5209aa8433 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
+@@ -382,11 +382,27 @@ static int smu_v13_0_7_append_powerplay_table(struct smu_context *smu)
+ return 0;
+ }
+
++static int smu_v13_0_7_get_pptable_from_pmfw(struct smu_context *smu,
++ void **table,
++ uint32_t *size)
++{
++ struct smu_table_context *smu_table = &smu->smu_table;
++ void *combo_pptable = smu_table->combo_pptable;
++ int ret = 0;
++
++ ret = smu_cmn_get_combo_pptable(smu);
++ if (ret)
++ return ret;
++
++ *table = combo_pptable;
++ *size = sizeof(struct smu_13_0_7_powerplay_table);
++
++ return 0;
++}
+
+ static int smu_v13_0_7_setup_pptable(struct smu_context *smu)
+ {
+ struct smu_table_context *smu_table = &smu->smu_table;
+- void *combo_pptable = smu_table->combo_pptable;
+ struct amdgpu_device *adev = smu->adev;
+ int ret = 0;
+
+@@ -395,18 +411,11 @@ static int smu_v13_0_7_setup_pptable(struct smu_context *smu)
+ * be used directly by driver. To get the raw pptable, we need to
+ * rely on the combo pptable(and its revelant SMU message).
+ */
+- if (adev->scpm_enabled) {
+- ret = smu_cmn_get_combo_pptable(smu);
+- if (ret)
+- return ret;
+-
+- smu->smu_table.power_play_table = combo_pptable;
+- smu->smu_table.power_play_table_size = sizeof(struct smu_13_0_7_powerplay_table);
+- } else {
+- ret = smu_v13_0_setup_pptable(smu);
+- if (ret)
+- return ret;
+- }
++ ret = smu_v13_0_7_get_pptable_from_pmfw(smu,
++ &smu_table->power_play_table,
++ &smu_table->power_play_table_size);
++ if (ret)
++ return ret;
+
+ ret = smu_v13_0_7_store_powerplay_table(smu);
+ if (ret)
+--
+2.35.1
+
--- /dev/null
+From 6c3d94294482ee10f16829a5e3e831403aed9964 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Aug 2022 23:00:02 +0800
+Subject: drm/amdgpu: disable FRU access on special SIENNA CICHLID card
+
+From: Guchun Chen <guchun.chen@amd.com>
+
+[ Upstream commit c8fea9273fd1be308668496badfcbd55183e0dd3 ]
+
+Below driver load error will be printed, not friendly to end user.
+
+amdgpu: ATOM BIOS: 113-D603GLXE-077
+[drm] FRU: Failed to get size field
+[drm:amdgpu_fru_get_product_info [amdgpu]] *ERROR* Failed to read FRU Manufacturer, ret:-5
+
+Signed-off-by: Guchun Chen <guchun.chen@amd.com>
+Reviewed-by: Kent Russell <kent.russell@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c
+index ecada5eadfe35..e325150879df7 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c
+@@ -66,10 +66,15 @@ static bool is_fru_eeprom_supported(struct amdgpu_device *adev)
+ return true;
+ case CHIP_SIENNA_CICHLID:
+ if (strnstr(atom_ctx->vbios_version, "D603",
++ sizeof(atom_ctx->vbios_version))) {
++ if (strnstr(atom_ctx->vbios_version, "D603GLXE",
+ sizeof(atom_ctx->vbios_version)))
+- return true;
+- else
++ return false;
++ else
++ return true;
++ } else {
+ return false;
++ }
+ default:
+ return false;
+ }
+--
+2.35.1
+
--- /dev/null
+From 1016d88007fe7d331ce90a5e364829af16ddb7e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Aug 2022 09:09:01 -0700
+Subject: drm/msm/rd: Fix FIFO-full deadlock
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit 174974d8463b77c2b4065e98513adb204e64de7d ]
+
+If the previous thing cat'ing $debugfs/rd left the FIFO full, then
+subsequent open could deadlock in rd_write() (because open is blocked,
+not giving a chance for read() to consume any data in the FIFO). Also
+it is generally a good idea to clear out old data from the FIFO.
+
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Patchwork: https://patchwork.freedesktop.org/patch/496706/
+Link: https://lore.kernel.org/r/20220807160901.2353471-2-robdclark@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_rd.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/msm_rd.c b/drivers/gpu/drm/msm/msm_rd.c
+index a92ffde53f0b3..db2f847c8535f 100644
+--- a/drivers/gpu/drm/msm/msm_rd.c
++++ b/drivers/gpu/drm/msm/msm_rd.c
+@@ -196,6 +196,9 @@ static int rd_open(struct inode *inode, struct file *file)
+ file->private_data = rd;
+ rd->open = true;
+
++ /* Reset fifo to clear any previously unread data: */
++ rd->fifo.head = rd->fifo.tail = 0;
++
+ /* the parsing tools need to know gpu-id to know which
+ * register database to load.
+ *
+--
+2.35.1
+
--- /dev/null
+From 8b9248357a1a1d9622e06e0548659b1b26678637 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Aug 2022 09:55:03 +0200
+Subject: dt-bindings: iio: gyroscope: bosch,bmg160: correct number of pins
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 767470209cedbe2cc72ba38d77c9f096d2c7694c ]
+
+BMG160 has two interrupt pins to which interrupts can be freely mapped.
+Correct the schema to express such case and fix warnings like:
+
+ qcom/msm8916-alcatel-idol347.dtb: gyroscope@68: interrupts: [[97, 1], [98, 1]] is too long
+
+However the basic issue still persists - the interrupts should come in a
+defined order.
+
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20220805075503.16983-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/iio/gyroscope/bosch,bmg160.yaml | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/Documentation/devicetree/bindings/iio/gyroscope/bosch,bmg160.yaml b/Documentation/devicetree/bindings/iio/gyroscope/bosch,bmg160.yaml
+index b6bbc312a7cf7..1414ba9977c16 100644
+--- a/Documentation/devicetree/bindings/iio/gyroscope/bosch,bmg160.yaml
++++ b/Documentation/devicetree/bindings/iio/gyroscope/bosch,bmg160.yaml
+@@ -24,8 +24,10 @@ properties:
+
+ interrupts:
+ minItems: 1
++ maxItems: 2
+ description:
+ Should be configured with type IRQ_TYPE_EDGE_RISING.
++ If two interrupts are provided, expected order is INT1 and INT2.
+
+ required:
+ - compatible
+--
+2.35.1
+
--- /dev/null
+From 6161f8f9ced77e5e886bc1f0c1638336a3e94262 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Sep 2022 13:45:23 -0400
+Subject: gpio: 104-dio-48e: Make irq_chip immutable
+
+From: William Breathitt Gray <william.gray@linaro.org>
+
+[ Upstream commit 35f0aa7727b092520bf91374768a4fdafd4a4fe3 ]
+
+Kernel warns about mutable irq_chips:
+
+ "not an immutable chip, please consider fixing!"
+
+Make the struct irq_chip const, flag it as IRQCHIP_IMMUTABLE, add the
+new helper functions, and call the appropriate gpiolib functions.
+
+Signed-off-by: William Breathitt Gray <william.gray@linaro.org>
+Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-104-dio-48e.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpio/gpio-104-dio-48e.c b/drivers/gpio/gpio-104-dio-48e.c
+index f118ad9bcd33d..0e95351d47d49 100644
+--- a/drivers/gpio/gpio-104-dio-48e.c
++++ b/drivers/gpio/gpio-104-dio-48e.c
+@@ -271,6 +271,7 @@ static void dio48e_irq_mask(struct irq_data *data)
+ dio48egpio->irq_mask &= ~BIT(0);
+ else
+ dio48egpio->irq_mask &= ~BIT(1);
++ gpiochip_disable_irq(chip, offset);
+
+ if (!dio48egpio->irq_mask)
+ /* disable interrupts */
+@@ -298,6 +299,7 @@ static void dio48e_irq_unmask(struct irq_data *data)
+ iowrite8(0x00, dio48egpio->base + 0xB);
+ }
+
++ gpiochip_enable_irq(chip, offset);
+ if (offset == 19)
+ dio48egpio->irq_mask |= BIT(0);
+ else
+@@ -320,12 +322,14 @@ static int dio48e_irq_set_type(struct irq_data *data, unsigned int flow_type)
+ return 0;
+ }
+
+-static struct irq_chip dio48e_irqchip = {
++static const struct irq_chip dio48e_irqchip = {
+ .name = "104-dio-48e",
+ .irq_ack = dio48e_irq_ack,
+ .irq_mask = dio48e_irq_mask,
+ .irq_unmask = dio48e_irq_unmask,
+- .irq_set_type = dio48e_irq_set_type
++ .irq_set_type = dio48e_irq_set_type,
++ .flags = IRQCHIP_IMMUTABLE,
++ GPIOCHIP_IRQ_RESOURCE_HELPERS,
+ };
+
+ static irqreturn_t dio48e_irq_handler(int irq, void *dev_id)
+@@ -414,7 +418,7 @@ static int dio48e_probe(struct device *dev, unsigned int id)
+ dio48egpio->chip.set_multiple = dio48e_gpio_set_multiple;
+
+ girq = &dio48egpio->chip.irq;
+- girq->chip = &dio48e_irqchip;
++ gpio_irq_chip_set_chip(girq, &dio48e_irqchip);
+ /* This will let us handle the parent IRQ in the driver */
+ girq->parent_handler = NULL;
+ girq->num_parents = 0;
+--
+2.35.1
+
--- /dev/null
+From 3b953f4bc2e370cf6ac441f1907558b406d7929d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Sep 2022 13:45:25 -0400
+Subject: gpio: 104-idio-16: Make irq_chip immutable
+
+From: William Breathitt Gray <william.gray@linaro.org>
+
+[ Upstream commit 410a5041aa60d91ff66a861560e7c879d664270f ]
+
+Kernel warns about mutable irq_chips:
+
+ "not an immutable chip, please consider fixing!"
+
+Make the struct irq_chip const, flag it as IRQCHIP_IMMUTABLE, add the
+new helper functions, and call the appropriate gpiolib functions.
+
+Signed-off-by: William Breathitt Gray <william.gray@linaro.org>
+Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-104-idio-16.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpio/gpio-104-idio-16.c b/drivers/gpio/gpio-104-idio-16.c
+index 45f7ad8573e19..a8b7c8eafac5a 100644
+--- a/drivers/gpio/gpio-104-idio-16.c
++++ b/drivers/gpio/gpio-104-idio-16.c
+@@ -150,10 +150,11 @@ static void idio_16_irq_mask(struct irq_data *data)
+ {
+ struct gpio_chip *chip = irq_data_get_irq_chip_data(data);
+ struct idio_16_gpio *const idio16gpio = gpiochip_get_data(chip);
+- const unsigned long mask = BIT(irqd_to_hwirq(data));
++ const unsigned long offset = irqd_to_hwirq(data);
+ unsigned long flags;
+
+- idio16gpio->irq_mask &= ~mask;
++ idio16gpio->irq_mask &= ~BIT(offset);
++ gpiochip_disable_irq(chip, offset);
+
+ if (!idio16gpio->irq_mask) {
+ raw_spin_lock_irqsave(&idio16gpio->lock, flags);
+@@ -168,11 +169,12 @@ static void idio_16_irq_unmask(struct irq_data *data)
+ {
+ struct gpio_chip *chip = irq_data_get_irq_chip_data(data);
+ struct idio_16_gpio *const idio16gpio = gpiochip_get_data(chip);
+- const unsigned long mask = BIT(irqd_to_hwirq(data));
++ const unsigned long offset = irqd_to_hwirq(data);
+ const unsigned long prev_irq_mask = idio16gpio->irq_mask;
+ unsigned long flags;
+
+- idio16gpio->irq_mask |= mask;
++ gpiochip_enable_irq(chip, offset);
++ idio16gpio->irq_mask |= BIT(offset);
+
+ if (!prev_irq_mask) {
+ raw_spin_lock_irqsave(&idio16gpio->lock, flags);
+@@ -193,12 +195,14 @@ static int idio_16_irq_set_type(struct irq_data *data, unsigned int flow_type)
+ return 0;
+ }
+
+-static struct irq_chip idio_16_irqchip = {
++static const struct irq_chip idio_16_irqchip = {
+ .name = "104-idio-16",
+ .irq_ack = idio_16_irq_ack,
+ .irq_mask = idio_16_irq_mask,
+ .irq_unmask = idio_16_irq_unmask,
+- .irq_set_type = idio_16_irq_set_type
++ .irq_set_type = idio_16_irq_set_type,
++ .flags = IRQCHIP_IMMUTABLE,
++ GPIOCHIP_IRQ_RESOURCE_HELPERS,
+ };
+
+ static irqreturn_t idio_16_irq_handler(int irq, void *dev_id)
+@@ -275,7 +279,7 @@ static int idio_16_probe(struct device *dev, unsigned int id)
+ idio16gpio->out_state = 0xFFFF;
+
+ girq = &idio16gpio->chip.irq;
+- girq->chip = &idio_16_irqchip;
++ gpio_irq_chip_set_chip(girq, &idio_16_irqchip);
+ /* This will let us handle the parent IRQ in the driver */
+ girq->parent_handler = NULL;
+ girq->num_parents = 0;
+--
+2.35.1
+
--- /dev/null
+From c7414484216988f19ec6aa108cd2c93c43c11f3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Aug 2022 04:10:25 +0000
+Subject: gpio: mockup: remove gpio debugfs when remove device
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit 303e6da99429510b1e4edf833afe90ac8542e747 ]
+
+GPIO mockup debugfs is created in gpio_mockup_probe() but
+forgot to remove when remove device. This patch add a devm
+managed callback for removing them.
+
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-mockup.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-mockup.c b/drivers/gpio/gpio-mockup.c
+index 8943cea927642..a2e505a7545cd 100644
+--- a/drivers/gpio/gpio-mockup.c
++++ b/drivers/gpio/gpio-mockup.c
+@@ -373,6 +373,13 @@ static void gpio_mockup_debugfs_setup(struct device *dev,
+ }
+ }
+
++static void gpio_mockup_debugfs_cleanup(void *data)
++{
++ struct gpio_mockup_chip *chip = data;
++
++ debugfs_remove_recursive(chip->dbg_dir);
++}
++
+ static void gpio_mockup_dispose_mappings(void *data)
+ {
+ struct gpio_mockup_chip *chip = data;
+@@ -455,7 +462,7 @@ static int gpio_mockup_probe(struct platform_device *pdev)
+
+ gpio_mockup_debugfs_setup(dev, chip);
+
+- return 0;
++ return devm_add_action_or_reset(dev, gpio_mockup_debugfs_cleanup, chip);
+ }
+
+ static const struct of_device_id gpio_mockup_of_match[] = {
+--
+2.35.1
+
--- /dev/null
+From 451116d127bf99e15f5ba02dd240c6a09ca658c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Aug 2022 08:59:19 +0800
+Subject: hid: intel-ish-hid: ishtp: Fix ishtp client sending disordered
+ message
+
+From: Even Xu <even.xu@intel.com>
+
+[ Upstream commit e1fa076706209cc447d7a2abd0843a18277e5ef7 ]
+
+There is a timing issue captured during ishtp client sending stress tests.
+It was observed during stress tests that ISH firmware is getting out of
+ordered messages. This is a rare scenario as the current set of ISH client
+drivers don't send much data to firmware. But this may not be the case
+going forward.
+
+When message size is bigger than IPC MTU, ishtp splits the message into
+fragments and uses serialized async method to send message fragments.
+The call stack:
+ishtp_cl_send_msg_ipc->ipc_tx_callback(first fregment)->
+ishtp_send_msg(with callback)->write_ipc_to_queue->
+write_ipc_from_queue->callback->ipc_tx_callback(next fregment)......
+
+When an ipc write complete interrupt is received, driver also calls
+write_ipc_from_queue->ipc_tx_callback in ISR to start sending of next fragment.
+
+Through ipc_tx_callback uses spin_lock to protect message splitting, as the
+serialized sending method will call back to ipc_tx_callback again, so it doesn't
+put sending under spin_lock, it causes driver cannot guarantee all fragments
+be sent in order.
+
+Considering this scenario:
+ipc_tx_callback just finished a fragment splitting, and not call ishtp_send_msg
+yet, there is a write complete interrupt happens, then ISR->write_ipc_from_queue
+->ipc_tx_callback->ishtp_send_msg->write_ipc_to_queue......
+
+Because ISR has higher exec priority than normal thread, this causes the new
+fragment be sent out before previous fragment. This disordered message causes
+invalid message to firmware.
+
+The solution is, to send fragments synchronously:
+Use ishtp_write_message writing fragments into tx queue directly one by one,
+instead of ishtp_send_msg only writing one fragment with completion callback.
+As no completion callback be used, so change ipc_tx_callback to ipc_tx_send.
+
+Signed-off-by: Even Xu <even.xu@intel.com>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@intel.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/intel-ish-hid/ishtp/client.c | 68 ++++++++++++++----------
+ 1 file changed, 39 insertions(+), 29 deletions(-)
+
+diff --git a/drivers/hid/intel-ish-hid/ishtp/client.c b/drivers/hid/intel-ish-hid/ishtp/client.c
+index 405e0d5212cc8..df0a825694f52 100644
+--- a/drivers/hid/intel-ish-hid/ishtp/client.c
++++ b/drivers/hid/intel-ish-hid/ishtp/client.c
+@@ -626,13 +626,14 @@ static void ishtp_cl_read_complete(struct ishtp_cl_rb *rb)
+ }
+
+ /**
+- * ipc_tx_callback() - IPC tx callback function
++ * ipc_tx_send() - IPC tx send function
+ * @prm: Pointer to client device instance
+ *
+- * Send message over IPC either first time or on callback on previous message
+- * completion
++ * Send message over IPC. Message will be split into fragments
++ * if message size is bigger than IPC FIFO size, and all
++ * fragments will be sent one by one.
+ */
+-static void ipc_tx_callback(void *prm)
++static void ipc_tx_send(void *prm)
+ {
+ struct ishtp_cl *cl = prm;
+ struct ishtp_cl_tx_ring *cl_msg;
+@@ -677,32 +678,41 @@ static void ipc_tx_callback(void *prm)
+ list);
+ rem = cl_msg->send_buf.size - cl->tx_offs;
+
+- ishtp_hdr.host_addr = cl->host_client_id;
+- ishtp_hdr.fw_addr = cl->fw_client_id;
+- ishtp_hdr.reserved = 0;
+- pmsg = cl_msg->send_buf.data + cl->tx_offs;
++ while (rem > 0) {
++ ishtp_hdr.host_addr = cl->host_client_id;
++ ishtp_hdr.fw_addr = cl->fw_client_id;
++ ishtp_hdr.reserved = 0;
++ pmsg = cl_msg->send_buf.data + cl->tx_offs;
++
++ if (rem <= dev->mtu) {
++ /* Last fragment or only one packet */
++ ishtp_hdr.length = rem;
++ ishtp_hdr.msg_complete = 1;
++ /* Submit to IPC queue with no callback */
++ ishtp_write_message(dev, &ishtp_hdr, pmsg);
++ cl->tx_offs = 0;
++ cl->sending = 0;
+
+- if (rem <= dev->mtu) {
+- ishtp_hdr.length = rem;
+- ishtp_hdr.msg_complete = 1;
+- cl->sending = 0;
+- list_del_init(&cl_msg->list); /* Must be before write */
+- spin_unlock_irqrestore(&cl->tx_list_spinlock, tx_flags);
+- /* Submit to IPC queue with no callback */
+- ishtp_write_message(dev, &ishtp_hdr, pmsg);
+- spin_lock_irqsave(&cl->tx_free_list_spinlock, tx_free_flags);
+- list_add_tail(&cl_msg->list, &cl->tx_free_list.list);
+- ++cl->tx_ring_free_size;
+- spin_unlock_irqrestore(&cl->tx_free_list_spinlock,
+- tx_free_flags);
+- } else {
+- /* Send IPC fragment */
+- spin_unlock_irqrestore(&cl->tx_list_spinlock, tx_flags);
+- cl->tx_offs += dev->mtu;
+- ishtp_hdr.length = dev->mtu;
+- ishtp_hdr.msg_complete = 0;
+- ishtp_send_msg(dev, &ishtp_hdr, pmsg, ipc_tx_callback, cl);
++ break;
++ } else {
++ /* Send ipc fragment */
++ ishtp_hdr.length = dev->mtu;
++ ishtp_hdr.msg_complete = 0;
++ /* All fregments submitted to IPC queue with no callback */
++ ishtp_write_message(dev, &ishtp_hdr, pmsg);
++ cl->tx_offs += dev->mtu;
++ rem = cl_msg->send_buf.size - cl->tx_offs;
++ }
+ }
++
++ list_del_init(&cl_msg->list);
++ spin_unlock_irqrestore(&cl->tx_list_spinlock, tx_flags);
++
++ spin_lock_irqsave(&cl->tx_free_list_spinlock, tx_free_flags);
++ list_add_tail(&cl_msg->list, &cl->tx_free_list.list);
++ ++cl->tx_ring_free_size;
++ spin_unlock_irqrestore(&cl->tx_free_list_spinlock,
++ tx_free_flags);
+ }
+
+ /**
+@@ -720,7 +730,7 @@ static void ishtp_cl_send_msg_ipc(struct ishtp_device *dev,
+ return;
+
+ cl->tx_offs = 0;
+- ipc_tx_callback(cl);
++ ipc_tx_send(cl);
+ ++cl->send_msg_cnt_ipc;
+ }
+
+--
+2.35.1
+
--- /dev/null
+From abd2d4d2b3660c8cbe780d543f19b6ac8c91034f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Aug 2022 08:58:14 +0800
+Subject: HID: ishtp-hid-clientHID: ishtp-hid-client: Fix comment typo
+
+From: Jason Wang <wangborong@cdjrlc.com>
+
+[ Upstream commit 94553f8a218540d676efbf3f7827ed493d1057cf ]
+
+The double `like' is duplicated in the comment, remove one.
+
+Signed-off-by: Jason Wang <wangborong@cdjrlc.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/intel-ish-hid/ishtp-hid.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hid/intel-ish-hid/ishtp-hid.h b/drivers/hid/intel-ish-hid/ishtp-hid.h
+index 6a5cc11aefd89..35dddc5015b37 100644
+--- a/drivers/hid/intel-ish-hid/ishtp-hid.h
++++ b/drivers/hid/intel-ish-hid/ishtp-hid.h
+@@ -105,7 +105,7 @@ struct report_list {
+ * @multi_packet_cnt: Count of fragmented packet count
+ *
+ * This structure is used to store completion flags and per client data like
+- * like report description, number of HID devices etc.
++ * report description, number of HID devices etc.
+ */
+ struct ishtp_cl_data {
+ /* completion flags */
+--
+2.35.1
+
--- /dev/null
+From c5acee41f7f7e8542106b2ffe118fa17a188e790 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Aug 2022 15:04:00 +0200
+Subject: hwmon: (pmbus) Use dev_err_probe() to filter -EPROBE_DEFER error
+ messages
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 09e52d17b72d3a4bf6951a90ccd8c97fae04e5cf ]
+
+devm_regulator_register() can return -EPROBE_DEFER, so better use
+dev_err_probe() instead of dev_err(), it is less verbose in such a case.
+
+It is also more informative, which can't hurt.
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/3adf1cea6e32e54c0f71f4604b4e98d992beaa71.1660741419.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/pmbus_core.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
+index 02912022853d8..e81609bf47021 100644
+--- a/drivers/hwmon/pmbus/pmbus_core.c
++++ b/drivers/hwmon/pmbus/pmbus_core.c
+@@ -2730,11 +2730,10 @@ static int pmbus_regulator_register(struct pmbus_data *data)
+
+ rdev = devm_regulator_register(dev, &info->reg_desc[i],
+ &config);
+- if (IS_ERR(rdev)) {
+- dev_err(dev, "Failed to register %s regulator\n",
+- info->reg_desc[i].name);
+- return PTR_ERR(rdev);
+- }
++ if (IS_ERR(rdev))
++ return dev_err_probe(dev, PTR_ERR(rdev),
++ "Failed to register %s regulator\n",
++ info->reg_desc[i].name);
+ }
+
+ return 0;
+--
+2.35.1
+
--- /dev/null
+From 19dfa7203eb7cba5c05aaee5ed7fb3c61337b228 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Aug 2022 15:12:59 +0800
+Subject: ieee802154: cc2520: add rc code in cc2520_tx()
+
+From: Li Qiong <liqiong@nfschina.com>
+
+[ Upstream commit ffd7bdddaab193c38416fd5dd416d065517d266e ]
+
+The rc code is 0 at the error path "status & CC2520_STATUS_TX_UNDERFLOW".
+Assign rc code with '-EINVAL' at this error path to fix it.
+
+Signed-off-by: Li Qiong <liqiong@nfschina.com>
+Link: https://lore.kernel.org/r/20220829071259.18330-1-liqiong@nfschina.com
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ieee802154/cc2520.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ieee802154/cc2520.c b/drivers/net/ieee802154/cc2520.c
+index 1e1f40f628a02..c69b87d3837da 100644
+--- a/drivers/net/ieee802154/cc2520.c
++++ b/drivers/net/ieee802154/cc2520.c
+@@ -504,6 +504,7 @@ cc2520_tx(struct ieee802154_hw *hw, struct sk_buff *skb)
+ goto err_tx;
+
+ if (status & CC2520_STATUS_TX_UNDERFLOW) {
++ rc = -EINVAL;
+ dev_err(&priv->spi->dev, "cc2520 tx underflow exception\n");
+ goto err_tx;
+ }
+--
+2.35.1
+
--- /dev/null
+From e90cd7d1668625447dd757413cae6e60b46c0a6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Aug 2022 16:16:54 -0700
+Subject: Input: goodix - add support for GT1158
+
+From: Ondrej Jirman <megi@xff.cz>
+
+[ Upstream commit 425fe4709c76e35f93f4c0e50240f0b61b2a2e54 ]
+
+This controller is used by PinePhone and PinePhone Pro. Support for
+the PinePhone Pro will be added in a later patch set.
+
+Signed-off-by: Ondrej Jirman <megi@xff.cz>
+Signed-off-by: Jarrah Gosbell <kernel@undef.tools>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20220809091200.290492-1-kernel@undef.tools
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/goodix.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c
+index aa45a9fee6a01..06d4fcafb7666 100644
+--- a/drivers/input/touchscreen/goodix.c
++++ b/drivers/input/touchscreen/goodix.c
+@@ -95,6 +95,7 @@ static const struct goodix_chip_data gt9x_chip_data = {
+
+ static const struct goodix_chip_id goodix_chip_ids[] = {
+ { .id = "1151", .data = >1x_chip_data },
++ { .id = "1158", .data = >1x_chip_data },
+ { .id = "5663", .data = >1x_chip_data },
+ { .id = "5688", .data = >1x_chip_data },
+ { .id = "917S", .data = >1x_chip_data },
+--
+2.35.1
+
--- /dev/null
+From 380116e1f3ab2117d3faa556642656bb8dbb5378 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Aug 2022 11:21:03 -0700
+Subject: Input: iforce - add support for Boeder Force Feedback Wheel
+
+From: Greg Tulli <greg.iforce@gmail.com>
+
+[ Upstream commit 9c9c71168f7979f3798b61c65b4530fbfbcf19d1 ]
+
+Add a new iforce_device entry to support the Boeder Force Feedback Wheel
+device.
+
+Signed-off-by: Greg Tulli <greg.iforce@gmail.com>
+Link: https://lore.kernel.org/r/3256420-c8ac-31b-8499-3c488a9880fd@gmail.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/input/joydev/joystick.rst | 1 +
+ drivers/input/joystick/iforce/iforce-main.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/Documentation/input/joydev/joystick.rst b/Documentation/input/joydev/joystick.rst
+index f615906a0821b..6d721396717a2 100644
+--- a/Documentation/input/joydev/joystick.rst
++++ b/Documentation/input/joydev/joystick.rst
+@@ -517,6 +517,7 @@ All I-Force devices are supported by the iforce module. This includes:
+ * AVB Mag Turbo Force
+ * AVB Top Shot Pegasus
+ * AVB Top Shot Force Feedback Racing Wheel
++* Boeder Force Feedback Wheel
+ * Logitech WingMan Force
+ * Logitech WingMan Force Wheel
+ * Guillemot Race Leader Force Feedback
+diff --git a/drivers/input/joystick/iforce/iforce-main.c b/drivers/input/joystick/iforce/iforce-main.c
+index b2a68bc9f0b4d..b86de1312512b 100644
+--- a/drivers/input/joystick/iforce/iforce-main.c
++++ b/drivers/input/joystick/iforce/iforce-main.c
+@@ -50,6 +50,7 @@ static struct iforce_device iforce_device[] = {
+ { 0x046d, 0xc291, "Logitech WingMan Formula Force", btn_wheel, abs_wheel, ff_iforce },
+ { 0x05ef, 0x020a, "AVB Top Shot Pegasus", btn_joystick_avb, abs_avb_pegasus, ff_iforce },
+ { 0x05ef, 0x8884, "AVB Mag Turbo Force", btn_wheel, abs_wheel, ff_iforce },
++ { 0x05ef, 0x8886, "Boeder Force Feedback Wheel", btn_wheel, abs_wheel, ff_iforce },
+ { 0x05ef, 0x8888, "AVB Top Shot Force Feedback Racing Wheel", btn_wheel, abs_wheel, ff_iforce }, //?
+ { 0x061c, 0xc0a4, "ACT LABS Force RS", btn_wheel, abs_wheel, ff_iforce }, //?
+ { 0x061c, 0xc084, "ACT LABS Force RS", btn_wheel, abs_wheel, ff_iforce },
+--
+2.35.1
+
--- /dev/null
+From 2ba542a3f1b9a5ea8d578154c2afb149d8ef601d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Aug 2022 15:49:39 -0700
+Subject: kvm: x86: mmu: Always flush TLBs when enabling dirty logging
+
+From: Junaid Shahid <junaids@google.com>
+
+[ Upstream commit b64d740ea7ddc929d97b28de4c0665f7d5db9e2a ]
+
+When A/D bits are not available, KVM uses a software access tracking
+mechanism, which involves making the SPTEs inaccessible. However,
+the clear_young() MMU notifier does not flush TLBs. So it is possible
+that there may still be stale, potentially writable, TLB entries.
+This is usually fine, but can be problematic when enabling dirty
+logging, because it currently only does a TLB flush if any SPTEs were
+modified. But if all SPTEs are in access-tracked state, then there
+won't be a TLB flush, which means that the guest could still possibly
+write to memory and not have it reflected in the dirty bitmap.
+
+So just unconditionally flush the TLBs when enabling dirty logging.
+As an alternative, KVM could explicitly check the MMU-Writable bit when
+write-protecting SPTEs to decide if a flush is needed (instead of
+checking the Writable bit), but given that a flush almost always happens
+anyway, so just making it unconditional seems simpler.
+
+Signed-off-by: Junaid Shahid <junaids@google.com>
+Message-Id: <20220810224939.2611160-1-junaids@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/mmu/mmu.c | 45 +++++++----------------------------------
+ arch/x86/kvm/mmu/spte.h | 14 +++++++++----
+ arch/x86/kvm/x86.c | 44 ++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 61 insertions(+), 42 deletions(-)
+
+diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
+index 356226c7ebbdc..aa1ba803659cd 100644
+--- a/arch/x86/kvm/mmu/mmu.c
++++ b/arch/x86/kvm/mmu/mmu.c
+@@ -5907,47 +5907,18 @@ void kvm_mmu_slot_remove_write_access(struct kvm *kvm,
+ const struct kvm_memory_slot *memslot,
+ int start_level)
+ {
+- bool flush = false;
+-
+ if (kvm_memslots_have_rmaps(kvm)) {
+ write_lock(&kvm->mmu_lock);
+- flush = slot_handle_level(kvm, memslot, slot_rmap_write_protect,
+- start_level, KVM_MAX_HUGEPAGE_LEVEL,
+- false);
++ slot_handle_level(kvm, memslot, slot_rmap_write_protect,
++ start_level, KVM_MAX_HUGEPAGE_LEVEL, false);
+ write_unlock(&kvm->mmu_lock);
+ }
+
+ if (is_tdp_mmu_enabled(kvm)) {
+ read_lock(&kvm->mmu_lock);
+- flush |= kvm_tdp_mmu_wrprot_slot(kvm, memslot, start_level);
++ kvm_tdp_mmu_wrprot_slot(kvm, memslot, start_level);
+ read_unlock(&kvm->mmu_lock);
+ }
+-
+- /*
+- * Flush TLBs if any SPTEs had to be write-protected to ensure that
+- * guest writes are reflected in the dirty bitmap before the memslot
+- * update completes, i.e. before enabling dirty logging is visible to
+- * userspace.
+- *
+- * Perform the TLB flush outside the mmu_lock to reduce the amount of
+- * time the lock is held. However, this does mean that another CPU can
+- * now grab mmu_lock and encounter a write-protected SPTE while CPUs
+- * still have a writable mapping for the associated GFN in their TLB.
+- *
+- * This is safe but requires KVM to be careful when making decisions
+- * based on the write-protection status of an SPTE. Specifically, KVM
+- * also write-protects SPTEs to monitor changes to guest page tables
+- * during shadow paging, and must guarantee no CPUs can write to those
+- * page before the lock is dropped. As mentioned in the previous
+- * paragraph, a write-protected SPTE is no guarantee that CPU cannot
+- * perform writes. So to determine if a TLB flush is truly required, KVM
+- * will clear a separate software-only bit (MMU-writable) and skip the
+- * flush if-and-only-if this bit was already clear.
+- *
+- * See is_writable_pte() for more details.
+- */
+- if (flush)
+- kvm_arch_flush_remote_tlbs_memslot(kvm, memslot);
+ }
+
+ /* Must be called with the mmu_lock held in write-mode. */
+@@ -6070,32 +6041,30 @@ void kvm_arch_flush_remote_tlbs_memslot(struct kvm *kvm,
+ void kvm_mmu_slot_leaf_clear_dirty(struct kvm *kvm,
+ const struct kvm_memory_slot *memslot)
+ {
+- bool flush = false;
+-
+ if (kvm_memslots_have_rmaps(kvm)) {
+ write_lock(&kvm->mmu_lock);
+ /*
+ * Clear dirty bits only on 4k SPTEs since the legacy MMU only
+ * support dirty logging at a 4k granularity.
+ */
+- flush = slot_handle_level_4k(kvm, memslot, __rmap_clear_dirty, false);
++ slot_handle_level_4k(kvm, memslot, __rmap_clear_dirty, false);
+ write_unlock(&kvm->mmu_lock);
+ }
+
+ if (is_tdp_mmu_enabled(kvm)) {
+ read_lock(&kvm->mmu_lock);
+- flush |= kvm_tdp_mmu_clear_dirty_slot(kvm, memslot);
++ kvm_tdp_mmu_clear_dirty_slot(kvm, memslot);
+ read_unlock(&kvm->mmu_lock);
+ }
+
+ /*
++ * The caller will flush the TLBs after this function returns.
++ *
+ * It's also safe to flush TLBs out of mmu lock here as currently this
+ * function is only used for dirty logging, in which case flushing TLB
+ * out of mmu lock also guarantees no dirty pages will be lost in
+ * dirty_bitmap.
+ */
+- if (flush)
+- kvm_arch_flush_remote_tlbs_memslot(kvm, memslot);
+ }
+
+ void kvm_mmu_zap_all(struct kvm *kvm)
+diff --git a/arch/x86/kvm/mmu/spte.h b/arch/x86/kvm/mmu/spte.h
+index f80dbb628df57..e09bdcf1e47c5 100644
+--- a/arch/x86/kvm/mmu/spte.h
++++ b/arch/x86/kvm/mmu/spte.h
+@@ -326,7 +326,7 @@ static __always_inline bool is_rsvd_spte(struct rsvd_bits_validate *rsvd_check,
+ }
+
+ /*
+- * An shadow-present leaf SPTE may be non-writable for 3 possible reasons:
++ * A shadow-present leaf SPTE may be non-writable for 4 possible reasons:
+ *
+ * 1. To intercept writes for dirty logging. KVM write-protects huge pages
+ * so that they can be split be split down into the dirty logging
+@@ -344,8 +344,13 @@ static __always_inline bool is_rsvd_spte(struct rsvd_bits_validate *rsvd_check,
+ * read-only memslot or guest memory backed by a read-only VMA. Writes to
+ * such pages are disallowed entirely.
+ *
+- * To keep track of why a given SPTE is write-protected, KVM uses 2
+- * software-only bits in the SPTE:
++ * 4. To emulate the Accessed bit for SPTEs without A/D bits. Note, in this
++ * case, the SPTE is access-protected, not just write-protected!
++ *
++ * For cases #1 and #4, KVM can safely make such SPTEs writable without taking
++ * mmu_lock as capturing the Accessed/Dirty state doesn't require taking it.
++ * To differentiate #1 and #4 from #2 and #3, KVM uses two software-only bits
++ * in the SPTE:
+ *
+ * shadow_mmu_writable_mask, aka MMU-writable -
+ * Cleared on SPTEs that KVM is currently write-protecting for shadow paging
+@@ -374,7 +379,8 @@ static __always_inline bool is_rsvd_spte(struct rsvd_bits_validate *rsvd_check,
+ * shadow page tables between vCPUs. Write-protecting an SPTE for dirty logging
+ * (which does not clear the MMU-writable bit), does not flush TLBs before
+ * dropping the lock, as it only needs to synchronize guest writes with the
+- * dirty bitmap.
++ * dirty bitmap. Similarly, making the SPTE inaccessible (and non-writable) for
++ * access-tracking via the clear_young() MMU notifier also does not flush TLBs.
+ *
+ * So, there is the problem: clearing the MMU-writable bit can encounter a
+ * write-protected SPTE while CPUs still have writable mappings for that SPTE
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 55de0d1981e52..5b36866528568 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -12265,6 +12265,50 @@ static void kvm_mmu_slot_apply_flags(struct kvm *kvm,
+ } else {
+ kvm_mmu_slot_remove_write_access(kvm, new, PG_LEVEL_4K);
+ }
++
++ /*
++ * Unconditionally flush the TLBs after enabling dirty logging.
++ * A flush is almost always going to be necessary (see below),
++ * and unconditionally flushing allows the helpers to omit
++ * the subtly complex checks when removing write access.
++ *
++ * Do the flush outside of mmu_lock to reduce the amount of
++ * time mmu_lock is held. Flushing after dropping mmu_lock is
++ * safe as KVM only needs to guarantee the slot is fully
++ * write-protected before returning to userspace, i.e. before
++ * userspace can consume the dirty status.
++ *
++ * Flushing outside of mmu_lock requires KVM to be careful when
++ * making decisions based on writable status of an SPTE, e.g. a
++ * !writable SPTE doesn't guarantee a CPU can't perform writes.
++ *
++ * Specifically, KVM also write-protects guest page tables to
++ * monitor changes when using shadow paging, and must guarantee
++ * no CPUs can write to those page before mmu_lock is dropped.
++ * Because CPUs may have stale TLB entries at this point, a
++ * !writable SPTE doesn't guarantee CPUs can't perform writes.
++ *
++ * KVM also allows making SPTES writable outside of mmu_lock,
++ * e.g. to allow dirty logging without taking mmu_lock.
++ *
++ * To handle these scenarios, KVM uses a separate software-only
++ * bit (MMU-writable) to track if a SPTE is !writable due to
++ * a guest page table being write-protected (KVM clears the
++ * MMU-writable flag when write-protecting for shadow paging).
++ *
++ * The use of MMU-writable is also the primary motivation for
++ * the unconditional flush. Because KVM must guarantee that a
++ * CPU doesn't contain stale, writable TLB entries for a
++ * !MMU-writable SPTE, KVM must flush if it encounters any
++ * MMU-writable SPTE regardless of whether the actual hardware
++ * writable bit was set. I.e. KVM is almost guaranteed to need
++ * to flush, while unconditionally flushing allows the "remove
++ * write access" helpers to ignore MMU-writable entirely.
++ *
++ * See is_writable_pte() for more details (the case involving
++ * access-tracked SPTEs is particularly relevant).
++ */
++ kvm_arch_flush_remote_tlbs_memslot(kvm, new);
+ }
+ }
+
+--
+2.35.1
+
--- /dev/null
+From 0a0bb758c21c713457c9b5e9ef03fba73cdb052a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Aug 2022 13:40:17 +0800
+Subject: LoongArch: Fix arch_remove_memory() undefined build error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yupeng Li <liyupeng@zbhlos.com>
+
+[ Upstream commit 1a470ce4e9106cc4c3c0edfb2e213dcbb7224dc4 ]
+
+The kernel build error when unslected CONFIG_MEMORY_HOTREMOVE because
+arch_remove_memory() is needed by mm/memory_hotplug.c but undefined.
+
+Some build error messages like:
+
+ LD vmlinux.o
+ MODPOST vmlinux.symvers
+ MODINFO modules.builtin.modinfo
+ GEN modules.builtin
+ LD .tmp_vmlinux.kallsyms1
+loongarch64-linux-gnu-ld: mm/memory_hotplug.o: in function `.L242':
+memory_hotplug.c:(.ref.text+0x930): undefined reference to `arch_remove_memory'
+make: *** [Makefile:1169：vmlinux] 错误 1
+
+Removed CONFIG_MEMORY_HOTREMOVE requirement and rearrange the file refer
+to the definitions of other platform architectures.
+
+Signed-off-by: Yupeng Li <liyupeng@zbhlos.com>
+Signed-off-by: Caicai <caizp2008@163.com>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/mm/init.c | 22 ++++++++++------------
+ 1 file changed, 10 insertions(+), 12 deletions(-)
+
+diff --git a/arch/loongarch/mm/init.c b/arch/loongarch/mm/init.c
+index 7094a68c9b832..3c3fbff0b8f86 100644
+--- a/arch/loongarch/mm/init.c
++++ b/arch/loongarch/mm/init.c
+@@ -131,18 +131,6 @@ int arch_add_memory(int nid, u64 start, u64 size, struct mhp_params *params)
+ return ret;
+ }
+
+-#ifdef CONFIG_NUMA
+-int memory_add_physaddr_to_nid(u64 start)
+-{
+- int nid;
+-
+- nid = pa_to_nid(start);
+- return nid;
+-}
+-EXPORT_SYMBOL_GPL(memory_add_physaddr_to_nid);
+-#endif
+-
+-#ifdef CONFIG_MEMORY_HOTREMOVE
+ void arch_remove_memory(u64 start, u64 size, struct vmem_altmap *altmap)
+ {
+ unsigned long start_pfn = start >> PAGE_SHIFT;
+@@ -154,6 +142,16 @@ void arch_remove_memory(u64 start, u64 size, struct vmem_altmap *altmap)
+ page += vmem_altmap_offset(altmap);
+ __remove_pages(start_pfn, nr_pages, altmap);
+ }
++
++#ifdef CONFIG_NUMA
++int memory_add_physaddr_to_nid(u64 start)
++{
++ int nid;
++
++ nid = pa_to_nid(start);
++ return nid;
++}
++EXPORT_SYMBOL_GPL(memory_add_physaddr_to_nid);
+ #endif
+ #endif
+
+--
+2.35.1
+
--- /dev/null
+From ca85504f2b48d87a6c3090255566969a5d27046a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Sep 2022 22:33:42 +0800
+Subject: LoongArch: Fix section mismatch due to acpi_os_ioremap()
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit e0fba87c854347007fb9fc873e890b686cc61302 ]
+
+Now acpi_os_ioremap() is marked with __init because it calls memblock_
+is_memory() which is also marked with __init in the !ARCH_KEEP_MEMBLOCK
+case. However, acpi_os_ioremap() is called by ordinary functions such
+as acpi_os_{read, write}_memory() and causes section mismatch warnings:
+
+WARNING: modpost: vmlinux.o: section mismatch in reference: acpi_os_read_memory (section: .text) -> acpi_os_ioremap (section: .init.text)
+WARNING: modpost: vmlinux.o: section mismatch in reference: acpi_os_write_memory (section: .text) -> acpi_os_ioremap (section: .init.text)
+
+Fix these warnings by selecting ARCH_KEEP_MEMBLOCK unconditionally and
+removing the __init modifier of acpi_os_ioremap(). This can also give a
+chance to track "memory" and "reserved" memblocks after early boot.
+
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/Kconfig | 1 +
+ arch/loongarch/include/asm/acpi.h | 2 +-
+ arch/loongarch/kernel/acpi.c | 2 +-
+ 3 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig
+index 62b5b07fa4e1c..ca64bf5f5b038 100644
+--- a/arch/loongarch/Kconfig
++++ b/arch/loongarch/Kconfig
+@@ -36,6 +36,7 @@ config LOONGARCH
+ select ARCH_INLINE_SPIN_UNLOCK_BH if !PREEMPTION
+ select ARCH_INLINE_SPIN_UNLOCK_IRQ if !PREEMPTION
+ select ARCH_INLINE_SPIN_UNLOCK_IRQRESTORE if !PREEMPTION
++ select ARCH_KEEP_MEMBLOCK
+ select ARCH_MIGHT_HAVE_PC_PARPORT
+ select ARCH_MIGHT_HAVE_PC_SERIO
+ select ARCH_SPARSEMEM_ENABLE
+diff --git a/arch/loongarch/include/asm/acpi.h b/arch/loongarch/include/asm/acpi.h
+index 62044cd5b7bc5..825c2519b9d1f 100644
+--- a/arch/loongarch/include/asm/acpi.h
++++ b/arch/loongarch/include/asm/acpi.h
+@@ -15,7 +15,7 @@ extern int acpi_pci_disabled;
+ extern int acpi_noirq;
+
+ #define acpi_os_ioremap acpi_os_ioremap
+-void __init __iomem *acpi_os_ioremap(acpi_physical_address phys, acpi_size size);
++void __iomem *acpi_os_ioremap(acpi_physical_address phys, acpi_size size);
+
+ static inline void disable_acpi(void)
+ {
+diff --git a/arch/loongarch/kernel/acpi.c b/arch/loongarch/kernel/acpi.c
+index bb729ee8a2370..796a24055a942 100644
+--- a/arch/loongarch/kernel/acpi.c
++++ b/arch/loongarch/kernel/acpi.c
+@@ -113,7 +113,7 @@ void __init __acpi_unmap_table(void __iomem *map, unsigned long size)
+ early_memunmap(map, size);
+ }
+
+-void __init __iomem *acpi_os_ioremap(acpi_physical_address phys, acpi_size size)
++void __iomem *acpi_os_ioremap(acpi_physical_address phys, acpi_size size)
+ {
+ if (!memblock_is_memory(phys))
+ return ioremap(phys, size);
+--
+2.35.1
+
--- /dev/null
+From 75650e260d8985d9a3085110f3c2800ad5c0d650 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Aug 2022 18:34:48 +0200
+Subject: net: dsa: hellcreek: Print warning only once
+
+From: Kurt Kanzenbach <kurt@linutronix.de>
+
+[ Upstream commit 52267ce25f60f37ae40ccbca0b21328ebae5ae75 ]
+
+In case the source port cannot be decoded, print the warning only once. This
+still brings attention to the user and does not spam the logs at the same time.
+
+Signed-off-by: Kurt Kanzenbach <kurt@linutronix.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Link: https://lore.kernel.org/r/20220830163448.8921-1-kurt@linutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dsa/tag_hellcreek.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/dsa/tag_hellcreek.c b/net/dsa/tag_hellcreek.c
+index eb204ad36eeec..846588c0070a5 100644
+--- a/net/dsa/tag_hellcreek.c
++++ b/net/dsa/tag_hellcreek.c
+@@ -45,7 +45,7 @@ static struct sk_buff *hellcreek_rcv(struct sk_buff *skb,
+
+ skb->dev = dsa_master_find_slave(dev, 0, port);
+ if (!skb->dev) {
+- netdev_warn(dev, "Failed to get source port: %d\n", port);
++ netdev_warn_once(dev, "Failed to get source port: %d\n", port);
+ return NULL;
+ }
+
+--
+2.35.1
+
--- /dev/null
+From b8583f4849c1488ea8e927f26a479e1bcbda5715 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Aug 2022 09:51:40 -0700
+Subject: nvme-pci: add NVME_QUIRK_BOGUS_NID for Lexar NM610
+
+From: Shyamin Ayesh <me@shyamin.com>
+
+[ Upstream commit 200dccd07df21b504a2168960059f0a971bf415d ]
+
+Lexar NM610 reports bogus eui64 values that appear to be the same across
+all drives. Quirk them out so they are not marked as "non globally unique"
+duplicates.
+
+Signed-off-by: Shyamin Ayesh <me@shyamin.com>
+[patch formatting]
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 73d9fcba3b1c0..9f6614f7dbeb1 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -3517,6 +3517,8 @@ static const struct pci_device_id nvme_id_table[] = {
+ .driver_data = NVME_QUIRK_NO_DEEPEST_PS, },
+ { PCI_DEVICE(0xc0a9, 0x540a), /* Crucial P2 */
+ .driver_data = NVME_QUIRK_BOGUS_NID, },
++ { PCI_DEVICE(0x1d97, 0x2263), /* Lexar NM610 */
++ .driver_data = NVME_QUIRK_BOGUS_NID, },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMAZON, 0x0061),
+ .driver_data = NVME_QUIRK_DMA_ADDRESS_BITS_48, },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMAZON, 0x0065),
+--
+2.35.1
+
--- /dev/null
+From 503f27757779ca4f4b04983e21e100711d0cc918 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Aug 2022 14:40:30 +0200
+Subject: nvmet-tcp: fix unhandled tcp states in nvmet_tcp_state_change()
+
+From: Maurizio Lombardi <mlombard@redhat.com>
+
+[ Upstream commit 478814a5584197fa1fb18377653626e3416e7cd6 ]
+
+TCP_FIN_WAIT2 and TCP_LAST_ACK were not handled, the connection is closing
+so we can ignore them and avoid printing the "unhandled state"
+warning message.
+
+[ 1298.852386] nvmet_tcp: queue 2 unhandled state 5
+[ 1298.879112] nvmet_tcp: queue 7 unhandled state 5
+[ 1298.884253] nvmet_tcp: queue 8 unhandled state 5
+[ 1298.889475] nvmet_tcp: queue 9 unhandled state 5
+
+v2: Do not call nvmet_tcp_schedule_release_queue(), just ignore
+the fin_wait2 and last_ack states.
+
+Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/tcp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
+index dc3b4dc8fe08b..a3694a32f6d52 100644
+--- a/drivers/nvme/target/tcp.c
++++ b/drivers/nvme/target/tcp.c
+@@ -1506,6 +1506,9 @@ static void nvmet_tcp_state_change(struct sock *sk)
+ goto done;
+
+ switch (sk->sk_state) {
++ case TCP_FIN_WAIT2:
++ case TCP_LAST_ACK:
++ break;
+ case TCP_FIN_WAIT1:
+ case TCP_CLOSE_WAIT:
+ case TCP_CLOSE:
+--
+2.35.1
+
--- /dev/null
+From 62fc26614fec3d98137e285b960bc996d6140038 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Jul 2022 12:15:01 +0200
+Subject: peci: cpu: Fix use-after-free in adev_release()
+
+From: Iwona Winiarska <iwona.winiarska@intel.com>
+
+[ Upstream commit 1c11289b34ab67ed080bbe0f1855c4938362d9cf ]
+
+When auxiliary_device_add() returns an error, auxiliary_device_uninit()
+is called, which causes refcount for device to be decremented and
+.release callback will be triggered.
+
+Because adev_release() re-calls auxiliary_device_uninit(), it will cause
+use-after-free:
+[ 1269.455172] WARNING: CPU: 0 PID: 14267 at lib/refcount.c:28 refcount_warn_saturate+0x110/0x15
+[ 1269.464007] refcount_t: underflow; use-after-free.
+
+Reported-by: Jianglei Nie <niejianglei2021@163.com>
+Signed-off-by: Iwona Winiarska <iwona.winiarska@intel.com>
+Link: https://lore.kernel.org/r/20220705101501.298395-1-iwona.winiarska@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/peci/cpu.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/peci/cpu.c b/drivers/peci/cpu.c
+index 68eb61c65d345..de4a7b3e5966e 100644
+--- a/drivers/peci/cpu.c
++++ b/drivers/peci/cpu.c
+@@ -188,8 +188,6 @@ static void adev_release(struct device *dev)
+ {
+ struct auxiliary_device *adev = to_auxiliary_dev(dev);
+
+- auxiliary_device_uninit(adev);
+-
+ kfree(adev->name);
+ kfree(adev);
+ }
+@@ -234,6 +232,7 @@ static void unregister_adev(void *_adev)
+ struct auxiliary_device *adev = _adev;
+
+ auxiliary_device_delete(adev);
++ auxiliary_device_uninit(adev);
+ }
+
+ static int devm_adev_add(struct device *dev, int idx)
+--
+2.35.1
+
--- /dev/null
+From 47f9b748f8c13c62eb592a641ceb330191c92791 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Aug 2022 09:18:44 +0800
+Subject: perf/arm_pmu_platform: fix tests for platform_get_irq() failure
+
+From: Yu Zhe <yuzhe@nfschina.com>
+
+[ Upstream commit 6bb0d64c100091e131cd16710b62fda3319cd0af ]
+
+The platform_get_irq() returns negative error codes. It can't actually
+return zero.
+
+Signed-off-by: Yu Zhe <yuzhe@nfschina.com>
+Link: https://lore.kernel.org/r/20220825011844.8536-1-yuzhe@nfschina.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm_pmu_platform.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/perf/arm_pmu_platform.c b/drivers/perf/arm_pmu_platform.c
+index 513de1f54e2d7..933b96e243b84 100644
+--- a/drivers/perf/arm_pmu_platform.c
++++ b/drivers/perf/arm_pmu_platform.c
+@@ -117,7 +117,7 @@ static int pmu_parse_irqs(struct arm_pmu *pmu)
+
+ if (num_irqs == 1) {
+ int irq = platform_get_irq(pdev, 0);
+- if (irq && irq_is_percpu_devid(irq))
++ if ((irq > 0) && irq_is_percpu_devid(irq))
+ return pmu_parse_percpu_irq(pmu, irq);
+ }
+
+--
+2.35.1
+
--- /dev/null
+From ee46be46f43a1213d49a75ddfc8633330c8b7c6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Aug 2022 16:01:33 +0200
+Subject: platform/surface: aggregator_registry: Add support for Surface Laptop
+ Go 2
+
+From: Maximilian Luz <luzmaximilian@gmail.com>
+
+[ Upstream commit 84b8e403435c8fb94b872309673764a447961e00 ]
+
+The Surface Laptop Go 2 seems to have the same SAM client devices as the
+Surface Laptop Go 1, so re-use its node group.
+
+Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Link: https://lore.kernel.org/r/20220810140133.99087-1-luzmaximilian@gmail.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/surface/surface_aggregator_registry.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/platform/surface/surface_aggregator_registry.c b/drivers/platform/surface/surface_aggregator_registry.c
+index ce2bd88feeaa8..08019c6ccc9ca 100644
+--- a/drivers/platform/surface/surface_aggregator_registry.c
++++ b/drivers/platform/surface/surface_aggregator_registry.c
+@@ -556,6 +556,9 @@ static const struct acpi_device_id ssam_platform_hub_match[] = {
+ /* Surface Laptop Go 1 */
+ { "MSHW0118", (unsigned long)ssam_node_group_slg1 },
+
++ /* Surface Laptop Go 2 */
++ { "MSHW0290", (unsigned long)ssam_node_group_slg1 },
++
+ /* Surface Laptop Studio */
+ { "MSHW0123", (unsigned long)ssam_node_group_sls },
+
+--
+2.35.1
+
--- /dev/null
+From fe3d55d7d85d09e85760f16e2450296afa9819b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Aug 2022 18:35:44 +0200
+Subject: platform/x86: acer-wmi: Acer Aspire One AOD270/Packard Bell Dot
+ keymap fixes
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit c3b82d26bc85f5fc2fef5ec8cce17c89633a55a8 ]
+
+2 keymap fixes for the Acer Aspire One AOD270 and the same hardware
+rebranded as Packard Bell Dot SC:
+
+1. The F2 key is marked with a big '?' symbol on the Packard Bell Dot SC,
+this sends WMID_HOTKEY_EVENTs with a scancode of 0x27 add a mapping
+for this.
+
+2. Scancode 0x61 is KEY_SWITCHVIDEOMODE. Usually this is a duplicate
+input event with the "Video Bus" input device events. But on these devices
+the "Video Bus" does not send events for this key. Map 0x61 to KEY_UNKNOWN
+instead of using KE_IGNORE so that udev/hwdb can override it on these devs.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20220829163544.5288-1-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/acer-wmi.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
+index 9c6943e401a6c..0fbcaffabbfc7 100644
+--- a/drivers/platform/x86/acer-wmi.c
++++ b/drivers/platform/x86/acer-wmi.c
+@@ -99,6 +99,7 @@ static const struct key_entry acer_wmi_keymap[] __initconst = {
+ {KE_KEY, 0x22, {KEY_PROG2} }, /* Arcade */
+ {KE_KEY, 0x23, {KEY_PROG3} }, /* P_Key */
+ {KE_KEY, 0x24, {KEY_PROG4} }, /* Social networking_Key */
++ {KE_KEY, 0x27, {KEY_HELP} },
+ {KE_KEY, 0x29, {KEY_PROG3} }, /* P_Key for TM8372 */
+ {KE_IGNORE, 0x41, {KEY_MUTE} },
+ {KE_IGNORE, 0x42, {KEY_PREVIOUSSONG} },
+@@ -112,7 +113,13 @@ static const struct key_entry acer_wmi_keymap[] __initconst = {
+ {KE_IGNORE, 0x48, {KEY_VOLUMEUP} },
+ {KE_IGNORE, 0x49, {KEY_VOLUMEDOWN} },
+ {KE_IGNORE, 0x4a, {KEY_VOLUMEDOWN} },
+- {KE_IGNORE, 0x61, {KEY_SWITCHVIDEOMODE} },
++ /*
++ * 0x61 is KEY_SWITCHVIDEOMODE. Usually this is a duplicate input event
++ * with the "Video Bus" input device events. But sometimes it is not
++ * a dup. Map it to KEY_UNKNOWN instead of using KE_IGNORE so that
++ * udev/hwdb can override it on systems where it is not a dup.
++ */
++ {KE_KEY, 0x61, {KEY_UNKNOWN} },
+ {KE_IGNORE, 0x62, {KEY_BRIGHTNESSUP} },
+ {KE_IGNORE, 0x63, {KEY_BRIGHTNESSDOWN} },
+ {KE_KEY, 0x64, {KEY_SWITCHVIDEOMODE} }, /* Display Switch */
+--
+2.35.1
+
--- /dev/null
+From e1d28befae68d8fdc7f53a072b223b0cd2b9aa77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Aug 2022 19:46:38 +1200
+Subject: platform/x86: asus-wmi: Increase FAN_CURVE_BUF_LEN to 32
+
+From: Luke D. Jones <luke@ljones.dev>
+
+[ Upstream commit 5542dfc582f4a925f67bbfaf8f62ca83506032ae ]
+
+Fix for TUF laptops returning with an -ENOSPC on calling
+asus_wmi_evaluate_method_buf() when fetching default curves. The TUF method
+requires at least 32 bytes space.
+
+This also moves and changes the pr_debug() in fan_curve_check_present() to
+pr_warn() in fan_curve_get_factory_default() so that there is at least some
+indication in logs of why it fails.
+
+Signed-off-by: Luke D. Jones <luke@ljones.dev>
+Link: https://lore.kernel.org/r/20220828074638.5473-1-luke@ljones.dev
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/asus-wmi.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
+index 62ce198a34631..a0f31624aee97 100644
+--- a/drivers/platform/x86/asus-wmi.c
++++ b/drivers/platform/x86/asus-wmi.c
+@@ -107,7 +107,7 @@ module_param(fnlock_default, bool, 0444);
+ #define WMI_EVENT_MASK 0xFFFF
+
+ #define FAN_CURVE_POINTS 8
+-#define FAN_CURVE_BUF_LEN (FAN_CURVE_POINTS * 2)
++#define FAN_CURVE_BUF_LEN 32
+ #define FAN_CURVE_DEV_CPU 0x00
+ #define FAN_CURVE_DEV_GPU 0x01
+ /* Mask to determine if setting temperature or percentage */
+@@ -2208,8 +2208,10 @@ static int fan_curve_get_factory_default(struct asus_wmi *asus, u32 fan_dev)
+ curves = &asus->custom_fan_curves[fan_idx];
+ err = asus_wmi_evaluate_method_buf(asus->dsts_id, fan_dev, mode, buf,
+ FAN_CURVE_BUF_LEN);
+- if (err)
++ if (err) {
++ pr_warn("%s (0x%08x) failed: %d\n", __func__, fan_dev, err);
+ return err;
++ }
+
+ fan_curve_copy_from_buf(curves, buf);
+ curves->device_id = fan_dev;
+@@ -2227,9 +2229,6 @@ static int fan_curve_check_present(struct asus_wmi *asus, bool *available,
+
+ err = fan_curve_get_factory_default(asus, fan_dev);
+ if (err) {
+- pr_debug("fan_curve_get_factory_default(0x%08x) failed: %d\n",
+- fan_dev, err);
+- /* Don't cause probe to fail on devices without fan-curves */
+ return 0;
+ }
+
+--
+2.35.1
+
--- /dev/null
+From 0e5638bbf705459d834799dc87608b18b5b84e64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Aug 2022 21:14:36 +0200
+Subject: r8152: add PID for the Lenovo OneLink+ Dock
+
+From: Jean-Francois Le Fillatre <jflf_kernel@gmx.com>
+
+[ Upstream commit 1bd3a383075c64d638e65d263c9267b08ee7733c ]
+
+The Lenovo OneLink+ Dock contains an RTL8153 controller that behaves as
+a broken CDC device by default. Add the custom Lenovo PID to the r8152
+driver to support it properly.
+
+Also, systems compatible with this dock provide a BIOS option to enable
+MAC address passthrough (as per Lenovo document "ThinkPad Docking
+Solutions 2017"). Add the custom PID to the MAC passthrough list too.
+
+Tested on a ThinkPad 13 1st gen with the expected results:
+
+passthrough disabled: Invalid header when reading pass-thru MAC addr
+passthrough enabled: Using pass-thru MAC addr XX:XX:XX:XX:XX:XX
+
+Signed-off-by: Jean-Francois Le Fillatre <jflf_kernel@gmx.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/cdc_ether.c | 7 +++++++
+ drivers/net/usb/r8152.c | 3 +++
+ 2 files changed, 10 insertions(+)
+
+diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
+index 2de09ad5bac03..e11f70911acc1 100644
+--- a/drivers/net/usb/cdc_ether.c
++++ b/drivers/net/usb/cdc_ether.c
+@@ -777,6 +777,13 @@ static const struct usb_device_id products[] = {
+ },
+ #endif
+
++/* Lenovo ThinkPad OneLink+ Dock (based on Realtek RTL8153) */
++{
++ USB_DEVICE_AND_INTERFACE_INFO(LENOVO_VENDOR_ID, 0x3054, USB_CLASS_COMM,
++ USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
++ .driver_info = 0,
++},
++
+ /* ThinkPad USB-C Dock (based on Realtek RTL8153) */
+ {
+ USB_DEVICE_AND_INTERFACE_INFO(LENOVO_VENDOR_ID, 0x3062, USB_CLASS_COMM,
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index d142ac8fcf6e2..688905ea0a6d3 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -770,6 +770,7 @@ enum rtl8152_flags {
+ RX_EPROTO,
+ };
+
++#define DEVICE_ID_THINKPAD_ONELINK_PLUS_DOCK 0x3054
+ #define DEVICE_ID_THINKPAD_THUNDERBOLT3_DOCK_GEN2 0x3082
+ #define DEVICE_ID_THINKPAD_USB_C_DONGLE 0x720c
+ #define DEVICE_ID_THINKPAD_USB_C_DOCK_GEN2 0xa387
+@@ -9581,6 +9582,7 @@ static bool rtl8152_supports_lenovo_macpassthru(struct usb_device *udev)
+
+ if (vendor_id == VENDOR_ID_LENOVO) {
+ switch (product_id) {
++ case DEVICE_ID_THINKPAD_ONELINK_PLUS_DOCK:
+ case DEVICE_ID_THINKPAD_THUNDERBOLT3_DOCK_GEN2:
+ case DEVICE_ID_THINKPAD_USB_C_DOCK_GEN2:
+ case DEVICE_ID_THINKPAD_USB_C_DOCK_GEN3:
+@@ -9828,6 +9830,7 @@ static const struct usb_device_id rtl8152_table[] = {
+ REALTEK_USB_DEVICE(VENDOR_ID_MICROSOFT, 0x0927),
+ REALTEK_USB_DEVICE(VENDOR_ID_SAMSUNG, 0xa101),
+ REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x304f),
++ REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x3054),
+ REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x3062),
+ REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x3069),
+ REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x3082),
+--
+2.35.1
+
rdma-mlx5-rely-on-roce-fw-cap-instead-of-devlink-whe.patch
rdma-mlx5-add-a-umr-recovery-flow.patch
rdma-mlx5-fix-umr-cleanup-on-error-flow-of-driver-in.patch
+input-goodix-add-support-for-gt1158.patch
+platform-surface-aggregator_registry-add-support-for.patch
+drm-msm-rd-fix-fifo-full-deadlock.patch
+peci-cpu-fix-use-after-free-in-adev_release.patch
+hwmon-pmbus-use-dev_err_probe-to-filter-eprobe_defer.patch
+kvm-x86-mmu-always-flush-tlbs-when-enabling-dirty-lo.patch
+dt-bindings-iio-gyroscope-bosch-bmg160-correct-numbe.patch
+hid-ishtp-hid-clienthid-ishtp-hid-client-fix-comment.patch
+hid-intel-ish-hid-ishtp-fix-ishtp-client-sending-dis.patch
+bluetooth-mgmt-fix-get-device-flags.patch
+tg3-disable-tg3-device-on-system-reboot-to-avoid-tri.patch
+r8152-add-pid-for-the-lenovo-onelink-dock.patch
+gpio-mockup-remove-gpio-debugfs-when-remove-device.patch
+ieee802154-cc2520-add-rc-code-in-cc2520_tx.patch
+input-iforce-add-support-for-boeder-force-feedback-w.patch
+drm-amdgpu-disable-fru-access-on-special-sienna-cich.patch
+drm-amd-pm-use-vbios-carried-pptable-for-all-smu13.0.patch
+nvme-pci-add-nvme_quirk_bogus_nid-for-lexar-nm610.patch
+nvmet-tcp-fix-unhandled-tcp-states-in-nvmet_tcp_stat.patch
+drm-amd-amdgpu-skip-ucode-loading-if-ucode_size-0.patch
+net-dsa-hellcreek-print-warning-only-once.patch
+perf-arm_pmu_platform-fix-tests-for-platform_get_irq.patch
+platform-x86-acer-wmi-acer-aspire-one-aod270-packard.patch
+usb-storage-add-asus-0x0b05-0x1932-to-ignore_uas.patch
+platform-x86-asus-wmi-increase-fan_curve_buf_len-to-.patch
+loongarch-fix-section-mismatch-due-to-acpi_os_iorema.patch
+loongarch-fix-arch_remove_memory-undefined-build-err.patch
+gpio-104-dio-48e-make-irq_chip-immutable.patch
+gpio-104-idio-16-make-irq_chip-immutable.patch
--- /dev/null
+From 780d9a55027cdbb40bd83e2c29a2487e45d36f01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Aug 2022 08:25:30 +0800
+Subject: tg3: Disable tg3 device on system reboot to avoid triggering AER
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+[ Upstream commit 2ca1c94ce0b65a2ce7512b718f3d8a0fe6224bca ]
+
+Commit d60cd06331a3 ("PM: ACPI: reboot: Use S5 for reboot") caused a
+reboot hang on one Dell servers so the commit was reverted.
+
+Someone managed to collect the AER log and it's caused by MSI:
+[ 148.762067] ACPI: Preparing to enter system sleep state S5
+[ 148.794638] {1}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 5
+[ 148.803731] {1}[Hardware Error]: event severity: recoverable
+[ 148.810191] {1}[Hardware Error]: Error 0, type: fatal
+[ 148.816088] {1}[Hardware Error]: section_type: PCIe error
+[ 148.822391] {1}[Hardware Error]: port_type: 0, PCIe end point
+[ 148.829026] {1}[Hardware Error]: version: 3.0
+[ 148.834266] {1}[Hardware Error]: command: 0x0006, status: 0x0010
+[ 148.841140] {1}[Hardware Error]: device_id: 0000:04:00.0
+[ 148.847309] {1}[Hardware Error]: slot: 0
+[ 148.852077] {1}[Hardware Error]: secondary_bus: 0x00
+[ 148.857876] {1}[Hardware Error]: vendor_id: 0x14e4, device_id: 0x165f
+[ 148.865145] {1}[Hardware Error]: class_code: 020000
+[ 148.870845] {1}[Hardware Error]: aer_uncor_status: 0x00100000, aer_uncor_mask: 0x00010000
+[ 148.879842] {1}[Hardware Error]: aer_uncor_severity: 0x000ef030
+[ 148.886575] {1}[Hardware Error]: TLP Header: 40000001 0000030f 90028090 00000000
+[ 148.894823] tg3 0000:04:00.0: AER: aer_status: 0x00100000, aer_mask: 0x00010000
+[ 148.902795] tg3 0000:04:00.0: AER: [20] UnsupReq (First)
+[ 148.910234] tg3 0000:04:00.0: AER: aer_layer=Transaction Layer, aer_agent=Requester ID
+[ 148.918806] tg3 0000:04:00.0: AER: aer_uncor_severity: 0x000ef030
+[ 148.925558] tg3 0000:04:00.0: AER: TLP Header: 40000001 0000030f 90028090 00000000
+
+The MSI is probably raised by incoming packets, so power down the device
+and disable bus mastering to stop the traffic, as user confirmed this
+approach works.
+
+In addition to that, be extra safe and cancel reset task if it's running.
+
+Cc: Josef Bacik <josef@toxicpanda.com>
+Link: https://lore.kernel.org/all/b8db79e6857c41dab4ef08bdf826ea7c47e3bafc.1615947283.git.josef@toxicpanda.com/
+BugLink: https://bugs.launchpad.net/bugs/1917471
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Link: https://lore.kernel.org/r/20220826002530.1153296-1-kai.heng.feng@canonical.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/tg3.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index c28f8cc00d1cf..a9cc85882b315 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -18076,16 +18076,20 @@ static void tg3_shutdown(struct pci_dev *pdev)
+ struct net_device *dev = pci_get_drvdata(pdev);
+ struct tg3 *tp = netdev_priv(dev);
+
++ tg3_reset_task_cancel(tp);
++
+ rtnl_lock();
++
+ netif_device_detach(dev);
+
+ if (netif_running(dev))
+ dev_close(dev);
+
+- if (system_state == SYSTEM_POWER_OFF)
+- tg3_power_down(tp);
++ tg3_power_down(tp);
+
+ rtnl_unlock();
++
++ pci_disable_device(pdev);
+ }
+
+ /**
+--
+2.35.1
+
--- /dev/null
+From 63a7944c93e08afeb4b377e4417ca2e1459cb0bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Sep 2022 12:57:37 +0800
+Subject: usb: storage: Add ASUS <0x0b05:0x1932> to IGNORE_UAS
+
+From: Hu Xiaoying <huxiaoying@kylinos.cn>
+
+[ Upstream commit c61feaee68b9735be06f162bc046c7f1959efb0c ]
+
+USB external storage device(0x0b05:1932), use gnome-disk-utility tools
+to test usb write < 30MB/s.
+if does not to load module of uas for this device, can increase the
+write speed from 20MB/s to >40MB/s.
+
+Suggested-by: Matthias Kaehlcke <mka@chromium.org>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Hu Xiaoying <huxiaoying@kylinos.cn>
+Link: https://lore.kernel.org/r/20220901045737.3438046-1-huxiaoying@kylinos.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/storage/unusual_uas.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index 4051c8cd0cd8a..23ab3b048d9be 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -62,6 +62,13 @@ UNUSUAL_DEV(0x0984, 0x0301, 0x0128, 0x0128,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_IGNORE_UAS),
+
++/* Reported-by: Tom Hu <huxiaoying@kylinos.cn> */
++UNUSUAL_DEV(0x0b05, 0x1932, 0x0000, 0x9999,
++ "ASUS",
++ "External HDD",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_IGNORE_UAS),
++
+ /* Reported-by: David Webb <djw@noc.ac.uk> */
+ UNUSUAL_DEV(0x0bc2, 0x331a, 0x0000, 0x9999,
+ "Seagate",
+--
+2.35.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
