--- /dev/null
+From ca8cf930a1071058bad0c49c7c18d2f7ae821834 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 18:36:55 +0800
+Subject: ACPI: Drop acpi_dev_irqresource_disabled()
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit 1c3f69b4543af0aad514c127298e5ea40392575d ]
+
+The functionality of acpi_dev_irqresource_disabled() is same as in common
+irqresource_disabled(), so drop acpi_dev_irqresource_disabled() in favour
+of that function.
+
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://lore.kernel.org/r/1606905417-183214-4-git-send-email-john.garry@huawei.com
+Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/resource.c | 17 +++++------------
+ 1 file changed, 5 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index f2f5f1dc7c61d..20a7892c6d3fd 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -380,13 +380,6 @@ unsigned int acpi_dev_get_irq_type(int triggering, int polarity)
+ }
+ EXPORT_SYMBOL_GPL(acpi_dev_get_irq_type);
+
+-static void acpi_dev_irqresource_disabled(struct resource *res, u32 gsi)
+-{
+- res->start = gsi;
+- res->end = gsi;
+- res->flags = IORESOURCE_IRQ | IORESOURCE_DISABLED | IORESOURCE_UNSET;
+-}
+-
+ static void acpi_dev_get_irqresource(struct resource *res, u32 gsi,
+ u8 triggering, u8 polarity, u8 shareable,
+ bool legacy)
+@@ -394,7 +387,7 @@ static void acpi_dev_get_irqresource(struct resource *res, u32 gsi,
+ int irq, p, t;
+
+ if (!valid_IRQ(gsi)) {
+- acpi_dev_irqresource_disabled(res, gsi);
++ irqresource_disabled(res, gsi);
+ return;
+ }
+
+@@ -426,7 +419,7 @@ static void acpi_dev_get_irqresource(struct resource *res, u32 gsi,
+ res->start = irq;
+ res->end = irq;
+ } else {
+- acpi_dev_irqresource_disabled(res, gsi);
++ irqresource_disabled(res, gsi);
+ }
+ }
+
+@@ -463,7 +456,7 @@ bool acpi_dev_resource_interrupt(struct acpi_resource *ares, int index,
+ */
+ irq = &ares->data.irq;
+ if (index >= irq->interrupt_count) {
+- acpi_dev_irqresource_disabled(res, 0);
++ irqresource_disabled(res, 0);
+ return false;
+ }
+ acpi_dev_get_irqresource(res, irq->interrupts[index],
+@@ -473,7 +466,7 @@ bool acpi_dev_resource_interrupt(struct acpi_resource *ares, int index,
+ case ACPI_RESOURCE_TYPE_EXTENDED_IRQ:
+ ext_irq = &ares->data.extended_irq;
+ if (index >= ext_irq->interrupt_count) {
+- acpi_dev_irqresource_disabled(res, 0);
++ irqresource_disabled(res, 0);
+ return false;
+ }
+ if (is_gsi(ext_irq))
+@@ -481,7 +474,7 @@ bool acpi_dev_resource_interrupt(struct acpi_resource *ares, int index,
+ ext_irq->triggering, ext_irq->polarity,
+ ext_irq->shareable, false);
+ else
+- acpi_dev_irqresource_disabled(res, 0);
++ irqresource_disabled(res, 0);
+ break;
+ default:
+ res->flags = 0;
+--
+2.40.1
+
--- /dev/null
+From bef17162dbd29498f2304eaa39730ecf710cbd6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Dec 2022 10:44:43 +0100
+Subject: ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 7203481fd12b1257938519efb2460ea02b9236ee ]
+
+The Asus ExpertBook B2502 has the same keyboard issue as Asus Vivobook
+K3402ZA/K3502ZA. The kernel overrides IRQ 1 to Edge_High when it
+should be Active_Low.
+
+This patch adds the ExpertBook B2502 model to the existing
+quirk list of Asus laptops with this issue.
+
+Fixes: b5f9223a105d ("ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA")
+Link: https://bugzilla.redhat.com/show_bug.cgi?id=2142574
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/resource.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index 7438e57455d17..f76147272b333 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -421,6 +421,13 @@ static const struct dmi_system_id asus_laptop[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"),
+ },
+ },
++ {
++ .ident = "Asus ExpertBook B2502",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_BOARD_NAME, "B2502CBA"),
++ },
++ },
+ { }
+ };
+
+--
+2.40.1
+
--- /dev/null
+From 514dc0b37edfe234096cccfc86551cc5dddcbdf7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Sep 2022 10:24:22 -0700
+Subject: ACPI: resource: Add ASUS model S5402ZA to quirks
+
+From: Kellen Renshaw <kellen.renshaw@canonical.com>
+
+[ Upstream commit 6e5cbe7c4b41824e500acbb42411da692d1435f1 ]
+
+The Asus Vivobook S5402ZA has the same keyboard issue as Asus Vivobook
+K3402ZA/K3502ZA. The kernel overrides IRQ 1 to Edge_High when it
+should be Active_Low.
+
+This patch adds the S5402ZA model to the quirk list.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=216158
+Tested-by: Kellen Renshaw <kellen.renshaw@canonical.com>
+Signed-off-by: Kellen Renshaw <kellen.renshaw@canonical.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/resource.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index 602c44821fb45..50ab81a333cdd 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -407,6 +407,13 @@ static const struct dmi_system_id asus_laptop[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "K3502ZA"),
+ },
+ },
++ {
++ .ident = "Asus Vivobook S5402ZA",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_BOARD_NAME, "S5402ZA"),
++ },
++ },
+ { }
+ };
+
+--
+2.40.1
+
--- /dev/null
+From 72b730cfe33c2267b137464d59d9a361e52e62a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Dec 2022 00:58:39 -0500
+Subject: ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA
+
+From: Tamim Khan <tamim@fusetak.com>
+
+[ Upstream commit 77c7248882385397cd7dffe9e1437f59f32ce2de ]
+
+Like the Asus Expertbook B2502CBA and various Asus Vivobook laptops,
+the Asus Expertbook B2402CBA has an ACPI DSDT table that describes IRQ 1
+as ActiveLow while the kernel overrides it to Edge_High. This prevents the
+keyboard from working. To fix this issue, add this laptop to the
+skip_override_table so that the kernel does not override IRQ 1.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=216864
+Tested-by: zelenat <zelenat@gmail.com>
+Signed-off-by: Tamim Khan <tamim@fusetak.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/resource.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index f76147272b333..57e8ba44df741 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -421,6 +421,13 @@ static const struct dmi_system_id asus_laptop[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"),
+ },
+ },
++ {
++ .ident = "Asus ExpertBook B2402CBA",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_BOARD_NAME, "B2402CBA"),
++ },
++ },
+ {
+ .ident = "Asus ExpertBook B2502",
+ .matches = {
+--
+2.40.1
+
--- /dev/null
+From 1d3b9f188707783927b909747accb7b96f773b45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 20:31:44 +0200
+Subject: ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA
+
+From: Paul Menzel <pmenzel@molgen.mpg.de>
+
+[ Upstream commit 05cda427126f30ce3fc8ffd82fd6f5196398d502 ]
+
+Like the ASUS ExpertBook B2502CBA and various ASUS Vivobook laptops, the
+ASUS ExpertBook B1502CBA has an ACPI DSDT table that describes IRQ 1 as
+ActiveLow while the kernel overrides it to Edge_High.
+
+ $ sudo dmesg | grep DMI
+ DMI: ASUSTeK COMPUTER INC. ASUS EXPERTBOOK B1502CBA_B1502CBA/B1502CBA, BIOS B1502CBA.300 01/18/2023
+ $ grep -A 40 PS2K dsdt.dsl | grep IRQ -A 1
+ IRQ (Level, ActiveLow, Exclusive, )
+ {1}
+
+This prevents the keyboard from working. To fix this issue, add this laptop
+to the skip_override_table so that the kernel does not override IRQ 1.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=217323
+Signed-off-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/resource.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index 57e8ba44df741..a49acf8ddacae 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -421,6 +421,13 @@ static const struct dmi_system_id asus_laptop[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"),
+ },
+ },
++ {
++ .ident = "Asus ExpertBook B1502CBA",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_BOARD_NAME, "B1502CBA"),
++ },
++ },
+ {
+ .ident = "Asus ExpertBook B2402CBA",
+ .matches = {
+--
+2.40.1
+
--- /dev/null
+From e29586c862567defe9941dfbc5d98d07e8f6971d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Sep 2023 12:08:27 +0200
+Subject: ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit c1ed72171ed580fbf159e703b77685aa4b0d0df5 ]
+
+Like various other ASUS ExpertBook-s, the ASUS ExpertBook B1402CBA
+has an ACPI DSDT table that describes IRQ 1 as ActiveLow while
+the kernel overrides it to EdgeHigh.
+
+This prevents the keyboard from working. To fix this issue, add this laptop
+to the skip_override_table so that the kernel does not override IRQ 1.
+
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217901
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/resource.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index a49acf8ddacae..bfd821173f863 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -421,6 +421,13 @@ static const struct dmi_system_id asus_laptop[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"),
+ },
+ },
++ {
++ .ident = "Asus ExpertBook B1402CBA",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_BOARD_NAME, "B1402CBA"),
++ },
++ },
+ {
+ .ident = "Asus ExpertBook B1502CBA",
+ .matches = {
+--
+2.40.1
+
--- /dev/null
+From 9f6eb6d21174fd75a158b48d0cb2930e0663693b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Aug 2022 23:04:19 -0400
+Subject: ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA
+
+From: Tamim Khan <tamim@fusetak.com>
+
+[ Upstream commit e12dee3736731e24b1e7367f87d66ac0fcd73ce7 ]
+
+In the ACPI DSDT table for Asus VivoBook K3402ZA/K3502ZA
+IRQ 1 is described as ActiveLow; however, the kernel overrides
+it to Edge_High. This prevents the internal keyboard from working
+on these laptops. In order to fix this add these laptops to the
+skip_override_table so that the kernel does not override IRQ 1 to
+Edge_High.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=216158
+Reviewed-by: Hui Wang <hui.wang@canonical.com>
+Tested-by: Tamim Khan <tamim@fusetak.com>
+Tested-by: Sunand <sunandchakradhar@gmail.com>
+Signed-off-by: Tamim Khan <tamim@fusetak.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/resource.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index bf7c2deafb0a9..602c44821fb45 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -392,6 +392,24 @@ static const struct dmi_system_id medion_laptop[] = {
+ { }
+ };
+
++static const struct dmi_system_id asus_laptop[] = {
++ {
++ .ident = "Asus Vivobook K3402ZA",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_BOARD_NAME, "K3402ZA"),
++ },
++ },
++ {
++ .ident = "Asus Vivobook K3502ZA",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_BOARD_NAME, "K3502ZA"),
++ },
++ },
++ { }
++};
++
+ struct irq_override_cmp {
+ const struct dmi_system_id *system;
+ unsigned char irq;
+@@ -402,6 +420,7 @@ struct irq_override_cmp {
+
+ static const struct irq_override_cmp skip_override_table[] = {
+ { medion_laptop, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0 },
++ { asus_laptop, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0 },
+ };
+
+ static bool acpi_dev_irq_override(u32 gsi, u8 triggering, u8 polarity,
+--
+2.40.1
+
--- /dev/null
+From 95c6a52a2311a25edda3f9dbeb6b4b39ad4a913c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Oct 2022 01:19:31 -0400
+Subject: ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA
+
+From: Tamim Khan <tamim@fusetak.com>
+
+[ Upstream commit b5f9223a105d9b56954ad1ca3eace4eaf26c99ed ]
+
+Like the Asus Vivobook K3402ZA/K3502ZA/S5402ZA Asus Vivobook S5602ZA
+has an ACPI DSDT table the describes IRQ 1 as ActiveLow while the kernel
+overrides it to Edge_High. This prevents the keyboard on this laptop
+from working. To fix this add this laptop to the skip_override_table so
+that the kernel does not override IRQ 1.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=216579
+Tested-by: Dzmitry <wrkedm@gmail.com>
+Signed-off-by: Tamim Khan <tamim@fusetak.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/resource.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index 50ab81a333cdd..7438e57455d17 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -414,6 +414,13 @@ static const struct dmi_system_id asus_laptop[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "S5402ZA"),
+ },
+ },
++ {
++ .ident = "Asus Vivobook S5602ZA",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"),
++ },
++ },
+ { }
+ };
+
+--
+2.40.1
+
--- /dev/null
+From 8508d745f7fa202fc2e5470f4c7fcaf2df7ab717 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Sep 2021 21:09:05 +0800
+Subject: ACPI: resources: Add DMI-based legacy IRQ override quirk
+
+From: Hui Wang <hui.wang@canonical.com>
+
+[ Upstream commit 892a012699fc0b91a2ed6309078936191447f480 ]
+
+After the commit 0ec4e55e9f57 ("ACPI: resources: Add checks for ACPI
+IRQ override") is reverted, the keyboard on Medion laptops can't
+work again.
+
+To fix the keyboard issue, add a DMI-based override check that will
+not affect other machines along the lines of prt_quirks[] in
+drivers/acpi/pci_irq.c.
+
+If similar issues are seen on other platforms, the quirk table could
+be expanded in the future.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=213031
+BugLink: http://bugs.launchpad.net/bugs/1909814
+Suggested-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reported-by: Manuel Krause <manuelkrause@netscape.net>
+Tested-by: Manuel Krause <manuelkrause@netscape.net>
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+[ rjw: Subject and changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/resource.c | 49 +++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 47 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index 20a7892c6d3fd..bf7c2deafb0a9 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -16,6 +16,7 @@
+ #include <linux/ioport.h>
+ #include <linux/slab.h>
+ #include <linux/irq.h>
++#include <linux/dmi.h>
+
+ #ifdef CONFIG_X86
+ #define valid_IRQ(i) (((i) != 0) && ((i) != 2))
+@@ -380,9 +381,51 @@ unsigned int acpi_dev_get_irq_type(int triggering, int polarity)
+ }
+ EXPORT_SYMBOL_GPL(acpi_dev_get_irq_type);
+
++static const struct dmi_system_id medion_laptop[] = {
++ {
++ .ident = "MEDION P15651",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "MEDION"),
++ DMI_MATCH(DMI_BOARD_NAME, "M15T"),
++ },
++ },
++ { }
++};
++
++struct irq_override_cmp {
++ const struct dmi_system_id *system;
++ unsigned char irq;
++ unsigned char triggering;
++ unsigned char polarity;
++ unsigned char shareable;
++};
++
++static const struct irq_override_cmp skip_override_table[] = {
++ { medion_laptop, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0 },
++};
++
++static bool acpi_dev_irq_override(u32 gsi, u8 triggering, u8 polarity,
++ u8 shareable)
++{
++ int i;
++
++ for (i = 0; i < ARRAY_SIZE(skip_override_table); i++) {
++ const struct irq_override_cmp *entry = &skip_override_table[i];
++
++ if (dmi_check_system(entry->system) &&
++ entry->irq == gsi &&
++ entry->triggering == triggering &&
++ entry->polarity == polarity &&
++ entry->shareable == shareable)
++ return false;
++ }
++
++ return true;
++}
++
+ static void acpi_dev_get_irqresource(struct resource *res, u32 gsi,
+ u8 triggering, u8 polarity, u8 shareable,
+- bool legacy)
++ bool check_override)
+ {
+ int irq, p, t;
+
+@@ -401,7 +444,9 @@ static void acpi_dev_get_irqresource(struct resource *res, u32 gsi,
+ * using extended IRQ descriptors we take the IRQ configuration
+ * from _CRS directly.
+ */
+- if (legacy && !acpi_get_override_irq(gsi, &t, &p)) {
++ if (check_override &&
++ acpi_dev_irq_override(gsi, triggering, polarity, shareable) &&
++ !acpi_get_override_irq(gsi, &t, &p)) {
+ u8 trig = t ? ACPI_LEVEL_SENSITIVE : ACPI_EDGE_SENSITIVE;
+ u8 pol = p ? ACPI_ACTIVE_LOW : ACPI_ACTIVE_HIGH;
+
+--
+2.40.1
+
--- /dev/null
+From d50cf49451bc1bd64fd96ec829a5517a51abf94f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Sep 2023 07:07:38 +0300
+Subject: ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for
+ mapphone
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 5ad37b5e30433afa7a5513e3eb61f69fa0976785 ]
+
+On mapphone devices we may get lots of noise on the micro-USB port in debug
+uart mode until the phy-cpcap-usb driver probes. Let's limit the noise by
+using overrun-throttle-ms.
+
+Note that there is also a related separate issue where the charger cable
+connected may cause random sysrq requests until phy-cpcap-usb probes that
+still remains.
+
+Cc: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
+Cc: Carl Philipp Klemm <philipp@uvos.xyz>
+Cc: Merlijn Wajer <merlijn@wizzup.org>
+Cc: Pavel Machek <pavel@ucw.cz>
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/motorola-mapphone-common.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/motorola-mapphone-common.dtsi b/arch/arm/boot/dts/motorola-mapphone-common.dtsi
+index 8cb26b924d3ca..f9392a135d387 100644
+--- a/arch/arm/boot/dts/motorola-mapphone-common.dtsi
++++ b/arch/arm/boot/dts/motorola-mapphone-common.dtsi
+@@ -765,6 +765,7 @@ &uart1 {
+ &uart3 {
+ interrupts-extended = <&wakeupgen GIC_SPI 74 IRQ_TYPE_LEVEL_HIGH
+ &omap4_pmx_core 0x17c>;
++ overrun-throttle-ms = <500>;
+ };
+
+ &uart4 {
+--
+2.40.1
+
--- /dev/null
+From 90dfc1decf78e57781c3b6b761d0a2223517f986 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Sep 2023 09:08:40 +0900
+Subject: ata: libata-eh: Fix compilation warning in ata_eh_link_report()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Damien Le Moal <dlemoal@kernel.org>
+
+[ Upstream commit 49728bdc702391902a473b9393f1620eea32acb0 ]
+
+The 6 bytes length of the tries_buf string in ata_eh_link_report() is
+too short and results in a gcc compilation warning with W-!:
+
+drivers/ata/libata-eh.c: In function ‘ata_eh_link_report’:
+drivers/ata/libata-eh.c:2371:59: warning: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 4 [-Wformat-truncation=]
+ 2371 | snprintf(tries_buf, sizeof(tries_buf), " t%d",
+ | ^~
+drivers/ata/libata-eh.c:2371:56: note: directive argument in the range [-2147483648, 4]
+ 2371 | snprintf(tries_buf, sizeof(tries_buf), " t%d",
+ | ^~~~~~
+drivers/ata/libata-eh.c:2371:17: note: ‘snprintf’ output between 4 and 14 bytes into a destination of size 6
+ 2371 | snprintf(tries_buf, sizeof(tries_buf), " t%d",
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ 2372 | ap->eh_tries);
+ | ~~~~~~~~~~~~~
+
+Avoid this warning by increasing the string size to 16B.
+
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-eh.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index 5fb3eda0a280b..2308c2be85a18 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -2224,7 +2224,7 @@ static void ata_eh_link_report(struct ata_link *link)
+ struct ata_eh_context *ehc = &link->eh_context;
+ struct ata_queued_cmd *qc;
+ const char *frozen, *desc;
+- char tries_buf[6] = "";
++ char tries_buf[16] = "";
+ int tag, nr_failed = 0;
+
+ if (ehc->i.flags & ATA_EHI_QUIET)
+--
+2.40.1
+
--- /dev/null
+From 2441facf78b24c97a16faba10bd43f2b68646328 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Sep 2023 04:39:34 +0000
+Subject: Bluetooth: Avoid redundant authentication
+
+From: Ying Hsu <yinghsu@chromium.org>
+
+[ Upstream commit 1d8e801422d66e4b8c7b187c52196bef94eed887 ]
+
+While executing the Android 13 CTS Verifier Secure Server test on a
+ChromeOS device, it was observed that the Bluetooth host initiates
+authentication for an RFCOMM connection after SSP completes.
+When this happens, some Intel Bluetooth controllers, like AC9560, would
+disconnect with "Connection Rejected due to Security Reasons (0x0e)".
+
+Historically, BlueZ did not mandate this authentication while an
+authenticated combination key was already in use for the connection.
+This behavior was changed since commit 7b5a9241b780
+("Bluetooth: Introduce requirements for security level 4").
+So, this patch addresses the aforementioned disconnection issue by
+restoring the previous behavior.
+
+Signed-off-by: Ying Hsu <yinghsu@chromium.org>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_conn.c | 63 ++++++++++++++++++++++------------------
+ 1 file changed, 35 insertions(+), 28 deletions(-)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index f93a5ef919d1c..a9f6089a2ae2a 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -1435,34 +1435,41 @@ int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
+ if (!test_bit(HCI_CONN_AUTH, &conn->flags))
+ goto auth;
+
+- /* An authenticated FIPS approved combination key has sufficient
+- * security for security level 4. */
+- if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
+- sec_level == BT_SECURITY_FIPS)
+- goto encrypt;
+-
+- /* An authenticated combination key has sufficient security for
+- security level 3. */
+- if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
+- conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
+- sec_level == BT_SECURITY_HIGH)
+- goto encrypt;
+-
+- /* An unauthenticated combination key has sufficient security for
+- security level 1 and 2. */
+- if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
+- conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
+- (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
+- goto encrypt;
+-
+- /* A combination key has always sufficient security for the security
+- levels 1 or 2. High security level requires the combination key
+- is generated using maximum PIN code length (16).
+- For pre 2.1 units. */
+- if (conn->key_type == HCI_LK_COMBINATION &&
+- (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
+- conn->pin_length == 16))
+- goto encrypt;
++ switch (conn->key_type) {
++ case HCI_LK_AUTH_COMBINATION_P256:
++ /* An authenticated FIPS approved combination key has
++ * sufficient security for security level 4 or lower.
++ */
++ if (sec_level <= BT_SECURITY_FIPS)
++ goto encrypt;
++ break;
++ case HCI_LK_AUTH_COMBINATION_P192:
++ /* An authenticated combination key has sufficient security for
++ * security level 3 or lower.
++ */
++ if (sec_level <= BT_SECURITY_HIGH)
++ goto encrypt;
++ break;
++ case HCI_LK_UNAUTH_COMBINATION_P192:
++ case HCI_LK_UNAUTH_COMBINATION_P256:
++ /* An unauthenticated combination key has sufficient security
++ * for security level 2 or lower.
++ */
++ if (sec_level <= BT_SECURITY_MEDIUM)
++ goto encrypt;
++ break;
++ case HCI_LK_COMBINATION:
++ /* A combination key has always sufficient security for the
++ * security levels 2 or lower. High security level requires the
++ * combination key is generated using maximum PIN code length
++ * (16). For pre 2.1 units.
++ */
++ if (sec_level <= BT_SECURITY_MEDIUM || conn->pin_length == 16)
++ goto encrypt;
++ break;
++ default:
++ break;
++ }
+
+ auth:
+ if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
+--
+2.40.1
+
--- /dev/null
+From 3df9d21fc6748c3236048c43d68826d9a7e931e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Sep 2023 14:42:27 -0700
+Subject: Bluetooth: hci_core: Fix build warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit dcda165706b9fbfd685898d46a6749d7d397e0c0 ]
+
+This fixes the following warnings:
+
+net/bluetooth/hci_core.c: In function ‘hci_register_dev’:
+net/bluetooth/hci_core.c:2620:54: warning: ‘%d’ directive output may
+be truncated writing between 1 and 10 bytes into a region of size 5
+[-Wformat-truncation=]
+ 2620 | snprintf(hdev->name, sizeof(hdev->name), "hci%d", id);
+ | ^~
+net/bluetooth/hci_core.c:2620:50: note: directive argument in the range
+[0, 2147483647]
+ 2620 | snprintf(hdev->name, sizeof(hdev->name), "hci%d", id);
+ | ^~~~~~~
+net/bluetooth/hci_core.c:2620:9: note: ‘snprintf’ output between 5 and
+14 bytes into a destination of size 8
+ 2620 | snprintf(hdev->name, sizeof(hdev->name), "hci%d", id);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/bluetooth/hci_core.h | 2 +-
+ net/bluetooth/hci_core.c | 8 +++++---
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
+index 11a92bb4d7a9f..e33433ec4a98f 100644
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -287,7 +287,7 @@ struct hci_dev {
+ struct list_head list;
+ struct mutex lock;
+
+- char name[8];
++ const char *name;
+ unsigned long flags;
+ __u16 id;
+ __u8 bus;
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 46e1e51ff28e3..e33fe4b1c4e29 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -3734,7 +3734,11 @@ int hci_register_dev(struct hci_dev *hdev)
+ if (id < 0)
+ return id;
+
+- snprintf(hdev->name, sizeof(hdev->name), "hci%d", id);
++ error = dev_set_name(&hdev->dev, "hci%u", id);
++ if (error)
++ return error;
++
++ hdev->name = dev_name(&hdev->dev);
+ hdev->id = id;
+
+ BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
+@@ -3756,8 +3760,6 @@ int hci_register_dev(struct hci_dev *hdev)
+ if (!IS_ERR_OR_NULL(bt_debugfs))
+ hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
+
+- dev_set_name(&hdev->dev, "%s", hdev->name);
+-
+ error = device_add(&hdev->dev);
+ if (error < 0)
+ goto err_wqueue;
+--
+2.40.1
+
--- /dev/null
+From a27d0fa150d2cefa0908063eceb98f2722171140 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Oct 2023 13:59:59 -0700
+Subject: Bluetooth: hci_event: Fix using memcmp when comparing keys
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit b541260615f601ae1b5d6d0cc54e790de706303b ]
+
+memcmp is not consider safe to use with cryptographic secrets:
+
+ 'Do not use memcmp() to compare security critical data, such as
+ cryptographic secrets, because the required CPU time depends on the
+ number of equal bytes.'
+
+While usage of memcmp for ZERO_KEY may not be considered a security
+critical data, it can lead to more usage of memcmp with pairing keys
+which could introduce more security problems.
+
+Fixes: 455c2ff0a558 ("Bluetooth: Fix BR/EDR out-of-band pairing with only initiator data")
+Fixes: 33155c4aae52 ("Bluetooth: hci_event: Ignore NULL link key")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_event.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index c0a2103241415..ad5294de97594 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -25,6 +25,8 @@
+ /* Bluetooth HCI event handling. */
+
+ #include <asm/unaligned.h>
++#include <linux/crypto.h>
++#include <crypto/algapi.h>
+
+ #include <net/bluetooth/bluetooth.h>
+ #include <net/bluetooth/hci_core.h>
+@@ -4076,7 +4078,7 @@ static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
+ goto unlock;
+
+ /* Ignore NULL link key against CVE-2020-26555 */
+- if (!memcmp(ev->link_key, ZERO_KEY, HCI_LINK_KEY_SIZE)) {
++ if (!crypto_memneq(ev->link_key, ZERO_KEY, HCI_LINK_KEY_SIZE)) {
+ bt_dev_dbg(hdev, "Ignore NULL link key (ZERO KEY) for %pMR",
+ &ev->bdaddr);
+ hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
+@@ -4588,8 +4590,8 @@ static u8 bredr_oob_data_present(struct hci_conn *conn)
+ * available, then do not declare that OOB data is
+ * present.
+ */
+- if (!memcmp(data->rand256, ZERO_KEY, 16) ||
+- !memcmp(data->hash256, ZERO_KEY, 16))
++ if (!crypto_memneq(data->rand256, ZERO_KEY, 16) ||
++ !crypto_memneq(data->hash256, ZERO_KEY, 16))
+ return 0x00;
+
+ return 0x02;
+@@ -4599,8 +4601,8 @@ static u8 bredr_oob_data_present(struct hci_conn *conn)
+ * not supported by the hardware, then check that if
+ * P-192 data values are present.
+ */
+- if (!memcmp(data->rand192, ZERO_KEY, 16) ||
+- !memcmp(data->hash192, ZERO_KEY, 16))
++ if (!crypto_memneq(data->rand192, ZERO_KEY, 16) ||
++ !crypto_memneq(data->hash192, ZERO_KEY, 16))
+ return 0x00;
+
+ return 0x01;
+--
+2.40.1
+
--- /dev/null
+From 314fdb22844adcbba57afa8412e30cd3eb1c80cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Sep 2023 15:47:27 -0400
+Subject: btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+[ Upstream commit 9147b9ded499d9853bdf0e9804b7eaa99c4429ed ]
+
+Jens reported the following warnings from -Wmaybe-uninitialized recent
+Linus' branch.
+
+ In file included from ./include/asm-generic/rwonce.h:26,
+ from ./arch/arm64/include/asm/rwonce.h:71,
+ from ./include/linux/compiler.h:246,
+ from ./include/linux/export.h:5,
+ from ./include/linux/linkage.h:7,
+ from ./include/linux/kernel.h:17,
+ from fs/btrfs/ioctl.c:6:
+ In function ‘instrument_copy_from_user_before’,
+ inlined from ‘_copy_from_user’ at ./include/linux/uaccess.h:148:3,
+ inlined from ‘copy_from_user’ at ./include/linux/uaccess.h:183:7,
+ inlined from ‘btrfs_ioctl_space_info’ at fs/btrfs/ioctl.c:2999:6,
+ inlined from ‘btrfs_ioctl’ at fs/btrfs/ioctl.c:4616:10:
+ ./include/linux/kasan-checks.h:38:27: warning: ‘space_args’ may be used
+ uninitialized [-Wmaybe-uninitialized]
+ 38 | #define kasan_check_write __kasan_check_write
+ ./include/linux/instrumented.h:129:9: note: in expansion of macro
+ ‘kasan_check_write’
+ 129 | kasan_check_write(to, n);
+ | ^~~~~~~~~~~~~~~~~
+ ./include/linux/kasan-checks.h: In function ‘btrfs_ioctl’:
+ ./include/linux/kasan-checks.h:20:6: note: by argument 1 of type ‘const
+ volatile void *’ to ‘__kasan_check_write’ declared here
+ 20 | bool __kasan_check_write(const volatile void *p, unsigned int
+ size);
+ | ^~~~~~~~~~~~~~~~~~~
+ fs/btrfs/ioctl.c:2981:39: note: ‘space_args’ declared here
+ 2981 | struct btrfs_ioctl_space_args space_args;
+ | ^~~~~~~~~~
+ In function ‘instrument_copy_from_user_before’,
+ inlined from ‘_copy_from_user’ at ./include/linux/uaccess.h:148:3,
+ inlined from ‘copy_from_user’ at ./include/linux/uaccess.h:183:7,
+ inlined from ‘_btrfs_ioctl_send’ at fs/btrfs/ioctl.c:4343:9,
+ inlined from ‘btrfs_ioctl’ at fs/btrfs/ioctl.c:4658:10:
+ ./include/linux/kasan-checks.h:38:27: warning: ‘args32’ may be used
+ uninitialized [-Wmaybe-uninitialized]
+ 38 | #define kasan_check_write __kasan_check_write
+ ./include/linux/instrumented.h:129:9: note: in expansion of macro
+ ‘kasan_check_write’
+ 129 | kasan_check_write(to, n);
+ | ^~~~~~~~~~~~~~~~~
+ ./include/linux/kasan-checks.h: In function ‘btrfs_ioctl’:
+ ./include/linux/kasan-checks.h:20:6: note: by argument 1 of type ‘const
+ volatile void *’ to ‘__kasan_check_write’ declared here
+ 20 | bool __kasan_check_write(const volatile void *p, unsigned int
+ size);
+ | ^~~~~~~~~~~~~~~~~~~
+ fs/btrfs/ioctl.c:4341:49: note: ‘args32’ declared here
+ 4341 | struct btrfs_ioctl_send_args_32 args32;
+ | ^~~~~~
+
+This was due to his config options and having KASAN turned on,
+which adds some extra checks around copy_from_user(), which then
+triggered the -Wmaybe-uninitialized checker for these cases.
+
+Fix the warnings by initializing the different structs we're copying
+into.
+
+Reported-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/ioctl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 930126b094add..cffd149faf639 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -3518,7 +3518,7 @@ static void get_block_group_info(struct list_head *groups_list,
+ static long btrfs_ioctl_space_info(struct btrfs_fs_info *fs_info,
+ void __user *arg)
+ {
+- struct btrfs_ioctl_space_args space_args;
++ struct btrfs_ioctl_space_args space_args = { 0 };
+ struct btrfs_ioctl_space_info space;
+ struct btrfs_ioctl_space_info *dest;
+ struct btrfs_ioctl_space_info *dest_orig;
+@@ -4858,7 +4858,7 @@ static int _btrfs_ioctl_send(struct file *file, void __user *argp, bool compat)
+
+ if (compat) {
+ #if defined(CONFIG_64BIT) && defined(CONFIG_COMPAT)
+- struct btrfs_ioctl_send_args_32 args32;
++ struct btrfs_ioctl_send_args_32 args32 = { 0 };
+
+ ret = copy_from_user(&args32, argp, sizeof(args32));
+ if (ret)
+--
+2.40.1
+
--- /dev/null
+From 6b58a8e22106e310c2c8f9c4f5cb164b986be8c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Sep 2023 12:15:24 -0400
+Subject: btrfs: initialize start_slot in btrfs_log_prealloc_extents
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+[ Upstream commit b4c639f699349880b7918b861e1bd360442ec450 ]
+
+Jens reported a compiler warning when using
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y that looks like this
+
+ fs/btrfs/tree-log.c: In function ‘btrfs_log_prealloc_extents’:
+ fs/btrfs/tree-log.c:4828:23: warning: ‘start_slot’ may be used
+ uninitialized [-Wmaybe-uninitialized]
+ 4828 | ret = copy_items(trans, inode, dst_path, path,
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ 4829 | start_slot, ins_nr, 1, 0);
+ | ~~~~~~~~~~~~~~~~~~~~~~~~~
+ fs/btrfs/tree-log.c:4725:13: note: ‘start_slot’ was declared here
+ 4725 | int start_slot;
+ | ^~~~~~~~~~
+
+The compiler is incorrect, as we only use this code when ins_len > 0,
+and when ins_len > 0 we have start_slot properly initialized. However
+we generally find the -Wmaybe-uninitialized warnings valuable, so
+initialize start_slot to get rid of the warning.
+
+Reported-by: Jens Axboe <axboe@kernel.dk>
+Tested-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/tree-log.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 9a8dc16673b43..10a0913ffb492 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -4337,7 +4337,7 @@ static int btrfs_log_prealloc_extents(struct btrfs_trans_handle *trans,
+ struct extent_buffer *leaf;
+ int slot;
+ int ins_nr = 0;
+- int start_slot;
++ int start_slot = 0;
+ int ret;
+
+ if (!(inode->flags & BTRFS_INODE_PREALLOC))
+--
+2.40.1
+
--- /dev/null
+From 7bae9cfdb56b314816bfd6c9e09dd52f48704b75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Sep 2023 18:20:23 +0100
+Subject: btrfs: return -EUCLEAN for delayed tree ref with a ref count not
+ equals to 1
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit 1bf76df3fee56d6637718e267f7c34ed70d0c7dc ]
+
+When running a delayed tree reference, if we find a ref count different
+from 1, we return -EIO. This isn't an IO error, as it indicates either a
+bug in the delayed refs code or a memory corruption, so change the error
+code from -EIO to -EUCLEAN. Also tag the branch as 'unlikely' as this is
+not expected to ever happen, and change the error message to print the
+tree block's bytenr without the parenthesis (and there was a missing space
+between the 'block' word and the opening parenthesis), for consistency as
+that's the style we used everywhere else.
+
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/extent-tree.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 4d2f25ebe3048..8f62e171053ba 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -1641,12 +1641,12 @@ static int run_delayed_tree_ref(struct btrfs_trans_handle *trans,
+ parent = ref->parent;
+ ref_root = ref->root;
+
+- if (node->ref_mod != 1) {
++ if (unlikely(node->ref_mod != 1)) {
+ btrfs_err(trans->fs_info,
+- "btree block(%llu) has %d references rather than 1: action %d ref_root %llu parent %llu",
++ "btree block %llu has %d references rather than 1: action %d ref_root %llu parent %llu",
+ node->bytenr, node->ref_mod, node->action, ref_root,
+ parent);
+- return -EIO;
++ return -EUCLEAN;
+ }
+ if (node->action == BTRFS_ADD_DELAYED_REF && insert_reserved) {
+ BUG_ON(!extent_op || !extent_op->update_flags);
+--
+2.40.1
+
--- /dev/null
+From f3c6ddf98c955edc473ef9cd768b728fb5c73d74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Sep 2023 13:04:33 -0400
+Subject: drm/amd/display: Don't set dpms_off for seamless boot
+
+From: Daniel Miess <daniel.miess@amd.com>
+
+[ Upstream commit 23645bca98304a2772f0de96f97370dd567d0ae6 ]
+
+[Why]
+eDPs fail to light up with seamless boot enabled
+
+[How]
+When seamless boot is enabled don't configure dpms_off
+in disable_vbios_mode_if_required.
+
+Reviewed-by: Charlene Liu <charlene.liu@amd.com>
+Cc: Mario Limonciello <mario.limonciello@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Acked-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Daniel Miess <daniel.miess@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index 9cf287124fe4c..36a9e9c84ed44 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -862,6 +862,9 @@ static void disable_vbios_mode_if_required(
+ if (stream == NULL)
+ continue;
+
++ if (stream->apply_seamless_boot_optimization)
++ continue;
++
+ // only looking for first odm pipe
+ if (pipe->prev_odm_pipe)
+ continue;
+--
+2.40.1
+
--- /dev/null
+From e2621e6309c29084cf06ef102feedf10d35f6212 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Oct 2020 09:25:05 -0400
+Subject: drm/amd/display: only check available pipe to disable vbios mode.
+
+From: Yongqiang Sun <yongqiang.sun@amd.com>
+
+[ Upstream commit 850d2fcf3e346a35e4e59e310b867e90e3ef8e5a ]
+
+[Why & How]
+1. only need to check first ODM pipe.
+2. Only need to check eDP which is on.
+
+Signed-off-by: Yongqiang Sun <yongqiang.sun@amd.com>
+Reviewed-by: Tony Cheng <Tony.Cheng@amd.com>
+Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 23645bca9830 ("drm/amd/display: Don't set dpms_off for seamless boot")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index 099542dd31544..9cf287124fe4c 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -862,12 +862,16 @@ static void disable_vbios_mode_if_required(
+ if (stream == NULL)
+ continue;
+
++ // only looking for first odm pipe
++ if (pipe->prev_odm_pipe)
++ continue;
++
+ if (stream->link->local_sink &&
+ stream->link->local_sink->sink_signal == SIGNAL_TYPE_EDP) {
+ link = stream->link;
+ }
+
+- if (link != NULL) {
++ if (link != NULL && link->link_enc->funcs->is_dig_enabled(link->link_enc)) {
+ unsigned int enc_inst, tg_inst = 0;
+ unsigned int pix_clk_100hz;
+
+--
+2.40.1
+
--- /dev/null
+From 89758f7eada498f675047493f08cd0a89726433d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 23:51:55 +0200
+Subject: drm/connector: Add a fwnode pointer to drm_connector and register
+ with ACPI (v2)
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 48c429c6d18db115c277b75000152d8fa4cd35d0 ]
+
+Add a fwnode pointer to struct drm_connector and register an acpi_bus_type
+for the connectors with the ACPI subsystem (when CONFIG_ACPI is enabled).
+
+The adding of the fwnode pointer allows drivers to associate a fwnode
+that represents a connector with that connector.
+
+When the new fwnode pointer points to an ACPI-companion, then the new
+acpi_bus_type will cause the ACPI subsys to bind the device instantiated
+for the connector with the fwnode by calling acpi_bind_one(). This will
+result in a firmware_node symlink under /sys/class/card#-<connecter-name>/
+which helps to verify that the fwnode-s and connectors are properly
+matched.
+
+Changes in v2:
+- Make drm_connector_cleanup() call fwnode_handle_put() on
+ connector->fwnode and document this
+
+Co-developed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Tested-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Link: https://lore.kernel.org/r/20210817215201.795062-3-hdegoede@redhat.com
+Stable-dep-of: 89434b069e46 ("usb: typec: altmodes/displayport: Signal hpd low when exiting mode")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_connector.c | 2 ++
+ drivers/gpu/drm/drm_sysfs.c | 37 +++++++++++++++++++++++++++++++++
+ include/drm/drm_connector.h | 8 +++++++
+ 3 files changed, 47 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
+index 9c3bbe2c3e6f9..c08501a5620d5 100644
+--- a/drivers/gpu/drm/drm_connector.c
++++ b/drivers/gpu/drm/drm_connector.c
+@@ -471,6 +471,8 @@ void drm_connector_cleanup(struct drm_connector *connector)
+ drm_mode_object_unregister(dev, &connector->base);
+ kfree(connector->name);
+ connector->name = NULL;
++ fwnode_handle_put(connector->fwnode);
++ connector->fwnode = NULL;
+ spin_lock_irq(&dev->mode_config.connector_list_lock);
+ list_del(&connector->head);
+ dev->mode_config.num_connector--;
+diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
+index a3b71478c5904..71a0d9596efee 100644
+--- a/drivers/gpu/drm/drm_sysfs.c
++++ b/drivers/gpu/drm/drm_sysfs.c
+@@ -10,6 +10,7 @@
+ * Copyright (c) 2003-2004 IBM Corp.
+ */
+
++#include <linux/acpi.h>
+ #include <linux/device.h>
+ #include <linux/err.h>
+ #include <linux/export.h>
+@@ -56,6 +57,39 @@ static struct device_type drm_sysfs_device_connector = {
+
+ struct class *drm_class;
+
++#ifdef CONFIG_ACPI
++static bool drm_connector_acpi_bus_match(struct device *dev)
++{
++ return dev->type == &drm_sysfs_device_connector;
++}
++
++static struct acpi_device *drm_connector_acpi_find_companion(struct device *dev)
++{
++ struct drm_connector *connector = to_drm_connector(dev);
++
++ return to_acpi_device_node(connector->fwnode);
++}
++
++static struct acpi_bus_type drm_connector_acpi_bus = {
++ .name = "drm_connector",
++ .match = drm_connector_acpi_bus_match,
++ .find_companion = drm_connector_acpi_find_companion,
++};
++
++static void drm_sysfs_acpi_register(void)
++{
++ register_acpi_bus_type(&drm_connector_acpi_bus);
++}
++
++static void drm_sysfs_acpi_unregister(void)
++{
++ unregister_acpi_bus_type(&drm_connector_acpi_bus);
++}
++#else
++static void drm_sysfs_acpi_register(void) { }
++static void drm_sysfs_acpi_unregister(void) { }
++#endif
++
+ static char *drm_devnode(struct device *dev, umode_t *mode)
+ {
+ return kasprintf(GFP_KERNEL, "dri/%s", dev_name(dev));
+@@ -89,6 +123,8 @@ int drm_sysfs_init(void)
+ }
+
+ drm_class->devnode = drm_devnode;
++
++ drm_sysfs_acpi_register();
+ return 0;
+ }
+
+@@ -101,6 +137,7 @@ void drm_sysfs_destroy(void)
+ {
+ if (IS_ERR_OR_NULL(drm_class))
+ return;
++ drm_sysfs_acpi_unregister();
+ class_remove_file(drm_class, &class_attr_version.attr);
+ class_destroy(drm_class);
+ drm_class = NULL;
+diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
+index 928136556174c..ffad68f775cc6 100644
+--- a/include/drm/drm_connector.h
++++ b/include/drm/drm_connector.h
+@@ -1174,6 +1174,14 @@ struct drm_connector {
+ struct device *kdev;
+ /** @attr: sysfs attributes */
+ struct device_attribute *attr;
++ /**
++ * @fwnode: associated fwnode supplied by platform firmware
++ *
++ * Drivers can set this to associate a fwnode with a connector, drivers
++ * are expected to get a reference on the fwnode when setting this.
++ * drm_connector_cleanup() will call fwnode_handle_put() on this.
++ */
++ struct fwnode_handle *fwnode;
+
+ /**
+ * @head:
+--
+2.40.1
+
--- /dev/null
+From ee97bc5579307c3cea27ef572d6bcb93852547ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 23:51:56 +0200
+Subject: drm/connector: Add drm_connector_find_by_fwnode() function (v3)
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 3d3f7c1e68691574c1d87cd0f9f2348323bc0199 ]
+
+Add a function to find a connector based on a fwnode.
+
+This will be used by the new drm_connector_oob_hotplug_event()
+function which is added by the next patch in this patch-set.
+
+Changes in v2:
+- Complete rewrite to use a global connector list in drm_connector.c
+ rather then using a class-dev-iter in drm_sysfs.c
+
+Changes in v3:
+- Add forward declaration for struct fwnode_handle to drm_crtc_internal.h
+ (fixes warning reported by kernel test robot <lkp@intel.com>)
+
+Tested-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Link: https://lore.kernel.org/r/20210817215201.795062-4-hdegoede@redhat.com
+Stable-dep-of: 89434b069e46 ("usb: typec: altmodes/displayport: Signal hpd low when exiting mode")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_connector.c | 50 +++++++++++++++++++++++++++++
+ drivers/gpu/drm/drm_crtc_internal.h | 2 ++
+ include/drm/drm_connector.h | 8 +++++
+ 3 files changed, 60 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
+index c08501a5620d5..fc06f73acd3c9 100644
+--- a/drivers/gpu/drm/drm_connector.c
++++ b/drivers/gpu/drm/drm_connector.c
+@@ -64,6 +64,14 @@
+ * support can instead use e.g. drm_helper_hpd_irq_event().
+ */
+
++/*
++ * Global connector list for drm_connector_find_by_fwnode().
++ * Note drm_connector_[un]register() first take connector->lock and then
++ * take the connector_list_lock.
++ */
++static DEFINE_MUTEX(connector_list_lock);
++static LIST_HEAD(connector_list);
++
+ struct drm_conn_prop_enum_list {
+ int type;
+ const char *name;
+@@ -265,6 +273,7 @@ int drm_connector_init(struct drm_device *dev,
+ goto out_put_type_id;
+ }
+
++ INIT_LIST_HEAD(&connector->global_connector_list_entry);
+ INIT_LIST_HEAD(&connector->probed_modes);
+ INIT_LIST_HEAD(&connector->modes);
+ mutex_init(&connector->mutex);
+@@ -534,6 +543,9 @@ int drm_connector_register(struct drm_connector *connector)
+ /* Let userspace know we have a new connector */
+ drm_sysfs_hotplug_event(connector->dev);
+
++ mutex_lock(&connector_list_lock);
++ list_add_tail(&connector->global_connector_list_entry, &connector_list);
++ mutex_unlock(&connector_list_lock);
+ goto unlock;
+
+ err_debugfs:
+@@ -562,6 +574,10 @@ void drm_connector_unregister(struct drm_connector *connector)
+ return;
+ }
+
++ mutex_lock(&connector_list_lock);
++ list_del_init(&connector->global_connector_list_entry);
++ mutex_unlock(&connector_list_lock);
++
+ if (connector->funcs->early_unregister)
+ connector->funcs->early_unregister(connector);
+
+@@ -2464,6 +2480,40 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
+ return ret;
+ }
+
++/**
++ * drm_connector_find_by_fwnode - Find a connector based on the associated fwnode
++ * @fwnode: fwnode for which to find the matching drm_connector
++ *
++ * This functions looks up a drm_connector based on its associated fwnode. When
++ * a connector is found a reference to the connector is returned. The caller must
++ * call drm_connector_put() to release this reference when it is done with the
++ * connector.
++ *
++ * Returns: A reference to the found connector or an ERR_PTR().
++ */
++struct drm_connector *drm_connector_find_by_fwnode(struct fwnode_handle *fwnode)
++{
++ struct drm_connector *connector, *found = ERR_PTR(-ENODEV);
++
++ if (!fwnode)
++ return ERR_PTR(-ENODEV);
++
++ mutex_lock(&connector_list_lock);
++
++ list_for_each_entry(connector, &connector_list, global_connector_list_entry) {
++ if (connector->fwnode == fwnode ||
++ (connector->fwnode && connector->fwnode->secondary == fwnode)) {
++ drm_connector_get(connector);
++ found = connector;
++ break;
++ }
++ }
++
++ mutex_unlock(&connector_list_lock);
++
++ return found;
++}
++
+
+ /**
+ * DOC: Tile group
+diff --git a/drivers/gpu/drm/drm_crtc_internal.h b/drivers/gpu/drm/drm_crtc_internal.h
+index da96b2f64d7e4..c3577eaee4164 100644
+--- a/drivers/gpu/drm/drm_crtc_internal.h
++++ b/drivers/gpu/drm/drm_crtc_internal.h
+@@ -57,6 +57,7 @@ struct drm_property;
+ struct edid;
+ struct kref;
+ struct work_struct;
++struct fwnode_handle;
+
+ /* drm_crtc.c */
+ int drm_mode_crtc_set_obj_prop(struct drm_mode_object *obj,
+@@ -182,6 +183,7 @@ int drm_connector_set_obj_prop(struct drm_mode_object *obj,
+ int drm_connector_create_standard_properties(struct drm_device *dev);
+ const char *drm_get_connector_force_name(enum drm_connector_force force);
+ void drm_connector_free_work_fn(struct work_struct *work);
++struct drm_connector *drm_connector_find_by_fwnode(struct fwnode_handle *fwnode);
+
+ /* IOCTL */
+ int drm_connector_property_set_ioctl(struct drm_device *dev,
+diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
+index ffad68f775cc6..d6c7554f1d405 100644
+--- a/include/drm/drm_connector.h
++++ b/include/drm/drm_connector.h
+@@ -1193,6 +1193,14 @@ struct drm_connector {
+ */
+ struct list_head head;
+
++ /**
++ * @global_connector_list_entry:
++ *
++ * Connector entry in the global connector-list, used by
++ * drm_connector_find_by_fwnode().
++ */
++ struct list_head global_connector_list_entry;
++
+ /** @base: base KMS object */
+ struct drm_mode_object base;
+
+--
+2.40.1
+
--- /dev/null
+From c05bb8f58c3106f103cfa2802681dda339e876f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 23:51:57 +0200
+Subject: drm/connector: Add support for out-of-band hotplug notification (v3)
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 72ad49682dde3d9de5708b8699dc8e0b44962322 ]
+
+Add a new drm_connector_oob_hotplug_event() function and
+oob_hotplug_event drm_connector_funcs member.
+
+On some hardware a hotplug event notification may come from outside the
+display driver / device. An example of this is some USB Type-C setups
+where the hardware muxes the DisplayPort data and aux-lines but does
+not pass the altmode HPD status bit to the GPU's DP HPD pin.
+
+In cases like this the new drm_connector_oob_hotplug_event() function can
+be used to report these out-of-band events.
+
+Changes in v2:
+- Make drm_connector_oob_hotplug_event() take a fwnode as argument and
+ have it call drm_connector_find_by_fwnode() internally. This allows
+ making drm_connector_find_by_fwnode() a drm-internal function and
+ avoids code outside the drm subsystem potentially holding on the
+ a drm_connector reference for a longer period.
+
+Changes in v3:
+- Drop the data argument to the drm_connector_oob_hotplug_event
+ function since it is not used atm. This can be re-added later when
+ a use for it actually arises.
+
+Tested-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Link: https://lore.kernel.org/r/20210817215201.795062-5-hdegoede@redhat.com
+Stable-dep-of: 89434b069e46 ("usb: typec: altmodes/displayport: Signal hpd low when exiting mode")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_connector.c | 27 +++++++++++++++++++++++++++
+ include/drm/drm_connector.h | 9 +++++++++
+ 2 files changed, 36 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
+index fc06f73acd3c9..c4ed4f1b369c1 100644
+--- a/drivers/gpu/drm/drm_connector.c
++++ b/drivers/gpu/drm/drm_connector.c
+@@ -2514,6 +2514,33 @@ struct drm_connector *drm_connector_find_by_fwnode(struct fwnode_handle *fwnode)
+ return found;
+ }
+
++/**
++ * drm_connector_oob_hotplug_event - Report out-of-band hotplug event to connector
++ * @connector: connector to report the event on
++ *
++ * On some hardware a hotplug event notification may come from outside the display
++ * driver / device. An example of this is some USB Type-C setups where the hardware
++ * muxes the DisplayPort data and aux-lines but does not pass the altmode HPD
++ * status bit to the GPU's DP HPD pin.
++ *
++ * This function can be used to report these out-of-band events after obtaining
++ * a drm_connector reference through calling drm_connector_find_by_fwnode().
++ */
++void drm_connector_oob_hotplug_event(struct fwnode_handle *connector_fwnode)
++{
++ struct drm_connector *connector;
++
++ connector = drm_connector_find_by_fwnode(connector_fwnode);
++ if (IS_ERR(connector))
++ return;
++
++ if (connector->funcs->oob_hotplug_event)
++ connector->funcs->oob_hotplug_event(connector);
++
++ drm_connector_put(connector);
++}
++EXPORT_SYMBOL(drm_connector_oob_hotplug_event);
++
+
+ /**
+ * DOC: Tile group
+diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
+index d6c7554f1d405..03d39532c7080 100644
+--- a/include/drm/drm_connector.h
++++ b/include/drm/drm_connector.h
+@@ -1030,6 +1030,14 @@ struct drm_connector_funcs {
+ */
+ void (*atomic_print_state)(struct drm_printer *p,
+ const struct drm_connector_state *state);
++
++ /**
++ * @oob_hotplug_event:
++ *
++ * This will get called when a hotplug-event for a drm-connector
++ * has been received from a source outside the display driver / device.
++ */
++ void (*oob_hotplug_event)(struct drm_connector *connector);
+ };
+
+ /**
+@@ -1612,6 +1620,7 @@ drm_connector_is_unregistered(struct drm_connector *connector)
+ DRM_CONNECTOR_UNREGISTERED;
+ }
+
++void drm_connector_oob_hotplug_event(struct fwnode_handle *connector_fwnode);
+ const char *drm_get_connector_type_name(unsigned int connector_type);
+ const char *drm_get_connector_status_name(enum drm_connector_status status);
+ const char *drm_get_subpixel_order_name(enum subpixel_order order);
+--
+2.40.1
+
--- /dev/null
+From 63aff345d021306fbb5e3d94ec6e261293e1a38b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 23:51:54 +0200
+Subject: drm/connector: Give connector sysfs devices there own device_type
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 331de7db3012b8e8e8d77beebc8f743e288d4c42 ]
+
+Give connector sysfs devices there own device_type, this allows us to
+check if a device passed to functions dealing with generic devices is
+a drm_connector or not.
+
+A check like this is necessary in the drm_connector_acpi_bus_match()
+function added in the next patch in this series.
+
+Tested-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Link: https://lore.kernel.org/r/20210817215201.795062-2-hdegoede@redhat.com
+Stable-dep-of: 89434b069e46 ("usb: typec: altmodes/displayport: Signal hpd low when exiting mode")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_sysfs.c | 50 +++++++++++++++++++++++++++----------
+ 1 file changed, 37 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
+index f0336c8046392..a3b71478c5904 100644
+--- a/drivers/gpu/drm/drm_sysfs.c
++++ b/drivers/gpu/drm/drm_sysfs.c
+@@ -50,6 +50,10 @@ static struct device_type drm_sysfs_device_minor = {
+ .name = "drm_minor"
+ };
+
++static struct device_type drm_sysfs_device_connector = {
++ .name = "drm_connector",
++};
++
+ struct class *drm_class;
+
+ static char *drm_devnode(struct device *dev, umode_t *mode)
+@@ -102,6 +106,11 @@ void drm_sysfs_destroy(void)
+ drm_class = NULL;
+ }
+
++static void drm_sysfs_release(struct device *dev)
++{
++ kfree(dev);
++}
++
+ /*
+ * Connector properties
+ */
+@@ -274,27 +283,47 @@ static const struct attribute_group *connector_dev_groups[] = {
+ int drm_sysfs_connector_add(struct drm_connector *connector)
+ {
+ struct drm_device *dev = connector->dev;
++ struct device *kdev;
++ int r;
+
+ if (connector->kdev)
+ return 0;
+
+- connector->kdev =
+- device_create_with_groups(drm_class, dev->primary->kdev, 0,
+- connector, connector_dev_groups,
+- "card%d-%s", dev->primary->index,
+- connector->name);
++ kdev = kzalloc(sizeof(*kdev), GFP_KERNEL);
++ if (!kdev)
++ return -ENOMEM;
++
++ device_initialize(kdev);
++ kdev->class = drm_class;
++ kdev->type = &drm_sysfs_device_connector;
++ kdev->parent = dev->primary->kdev;
++ kdev->groups = connector_dev_groups;
++ kdev->release = drm_sysfs_release;
++ dev_set_drvdata(kdev, connector);
++
++ r = dev_set_name(kdev, "card%d-%s", dev->primary->index, connector->name);
++ if (r)
++ goto err_free;
++
+ DRM_DEBUG("adding \"%s\" to sysfs\n",
+ connector->name);
+
+- if (IS_ERR(connector->kdev)) {
+- DRM_ERROR("failed to register connector device: %ld\n", PTR_ERR(connector->kdev));
+- return PTR_ERR(connector->kdev);
++ r = device_add(kdev);
++ if (r) {
++ drm_err(dev, "failed to register connector device: %d\n", r);
++ goto err_free;
+ }
+
++ connector->kdev = kdev;
++
+ if (connector->ddc)
+ return sysfs_create_link(&connector->kdev->kobj,
+ &connector->ddc->dev.kobj, "ddc");
+ return 0;
++
++err_free:
++ put_device(kdev);
++ return r;
+ }
+
+ void drm_sysfs_connector_remove(struct drm_connector *connector)
+@@ -375,11 +404,6 @@ void drm_sysfs_connector_status_event(struct drm_connector *connector,
+ }
+ EXPORT_SYMBOL(drm_sysfs_connector_status_event);
+
+-static void drm_sysfs_release(struct device *dev)
+-{
+- kfree(dev);
+-}
+-
+ struct device *drm_sysfs_minor_alloc(struct drm_minor *minor)
+ {
+ const char *minor_str;
+--
+2.40.1
+
--- /dev/null
+From 4908eeb6b219ce971c12ef6ed0779e5e1dfe4c9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Oct 2023 13:47:10 +0200
+Subject: drm: panel-orientation-quirks: Add quirk for One Mix 2S
+
+From: Kai Uwe Broulik <foss-linux@broulik.de>
+
+[ Upstream commit cbb7eb2dbd9472816e42a1b0fdb51af49abbf812 ]
+
+The One Mix 2S is a mini laptop with a 1200x1920 portrait screen
+mounted in a landscape oriented clamshell case. Because of the too
+generic DMI strings this entry is also doing bios-date matching.
+
+Signed-off-by: Kai Uwe Broulik <foss-linux@broulik.de>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231001114710.336172-1-foss-linux@broulik.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_panel_orientation_quirks.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index 6106fa7c43028..43de9dfcba19a 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -44,6 +44,14 @@ static const struct drm_dmi_panel_orientation_data gpd_micropc = {
+ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
+ };
+
++static const struct drm_dmi_panel_orientation_data gpd_onemix2s = {
++ .width = 1200,
++ .height = 1920,
++ .bios_dates = (const char * const []){ "05/21/2018", "10/26/2018",
++ "03/04/2019", NULL },
++ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
++};
++
+ static const struct drm_dmi_panel_orientation_data gpd_pocket = {
+ .width = 1200,
+ .height = 1920,
+@@ -329,6 +337,14 @@ static const struct dmi_system_id orientation_data[] = {
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "LTH17"),
+ },
+ .driver_data = (void *)&lcd800x1280_rightside_up,
++ }, { /* One Mix 2S (generic strings, also match on bios date) */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Default string"),
++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Default string"),
++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"),
++ },
++ .driver_data = (void *)&gpd_onemix2s,
+ },
+ {}
+ };
+--
+2.40.1
+
--- /dev/null
+From a79e12459eb1ada5277ad4ef2d106eca2229c50c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Sep 2023 10:29:14 +0000
+Subject: gpio: timberdale: Fix potential deadlock on &tgpio->lock
+
+From: Chengfeng Ye <dg573847474@gmail.com>
+
+[ Upstream commit 9e8bc2dda5a7a8e2babc9975f4b11c9a6196e490 ]
+
+As timbgpio_irq_enable()/timbgpio_irq_disable() callback could be
+executed under irq context, it could introduce double locks on
+&tgpio->lock if it preempts other execution units requiring
+the same locks.
+
+timbgpio_gpio_set()
+--> timbgpio_update_bit()
+--> spin_lock(&tgpio->lock)
+<interrupt>
+ --> timbgpio_irq_disable()
+ --> spin_lock_irqsave(&tgpio->lock)
+
+This flaw was found by an experimental static analysis tool I am
+developing for irq-related deadlock.
+
+To prevent the potential deadlock, the patch uses spin_lock_irqsave()
+on &tgpio->lock inside timbgpio_gpio_set() to prevent the possible
+deadlock scenario.
+
+Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-timberdale.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpio-timberdale.c b/drivers/gpio/gpio-timberdale.c
+index de14949a3fe5a..92c1f2baa4bff 100644
+--- a/drivers/gpio/gpio-timberdale.c
++++ b/drivers/gpio/gpio-timberdale.c
+@@ -43,9 +43,10 @@ static int timbgpio_update_bit(struct gpio_chip *gpio, unsigned index,
+ unsigned offset, bool enabled)
+ {
+ struct timbgpio *tgpio = gpiochip_get_data(gpio);
++ unsigned long flags;
+ u32 reg;
+
+- spin_lock(&tgpio->lock);
++ spin_lock_irqsave(&tgpio->lock, flags);
+ reg = ioread32(tgpio->membase + offset);
+
+ if (enabled)
+@@ -54,7 +55,7 @@ static int timbgpio_update_bit(struct gpio_chip *gpio, unsigned index,
+ reg &= ~(1 << index);
+
+ iowrite32(reg, tgpio->membase + offset);
+- spin_unlock(&tgpio->lock);
++ spin_unlock_irqrestore(&tgpio->lock, flags);
+
+ return 0;
+ }
+--
+2.40.1
+
--- /dev/null
+From 184cf193de74534a0f0c356e0de95ef03f740065 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Sep 2023 10:40:59 +0800
+Subject: HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event
+
+From: Ma Ke <make_ruc2021@163.com>
+
+[ Upstream commit ffe3b7837a2bb421df84d0177481db9f52c93a71 ]
+
+There is a slab-out-of-bounds Write bug in hid-holtek-kbd driver.
+The problem is the driver assumes the device must have an input
+but some malicious devices violate this assumption.
+
+Fix this by checking hid_device's input is non-empty before its usage.
+
+Signed-off-by: Ma Ke <make_ruc2021@163.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-holtek-kbd.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-holtek-kbd.c b/drivers/hid/hid-holtek-kbd.c
+index 403506b9697e7..b346d68a06f5a 100644
+--- a/drivers/hid/hid-holtek-kbd.c
++++ b/drivers/hid/hid-holtek-kbd.c
+@@ -130,6 +130,10 @@ static int holtek_kbd_input_event(struct input_dev *dev, unsigned int type,
+ return -ENODEV;
+
+ boot_hid = usb_get_intfdata(boot_interface);
++ if (list_empty(&boot_hid->inputs)) {
++ hid_err(hid, "no inputs found\n");
++ return -ENODEV;
++ }
+ boot_hid_input = list_first_entry(&boot_hid->inputs,
+ struct hid_input, list);
+
+--
+2.40.1
+
--- /dev/null
+From c45537bf38cc7353cf0a43f6b58c0b5a53ed783c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Sep 2023 16:18:43 +0000
+Subject: HID: multitouch: Add required quirk for Synaptics 0xcd7e device
+
+From: Rahul Rameshbabu <sergeantsagara@protonmail.com>
+
+[ Upstream commit 1437e4547edf41689d7135faaca4222ef0081bc1 ]
+
+Register the Synaptics device as a special multitouch device with certain
+quirks that may improve usability of the touchpad device.
+
+Reported-by: Rain <rain@sunshowers.io>
+Closes: https://lore.kernel.org/linux-input/2bbb8e1d-1793-4df1-810f-cb0137341ff4@app.fastmail.com/
+Signed-off-by: Rahul Rameshbabu <sergeantsagara@protonmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-multitouch.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index dc7c33f6b2c4e..84b12599eaf69 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -2058,6 +2058,10 @@ static const struct hid_device_id mt_devices[] = {
+ USB_DEVICE_ID_MTP_STM)},
+
+ /* Synaptics devices */
++ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT,
++ HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
++ USB_VENDOR_ID_SYNAPTICS, 0xcd7e) },
++
+ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT,
+ HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
+ USB_VENDOR_ID_SYNAPTICS, 0xce08) },
+--
+2.40.1
+
--- /dev/null
+From 76ff1767dea31d1d007810a48eff775dd6556e4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Sep 2023 23:54:06 +0200
+Subject: i2c: mux: Avoid potential false error message in i2c_mux_add_adapter
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit b13e59e74ff71a1004e0508107e91e9a84fd7388 ]
+
+I2C_CLASS_DEPRECATED is a flag and not an actual class.
+There's nothing speaking against both, parent and child, having
+I2C_CLASS_DEPRECATED set. Therefore exclude it from the check.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Acked-by: Peter Rosin <peda@axentia.se>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/i2c-mux.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
+index 774507b54b57b..c90cec8d9656d 100644
+--- a/drivers/i2c/i2c-mux.c
++++ b/drivers/i2c/i2c-mux.c
+@@ -340,7 +340,7 @@ int i2c_mux_add_adapter(struct i2c_mux_core *muxc,
+ priv->adap.lock_ops = &i2c_parent_lock_ops;
+
+ /* Sanity check on class */
+- if (i2c_mux_parent_classes(parent) & class)
++ if (i2c_mux_parent_classes(parent) & class & ~I2C_CLASS_DEPRECATED)
+ dev_err(&parent->dev,
+ "Segment %d behind mux can't share classes with ancestors\n",
+ chan_id);
+--
+2.40.1
+
--- /dev/null
+From aab0a42b5fec87285841b9bbb6f240dad18abe7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Sep 2023 15:55:08 +0800
+Subject: ipv4/fib: send notify when delete source address routes
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit 4b2b606075e50cdae62ab2356b0a1e206947c354 ]
+
+After deleting an interface address in fib_del_ifaddr(), the function
+scans the fib_info list for stray entries and calls fib_flush() and
+fib_table_flush(). Then the stray entries will be deleted silently and no
+RTM_DELROUTE notification will be sent.
+
+This lack of notification can make routing daemons, or monitor like
+`ip monitor route` miss the routing changes. e.g.
+
++ ip link add dummy1 type dummy
++ ip link add dummy2 type dummy
++ ip link set dummy1 up
++ ip link set dummy2 up
++ ip addr add 192.168.5.5/24 dev dummy1
++ ip route add 7.7.7.0/24 dev dummy2 src 192.168.5.5
++ ip -4 route
+7.7.7.0/24 dev dummy2 scope link src 192.168.5.5
+192.168.5.0/24 dev dummy1 proto kernel scope link src 192.168.5.5
++ ip monitor route
++ ip addr del 192.168.5.5/24 dev dummy1
+Deleted 192.168.5.0/24 dev dummy1 proto kernel scope link src 192.168.5.5
+Deleted broadcast 192.168.5.255 dev dummy1 table local proto kernel scope link src 192.168.5.5
+Deleted local 192.168.5.5 dev dummy1 table local proto kernel scope host src 192.168.5.5
+
+As Ido reminded, fib_table_flush() isn't only called when an address is
+deleted, but also when an interface is deleted or put down. The lack of
+notification in these cases is deliberate. And commit 7c6bb7d2faaf
+("net/ipv6: Add knob to skip DELROUTE message on device down") introduced
+a sysctl to make IPv6 behave like IPv4 in this regard. So we can't send
+the route delete notify blindly in fib_table_flush().
+
+To fix this issue, let's add a new flag in "struct fib_info" to track the
+deleted prefer source address routes, and only send notify for them.
+
+After update:
++ ip monitor route
++ ip addr del 192.168.5.5/24 dev dummy1
+Deleted 192.168.5.0/24 dev dummy1 proto kernel scope link src 192.168.5.5
+Deleted broadcast 192.168.5.255 dev dummy1 table local proto kernel scope link src 192.168.5.5
+Deleted local 192.168.5.5 dev dummy1 table local proto kernel scope host src 192.168.5.5
+Deleted 7.7.7.0/24 dev dummy2 scope link src 192.168.5.5
+
+Suggested-by: Thomas Haller <thaller@redhat.com>
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://lore.kernel.org/r/20230922075508.848925-1-liuhangbin@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ip_fib.h | 1 +
+ net/ipv4/fib_semantics.c | 1 +
+ net/ipv4/fib_trie.c | 4 ++++
+ 3 files changed, 6 insertions(+)
+
+diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
+index 088f257cd6fb3..0d3cb34c7abc5 100644
+--- a/include/net/ip_fib.h
++++ b/include/net/ip_fib.h
+@@ -151,6 +151,7 @@ struct fib_info {
+ int fib_nhs;
+ bool fib_nh_is_v6;
+ bool nh_updated;
++ bool pfsrc_removed;
+ struct nexthop *nh;
+ struct rcu_head rcu;
+ struct fib_nh fib_nh[];
+diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
+index 5f786cff2e410..bb5255178d75c 100644
+--- a/net/ipv4/fib_semantics.c
++++ b/net/ipv4/fib_semantics.c
+@@ -1908,6 +1908,7 @@ int fib_sync_down_addr(struct net_device *dev, __be32 local)
+ continue;
+ if (fi->fib_prefsrc == local) {
+ fi->fib_flags |= RTNH_F_DEAD;
++ fi->pfsrc_removed = true;
+ ret++;
+ }
+ }
+diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
+index 456240d2adc11..3f4f6458d40e9 100644
+--- a/net/ipv4/fib_trie.c
++++ b/net/ipv4/fib_trie.c
+@@ -1977,6 +1977,7 @@ void fib_table_flush_external(struct fib_table *tb)
+ int fib_table_flush(struct net *net, struct fib_table *tb, bool flush_all)
+ {
+ struct trie *t = (struct trie *)tb->tb_data;
++ struct nl_info info = { .nl_net = net };
+ struct key_vector *pn = t->kv;
+ unsigned long cindex = 1;
+ struct hlist_node *tmp;
+@@ -2039,6 +2040,9 @@ int fib_table_flush(struct net *net, struct fib_table *tb, bool flush_all)
+
+ fib_notify_alias_delete(net, n->key, &n->leaf, fa,
+ NULL);
++ if (fi->pfsrc_removed)
++ rtmsg_fib(RTM_DELROUTE, htonl(n->key), fa,
++ KEYLENGTH - fa->fa_slen, tb->tb_id, &info, 0);
+ hlist_del_rcu(&fa->fa_list);
+ fib_release_info(fa->fa_info);
+ alias_free_mem_rcu(fa);
+--
+2.40.1
+
--- /dev/null
+From 0a483eabb058a193184d5b8047a57ef6e2b11c58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Sep 2023 21:48:30 +0300
+Subject: net/mlx5: Handle fw tracer change ownership event based on MTRC
+
+From: Maher Sanalla <msanalla@nvidia.com>
+
+[ Upstream commit 92fd39634541eb0a11bf1bafbc8ba92d6ddb8dba ]
+
+Currently, whenever fw issues a change ownership event, the PF that owns
+the fw tracer drops its ownership directly and the other PFs try to pick
+up the ownership via what MTRC register suggests.
+
+In some cases, driver releases the ownership of the tracer and reacquires
+it later on. Whenever the driver releases ownership of the tracer, fw
+issues a change ownership event. This event can be delayed and come after
+driver has reacquired ownership of the tracer. Thus the late event will
+trigger the tracer owner PF to release the ownership again and lead to a
+scenario where no PF is owning the tracer.
+
+To prevent the scenario described above, when handling a change
+ownership event, do not drop ownership of the tracer directly, instead
+read the fw MTRC register to retrieve the up-to-date owner of the tracer
+and set it accordingly in driver level.
+
+Fixes: f53aaa31cce7 ("net/mlx5: FW tracer, implement tracer logic")
+Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
+Reviewed-by: Shay Drory <shayd@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+index 5273644fb2bf9..86088ccab23aa 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+@@ -821,7 +821,7 @@ static void mlx5_fw_tracer_ownership_change(struct work_struct *work)
+
+ mlx5_core_dbg(tracer->dev, "FWTracer: ownership changed, current=(%d)\n", tracer->owner);
+ if (tracer->owner) {
+- tracer->owner = false;
++ mlx5_fw_tracer_ownership_acquire(tracer);
+ return;
+ }
+
+--
+2.40.1
+
--- /dev/null
+From 94c094587542037336c5092d3a55235ff0262b7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Sep 2023 09:33:12 -0400
+Subject: overlayfs: set ctime when setting mtime and atime
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit 03dbab3bba5f009d053635c729d1244f2c8bad38 ]
+
+Nathan reported that he was seeing the new warning in
+setattr_copy_mgtime pop when starting podman containers. Overlayfs is
+trying to set the atime and mtime via notify_change without also
+setting the ctime.
+
+POSIX states that when the atime and mtime are updated via utimes() that
+we must also update the ctime to the current time. The situation with
+overlayfs copy-up is analogies, so add ATTR_CTIME to the bitmask.
+notify_change will fill in the value.
+
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Tested-by: Nathan Chancellor <nathan@kernel.org>
+Acked-by: Christian Brauner <brauner@kernel.org>
+Acked-by: Amir Goldstein <amir73il@gmail.com>
+Message-Id: <20230913-ctime-v1-1-c6bc509cbc27@kernel.org>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/overlayfs/copy_up.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
+index 7ef3c87f8a23d..65ac504595ba4 100644
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -243,7 +243,7 @@ static int ovl_set_timestamps(struct dentry *upperdentry, struct kstat *stat)
+ {
+ struct iattr attr = {
+ .ia_valid =
+- ATTR_ATIME | ATTR_MTIME | ATTR_ATIME_SET | ATTR_MTIME_SET,
++ ATTR_ATIME | ATTR_MTIME | ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_CTIME,
+ .ia_atime = stat->atime,
+ .ia_mtime = stat->mtime,
+ };
+--
+2.40.1
+
--- /dev/null
+From 30c6d8b155b0bc2582477d4fc007edd1a3025a78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Oct 2023 19:59:00 -0400
+Subject: platform/x86: touchscreen_dmi: Add info for the Positivo C4128B
+
+From: Renan Guilherme Lebre Ramos <japareaggae@gmail.com>
+
+[ Upstream commit aa7dcba3bae6869122828b144a3cfd231718089d ]
+
+Add information for the Positivo C4128B, a notebook/tablet convertible.
+
+Link: https://github.com/onitake/gsl-firmware/pull/217
+Signed-off-by: Renan Guilherme Lebre Ramos <japareaggae@gmail.com>
+Link: https://lore.kernel.org/r/20231004235900.426240-1-japareaggae@gmail.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/touchscreen_dmi.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c
+index 55a18cd0c298f..eedff2ae28511 100644
+--- a/drivers/platform/x86/touchscreen_dmi.c
++++ b/drivers/platform/x86/touchscreen_dmi.c
+@@ -726,6 +726,21 @@ static const struct ts_dmi_data pipo_w11_data = {
+ .properties = pipo_w11_props,
+ };
+
++static const struct property_entry positivo_c4128b_props[] = {
++ PROPERTY_ENTRY_U32("touchscreen-min-x", 4),
++ PROPERTY_ENTRY_U32("touchscreen-min-y", 13),
++ PROPERTY_ENTRY_U32("touchscreen-size-x", 1915),
++ PROPERTY_ENTRY_U32("touchscreen-size-y", 1269),
++ PROPERTY_ENTRY_STRING("firmware-name", "gsl1680-positivo-c4128b.fw"),
++ PROPERTY_ENTRY_U32("silead,max-fingers", 10),
++ { }
++};
++
++static const struct ts_dmi_data positivo_c4128b_data = {
++ .acpi_name = "MSSL1680:00",
++ .properties = positivo_c4128b_props,
++};
++
+ static const struct property_entry pov_mobii_wintab_p800w_v20_props[] = {
+ PROPERTY_ENTRY_U32("touchscreen-min-x", 32),
+ PROPERTY_ENTRY_U32("touchscreen-min-y", 16),
+@@ -1389,6 +1404,14 @@ const struct dmi_system_id touchscreen_dmi_table[] = {
+ DMI_MATCH(DMI_BIOS_VERSION, "MOMO.G.WI71C.MABMRBA02"),
+ },
+ },
++ {
++ /* Positivo C4128B */
++ .driver_data = (void *)&positivo_c4128b_data,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Positivo Tecnologia SA"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "C4128B-1"),
++ },
++ },
+ {
+ /* Point of View mobii wintab p800w (v2.0) */
+ .driver_data = (void *)&pov_mobii_wintab_p800w_v20_data,
+--
+2.40.1
+
--- /dev/null
+From 146e8932a5af2c7486990f4b290c4d7edf863124 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Sep 2023 00:50:27 +0200
+Subject: regulator/core: Revert "fix kobject release warning and memory leak
+ in regulator_register()"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+[ Upstream commit 6e800968f6a715c0661716d2ec5e1f56ed9f9c08 ]
+
+This reverts commit 5f4b204b6b8153923d5be8002c5f7082985d153f.
+
+Since rdev->dev now has a release() callback, the proper way of freeing
+the initialized device can be restored.
+
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Link: https://lore.kernel.org/r/d7f469f3f7b1f0e1d52f9a7ede3f3c5703382090.1695077303.git.mirq-linux@rere.qmqm.pl
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 52b75779dbb7e..51c4f604d3b24 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -5483,15 +5483,11 @@ regulator_register(const struct regulator_desc *regulator_desc,
+ mutex_lock(®ulator_list_mutex);
+ regulator_ena_gpio_free(rdev);
+ mutex_unlock(®ulator_list_mutex);
+- put_device(&rdev->dev);
+- rdev = NULL;
+ clean:
+ if (dangling_of_gpiod)
+ gpiod_put(config->ena_gpiod);
+- if (rdev && rdev->dev.of_node)
+- of_node_put(rdev->dev.of_node);
+- kfree(rdev);
+ kfree(config);
++ put_device(&rdev->dev);
+ rinse:
+ if (dangling_cfg_gpiod)
+ gpiod_put(cfg->ena_gpiod);
+--
+2.40.1
+
--- /dev/null
+From c96d97c2ff11ca8daf1519130a6740a4bfbc40c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 18:36:54 +0800
+Subject: resource: Add irqresource_disabled()
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit 9806731db684a475ade1e95d166089b9edbd9da3 ]
+
+Add a common function to set the fields for a irq resource to disabled,
+which mimics what is done in acpi_dev_irqresource_disabled(), with a view
+to replace that function.
+
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://lore.kernel.org/r/1606905417-183214-3-git-send-email-john.garry@huawei.com
+Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/ioport.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/include/linux/ioport.h b/include/linux/ioport.h
+index 5135d4b86cd6a..f9bf374f96336 100644
+--- a/include/linux/ioport.h
++++ b/include/linux/ioport.h
+@@ -307,6 +307,13 @@ struct resource *devm_request_free_mem_region(struct device *dev,
+ struct resource *request_free_mem_region(struct resource *base,
+ unsigned long size, const char *name);
+
++static inline void irqresource_disabled(struct resource *res, u32 irq)
++{
++ res->start = irq;
++ res->end = irq;
++ res->flags = IORESOURCE_IRQ | IORESOURCE_DISABLED | IORESOURCE_UNSET;
++}
++
+ #ifdef CONFIG_IO_STRICT_DEVMEM
+ void revoke_devmem(struct resource *res);
+ #else
+--
+2.40.1
+
--- /dev/null
+From b3fc4c47932f87feeed383e3a3b667bc710a7e17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Sep 2023 02:19:44 +0800
+Subject: selftests/mm: fix awk usage in charge_reserved_hugetlb.sh and
+ hugetlb_reparenting_test.sh that may cause error
+
+From: Juntong Deng <juntong.deng@outlook.com>
+
+[ Upstream commit bbe246f875d064ecfb872fe4f66152e743dfd22d ]
+
+According to the awk manual, the -e option does not need to be specified
+in front of 'program' (unless you need to mix program-file).
+
+The redundant -e option can cause error when users use awk tools other
+than gawk (for example, mawk does not support the -e option).
+
+Error Example:
+awk: not an option: -e
+
+Link: https://lkml.kernel.org/r/VI1P193MB075228810591AF2FDD7D42C599C3A@VI1P193MB0752.EURP193.PROD.OUTLOOK.COM
+Signed-off-by: Juntong Deng <juntong.deng@outlook.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/vm/charge_reserved_hugetlb.sh | 4 ++--
+ tools/testing/selftests/vm/hugetlb_reparenting_test.sh | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/tools/testing/selftests/vm/charge_reserved_hugetlb.sh b/tools/testing/selftests/vm/charge_reserved_hugetlb.sh
+index 71d3cf3bf130a..7536ff2f890a1 100644
+--- a/tools/testing/selftests/vm/charge_reserved_hugetlb.sh
++++ b/tools/testing/selftests/vm/charge_reserved_hugetlb.sh
+@@ -22,7 +22,7 @@ if [[ "$1" == "-cgroup-v2" ]]; then
+ fi
+
+ if [[ $cgroup2 ]]; then
+- cgroup_path=$(mount -t cgroup2 | head -1 | awk -e '{print $3}')
++ cgroup_path=$(mount -t cgroup2 | head -1 | awk '{print $3}')
+ if [[ -z "$cgroup_path" ]]; then
+ cgroup_path=/dev/cgroup/memory
+ mount -t cgroup2 none $cgroup_path
+@@ -30,7 +30,7 @@ if [[ $cgroup2 ]]; then
+ fi
+ echo "+hugetlb" >$cgroup_path/cgroup.subtree_control
+ else
+- cgroup_path=$(mount -t cgroup | grep ",hugetlb" | awk -e '{print $3}')
++ cgroup_path=$(mount -t cgroup | grep ",hugetlb" | awk '{print $3}')
+ if [[ -z "$cgroup_path" ]]; then
+ cgroup_path=/dev/cgroup/memory
+ mount -t cgroup memory,hugetlb $cgroup_path
+diff --git a/tools/testing/selftests/vm/hugetlb_reparenting_test.sh b/tools/testing/selftests/vm/hugetlb_reparenting_test.sh
+index 54234e12288c9..c665b16f1e370 100644
+--- a/tools/testing/selftests/vm/hugetlb_reparenting_test.sh
++++ b/tools/testing/selftests/vm/hugetlb_reparenting_test.sh
+@@ -17,7 +17,7 @@ fi
+
+
+ if [[ $cgroup2 ]]; then
+- CGROUP_ROOT=$(mount -t cgroup2 | head -1 | awk -e '{print $3}')
++ CGROUP_ROOT=$(mount -t cgroup2 | head -1 | awk '{print $3}')
+ if [[ -z "$CGROUP_ROOT" ]]; then
+ CGROUP_ROOT=/dev/cgroup/memory
+ mount -t cgroup2 none $CGROUP_ROOT
+@@ -25,7 +25,7 @@ if [[ $cgroup2 ]]; then
+ fi
+ echo "+hugetlb +memory" >$CGROUP_ROOT/cgroup.subtree_control
+ else
+- CGROUP_ROOT=$(mount -t cgroup | grep ",hugetlb" | awk -e '{print $3}')
++ CGROUP_ROOT=$(mount -t cgroup | grep ",hugetlb" | awk '{print $3}')
+ if [[ -z "$CGROUP_ROOT" ]]; then
+ CGROUP_ROOT=/dev/cgroup/memory
+ mount -t cgroup memory,hugetlb $CGROUP_ROOT
+--
+2.40.1
+
--- /dev/null
+From d40f59cc05433d9d4e8967f8c2445c7fd4175a4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Jan 2022 14:07:58 -0800
+Subject: selftests/vm: make charge_reserved_hugetlb.sh work with existing
+ cgroup setting
+
+From: Waiman Long <longman@redhat.com>
+
+[ Upstream commit 209376ed2a8431ccb4c40fdcef11194fc1e749b0 ]
+
+The hugetlb cgroup reservation test charge_reserved_hugetlb.sh assume
+that no cgroup filesystems are mounted before running the test. That is
+not true in many cases. As a result, the test fails to run. Fix that
+by querying the current cgroup mount setting and using the existing
+cgroup setup instead before attempting to freshly mount a cgroup
+filesystem.
+
+Similar change is also made for hugetlb_reparenting_test.sh as well,
+though it still has problem if cgroup v2 isn't used.
+
+The patched test scripts were run on a centos 8 based system to verify
+that they ran properly.
+
+Link: https://lkml.kernel.org/r/20220106201359.1646575-1-longman@redhat.com
+Fixes: 29750f71a9b4 ("hugetlb_cgroup: add hugetlb_cgroup reservation tests")
+Signed-off-by: Waiman Long <longman@redhat.com>
+Acked-by: Mina Almasry <almasrymina@google.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: Mike Kravetz <mike.kravetz@oracle.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Stable-dep-of: bbe246f875d0 ("selftests/mm: fix awk usage in charge_reserved_hugetlb.sh and hugetlb_reparenting_test.sh that may cause error")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/vm/charge_reserved_hugetlb.sh | 34 +++++++++++--------
+ .../selftests/vm/hugetlb_reparenting_test.sh | 21 +++++++-----
+ .../selftests/vm/write_hugetlb_memory.sh | 2 +-
+ 3 files changed, 34 insertions(+), 23 deletions(-)
+
+diff --git a/tools/testing/selftests/vm/charge_reserved_hugetlb.sh b/tools/testing/selftests/vm/charge_reserved_hugetlb.sh
+index 18d33684faade..71d3cf3bf130a 100644
+--- a/tools/testing/selftests/vm/charge_reserved_hugetlb.sh
++++ b/tools/testing/selftests/vm/charge_reserved_hugetlb.sh
+@@ -21,19 +21,23 @@ if [[ "$1" == "-cgroup-v2" ]]; then
+ reservation_usage_file=rsvd.current
+ fi
+
+-cgroup_path=/dev/cgroup/memory
+-if [[ ! -e $cgroup_path ]]; then
+- mkdir -p $cgroup_path
+- if [[ $cgroup2 ]]; then
++if [[ $cgroup2 ]]; then
++ cgroup_path=$(mount -t cgroup2 | head -1 | awk -e '{print $3}')
++ if [[ -z "$cgroup_path" ]]; then
++ cgroup_path=/dev/cgroup/memory
+ mount -t cgroup2 none $cgroup_path
+- else
++ do_umount=1
++ fi
++ echo "+hugetlb" >$cgroup_path/cgroup.subtree_control
++else
++ cgroup_path=$(mount -t cgroup | grep ",hugetlb" | awk -e '{print $3}')
++ if [[ -z "$cgroup_path" ]]; then
++ cgroup_path=/dev/cgroup/memory
+ mount -t cgroup memory,hugetlb $cgroup_path
++ do_umount=1
+ fi
+ fi
+-
+-if [[ $cgroup2 ]]; then
+- echo "+hugetlb" >/dev/cgroup/memory/cgroup.subtree_control
+-fi
++export cgroup_path
+
+ function cleanup() {
+ if [[ $cgroup2 ]]; then
+@@ -105,7 +109,7 @@ function setup_cgroup() {
+
+ function wait_for_hugetlb_memory_to_get_depleted() {
+ local cgroup="$1"
+- local path="/dev/cgroup/memory/$cgroup/hugetlb.${MB}MB.$reservation_usage_file"
++ local path="$cgroup_path/$cgroup/hugetlb.${MB}MB.$reservation_usage_file"
+ # Wait for hugetlbfs memory to get depleted.
+ while [ $(cat $path) != 0 ]; do
+ echo Waiting for hugetlb memory to get depleted.
+@@ -118,7 +122,7 @@ function wait_for_hugetlb_memory_to_get_reserved() {
+ local cgroup="$1"
+ local size="$2"
+
+- local path="/dev/cgroup/memory/$cgroup/hugetlb.${MB}MB.$reservation_usage_file"
++ local path="$cgroup_path/$cgroup/hugetlb.${MB}MB.$reservation_usage_file"
+ # Wait for hugetlbfs memory to get written.
+ while [ $(cat $path) != $size ]; do
+ echo Waiting for hugetlb memory reservation to reach size $size.
+@@ -131,7 +135,7 @@ function wait_for_hugetlb_memory_to_get_written() {
+ local cgroup="$1"
+ local size="$2"
+
+- local path="/dev/cgroup/memory/$cgroup/hugetlb.${MB}MB.$fault_usage_file"
++ local path="$cgroup_path/$cgroup/hugetlb.${MB}MB.$fault_usage_file"
+ # Wait for hugetlbfs memory to get written.
+ while [ $(cat $path) != $size ]; do
+ echo Waiting for hugetlb memory to reach size $size.
+@@ -571,5 +575,7 @@ for populate in "" "-o"; do
+ done # populate
+ done # method
+
+-umount $cgroup_path
+-rmdir $cgroup_path
++if [[ $do_umount ]]; then
++ umount $cgroup_path
++ rmdir $cgroup_path
++fi
+diff --git a/tools/testing/selftests/vm/hugetlb_reparenting_test.sh b/tools/testing/selftests/vm/hugetlb_reparenting_test.sh
+index d11d1febccc3b..54234e12288c9 100644
+--- a/tools/testing/selftests/vm/hugetlb_reparenting_test.sh
++++ b/tools/testing/selftests/vm/hugetlb_reparenting_test.sh
+@@ -15,19 +15,24 @@ if [[ "$1" == "-cgroup-v2" ]]; then
+ usage_file=current
+ fi
+
+-CGROUP_ROOT='/dev/cgroup/memory'
+-MNT='/mnt/huge/'
+
+-if [[ ! -e $CGROUP_ROOT ]]; then
+- mkdir -p $CGROUP_ROOT
+- if [[ $cgroup2 ]]; then
++if [[ $cgroup2 ]]; then
++ CGROUP_ROOT=$(mount -t cgroup2 | head -1 | awk -e '{print $3}')
++ if [[ -z "$CGROUP_ROOT" ]]; then
++ CGROUP_ROOT=/dev/cgroup/memory
+ mount -t cgroup2 none $CGROUP_ROOT
+- sleep 1
+- echo "+hugetlb +memory" >$CGROUP_ROOT/cgroup.subtree_control
+- else
++ do_umount=1
++ fi
++ echo "+hugetlb +memory" >$CGROUP_ROOT/cgroup.subtree_control
++else
++ CGROUP_ROOT=$(mount -t cgroup | grep ",hugetlb" | awk -e '{print $3}')
++ if [[ -z "$CGROUP_ROOT" ]]; then
++ CGROUP_ROOT=/dev/cgroup/memory
+ mount -t cgroup memory,hugetlb $CGROUP_ROOT
++ do_umount=1
+ fi
+ fi
++MNT='/mnt/huge/'
+
+ function get_machine_hugepage_size() {
+ hpz=$(grep -i hugepagesize /proc/meminfo)
+diff --git a/tools/testing/selftests/vm/write_hugetlb_memory.sh b/tools/testing/selftests/vm/write_hugetlb_memory.sh
+index d3d0d108924d4..70a02301f4c27 100644
+--- a/tools/testing/selftests/vm/write_hugetlb_memory.sh
++++ b/tools/testing/selftests/vm/write_hugetlb_memory.sh
+@@ -14,7 +14,7 @@ want_sleep=$8
+ reserve=$9
+
+ echo "Putting task in cgroup '$cgroup'"
+-echo $$ > /dev/cgroup/memory/"$cgroup"/cgroup.procs
++echo $$ > ${cgroup_path:-/dev/cgroup/memory}/"$cgroup"/cgroup.procs
+
+ echo "Method is $method"
+
+--
+2.40.1
+
--- /dev/null
+From e301fabf1d5f8ac44f76028e593b8e368368b094 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 May 2023 11:20:12 +0300
+Subject: serial: 8250: omap: Fix imprecise external abort for omap_8250_pm()
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 398cecc24846e867b9f90a0bd22730e3df6b05be ]
+
+We must idle the uart only after serial8250_unregister_port(). Otherwise
+unbinding the uart via sysfs while doing cat on the port produces an
+imprecise external abort:
+
+mem_serial_in from omap_8250_pm+0x44/0xf4
+omap_8250_pm from uart_hangup+0xe0/0x194
+uart_hangup from __tty_hangup.part.0+0x37c/0x3a8
+__tty_hangup.part.0 from uart_remove_one_port+0x9c/0x22c
+uart_remove_one_port from serial8250_unregister_port+0x60/0xe8
+serial8250_unregister_port from omap8250_remove+0x6c/0xd0
+omap8250_remove from platform_remove+0x28/0x54
+
+Turns out the driver needs to have runtime PM functional before the
+driver probe calls serial8250_register_8250_port(). And it needs
+runtime PM after driver remove calls serial8250_unregister_port().
+
+On probe, we need to read registers before registering the port in
+omap_serial_fill_features_erratas(). We do that with custom uart_read()
+already.
+
+On remove, after serial8250_unregister_port(), we need to write to the
+uart registers to idle the device. Let's add a custom uart_write() for
+that.
+
+Currently the uart register access depends on port->membase to be
+initialized, which won't work after serial8250_unregister_port().
+Let's use priv->membase instead, and use it for runtime PM related
+functions to remove the dependency to port->membase for early and
+late register access.
+
+Note that during use, we need to check for a valid port in the runtime PM
+related functions. This is needed for the optional wakeup configuration.
+We now need to set the drvdata a bit earlier so it's available for the
+runtime PM functions.
+
+With the port checks in runtime PM functions, the old checks for priv in
+omap8250_runtime_suspend() and omap8250_runtime_resume() functions are no
+longer needed and are removed.
+
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20230508082014.23083-3-tony@atomide.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 560706eff7c8 ("serial: 8250_omap: Fix errors with no_console_suspend")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 70 ++++++++++++++++-------------
+ 1 file changed, 38 insertions(+), 32 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index e26ac3f42e05c..a6f0a74858eab 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -32,6 +32,7 @@
+ #include "8250.h"
+
+ #define DEFAULT_CLK_SPEED 48000000
++#define OMAP_UART_REGSHIFT 2
+
+ #define UART_ERRATA_i202_MDR1_ACCESS (1 << 0)
+ #define OMAP_UART_WER_HAS_TX_WAKEUP (1 << 1)
+@@ -109,6 +110,7 @@
+ #define UART_OMAP_RX_LVL 0x19
+
+ struct omap8250_priv {
++ void __iomem *membase;
+ int line;
+ u8 habit;
+ u8 mdr1;
+@@ -152,9 +154,14 @@ static void omap_8250_rx_dma_flush(struct uart_8250_port *p);
+ static inline void omap_8250_rx_dma_flush(struct uart_8250_port *p) { }
+ #endif
+
+-static u32 uart_read(struct uart_8250_port *up, u32 reg)
++static u32 uart_read(struct omap8250_priv *priv, u32 reg)
+ {
+- return readl(up->port.membase + (reg << up->port.regshift));
++ return readl(priv->membase + (reg << OMAP_UART_REGSHIFT));
++}
++
++static void uart_write(struct omap8250_priv *priv, u32 reg, u32 val)
++{
++ writel(val, priv->membase + (reg << OMAP_UART_REGSHIFT));
+ }
+
+ /*
+@@ -552,7 +559,7 @@ static void omap_serial_fill_features_erratas(struct uart_8250_port *up,
+ u32 mvr, scheme;
+ u16 revision, major, minor;
+
+- mvr = uart_read(up, UART_OMAP_MVER);
++ mvr = uart_read(priv, UART_OMAP_MVER);
+
+ /* Check revision register scheme */
+ scheme = mvr >> OMAP_UART_MVR_SCHEME_SHIFT;
+@@ -1336,7 +1343,7 @@ static int omap8250_probe(struct platform_device *pdev)
+ UPF_HARD_FLOW;
+ up.port.private_data = priv;
+
+- up.port.regshift = 2;
++ up.port.regshift = OMAP_UART_REGSHIFT;
+ up.port.fifosize = 64;
+ up.tx_loadsz = 64;
+ up.capabilities = UART_CAP_FIFO;
+@@ -1397,6 +1404,8 @@ static int omap8250_probe(struct platform_device *pdev)
+ DEFAULT_CLK_SPEED);
+ }
+
++ priv->membase = membase;
++ priv->line = -ENODEV;
+ priv->latency = PM_QOS_CPU_LATENCY_DEFAULT_VALUE;
+ priv->calc_latency = PM_QOS_CPU_LATENCY_DEFAULT_VALUE;
+ cpu_latency_qos_add_request(&priv->pm_qos_request, priv->latency);
+@@ -1404,6 +1413,8 @@ static int omap8250_probe(struct platform_device *pdev)
+
+ spin_lock_init(&priv->rx_dma_lock);
+
++ platform_set_drvdata(pdev, priv);
++
+ device_init_wakeup(&pdev->dev, true);
+ pm_runtime_enable(&pdev->dev);
+ pm_runtime_use_autosuspend(&pdev->dev);
+@@ -1465,7 +1476,6 @@ static int omap8250_probe(struct platform_device *pdev)
+ goto err;
+ }
+ priv->line = ret;
+- platform_set_drvdata(pdev, priv);
+ pm_runtime_mark_last_busy(&pdev->dev);
+ pm_runtime_put_autosuspend(&pdev->dev);
+ return 0;
+@@ -1487,11 +1497,12 @@ static int omap8250_remove(struct platform_device *pdev)
+ if (err)
+ return err;
+
++ serial8250_unregister_port(priv->line);
++ priv->line = -ENODEV;
+ pm_runtime_dont_use_autosuspend(&pdev->dev);
+ pm_runtime_put_sync(&pdev->dev);
+ flush_work(&priv->qos_work);
+ pm_runtime_disable(&pdev->dev);
+- serial8250_unregister_port(priv->line);
+ cpu_latency_qos_remove_request(&priv->pm_qos_request);
+ device_init_wakeup(&pdev->dev, false);
+ return 0;
+@@ -1577,7 +1588,6 @@ static int omap8250_lost_context(struct uart_8250_port *up)
+ static int omap8250_soft_reset(struct device *dev)
+ {
+ struct omap8250_priv *priv = dev_get_drvdata(dev);
+- struct uart_8250_port *up = serial8250_get_port(priv->line);
+ int timeout = 100;
+ int sysc;
+ int syss;
+@@ -1591,20 +1601,20 @@ static int omap8250_soft_reset(struct device *dev)
+ * needing omap8250_soft_reset() quirk. Do it in two writes as
+ * recommended in the comment for omap8250_update_scr().
+ */
+- serial_out(up, UART_OMAP_SCR, OMAP_UART_SCR_DMAMODE_1);
+- serial_out(up, UART_OMAP_SCR,
++ uart_write(priv, UART_OMAP_SCR, OMAP_UART_SCR_DMAMODE_1);
++ uart_write(priv, UART_OMAP_SCR,
+ OMAP_UART_SCR_DMAMODE_1 | OMAP_UART_SCR_DMAMODE_CTL);
+
+- sysc = serial_in(up, UART_OMAP_SYSC);
++ sysc = uart_read(priv, UART_OMAP_SYSC);
+
+ /* softreset the UART */
+ sysc |= OMAP_UART_SYSC_SOFTRESET;
+- serial_out(up, UART_OMAP_SYSC, sysc);
++ uart_write(priv, UART_OMAP_SYSC, sysc);
+
+ /* By experiments, 1us enough for reset complete on AM335x */
+ do {
+ udelay(1);
+- syss = serial_in(up, UART_OMAP_SYSS);
++ syss = uart_read(priv, UART_OMAP_SYSS);
+ } while (--timeout && !(syss & OMAP_UART_SYSS_RESETDONE));
+
+ if (!timeout) {
+@@ -1618,13 +1628,10 @@ static int omap8250_soft_reset(struct device *dev)
+ static int omap8250_runtime_suspend(struct device *dev)
+ {
+ struct omap8250_priv *priv = dev_get_drvdata(dev);
+- struct uart_8250_port *up;
+-
+- /* In case runtime-pm tries this before we are setup */
+- if (!priv)
+- return 0;
++ struct uart_8250_port *up = NULL;
+
+- up = serial8250_get_port(priv->line);
++ if (priv->line >= 0)
++ up = serial8250_get_port(priv->line);
+ /*
+ * When using 'no_console_suspend', the console UART must not be
+ * suspended. Since driver suspend is managed by runtime suspend,
+@@ -1632,7 +1639,7 @@ static int omap8250_runtime_suspend(struct device *dev)
+ * active during suspend.
+ */
+ if (priv->is_suspending && !console_suspend_enabled) {
+- if (uart_console(&up->port))
++ if (up && uart_console(&up->port))
+ return -EBUSY;
+ }
+
+@@ -1643,13 +1650,15 @@ static int omap8250_runtime_suspend(struct device *dev)
+ if (ret)
+ return ret;
+
+- /* Restore to UART mode after reset (for wakeup) */
+- omap8250_update_mdr1(up, priv);
+- /* Restore wakeup enable register */
+- serial_out(up, UART_OMAP_WER, priv->wer);
++ if (up) {
++ /* Restore to UART mode after reset (for wakeup) */
++ omap8250_update_mdr1(up, priv);
++ /* Restore wakeup enable register */
++ serial_out(up, UART_OMAP_WER, priv->wer);
++ }
+ }
+
+- if (up->dma && up->dma->rxchan)
++ if (up && up->dma && up->dma->rxchan)
+ omap_8250_rx_dma_flush(up);
+
+ priv->latency = PM_QOS_CPU_LATENCY_DEFAULT_VALUE;
+@@ -1661,18 +1670,15 @@ static int omap8250_runtime_suspend(struct device *dev)
+ static int omap8250_runtime_resume(struct device *dev)
+ {
+ struct omap8250_priv *priv = dev_get_drvdata(dev);
+- struct uart_8250_port *up;
+-
+- /* In case runtime-pm tries this before we are setup */
+- if (!priv)
+- return 0;
++ struct uart_8250_port *up = NULL;
+
+- up = serial8250_get_port(priv->line);
++ if (priv->line >= 0)
++ up = serial8250_get_port(priv->line);
+
+- if (omap8250_lost_context(up))
++ if (up && omap8250_lost_context(up))
+ omap8250_restore_regs(up);
+
+- if (up->dma && up->dma->rxchan && !(priv->habit & UART_HAS_EFR2))
++ if (up && up->dma && up->dma->rxchan && !(priv->habit & UART_HAS_EFR2))
+ omap_8250_rx_dma(up);
+
+ priv->latency = priv->calc_latency;
+--
+2.40.1
+
--- /dev/null
+From 3c9b5be6156e7267cbd5e25312b3cc02db8f9ea6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Sep 2023 09:13:17 +0300
+Subject: serial: 8250_omap: Fix errors with no_console_suspend
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 560706eff7c8e5621b0d63afe0866e0e1906e87e ]
+
+We now get errors on system suspend if no_console_suspend is set as
+reported by Thomas. The errors started with commit 20a41a62618d ("serial:
+8250_omap: Use force_suspend and resume for system suspend").
+
+Let's fix the issue by checking for console_suspend_enabled in the system
+suspend and resume path.
+
+Note that with this fix the checks for console_suspend_enabled in
+omap8250_runtime_suspend() become useless. We now keep runtime PM usage
+count for an attached kernel console starting with commit bedb404e91bb
+("serial: 8250_port: Don't use power management for kernel console").
+
+Fixes: 20a41a62618d ("serial: 8250_omap: Use force_suspend and resume for system suspend")
+Cc: stable <stable@kernel.org>
+Cc: Udit Kumar <u-kumar1@ti.com>
+Reported-by: Thomas Richard <thomas.richard@bootlin.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Tested-by: Thomas Richard <thomas.richard@bootlin.com>
+Reviewed-by: Dhruva Gole <d-gole@ti.com>
+Link: https://lore.kernel.org/r/20230926061319.15140-1-tony@atomide.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 25 ++++++++++---------------
+ 1 file changed, 10 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index a6f0a74858eab..e7e84aa2c5f84 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -1532,7 +1532,7 @@ static int omap8250_suspend(struct device *dev)
+ {
+ struct omap8250_priv *priv = dev_get_drvdata(dev);
+ struct uart_8250_port *up = serial8250_get_port(priv->line);
+- int err;
++ int err = 0;
+
+ serial8250_suspend_port(priv->line);
+
+@@ -1542,7 +1542,8 @@ static int omap8250_suspend(struct device *dev)
+ if (!device_may_wakeup(dev))
+ priv->wer = 0;
+ serial_out(up, UART_OMAP_WER, priv->wer);
+- err = pm_runtime_force_suspend(dev);
++ if (uart_console(&up->port) && console_suspend_enabled)
++ err = pm_runtime_force_suspend(dev);
+ flush_work(&priv->qos_work);
+
+ return err;
+@@ -1551,11 +1552,15 @@ static int omap8250_suspend(struct device *dev)
+ static int omap8250_resume(struct device *dev)
+ {
+ struct omap8250_priv *priv = dev_get_drvdata(dev);
++ struct uart_8250_port *up = serial8250_get_port(priv->line);
+ int err;
+
+- err = pm_runtime_force_resume(dev);
+- if (err)
+- return err;
++ if (uart_console(&up->port) && console_suspend_enabled) {
++ err = pm_runtime_force_resume(dev);
++ if (err)
++ return err;
++ }
++
+ serial8250_resume_port(priv->line);
+ /* Paired with pm_runtime_resume_and_get() in omap8250_suspend() */
+ pm_runtime_mark_last_busy(dev);
+@@ -1632,16 +1637,6 @@ static int omap8250_runtime_suspend(struct device *dev)
+
+ if (priv->line >= 0)
+ up = serial8250_get_port(priv->line);
+- /*
+- * When using 'no_console_suspend', the console UART must not be
+- * suspended. Since driver suspend is managed by runtime suspend,
+- * preventing runtime suspend (by returning error) will keep device
+- * active during suspend.
+- */
+- if (priv->is_suspending && !console_suspend_enabled) {
+- if (up && uart_console(&up->port))
+- return -EBUSY;
+- }
+
+ if (priv->habit & UART_ERRATA_CLOCK_DISABLE) {
+ int ret;
+--
+2.40.1
+
neighbor-tracing-move-pin6-inside-config_ipv6-y-section.patch
netfilter-nft_set_rbtree-.deactivate-fails-if-element-has-expired.patch
net-pktgen-fix-interface-flags-printing.patch
+thunderbolt-workaround-an-iommu-fault-on-certain-sys.patch
+resource-add-irqresource_disabled.patch
+acpi-drop-acpi_dev_irqresource_disabled.patch
+acpi-resources-add-dmi-based-legacy-irq-override-qui.patch
+acpi-resource-skip-irq-override-on-asus-vivobook-k34.patch
+acpi-resource-add-asus-model-s5402za-to-quirks.patch
+acpi-resource-skip-irq-override-on-asus-vivobook-s56.patch
+acpi-resource-add-asus-expertbook-b2502-to-asus-quir.patch
+acpi-resource-skip-irq-override-on-asus-expertbook-b.patch
+acpi-resource-skip-irq-override-on-asus-expertbook-b.patch-22201
+acpi-resource-skip-irq-override-on-asus-expertbook-b.patch-28713
+selftests-vm-make-charge_reserved_hugetlb.sh-work-wi.patch
+selftests-mm-fix-awk-usage-in-charge_reserved_hugetl.patch
+usb-core-track-superspeed-plus-genxxy.patch
+xhci-cleanup-xhci_hub_control-port-references.patch
+xhci-move-port-specific-items-such-as-state-completi.patch
+xhci-rename-resume_done-to-resume_timestamp.patch
+xhci-clear-usb2-resume-related-variables-in-one-plac.patch
+xhci-decouple-usb2-port-resume-and-get_port_status-r.patch
+xhci-track-port-suspend-state-correctly-in-unsuccess.patch
+serial-8250-omap-fix-imprecise-external-abort-for-om.patch
+serial-8250_omap-fix-errors-with-no_console_suspend.patch
+drm-amd-display-only-check-available-pipe-to-disable.patch
+drm-amd-display-don-t-set-dpms_off-for-seamless-boot.patch
+drm-connector-give-connector-sysfs-devices-there-own.patch
+drm-connector-add-a-fwnode-pointer-to-drm_connector-.patch
+drm-connector-add-drm_connector_find_by_fwnode-funct.patch
+drm-connector-add-support-for-out-of-band-hotplug-no.patch
+usb-typec-altmodes-displayport-notify-drm-subsys-of-.patch
+usb-typec-altmodes-displayport-signal-hpd-low-when-e.patch
+arm-dts-ti-omap-fix-noisy-serial-with-overrun-thrott.patch
+btrfs-return-euclean-for-delayed-tree-ref-with-a-ref.patch
+btrfs-initialize-start_slot-in-btrfs_log_prealloc_ex.patch
+i2c-mux-avoid-potential-false-error-message-in-i2c_m.patch
+overlayfs-set-ctime-when-setting-mtime-and-atime.patch
+gpio-timberdale-fix-potential-deadlock-on-tgpio-lock.patch
+ata-libata-eh-fix-compilation-warning-in-ata_eh_link.patch
+tracing-relax-trace_event_eval_update-execution-with.patch
+hid-holtek-fix-slab-out-of-bounds-write-in-holtek_kb.patch
+bluetooth-avoid-redundant-authentication.patch
+bluetooth-hci_core-fix-build-warnings.patch
+wifi-cfg80211-fix-6ghz-scan-configuration.patch
+wifi-mac80211-allow-transmitting-eapol-frames-with-t.patch
+wifi-cfg80211-avoid-leaking-stack-data-into-trace.patch
+regulator-core-revert-fix-kobject-release-warning-an.patch
+sky2-make-sure-there-is-at-least-one-frag_addr-avail.patch
+ipv4-fib-send-notify-when-delete-source-address-rout.patch
+drm-panel-orientation-quirks-add-quirk-for-one-mix-2.patch
+btrfs-fix-some-wmaybe-uninitialized-warnings-in-ioct.patch
+hid-multitouch-add-required-quirk-for-synaptics-0xcd.patch
+platform-x86-touchscreen_dmi-add-info-for-the-positi.patch
+net-mlx5-handle-fw-tracer-change-ownership-event-bas.patch
+bluetooth-hci_event-fix-using-memcmp-when-comparing-.patch
--- /dev/null
+From dc4c5a5ffd95ee644be0d214d724cabd1cacb1c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Sep 2023 09:50:39 -0700
+Subject: sky2: Make sure there is at least one frag_addr available
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 6a70e5cbedaf8ad10528ac9ac114f3ec20f422df ]
+
+In the pathological case of building sky2 with 16k PAGE_SIZE, the
+frag_addr[] array would never be used, so the original code was correct
+that size should be 0. But the compiler now gets upset with 0 size arrays
+in places where it hasn't eliminated the code that might access such an
+array (it can't figure out that in this case an rx skb with fragments
+would never be created). To keep the compiler happy, make sure there is
+at least 1 frag_addr in struct rx_ring_info:
+
+ In file included from include/linux/skbuff.h:28,
+ from include/net/net_namespace.h:43,
+ from include/linux/netdevice.h:38,
+ from drivers/net/ethernet/marvell/sky2.c:18:
+ drivers/net/ethernet/marvell/sky2.c: In function 'sky2_rx_unmap_skb':
+ include/linux/dma-mapping.h:416:36: warning: array subscript i is outside array bounds of 'dma_addr_t[0]' {aka 'long long unsigned int[]'} [-Warray-bounds=]
+ 416 | #define dma_unmap_page(d, a, s, r) dma_unmap_page_attrs(d, a, s, r, 0)
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ drivers/net/ethernet/marvell/sky2.c:1257:17: note: in expansion of macro 'dma_unmap_page'
+ 1257 | dma_unmap_page(&pdev->dev, re->frag_addr[i],
+ | ^~~~~~~~~~~~~~
+ In file included from drivers/net/ethernet/marvell/sky2.c:41:
+ drivers/net/ethernet/marvell/sky2.h:2198:25: note: while referencing 'frag_addr'
+ 2198 | dma_addr_t frag_addr[ETH_JUMBO_MTU >> PAGE_SHIFT];
+ | ^~~~~~~~~
+
+With CONFIG_PAGE_SIZE_16KB=y, PAGE_SHIFT == 14, so:
+
+ #define ETH_JUMBO_MTU 9000
+
+causes "ETH_JUMBO_MTU >> PAGE_SHIFT" to be 0. Use "?: 1" to solve this build warning.
+
+Cc: Mirko Lindner <mlindner@marvell.com>
+Cc: Stephen Hemminger <stephen@networkplumber.org>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: netdev@vger.kernel.org
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202309191958.UBw1cjXk-lkp@intel.com/
+Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/sky2.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/sky2.h b/drivers/net/ethernet/marvell/sky2.h
+index b2dddd8a246c8..2bd0a7971ae62 100644
+--- a/drivers/net/ethernet/marvell/sky2.h
++++ b/drivers/net/ethernet/marvell/sky2.h
+@@ -2195,7 +2195,7 @@ struct rx_ring_info {
+ struct sk_buff *skb;
+ dma_addr_t data_addr;
+ DEFINE_DMA_UNMAP_LEN(data_size);
+- dma_addr_t frag_addr[ETH_JUMBO_MTU >> PAGE_SHIFT];
++ dma_addr_t frag_addr[ETH_JUMBO_MTU >> PAGE_SHIFT ?: 1];
+ };
+
+ enum flow_control {
+--
+2.40.1
+
--- /dev/null
+From 767920f9d0268a2193655cd2b0ad8342218482cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Aug 2023 15:27:46 +0300
+Subject: thunderbolt: Workaround an IOMMU fault on certain systems with Intel
+ Maple Ridge
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+[ Upstream commit 582620d9f6b352552bc9a3316fe2b1c3acd8742d ]
+
+On some systems the IOMMU blocks the first couple of driver ready
+messages to the connection manager firmware as can be seen in below
+excerpts:
+
+ thunderbolt 0000:06:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0010 address=0xbb0e3400 flags=0x0020]
+
+or
+
+ DMAR: DRHD: handling fault status reg 2
+ DMAR: [DMA Write] Request device [04:00.0] PASID ffffffff fault addr 69974000 [fault reason 05] PTE Write access is not set
+
+The reason is unknown and hard to debug because we were not able to
+reproduce this locally. This only happens on certain systems with Intel
+Maple Ridge Thunderbolt controller. If there is a device connected when
+the driver is loaded the issue does not happen either. Only when there
+is nothing connected (so typically when the system is booted up).
+
+We can work this around by sending the driver ready several times. After
+a couple of retries the message goes through and the controller works
+just fine. For this reason make the number of retries a parameter for
+icm_request() and then for Maple Ridge (and Titan Ridge as they us the
+same function but this should not matter) increase number of retries
+while shortening the timeout accordingly.
+
+Reported-by: Werner Sembach <wse@tuxedocomputers.com>
+Reported-by: Konrad J Hambrick <kjhambrick@gmail.com>
+Reported-by: Calvin Walton <calvin.walton@kepstin.ca>
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=214259
+Cc: stable@vger.kernel.org
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thunderbolt/icm.c | 38 +++++++++++++++++++-------------------
+ 1 file changed, 19 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/thunderbolt/icm.c b/drivers/thunderbolt/icm.c
+index b2fb3397310e4..90f1d9a534614 100644
+--- a/drivers/thunderbolt/icm.c
++++ b/drivers/thunderbolt/icm.c
+@@ -41,6 +41,7 @@
+ #define PHY_PORT_CS1_LINK_STATE_SHIFT 26
+
+ #define ICM_TIMEOUT 5000 /* ms */
++#define ICM_RETRIES 3
+ #define ICM_APPROVE_TIMEOUT 10000 /* ms */
+ #define ICM_MAX_LINK 4
+
+@@ -280,10 +281,9 @@ static bool icm_copy(struct tb_cfg_request *req, const struct ctl_pkg *pkg)
+
+ static int icm_request(struct tb *tb, const void *request, size_t request_size,
+ void *response, size_t response_size, size_t npackets,
+- unsigned int timeout_msec)
++ int retries, unsigned int timeout_msec)
+ {
+ struct icm *icm = tb_priv(tb);
+- int retries = 3;
+
+ do {
+ struct tb_cfg_request *req;
+@@ -394,7 +394,7 @@ static int icm_fr_get_route(struct tb *tb, u8 link, u8 depth, u64 *route)
+ return -ENOMEM;
+
+ ret = icm_request(tb, &request, sizeof(request), switches,
+- sizeof(*switches), npackets, ICM_TIMEOUT);
++ sizeof(*switches), npackets, ICM_RETRIES, ICM_TIMEOUT);
+ if (ret)
+ goto err_free;
+
+@@ -447,7 +447,7 @@ icm_fr_driver_ready(struct tb *tb, enum tb_security_level *security_level,
+
+ memset(&reply, 0, sizeof(reply));
+ ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
+- 1, ICM_TIMEOUT);
++ 1, ICM_RETRIES, ICM_TIMEOUT);
+ if (ret)
+ return ret;
+
+@@ -472,7 +472,7 @@ static int icm_fr_approve_switch(struct tb *tb, struct tb_switch *sw)
+ memset(&reply, 0, sizeof(reply));
+ /* Use larger timeout as establishing tunnels can take some time */
+ ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
+- 1, ICM_APPROVE_TIMEOUT);
++ 1, ICM_RETRIES, ICM_APPROVE_TIMEOUT);
+ if (ret)
+ return ret;
+
+@@ -499,7 +499,7 @@ static int icm_fr_add_switch_key(struct tb *tb, struct tb_switch *sw)
+
+ memset(&reply, 0, sizeof(reply));
+ ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
+- 1, ICM_TIMEOUT);
++ 1, ICM_RETRIES, ICM_TIMEOUT);
+ if (ret)
+ return ret;
+
+@@ -527,7 +527,7 @@ static int icm_fr_challenge_switch_key(struct tb *tb, struct tb_switch *sw,
+
+ memset(&reply, 0, sizeof(reply));
+ ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
+- 1, ICM_TIMEOUT);
++ 1, ICM_RETRIES, ICM_TIMEOUT);
+ if (ret)
+ return ret;
+
+@@ -559,7 +559,7 @@ static int icm_fr_approve_xdomain_paths(struct tb *tb, struct tb_xdomain *xd)
+
+ memset(&reply, 0, sizeof(reply));
+ ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
+- 1, ICM_TIMEOUT);
++ 1, ICM_RETRIES, ICM_TIMEOUT);
+ if (ret)
+ return ret;
+
+@@ -996,7 +996,7 @@ icm_tr_driver_ready(struct tb *tb, enum tb_security_level *security_level,
+
+ memset(&reply, 0, sizeof(reply));
+ ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
+- 1, 20000);
++ 1, 10, 2000);
+ if (ret)
+ return ret;
+
+@@ -1026,7 +1026,7 @@ static int icm_tr_approve_switch(struct tb *tb, struct tb_switch *sw)
+
+ memset(&reply, 0, sizeof(reply));
+ ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
+- 1, ICM_APPROVE_TIMEOUT);
++ 1, ICM_RETRIES, ICM_APPROVE_TIMEOUT);
+ if (ret)
+ return ret;
+
+@@ -1054,7 +1054,7 @@ static int icm_tr_add_switch_key(struct tb *tb, struct tb_switch *sw)
+
+ memset(&reply, 0, sizeof(reply));
+ ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
+- 1, ICM_TIMEOUT);
++ 1, ICM_RETRIES, ICM_TIMEOUT);
+ if (ret)
+ return ret;
+
+@@ -1083,7 +1083,7 @@ static int icm_tr_challenge_switch_key(struct tb *tb, struct tb_switch *sw,
+
+ memset(&reply, 0, sizeof(reply));
+ ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
+- 1, ICM_TIMEOUT);
++ 1, ICM_RETRIES, ICM_TIMEOUT);
+ if (ret)
+ return ret;
+
+@@ -1115,7 +1115,7 @@ static int icm_tr_approve_xdomain_paths(struct tb *tb, struct tb_xdomain *xd)
+
+ memset(&reply, 0, sizeof(reply));
+ ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
+- 1, ICM_TIMEOUT);
++ 1, ICM_RETRIES, ICM_TIMEOUT);
+ if (ret)
+ return ret;
+
+@@ -1141,7 +1141,7 @@ static int icm_tr_xdomain_tear_down(struct tb *tb, struct tb_xdomain *xd,
+
+ memset(&reply, 0, sizeof(reply));
+ ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
+- 1, ICM_TIMEOUT);
++ 1, ICM_RETRIES, ICM_TIMEOUT);
+ if (ret)
+ return ret;
+
+@@ -1460,7 +1460,7 @@ icm_ar_driver_ready(struct tb *tb, enum tb_security_level *security_level,
+
+ memset(&reply, 0, sizeof(reply));
+ ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
+- 1, ICM_TIMEOUT);
++ 1, ICM_RETRIES, ICM_TIMEOUT);
+ if (ret)
+ return ret;
+
+@@ -1486,7 +1486,7 @@ static int icm_ar_get_route(struct tb *tb, u8 link, u8 depth, u64 *route)
+
+ memset(&reply, 0, sizeof(reply));
+ ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
+- 1, ICM_TIMEOUT);
++ 1, ICM_RETRIES, ICM_TIMEOUT);
+ if (ret)
+ return ret;
+
+@@ -1507,7 +1507,7 @@ static int icm_ar_get_boot_acl(struct tb *tb, uuid_t *uuids, size_t nuuids)
+
+ memset(&reply, 0, sizeof(reply));
+ ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
+- 1, ICM_TIMEOUT);
++ 1, ICM_RETRIES, ICM_TIMEOUT);
+ if (ret)
+ return ret;
+
+@@ -1568,7 +1568,7 @@ static int icm_ar_set_boot_acl(struct tb *tb, const uuid_t *uuids,
+
+ memset(&reply, 0, sizeof(reply));
+ ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
+- 1, ICM_TIMEOUT);
++ 1, ICM_RETRIES, ICM_TIMEOUT);
+ if (ret)
+ return ret;
+
+@@ -1590,7 +1590,7 @@ icm_icl_driver_ready(struct tb *tb, enum tb_security_level *security_level,
+
+ memset(&reply, 0, sizeof(reply));
+ ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
+- 1, 20000);
++ 1, ICM_RETRIES, 20000);
+ if (ret)
+ return ret;
+
+--
+2.40.1
+
--- /dev/null
+From 8899fa4f70d005c877858a5a5201ecb2beb39990 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Sep 2023 21:16:37 +0200
+Subject: tracing: relax trace_event_eval_update() execution with
+ cond_resched()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Léger <cleger@rivosinc.com>
+
+[ Upstream commit 23cce5f25491968b23fb9c399bbfb25f13870cd9 ]
+
+When kernel is compiled without preemption, the eval_map_work_func()
+(which calls trace_event_eval_update()) will not be preempted up to its
+complete execution. This can actually cause a problem since if another
+CPU call stop_machine(), the call will have to wait for the
+eval_map_work_func() function to finish executing in the workqueue
+before being able to be scheduled. This problem was observe on a SMP
+system at boot time, when the CPU calling the initcalls executed
+clocksource_done_booting() which in the end calls stop_machine(). We
+observed a 1 second delay because one CPU was executing
+eval_map_work_func() and was not preempted by the stop_machine() task.
+
+Adding a call to cond_resched() in trace_event_eval_update() allows
+other tasks to be executed and thus continue working asynchronously
+like before without blocking any pending task at boot time.
+
+Link: https://lore.kernel.org/linux-trace-kernel/20230929191637.416931-1-cleger@rivosinc.com
+
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Clément Léger <cleger@rivosinc.com>
+Tested-by: Atish Patra <atishp@rivosinc.com>
+Reviewed-by: Atish Patra <atishp@rivosinc.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_events.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index 321cfda1b3338..c7f0a02442e50 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -2451,6 +2451,7 @@ void trace_event_eval_update(struct trace_eval_map **map, int len)
+ update_event_printk(call, map[i]);
+ }
+ }
++ cond_resched();
+ }
+ up_write(&trace_event_sem);
+ }
+--
+2.40.1
+
--- /dev/null
+From 7267a8fc9eb39f204105016f42c8011166ec53cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Mar 2021 19:42:44 -0800
+Subject: usb: core: Track SuperSpeed Plus GenXxY
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+[ Upstream commit 0299809be415567366b66f248eed93848b8dc9f3 ]
+
+Introduce ssp_rate field to usb_device structure to capture the
+connected SuperSpeed Plus signaling rate generation and lane count with
+the corresponding usb_ssp_rate enum.
+
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/b7805d121e5ae4ad5ae144bd860b6ac04ee47436.1615432770.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: f74a7afc224a ("usb: hub: Guard against accesses to uninitialized BOS descriptors")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/core/hcd.c | 6 +++-
+ drivers/usb/core/hub.c | 78 ++++++++++++++++++++++++++++++++++++++++++
+ include/linux/usb.h | 2 ++
+ 3 files changed, 85 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
+index 63bb04d262d84..0a77717d6af20 100644
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -2745,6 +2745,7 @@ int usb_add_hcd(struct usb_hcd *hcd,
+
+ rhdev->rx_lanes = 1;
+ rhdev->tx_lanes = 1;
++ rhdev->ssp_rate = USB_SSP_GEN_UNKNOWN;
+
+ switch (hcd->speed) {
+ case HCD_USB11:
+@@ -2762,8 +2763,11 @@ int usb_add_hcd(struct usb_hcd *hcd,
+ case HCD_USB32:
+ rhdev->rx_lanes = 2;
+ rhdev->tx_lanes = 2;
+- fallthrough;
++ rhdev->ssp_rate = USB_SSP_GEN_2x2;
++ rhdev->speed = USB_SPEED_SUPER_PLUS;
++ break;
+ case HCD_USB31:
++ rhdev->ssp_rate = USB_SSP_GEN_2x1;
+ rhdev->speed = USB_SPEED_SUPER_PLUS;
+ break;
+ default:
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index b91b01c2c5dee..cfcd4f2ffffaa 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -31,6 +31,7 @@
+ #include <linux/pm_qos.h>
+ #include <linux/kobject.h>
+
++#include <linux/bitfield.h>
+ #include <linux/uaccess.h>
+ #include <asm/byteorder.h>
+
+@@ -2691,6 +2692,81 @@ int usb_authorize_device(struct usb_device *usb_dev)
+ return result;
+ }
+
++/**
++ * get_port_ssp_rate - Match the extended port status to SSP rate
++ * @hdev: The hub device
++ * @ext_portstatus: extended port status
++ *
++ * Match the extended port status speed id to the SuperSpeed Plus sublink speed
++ * capability attributes. Base on the number of connected lanes and speed,
++ * return the corresponding enum usb_ssp_rate.
++ */
++static enum usb_ssp_rate get_port_ssp_rate(struct usb_device *hdev,
++ u32 ext_portstatus)
++{
++ struct usb_ssp_cap_descriptor *ssp_cap = hdev->bos->ssp_cap;
++ u32 attr;
++ u8 speed_id;
++ u8 ssac;
++ u8 lanes;
++ int i;
++
++ if (!ssp_cap)
++ goto out;
++
++ speed_id = ext_portstatus & USB_EXT_PORT_STAT_RX_SPEED_ID;
++ lanes = USB_EXT_PORT_RX_LANES(ext_portstatus) + 1;
++
++ ssac = le32_to_cpu(ssp_cap->bmAttributes) &
++ USB_SSP_SUBLINK_SPEED_ATTRIBS;
++
++ for (i = 0; i <= ssac; i++) {
++ u8 ssid;
++
++ attr = le32_to_cpu(ssp_cap->bmSublinkSpeedAttr[i]);
++ ssid = FIELD_GET(USB_SSP_SUBLINK_SPEED_SSID, attr);
++ if (speed_id == ssid) {
++ u16 mantissa;
++ u8 lse;
++ u8 type;
++
++ /*
++ * Note: currently asymmetric lane types are only
++ * applicable for SSIC operate in SuperSpeed protocol
++ */
++ type = FIELD_GET(USB_SSP_SUBLINK_SPEED_ST, attr);
++ if (type == USB_SSP_SUBLINK_SPEED_ST_ASYM_RX ||
++ type == USB_SSP_SUBLINK_SPEED_ST_ASYM_TX)
++ goto out;
++
++ if (FIELD_GET(USB_SSP_SUBLINK_SPEED_LP, attr) !=
++ USB_SSP_SUBLINK_SPEED_LP_SSP)
++ goto out;
++
++ lse = FIELD_GET(USB_SSP_SUBLINK_SPEED_LSE, attr);
++ mantissa = FIELD_GET(USB_SSP_SUBLINK_SPEED_LSM, attr);
++
++ /* Convert to Gbps */
++ for (; lse < USB_SSP_SUBLINK_SPEED_LSE_GBPS; lse++)
++ mantissa /= 1000;
++
++ if (mantissa >= 10 && lanes == 1)
++ return USB_SSP_GEN_2x1;
++
++ if (mantissa >= 10 && lanes == 2)
++ return USB_SSP_GEN_2x2;
++
++ if (mantissa >= 5 && lanes == 2)
++ return USB_SSP_GEN_1x2;
++
++ goto out;
++ }
++ }
++
++out:
++ return USB_SSP_GEN_UNKNOWN;
++}
++
+ /*
+ * Return 1 if port speed is SuperSpeedPlus, 0 otherwise or if the
+ * capability couldn't be checked.
+@@ -2878,9 +2954,11 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1,
+ /* extended portstatus Rx and Tx lane count are zero based */
+ udev->rx_lanes = USB_EXT_PORT_RX_LANES(ext_portstatus) + 1;
+ udev->tx_lanes = USB_EXT_PORT_TX_LANES(ext_portstatus) + 1;
++ udev->ssp_rate = get_port_ssp_rate(hub->hdev, ext_portstatus);
+ } else {
+ udev->rx_lanes = 1;
+ udev->tx_lanes = 1;
++ udev->ssp_rate = USB_SSP_GEN_UNKNOWN;
+ }
+ if (hub_is_wusb(hub))
+ udev->speed = USB_SPEED_WIRELESS;
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index bc59237727033..8bc1119afc317 100644
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -565,6 +565,7 @@ struct usb3_lpm_parameters {
+ * @speed: device speed: high/full/low (or error)
+ * @rx_lanes: number of rx lanes in use, USB 3.2 adds dual-lane support
+ * @tx_lanes: number of tx lanes in use, USB 3.2 adds dual-lane support
++ * @ssp_rate: SuperSpeed Plus phy signaling rate and lane count
+ * @tt: Transaction Translator info; used with low/full speed dev, highspeed hub
+ * @ttport: device port on that tt hub
+ * @toggle: one bit for each endpoint, with ([0] = IN, [1] = OUT) endpoints
+@@ -642,6 +643,7 @@ struct usb_device {
+ enum usb_device_speed speed;
+ unsigned int rx_lanes;
+ unsigned int tx_lanes;
++ enum usb_ssp_rate ssp_rate;
+
+ struct usb_tt *tt;
+ int ttport;
+--
+2.40.1
+
--- /dev/null
+From cb721ade68a1674d57fd79cc20a7e8a1abfe6fa3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 23:52:01 +0200
+Subject: usb: typec: altmodes/displayport: Notify drm subsys of hotplug events
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 7f811394878535ed9a6849717de8c2959ae38899 ]
+
+Use the new drm_connector_oob_hotplug_event() functions to let drm/kms
+drivers know about DisplayPort over Type-C hotplug events.
+
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Tested-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Link: https://lore.kernel.org/r/20210817215201.795062-9-hdegoede@redhat.com
+Stable-dep-of: 89434b069e46 ("usb: typec: altmodes/displayport: Signal hpd low when exiting mode")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/altmodes/Kconfig | 1 +
+ drivers/usb/typec/altmodes/displayport.c | 23 +++++++++++++++++++++++
+ 2 files changed, 24 insertions(+)
+
+diff --git a/drivers/usb/typec/altmodes/Kconfig b/drivers/usb/typec/altmodes/Kconfig
+index 60d375e9c3c7c..1a6b5e872b0d9 100644
+--- a/drivers/usb/typec/altmodes/Kconfig
++++ b/drivers/usb/typec/altmodes/Kconfig
+@@ -4,6 +4,7 @@ menu "USB Type-C Alternate Mode drivers"
+
+ config TYPEC_DP_ALTMODE
+ tristate "DisplayPort Alternate Mode driver"
++ depends on DRM
+ help
+ DisplayPort USB Type-C Alternate Mode allows DisplayPort
+ displays and adapters to be attached to the USB Type-C
+diff --git a/drivers/usb/typec/altmodes/displayport.c b/drivers/usb/typec/altmodes/displayport.c
+index 0d4b1c0eeefb3..8083d5faf0c98 100644
+--- a/drivers/usb/typec/altmodes/displayport.c
++++ b/drivers/usb/typec/altmodes/displayport.c
+@@ -11,8 +11,10 @@
+ #include <linux/delay.h>
+ #include <linux/mutex.h>
+ #include <linux/module.h>
++#include <linux/property.h>
+ #include <linux/usb/pd_vdo.h>
+ #include <linux/usb/typec_dp.h>
++#include <drm/drm_connector.h>
+ #include "displayport.h"
+
+ #define DP_HEADER(_dp, cmd) (VDO((_dp)->alt->svid, 1, cmd) | \
+@@ -57,11 +59,13 @@ struct dp_altmode {
+ struct typec_displayport_data data;
+
+ enum dp_state state;
++ bool hpd;
+
+ struct mutex lock; /* device lock */
+ struct work_struct work;
+ struct typec_altmode *alt;
+ const struct typec_altmode *port;
++ struct fwnode_handle *connector_fwnode;
+ };
+
+ static int dp_altmode_notify(struct dp_altmode *dp)
+@@ -122,6 +126,7 @@ static int dp_altmode_configure(struct dp_altmode *dp, u8 con)
+ static int dp_altmode_status_update(struct dp_altmode *dp)
+ {
+ bool configured = !!DP_CONF_GET_PIN_ASSIGN(dp->data.conf);
++ bool hpd = !!(dp->data.status & DP_STATUS_HPD_STATE);
+ u8 con = DP_STATUS_CONNECTION(dp->data.status);
+ int ret = 0;
+
+@@ -134,6 +139,11 @@ static int dp_altmode_status_update(struct dp_altmode *dp)
+ ret = dp_altmode_configure(dp, con);
+ if (!ret)
+ dp->state = DP_STATE_CONFIGURE;
++ } else {
++ if (dp->hpd != hpd) {
++ drm_connector_oob_hotplug_event(dp->connector_fwnode);
++ dp->hpd = hpd;
++ }
+ }
+
+ return ret;
+@@ -526,6 +536,7 @@ static const struct attribute_group dp_altmode_group = {
+ int dp_altmode_probe(struct typec_altmode *alt)
+ {
+ const struct typec_altmode *port = typec_altmode_get_partner(alt);
++ struct fwnode_handle *fwnode;
+ struct dp_altmode *dp;
+ int ret;
+
+@@ -554,6 +565,11 @@ int dp_altmode_probe(struct typec_altmode *alt)
+ alt->desc = "DisplayPort";
+ alt->ops = &dp_altmode_ops;
+
++ fwnode = dev_fwnode(alt->dev.parent->parent); /* typec_port fwnode */
++ dp->connector_fwnode = fwnode_find_reference(fwnode, "displayport", 0);
++ if (IS_ERR(dp->connector_fwnode))
++ dp->connector_fwnode = NULL;
++
+ typec_altmode_set_drvdata(alt, dp);
+
+ dp->state = DP_STATE_ENTER;
+@@ -569,6 +585,13 @@ void dp_altmode_remove(struct typec_altmode *alt)
+
+ sysfs_remove_group(&alt->dev.kobj, &dp_altmode_group);
+ cancel_work_sync(&dp->work);
++
++ if (dp->connector_fwnode) {
++ if (dp->hpd)
++ drm_connector_oob_hotplug_event(dp->connector_fwnode);
++
++ fwnode_handle_put(dp->connector_fwnode);
++ }
+ }
+ EXPORT_SYMBOL_GPL(dp_altmode_remove);
+
+--
+2.40.1
+
--- /dev/null
+From 5823fc58db79f5156f75ac75d6880fddebb0cab8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Oct 2023 21:00:58 +0000
+Subject: usb: typec: altmodes/displayport: Signal hpd low when exiting mode
+
+From: RD Babiera <rdbabiera@google.com>
+
+[ Upstream commit 89434b069e460967624903b049e5cf5c9e6b99b9 ]
+
+Upon receiving an ACK for a sent EXIT_MODE message, the DisplayPort
+driver currently resets the status and configuration of the port partner.
+The hpd signal is not updated despite being part of the status, so the
+Display stack can still transmit video despite typec_altmode_exit placing
+the lanes in a Safe State.
+
+Set hpd to low when a sent EXIT_MODE message is ACK'ed.
+
+Fixes: 0e3bb7d6894d ("usb: typec: Add driver for DisplayPort alternate mode")
+Cc: stable@vger.kernel.org
+Signed-off-by: RD Babiera <rdbabiera@google.com>
+Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20231009210057.3773877-2-rdbabiera@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/altmodes/displayport.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/usb/typec/altmodes/displayport.c b/drivers/usb/typec/altmodes/displayport.c
+index 8083d5faf0c98..def903e9d2ab4 100644
+--- a/drivers/usb/typec/altmodes/displayport.c
++++ b/drivers/usb/typec/altmodes/displayport.c
+@@ -285,6 +285,11 @@ static int dp_altmode_vdm(struct typec_altmode *alt,
+ case CMD_EXIT_MODE:
+ dp->data.status = 0;
+ dp->data.conf = 0;
++ if (dp->hpd) {
++ drm_connector_oob_hotplug_event(dp->connector_fwnode);
++ dp->hpd = false;
++ sysfs_notify(&dp->alt->dev.kobj, "displayport", "hpd");
++ }
+ break;
+ case DP_CMD_STATUS_UPDATE:
+ dp->data.status = *vdo;
+--
+2.40.1
+
--- /dev/null
+From 9f72e1d222fbd0bb8afa02f3bf0437061f5cecfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Sep 2023 17:18:56 +0200
+Subject: wifi: cfg80211: avoid leaking stack data into trace
+
+From: Benjamin Berg <benjamin.berg@intel.com>
+
+[ Upstream commit 334bf33eec5701a1e4e967bcb7cc8611a998334b ]
+
+If the structure is not initialized then boolean types might be copied
+into the tracing data without being initialised. This causes data from
+the stack to leak into the trace and also triggers a UBSAN failure which
+can easily be avoided here.
+
+Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
+Link: https://lore.kernel.org/r/20230925171855.a9271ef53b05.I8180bae663984c91a3e036b87f36a640ba409817@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/nl80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index ea36d8c47b31a..0ac829c8f1888 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -7467,7 +7467,7 @@ static int nl80211_update_mesh_config(struct sk_buff *skb,
+ struct cfg80211_registered_device *rdev = info->user_ptr[0];
+ struct net_device *dev = info->user_ptr[1];
+ struct wireless_dev *wdev = dev->ieee80211_ptr;
+- struct mesh_config cfg;
++ struct mesh_config cfg = {};
+ u32 mask;
+ int err;
+
+--
+2.40.1
+
--- /dev/null
+From bb350bc4ee8663a567f60044ee071d1a3f6512eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Sep 2023 14:10:54 +0300
+Subject: wifi: cfg80211: Fix 6GHz scan configuration
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit 0914468adf92296c4cba8a2134e06e3dea150f2e ]
+
+When the scan request includes a non broadcast BSSID, when adding the
+scan parameters for 6GHz collocated scanning, do not include entries
+that do not match the given BSSID.
+
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230918140607.6d31d2a96baf.I6c4e3e3075d1d1878ee41f45190fdc6b86f18708@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/scan.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/wireless/scan.c b/net/wireless/scan.c
+index f59691936e5b8..1e6dfe204ff36 100644
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -875,6 +875,10 @@ static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev)
+ !cfg80211_find_ssid_match(ap, request))
+ continue;
+
++ if (!is_broadcast_ether_addr(request->bssid) &&
++ !ether_addr_equal(request->bssid, ap->bssid))
++ continue;
++
+ if (!request->n_ssids && ap->multi_bss && !ap->transmitted_bssid)
+ continue;
+
+--
+2.40.1
+
--- /dev/null
+From c9dad957a642a340bd70a2407b1c39ae0812d988 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Aug 2023 02:47:51 -0400
+Subject: wifi: mac80211: allow transmitting EAPOL frames with tainted key
+
+From: Wen Gong <quic_wgong@quicinc.com>
+
+[ Upstream commit 61304336c67358d49a989e5e0060d8c99bad6ca8 ]
+
+Lower layer device driver stop/wake TX by calling ieee80211_stop_queue()/
+ieee80211_wake_queue() while hw scan. Sometimes hw scan and PTK rekey are
+running in parallel, when M4 sent from wpa_supplicant arrive while the TX
+queue is stopped, then the M4 will pending send, and then new key install
+from wpa_supplicant. After TX queue wake up by lower layer device driver,
+the M4 will be dropped by below call stack.
+
+When key install started, the current key flag is set KEY_FLAG_TAINTED in
+ieee80211_pairwise_rekey(), and then mac80211 wait key install complete by
+lower layer device driver. Meanwhile ieee80211_tx_h_select_key() will return
+TX_DROP for the M4 in step 12 below, and then ieee80211_free_txskb() called
+by ieee80211_tx_dequeue(), so the M4 will not send and free, then the rekey
+process failed becaue AP not receive M4. Please see details in steps below.
+
+There are a interval between KEY_FLAG_TAINTED set for current key flag and
+install key complete by lower layer device driver, the KEY_FLAG_TAINTED is
+set in this interval, all packet including M4 will be dropped in this
+interval, the interval is step 8~13 as below.
+
+issue steps:
+ TX thread install key thread
+1. stop_queue -idle-
+2. sending M4 -idle-
+3. M4 pending -idle-
+4. -idle- starting install key from wpa_supplicant
+5. -idle- =>ieee80211_key_replace()
+6. -idle- =>ieee80211_pairwise_rekey() and set
+ currently key->flags |= KEY_FLAG_TAINTED
+7. -idle- =>ieee80211_key_enable_hw_accel()
+8. -idle- =>drv_set_key() and waiting key install
+ complete from lower layer device driver
+9. wake_queue -waiting state-
+10. re-sending M4 -waiting state-
+11. =>ieee80211_tx_h_select_key() -waiting state-
+12. drop M4 by KEY_FLAG_TAINTED -waiting state-
+13. -idle- install key complete with success/fail
+ success: clear flag KEY_FLAG_TAINTED
+ fail: start disconnect
+
+Hence add check in step 11 above to allow the EAPOL send out in the
+interval. If lower layer device driver use the old key/cipher to encrypt
+the M4, then AP received/decrypt M4 correctly, after M4 send out, lower
+layer device driver install the new key/cipher to hardware and return
+success.
+
+If lower layer device driver use new key/cipher to send the M4, then AP
+will/should drop the M4, then it is same result with this issue, AP will/
+should kick out station as well as this issue.
+
+issue log:
+kworker/u16:4-5238 [000] 6456.108926: stop_queue: phy1 queue:0, reason:0
+wpa_supplicant-961 [003] 6456.119737: rdev_tx_control_port: wiphy_name=phy1 name=wlan0 ifindex=6 dest=ARRAY[9e, 05, 31, 20, 9b, d0] proto=36488 unencrypted=0
+wpa_supplicant-961 [003] 6456.119839: rdev_return_int_cookie: phy1, returned 0, cookie: 504
+wpa_supplicant-961 [003] 6456.120287: rdev_add_key: phy1, netdev:wlan0(6), key_index: 0, mode: 0, pairwise: true, mac addr: 9e:05:31:20:9b:d0
+wpa_supplicant-961 [003] 6456.120453: drv_set_key: phy1 vif:wlan0(2) sta:9e:05:31:20:9b:d0 cipher:0xfac04, flags=0x9, keyidx=0, hw_key_idx=0
+kworker/u16:9-3829 [001] 6456.168240: wake_queue: phy1 queue:0, reason:0
+kworker/u16:9-3829 [001] 6456.168255: drv_wake_tx_queue: phy1 vif:wlan0(2) sta:9e:05:31:20:9b:d0 ac:0 tid:7
+kworker/u16:9-3829 [001] 6456.168305: cfg80211_control_port_tx_status: wdev(1), cookie: 504, ack: false
+wpa_supplicant-961 [003] 6459.167982: drv_return_int: phy1 - -110
+
+issue call stack:
+nl80211_frame_tx_status+0x230/0x340 [cfg80211]
+cfg80211_control_port_tx_status+0x1c/0x28 [cfg80211]
+ieee80211_report_used_skb+0x374/0x3e8 [mac80211]
+ieee80211_free_txskb+0x24/0x40 [mac80211]
+ieee80211_tx_dequeue+0x644/0x954 [mac80211]
+ath10k_mac_tx_push_txq+0xac/0x238 [ath10k_core]
+ath10k_mac_op_wake_tx_queue+0xac/0xe0 [ath10k_core]
+drv_wake_tx_queue+0x80/0x168 [mac80211]
+__ieee80211_wake_txqs+0xe8/0x1c8 [mac80211]
+_ieee80211_wake_txqs+0xb4/0x120 [mac80211]
+ieee80211_wake_txqs+0x48/0x80 [mac80211]
+tasklet_action_common+0xa8/0x254
+tasklet_action+0x2c/0x38
+__do_softirq+0xdc/0x384
+
+Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
+Link: https://lore.kernel.org/r/20230801064751.25803-1-quic_wgong@quicinc.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/tx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index bbbcc678c655c..788b6a3c14191 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -656,7 +656,8 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
+ }
+
+ if (unlikely(tx->key && tx->key->flags & KEY_FLAG_TAINTED &&
+- !ieee80211_is_deauth(hdr->frame_control)))
++ !ieee80211_is_deauth(hdr->frame_control)) &&
++ tx->skb->protocol != tx->sdata->control_port_protocol)
+ return TX_DROP;
+
+ if (!skip_hw && tx->key &&
+--
+2.40.1
+
--- /dev/null
+From c3559786f5cbe6dabd18f21e9a833751749865d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 17:04:59 +0200
+Subject: xhci: cleanup xhci_hub_control port references
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+[ Upstream commit faaae0190dcd1e230616c85bbc3b339f27ba5b81 ]
+
+Both port number and port structure of a port are referred to several
+times when handing hub requests in xhci.
+
+Use more suitable data types and readable names for these.
+Cleanup only, no functional changes
+
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20230202150505.618915-6-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-hub.c | 123 ++++++++++++++++++------------------
+ 1 file changed, 63 insertions(+), 60 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 7bb3067418076..c2a8d455eeace 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -1108,11 +1108,14 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ u16 test_mode = 0;
+ struct xhci_hub *rhub;
+ struct xhci_port **ports;
++ struct xhci_port *port;
++ int portnum1;
+
+ rhub = xhci_get_rhub(hcd);
+ ports = rhub->ports;
+ max_ports = rhub->num_ports;
+ bus_state = &rhub->bus_state;
++ portnum1 = wIndex & 0xff;
+
+ spin_lock_irqsave(&xhci->lock, flags);
+ switch (typeReq) {
+@@ -1146,10 +1149,12 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ spin_unlock_irqrestore(&xhci->lock, flags);
+ return retval;
+ case GetPortStatus:
+- if (!wIndex || wIndex > max_ports)
++ if (!portnum1 || portnum1 > max_ports)
+ goto error;
++
+ wIndex--;
+- temp = readl(ports[wIndex]->addr);
++ port = ports[portnum1 - 1];
++ temp = readl(port->addr);
+ if (temp == ~(u32)0) {
+ xhci_hc_died(xhci);
+ retval = -ENODEV;
+@@ -1162,7 +1167,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ goto error;
+
+ xhci_dbg(xhci, "Get port status %d-%d read: 0x%x, return 0x%x",
+- hcd->self.busnum, wIndex + 1, temp, status);
++ hcd->self.busnum, portnum1, temp, status);
+
+ put_unaligned(cpu_to_le32(status), (__le32 *) buf);
+ /* if USB 3.1 extended port status return additional 4 bytes */
+@@ -1174,7 +1179,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ retval = -EINVAL;
+ break;
+ }
+- port_li = readl(ports[wIndex]->addr + PORTLI);
++ port_li = readl(port->addr + PORTLI);
+ status = xhci_get_ext_port_status(temp, port_li);
+ put_unaligned_le32(status, &buf[4]);
+ }
+@@ -1188,11 +1193,14 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ test_mode = (wIndex & 0xff00) >> 8;
+ /* The MSB of wIndex is the U1/U2 timeout */
+ timeout = (wIndex & 0xff00) >> 8;
++
+ wIndex &= 0xff;
+- if (!wIndex || wIndex > max_ports)
++ if (!portnum1 || portnum1 > max_ports)
+ goto error;
++
++ port = ports[portnum1 - 1];
+ wIndex--;
+- temp = readl(ports[wIndex]->addr);
++ temp = readl(port->addr);
+ if (temp == ~(u32)0) {
+ xhci_hc_died(xhci);
+ retval = -ENODEV;
+@@ -1202,11 +1210,10 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ /* FIXME: What new port features do we need to support? */
+ switch (wValue) {
+ case USB_PORT_FEAT_SUSPEND:
+- temp = readl(ports[wIndex]->addr);
++ temp = readl(port->addr);
+ if ((temp & PORT_PLS_MASK) != XDEV_U0) {
+ /* Resume the port to U0 first */
+- xhci_set_link_state(xhci, ports[wIndex],
+- XDEV_U0);
++ xhci_set_link_state(xhci, port, XDEV_U0);
+ spin_unlock_irqrestore(&xhci->lock, flags);
+ msleep(10);
+ spin_lock_irqsave(&xhci->lock, flags);
+@@ -1215,16 +1222,16 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ * a port unless the port reports that it is in the
+ * enabled (PED = ‘1’,PLS < ‘3’) state.
+ */
+- temp = readl(ports[wIndex]->addr);
++ temp = readl(port->addr);
+ if ((temp & PORT_PE) == 0 || (temp & PORT_RESET)
+ || (temp & PORT_PLS_MASK) >= XDEV_U3) {
+ xhci_warn(xhci, "USB core suspending port %d-%d not in U0/U1/U2\n",
+- hcd->self.busnum, wIndex + 1);
++ hcd->self.busnum, portnum1);
+ goto error;
+ }
+
+ slot_id = xhci_find_slot_id_by_port(hcd, xhci,
+- wIndex + 1);
++ portnum1);
+ if (!slot_id) {
+ xhci_warn(xhci, "slot_id is zero\n");
+ goto error;
+@@ -1234,21 +1241,21 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ xhci_stop_device(xhci, slot_id, 1);
+ spin_lock_irqsave(&xhci->lock, flags);
+
+- xhci_set_link_state(xhci, ports[wIndex], XDEV_U3);
++ xhci_set_link_state(xhci, port, XDEV_U3);
+
+ spin_unlock_irqrestore(&xhci->lock, flags);
+ msleep(10); /* wait device to enter */
+ spin_lock_irqsave(&xhci->lock, flags);
+
+- temp = readl(ports[wIndex]->addr);
++ temp = readl(port->addr);
+ bus_state->suspended_ports |= 1 << wIndex;
+ break;
+ case USB_PORT_FEAT_LINK_STATE:
+- temp = readl(ports[wIndex]->addr);
++ temp = readl(port->addr);
+ /* Disable port */
+ if (link_state == USB_SS_PORT_LS_SS_DISABLED) {
+ xhci_dbg(xhci, "Disable port %d-%d\n",
+- hcd->self.busnum, wIndex + 1);
++ hcd->self.busnum, portnum1);
+ temp = xhci_port_state_to_neutral(temp);
+ /*
+ * Clear all change bits, so that we get a new
+@@ -1257,18 +1264,17 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ temp |= PORT_CSC | PORT_PEC | PORT_WRC |
+ PORT_OCC | PORT_RC | PORT_PLC |
+ PORT_CEC;
+- writel(temp | PORT_PE, ports[wIndex]->addr);
+- temp = readl(ports[wIndex]->addr);
++ writel(temp | PORT_PE, port->addr);
++ temp = readl(port->addr);
+ break;
+ }
+
+ /* Put link in RxDetect (enable port) */
+ if (link_state == USB_SS_PORT_LS_RX_DETECT) {
+ xhci_dbg(xhci, "Enable port %d-%d\n",
+- hcd->self.busnum, wIndex + 1);
+- xhci_set_link_state(xhci, ports[wIndex],
+- link_state);
+- temp = readl(ports[wIndex]->addr);
++ hcd->self.busnum, portnum1);
++ xhci_set_link_state(xhci, port, link_state);
++ temp = readl(port->addr);
+ break;
+ }
+
+@@ -1298,11 +1304,10 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ }
+
+ xhci_dbg(xhci, "Enable compliance mode transition for port %d-%d\n",
+- hcd->self.busnum, wIndex + 1);
+- xhci_set_link_state(xhci, ports[wIndex],
+- link_state);
++ hcd->self.busnum, portnum1);
++ xhci_set_link_state(xhci, port, link_state);
+
+- temp = readl(ports[wIndex]->addr);
++ temp = readl(port->addr);
+ break;
+ }
+ /* Port must be enabled */
+@@ -1313,8 +1318,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ /* Can't set port link state above '3' (U3) */
+ if (link_state > USB_SS_PORT_LS_U3) {
+ xhci_warn(xhci, "Cannot set port %d-%d link state %d\n",
+- hcd->self.busnum, wIndex + 1,
+- link_state);
++ hcd->self.busnum, portnum1, link_state);
+ goto error;
+ }
+
+@@ -1339,8 +1343,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ reinit_completion(&bus_state->u3exit_done[wIndex]);
+ }
+ if (pls <= XDEV_U3) /* U1, U2, U3 */
+- xhci_set_link_state(xhci, ports[wIndex],
+- USB_SS_PORT_LS_U0);
++ xhci_set_link_state(xhci, port, USB_SS_PORT_LS_U0);
+ if (!wait_u0) {
+ if (pls > XDEV_U3)
+ goto error;
+@@ -1350,16 +1353,16 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ if (!wait_for_completion_timeout(&bus_state->u3exit_done[wIndex],
+ msecs_to_jiffies(500)))
+ xhci_dbg(xhci, "missing U0 port change event for port %d-%d\n",
+- hcd->self.busnum, wIndex + 1);
++ hcd->self.busnum, portnum1);
+ spin_lock_irqsave(&xhci->lock, flags);
+- temp = readl(ports[wIndex]->addr);
++ temp = readl(port->addr);
+ break;
+ }
+
+ if (link_state == USB_SS_PORT_LS_U3) {
+ int retries = 16;
+ slot_id = xhci_find_slot_id_by_port(hcd, xhci,
+- wIndex + 1);
++ portnum1);
+ if (slot_id) {
+ /* unlock to execute stop endpoint
+ * commands */
+@@ -1368,16 +1371,16 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ xhci_stop_device(xhci, slot_id, 1);
+ spin_lock_irqsave(&xhci->lock, flags);
+ }
+- xhci_set_link_state(xhci, ports[wIndex], USB_SS_PORT_LS_U3);
++ xhci_set_link_state(xhci, port, USB_SS_PORT_LS_U3);
+ spin_unlock_irqrestore(&xhci->lock, flags);
+ while (retries--) {
+ usleep_range(4000, 8000);
+- temp = readl(ports[wIndex]->addr);
++ temp = readl(port->addr);
+ if ((temp & PORT_PLS_MASK) == XDEV_U3)
+ break;
+ }
+ spin_lock_irqsave(&xhci->lock, flags);
+- temp = readl(ports[wIndex]->addr);
++ temp = readl(port->addr);
+ bus_state->suspended_ports |= 1 << wIndex;
+ }
+ break;
+@@ -1392,39 +1395,38 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ break;
+ case USB_PORT_FEAT_RESET:
+ temp = (temp | PORT_RESET);
+- writel(temp, ports[wIndex]->addr);
++ writel(temp, port->addr);
+
+- temp = readl(ports[wIndex]->addr);
++ temp = readl(port->addr);
+ xhci_dbg(xhci, "set port reset, actual port %d-%d status = 0x%x\n",
+- hcd->self.busnum, wIndex + 1, temp);
++ hcd->self.busnum, portnum1, temp);
+ break;
+ case USB_PORT_FEAT_REMOTE_WAKE_MASK:
+- xhci_set_remote_wake_mask(xhci, ports[wIndex],
+- wake_mask);
+- temp = readl(ports[wIndex]->addr);
++ xhci_set_remote_wake_mask(xhci, port, wake_mask);
++ temp = readl(port->addr);
+ xhci_dbg(xhci, "set port remote wake mask, actual port %d-%d status = 0x%x\n",
+- hcd->self.busnum, wIndex + 1, temp);
++ hcd->self.busnum, portnum1, temp);
+ break;
+ case USB_PORT_FEAT_BH_PORT_RESET:
+ temp |= PORT_WR;
+- writel(temp, ports[wIndex]->addr);
+- temp = readl(ports[wIndex]->addr);
++ writel(temp, port->addr);
++ temp = readl(port->addr);
+ break;
+ case USB_PORT_FEAT_U1_TIMEOUT:
+ if (hcd->speed < HCD_USB3)
+ goto error;
+- temp = readl(ports[wIndex]->addr + PORTPMSC);
++ temp = readl(port->addr + PORTPMSC);
+ temp &= ~PORT_U1_TIMEOUT_MASK;
+ temp |= PORT_U1_TIMEOUT(timeout);
+- writel(temp, ports[wIndex]->addr + PORTPMSC);
++ writel(temp, port->addr + PORTPMSC);
+ break;
+ case USB_PORT_FEAT_U2_TIMEOUT:
+ if (hcd->speed < HCD_USB3)
+ goto error;
+- temp = readl(ports[wIndex]->addr + PORTPMSC);
++ temp = readl(port->addr + PORTPMSC);
+ temp &= ~PORT_U2_TIMEOUT_MASK;
+ temp |= PORT_U2_TIMEOUT(timeout);
+- writel(temp, ports[wIndex]->addr + PORTPMSC);
++ writel(temp, port->addr + PORTPMSC);
+ break;
+ case USB_PORT_FEAT_TEST:
+ /* 4.19.6 Port Test Modes (USB2 Test Mode) */
+@@ -1440,13 +1442,16 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ goto error;
+ }
+ /* unblock any posted writes */
+- temp = readl(ports[wIndex]->addr);
++ temp = readl(port->addr);
+ break;
+ case ClearPortFeature:
+- if (!wIndex || wIndex > max_ports)
++ if (!portnum1 || portnum1 > max_ports)
+ goto error;
++
++ port = ports[portnum1 - 1];
++
+ wIndex--;
+- temp = readl(ports[wIndex]->addr);
++ temp = readl(port->addr);
+ if (temp == ~(u32)0) {
+ xhci_hc_died(xhci);
+ retval = -ENODEV;
+@@ -1456,7 +1461,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ temp = xhci_port_state_to_neutral(temp);
+ switch (wValue) {
+ case USB_PORT_FEAT_SUSPEND:
+- temp = readl(ports[wIndex]->addr);
++ temp = readl(port->addr);
+ xhci_dbg(xhci, "clear USB_PORT_FEAT_SUSPEND\n");
+ xhci_dbg(xhci, "PORTSC %04x\n", temp);
+ if (temp & PORT_RESET)
+@@ -1467,20 +1472,18 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+
+ set_bit(wIndex, &bus_state->resuming_ports);
+ usb_hcd_start_port_resume(&hcd->self, wIndex);
+- xhci_set_link_state(xhci, ports[wIndex],
+- XDEV_RESUME);
++ xhci_set_link_state(xhci, port, XDEV_RESUME);
+ spin_unlock_irqrestore(&xhci->lock, flags);
+ msleep(USB_RESUME_TIMEOUT);
+ spin_lock_irqsave(&xhci->lock, flags);
+- xhci_set_link_state(xhci, ports[wIndex],
+- XDEV_U0);
++ xhci_set_link_state(xhci, port, XDEV_U0);
+ clear_bit(wIndex, &bus_state->resuming_ports);
+ usb_hcd_end_port_resume(&hcd->self, wIndex);
+ }
+ bus_state->port_c_suspend |= 1 << wIndex;
+
+ slot_id = xhci_find_slot_id_by_port(hcd, xhci,
+- wIndex + 1);
++ portnum1);
+ if (!slot_id) {
+ xhci_dbg(xhci, "slot_id is zero\n");
+ goto error;
+@@ -1498,11 +1501,11 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ case USB_PORT_FEAT_C_PORT_LINK_STATE:
+ case USB_PORT_FEAT_C_PORT_CONFIG_ERROR:
+ xhci_clear_port_change_bit(xhci, wValue, wIndex,
+- ports[wIndex]->addr, temp);
++ port->addr, temp);
+ break;
+ case USB_PORT_FEAT_ENABLE:
+ xhci_disable_port(hcd, xhci, wIndex,
+- ports[wIndex]->addr, temp);
++ port->addr, temp);
+ break;
+ case USB_PORT_FEAT_POWER:
+ xhci_set_port_power(xhci, hcd, wIndex, false, &flags);
+--
+2.40.1
+
--- /dev/null
+From 4f6f11392db2f4cf07d2f8ab46768c676e1cfce6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 17:05:04 +0200
+Subject: xhci: clear usb2 resume related variables in one place.
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+[ Upstream commit 0e6275452ce26d7ff274a5c1b15ed581a26f7986 ]
+
+Initially resume related USB2 variables were cleared once port
+successfully resumed to U0. Later code was added to clean up
+stale resume variables in case of port failed to resume to U0.
+
+Clear the variables in one place after port is no longer resuming
+or in suspended U3 state.
+
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20230202150505.618915-11-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-hub.c | 38 ++++++++++++++++---------------------
+ 1 file changed, 16 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 39c58b1782d5c..0aac8fcd37798 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -985,7 +985,6 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
+ struct xhci_bus_state *bus_state;
+ u32 link_state;
+ u32 portnum;
+- int ret;
+
+ bus_state = &port->rhub->bus_state;
+ link_state = portsc & PORT_PLS_MASK;
+@@ -1001,23 +1000,30 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
+ if (link_state == XDEV_U2)
+ *status |= USB_PORT_STAT_L1;
+ if (link_state == XDEV_U0) {
+- if (port->resume_timestamp)
+- usb_hcd_end_port_resume(&port->rhub->hcd->self,
+- portnum);
+- port->resume_timestamp = 0;
+- clear_bit(portnum, &bus_state->resuming_ports);
+ if (bus_state->suspended_ports & (1 << portnum)) {
+ bus_state->suspended_ports &= ~(1 << portnum);
+ bus_state->port_c_suspend |= 1 << portnum;
+ }
+ }
+ if (link_state == XDEV_RESUME) {
+- ret = xhci_handle_usb2_port_link_resume(port, status,
+- portsc, flags);
+- if (ret)
+- return;
++ xhci_handle_usb2_port_link_resume(port, status, portsc,
++ flags);
+ }
+ }
++
++ /*
++ * Clear usb2 resume signalling variables if port is no longer suspended
++ * or resuming. Port either resumed to U0/U1/U2, disconnected, or in a
++ * error state. Resume related variables should be cleared in all those cases.
++ */
++ if ((link_state != XDEV_U3 &&
++ link_state != XDEV_RESUME) &&
++ (port->resume_timestamp ||
++ test_bit(portnum, &bus_state->resuming_ports))) {
++ port->resume_timestamp = 0;
++ clear_bit(portnum, &bus_state->resuming_ports);
++ usb_hcd_end_port_resume(&port->rhub->hcd->self, portnum);
++ }
+ }
+
+ /*
+@@ -1072,18 +1078,6 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ else
+ xhci_get_usb2_port_status(port, &status, raw_port_status,
+ flags);
+- /*
+- * Clear stale usb2 resume signalling variables in case port changed
+- * state during resume signalling. For example on error
+- */
+- if ((port->resume_timestamp ||
+- test_bit(wIndex, &bus_state->resuming_ports)) &&
+- (raw_port_status & PORT_PLS_MASK) != XDEV_U3 &&
+- (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) {
+- port->resume_timestamp = 0;
+- clear_bit(wIndex, &bus_state->resuming_ports);
+- usb_hcd_end_port_resume(&hcd->self, wIndex);
+- }
+
+ if (bus_state->port_c_suspend & (1 << wIndex))
+ status |= USB_PORT_STAT_C_SUSPEND << 16;
+--
+2.40.1
+
--- /dev/null
+From 930c614c25fbc8c9c2b21b5544fd15fcc0161436 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 17:05:05 +0200
+Subject: xhci: decouple usb2 port resume and get_port_status request handling
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+[ Upstream commit b0425784b942fffbbdb804896197f1dbccda37c5 ]
+
+The get port status hub request code in xhci-hub.c will complete usb2
+port resume signalling if signalling has been going on for long enough.
+
+The code that completes the resume signalling, and the code that returns
+the port status have gotten too intertwined, so separate them a bit.
+
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20230202150505.618915-12-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-hub.c | 47 ++++++++++++++++++++-----------------
+ 1 file changed, 25 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 0aac8fcd37798..b8dad0a3aab39 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -819,7 +819,7 @@ static void xhci_del_comp_mod_timer(struct xhci_hcd *xhci, u32 status,
+ }
+
+ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
+- u32 *status, u32 portsc,
++ u32 portsc,
+ unsigned long *flags)
+ {
+ struct xhci_bus_state *bus_state;
+@@ -834,7 +834,6 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
+ wIndex = port->hcd_portnum;
+
+ if ((portsc & PORT_RESET) || !(portsc & PORT_PE)) {
+- *status = 0xffffffff;
+ return -EINVAL;
+ }
+ /* did port event handler already start resume timing? */
+@@ -868,6 +867,8 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
+
+ port->resume_timestamp = 0;
+ clear_bit(wIndex, &bus_state->resuming_ports);
++
++ reinit_completion(&port->rexit_done);
+ port->rexit_active = true;
+
+ xhci_test_and_clear_bit(xhci, port, PORT_PLC);
+@@ -884,7 +885,6 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
+ wIndex + 1);
+ if (!slot_id) {
+ xhci_dbg(xhci, "slot_id is zero\n");
+- *status = 0xffffffff;
+ return -ENODEV;
+ }
+ xhci_ring_device(xhci, slot_id);
+@@ -893,22 +893,19 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
+
+ xhci_warn(xhci, "Port resume timed out, port %d-%d: 0x%x\n",
+ hcd->self.busnum, wIndex + 1, port_status);
+- *status |= USB_PORT_STAT_SUSPEND;
+- port->rexit_active = false;
++ /*
++ * keep rexit_active set if U0 transition failed so we
++ * know to report PORT_STAT_SUSPEND status back to
++ * usbcore. It will be cleared later once the port is
++ * out of RESUME/U3 state
++ */
+ }
+
+ usb_hcd_end_port_resume(&hcd->self, wIndex);
+ bus_state->port_c_suspend |= 1 << wIndex;
+ bus_state->suspended_ports &= ~(1 << wIndex);
+- } else {
+- /*
+- * The resume has been signaling for less than
+- * USB_RESUME_TIME. Report the port status as SUSPEND,
+- * let the usbcore check port status again and clear
+- * resume signaling later.
+- */
+- *status |= USB_PORT_STAT_SUSPEND;
+ }
++
+ return 0;
+ }
+
+@@ -985,6 +982,7 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
+ struct xhci_bus_state *bus_state;
+ u32 link_state;
+ u32 portnum;
++ int err;
+
+ bus_state = &port->rhub->bus_state;
+ link_state = portsc & PORT_PLS_MASK;
+@@ -1006,8 +1004,12 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
+ }
+ }
+ if (link_state == XDEV_RESUME) {
+- xhci_handle_usb2_port_link_resume(port, status, portsc,
+- flags);
++ err = xhci_handle_usb2_port_link_resume(port, portsc,
++ flags);
++ if (err < 0)
++ *status = 0xffffffff;
++ else if (port->resume_timestamp || port->rexit_active)
++ *status |= USB_PORT_STAT_SUSPEND;
+ }
+ }
+
+@@ -1016,13 +1018,14 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
+ * or resuming. Port either resumed to U0/U1/U2, disconnected, or in a
+ * error state. Resume related variables should be cleared in all those cases.
+ */
+- if ((link_state != XDEV_U3 &&
+- link_state != XDEV_RESUME) &&
+- (port->resume_timestamp ||
+- test_bit(portnum, &bus_state->resuming_ports))) {
+- port->resume_timestamp = 0;
+- clear_bit(portnum, &bus_state->resuming_ports);
+- usb_hcd_end_port_resume(&port->rhub->hcd->self, portnum);
++ if (link_state != XDEV_U3 && link_state != XDEV_RESUME) {
++ if (port->resume_timestamp ||
++ test_bit(portnum, &bus_state->resuming_ports)) {
++ port->resume_timestamp = 0;
++ clear_bit(portnum, &bus_state->resuming_ports);
++ usb_hcd_end_port_resume(&port->rhub->hcd->self, portnum);
++ }
++ port->rexit_active = 0;
+ }
+ }
+
+--
+2.40.1
+
--- /dev/null
+From d6545c8cb825946f14ce3f9fa6742248c1d522b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 17:05:01 +0200
+Subject: xhci: move port specific items such as state completions to port
+ structure
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+[ Upstream commit 2996e9fc00c378987c18ecbafe5624581b18c0d6 ]
+
+Now that we have a port structure for each port it makes sense to
+move per port variables, timestamps and completions there.
+Get rid of storing bitfileds and arrays of port specific items per bus.
+
+Move
+unsigned long resume_done;
+insigned long rexit_ports
+struct completion rexit_done;
+struct completion u3exit_done;
+
+Rename rexit_ports to rexit_active, and remove a redundant hcd
+speed check while checking if rexit_active is set.
+
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20230202150505.618915-8-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-hub.c | 31 +++++++++++++++----------------
+ drivers/usb/host/xhci-mem.c | 10 +++-------
+ drivers/usb/host/xhci-ring.c | 13 ++++++-------
+ drivers/usb/host/xhci.h | 9 ++++-----
+ 4 files changed, 28 insertions(+), 35 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index c2a8d455eeace..f836710bcd6e6 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -838,7 +838,7 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
+ return -EINVAL;
+ }
+ /* did port event handler already start resume timing? */
+- if (!bus_state->resume_done[wIndex]) {
++ if (!port->resume_done) {
+ /* If not, maybe we are in a host initated resume? */
+ if (test_bit(wIndex, &bus_state->resuming_ports)) {
+ /* Host initated resume doesn't time the resume
+@@ -855,28 +855,27 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
+ msecs_to_jiffies(USB_RESUME_TIMEOUT);
+
+ set_bit(wIndex, &bus_state->resuming_ports);
+- bus_state->resume_done[wIndex] = timeout;
++ port->resume_done = timeout;
+ mod_timer(&hcd->rh_timer, timeout);
+ usb_hcd_start_port_resume(&hcd->self, wIndex);
+ }
+ /* Has resume been signalled for USB_RESUME_TIME yet? */
+- } else if (time_after_eq(jiffies, bus_state->resume_done[wIndex])) {
++ } else if (time_after_eq(jiffies, port->resume_done)) {
+ int time_left;
+
+ xhci_dbg(xhci, "resume USB2 port %d-%d\n",
+ hcd->self.busnum, wIndex + 1);
+
+- bus_state->resume_done[wIndex] = 0;
++ port->resume_done = 0;
+ clear_bit(wIndex, &bus_state->resuming_ports);
+-
+- set_bit(wIndex, &bus_state->rexit_ports);
++ port->rexit_active = true;
+
+ xhci_test_and_clear_bit(xhci, port, PORT_PLC);
+ xhci_set_link_state(xhci, port, XDEV_U0);
+
+ spin_unlock_irqrestore(&xhci->lock, *flags);
+ time_left = wait_for_completion_timeout(
+- &bus_state->rexit_done[wIndex],
++ &port->rexit_done,
+ msecs_to_jiffies(XHCI_MAX_REXIT_TIMEOUT_MS));
+ spin_lock_irqsave(&xhci->lock, *flags);
+
+@@ -895,7 +894,7 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
+ xhci_warn(xhci, "Port resume timed out, port %d-%d: 0x%x\n",
+ hcd->self.busnum, wIndex + 1, port_status);
+ *status |= USB_PORT_STAT_SUSPEND;
+- clear_bit(wIndex, &bus_state->rexit_ports);
++ port->rexit_active = false;
+ }
+
+ usb_hcd_end_port_resume(&hcd->self, wIndex);
+@@ -1002,10 +1001,10 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
+ if (link_state == XDEV_U2)
+ *status |= USB_PORT_STAT_L1;
+ if (link_state == XDEV_U0) {
+- if (bus_state->resume_done[portnum])
++ if (port->resume_done)
+ usb_hcd_end_port_resume(&port->rhub->hcd->self,
+ portnum);
+- bus_state->resume_done[portnum] = 0;
++ port->resume_done = 0;
+ clear_bit(portnum, &bus_state->resuming_ports);
+ if (bus_state->suspended_ports & (1 << portnum)) {
+ bus_state->suspended_ports &= ~(1 << portnum);
+@@ -1077,11 +1076,11 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ * Clear stale usb2 resume signalling variables in case port changed
+ * state during resume signalling. For example on error
+ */
+- if ((bus_state->resume_done[wIndex] ||
++ if ((port->resume_done ||
+ test_bit(wIndex, &bus_state->resuming_ports)) &&
+ (raw_port_status & PORT_PLS_MASK) != XDEV_U3 &&
+ (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) {
+- bus_state->resume_done[wIndex] = 0;
++ port->resume_done = 0;
+ clear_bit(wIndex, &bus_state->resuming_ports);
+ usb_hcd_end_port_resume(&hcd->self, wIndex);
+ }
+@@ -1340,7 +1339,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ pls == XDEV_RESUME ||
+ pls == XDEV_RECOVERY) {
+ wait_u0 = true;
+- reinit_completion(&bus_state->u3exit_done[wIndex]);
++ reinit_completion(&port->u3exit_done);
+ }
+ if (pls <= XDEV_U3) /* U1, U2, U3 */
+ xhci_set_link_state(xhci, port, USB_SS_PORT_LS_U0);
+@@ -1350,7 +1349,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ break;
+ }
+ spin_unlock_irqrestore(&xhci->lock, flags);
+- if (!wait_for_completion_timeout(&bus_state->u3exit_done[wIndex],
++ if (!wait_for_completion_timeout(&port->u3exit_done,
+ msecs_to_jiffies(500)))
+ xhci_dbg(xhci, "missing U0 port change event for port %d-%d\n",
+ hcd->self.busnum, portnum1);
+@@ -1589,8 +1588,8 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
+
+ if ((temp & mask) != 0 ||
+ (bus_state->port_c_suspend & 1 << i) ||
+- (bus_state->resume_done[i] && time_after_eq(
+- jiffies, bus_state->resume_done[i]))) {
++ (ports[i]->resume_done && time_after_eq(
++ jiffies, ports[i]->resume_done))) {
+ buf[(i + 1) / 8] |= 1 << (i + 1) % 8;
+ status = 1;
+ }
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 390bdf823e088..006e1b15fbda9 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -2336,6 +2336,9 @@ static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags)
+ xhci->hw_ports[i].addr = &xhci->op_regs->port_status_base +
+ NUM_PORT_REGS * i;
+ xhci->hw_ports[i].hw_portnum = i;
++
++ init_completion(&xhci->hw_ports[i].rexit_done);
++ init_completion(&xhci->hw_ports[i].u3exit_done);
+ }
+
+ xhci->rh_bw = kcalloc_node(num_ports, sizeof(*xhci->rh_bw), flags,
+@@ -2603,13 +2606,6 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
+ */
+ for (i = 0; i < MAX_HC_SLOTS; i++)
+ xhci->devs[i] = NULL;
+- for (i = 0; i < USB_MAXCHILDREN; i++) {
+- xhci->usb2_rhub.bus_state.resume_done[i] = 0;
+- xhci->usb3_rhub.bus_state.resume_done[i] = 0;
+- /* Only the USB 2.0 completions will ever be used. */
+- init_completion(&xhci->usb2_rhub.bus_state.rexit_done[i]);
+- init_completion(&xhci->usb3_rhub.bus_state.u3exit_done[i]);
+- }
+
+ if (scratchpad_alloc(xhci, flags))
+ goto fail;
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 248bfa3020de3..ada9977c41aa9 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1851,7 +1851,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ goto cleanup;
+ } else if (!test_bit(hcd_portnum, &bus_state->resuming_ports)) {
+ xhci_dbg(xhci, "resume HS port %d\n", port_id);
+- bus_state->resume_done[hcd_portnum] = jiffies +
++ port->resume_done = jiffies +
+ msecs_to_jiffies(USB_RESUME_TIMEOUT);
+ set_bit(hcd_portnum, &bus_state->resuming_ports);
+ /* Do the rest in GetPortStatus after resume time delay.
+@@ -1860,7 +1860,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ */
+ set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+ mod_timer(&hcd->rh_timer,
+- bus_state->resume_done[hcd_portnum]);
++ port->resume_done);
+ usb_hcd_start_port_resume(&hcd->self, hcd_portnum);
+ bogus_port_status = true;
+ }
+@@ -1872,7 +1872,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ (portsc & PORT_PLS_MASK) == XDEV_U1 ||
+ (portsc & PORT_PLS_MASK) == XDEV_U2)) {
+ xhci_dbg(xhci, "resume SS port %d finished\n", port_id);
+- complete(&bus_state->u3exit_done[hcd_portnum]);
++ complete(&port->u3exit_done);
+ /* We've just brought the device into U0/1/2 through either the
+ * Resume state after a device remote wakeup, or through the
+ * U3Exit state after a host-initiated resume. If it's a device
+@@ -1897,10 +1897,9 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ * RExit to a disconnect state). If so, let the the driver know it's
+ * out of the RExit state.
+ */
+- if (!DEV_SUPERSPEED_ANY(portsc) && hcd->speed < HCD_USB3 &&
+- test_and_clear_bit(hcd_portnum,
+- &bus_state->rexit_ports)) {
+- complete(&bus_state->rexit_done[hcd_portnum]);
++ if (hcd->speed < HCD_USB3 && port->rexit_active) {
++ complete(&port->rexit_done);
++ port->rexit_active = false;
+ bogus_port_status = true;
+ goto cleanup;
+ }
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 6a7c05940e661..14eb13a85fce3 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1699,13 +1699,8 @@ struct xhci_bus_state {
+ u32 port_c_suspend;
+ u32 suspended_ports;
+ u32 port_remote_wakeup;
+- unsigned long resume_done[USB_MAXCHILDREN];
+ /* which ports have started to resume */
+ unsigned long resuming_ports;
+- /* Which ports are waiting on RExit to U0 transition. */
+- unsigned long rexit_ports;
+- struct completion rexit_done[USB_MAXCHILDREN];
+- struct completion u3exit_done[USB_MAXCHILDREN];
+ };
+
+
+@@ -1729,6 +1724,10 @@ struct xhci_port {
+ struct xhci_hub *rhub;
+ struct xhci_port_cap *port_cap;
+ unsigned int lpm_incapable:1;
++ unsigned long resume_done;
++ bool rexit_active;
++ struct completion rexit_done;
++ struct completion u3exit_done;
+ };
+
+ struct xhci_hub {
+--
+2.40.1
+
--- /dev/null
+From 5d580a3811bd9251f86a320011fc73e6b8a8df9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 17:05:03 +0200
+Subject: xhci: rename resume_done to resume_timestamp
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+[ Upstream commit a909d629ae77b97b6288bc3cfe68560454bf79c6 ]
+
+resume_done is just a timestamp, avoid confusing it with completions
+related to port state transitions that are named *_done
+
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20230202150505.618915-10-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-hub.c | 20 ++++++++++----------
+ drivers/usb/host/xhci-ring.c | 4 ++--
+ drivers/usb/host/xhci.h | 2 +-
+ 3 files changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index f836710bcd6e6..39c58b1782d5c 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -838,7 +838,7 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
+ return -EINVAL;
+ }
+ /* did port event handler already start resume timing? */
+- if (!port->resume_done) {
++ if (!port->resume_timestamp) {
+ /* If not, maybe we are in a host initated resume? */
+ if (test_bit(wIndex, &bus_state->resuming_ports)) {
+ /* Host initated resume doesn't time the resume
+@@ -855,18 +855,18 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
+ msecs_to_jiffies(USB_RESUME_TIMEOUT);
+
+ set_bit(wIndex, &bus_state->resuming_ports);
+- port->resume_done = timeout;
++ port->resume_timestamp = timeout;
+ mod_timer(&hcd->rh_timer, timeout);
+ usb_hcd_start_port_resume(&hcd->self, wIndex);
+ }
+ /* Has resume been signalled for USB_RESUME_TIME yet? */
+- } else if (time_after_eq(jiffies, port->resume_done)) {
++ } else if (time_after_eq(jiffies, port->resume_timestamp)) {
+ int time_left;
+
+ xhci_dbg(xhci, "resume USB2 port %d-%d\n",
+ hcd->self.busnum, wIndex + 1);
+
+- port->resume_done = 0;
++ port->resume_timestamp = 0;
+ clear_bit(wIndex, &bus_state->resuming_ports);
+ port->rexit_active = true;
+
+@@ -1001,10 +1001,10 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
+ if (link_state == XDEV_U2)
+ *status |= USB_PORT_STAT_L1;
+ if (link_state == XDEV_U0) {
+- if (port->resume_done)
++ if (port->resume_timestamp)
+ usb_hcd_end_port_resume(&port->rhub->hcd->self,
+ portnum);
+- port->resume_done = 0;
++ port->resume_timestamp = 0;
+ clear_bit(portnum, &bus_state->resuming_ports);
+ if (bus_state->suspended_ports & (1 << portnum)) {
+ bus_state->suspended_ports &= ~(1 << portnum);
+@@ -1076,11 +1076,11 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ * Clear stale usb2 resume signalling variables in case port changed
+ * state during resume signalling. For example on error
+ */
+- if ((port->resume_done ||
++ if ((port->resume_timestamp ||
+ test_bit(wIndex, &bus_state->resuming_ports)) &&
+ (raw_port_status & PORT_PLS_MASK) != XDEV_U3 &&
+ (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) {
+- port->resume_done = 0;
++ port->resume_timestamp = 0;
+ clear_bit(wIndex, &bus_state->resuming_ports);
+ usb_hcd_end_port_resume(&hcd->self, wIndex);
+ }
+@@ -1588,8 +1588,8 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
+
+ if ((temp & mask) != 0 ||
+ (bus_state->port_c_suspend & 1 << i) ||
+- (ports[i]->resume_done && time_after_eq(
+- jiffies, ports[i]->resume_done))) {
++ (ports[i]->resume_timestamp && time_after_eq(
++ jiffies, ports[i]->resume_timestamp))) {
+ buf[(i + 1) / 8] |= 1 << (i + 1) % 8;
+ status = 1;
+ }
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index ada9977c41aa9..5ee095a5d38aa 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1851,7 +1851,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ goto cleanup;
+ } else if (!test_bit(hcd_portnum, &bus_state->resuming_ports)) {
+ xhci_dbg(xhci, "resume HS port %d\n", port_id);
+- port->resume_done = jiffies +
++ port->resume_timestamp = jiffies +
+ msecs_to_jiffies(USB_RESUME_TIMEOUT);
+ set_bit(hcd_portnum, &bus_state->resuming_ports);
+ /* Do the rest in GetPortStatus after resume time delay.
+@@ -1860,7 +1860,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ */
+ set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+ mod_timer(&hcd->rh_timer,
+- port->resume_done);
++ port->resume_timestamp);
+ usb_hcd_start_port_resume(&hcd->self, hcd_portnum);
+ bogus_port_status = true;
+ }
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 14eb13a85fce3..bb3c362a194b2 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1724,7 +1724,7 @@ struct xhci_port {
+ struct xhci_hub *rhub;
+ struct xhci_port_cap *port_cap;
+ unsigned int lpm_incapable:1;
+- unsigned long resume_done;
++ unsigned long resume_timestamp;
+ bool rexit_active;
+ struct completion rexit_done;
+ struct completion u3exit_done;
+--
+2.40.1
+
--- /dev/null
+From d9c1d633e24c7f8aca63b908ecf428cbfa7aa942 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Sep 2023 17:31:06 +0300
+Subject: xhci: track port suspend state correctly in unsuccessful resume cases
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+[ Upstream commit d7cdfc319b2bcf6899ab0a05eec0958bc802a9a1 ]
+
+xhci-hub.c tracks suspended ports in a suspended_port bitfield.
+This is checked when responding to a Get_Status(PORT) request to see if a
+port in running U0 state was recently resumed, and adds the required
+USB_PORT_STAT_C_SUSPEND change bit in those cases.
+
+The suspended_port bit was left uncleared if a device is disconnected
+during suspend. The bit remained set even when a new device was connected
+and enumerated. The set bit resulted in a incorrect Get_Status(PORT)
+response with a bogus USB_PORT_STAT_C_SUSPEND change
+bit set once the new device reached U0 link state.
+
+USB_PORT_STAT_C_SUSPEND change bit is only used for USB2 ports, but
+xhci-hub keeps track of both USB2 and USB3 suspended ports.
+
+Cc: stable@vger.kernel.org
+Reported-by: Wesley Cheng <quic_wcheng@quicinc.com>
+Closes: https://lore.kernel.org/linux-usb/d68aa806-b26a-0e43-42fb-b8067325e967@quicinc.com/
+Fixes: 1d5810b6923c ("xhci: Rework port suspend structures for limited ports.")
+Tested-by: Wesley Cheng <quic_wcheng@quicinc.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20230915143108.1532163-3-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-hub.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index b8dad0a3aab39..e92f920256b2e 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -957,19 +957,19 @@ static void xhci_get_usb3_port_status(struct xhci_port *port, u32 *status,
+ *status |= USB_PORT_STAT_C_CONFIG_ERROR << 16;
+
+ /* USB3 specific wPortStatus bits */
+- if (portsc & PORT_POWER) {
++ if (portsc & PORT_POWER)
+ *status |= USB_SS_PORT_STAT_POWER;
+- /* link state handling */
+- if (link_state == XDEV_U0)
+- bus_state->suspended_ports &= ~(1 << portnum);
+- }
+
+- /* remote wake resume signaling complete */
+- if (bus_state->port_remote_wakeup & (1 << portnum) &&
++ /* no longer suspended or resuming */
++ if (link_state != XDEV_U3 &&
+ link_state != XDEV_RESUME &&
+ link_state != XDEV_RECOVERY) {
+- bus_state->port_remote_wakeup &= ~(1 << portnum);
+- usb_hcd_end_port_resume(&hcd->self, portnum);
++ /* remote wake resume signaling complete */
++ if (bus_state->port_remote_wakeup & (1 << portnum)) {
++ bus_state->port_remote_wakeup &= ~(1 << portnum);
++ usb_hcd_end_port_resume(&hcd->self, portnum);
++ }
++ bus_state->suspended_ports &= ~(1 << portnum);
+ }
+
+ xhci_hub_report_usb3_link_state(xhci, status, portsc);
+@@ -1026,6 +1026,7 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
+ usb_hcd_end_port_resume(&port->rhub->hcd->self, portnum);
+ }
+ port->rexit_active = 0;
++ bus_state->suspended_ports &= ~(1 << portnum);
+ }
+ }
+
+--
+2.40.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
