--- /dev/null
+From 209a04885ab5f76722a1671d0fbf0a5b4bccacec Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Sun, 28 Aug 2022 11:43:39 +0300
+Subject: arm64: dts: qcom: sdm845-mtp: correct ADC settle time
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit 209a04885ab5f76722a1671d0fbf0a5b4bccacec upstream.
+
+The PMIC's VADC property for settle time is qcom,hw-settle-time, not
+qcom,hw-settle-time-us. The latter is used in PMIC's TM ADC.
+
+ qcom/sdm845-mtp.dtb: pmic@0: adc@3100:adc-chan@4c: 'qcom,hw-settle-time-us' does not match any of the regexes: 'pinctrl-[0-9]+'
+
+Fixes: d5e12f3823ae ("arm64: dts: qcom: sdm845: mtp: Add vadc channels and thermal zones")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Reviewed-by: Vinod Koul <vkoul@kernel.org>
+Reviewed-by: David Heidelberg <david@ixit.cz>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20220828084341.112146-13-krzysztof.kozlowski@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845-mtp.dts | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/arm64/boot/dts/qcom/sdm845-mtp.dts
++++ b/arch/arm64/boot/dts/qcom/sdm845-mtp.dts
+@@ -536,42 +536,42 @@
+ reg = <ADC5_XO_THERM_100K_PU>;
+ label = "xo_therm";
+ qcom,ratiometric;
+- qcom,hw-settle-time-us = <200>;
++ qcom,hw-settle-time = <200>;
+ };
+
+ adc-chan@4d {
+ reg = <ADC5_AMUX_THM1_100K_PU>;
+ label = "msm_therm";
+ qcom,ratiometric;
+- qcom,hw-settle-time-us = <200>;
++ qcom,hw-settle-time = <200>;
+ };
+
+ adc-chan@4f {
+ reg = <ADC5_AMUX_THM3_100K_PU>;
+ label = "pa_therm1";
+ qcom,ratiometric;
+- qcom,hw-settle-time-us = <200>;
++ qcom,hw-settle-time = <200>;
+ };
+
+ adc-chan@51 {
+ reg = <ADC5_AMUX_THM5_100K_PU>;
+ label = "quiet_therm";
+ qcom,ratiometric;
+- qcom,hw-settle-time-us = <200>;
++ qcom,hw-settle-time = <200>;
+ };
+
+ adc-chan@83 {
+ reg = <ADC5_VPH_PWR>;
+ label = "vph_pwr";
+ qcom,ratiometric;
+- qcom,hw-settle-time-us = <200>;
++ qcom,hw-settle-time = <200>;
+ };
+
+ adc-chan@85 {
+ reg = <ADC5_VCOIN>;
+ label = "vcoin";
+ qcom,ratiometric;
+- qcom,hw-settle-time-us = <200>;
++ qcom,hw-settle-time = <200>;
+ };
+ };
+
--- /dev/null
+From ea8ef003aa53ad23e7705c5cab1c4e664faa6c79 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Wed, 21 Sep 2022 16:53:53 +0200
+Subject: ASoC: wcd9335: fix order of Slimbus unprepare/disable
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit ea8ef003aa53ad23e7705c5cab1c4e664faa6c79 upstream.
+
+Slimbus streams are first prepared and then enabled, so the cleanup path
+should reverse it. The unprepare sets stream->num_ports to 0 and frees
+the stream->ports. Calling disable after unprepare was not really
+effective (channels was not deactivated) and could lead to further
+issues due to making transfers on unprepared stream.
+
+Fixes: 20aedafdf492 ("ASoC: wcd9335: add support to wcd9335 codec")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220921145354.1683791-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/wcd9335.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wcd9335.c
++++ b/sound/soc/codecs/wcd9335.c
+@@ -1974,8 +1974,8 @@ static int wcd9335_trigger(struct snd_pc
+ case SNDRV_PCM_TRIGGER_STOP:
+ case SNDRV_PCM_TRIGGER_SUSPEND:
+ case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+- slim_stream_unprepare(dai_data->sruntime);
+ slim_stream_disable(dai_data->sruntime);
++ slim_stream_unprepare(dai_data->sruntime);
+ break;
+ default:
+ break;
--- /dev/null
+From e96bca7eaa5747633ec638b065630ff83728982a Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Wed, 21 Sep 2022 16:53:54 +0200
+Subject: ASoC: wcd934x: fix order of Slimbus unprepare/disable
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit e96bca7eaa5747633ec638b065630ff83728982a upstream.
+
+Slimbus streams are first prepared and then enabled, so the cleanup path
+should reverse it. The unprepare sets stream->num_ports to 0 and frees
+the stream->ports. Calling disable after unprepare was not really
+effective (channels was not deactivated) and could lead to further
+issues due to making transfers on unprepared stream.
+
+Fixes: a61f3b4f476e ("ASoC: wcd934x: add support to wcd9340/wcd9341 codec")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20220921145354.1683791-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/wcd934x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wcd934x.c
++++ b/sound/soc/codecs/wcd934x.c
+@@ -1913,8 +1913,8 @@ static int wcd934x_trigger(struct snd_pc
+ case SNDRV_PCM_TRIGGER_STOP:
+ case SNDRV_PCM_TRIGGER_SUSPEND:
+ case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+- slim_stream_unprepare(dai_data->sruntime);
+ slim_stream_disable(dai_data->sruntime);
++ slim_stream_unprepare(dai_data->sruntime);
+ break;
+ default:
+ break;
--- /dev/null
+From 00f146413ccb6c84308e559281449755c83f54c5 Mon Sep 17 00:00:00 2001
+From: Roberto Sassu <roberto.sassu@huawei.com>
+Date: Tue, 20 Sep 2022 09:59:40 +0200
+Subject: btf: Export bpf_dynptr definition
+
+From: Roberto Sassu <roberto.sassu@huawei.com>
+
+commit 00f146413ccb6c84308e559281449755c83f54c5 upstream.
+
+eBPF dynamic pointers is a new feature recently added to upstream. It binds
+together a pointer to a memory area and its size. The internal kernel
+structure bpf_dynptr_kern is not accessible by eBPF programs in user space.
+They instead see bpf_dynptr, which is then translated to the internal
+kernel structure by the eBPF verifier.
+
+The problem is that it is not possible to include at the same time the uapi
+include linux/bpf.h and the vmlinux BTF vmlinux.h, as they both contain the
+definition of some structures/enums. The compiler complains saying that the
+structures/enums are redefined.
+
+As bpf_dynptr is defined in the uapi include linux/bpf.h, this makes it
+impossible to include vmlinux.h. However, in some cases, e.g. when using
+kfuncs, vmlinux.h has to be included. The only option until now was to
+include vmlinux.h and add the definition of bpf_dynptr directly in the eBPF
+program source code from linux/bpf.h.
+
+Solve the problem by using the same approach as for bpf_timer (which also
+follows the same scheme with the _kern suffix for the internal kernel
+structure).
+
+Add the following line in one of the dynamic pointer helpers,
+bpf_dynptr_from_mem():
+
+BTF_TYPE_EMIT(struct bpf_dynptr);
+
+Cc: stable@vger.kernel.org
+Cc: Joanne Koong <joannelkoong@gmail.com>
+Fixes: 97e03f521050c ("bpf: Add verifier support for dynptrs")
+Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
+Acked-by: Yonghong Song <yhs@fb.com>
+Tested-by: KP Singh <kpsingh@kernel.org>
+Link: https://lore.kernel.org/r/20220920075951.929132-3-roberto.sassu@huaweicloud.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/bpf/helpers.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/kernel/bpf/helpers.c
++++ b/kernel/bpf/helpers.c
+@@ -1468,6 +1468,8 @@ BPF_CALL_4(bpf_dynptr_from_mem, void *,
+ {
+ int err;
+
++ BTF_TYPE_EMIT(struct bpf_dynptr);
++
+ err = bpf_dynptr_check_size(size);
+ if (err)
+ goto error;
--- /dev/null
+From 7175e131ebba47afef47e6ac4d5bab474d1e6e49 Mon Sep 17 00:00:00 2001
+From: Alexander Aring <aahringo@redhat.com>
+Date: Mon, 15 Aug 2022 15:43:19 -0400
+Subject: fs: dlm: fix invalid derefence of sb_lvbptr
+
+From: Alexander Aring <aahringo@redhat.com>
+
+commit 7175e131ebba47afef47e6ac4d5bab474d1e6e49 upstream.
+
+I experience issues when putting a lkbsb on the stack and have sb_lvbptr
+field to a dangled pointer while not using DLM_LKF_VALBLK. It will crash
+with the following kernel message, the dangled pointer is here
+0xdeadbeef as example:
+
+[ 102.749317] BUG: unable to handle page fault for address: 00000000deadbeef
+[ 102.749320] #PF: supervisor read access in kernel mode
+[ 102.749323] #PF: error_code(0x0000) - not-present page
+[ 102.749325] PGD 0 P4D 0
+[ 102.749332] Oops: 0000 [#1] PREEMPT SMP PTI
+[ 102.749336] CPU: 0 PID: 1567 Comm: lock_torture_wr Tainted: G W 5.19.0-rc3+ #1565
+[ 102.749343] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-2.module+el8.7.0+15506+033991b0 04/01/2014
+[ 102.749344] RIP: 0010:memcpy_erms+0x6/0x10
+[ 102.749353] Code: cc cc cc cc eb 1e 0f 1f 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 <f3> a4 c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20 72 7e 40 38 fe
+[ 102.749355] RSP: 0018:ffff97a58145fd08 EFLAGS: 00010202
+[ 102.749358] RAX: ffff901778b77070 RBX: 0000000000000000 RCX: 0000000000000040
+[ 102.749360] RDX: 0000000000000040 RSI: 00000000deadbeef RDI: ffff901778b77070
+[ 102.749362] RBP: ffff97a58145fd10 R08: ffff901760b67a70 R09: 0000000000000001
+[ 102.749364] R10: ffff9017008e2cb8 R11: 0000000000000001 R12: ffff901760b67a70
+[ 102.749366] R13: ffff901760b78f00 R14: 0000000000000003 R15: 0000000000000001
+[ 102.749368] FS: 0000000000000000(0000) GS:ffff901876e00000(0000) knlGS:0000000000000000
+[ 102.749372] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 102.749374] CR2: 00000000deadbeef CR3: 000000017c49a004 CR4: 0000000000770ef0
+[ 102.749376] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 102.749378] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 102.749379] PKRU: 55555554
+[ 102.749381] Call Trace:
+[ 102.749382] <TASK>
+[ 102.749383] ? send_args+0xb2/0xd0
+[ 102.749389] send_common+0xb7/0xd0
+[ 102.749395] _unlock_lock+0x2c/0x90
+[ 102.749400] unlock_lock.isra.56+0x62/0xa0
+[ 102.749405] dlm_unlock+0x21e/0x330
+[ 102.749411] ? lock_torture_stats+0x80/0x80 [dlm_locktorture]
+[ 102.749416] torture_unlock+0x5a/0x90 [dlm_locktorture]
+[ 102.749419] ? preempt_count_sub+0xba/0x100
+[ 102.749427] lock_torture_writer+0xbd/0x150 [dlm_locktorture]
+[ 102.786186] kthread+0x10a/0x130
+[ 102.786581] ? kthread_complete_and_exit+0x20/0x20
+[ 102.787156] ret_from_fork+0x22/0x30
+[ 102.787588] </TASK>
+[ 102.787855] Modules linked in: dlm_locktorture torture rpcsec_gss_krb5 intel_rapl_msr intel_rapl_common kvm_intel iTCO_wdt iTCO_vendor_support kvm vmw_vsock_virtio_transport qxl irqbypass vmw_vsock_virtio_transport_common drm_ttm_helper crc32_pclmul joydev crc32c_intel ttm vsock virtio_scsi virtio_balloon snd_pcm drm_kms_helper virtio_console snd_timer snd drm soundcore syscopyarea i2c_i801 sysfillrect sysimgblt i2c_smbus pcspkr fb_sys_fops lpc_ich serio_raw
+[ 102.792536] CR2: 00000000deadbeef
+[ 102.792930] ---[ end trace 0000000000000000 ]---
+
+This patch fixes the issue by checking also on DLM_LKF_VALBLK on exflags
+is set when copying the lvbptr array instead of if it's just null which
+fixes for me the issue.
+
+I think this patch can fix other dlm users as well, depending how they
+handle the init, freeing memory handling of sb_lvbptr and don't set
+DLM_LKF_VALBLK for some dlm_lock() calls. It might a there could be a
+hidden issue all the time. However with checking on DLM_LKF_VALBLK the
+user always need to provide a sb_lvbptr non-null value. There might be
+more intelligent handling between per ls lvblen, DLM_LKF_VALBLK and
+non-null to report the user the way how DLM API is used is wrong but can
+be added for later, this will only fix the current behaviour.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Alexander Aring <aahringo@redhat.com>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/dlm/lock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/dlm/lock.c
++++ b/fs/dlm/lock.c
+@@ -3623,7 +3623,7 @@ static void send_args(struct dlm_rsb *r,
+ case cpu_to_le32(DLM_MSG_REQUEST_REPLY):
+ case cpu_to_le32(DLM_MSG_CONVERT_REPLY):
+ case cpu_to_le32(DLM_MSG_GRANT):
+- if (!lkb->lkb_lvbptr)
++ if (!lkb->lkb_lvbptr || !(lkb->lkb_exflags & DLM_LKF_VALBLK))
+ break;
+ memcpy(ms->m_extra, lkb->lkb_lvbptr, r->res_ls->ls_lvblen);
+ break;
--- /dev/null
+From eef6ec9bf390e836a6c4029f3620fe49528aa1fe Mon Sep 17 00:00:00 2001
+From: Alexander Aring <aahringo@redhat.com>
+Date: Mon, 15 Aug 2022 15:43:14 -0400
+Subject: fs: dlm: fix race between test_bit() and queue_work()
+
+From: Alexander Aring <aahringo@redhat.com>
+
+commit eef6ec9bf390e836a6c4029f3620fe49528aa1fe upstream.
+
+This patch fixes a race by using ls_cb_mutex around the bit
+operations and conditional code blocks for LSFL_CB_DELAY.
+
+The function dlm_callback_stop() expects to stop all callbacks and
+flush all currently queued onces. The set_bit() is not enough because
+there can still be queue_work() after the workqueue was flushed.
+To avoid queue_work() after set_bit(), surround both by ls_cb_mutex.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Alexander Aring <aahringo@redhat.com>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/dlm/ast.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/dlm/ast.c
++++ b/fs/dlm/ast.c
+@@ -200,13 +200,13 @@ void dlm_add_cb(struct dlm_lkb *lkb, uin
+ if (!prev_seq) {
+ kref_get(&lkb->lkb_ref);
+
++ mutex_lock(&ls->ls_cb_mutex);
+ if (test_bit(LSFL_CB_DELAY, &ls->ls_flags)) {
+- mutex_lock(&ls->ls_cb_mutex);
+ list_add(&lkb->lkb_cb_list, &ls->ls_cb_delay);
+- mutex_unlock(&ls->ls_cb_mutex);
+ } else {
+ queue_work(ls->ls_callback_wq, &lkb->lkb_cb_work);
+ }
++ mutex_unlock(&ls->ls_cb_mutex);
+ }
+ out:
+ mutex_unlock(&lkb->lkb_cb_mutex);
+@@ -288,7 +288,9 @@ void dlm_callback_stop(struct dlm_ls *ls
+
+ void dlm_callback_suspend(struct dlm_ls *ls)
+ {
++ mutex_lock(&ls->ls_cb_mutex);
+ set_bit(LSFL_CB_DELAY, &ls->ls_flags);
++ mutex_unlock(&ls->ls_cb_mutex);
+
+ if (ls->ls_callback_wq)
+ flush_workqueue(ls->ls_callback_wq);
--- /dev/null
+From 44637ca41d551d409a481117b07fa209b330fca9 Mon Sep 17 00:00:00 2001
+From: Alexander Aring <aahringo@redhat.com>
+Date: Mon, 15 Aug 2022 15:43:15 -0400
+Subject: fs: dlm: handle -EBUSY first in lock arg validation
+
+From: Alexander Aring <aahringo@redhat.com>
+
+commit 44637ca41d551d409a481117b07fa209b330fca9 upstream.
+
+During lock arg validation, first check for -EBUSY cases, then for
+-EINVAL cases. The -EINVAL checks look at lkb state variables
+which are not stable when an lkb is busy and would cause an
+-EBUSY result, e.g. lkb->lkb_grmode.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Alexander Aring <aahringo@redhat.com>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/dlm/lock.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/fs/dlm/lock.c
++++ b/fs/dlm/lock.c
+@@ -2864,17 +2864,9 @@ static int set_unlock_args(uint32_t flag
+ static int validate_lock_args(struct dlm_ls *ls, struct dlm_lkb *lkb,
+ struct dlm_args *args)
+ {
+- int rv = -EINVAL;
++ int rv = -EBUSY;
+
+ if (args->flags & DLM_LKF_CONVERT) {
+- if (lkb->lkb_flags & DLM_IFL_MSTCPY)
+- goto out;
+-
+- if (args->flags & DLM_LKF_QUECVT &&
+- !__quecvt_compat_matrix[lkb->lkb_grmode+1][args->mode+1])
+- goto out;
+-
+- rv = -EBUSY;
+ if (lkb->lkb_status != DLM_LKSTS_GRANTED)
+ goto out;
+
+@@ -2884,6 +2876,14 @@ static int validate_lock_args(struct dlm
+
+ if (is_overlap(lkb))
+ goto out;
++
++ rv = -EINVAL;
++ if (lkb->lkb_flags & DLM_IFL_MSTCPY)
++ goto out;
++
++ if (args->flags & DLM_LKF_QUECVT &&
++ !__quecvt_compat_matrix[lkb->lkb_grmode+1][args->mode+1])
++ goto out;
+ }
+
+ lkb->lkb_exflags = args->flags;
--- /dev/null
+From be6e2b5734a425941fcdcdbd2a9337be498ce2cf Mon Sep 17 00:00:00 2001
+From: Andri Yngvason <andri@yngvason.is>
+Date: Wed, 7 Sep 2022 15:01:59 +0000
+Subject: HID: multitouch: Add memory barriers
+
+From: Andri Yngvason <andri@yngvason.is>
+
+commit be6e2b5734a425941fcdcdbd2a9337be498ce2cf upstream.
+
+This fixes broken atomic checks which cause a race between the
+release-timer and processing of hid input.
+
+I noticed that contacts were sometimes sticking, even with the "sticky
+fingers" quirk enabled. This fixes that problem.
+
+Cc: stable@vger.kernel.org
+Fixes: 9609827458c3 ("HID: multitouch: optimize the sticky fingers timer")
+Signed-off-by: Andri Yngvason <andri@yngvason.is>
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Link: https://lore.kernel.org/r/20220907150159.2285460-1-andri@yngvason.is
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-multitouch.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -1186,7 +1186,7 @@ static void mt_touch_report(struct hid_d
+ int contact_count = -1;
+
+ /* sticky fingers release in progress, abort */
+- if (test_and_set_bit(MT_IO_FLAGS_RUNNING, &td->mt_io_flags))
++ if (test_and_set_bit_lock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags))
+ return;
+
+ scantime = *app->scantime;
+@@ -1267,7 +1267,7 @@ static void mt_touch_report(struct hid_d
+ del_timer(&td->release_timer);
+ }
+
+- clear_bit(MT_IO_FLAGS_RUNNING, &td->mt_io_flags);
++ clear_bit_unlock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags);
+ }
+
+ static int mt_touch_input_configured(struct hid_device *hdev,
+@@ -1699,11 +1699,11 @@ static void mt_expired_timeout(struct ti
+ * An input report came in just before we release the sticky fingers,
+ * it will take care of the sticky fingers.
+ */
+- if (test_and_set_bit(MT_IO_FLAGS_RUNNING, &td->mt_io_flags))
++ if (test_and_set_bit_lock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags))
+ return;
+ if (test_bit(MT_IO_FLAGS_PENDING_SLOTS, &td->mt_io_flags))
+ mt_release_contacts(hdev);
+- clear_bit(MT_IO_FLAGS_RUNNING, &td->mt_io_flags);
++ clear_bit_unlock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags);
+ }
+
+ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
--- /dev/null
+From 7f62cf781e6567d59c8935dc8c6068ce2bb904b7 Mon Sep 17 00:00:00 2001
+From: Liang He <windhl@126.com>
+Date: Fri, 16 Sep 2022 23:47:08 +0800
+Subject: hwmon: (gsc-hwmon) Call of_node_get() before of_find_xxx API
+
+From: Liang He <windhl@126.com>
+
+commit 7f62cf781e6567d59c8935dc8c6068ce2bb904b7 upstream.
+
+In gsc_hwmon_get_devtree_pdata(), we should call of_node_get() before
+the of_find_compatible_node() which will automatically call
+of_node_put() for the 'from' argument.
+
+Fixes: 3bce5377ef66 ("hwmon: Add Gateworks System Controller support")
+Signed-off-by: Liang He <windhl@126.com>
+Co-developed-by: Mengda Chen <chenmengda2009@163.com>
+Signed-off-by: Mengda Chen <chenmengda2009@163.com>
+Link: https://lore.kernel.org/r/20220916154708.3084515-1-chenmengda2009@163.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/gsc-hwmon.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hwmon/gsc-hwmon.c
++++ b/drivers/hwmon/gsc-hwmon.c
+@@ -267,6 +267,7 @@ gsc_hwmon_get_devtree_pdata(struct devic
+ pdata->nchannels = nchannels;
+
+ /* fan controller base address */
++ of_node_get(dev->parent->of_node);
+ fan = of_find_compatible_node(dev->parent->of_node, NULL, "gw,gsc-fan");
+ if (fan && of_property_read_u32(fan, "reg", &pdata->fan_base)) {
+ of_node_put(fan);
--- /dev/null
+From 5fc4cbd9fde5d4630494fd6ffc884148fb618087 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Thu, 8 Sep 2022 11:10:32 +0200
+Subject: mbcache: Avoid nesting of cache->c_list_lock under bit locks
+
+From: Jan Kara <jack@suse.cz>
+
+commit 5fc4cbd9fde5d4630494fd6ffc884148fb618087 upstream.
+
+Commit 307af6c87937 ("mbcache: automatically delete entries from cache
+on freeing") started nesting cache->c_list_lock under the bit locks
+protecting hash buckets of the mbcache hash table in
+mb_cache_entry_create(). This causes problems for real-time kernels
+because there spinlocks are sleeping locks while bitlocks stay atomic.
+Luckily the nesting is easy to avoid by holding entry reference until
+the entry is added to the LRU list. This makes sure we cannot race with
+entry deletion.
+
+Cc: stable@kernel.org
+Fixes: 307af6c87937 ("mbcache: automatically delete entries from cache on freeing")
+Reported-by: Mike Galbraith <efault@gmx.de>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20220908091032.10513-1-jack@suse.cz
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/mbcache.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/fs/mbcache.c b/fs/mbcache.c
+index 47ccfcbe0a22..e272ad738faf 100644
+--- a/fs/mbcache.c
++++ b/fs/mbcache.c
+@@ -90,8 +90,14 @@ int mb_cache_entry_create(struct mb_cache *cache, gfp_t mask, u32 key,
+ return -ENOMEM;
+
+ INIT_LIST_HEAD(&entry->e_list);
+- /* Initial hash reference */
+- atomic_set(&entry->e_refcnt, 1);
++ /*
++ * We create entry with two references. One reference is kept by the
++ * hash table, the other reference is used to protect us from
++ * mb_cache_entry_delete_or_get() until the entry is fully setup. This
++ * avoids nesting of cache->c_list_lock into hash table bit locks which
++ * is problematic for RT.
++ */
++ atomic_set(&entry->e_refcnt, 2);
+ entry->e_key = key;
+ entry->e_value = value;
+ entry->e_reusable = reusable;
+@@ -106,15 +112,12 @@ int mb_cache_entry_create(struct mb_cache *cache, gfp_t mask, u32 key,
+ }
+ }
+ hlist_bl_add_head(&entry->e_hash_list, head);
+- /*
+- * Add entry to LRU list before it can be found by
+- * mb_cache_entry_delete() to avoid races
+- */
++ hlist_bl_unlock(head);
+ spin_lock(&cache->c_list_lock);
+ list_add_tail(&entry->e_list, &cache->c_list);
+ cache->c_entry_count++;
+ spin_unlock(&cache->c_list_lock);
+- hlist_bl_unlock(head);
++ mb_cache_entry_put(cache, entry);
+
+ return 0;
+ }
+--
+2.38.0
+
--- /dev/null
+From ff7cd07f306406493f7b78890475e85b6d0811ed Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Tue, 30 Aug 2022 18:32:46 +0300
+Subject: net: thunderbolt: Enable DMA paths only after rings are enabled
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+commit ff7cd07f306406493f7b78890475e85b6d0811ed upstream.
+
+If the other host starts sending packets early on it is possible that we
+are still in the middle of populating the initial Rx ring packets to the
+ring. This causes the tbnet_poll() to mess over the queue and causes
+list corruption. This happens specifically when connected with macOS as
+it seems start sending various IP discovery packets as soon as its side
+of the paths are configured.
+
+To prevent this we move the DMA path enabling to happen after we have
+primed the Rx ring. This makes sure no incoming packets can arrive
+before we are ready to handle them.
+
+Fixes: e69b6c02b4c3 ("net: Add support for networking over Thunderbolt cable")
+Cc: stable@vger.kernel.org
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/thunderbolt.c | 28 +++++++++++++++++-----------
+ 1 file changed, 17 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/thunderbolt.c
++++ b/drivers/net/thunderbolt.c
+@@ -612,18 +612,13 @@ static void tbnet_connected_work(struct
+ return;
+ }
+
+- /* Both logins successful so enable the high-speed DMA paths and
+- * start the network device queue.
++ /* Both logins successful so enable the rings, high-speed DMA
++ * paths and start the network device queue.
++ *
++ * Note we enable the DMA paths last to make sure we have primed
++ * the Rx ring before any incoming packets are allowed to
++ * arrive.
+ */
+- ret = tb_xdomain_enable_paths(net->xd, net->local_transmit_path,
+- net->rx_ring.ring->hop,
+- net->remote_transmit_path,
+- net->tx_ring.ring->hop);
+- if (ret) {
+- netdev_err(net->dev, "failed to enable DMA paths\n");
+- return;
+- }
+-
+ tb_ring_start(net->tx_ring.ring);
+ tb_ring_start(net->rx_ring.ring);
+
+@@ -635,10 +630,21 @@ static void tbnet_connected_work(struct
+ if (ret)
+ goto err_free_rx_buffers;
+
++ ret = tb_xdomain_enable_paths(net->xd, net->local_transmit_path,
++ net->rx_ring.ring->hop,
++ net->remote_transmit_path,
++ net->tx_ring.ring->hop);
++ if (ret) {
++ netdev_err(net->dev, "failed to enable DMA paths\n");
++ goto err_free_tx_buffers;
++ }
++
+ netif_carrier_on(net->dev);
+ netif_start_queue(net->dev);
+ return;
+
++err_free_tx_buffers:
++ tbnet_free_buffers(&net->tx_ring);
+ err_free_rx_buffers:
+ tbnet_free_buffers(&net->rx_ring);
+ err_stop_rings:
--- /dev/null
+From f74c7557ed0d321947e8bb4e9d47c1013f8b2227 Mon Sep 17 00:00:00 2001
+From: Patryk Duda <pdk@semihalf.com>
+Date: Tue, 2 Aug 2022 17:41:28 +0200
+Subject: platform/chrome: cros_ec_proto: Update version on GET_NEXT_EVENT failure
+
+From: Patryk Duda <pdk@semihalf.com>
+
+commit f74c7557ed0d321947e8bb4e9d47c1013f8b2227 upstream.
+
+Some EC based devices (e.g. Fingerpint MCU) can jump to RO part of the
+firmware (intentionally or due to device reboot). The RO part doesn't
+change during the device lifecycle, so it won't support newer version
+of EC_CMD_GET_NEXT_EVENT command.
+
+Function cros_ec_query_all() is responsible for finding maximum
+supported MKBP event version. It's usually called when the device is
+running RW part of the firmware, so the command version can be
+potentially higher than version supported by the RO.
+
+The problem was fixed by updating maximum supported version when the
+device returns EC_RES_INVALID_VERSION (mapped to -ENOPROTOOPT). That way
+the kernel will use highest common version supported by RO and RW.
+
+Fixes: 3300fdd630d4 ("platform/chrome: cros_ec: handle MKBP more events flag")
+Cc: <stable@vger.kernel.org> # 5.10+
+Reviewed-by: Guenter Roeck <groeck@chromium.org>
+Signed-off-by: Patryk Duda <pdk@semihalf.com>
+Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
+Link: https://lore.kernel.org/r/20220802154128.21175-1-pdk@semihalf.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/chrome/cros_ec_proto.c | 32 ++++++++++++++++++++++++++++++++
+ 1 file changed, 32 insertions(+)
+
+--- a/drivers/platform/chrome/cros_ec_proto.c
++++ b/drivers/platform/chrome/cros_ec_proto.c
+@@ -773,6 +773,7 @@ int cros_ec_get_next_event(struct cros_e
+ u8 event_type;
+ u32 host_event;
+ int ret;
++ u32 ver_mask;
+
+ /*
+ * Default value for wake_event.
+@@ -794,6 +795,37 @@ int cros_ec_get_next_event(struct cros_e
+ return get_keyboard_state_event(ec_dev);
+
+ ret = get_next_event(ec_dev);
++ /*
++ * -ENOPROTOOPT is returned when EC returns EC_RES_INVALID_VERSION.
++ * This can occur when EC based device (e.g. Fingerprint MCU) jumps to
++ * the RO image which doesn't support newer version of the command. In
++ * this case we will attempt to update maximum supported version of the
++ * EC_CMD_GET_NEXT_EVENT.
++ */
++ if (ret == -ENOPROTOOPT) {
++ dev_dbg(ec_dev->dev,
++ "GET_NEXT_EVENT returned invalid version error.\n");
++ ret = cros_ec_get_host_command_version_mask(ec_dev,
++ EC_CMD_GET_NEXT_EVENT,
++ &ver_mask);
++ if (ret < 0 || ver_mask == 0)
++ /*
++ * Do not change the MKBP supported version if we can't
++ * obtain supported version correctly. Please note that
++ * calling EC_CMD_GET_NEXT_EVENT returned
++ * EC_RES_INVALID_VERSION which means that the command
++ * is present.
++ */
++ return -ENOPROTOOPT;
++
++ ec_dev->mkbp_event_supported = fls(ver_mask);
++ dev_dbg(ec_dev->dev, "MKBP support version changed to %u\n",
++ ec_dev->mkbp_event_supported - 1);
++
++ /* Try to get next event with new MKBP support version set. */
++ ret = get_next_event(ec_dev);
++ }
++
+ if (ret <= 0)
+ return ret;
+
--- /dev/null
+From 6c8ea8b8cd4722efd419f91ca46a2dc81b7d89a3 Mon Sep 17 00:00:00 2001
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+Date: Fri, 23 Sep 2022 21:45:52 +0800
+Subject: quota: Check next/prev free block number after reading from quota file
+
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+
+commit 6c8ea8b8cd4722efd419f91ca46a2dc81b7d89a3 upstream.
+
+Following process:
+ Init: v2_read_file_info: <3> dqi_free_blk 0 dqi_free_entry 5 dqi_blks 6
+
+ Step 1. chown bin f_a -> dquot_acquire -> v2_write_dquot:
+ qtree_write_dquot
+ do_insert_tree
+ find_free_dqentry
+ get_free_dqblk
+ write_blk(info->dqi_blocks) // info->dqi_blocks = 6, failure. The
+ content in physical block (corresponding to blk 6) is random.
+
+ Step 2. chown root f_a -> dquot_transfer -> dqput_all -> dqput ->
+ ext4_release_dquot -> v2_release_dquot -> qtree_delete_dquot:
+ dquot_release
+ remove_tree
+ free_dqentry
+ put_free_dqblk(6)
+ info->dqi_free_blk = blk // info->dqi_free_blk = 6
+
+ Step 3. drop cache (buffer head for block 6 is released)
+
+ Step 4. chown bin f_b -> dquot_acquire -> commit_dqblk -> v2_write_dquot:
+ qtree_write_dquot
+ do_insert_tree
+ find_free_dqentry
+ get_free_dqblk
+ dh = (struct qt_disk_dqdbheader *)buf
+ blk = info->dqi_free_blk // 6
+ ret = read_blk(info, blk, buf) // The content of buf is random
+ info->dqi_free_blk = le32_to_cpu(dh->dqdh_next_free) // random blk
+
+ Step 5. chown bin f_c -> notify_change -> ext4_setattr -> dquot_transfer:
+ dquot = dqget -> acquire_dquot -> ext4_acquire_dquot -> dquot_acquire ->
+ commit_dqblk -> v2_write_dquot -> dq_insert_tree:
+ do_insert_tree
+ find_free_dqentry
+ get_free_dqblk
+ blk = info->dqi_free_blk // If blk < 0 and blk is not an error
+ code, it will be returned as dquot
+
+ transfer_to[USRQUOTA] = dquot // A random negative value
+ __dquot_transfer(transfer_to)
+ dquot_add_inodes(transfer_to[cnt])
+ spin_lock(&dquot->dq_dqb_lock) // page fault
+
+, which will lead to kernel page fault:
+ Quota error (device sda): qtree_write_dquot: Error -8000 occurred
+ while creating quota
+ BUG: unable to handle page fault for address: ffffffffffffe120
+ #PF: supervisor write access in kernel mode
+ #PF: error_code(0x0002) - not-present page
+ Oops: 0002 [#1] PREEMPT SMP
+ CPU: 0 PID: 5974 Comm: chown Not tainted 6.0.0-rc1-00004
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
+ RIP: 0010:_raw_spin_lock+0x3a/0x90
+ Call Trace:
+ dquot_add_inodes+0x28/0x270
+ __dquot_transfer+0x377/0x840
+ dquot_transfer+0xde/0x540
+ ext4_setattr+0x405/0x14d0
+ notify_change+0x68e/0x9f0
+ chown_common+0x300/0x430
+ __x64_sys_fchownat+0x29/0x40
+
+In order to avoid accessing invalid quota memory address, this patch adds
+block number checking of next/prev free block read from quota file.
+
+Fetch a reproducer in [Link].
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=216372
+Fixes: 1da177e4c3f4152 ("Linux-2.6.12-rc2")
+CC: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20220923134555.2623931-2-chengzhihao1@huawei.com
+Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/quota/quota_tree.c | 38 ++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 38 insertions(+)
+
+--- a/fs/quota/quota_tree.c
++++ b/fs/quota/quota_tree.c
+@@ -71,6 +71,35 @@ static ssize_t write_blk(struct qtree_me
+ return ret;
+ }
+
++static inline int do_check_range(struct super_block *sb, const char *val_name,
++ uint val, uint min_val, uint max_val)
++{
++ if (val < min_val || val > max_val) {
++ quota_error(sb, "Getting %s %u out of range %u-%u",
++ val_name, val, min_val, max_val);
++ return -EUCLEAN;
++ }
++
++ return 0;
++}
++
++static int check_dquot_block_header(struct qtree_mem_dqinfo *info,
++ struct qt_disk_dqdbheader *dh)
++{
++ int err = 0;
++
++ err = do_check_range(info->dqi_sb, "dqdh_next_free",
++ le32_to_cpu(dh->dqdh_next_free), 0,
++ info->dqi_blocks - 1);
++ if (err)
++ return err;
++ err = do_check_range(info->dqi_sb, "dqdh_prev_free",
++ le32_to_cpu(dh->dqdh_prev_free), 0,
++ info->dqi_blocks - 1);
++
++ return err;
++}
++
+ /* Remove empty block from list and return it */
+ static int get_free_dqblk(struct qtree_mem_dqinfo *info)
+ {
+@@ -85,6 +114,9 @@ static int get_free_dqblk(struct qtree_m
+ ret = read_blk(info, blk, buf);
+ if (ret < 0)
+ goto out_buf;
++ ret = check_dquot_block_header(info, dh);
++ if (ret)
++ goto out_buf;
+ info->dqi_free_blk = le32_to_cpu(dh->dqdh_next_free);
+ }
+ else {
+@@ -232,6 +264,9 @@ static uint find_free_dqentry(struct qtr
+ *err = read_blk(info, blk, buf);
+ if (*err < 0)
+ goto out_buf;
++ *err = check_dquot_block_header(info, dh);
++ if (*err)
++ goto out_buf;
+ } else {
+ blk = get_free_dqblk(info);
+ if ((int)blk < 0) {
+@@ -424,6 +459,9 @@ static int free_dqentry(struct qtree_mem
+ goto out_buf;
+ }
+ dh = (struct qt_disk_dqdbheader *)buf;
++ ret = check_dquot_block_header(info, dh);
++ if (ret)
++ goto out_buf;
+ le16_add_cpu(&dh->dqdh_entries, -1);
+ if (!le16_to_cpu(dh->dqdh_entries)) { /* Block got free? */
+ ret = remove_free_dqentry(info, buf, blk);
--- /dev/null
+From 8478ed5844588703a1a4c96a004b1525fbdbdd5e Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Fri, 9 Sep 2022 13:25:29 +0200
+Subject: regulator: qcom_rpm: Fix circular deferral regression
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit 8478ed5844588703a1a4c96a004b1525fbdbdd5e upstream.
+
+On recent kernels, the PM8058 L16 (or any other PM8058 LDO-regulator)
+does not come up if they are supplied by an SMPS-regulator. This
+is not very strange since the regulators are registered in a long
+array and the L-regulators are registered before the S-regulators,
+and if an L-regulator defers, it will never get around to registering
+the S-regulator that it needs.
+
+See arch/arm/boot/dts/qcom-apq8060-dragonboard.dts:
+
+pm8058-regulators {
+ (...)
+ vdd_l13_l16-supply = <&pm8058_s4>;
+ (...)
+
+Ooops.
+
+Fix this by moving the PM8058 S-regulators first in the array.
+
+Do the same for the PM8901 S-regulators (though this is currently
+not causing any problems with out device trees) so that the pattern
+of registration order is the same on all PMnnnn chips.
+
+Fixes: 087a1b5cdd55 ("regulator: qcom: Rework to single platform device")
+Cc: stable@vger.kernel.org
+Cc: Andy Gross <agross@kernel.org>
+Cc: Bjorn Andersson <andersson@kernel.org>
+Cc: Konrad Dybcio <konrad.dybcio@somainline.org>
+Cc: linux-arm-msm@vger.kernel.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20220909112529.239143-1-linus.walleij@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/regulator/qcom_rpm-regulator.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+--- a/drivers/regulator/qcom_rpm-regulator.c
++++ b/drivers/regulator/qcom_rpm-regulator.c
+@@ -802,6 +802,12 @@ static const struct rpm_regulator_data r
+ };
+
+ static const struct rpm_regulator_data rpm_pm8058_regulators[] = {
++ { "s0", QCOM_RPM_PM8058_SMPS0, &pm8058_smps, "vdd_s0" },
++ { "s1", QCOM_RPM_PM8058_SMPS1, &pm8058_smps, "vdd_s1" },
++ { "s2", QCOM_RPM_PM8058_SMPS2, &pm8058_smps, "vdd_s2" },
++ { "s3", QCOM_RPM_PM8058_SMPS3, &pm8058_smps, "vdd_s3" },
++ { "s4", QCOM_RPM_PM8058_SMPS4, &pm8058_smps, "vdd_s4" },
++
+ { "l0", QCOM_RPM_PM8058_LDO0, &pm8058_nldo, "vdd_l0_l1_lvs" },
+ { "l1", QCOM_RPM_PM8058_LDO1, &pm8058_nldo, "vdd_l0_l1_lvs" },
+ { "l2", QCOM_RPM_PM8058_LDO2, &pm8058_pldo, "vdd_l2_l11_l12" },
+@@ -829,12 +835,6 @@ static const struct rpm_regulator_data r
+ { "l24", QCOM_RPM_PM8058_LDO24, &pm8058_nldo, "vdd_l23_l24_l25" },
+ { "l25", QCOM_RPM_PM8058_LDO25, &pm8058_nldo, "vdd_l23_l24_l25" },
+
+- { "s0", QCOM_RPM_PM8058_SMPS0, &pm8058_smps, "vdd_s0" },
+- { "s1", QCOM_RPM_PM8058_SMPS1, &pm8058_smps, "vdd_s1" },
+- { "s2", QCOM_RPM_PM8058_SMPS2, &pm8058_smps, "vdd_s2" },
+- { "s3", QCOM_RPM_PM8058_SMPS3, &pm8058_smps, "vdd_s3" },
+- { "s4", QCOM_RPM_PM8058_SMPS4, &pm8058_smps, "vdd_s4" },
+-
+ { "lvs0", QCOM_RPM_PM8058_LVS0, &pm8058_switch, "vdd_l0_l1_lvs" },
+ { "lvs1", QCOM_RPM_PM8058_LVS1, &pm8058_switch, "vdd_l0_l1_lvs" },
+
+@@ -843,6 +843,12 @@ static const struct rpm_regulator_data r
+ };
+
+ static const struct rpm_regulator_data rpm_pm8901_regulators[] = {
++ { "s0", QCOM_RPM_PM8901_SMPS0, &pm8901_ftsmps, "vdd_s0" },
++ { "s1", QCOM_RPM_PM8901_SMPS1, &pm8901_ftsmps, "vdd_s1" },
++ { "s2", QCOM_RPM_PM8901_SMPS2, &pm8901_ftsmps, "vdd_s2" },
++ { "s3", QCOM_RPM_PM8901_SMPS3, &pm8901_ftsmps, "vdd_s3" },
++ { "s4", QCOM_RPM_PM8901_SMPS4, &pm8901_ftsmps, "vdd_s4" },
++
+ { "l0", QCOM_RPM_PM8901_LDO0, &pm8901_nldo, "vdd_l0" },
+ { "l1", QCOM_RPM_PM8901_LDO1, &pm8901_pldo, "vdd_l1" },
+ { "l2", QCOM_RPM_PM8901_LDO2, &pm8901_pldo, "vdd_l2" },
+@@ -851,12 +857,6 @@ static const struct rpm_regulator_data r
+ { "l5", QCOM_RPM_PM8901_LDO5, &pm8901_pldo, "vdd_l5" },
+ { "l6", QCOM_RPM_PM8901_LDO6, &pm8901_pldo, "vdd_l6" },
+
+- { "s0", QCOM_RPM_PM8901_SMPS0, &pm8901_ftsmps, "vdd_s0" },
+- { "s1", QCOM_RPM_PM8901_SMPS1, &pm8901_ftsmps, "vdd_s1" },
+- { "s2", QCOM_RPM_PM8901_SMPS2, &pm8901_ftsmps, "vdd_s2" },
+- { "s3", QCOM_RPM_PM8901_SMPS3, &pm8901_ftsmps, "vdd_s3" },
+- { "s4", QCOM_RPM_PM8901_SMPS4, &pm8901_ftsmps, "vdd_s4" },
+-
+ { "lvs0", QCOM_RPM_PM8901_LVS0, &pm8901_switch, "lvs0_in" },
+ { "lvs1", QCOM_RPM_PM8901_LVS1, &pm8901_switch, "lvs1_in" },
+ { "lvs2", QCOM_RPM_PM8901_LVS2, &pm8901_switch, "lvs2_in" },
mmc-sdhci-tegra-use-actual-clock-rate-for-sw-tuning-correction.patch
mmc-sdhci-sprd-fix-minimum-clock-limit.patch
i2c-designware-fix-handling-of-real-but-unexpected-device-interrupts.patch
+fs-dlm-fix-race-between-test_bit-and-queue_work.patch
+fs-dlm-handle-ebusy-first-in-lock-arg-validation.patch
+fs-dlm-fix-invalid-derefence-of-sb_lvbptr.patch
+btf-export-bpf_dynptr-definition.patch
+mbcache-avoid-nesting-of-cache-c_list_lock-under-bit-locks.patch
+hid-multitouch-add-memory-barriers.patch
+quota-check-next-prev-free-block-number-after-reading-from-quota-file.patch
+platform-chrome-cros_ec_proto-update-version-on-get_next_event-failure.patch
+arm64-dts-qcom-sdm845-mtp-correct-adc-settle-time.patch
+asoc-wcd9335-fix-order-of-slimbus-unprepare-disable.patch
+asoc-wcd934x-fix-order-of-slimbus-unprepare-disable.patch
+hwmon-gsc-hwmon-call-of_node_get-before-of_find_xxx-api.patch
+net-thunderbolt-enable-dma-paths-only-after-rings-are-enabled.patch
+regulator-qcom_rpm-fix-circular-deferral-regression.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
