Update to 5.19.7.pf3-1

- New upstream release based on 5.19.6 - Add linux-5.19.7 stable patches - Sync kernel config with Arch and Arch32 - Always package objtool, fixes #9. - Remove patch for kernel#211005 as it commited upstream Signed-off-by: Björn Bidar <bjorn.bidar@thaodan.de>
author: Björn Bidar 2022-09-06 03:05:45 +0300
committer: Björn Bidar 2022-09-06 15:55:49 +0300
commit: dafa8d62d3f6493d66afc5d568273f5a7e7b8924 (patch)
tree: e41709bc271bbf6671ce34c491a455ff08547e34
parent: 0c2ed81feac01240fdc5ed571ed3b563ec0dbec2 (diff)
download: aur-dafa8d62d3f6493d66afc5d568273f5a7e7b8924.tar.gz
75 files changed, 5896 insertions, 28 deletions
diff --git a/.SRCINFO b/.SRCINFO
index eac23c518430..ee71e793c45c 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,8 +1,8 @@
 # Generated by mksrcinfo v8
-# Sun Aug 14 22:50:25 UTC 2022
+# Tue Sep  6 00:31:17 UTC 2022
 pkgbase = linux-pf
 	pkgdesc = Linux with the pf-kernel patch (uksm, ZSTD, FSGSBASE and more)
-	pkgver = 5.19.1.pf2
+	pkgver = 5.19.7.pf3
 	pkgrel = 1
 	url = https://codeberg.org/pf-kernel/linux/wiki/README
 	arch = i686
@@ -19,7 +19,7 @@ pkgbase = linux-pf
 	makedepends = pahole
 	makedepends = cpio
 	options = !strip
-	source = linux-pf::git+https://codeberg.org/pf-kernel/linux.git#tag=v5.19-pf2
+	source = linux-pf::git+https://codeberg.org/pf-kernel/linux.git#tag=v5.19-pf3
 	source = config.x86_64
 	source = config.i686
 	source = pf_defconfig
@@ -51,9 +51,80 @@ pkgbase = linux-pf
 	source = 0027-ZEN-INTERACTIVE-mm-Disable-unevictable-compaction.patch
 	source = 0028-ZEN-INTERACTIVE-mm-Disable-proactive-compaction-by-d.patch
 	source = 0029-ZEN-INTERACTIVE-dm-crypt-Disable-workqueues-for-cryp.patch
-	source = asus_zenith_ii_map.patch::https://bugzilla.kernel.org/attachment.cgi?id=294489
+	source = 0001-drm-vc4-hdmi-Rework-power-up.patch
+	source = 0002-drm-vc4-hdmi-Depends-on-CONFIG_PM.patch
+	source = 0003-firmware-tegra-bpmp-Do-only-aligned-access-to-IPC-me.patch
+	source = 0004-crypto-lib-remove-unneeded-selection-of-XOR_BLOCKS.patch
+	source = 0005-docs-kerneldoc-preamble-Test-xeCJK.sty-before-loadin.patch
+	source = 0006-arm64-errata-Add-Cortex-A510-to-the-repeat-tlbi-list.patch
+	source = 0007-Bluetooth-L2CAP-Fix-build-errors-in-some-archs.patch
+	source = 0008-Revert-PCI-portdrv-Don-t-disable-AER-reporting-in-ge.patch
+	source = 0009-HID-steam-Prevent-NULL-pointer-dereference-in-steam_.patch
+	source = 0010-udmabuf-Set-the-DMA-mask-for-the-udmabuf-device-v2.patch
+	source = 0011-media-pvrusb2-fix-memory-leak-in-pvr_probe.patch
+	source = 0012-USB-gadget-Fix-use-after-free-Read-in-usb_udc_uevent.patch
+	source = 0013-HID-hidraw-fix-memory-leak-in-hidraw_release.patch
+	source = 0014-net-fix-refcount-bug-in-sk_psock_get-2.patch
+	source = 0015-fbdev-fb_pm2fb-Avoid-potential-divide-by-zero-error.patch
+	source = 0016-ftrace-Fix-NULL-pointer-dereference-in-is_ftrace_tra.patch
+	source = 0017-bpf-Don-t-redirect-packets-with-invalid-pkt_len.patch
+	source = 0018-mm-rmap-Fix-anon_vma-degree-ambiguity-leading-to-dou.patch
+	source = 0019-ALSA-usb-audio-Add-quirk-for-LH-Labs-Geek-Out-HD-Aud.patch
+	source = 0020-HID-input-fix-uclogic-tablets.patch
+	source = 0021-HID-add-Lenovo-Yoga-C630-battery-quirk.patch
+	source = 0022-HID-AMD_SFH-Add-a-DMI-quirk-entry-for-Chromebooks.patch
+	source = 0023-HID-Add-Apple-Touchbar-on-T2-Macs-in-hid_have_specia.patch
+	source = 0024-HID-asus-ROG-NKey-Ignore-portion-of-0x5a-report.patch
+	source = 0025-HID-nintendo-fix-rumble-worker-null-pointer-deref.patch
+	source = 0026-HID-thrustmaster-Add-sparco-wheel-and-fix-array-leng.patch
+	source = 0027-HID-intel-ish-hid-ipc-Add-Meteor-Lake-PCI-device-ID.patch
+	source = 0028-mmc-mtk-sd-Clear-interrupts-when-cqe-off-disable.patch
+	source = 0029-mmc-sdhci-of-dwcmshc-add-reset-call-back-for-rockchi.patch
+	source = 0030-mmc-sdhci-of-dwcmshc-rename-rk3568-to-rk35xx.patch
+	source = 0031-mmc-sdhci-of-dwcmshc-Re-enable-support-for-the-BlueF.patch
+	source = 0032-fs-ntfs3-Fix-work-with-fragmented-xattr.patch
+	source = 0033-ASoC-sh-rz-ssi-Improve-error-handling-in-rz_ssi_prob.patch
+	source = 0034-ASoC-rt5640-Fix-the-JD-voltage-dropping-issue.patch
+	source = 0035-rtla-Fix-tracer-name.patch
+	source = 0036-drm-amd-display-Add-a-missing-register-field-for-HPO.patch
+	source = 0037-drm-amd-display-Device-flash-garbage-before-get-in-O.patch
+	source = 0038-drm-amd-display-Avoid-MPC-infinite-loop.patch
+	source = 0039-drm-amd-display-Fix-HDMI-VSIF-V3-incorrect-issue.patch
+	source = 0040-drm-amd-display-For-stereo-keep-FLIP_ANY_FRAME.patch
+	source = 0041-drm-amd-display-clear-optc-underflow-before-turn-off.patch
+	source = 0042-drm-amd-display-Fix-TDR-eDP-and-USB4-display-light-u.patch
+	source = 0043-drm-amd-pm-skip-pptable-override-for-smu_v13_0_7.patch
+	source = 0044-drm-amdkfd-Handle-restart-of-kfd_ioctl_wait_events.patch
+	source = 0045-drm-amd-pm-Fix-a-potential-gpu_metrics_table-memory-.patch
+	source = 0046-ksmbd-return-STATUS_BAD_NETWORK_NAME-error-status-if.patch
+	source = 0047-net-lan966x-fix-checking-for-return-value-of-platfor.patch
+	source = 0048-neigh-fix-possible-DoS-due-to-net-iface-start-stop-l.patch
+	source = 0049-ALSA-hda-realtek-Add-quirks-for-ASUS-Zenbooks-using-.patch
+	source = 0050-s390-hypfs-avoid-error-message-under-KVM.patch
+	source = 0051-ksmbd-don-t-remove-dos-attribute-xattr-on-O_TRUNC-op.patch
+	source = 0052-drm-amdgpu-disable-3DCGCG-CGLS-temporarily-due-to-st.patch
+	source = 0053-drm-amd-pm-add-missing-fini_microcode-interface-for-.patch
+	source = 0054-drm-amd-pm-add-missing-fini_xxxx-interfaces-for-some.patch
+	source = 0055-drm-amd-display-Fix-pixel-clock-programming.patch
+	source = 0056-drm-amdgpu-Increase-tlb-flush-timeout-for-sriov.patch
+	source = 0057-drm-amd-display-Fix-plug-unplug-external-monitor-wil.patch
+	source = 0058-drm-amd-display-avoid-doing-vm_init-multiple-time.patch
+	source = 0059-drm-amdgpu-Add-decode_iv_ts-helper-for-ih_v6-block.patch
+	source = 0060-drm-amdgpu-Add-secure-display-TA-load-for-Renoir.patch
+	source = 0061-drm-amdgpu-Fix-interrupt-handling-on-ih_soft-ring.patch
+	source = 0062-netfilter-conntrack-NF_CONNTRACK_PROCFS-should-no-lo.patch
+	source = 0063-testing-selftests-nft_flowtable.sh-use-random-netns-.patch
+	source = 0064-platform-x86-serial-multi-instantiate-Add-CLSA0101-L.patch
+	source = 0065-ALSA-hda-cs8409-Support-new-Dolphin-Variants.patch
+	source = 0066-btrfs-move-lockdep-class-helpers-to-locking.c.patch
+	source = 0067-btrfs-fix-lockdep-splat-with-reloc-root-extent-buffe.patch
+	source = 0068-btrfs-tree-checker-check-for-overlapping-extent-item.patch
+	source = 0069-android-binder-fix-lockdep-check-on-clearing-vma.patch
+	source = 0070-net-af_packet-check-len-when-min_header_len-equals-t.patch
+	source = 0071-net-neigh-don-t-call-kfree_skb-under-spin_lock_irqsa.patch
+	source = 0072-arm64-cacheinfo-Fix-incorrect-assignment-of-signed-e.patch
 	sha256sums = SKIP
-	sha256sums = 28b4a6f7655079ff4a9cfe48763fae4c1e26be6956273d832062ceccddf23997
+	sha256sums = 49c471ab3cf341c6333f08957c0c3cfccc38a7cef2c9ca1895888f4674b441ec
 	sha256sums = 2b4b6887e75c9e6d40d1fa00e4405745da4c0649f7bf8c48e1bb35d511270443
 	sha256sums = 30566498a4f549e972fcd430d2fc44b2bd643c55bae20096f083f8837d8c43e4
 	sha256sums = 82d660caa11db0cd34fd550a049d7296b4a9dcd28f2a50c81418066d6e598864
@@ -84,7 +155,78 @@ pkgbase = linux-pf
 	sha256sums = 1a2598a00966da4e9985644edb900af7204409411464771c31d67d472595d817
 	sha256sums = 3d329b5153230184e270355f61697f5f7248787a4da045ac7b660e837c088630
 	sha256sums = c6730df729723340475fa64cf0ce4fee02ff0a1739f355166324bb2abeca5168
-	sha256sums = 67558840c3e1f1de229b23a54342cb126735282353a4d0a8cd10e4d582e6d9d6
+	sha256sums = e44a5e123fb22092a009630a8d80c496b70feaf9f9e244d76760290608edf277
+	sha256sums = 54676e48e43b41351e3e7e195c5e752f855f44db7a3fe0d4bd66499344da8386
+	sha256sums = 33bc73315a5f5757a093bd21fcc68e7a37a9c86ee2b731a85ef3c5067729199a
+	sha256sums = f84e76eca884191d9abc0b1876f9d9587e8bfde6a19a4d194445528d5b084f9b
+	sha256sums = b5a2082541aeec7162c6e673ea2dd0098f36d97c5deb03059afbf723b6789faa
+	sha256sums = 20a3c119838e4487bcc7fc28d4301f39e016afc24c76a33c25a84b9c911e3eed
+	sha256sums = 0bbaaf956dcc460bafe874c23b8ed495a46ced76918b044764b172b5719c9d44
+	sha256sums = e9a7b6ef185818f1472a15a98bbeb7be020e38c4d25ad3d9fead11961602bc03
+	sha256sums = c15ea9caacb98a4d61de2e3c6ecf1fcd083a8ed5a5ee69dc6a05b4583463badc
+	sha256sums = 70353d1e4bec0bc3c895887c4b1557e2222b257c34cf0c303781e5ac6b0efec9
+	sha256sums = 84301e69155a2404c24f18d8f2cc4986f355a86b9c072d59df9aca787e1abac2
+	sha256sums = 9c405a65a4d5d532fc1517e8c67e5d6703cc5bad7daf4c38a3771216fc1719ad
+	sha256sums = 96766d4ec6bae908fe6048f39e93fbc8627531daf6b5986cec99edd056581fac
+	sha256sums = 05995c977c1cc77fbc49b220d95390147fa448aae2bfa9698a402e8a56b41877
+	sha256sums = 9e16ce1da7499d2351dac47649c44a57ac1ec813f2d678d6da270e98359a51e4
+	sha256sums = 0c99d880164142334e7b4e0eb87f073ff4d6d15ec7d4490ee5e046b44e20562d
+	sha256sums = 83967bcd17746052db9cd95c92456658e51b22a717dfee004a9f34dc7fa26dfb
+	sha256sums = a307e5269cee8ae850997b93c14a4e3abb220a553dd7ece5337422c2e8770cfb
+	sha256sums = 83c68bdd89892c9c1b747de8eaee210ae6578881a0d5c79431148e8712046493
+	sha256sums = 2adff7cf24c62c13343e4821627c0a482ca139166147a76a76f520632d526cff
+	sha256sums = e9579fe46b98590d61d89cff16f719fe2b7eae88509c1ee168d85639a3cf2c0e
+	sha256sums = 8dab0a83aafbd2374696ced71d8fd53db35423d6db52340c8991e4e1ba134249
+	sha256sums = a8f65f98ae26eb5039e4998634a11b6ef43d9f632596b5a291e2c9107bc45901
+	sha256sums = 492191b1cd02c7f30ef0c77fb8ac8658cc1571a8953b7dae115ff90932b7391e
+	sha256sums = 348c3d85a8942f3b9e9b7ba1e33ad33f5454277badfa17baede5e7ee0623a85a
+	sha256sums = 809ad3f9f8a3b7933a8f5a174273b81fbd7ca875790a862984550bd53f08379d
+	sha256sums = 244cce4734c37ba829580e21ca7f828433653d79260d9e20ebc524f05aa0fdb2
+	sha256sums = 2b8fca8395d936999a41d3a5ed1d58931222fabed89f8748dba0ef8ce6e3b51a
+	sha256sums = cf06c51563c0eb21e2596cb516ce6cf0dbf3ece5573259ea59291a9b5a8cc40d
+	sha256sums = a6d9099008a7d4e90f91a417bbb8d42b6ac8ae3c4dc1a713530a24c78b90b06f
+	sha256sums = 8a569cb9a6df4b6833234690931461620c4759c6f8591f163648a250bb97c2eb
+	sha256sums = 1cb5fadc9854b97419a909ebf72dae3a2def66ee316c73292d42d85a60604757
+	sha256sums = 2274585298c76b59dfb5b0f27d0e51f44e6dd0f0cd10627c5a3c51fa893d7bc0
+	sha256sums = 02567508d03043eee5a0b2c4fe00db21873fc280c29e75942233b522dafe7234
+	sha256sums = ad574f61903c6db66110f4c607cd1ead2ce173e3dd95c5287aa392cb550dc973
+	sha256sums = b17687196d098311e7cc58af9e7f434cbc96c7075e6c24ed36362a24473b547e
+	sha256sums = 150487680af2d7da5731b045d764d3501f6188e083cb5299a163edd894f9eb73
+	sha256sums = 34ba987a290a3779a47f92468e834275925abaa11b008a846e5689e173128844
+	sha256sums = 3267cf5af76e8253263220536b51c8203287148f2d1b564c41de151a9c3ff41e
+	sha256sums = dc6505ce152095aa7048977d2a4457918b8ba780bc4ae6d4188cf81321592068
+	sha256sums = 71a27a759b2a8b990386b4d52ca95417205bb1674123f874b89fd17a929370fa
+	sha256sums = e2f6cc6c4a3443d26b852e252438564fe1fa80ab02a93b1bd325204da67663ae
+	sha256sums = 6d87fb84681433d5508e1c225fbd54d9b606b1a0f4c6d54b1d3970fb69fae881
+	sha256sums = 29f17c6768ee91706d1772758ddfabc9242331efef8d8a7eecb4b8c04deae394
+	sha256sums = dd88a730ac985b8c015ced758c7445f966acb0509e61296448b45d65d8d630a2
+	sha256sums = 9fe796c6177a9faf99b1edc4656be8ec2303e8757600b557e9dde3258952bc7e
+	sha256sums = 9ef664c55663f953ffb37087da1f1ad4b9a9f2519c84b1ac1add97178169095a
+	sha256sums = 42ac5d9000ef8e2ff7ab5f88f6203c559ce727766cc2b2f4f089041b0d9e6ee8
+	sha256sums = 3bbd0a5869969297ec2d5d8f062e346978be47e43480daf8255c67fe4c661ccf
+	sha256sums = ba79c549d798540c50ed17912eacc1f1651293b345f6aae8bd59cbe9633b4d0c
+	sha256sums = 851f44e92b6266bfa79f4acdd860f44f95c6ab327b685998a9ae68e9e75a08cf
+	sha256sums = aa0d9b3c7225d664b5faa3385d3f3f736956d7f61052154c6b0ea0ec09bbbc89
+	sha256sums = 60fe115a02d56ef029df6313f9e1c14a98da34ad742968845fbeaebc9237140f
+	sha256sums = 17017d9d552d36e27cf11ac07c3ae678bb0c1f45761ef9796acf106c86234d95
+	sha256sums = 73416c7b125bd78ceab3b3c0bb213a666976f7db3208b52d8735f81669d16650
+	sha256sums = 6c7e2bcb0823892fffc1a6f86a01928e5931e1fc37cb3cfad911740d3f7d1854
+	sha256sums = f3dbd4095f7cbafb2f8f7407d6f5a2f592ef8aef1270f3c6ab10e0c666262ba9
+	sha256sums = 1e8a5eb92ac2b5ecc17fdbfc7b5885a5991cdb2af5300817954102f1c5bfb5ec
+	sha256sums = b308b21874ca0b86cfb95ddcc76432daa2d4cc6d0053981367ab66fdeea6a01c
+	sha256sums = e0956a1f8785fdae0b68e2ac79d9187499662e9f6b8347be8eecb36717f8a63d
+	sha256sums = 03bee283b4ec139b2722c1531ad566ff0d674e44a2ec49689686ca85a89c7f82
+	sha256sums = 154c5f66ae84300ab69a4c9502a5893d9563f8b774887bda6959b930e3bbc6e0
+	sha256sums = d73dda2abcc118ea197cc3a61b5487b28d0fc584b0eb9deecba7d4b98b19f4ae
+	sha256sums = 10c74ccc91d7b993c91dea5ec1f6d3710e642d35dce6001a27aa6d8bc4404dde
+	sha256sums = 7c734ed61313ec21dc1c2c5adc6b828fac60f5a6f67de8869d2e7acfccbf4867
+	sha256sums = cb21bf8906fa812e46405269bf7e78361d05082dc63dfbf1c9719205768e49ac
+	sha256sums = c1f7da7edfb26701817a1fb3bb9b592e8966cf4b79b6305a1a3761bc8a4d2ab7
+	sha256sums = 676cfac9acbf8ed66d2e90ff5127ae5920aaa0eece3f512d9e43fb06e6e83495
+	sha256sums = e151e8dc209e32a584a5b96752073f976acf823d758c34cbef5955e1172e50d5
+	sha256sums = d4903b81e4102ccaed88f7605c7208f57048cf087edbcc03a64e64580f404cae
+	sha256sums = 15ff60a67694331a54435a4bb8d75c60d4e1c2895bd4fdb82401fe76da87e45d
+	sha256sums = 08ba24891b0115a2b355b5b17da2b485c6e8c7fadabe08d7fb71716ae0d2d05e
 
 pkgname = linux-pf
 	pkgdesc = The Linux with the pf-kernel patch (uksm, ZSTD, FSGSBASE and more) kernel and modules
diff --git a/0001-drm-vc4-hdmi-Rework-power-up.patch b/0001-drm-vc4-hdmi-Rework-power-up.patch
new file mode 100644
index 000000000000..e034db07090c
--- /dev/null
+++ b/0001-drm-vc4-hdmi-Rework-power-up.patch
@@ -0,0 +1,78 @@
+From 1a289a16857062e704da52683a49aaf16e826cbf Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Wed, 29 Jun 2022 14:34:37 +0200
+Subject: [PATCH 01/73] drm/vc4: hdmi: Rework power up
+
+commit 258e483a4d5e97a6a8caa74381ddc1f395ac1c71 upstream.
+
+The current code tries to handle the case where CONFIG_PM isn't selected
+by first calling our runtime_resume implementation and then properly
+report the power state to the runtime_pm core.
+
+This allows to have a functionning device even if pm_runtime_get_*
+functions are nops.
+
+However, the device power state if CONFIG_PM is enabled is
+RPM_SUSPENDED, and thus our vc4_hdmi_write() and vc4_hdmi_read() calls
+in the runtime_pm hooks will now report a warning since the device might
+not be properly powered.
+
+Even more so, we need CONFIG_PM enabled since the previous RaspberryPi
+have a power domain that needs to be powered up for the HDMI controller
+to be usable.
+
+The previous patch has created a dependency on CONFIG_PM, now we can
+just assume it's there and only call pm_runtime_resume_and_get() to make
+sure our device is powered in bind.
+
+Link: https://lore.kernel.org/r/20220629123510.1915022-39-maxime@cerno.tech
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+(cherry picked from commit 53565c28e6af2cef6bbf438c34250135e3564459)
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Cc: "Sudip Mukherjee (Codethink)" <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
+index 23ff6aa5e8f6..844a031a3663 100644
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -2992,17 +2992,15 @@ static int vc4_hdmi_bind(struct device *dev, struct device *master, void *data)
+ 			vc4_hdmi->disable_4kp60 = true;
+ 	}
+ 
++	pm_runtime_enable(dev);
++
+ 	/*
+-	 * We need to have the device powered up at this point to call
+-	 * our reset hook and for the CEC init.
++	 *  We need to have the device powered up at this point to call
++	 *  our reset hook and for the CEC init.
+ 	 */
+-	ret = vc4_hdmi_runtime_resume(dev);
++	ret = pm_runtime_resume_and_get(dev);
+ 	if (ret)
+-		goto err_put_ddc;
+-
+-	pm_runtime_get_noresume(dev);
+-	pm_runtime_set_active(dev);
+-	pm_runtime_enable(dev);
++		goto err_disable_runtime_pm;
+ 
+ 	if ((of_device_is_compatible(dev->of_node, "brcm,bcm2711-hdmi0") ||
+ 	     of_device_is_compatible(dev->of_node, "brcm,bcm2711-hdmi1")) &&
+@@ -3048,6 +3046,7 @@ static int vc4_hdmi_bind(struct device *dev, struct device *master, void *data)
+ err_destroy_encoder:
+ 	drm_encoder_cleanup(encoder);
+ 	pm_runtime_put_sync(dev);
++err_disable_runtime_pm:
+ 	pm_runtime_disable(dev);
+ err_put_ddc:
+ 	put_device(&vc4_hdmi->ddc->dev);
+-- 
+2.37.3
+
diff --git a/0002-drm-vc4-hdmi-Depends-on-CONFIG_PM.patch b/0002-drm-vc4-hdmi-Depends-on-CONFIG_PM.patch
new file mode 100644
index 000000000000..ba593124dff6
--- /dev/null
+++ b/0002-drm-vc4-hdmi-Depends-on-CONFIG_PM.patch
@@ -0,0 +1,52 @@
+From 1cf82931822dbf3b24945147b5330d8fdd86cdff Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime@cerno.tech>
+Date: Wed, 29 Jun 2022 14:34:36 +0200
+Subject: [PATCH 02/73] drm/vc4: hdmi: Depends on CONFIG_PM
+
+commit 72e2329e7c9bbe15e7a813670497ec9c6f919af3 upstream.
+
+We already depend on runtime PM to get the power domains and clocks for
+most of the devices supported by the vc4 driver, so let's just select it
+to make sure it's there.
+
+Link: https://lore.kernel.org/r/20220629123510.1915022-38-maxime@cerno.tech
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+(cherry picked from commit f1bc386b319e93e56453ae27e9e83817bb1f6f95)
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Cc: "Sudip Mukherjee (Codethink)" <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vc4/Kconfig    | 1 +
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vc4/Kconfig b/drivers/gpu/drm/vc4/Kconfig
+index 061be9a6619d..b0f3117102ca 100644
+--- a/drivers/gpu/drm/vc4/Kconfig
++++ b/drivers/gpu/drm/vc4/Kconfig
+@@ -8,6 +8,7 @@ config DRM_VC4
+ 	depends on DRM
+ 	depends on SND && SND_SOC
+ 	depends on COMMON_CLK
++	depends on PM
+ 	select DRM_DISPLAY_HDMI_HELPER
+ 	select DRM_DISPLAY_HELPER
+ 	select DRM_KMS_HELPER
+diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
+index 844a031a3663..199bc398817f 100644
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -2875,7 +2875,7 @@ static int vc5_hdmi_init_resources(struct vc4_hdmi *vc4_hdmi)
+ 	return 0;
+ }
+ 
+-static int __maybe_unused vc4_hdmi_runtime_suspend(struct device *dev)
++static int vc4_hdmi_runtime_suspend(struct device *dev)
+ {
+ 	struct vc4_hdmi *vc4_hdmi = dev_get_drvdata(dev);
+ 
+-- 
+2.37.3
+
diff --git a/0003-firmware-tegra-bpmp-Do-only-aligned-access-to-IPC-me.patch b/0003-firmware-tegra-bpmp-Do-only-aligned-access-to-IPC-me.patch
new file mode 100644
index 000000000000..216708899a77
--- /dev/null
+++ b/0003-firmware-tegra-bpmp-Do-only-aligned-access-to-IPC-me.patch
@@ -0,0 +1,57 @@
+From 515af71adf3d5e05587c7bb27c1725c20cd259a0 Mon Sep 17 00:00:00 2001
+From: Timo Alho <talho@nvidia.com>
+Date: Wed, 22 Jun 2022 16:22:59 +0300
+Subject: [PATCH 03/73] firmware: tegra: bpmp: Do only aligned access to IPC
+ memory area
+
+commit a4740b148a04dc60e14fe6a1dfe216d3bae214fd upstream.
+
+Use memcpy_toio and memcpy_fromio variants of memcpy to guarantee no
+unaligned access to IPC memory area. This is to allow the IPC memory to
+be mapped as Device memory to further suppress speculative reads from
+happening within the 64 kB memory area above the IPC memory when 64 kB
+memory pages are used.
+
+Signed-off-by: Timo Alho <talho@nvidia.com>
+Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Cc: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/firmware/tegra/bpmp.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/firmware/tegra/bpmp.c b/drivers/firmware/tegra/bpmp.c
+index 5654c5e9862b..037db21de510 100644
+--- a/drivers/firmware/tegra/bpmp.c
++++ b/drivers/firmware/tegra/bpmp.c
+@@ -201,7 +201,7 @@ static ssize_t __tegra_bpmp_channel_read(struct tegra_bpmp_channel *channel,
+ 	int err;
+ 
+ 	if (data && size > 0)
+-		memcpy(data, channel->ib->data, size);
++		memcpy_fromio(data, channel->ib->data, size);
+ 
+ 	err = tegra_bpmp_ack_response(channel);
+ 	if (err < 0)
+@@ -245,7 +245,7 @@ static ssize_t __tegra_bpmp_channel_write(struct tegra_bpmp_channel *channel,
+ 	channel->ob->flags = flags;
+ 
+ 	if (data && size > 0)
+-		memcpy(channel->ob->data, data, size);
++		memcpy_toio(channel->ob->data, data, size);
+ 
+ 	return tegra_bpmp_post_request(channel);
+ }
+@@ -420,7 +420,7 @@ void tegra_bpmp_mrq_return(struct tegra_bpmp_channel *channel, int code,
+ 	channel->ob->code = code;
+ 
+ 	if (data && size > 0)
+-		memcpy(channel->ob->data, data, size);
++		memcpy_toio(channel->ob->data, data, size);
+ 
+ 	err = tegra_bpmp_post_response(channel);
+ 	if (WARN_ON(err < 0))
+-- 
+2.37.3
+
diff --git a/0004-crypto-lib-remove-unneeded-selection-of-XOR_BLOCKS.patch b/0004-crypto-lib-remove-unneeded-selection-of-XOR_BLOCKS.patch
new file mode 100644
index 000000000000..768851474be3
--- /dev/null
+++ b/0004-crypto-lib-remove-unneeded-selection-of-XOR_BLOCKS.patch
@@ -0,0 +1,40 @@
+From e120a63532946bad71dc6255579a3219a9caf66c Mon Sep 17 00:00:00 2001
+From: Eric Biggers <ebiggers@google.com>
+Date: Thu, 25 Aug 2022 22:04:56 -0700
+Subject: [PATCH 04/73] crypto: lib - remove unneeded selection of XOR_BLOCKS
+
+commit 874b301985ef2f89b8b592ad255e03fb6fbfe605 upstream.
+
+CRYPTO_LIB_CHACHA_GENERIC doesn't need to select XOR_BLOCKS.  It perhaps
+was thought that it's needed for __crypto_xor, but that's not the case.
+
+Enabling XOR_BLOCKS is problematic because the XOR_BLOCKS code runs a
+benchmark when it is initialized.  That causes a boot time regression on
+systems that didn't have it enabled before.
+
+Therefore, remove this unnecessary and problematic selection.
+
+Fixes: e56e18985596 ("lib/crypto: add prompts back to crypto libraries")
+Cc: stable@vger.kernel.org
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/crypto/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/lib/crypto/Kconfig b/lib/crypto/Kconfig
+index 2082af43d51f..0717a0dcefed 100644
+--- a/lib/crypto/Kconfig
++++ b/lib/crypto/Kconfig
+@@ -33,7 +33,6 @@ config CRYPTO_ARCH_HAVE_LIB_CHACHA
+ 
+ config CRYPTO_LIB_CHACHA_GENERIC
+ 	tristate
+-	select XOR_BLOCKS
+ 	help
+ 	  This symbol can be depended upon by arch implementations of the
+ 	  ChaCha library interface that require the generic code as a
+-- 
+2.37.3
+
diff --git a/0005-docs-kerneldoc-preamble-Test-xeCJK.sty-before-loadin.patch b/0005-docs-kerneldoc-preamble-Test-xeCJK.sty-before-loadin.patch
new file mode 100644
index 000000000000..5f9b72dbe4af
--- /dev/null
+++ b/0005-docs-kerneldoc-preamble-Test-xeCJK.sty-before-loadin.patch
@@ -0,0 +1,88 @@
+From a8ba16e9f171e9638401ff39daebdd2b84553e2d Mon Sep 17 00:00:00 2001
+From: Akira Yokosawa <akiyks@gmail.com>
+Date: Mon, 8 Aug 2022 17:53:57 +0900
+Subject: [PATCH 05/73] docs: kerneldoc-preamble: Test xeCJK.sty before loading
+
+commit cee7db1b0239468b22c295cf04a8c40c34ecd35a upstream.
+
+On distros whose texlive packaging is fine-grained, texlive-xecjk
+can be installed/removed independently of other texlive packages.
+Conditionally loading xeCJK depending only on the existence of the
+"Noto Sans CJK SC" font might end up in xelatex error of
+"xeCJK.sty not found!".
+
+Improve the situation by testing existence of xeCJK.sty before
+loading it.
+
+This is useful on RHEL 9 and its clone distros where texlive-xecjk
+doesn't work at the moment due to a missing dependency [1].
+"make pdfdocs" for non-CJK contents should work after removing
+texlive-xecjk.
+
+Link: [1] https://bugzilla.redhat.com/show_bug.cgi?id=2086254
+Fixes: 398f7abdcb7e ("docs: pdfdocs: Pull LaTeX preamble part out of conf.py")
+Cc: stable@vger.kernel.org # v5.18+
+Signed-off-by: Akira Yokosawa <akiyks@gmail.com>
+Acked-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Link: https://lore.kernel.org/r/c24c2a87-70b2-5342-bcc9-de467940466e@gmail.com
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/sphinx/kerneldoc-preamble.sty | 22 +++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/Documentation/sphinx/kerneldoc-preamble.sty b/Documentation/sphinx/kerneldoc-preamble.sty
+index 2a29cbe51396..9707e033c8c4 100644
+--- a/Documentation/sphinx/kerneldoc-preamble.sty
++++ b/Documentation/sphinx/kerneldoc-preamble.sty
+@@ -70,8 +70,16 @@
+ 
+ % Translations have Asian (CJK) characters which are only displayed if
+ % xeCJK is used
++\usepackage{ifthen}
++\newboolean{enablecjk}
++\setboolean{enablecjk}{false}
+ \IfFontExistsTF{Noto Sans CJK SC}{
+-    % Load xeCJK when CJK font is available
++    \IfFileExists{xeCJK.sty}{
++	\setboolean{enablecjk}{true}
++    }{}
++}{}
++\ifthenelse{\boolean{enablecjk}}{
++    % Load xeCJK when both the Noto Sans CJK font and xeCJK.sty are available.
+     \usepackage{xeCJK}
+     % Noto CJK fonts don't provide slant shape. [AutoFakeSlant] permits
+     % its emulation.
+@@ -196,7 +204,7 @@
+     % Inactivate CJK after tableofcontents
+     \apptocmd{\sphinxtableofcontents}{\kerneldocCJKoff}{}{}
+     \xeCJKsetup{CJKspace = true}% For inter-phrase space of Korean TOC
+-}{ % No CJK font found
++}{ % Don't enable CJK
+     % Custom macros to on/off CJK and switch CJK fonts (Dummy)
+     \newcommand{\kerneldocCJKon}{}
+     \newcommand{\kerneldocCJKoff}{}
+@@ -204,14 +212,16 @@
+     %% and ignore the argument (#1) in their definitions, whole contents of
+     %% CJK chapters can be ignored.
+     \newcommand{\kerneldocBeginSC}[1]{%
+-	%% Put a note on missing CJK fonts in place of zh_CN translation.
+-	\begin{sphinxadmonition}{note}{Note on missing fonts:}
++	%% Put a note on missing CJK fonts or the xecjk package in place of
++	%% zh_CN translation.
++	\begin{sphinxadmonition}{note}{Note on missing fonts and a package:}
+ 	    Translations of Simplified Chinese (zh\_CN), Traditional Chinese
+ 	    (zh\_TW), Korean (ko\_KR), and Japanese (ja\_JP) were skipped
+-	    due to the lack of suitable font families.
++	    due to the lack of suitable font families and/or the texlive-xecjk
++	    package.
+ 
+ 	    If you want them, please install ``Noto Sans CJK'' font families
+-	    by following instructions from
++	    along with the texlive-xecjk package by following instructions from
+ 	    \sphinxcode{./scripts/sphinx-pre-install}.
+ 	    Having optional ``Noto Serif CJK'' font families will improve
+ 	    the looks of those translations.
+-- 
+2.37.3
+
diff --git a/0006-arm64-errata-Add-Cortex-A510-to-the-repeat-tlbi-list.patch b/0006-arm64-errata-Add-Cortex-A510-to-the-repeat-tlbi-list.patch
new file mode 100644
index 000000000000..2622a4a106ef
--- /dev/null
+++ b/0006-arm64-errata-Add-Cortex-A510-to-the-repeat-tlbi-list.patch
@@ -0,0 +1,96 @@
+From d3916da4bc6c022c9c41c576f6538fa78e5ce746 Mon Sep 17 00:00:00 2001
+From: James Morse <james.morse@arm.com>
+Date: Mon, 4 Jul 2022 16:57:32 +0100
+Subject: [PATCH 06/73] arm64: errata: Add Cortex-A510 to the repeat tlbi list
+
+commit 39fdb65f52e9a53d32a6ba719f96669fd300ae78 upstream.
+
+Cortex-A510 is affected by an erratum where in rare circumstances the
+CPUs may not handle a race between a break-before-make sequence on one
+CPU, and another CPU accessing the same page. This could allow a store
+to a page that has been unmapped.
+
+Work around this by adding the affected CPUs to the list that needs
+TLB sequences to be done twice.
+
+Signed-off-by: James Morse <james.morse@arm.com>
+Link: https://lore.kernel.org/r/20220704155732.21216-1-james.morse@arm.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Cc: Lucas Wei <lucaswei@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/arm64/silicon-errata.rst |  2 ++
+ arch/arm64/Kconfig                     | 17 +++++++++++++++++
+ arch/arm64/kernel/cpu_errata.c         |  8 +++++++-
+ 3 files changed, 26 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst
+index 0b4235b1f8c4..33b04db8408f 100644
+--- a/Documentation/arm64/silicon-errata.rst
++++ b/Documentation/arm64/silicon-errata.rst
+@@ -106,6 +106,8 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM            | Cortex-A510     | #2077057        | ARM64_ERRATUM_2077057       |
+ +----------------+-----------------+-----------------+-----------------------------+
++| ARM            | Cortex-A510     | #2441009        | ARM64_ERRATUM_2441009       |
+++----------------+-----------------+-----------------+-----------------------------+
+ | ARM            | Cortex-A710     | #2119858        | ARM64_ERRATUM_2119858       |
+ +----------------+-----------------+-----------------+-----------------------------+
+ | ARM            | Cortex-A710     | #2054223        | ARM64_ERRATUM_2054223       |
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index a5d1b561ed53..001eaba5a6b4 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -838,6 +838,23 @@ config ARM64_ERRATUM_2224489
+ 
+ 	  If unsure, say Y.
+ 
++config ARM64_ERRATUM_2441009
++	bool "Cortex-A510: Completion of affected memory accesses might not be guaranteed by completion of a TLBI"
++	default y
++	select ARM64_WORKAROUND_REPEAT_TLBI
++	help
++	  This option adds a workaround for ARM Cortex-A510 erratum #2441009.
++
++	  Under very rare circumstances, affected Cortex-A510 CPUs
++	  may not handle a race between a break-before-make sequence on one
++	  CPU, and another CPU accessing the same page. This could allow a
++	  store to a page that has been unmapped.
++
++	  Work around this by adding the affected CPUs to the list that needs
++	  TLB sequences to be done twice.
++
++	  If unsure, say Y.
++
+ config ARM64_ERRATUM_2064142
+ 	bool "Cortex-A510: 2064142: workaround TRBE register writes while disabled"
+ 	depends on CORESIGHT_TRBE
+diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
+index b374e258f705..5f4117dae888 100644
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -213,6 +213,12 @@ static const struct arm64_cpu_capabilities arm64_repeat_tlbi_list[] = {
+ 		/* Kryo4xx Gold (rcpe to rfpe) => (r0p0 to r3p0) */
+ 		ERRATA_MIDR_RANGE(MIDR_QCOM_KRYO_4XX_GOLD, 0xc, 0xe, 0xf, 0xe),
+ 	},
++#endif
++#ifdef CONFIG_ARM64_ERRATUM_2441009
++	{
++		/* Cortex-A510 r0p0 -> r1p1. Fixed in r1p2 */
++		ERRATA_MIDR_RANGE(MIDR_CORTEX_A510, 0, 0, 1, 1),
++	},
+ #endif
+ 	{},
+ };
+@@ -490,7 +496,7 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
+ #endif
+ #ifdef CONFIG_ARM64_WORKAROUND_REPEAT_TLBI
+ 	{
+-		.desc = "Qualcomm erratum 1009, or ARM erratum 1286807",
++		.desc = "Qualcomm erratum 1009, or ARM erratum 1286807, 2441009",
+ 		.capability = ARM64_WORKAROUND_REPEAT_TLBI,
+ 		.type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM,
+ 		.matches = cpucap_multi_entry_cap_matches,
+-- 
+2.37.3
+
diff --git a/0007-Bluetooth-L2CAP-Fix-build-errors-in-some-archs.patch b/0007-Bluetooth-L2CAP-Fix-build-errors-in-some-archs.patch
new file mode 100644
index 000000000000..b399cefe0e85
--- /dev/null
+++ b/0007-Bluetooth-L2CAP-Fix-build-errors-in-some-archs.patch
@@ -0,0 +1,66 @@
+From e8fcbce5424966ddbe9e426c163b2e63ff91b789 Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Date: Fri, 12 Aug 2022 15:33:57 -0700
+Subject: [PATCH 07/73] Bluetooth: L2CAP: Fix build errors in some archs
+
+commit b840304fb46cdf7012722f456bce06f151b3e81b upstream.
+
+This attempts to fix the follow errors:
+
+In function 'memcmp',
+    inlined from 'bacmp' at ./include/net/bluetooth/bluetooth.h:347:9,
+    inlined from 'l2cap_global_chan_by_psm' at
+    net/bluetooth/l2cap_core.c:2003:15:
+./include/linux/fortify-string.h:44:33: error: '__builtin_memcmp'
+specified bound 6 exceeds source size 0 [-Werror=stringop-overread]
+   44 | #define __underlying_memcmp     __builtin_memcmp
+      |                                 ^
+./include/linux/fortify-string.h:420:16: note: in expansion of macro
+'__underlying_memcmp'
+  420 |         return __underlying_memcmp(p, q, size);
+      |                ^~~~~~~~~~~~~~~~~~~
+In function 'memcmp',
+    inlined from 'bacmp' at ./include/net/bluetooth/bluetooth.h:347:9,
+    inlined from 'l2cap_global_chan_by_psm' at
+    net/bluetooth/l2cap_core.c:2004:15:
+./include/linux/fortify-string.h:44:33: error: '__builtin_memcmp'
+specified bound 6 exceeds source size 0 [-Werror=stringop-overread]
+   44 | #define __underlying_memcmp     __builtin_memcmp
+      |                                 ^
+./include/linux/fortify-string.h:420:16: note: in expansion of macro
+'__underlying_memcmp'
+  420 |         return __underlying_memcmp(p, q, size);
+      |                ^~~~~~~~~~~~~~~~~~~
+
+Fixes: 332f1795ca20 ("Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Cc: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/l2cap_core.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index f18d0c72713f..48fbd0ae882b 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -1991,11 +1991,11 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
+ 			src_match = !bacmp(&c->src, src);
+ 			dst_match = !bacmp(&c->dst, dst);
+ 			if (src_match && dst_match) {
+-				c = l2cap_chan_hold_unless_zero(c);
+-				if (c) {
+-					read_unlock(&chan_list_lock);
+-					return c;
+-				}
++				if (!l2cap_chan_hold_unless_zero(c))
++					continue;
++
++				read_unlock(&chan_list_lock);
++				return c;
+ 			}
+ 
+ 			/* Closest match */
+-- 
+2.37.3
+
diff --git a/0008-Revert-PCI-portdrv-Don-t-disable-AER-reporting-in-ge.patch b/0008-Revert-PCI-portdrv-Don-t-disable-AER-reporting-in-ge.patch
new file mode 100644
index 000000000000..6d735d532707
--- /dev/null
+++ b/0008-Revert-PCI-portdrv-Don-t-disable-AER-reporting-in-ge.patch
@@ -0,0 +1,55 @@
+From adb9caabcd16a4a7535f3fcce79d98eab185d434 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Thu, 1 Sep 2022 13:01:03 +0200
+Subject: [PATCH 08/73] Revert "PCI/portdrv: Don't disable AER reporting in
+ get_port_device_capability()"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This reverts commit 65e393fddc5379b2c41ca7e73cd4bb9572c4d90e which is
+commit 8795e182b02dc87e343c79e73af6b8b7f9c5e635 upstream.
+
+It is reported to cause problems, so drop it from the stable trees for
+now until it gets sorted out.
+
+Link: https://lore.kernel.org/r/47b775c5-57fa-5edf-b59e-8a9041ffbee7@candelatech.com
+Reported-by: Ben Greear <greearb@candelatech.com>
+Cc: Stefan Roese <sr@denx.de>
+Cc: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Pali Rohár <pali@kernel.org>
+Cc: Rafael J. Wysocki <rjw@rjwysocki.net>
+Cc: Bharat Kumar Gogada <bharat.kumar.gogada@xilinx.com>
+Cc: Michal Simek <michal.simek@xilinx.com>
+Cc: Yao Hongbo <yaohongbo@linux.alibaba.com>
+Cc: Naveen Naidu <naveennaidu479@gmail.com>
+Cc: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/pcie/portdrv_core.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/pcie/portdrv_core.c b/drivers/pci/pcie/portdrv_core.c
+index 1ac7fec47d6f..604feeb84ee4 100644
+--- a/drivers/pci/pcie/portdrv_core.c
++++ b/drivers/pci/pcie/portdrv_core.c
+@@ -222,8 +222,15 @@ static int get_port_device_capability(struct pci_dev *dev)
+ 
+ #ifdef CONFIG_PCIEAER
+ 	if (dev->aer_cap && pci_aer_available() &&
+-	    (pcie_ports_native || host->native_aer))
++	    (pcie_ports_native || host->native_aer)) {
+ 		services |= PCIE_PORT_SERVICE_AER;
++
++		/*
++		 * Disable AER on this port in case it's been enabled by the
++		 * BIOS (the AER service driver will enable it when necessary).
++		 */
++		pci_disable_pcie_error_reporting(dev);
++	}
+ #endif
+ 
+ 	/* Root Ports and Root Complex Event Collectors may generate PMEs */
+-- 
+2.37.3
+
diff --git a/0009-HID-steam-Prevent-NULL-pointer-dereference-in-steam_.patch b/0009-HID-steam-Prevent-NULL-pointer-dereference-in-steam_.patch
new file mode 100644
index 000000000000..c6fe61c40ebb
--- /dev/null
+++ b/0009-HID-steam-Prevent-NULL-pointer-dereference-in-steam_.patch
@@ -0,0 +1,55 @@
+From dee1e51b54794e90763e70a3c78f27ba4fa930ec Mon Sep 17 00:00:00 2001
+From: Lee Jones <lee.jones@linaro.org>
+Date: Fri, 8 Jul 2022 08:40:09 +0100
+Subject: [PATCH 09/73] HID: steam: Prevent NULL pointer dereference in
+ steam_{recv,send}_report
+
+commit cd11d1a6114bd4bc6450ae59f6e110ec47362126 upstream.
+
+It is possible for a malicious device to forgo submitting a Feature
+Report.  The HID Steam driver presently makes no prevision for this
+and de-references the 'struct hid_report' pointer obtained from the
+HID devices without first checking its validity.  Let's change that.
+
+Cc: Jiri Kosina <jikos@kernel.org>
+Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Cc: linux-input@vger.kernel.org
+Fixes: c164d6abf3841 ("HID: add driver for Valve Steam Controller")
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-steam.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
+index a3b151b29bd7..fc616db4231b 100644
+--- a/drivers/hid/hid-steam.c
++++ b/drivers/hid/hid-steam.c
+@@ -134,6 +134,11 @@ static int steam_recv_report(struct steam_device *steam,
+ 	int ret;
+ 
+ 	r = steam->hdev->report_enum[HID_FEATURE_REPORT].report_id_hash[0];
++	if (!r) {
++		hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted -  nothing to read\n");
++		return -EINVAL;
++	}
++
+ 	if (hid_report_len(r) < 64)
+ 		return -EINVAL;
+ 
+@@ -165,6 +170,11 @@ static int steam_send_report(struct steam_device *steam,
+ 	int ret;
+ 
+ 	r = steam->hdev->report_enum[HID_FEATURE_REPORT].report_id_hash[0];
++	if (!r) {
++		hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted -  nothing to read\n");
++		return -EINVAL;
++	}
++
+ 	if (hid_report_len(r) < 64)
+ 		return -EINVAL;
+ 
+-- 
+2.37.3
+
diff --git a/0010-udmabuf-Set-the-DMA-mask-for-the-udmabuf-device-v2.patch b/0010-udmabuf-Set-the-DMA-mask-for-the-udmabuf-device-v2.patch
new file mode 100644
index 000000000000..2e31ced32f92
--- /dev/null
+++ b/0010-udmabuf-Set-the-DMA-mask-for-the-udmabuf-device-v2.patch
@@ -0,0 +1,104 @@
+From f2f6ea1a8da1317430a84701fc0170449ee88315 Mon Sep 17 00:00:00 2001
+From: Vivek Kasireddy <vivek.kasireddy@intel.com>
+Date: Fri, 20 May 2022 13:52:35 -0700
+Subject: [PATCH 10/73] udmabuf: Set the DMA mask for the udmabuf device (v2)
+
+commit 9e9fa6a9198b767b00f48160800128e83a038f9f upstream.
+
+If the DMA mask is not set explicitly, the following warning occurs
+when the userspace tries to access the dma-buf via the CPU as
+reported by syzbot here:
+
+WARNING: CPU: 1 PID: 3595 at kernel/dma/mapping.c:188
+__dma_map_sg_attrs+0x181/0x1f0 kernel/dma/mapping.c:188
+Modules linked in:
+CPU: 0 PID: 3595 Comm: syz-executor249 Not tainted
+5.17.0-rc2-syzkaller-00316-g0457e5153e0e #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
+Google 01/01/2011
+RIP: 0010:__dma_map_sg_attrs+0x181/0x1f0 kernel/dma/mapping.c:188
+Code: 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 71 4c 8b 3d c0
+83 b5 0d e9 db fe ff ff e8 b6 0f 13 00 0f 0b e8 af 0f 13 00 <0f> 0b 45
+   31 e4 e9 54 ff ff ff e8 a0 0f 13 00 49 8d 7f 50 48 b8 00
+RSP: 0018:ffffc90002a07d68 EFLAGS: 00010293
+RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
+RDX: ffff88807e25e2c0 RSI: ffffffff81649e91 RDI: ffff88801b848408
+RBP: ffff88801b848000 R08: 0000000000000002 R09: ffff88801d86c74f
+R10: ffffffff81649d72 R11: 0000000000000001 R12: 0000000000000002
+R13: ffff88801d86c680 R14: 0000000000000001 R15: 0000000000000000
+FS:  0000555556e30300(0000) GS:ffff8880b9d00000(0000)
+knlGS:0000000000000000
+CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00000000200000cc CR3: 000000001d74a000 CR4: 00000000003506e0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ <TASK>
+ dma_map_sgtable+0x70/0xf0 kernel/dma/mapping.c:264
+ get_sg_table.isra.0+0xe0/0x160 drivers/dma-buf/udmabuf.c:72
+ begin_cpu_udmabuf+0x130/0x1d0 drivers/dma-buf/udmabuf.c:126
+ dma_buf_begin_cpu_access+0xfd/0x1d0 drivers/dma-buf/dma-buf.c:1164
+ dma_buf_ioctl+0x259/0x2b0 drivers/dma-buf/dma-buf.c:363
+ vfs_ioctl fs/ioctl.c:51 [inline]
+ __do_sys_ioctl fs/ioctl.c:874 [inline]
+ __se_sys_ioctl fs/ioctl.c:860 [inline]
+ __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+RIP: 0033:0x7f62fcf530f9
+Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89
+f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01
+f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
+RSP: 002b:00007ffe3edab9b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
+RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f62fcf530f9
+RDX: 0000000020000200 RSI: 0000000040086200 RDI: 0000000000000006
+RBP: 00007f62fcf170e0 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000246 R12: 00007f62fcf17170
+R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
+ </TASK>
+
+v2: Dont't forget to deregister if DMA mask setup fails.
+
+Reported-by: syzbot+10e27961f4da37c443b2@syzkaller.appspotmail.com
+Cc: Gerd Hoffmann <kraxel@redhat.com>
+Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/20220520205235.3687336-1-vivek.kasireddy@intel.com
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma-buf/udmabuf.c | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
+index 9631f2fd2faf..38e8767ec371 100644
+--- a/drivers/dma-buf/udmabuf.c
++++ b/drivers/dma-buf/udmabuf.c
+@@ -368,7 +368,23 @@ static struct miscdevice udmabuf_misc = {
+ 
+ static int __init udmabuf_dev_init(void)
+ {
+-	return misc_register(&udmabuf_misc);
++	int ret;
++
++	ret = misc_register(&udmabuf_misc);
++	if (ret < 0) {
++		pr_err("Could not initialize udmabuf device\n");
++		return ret;
++	}
++
++	ret = dma_coerce_mask_and_coherent(udmabuf_misc.this_device,
++					   DMA_BIT_MASK(64));
++	if (ret < 0) {
++		pr_err("Could not setup DMA mask for udmabuf device\n");
++		misc_deregister(&udmabuf_misc);
++		return ret;
++	}
++
++	return 0;
+ }
+ 
+ static void __exit udmabuf_dev_exit(void)
+-- 
+2.37.3
+
diff --git a/0011-media-pvrusb2-fix-memory-leak-in-pvr_probe.patch b/0011-media-pvrusb2-fix-memory-leak-in-pvr_probe.patch
new file mode 100644
index 000000000000..c53a8dd18ab8
--- /dev/null
+++ b/0011-media-pvrusb2-fix-memory-leak-in-pvr_probe.patch
@@ -0,0 +1,39 @@
+From c02d2a91a85c4c4d05826cd1ea74a9b8d42e4280 Mon Sep 17 00:00:00 2001
+From: Dongliang Mu <mudongliangabcd@gmail.com>
+Date: Thu, 9 Jun 2022 08:35:28 +0100
+Subject: [PATCH 11/73] media: pvrusb2: fix memory leak in pvr_probe
+
+commit 945a9a8e448b65bec055d37eba58f711b39f66f0 upstream.
+
+The error handling code in pvr2_hdw_create forgets to unregister the
+v4l2 device. When pvr2_hdw_create returns back to pvr2_context_create,
+it calls pvr2_context_destroy to destroy context, but mp->hdw is NULL,
+which leads to that pvr2_hdw_destroy directly returns.
+
+Fix this by adding v4l2_device_unregister to decrease the refcount of
+usb interface.
+
+Reported-by: syzbot+77b432d57c4791183ed4@syzkaller.appspotmail.com
+Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+index a9666373af6b..92d6db1ad00f 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+@@ -2610,6 +2610,7 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf,
+ 		del_timer_sync(&hdw->encoder_run_timer);
+ 		del_timer_sync(&hdw->encoder_wait_timer);
+ 		flush_work(&hdw->workpoll);
++		v4l2_device_unregister(&hdw->v4l2_dev);
+ 		usb_free_urb(hdw->ctl_read_urb);
+ 		usb_free_urb(hdw->ctl_write_urb);
+ 		kfree(hdw->ctl_read_buffer);
+-- 
+2.37.3
+
diff --git a/0012-USB-gadget-Fix-use-after-free-Read-in-usb_udc_uevent.patch b/0012-USB-gadget-Fix-use-after-free-Read-in-usb_udc_uevent.patch
new file mode 100644
index 000000000000..0f4d4bc28c6d
--- /dev/null
+++ b/0012-USB-gadget-Fix-use-after-free-Read-in-usb_udc_uevent.patch
@@ -0,0 +1,76 @@
+From f44b0b95d50fffeca036e1ba36770390e0b519dd Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Thu, 21 Jul 2022 11:07:10 -0400
+Subject: [PATCH 12/73] USB: gadget: Fix use-after-free Read in
+ usb_udc_uevent()
+
+commit 2191c00855b03aa59c20e698be713d952d51fc18 upstream.
+
+The syzbot fuzzer found a race between uevent callbacks and gadget
+driver unregistration that can cause a use-after-free bug:
+
+---------------------------------------------------------------
+BUG: KASAN: use-after-free in usb_udc_uevent+0x11f/0x130
+drivers/usb/gadget/udc/core.c:1732
+Read of size 8 at addr ffff888078ce2050 by task udevd/2968
+
+CPU: 1 PID: 2968 Comm: udevd Not tainted 5.19.0-rc4-next-20220628-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
+06/29/2022
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
+ print_address_description mm/kasan/report.c:317 [inline]
+ print_report.cold+0x2ba/0x719 mm/kasan/report.c:433
+ kasan_report+0xbe/0x1f0 mm/kasan/report.c:495
+ usb_udc_uevent+0x11f/0x130 drivers/usb/gadget/udc/core.c:1732
+ dev_uevent+0x290/0x770 drivers/base/core.c:2424
+---------------------------------------------------------------
+
+The bug occurs because usb_udc_uevent() dereferences udc->driver but
+does so without acquiring the udc_lock mutex, which protects this
+field.  If the gadget driver is unbound from the udc concurrently with
+uevent processing, the driver structure may be accessed after it has
+been deallocated.
+
+To prevent the race, we make sure that the routine holds the mutex
+around the racing accesses.
+
+Link: <https://lore.kernel.org/all/0000000000004de90405a719c951@google.com>
+CC: stable@vger.kernel.org # fc274c1e9973
+Reported-and-tested-by: syzbot+b0de012ceb1e2a97891b@syzkaller.appspotmail.com
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/YtlrnhHyrHsSky9m@rowland.harvard.edu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/udc/core.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
+index 7886497253cc..cafcf260394c 100644
+--- a/drivers/usb/gadget/udc/core.c
++++ b/drivers/usb/gadget/udc/core.c
+@@ -1728,13 +1728,14 @@ static int usb_udc_uevent(struct device *dev, struct kobj_uevent_env *env)
+ 		return ret;
+ 	}
+ 
+-	if (udc->driver) {
++	mutex_lock(&udc_lock);
++	if (udc->driver)
+ 		ret = add_uevent_var(env, "USB_UDC_DRIVER=%s",
+ 				udc->driver->function);
+-		if (ret) {
+-			dev_err(dev, "failed to add uevent USB_UDC_DRIVER\n");
+-			return ret;
+-		}
++	mutex_unlock(&udc_lock);
++	if (ret) {
++		dev_err(dev, "failed to add uevent USB_UDC_DRIVER\n");
++		return ret;
+ 	}
+ 
+ 	return 0;
+-- 
+2.37.3
+
diff --git a/0013-HID-hidraw-fix-memory-leak-in-hidraw_release.patch b/0013-HID-hidraw-fix-memory-leak-in-hidraw_release.patch
new file mode 100644
index 000000000000..c49afc1c8a48
--- /dev/null
+++ b/0013-HID-hidraw-fix-memory-leak-in-hidraw_release.patch
@@ -0,0 +1,66 @@
+From 52a3c62a815161c2dcf38ac421f6c41d8679462b Mon Sep 17 00:00:00 2001
+From: Karthik Alapati <mail@karthek.com>
+Date: Thu, 28 Jul 2022 21:13:17 +0530
+Subject: [PATCH 13/73] HID: hidraw: fix memory leak in hidraw_release()
+
+commit a5623a203cffe2d2b84d2f6c989d9017db1856af upstream.
+
+Free the buffered reports before deleting the list entry.
+
+BUG: memory leak
+unreferenced object 0xffff88810e72f180 (size 32):
+  comm "softirq", pid 0, jiffies 4294945143 (age 16.080s)
+  hex dump (first 32 bytes):
+    64 f3 c6 6a d1 88 07 04 00 00 00 00 00 00 00 00  d..j............
+    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
+  backtrace:
+    [<ffffffff814ac6c3>] kmemdup+0x23/0x50 mm/util.c:128
+    [<ffffffff8357c1d2>] kmemdup include/linux/fortify-string.h:440 [inline]
+    [<ffffffff8357c1d2>] hidraw_report_event+0xa2/0x150 drivers/hid/hidraw.c:521
+    [<ffffffff8356ddad>] hid_report_raw_event+0x27d/0x740 drivers/hid/hid-core.c:1992
+    [<ffffffff8356e41e>] hid_input_report+0x1ae/0x270 drivers/hid/hid-core.c:2065
+    [<ffffffff835f0d3f>] hid_irq_in+0x1ff/0x250 drivers/hid/usbhid/hid-core.c:284
+    [<ffffffff82d3c7f9>] __usb_hcd_giveback_urb+0xf9/0x230 drivers/usb/core/hcd.c:1670
+    [<ffffffff82d3cc26>] usb_hcd_giveback_urb+0x1b6/0x1d0 drivers/usb/core/hcd.c:1747
+    [<ffffffff82ef1e14>] dummy_timer+0x8e4/0x14c0 drivers/usb/gadget/udc/dummy_hcd.c:1988
+    [<ffffffff812f50a8>] call_timer_fn+0x38/0x200 kernel/time/timer.c:1474
+    [<ffffffff812f5586>] expire_timers kernel/time/timer.c:1519 [inline]
+    [<ffffffff812f5586>] __run_timers.part.0+0x316/0x430 kernel/time/timer.c:1790
+    [<ffffffff812f56e4>] __run_timers kernel/time/timer.c:1768 [inline]
+    [<ffffffff812f56e4>] run_timer_softirq+0x44/0x90 kernel/time/timer.c:1803
+    [<ffffffff848000e6>] __do_softirq+0xe6/0x2ea kernel/softirq.c:571
+    [<ffffffff81246db0>] invoke_softirq kernel/softirq.c:445 [inline]
+    [<ffffffff81246db0>] __irq_exit_rcu kernel/softirq.c:650 [inline]
+    [<ffffffff81246db0>] irq_exit_rcu+0xc0/0x110 kernel/softirq.c:662
+    [<ffffffff84574f02>] sysvec_apic_timer_interrupt+0xa2/0xd0 arch/x86/kernel/apic/apic.c:1106
+    [<ffffffff84600c8b>] asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:649
+    [<ffffffff8458a070>] native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline]
+    [<ffffffff8458a070>] arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline]
+    [<ffffffff8458a070>] acpi_safe_halt drivers/acpi/processor_idle.c:111 [inline]
+    [<ffffffff8458a070>] acpi_idle_do_entry+0xc0/0xd0 drivers/acpi/processor_idle.c:554
+
+Link: https://syzkaller.appspot.com/bug?id=19a04b43c75ed1092021010419b5e560a8172c4f
+Reported-by: syzbot+f59100a0428e6ded9443@syzkaller.appspotmail.com
+Signed-off-by: Karthik Alapati <mail@karthek.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hidraw.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
+index 681614a8302a..197b1e7bf029 100644
+--- a/drivers/hid/hidraw.c
++++ b/drivers/hid/hidraw.c
+@@ -350,6 +350,8 @@ static int hidraw_release(struct inode * inode, struct file * file)
+ 	down_write(&minors_rwsem);
+ 
+ 	spin_lock_irqsave(&hidraw_table[minor]->list_lock, flags);
++	for (int i = list->tail; i < list->head; i++)
++		kfree(list->buffer[i].value);
+ 	list_del(&list->node);
+ 	spin_unlock_irqrestore(&hidraw_table[minor]->list_lock, flags);
+ 	kfree(list);
+-- 
+2.37.3
+
diff --git a/0014-net-fix-refcount-bug-in-sk_psock_get-2.patch b/0014-net-fix-refcount-bug-in-sk_psock_get-2.patch
new file mode 100644
index 000000000000..7617995a8867
--- /dev/null
+++ b/0014-net-fix-refcount-bug-in-sk_psock_get-2.patch
@@ -0,0 +1,199 @@
+From 86026be8535c16fcc5e4f960286faf04d7f77815 Mon Sep 17 00:00:00 2001
+From: Hawkins Jiawei <yin31149@gmail.com>
+Date: Fri, 5 Aug 2022 15:48:34 +0800
+Subject: [PATCH 14/73] net: fix refcount bug in sk_psock_get (2)
+
+commit 2a0133723f9ebeb751cfce19f74ec07e108bef1f upstream.
+
+Syzkaller reports refcount bug as follows:
+------------[ cut here ]------------
+refcount_t: saturated; leaking memory.
+WARNING: CPU: 1 PID: 3605 at lib/refcount.c:19 refcount_warn_saturate+0xf4/0x1e0 lib/refcount.c:19
+Modules linked in:
+CPU: 1 PID: 3605 Comm: syz-executor208 Not tainted 5.18.0-syzkaller-03023-g7e062cda7d90 #0
+ <TASK>
+ __refcount_add_not_zero include/linux/refcount.h:163 [inline]
+ __refcount_inc_not_zero include/linux/refcount.h:227 [inline]
+ refcount_inc_not_zero include/linux/refcount.h:245 [inline]
+ sk_psock_get+0x3bc/0x410 include/linux/skmsg.h:439
+ tls_data_ready+0x6d/0x1b0 net/tls/tls_sw.c:2091
+ tcp_data_ready+0x106/0x520 net/ipv4/tcp_input.c:4983
+ tcp_data_queue+0x25f2/0x4c90 net/ipv4/tcp_input.c:5057
+ tcp_rcv_state_process+0x1774/0x4e80 net/ipv4/tcp_input.c:6659
+ tcp_v4_do_rcv+0x339/0x980 net/ipv4/tcp_ipv4.c:1682
+ sk_backlog_rcv include/net/sock.h:1061 [inline]
+ __release_sock+0x134/0x3b0 net/core/sock.c:2849
+ release_sock+0x54/0x1b0 net/core/sock.c:3404
+ inet_shutdown+0x1e0/0x430 net/ipv4/af_inet.c:909
+ __sys_shutdown_sock net/socket.c:2331 [inline]
+ __sys_shutdown_sock net/socket.c:2325 [inline]
+ __sys_shutdown+0xf1/0x1b0 net/socket.c:2343
+ __do_sys_shutdown net/socket.c:2351 [inline]
+ __se_sys_shutdown net/socket.c:2349 [inline]
+ __x64_sys_shutdown+0x50/0x70 net/socket.c:2349
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x46/0xb0
+ </TASK>
+
+During SMC fallback process in connect syscall, kernel will
+replaces TCP with SMC. In order to forward wakeup
+smc socket waitqueue after fallback, kernel will sets
+clcsk->sk_user_data to origin smc socket in
+smc_fback_replace_callbacks().
+
+Later, in shutdown syscall, kernel will calls
+sk_psock_get(), which treats the clcsk->sk_user_data
+as psock type, triggering the refcnt warning.
+
+So, the root cause is that smc and psock, both will use
+sk_user_data field. So they will mismatch this field
+easily.
+
+This patch solves it by using another bit(defined as
+SK_USER_DATA_PSOCK) in PTRMASK, to mark whether
+sk_user_data points to a psock object or not.
+This patch depends on a PTRMASK introduced in commit f1ff5ce2cd5e
+("net, sk_msg: Clear sk_user_data pointer on clone if tagged").
+
+For there will possibly be more flags in the sk_user_data field,
+this patch also refactor sk_user_data flags code to be more generic
+to improve its maintainability.
+
+Reported-and-tested-by: syzbot+5f26f85569bd179c18ce@syzkaller.appspotmail.com
+Suggested-by: Jakub Kicinski <kuba@kernel.org>
+Acked-by: Wen Gu <guwen@linux.alibaba.com>
+Signed-off-by: Hawkins Jiawei <yin31149@gmail.com>
+Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/skmsg.h |  3 +-
+ include/net/sock.h    | 68 ++++++++++++++++++++++++++++++-------------
+ net/core/skmsg.c      |  4 ++-
+ 3 files changed, 53 insertions(+), 22 deletions(-)
+
+diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h
+index c5a2d6f50f25..c5bdc5975a5c 100644
+--- a/include/linux/skmsg.h
++++ b/include/linux/skmsg.h
+@@ -277,7 +277,8 @@ static inline void sk_msg_sg_copy_clear(struct sk_msg *msg, u32 start)
+ 
+ static inline struct sk_psock *sk_psock(const struct sock *sk)
+ {
+-	return rcu_dereference_sk_user_data(sk);
++	return __rcu_dereference_sk_user_data_with_flags(sk,
++							 SK_USER_DATA_PSOCK);
+ }
+ 
+ static inline void sk_psock_set_state(struct sk_psock *psock,
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 13944ceea7ed..bf45b572f289 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -545,14 +545,26 @@ enum sk_pacing {
+ 	SK_PACING_FQ		= 2,
+ };
+ 
+-/* Pointer stored in sk_user_data might not be suitable for copying
+- * when cloning the socket. For instance, it can point to a reference
+- * counted object. sk_user_data bottom bit is set if pointer must not
+- * be copied.
++/* flag bits in sk_user_data
++ *
++ * - SK_USER_DATA_NOCOPY:      Pointer stored in sk_user_data might
++ *   not be suitable for copying when cloning the socket. For instance,
++ *   it can point to a reference counted object. sk_user_data bottom
++ *   bit is set if pointer must not be copied.
++ *
++ * - SK_USER_DATA_BPF:         Mark whether sk_user_data field is
++ *   managed/owned by a BPF reuseport array. This bit should be set
++ *   when sk_user_data's sk is added to the bpf's reuseport_array.
++ *
++ * - SK_USER_DATA_PSOCK:       Mark whether pointer stored in
++ *   sk_user_data points to psock type. This bit should be set
++ *   when sk_user_data is assigned to a psock object.
+  */
+ #define SK_USER_DATA_NOCOPY	1UL
+-#define SK_USER_DATA_BPF	2UL	/* Managed by BPF */
+-#define SK_USER_DATA_PTRMASK	~(SK_USER_DATA_NOCOPY | SK_USER_DATA_BPF)
++#define SK_USER_DATA_BPF	2UL
++#define SK_USER_DATA_PSOCK	4UL
++#define SK_USER_DATA_PTRMASK	~(SK_USER_DATA_NOCOPY | SK_USER_DATA_BPF |\
++				  SK_USER_DATA_PSOCK)
+ 
+ /**
+  * sk_user_data_is_nocopy - Test if sk_user_data pointer must not be copied
+@@ -565,24 +577,40 @@ static inline bool sk_user_data_is_nocopy(const struct sock *sk)
+ 
+ #define __sk_user_data(sk) ((*((void __rcu **)&(sk)->sk_user_data)))
+ 
++/**
++ * __rcu_dereference_sk_user_data_with_flags - return the pointer
++ * only if argument flags all has been set in sk_user_data. Otherwise
++ * return NULL
++ *
++ * @sk: socket
++ * @flags: flag bits
++ */
++static inline void *
++__rcu_dereference_sk_user_data_with_flags(const struct sock *sk,
++					  uintptr_t flags)
++{
++	uintptr_t sk_user_data = (uintptr_t)rcu_dereference(__sk_user_data(sk));
++
++	WARN_ON_ONCE(flags & SK_USER_DATA_PTRMASK);
++
++	if ((sk_user_data & flags) == flags)
++		return (void *)(sk_user_data & SK_USER_DATA_PTRMASK);
++	return NULL;
++}
++
+ #define rcu_dereference_sk_user_data(sk)				\
++	__rcu_dereference_sk_user_data_with_flags(sk, 0)
++#define __rcu_assign_sk_user_data_with_flags(sk, ptr, flags)		\
+ ({									\
+-	void *__tmp = rcu_dereference(__sk_user_data((sk)));		\
+-	(void *)((uintptr_t)__tmp & SK_USER_DATA_PTRMASK);		\
+-})
+-#define rcu_assign_sk_user_data(sk, ptr)				\
+-({									\
+-	uintptr_t __tmp = (uintptr_t)(ptr);				\
+-	WARN_ON_ONCE(__tmp & ~SK_USER_DATA_PTRMASK);			\
+-	rcu_assign_pointer(__sk_user_data((sk)), __tmp);		\
+-})
+-#define rcu_assign_sk_user_data_nocopy(sk, ptr)				\
+-({									\
+-	uintptr_t __tmp = (uintptr_t)(ptr);				\
+-	WARN_ON_ONCE(__tmp & ~SK_USER_DATA_PTRMASK);			\
++	uintptr_t __tmp1 = (uintptr_t)(ptr),				\
++		  __tmp2 = (uintptr_t)(flags);				\
++	WARN_ON_ONCE(__tmp1 & ~SK_USER_DATA_PTRMASK);			\
++	WARN_ON_ONCE(__tmp2 & SK_USER_DATA_PTRMASK);			\
+ 	rcu_assign_pointer(__sk_user_data((sk)),			\
+-			   __tmp | SK_USER_DATA_NOCOPY);		\
++			   __tmp1 | __tmp2);				\
+ })
++#define rcu_assign_sk_user_data(sk, ptr)				\
++	__rcu_assign_sk_user_data_with_flags(sk, ptr, 0)
+ 
+ static inline
+ struct net *sock_net(const struct sock *sk)
+diff --git a/net/core/skmsg.c b/net/core/skmsg.c
+index a8dbea559c7f..84209e661171 100644
+--- a/net/core/skmsg.c
++++ b/net/core/skmsg.c
+@@ -735,7 +735,9 @@ struct sk_psock *sk_psock_init(struct sock *sk, int node)
+ 	sk_psock_set_state(psock, SK_PSOCK_TX_ENABLED);
+ 	refcount_set(&psock->refcnt, 1);
+ 
+-	rcu_assign_sk_user_data_nocopy(sk, psock);
++	__rcu_assign_sk_user_data_with_flags(sk, psock,
++					     SK_USER_DATA_NOCOPY |
++					     SK_USER_DATA_PSOCK);
+ 	sock_hold(sk);
+ 
+ out:
+-- 
+2.37.3
+
diff --git a/0015-fbdev-fb_pm2fb-Avoid-potential-divide-by-zero-error.patch b/0015-fbdev-fb_pm2fb-Avoid-potential-divide-by-zero-error.patch
new file mode 100644
index 000000000000..0b6da2f4f43e
--- /dev/null
+++ b/0015-fbdev-fb_pm2fb-Avoid-potential-divide-by-zero-error.patch
@@ -0,0 +1,50 @@
+From cb4bb011a683532841344ca7f281b5e04389b4f8 Mon Sep 17 00:00:00 2001
+From: Letu Ren <fantasquex@gmail.com>
+Date: Thu, 18 Aug 2022 18:44:24 +0800
+Subject: [PATCH 15/73] fbdev: fb_pm2fb: Avoid potential divide by zero error
+
+commit 19f953e7435644b81332dd632ba1b2d80b1e37af upstream.
+
+In `do_fb_ioctl()` of fbmem.c, if cmd is FBIOPUT_VSCREENINFO, var will be
+copied from user, then go through `fb_set_var()` and
+`info->fbops->fb_check_var()` which could may be `pm2fb_check_var()`.
+Along the path, `var->pixclock` won't be modified. This function checks
+whether reciprocal of `var->pixclock` is too high. If `var->pixclock` is
+zero, there will be a divide by zero error. So, it is necessary to check
+whether denominator is zero to avoid crash. As this bug is found by
+Syzkaller, logs are listed below.
+
+divide error in pm2fb_check_var
+Call Trace:
+ <TASK>
+ fb_set_var+0x367/0xeb0 drivers/video/fbdev/core/fbmem.c:1015
+ do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110
+ fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189
+
+Reported-by: Zheyu Ma <zheyuma97@gmail.com>
+Signed-off-by: Letu Ren <fantasquex@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/pm2fb.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/video/fbdev/pm2fb.c b/drivers/video/fbdev/pm2fb.c
+index d3be2c64f1c0..8fd79deb1e2a 100644
+--- a/drivers/video/fbdev/pm2fb.c
++++ b/drivers/video/fbdev/pm2fb.c
+@@ -617,6 +617,11 @@ static int pm2fb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
+ 		return -EINVAL;
+ 	}
+ 
++	if (!var->pixclock) {
++		DPRINTK("pixclock is zero\n");
++		return -EINVAL;
++	}
++
+ 	if (PICOS2KHZ(var->pixclock) > PM2_MAX_PIXCLOCK) {
+ 		DPRINTK("pixclock too high (%ldKHz)\n",
+ 			PICOS2KHZ(var->pixclock));
+-- 
+2.37.3
+
diff --git a/0016-ftrace-Fix-NULL-pointer-dereference-in-is_ftrace_tra.patch b/0016-ftrace-Fix-NULL-pointer-dereference-in-is_ftrace_tra.patch
new file mode 100644
index 000000000000..26e1c1126386
--- /dev/null
+++ b/0016-ftrace-Fix-NULL-pointer-dereference-in-is_ftrace_tra.patch
@@ -0,0 +1,97 @@
+From d81bd6671f45fde4c3ac7fd7733c6e3082ae9d8e Mon Sep 17 00:00:00 2001
+From: Yang Jihong <yangjihong1@huawei.com>
+Date: Thu, 18 Aug 2022 11:26:59 +0800
+Subject: [PATCH 16/73] ftrace: Fix NULL pointer dereference in
+ is_ftrace_trampoline when ftrace is dead
+
+commit c3b0f72e805f0801f05fa2aa52011c4bfc694c44 upstream.
+
+ftrace_startup does not remove ops from ftrace_ops_list when
+ftrace_startup_enable fails:
+
+register_ftrace_function
+  ftrace_startup
+    __register_ftrace_function
+      ...
+      add_ftrace_ops(&ftrace_ops_list, ops)
+      ...
+    ...
+    ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1
+    ...
+  return 0 // ops is in the ftrace_ops_list.
+
+When ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything:
+unregister_ftrace_function
+  ftrace_shutdown
+    if (unlikely(ftrace_disabled))
+            return -ENODEV;  // return here, __unregister_ftrace_function is not executed,
+                             // as a result, ops is still in the ftrace_ops_list
+    __unregister_ftrace_function
+    ...
+
+If ops is dynamically allocated, it will be free later, in this case,
+is_ftrace_trampoline accesses NULL pointer:
+
+is_ftrace_trampoline
+  ftrace_ops_trampoline
+    do_for_each_ftrace_op(op, ftrace_ops_list) // OOPS! op may be NULL!
+
+Syzkaller reports as follows:
+[ 1203.506103] BUG: kernel NULL pointer dereference, address: 000000000000010b
+[ 1203.508039] #PF: supervisor read access in kernel mode
+[ 1203.508798] #PF: error_code(0x0000) - not-present page
+[ 1203.509558] PGD 800000011660b067 P4D 800000011660b067 PUD 130fb8067 PMD 0
+[ 1203.510560] Oops: 0000 [#1] SMP KASAN PTI
+[ 1203.511189] CPU: 6 PID: 29532 Comm: syz-executor.2 Tainted: G    B   W         5.10.0 #8
+[ 1203.512324] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
+[ 1203.513895] RIP: 0010:is_ftrace_trampoline+0x26/0xb0
+[ 1203.514644] Code: ff eb d3 90 41 55 41 54 49 89 fc 55 53 e8 f2 00 fd ff 48 8b 1d 3b 35 5d 03 e8 e6 00 fd ff 48 8d bb 90 00 00 00 e8 2a 81 26 00 <48> 8b ab 90 00 00 00 48 85 ed 74 1d e8 c9 00 fd ff 48 8d bb 98 00
+[ 1203.518838] RSP: 0018:ffffc900012cf960 EFLAGS: 00010246
+[ 1203.520092] RAX: 0000000000000000 RBX: 000000000000007b RCX: ffffffff8a331866
+[ 1203.521469] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000000000000010b
+[ 1203.522583] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8df18b07
+[ 1203.523550] R10: fffffbfff1be3160 R11: 0000000000000001 R12: 0000000000478399
+[ 1203.524596] R13: 0000000000000000 R14: ffff888145088000 R15: 0000000000000008
+[ 1203.525634] FS:  00007f429f5f4700(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000
+[ 1203.526801] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 1203.527626] CR2: 000000000000010b CR3: 0000000170e1e001 CR4: 00000000003706e0
+[ 1203.528611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 1203.529605] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+
+Therefore, when ftrace_startup_enable fails, we need to rollback registration
+process and remove ops from ftrace_ops_list.
+
+Link: https://lkml.kernel.org/r/20220818032659.56209-1-yangjihong1@huawei.com
+
+Suggested-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/ftrace.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 601ccf1b2f09..4baa99363b16 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -2937,6 +2937,16 @@ int ftrace_startup(struct ftrace_ops *ops, int command)
+ 
+ 	ftrace_startup_enable(command);
+ 
++	/*
++	 * If ftrace is in an undefined state, we just remove ops from list
++	 * to prevent the NULL pointer, instead of totally rolling it back and
++	 * free trampoline, because those actions could cause further damage.
++	 */
++	if (unlikely(ftrace_disabled)) {
++		__unregister_ftrace_function(ops);
++		return -ENODEV;
++	}
++
+ 	ops->flags &= ~FTRACE_OPS_FL_ADDING;
+ 
+ 	return 0;
+-- 
+2.37.3
+
diff --git a/0017-bpf-Don-t-redirect-packets-with-invalid-pkt_len.patch b/0017-bpf-Don-t-redirect-packets-with-invalid-pkt_len.patch
new file mode 100644
index 000000000000..3eab5b5de836
--- /dev/null
+++ b/0017-bpf-Don-t-redirect-packets-with-invalid-pkt_len.patch
@@ -0,0 +1,77 @@
+From 72f2dc8993f10262092745a88cb2dd0fef094f23 Mon Sep 17 00:00:00 2001
+From: Zhengchao Shao <shaozhengchao@huawei.com>
+Date: Fri, 15 Jul 2022 19:55:59 +0800
+Subject: [PATCH 17/73] bpf: Don't redirect packets with invalid pkt_len
+
+commit fd1894224407c484f652ad456e1ce423e89bb3eb upstream.
+
+Syzbot found an issue [1]: fq_codel_drop() try to drop a flow whitout any
+skbs, that is, the flow->head is null.
+The root cause, as the [2] says, is because that bpf_prog_test_run_skb()
+run a bpf prog which redirects empty skbs.
+So we should determine whether the length of the packet modified by bpf
+prog or others like bpf_prog_test is valid before forwarding it directly.
+
+LINK: [1] https://syzkaller.appspot.com/bug?id=0b84da80c2917757915afa89f7738a9d16ec96c5
+LINK: [2] https://www.spinics.net/lists/netdev/msg777503.html
+
+Reported-by: syzbot+7a12909485b94426aceb@syzkaller.appspotmail.com
+Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
+Reviewed-by: Stanislav Fomichev <sdf@google.com>
+Link: https://lore.kernel.org/r/20220715115559.139691-1-shaozhengchao@huawei.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/skbuff.h | 8 ++++++++
+ net/bpf/test_run.c     | 3 +++
+ net/core/dev.c         | 1 +
+ 3 files changed, 12 insertions(+)
+
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index d3d10556f0fa..2f41364a6791 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -2624,6 +2624,14 @@ static inline void skb_set_tail_pointer(struct sk_buff *skb, const int offset)
+ 
+ #endif /* NET_SKBUFF_DATA_USES_OFFSET */
+ 
++static inline void skb_assert_len(struct sk_buff *skb)
++{
++#ifdef CONFIG_DEBUG_NET
++	if (WARN_ONCE(!skb->len, "%s\n", __func__))
++		DO_ONCE_LITE(skb_dump, KERN_ERR, skb, false);
++#endif /* CONFIG_DEBUG_NET */
++}
++
+ /*
+  *	Add data to an sk_buff
+  */
+diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
+index 56f059b3c242..42f8de4ebbd7 100644
+--- a/net/bpf/test_run.c
++++ b/net/bpf/test_run.c
+@@ -955,6 +955,9 @@ static int convert___skb_to_skb(struct sk_buff *skb, struct __sk_buff *__skb)
+ {
+ 	struct qdisc_skb_cb *cb = (struct qdisc_skb_cb *)skb->cb;
+ 
++	if (!skb->len)
++		return -EINVAL;
++
+ 	if (!__skb)
+ 		return 0;
+ 
+diff --git a/net/core/dev.c b/net/core/dev.c
+index a77a979a4bf7..ecaeb3ef8e5c 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4168,6 +4168,7 @@ int __dev_queue_xmit(struct sk_buff *skb, struct net_device *sb_dev)
+ 	bool again = false;
+ 
+ 	skb_reset_mac_header(skb);
++	skb_assert_len(skb);
+ 
+ 	if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_SCHED_TSTAMP))
+ 		__skb_tstamp_tx(skb, NULL, NULL, skb->sk, SCM_TSTAMP_SCHED);
+-- 
+2.37.3
+
diff --git a/0018-mm-rmap-Fix-anon_vma-degree-ambiguity-leading-to-dou.patch b/0018-mm-rmap-Fix-anon_vma-degree-ambiguity-leading-to-dou.patch
new file mode 100644
index 000000000000..f638a0c847fe
--- /dev/null
+++ b/0018-mm-rmap-Fix-anon_vma-degree-ambiguity-leading-to-dou.patch
@@ -0,0 +1,173 @@
+From 7877eaa1131147b4d6a063962f3aac0ab1b8ea1c Mon Sep 17 00:00:00 2001
+From: Jann Horn <jannh@google.com>
+Date: Wed, 31 Aug 2022 19:06:00 +0200
+Subject: [PATCH 18/73] mm/rmap: Fix anon_vma->degree ambiguity leading to
+ double-reuse
+
+commit 2555283eb40df89945557273121e9393ef9b542b upstream.
+
+anon_vma->degree tracks the combined number of child anon_vmas and VMAs
+that use the anon_vma as their ->anon_vma.
+
+anon_vma_clone() then assumes that for any anon_vma attached to
+src->anon_vma_chain other than src->anon_vma, it is impossible for it to
+be a leaf node of the VMA tree, meaning that for such VMAs ->degree is
+elevated by 1 because of a child anon_vma, meaning that if ->degree
+equals 1 there are no VMAs that use the anon_vma as their ->anon_vma.
+
+This assumption is wrong because the ->degree optimization leads to leaf
+nodes being abandoned on anon_vma_clone() - an existing anon_vma is
+reused and no new parent-child relationship is created.  So it is
+possible to reuse an anon_vma for one VMA while it is still tied to
+another VMA.
+
+This is an issue because is_mergeable_anon_vma() and its callers assume
+that if two VMAs have the same ->anon_vma, the list of anon_vmas
+attached to the VMAs is guaranteed to be the same.  When this assumption
+is violated, vma_merge() can merge pages into a VMA that is not attached
+to the corresponding anon_vma, leading to dangling page->mapping
+pointers that will be dereferenced during rmap walks.
+
+Fix it by separately tracking the number of child anon_vmas and the
+number of VMAs using the anon_vma as their ->anon_vma.
+
+Fixes: 7a3ef208e662 ("mm: prevent endless growth of anon_vma hierarchy")
+Cc: stable@kernel.org
+Acked-by: Michal Hocko <mhocko@suse.com>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/rmap.h |  7 +++++--
+ mm/rmap.c            | 29 ++++++++++++++++-------------
+ 2 files changed, 21 insertions(+), 15 deletions(-)
+
+diff --git a/include/linux/rmap.h b/include/linux/rmap.h
+index bf80adca980b..b89b4b86951f 100644
+--- a/include/linux/rmap.h
++++ b/include/linux/rmap.h
+@@ -41,12 +41,15 @@ struct anon_vma {
+ 	atomic_t refcount;
+ 
+ 	/*
+-	 * Count of child anon_vmas and VMAs which points to this anon_vma.
++	 * Count of child anon_vmas. Equals to the count of all anon_vmas that
++	 * have ->parent pointing to this one, including itself.
+ 	 *
+ 	 * This counter is used for making decision about reusing anon_vma
+ 	 * instead of forking new one. See comments in function anon_vma_clone.
+ 	 */
+-	unsigned degree;
++	unsigned long num_children;
++	/* Count of VMAs whose ->anon_vma pointer points to this object. */
++	unsigned long num_active_vmas;
+ 
+ 	struct anon_vma *parent;	/* Parent of this anon_vma */
+ 
+diff --git a/mm/rmap.c b/mm/rmap.c
+index 746c05acad27..f6dd281df410 100644
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -93,7 +93,8 @@ static inline struct anon_vma *anon_vma_alloc(void)
+ 	anon_vma = kmem_cache_alloc(anon_vma_cachep, GFP_KERNEL);
+ 	if (anon_vma) {
+ 		atomic_set(&anon_vma->refcount, 1);
+-		anon_vma->degree = 1;	/* Reference for first vma */
++		anon_vma->num_children = 0;
++		anon_vma->num_active_vmas = 0;
+ 		anon_vma->parent = anon_vma;
+ 		/*
+ 		 * Initialise the anon_vma root to point to itself. If called
+@@ -201,6 +202,7 @@ int __anon_vma_prepare(struct vm_area_struct *vma)
+ 		anon_vma = anon_vma_alloc();
+ 		if (unlikely(!anon_vma))
+ 			goto out_enomem_free_avc;
++		anon_vma->num_children++; /* self-parent link for new root */
+ 		allocated = anon_vma;
+ 	}
+ 
+@@ -210,8 +212,7 @@ int __anon_vma_prepare(struct vm_area_struct *vma)
+ 	if (likely(!vma->anon_vma)) {
+ 		vma->anon_vma = anon_vma;
+ 		anon_vma_chain_link(vma, avc, anon_vma);
+-		/* vma reference or self-parent link for new root */
+-		anon_vma->degree++;
++		anon_vma->num_active_vmas++;
+ 		allocated = NULL;
+ 		avc = NULL;
+ 	}
+@@ -296,19 +297,19 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
+ 		anon_vma_chain_link(dst, avc, anon_vma);
+ 
+ 		/*
+-		 * Reuse existing anon_vma if its degree lower than two,
+-		 * that means it has no vma and only one anon_vma child.
++		 * Reuse existing anon_vma if it has no vma and only one
++		 * anon_vma child.
+ 		 *
+-		 * Do not choose parent anon_vma, otherwise first child
+-		 * will always reuse it. Root anon_vma is never reused:
++		 * Root anon_vma is never reused:
+ 		 * it has self-parent reference and at least one child.
+ 		 */
+ 		if (!dst->anon_vma && src->anon_vma &&
+-		    anon_vma != src->anon_vma && anon_vma->degree < 2)
++		    anon_vma->num_children < 2 &&
++		    anon_vma->num_active_vmas == 0)
+ 			dst->anon_vma = anon_vma;
+ 	}
+ 	if (dst->anon_vma)
+-		dst->anon_vma->degree++;
++		dst->anon_vma->num_active_vmas++;
+ 	unlock_anon_vma_root(root);
+ 	return 0;
+ 
+@@ -358,6 +359,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
+ 	anon_vma = anon_vma_alloc();
+ 	if (!anon_vma)
+ 		goto out_error;
++	anon_vma->num_active_vmas++;
+ 	avc = anon_vma_chain_alloc(GFP_KERNEL);
+ 	if (!avc)
+ 		goto out_error_free_anon_vma;
+@@ -378,7 +380,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
+ 	vma->anon_vma = anon_vma;
+ 	anon_vma_lock_write(anon_vma);
+ 	anon_vma_chain_link(vma, avc, anon_vma);
+-	anon_vma->parent->degree++;
++	anon_vma->parent->num_children++;
+ 	anon_vma_unlock_write(anon_vma);
+ 
+ 	return 0;
+@@ -410,7 +412,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma)
+ 		 * to free them outside the lock.
+ 		 */
+ 		if (RB_EMPTY_ROOT(&anon_vma->rb_root.rb_root)) {
+-			anon_vma->parent->degree--;
++			anon_vma->parent->num_children--;
+ 			continue;
+ 		}
+ 
+@@ -418,7 +420,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma)
+ 		anon_vma_chain_free(avc);
+ 	}
+ 	if (vma->anon_vma) {
+-		vma->anon_vma->degree--;
++		vma->anon_vma->num_active_vmas--;
+ 
+ 		/*
+ 		 * vma would still be needed after unlink, and anon_vma will be prepared
+@@ -436,7 +438,8 @@ void unlink_anon_vmas(struct vm_area_struct *vma)
+ 	list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) {
+ 		struct anon_vma *anon_vma = avc->anon_vma;
+ 
+-		VM_WARN_ON(anon_vma->degree);
++		VM_WARN_ON(anon_vma->num_children);
++		VM_WARN_ON(anon_vma->num_active_vmas);
+ 		put_anon_vma(anon_vma);
+ 
+ 		list_del(&avc->same_vma);
+-- 
+2.37.3
+
diff --git a/0019-ALSA-usb-audio-Add-quirk-for-LH-Labs-Geek-Out-HD-Aud.patch b/0019-ALSA-usb-audio-Add-quirk-for-LH-Labs-Geek-Out-HD-Aud.patch
new file mode 100644
index 000000000000..4a50a13e23cc
--- /dev/null
+++ b/0019-ALSA-usb-audio-Add-quirk-for-LH-Labs-Geek-Out-HD-Aud.patch
@@ -0,0 +1,39 @@
+From ec45c77833192fa8da4681b1a4c6847fe7e4bf4c Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sun, 28 Aug 2022 09:41:43 +0200
+Subject: [PATCH 19/73] ALSA: usb-audio: Add quirk for LH Labs Geek Out HD
+ Audio 1V5
+
+commit 5f3d9e8161bb8cb23ab3b4678cd13f6e90a06186 upstream.
+
+The USB DAC from LH Labs (2522:0007) seems requiring the same quirk as
+Sony Walkman to set up the interface like UAC1; otherwise it gets the
+constant errors "usb_set_interface failed (-71)".  This patch adds a
+quirk entry for addressing the buggy behavior.
+
+Reported-by: Lennert Van Alboom <lennert@vanalboom.org>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/T3VPXtCc4uFws9Gfh2RjX6OdwM1RqfC6VqQr--_LMDyB2x5N3p9_q6AtPna17IXhHwBtcJVdXuS80ZZSCMjh_BafIbnzJPhbrkmhmWS6DlI=@vanalboom.org
+Link: https://lore.kernel.org/r/20220828074143.14736-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/quirks.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 168fd802d70b..9bfead5efc4c 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1903,6 +1903,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
+ 		   QUIRK_FLAG_SHARE_MEDIA_DEVICE | QUIRK_FLAG_ALIGN_TRANSFER),
+ 	DEVICE_FLG(0x21b4, 0x0081, /* AudioQuest DragonFly */
+ 		   QUIRK_FLAG_GET_SAMPLE_RATE),
++	DEVICE_FLG(0x2522, 0x0007, /* LH Labs Geek Out HD Audio 1V5 */
++		   QUIRK_FLAG_SET_IFACE_FIRST),
+ 	DEVICE_FLG(0x2708, 0x0002, /* Audient iD14 */
+ 		   QUIRK_FLAG_IGNORE_CTL_ERROR),
+ 	DEVICE_FLG(0x2912, 0x30c8, /* Audioengine D1 */
+-- 
+2.37.3
+
diff --git a/0020-HID-input-fix-uclogic-tablets.patch b/0020-HID-input-fix-uclogic-tablets.patch
new file mode 100644
index 000000000000..f8a95f4638ca
--- /dev/null
+++ b/0020-HID-input-fix-uclogic-tablets.patch
@@ -0,0 +1,46 @@
+From b61400c4e784065c9783442e8ef096fefa811901 Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Date: Mon, 22 Aug 2022 08:22:47 +0200
+Subject: [PATCH 20/73] HID: input: fix uclogic tablets
+
+commit 8db8be9cfc89935c97d791c7e6264e710a7e8a56 upstream.
+
+commit 87562fcd1342 ("HID: input: remove the need for HID_QUIRK_INVERT")
+made the assumption that it was the only one handling tablets and thus
+kept an internal state regarding the tool.
+
+Turns out that the uclogic driver has a timer to release the in range
+bit, effectively making hid-input ignoring all in range information
+after the very first one.
+
+Fix that by having a more rationale approach which consists in forwarding
+every event and let the input stack filter out the duplicates.
+
+Reported-by: Stefan Hansson <newbie13xd@gmail.com>
+Fixes: 87562fcd1342 ("HID: input: remove the need for HID_QUIRK_INVERT")
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-input.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 48c1c02c69f4..871a185a0f1f 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -1532,7 +1532,10 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct
+ 			 * assume ours
+ 			 */
+ 			if (!report->tool)
+-				hid_report_set_tool(report, input, usage->code);
++				report->tool = usage->code;
++
++			/* drivers may have changed the value behind our back, resend it */
++			hid_report_set_tool(report, input, report->tool);
+ 		} else {
+ 			hid_report_release_tool(report, input, usage->code);
+ 		}
+-- 
+2.37.3
+
diff --git a/0021-HID-add-Lenovo-Yoga-C630-battery-quirk.patch b/0021-HID-add-Lenovo-Yoga-C630-battery-quirk.patch
new file mode 100644
index 000000000000..13763c3e3255
--- /dev/null
+++ b/0021-HID-add-Lenovo-Yoga-C630-battery-quirk.patch
@@ -0,0 +1,50 @@
+From 4af0f12367b2cdf687e58044a71916edb60b0f4d Mon Sep 17 00:00:00 2001
+From: Steev Klimaszewski <steev@kali.org>
+Date: Thu, 18 Aug 2022 21:39:24 -0500
+Subject: [PATCH 21/73] HID: add Lenovo Yoga C630 battery quirk
+
+commit 3a47fa7b14c7d9613909a844aba27f99d3c58634 upstream.
+
+Similar to the Surface Go devices, the Elantech touchscreen/digitizer in
+the Lenovo Yoga C630 mistakenly reports the battery of the stylus, and
+always reports an empty battery.
+
+Apply the HID_BATTERY_QUIRK_IGNORE quirk to ignore this battery and
+prevent the erroneous low battery warnings.
+
+Signed-off-by: Steev Klimaszewski <steev@kali.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-ids.h   | 1 +
+ drivers/hid/hid-input.c | 2 ++
+ 2 files changed, 3 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 9c4e92a9c646..f7e4a0d06fb8 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -414,6 +414,7 @@
+ #define USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN	0x2706
+ #define I2C_DEVICE_ID_SURFACE_GO_TOUCHSCREEN	0x261A
+ #define I2C_DEVICE_ID_SURFACE_GO2_TOUCHSCREEN	0x2A1C
++#define I2C_DEVICE_ID_LENOVO_YOGA_C630_TOUCHSCREEN	0x279F
+ 
+ #define USB_VENDOR_ID_ELECOM		0x056e
+ #define USB_DEVICE_ID_ELECOM_BM084	0x0061
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 871a185a0f1f..859aeb07542e 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -383,6 +383,8 @@ static const struct hid_device_id hid_battery_quirks[] = {
+ 	  HID_BATTERY_QUIRK_IGNORE },
+ 	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_SURFACE_GO2_TOUCHSCREEN),
+ 	  HID_BATTERY_QUIRK_IGNORE },
++	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_LENOVO_YOGA_C630_TOUCHSCREEN),
++	  HID_BATTERY_QUIRK_IGNORE },
+ 	{}
+ };
+ 
+-- 
+2.37.3
+
diff --git a/0022-HID-AMD_SFH-Add-a-DMI-quirk-entry-for-Chromebooks.patch b/0022-HID-AMD_SFH-Add-a-DMI-quirk-entry-for-Chromebooks.patch
new file mode 100644
index 000000000000..0b803b318e36
--- /dev/null
+++ b/0022-HID-AMD_SFH-Add-a-DMI-quirk-entry-for-Chromebooks.patch
@@ -0,0 +1,60 @@
+From 2803225ac89bc761ade8673105db8a8d84335054 Mon Sep 17 00:00:00 2001
+From: Akihiko Odaki <akihiko.odaki@gmail.com>
+Date: Tue, 16 Aug 2022 19:21:20 +0900
+Subject: [PATCH 22/73] HID: AMD_SFH: Add a DMI quirk entry for Chromebooks
+
+commit adada3f4930ac084740ea340bd8e94028eba4f22 upstream.
+
+Google Chromebooks use Chrome OS Embedded Controller Sensor Hub instead
+of Sensor Hub Fusion and leaves MP2 uninitialized, which disables all
+functionalities, even including the registers necessary for feature
+detections.
+
+The behavior was observed with Lenovo ThinkPad C13 Yoga.
+
+Signed-off-by: Akihiko Odaki <akihiko.odaki@gmail.com>
+Suggested-by: Mario Limonciello <mario.limonciello@amd.com>
+Acked-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
+index 1441787a154a..9b97dc0695e3 100644
+--- a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
++++ b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
+@@ -285,11 +285,29 @@ static int amd_sfh_irq_init(struct amd_mp2_dev *privdata)
+ 	return 0;
+ }
+ 
++static const struct dmi_system_id dmi_nodevs[] = {
++	{
++		/*
++		 * Google Chromebooks use Chrome OS Embedded Controller Sensor
++		 * Hub instead of Sensor Hub Fusion and leaves MP2
++		 * uninitialized, which disables all functionalities, even
++		 * including the registers necessary for feature detections.
++		 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Google"),
++		},
++	},
++	{ }
++};
++
+ static int amd_mp2_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ {
+ 	struct amd_mp2_dev *privdata;
+ 	int rc;
+ 
++	if (dmi_first_match(dmi_nodevs))
++		return -ENODEV;
++
+ 	privdata = devm_kzalloc(&pdev->dev, sizeof(*privdata), GFP_KERNEL);
+ 	if (!privdata)
+ 		return -ENOMEM;
+-- 
+2.37.3
+
diff --git a/0023-HID-Add-Apple-Touchbar-on-T2-Macs-in-hid_have_specia.patch b/0023-HID-Add-Apple-Touchbar-on-T2-Macs-in-hid_have_specia.patch
new file mode 100644
index 000000000000..815f96874316
--- /dev/null
+++ b/0023-HID-Add-Apple-Touchbar-on-T2-Macs-in-hid_have_specia.patch
@@ -0,0 +1,65 @@
+From 5b3063adff7da583e61b284beb3308f7588a4c8a Mon Sep 17 00:00:00 2001
+From: Aditya Garg <gargaditya08@live.com>
+Date: Sun, 21 Aug 2022 08:04:45 +0000
+Subject: [PATCH 23/73] HID: Add Apple Touchbar on T2 Macs in
+ hid_have_special_driver list
+
+commit 750ec977288d96e9a11424e3507ede097af732c4 upstream.
+
+The touchbar on Apple T2 Macs has 2 modes, one that shows the function
+keys and other that shows the media controls. The user can use the fn
+key on his keyboard to switch between the 2 modes.
+
+On Linux, if people were using an external keyboard or mouse, the
+touchbar failed to change modes on pressing the fn key with the following
+in dmesg :-
+
+[   10.661445] apple-ib-als 0003:05AC:8262.0001: : USB HID v1.01 Device [Apple Inc. Ambient Light Sensor] on usb-bce-vhci-3/input0
+[   11.830992] apple-ib-touchbar 0003:05AC:8302.0007: input: USB HID v1.01 Keyboard [Apple Inc. Touch Bar Display] on usb-bce-vhci-6/input0
+[   12.139407] apple-ib-touchbar 0003:05AC:8102.0008: : USB HID v1.01 Device [Apple Inc. Touch Bar Backlight] on usb-bce-vhci-7/input0
+[   12.211824] apple-ib-touchbar 0003:05AC:8102.0009: : USB HID v1.01 Device [Apple Inc. Touch Bar Backlight] on usb-bce-vhci-7/input1
+[   14.219759] apple-ib-touchbar 0003:05AC:8302.0007: tb: Failed to set touch bar mode to 2 (-110)
+[   24.395670] apple-ib-touchbar 0003:05AC:8302.0007: tb: Failed to set touch bar mode to 2 (-110)
+[   34.635791] apple-ib-touchbar 0003:05AC:8302.0007: tb: Failed to set touch bar mode to 2 (-110)
+[  269.579233] apple-ib-touchbar 0003:05AC:8302.0007: tb: Failed to set touch bar mode to 1 (-110)
+
+Add the USB IDs of the touchbar found in T2 Macs to HID have special
+driver list to fix the issue.
+
+Signed-off-by: Aditya Garg <gargaditya08@live.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-ids.h    | 2 ++
+ drivers/hid/hid-quirks.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index f7e4a0d06fb8..bc550e884f37 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -185,6 +185,8 @@
+ #define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021   0x029c
+ #define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021   0x029a
+ #define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_2021   0x029f
++#define USB_DEVICE_ID_APPLE_TOUCHBAR_BACKLIGHT 0x8102
++#define USB_DEVICE_ID_APPLE_TOUCHBAR_DISPLAY 0x8302
+ 
+ #define USB_VENDOR_ID_ASUS		0x0486
+ #define USB_DEVICE_ID_ASUS_T91MT	0x0185
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index dc67717d2dab..70f602c64fd1 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -314,6 +314,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_TOUCHBAR_BACKLIGHT) },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_TOUCHBAR_DISPLAY) },
+ #endif
+ #if IS_ENABLED(CONFIG_HID_APPLEIR)
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL) },
+-- 
+2.37.3
+
diff --git a/0024-HID-asus-ROG-NKey-Ignore-portion-of-0x5a-report.patch b/0024-HID-asus-ROG-NKey-Ignore-portion-of-0x5a-report.patch
new file mode 100644
index 000000000000..dcb1277fc522
--- /dev/null
+++ b/0024-HID-asus-ROG-NKey-Ignore-portion-of-0x5a-report.patch
@@ -0,0 +1,43 @@
+From 2b32e820ccf5a0385e46d1c038b321aba9a5ec2d Mon Sep 17 00:00:00 2001
+From: Josh Kilmer <srjek2@gmail.com>
+Date: Thu, 28 Jul 2022 12:51:11 -0500
+Subject: [PATCH 24/73] HID: asus: ROG NKey: Ignore portion of 0x5a report
+
+commit 1c0cc9d11c665020cbeb80e660fb8929164407f4 upstream.
+
+On an Asus G513QY, of the 5 bytes in a 0x5a report, only the first byte
+is a meaningful keycode. The other bytes are zeroed out or hold garbage
+from the last packet sent to the keyboard.
+
+This patch fixes up the report descriptor for this event so that the
+general hid code will only process 1 byte for keycodes, avoiding
+spurious key events and unmapped Asus vendor usagepage code warnings.
+
+Signed-off-by: Josh Kilmer <srjek2@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-asus.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
+index 08c9a9a60ae4..b59c3dafa6a4 100644
+--- a/drivers/hid/hid-asus.c
++++ b/drivers/hid/hid-asus.c
+@@ -1212,6 +1212,13 @@ static __u8 *asus_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ 		rdesc = new_rdesc;
+ 	}
+ 
++	if (drvdata->quirks & QUIRK_ROG_NKEY_KEYBOARD &&
++			*rsize == 331 && rdesc[190] == 0x85 && rdesc[191] == 0x5a &&
++			rdesc[204] == 0x95 && rdesc[205] == 0x05) {
++		hid_info(hdev, "Fixing up Asus N-KEY keyb report descriptor\n");
++		rdesc[205] = 0x01;
++	}
++
+ 	return rdesc;
+ }
+ 
+-- 
+2.37.3
+
diff --git a/0025-HID-nintendo-fix-rumble-worker-null-pointer-deref.patch b/0025-HID-nintendo-fix-rumble-worker-null-pointer-deref.patch
new file mode 100644
index 000000000000..145b7ec77cd5
--- /dev/null
+++ b/0025-HID-nintendo-fix-rumble-worker-null-pointer-deref.patch
@@ -0,0 +1,54 @@
+From 7c6e6c334154be16740b44dcd7638fb510b9bd91 Mon Sep 17 00:00:00 2001
+From: "Daniel J. Ogorchock" <djogorchock@gmail.com>
+Date: Wed, 13 Jul 2022 16:20:59 -0400
+Subject: [PATCH 25/73] HID: nintendo: fix rumble worker null pointer deref
+
+commit 1ff89e06c2e5fab30274e4b02360d4241d6e605e upstream.
+
+We can dereference a null pointer trying to queue work to a destroyed
+workqueue.
+
+If the device is disconnected, nintendo_hid_remove is called, in which
+the rumble_queue is destroyed. Avoid using that queue to defer rumble
+work once the controller state is set to JOYCON_CTLR_STATE_REMOVED.
+
+This eliminates the null pointer dereference.
+
+Signed-off-by: Daniel J. Ogorchock <djogorchock@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-nintendo.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/hid-nintendo.c b/drivers/hid/hid-nintendo.c
+index 4b1173957c17..f33a03c96ba6 100644
+--- a/drivers/hid/hid-nintendo.c
++++ b/drivers/hid/hid-nintendo.c
+@@ -1222,6 +1222,7 @@ static void joycon_parse_report(struct joycon_ctlr *ctlr,
+ 
+ 	spin_lock_irqsave(&ctlr->lock, flags);
+ 	if (IS_ENABLED(CONFIG_NINTENDO_FF) && rep->vibrator_report &&
++	    ctlr->ctlr_state != JOYCON_CTLR_STATE_REMOVED &&
+ 	    (msecs - ctlr->rumble_msecs) >= JC_RUMBLE_PERIOD_MS &&
+ 	    (ctlr->rumble_queue_head != ctlr->rumble_queue_tail ||
+ 	     ctlr->rumble_zero_countdown > 0)) {
+@@ -1546,12 +1547,13 @@ static int joycon_set_rumble(struct joycon_ctlr *ctlr, u16 amp_r, u16 amp_l,
+ 		ctlr->rumble_queue_head = 0;
+ 	memcpy(ctlr->rumble_data[ctlr->rumble_queue_head], data,
+ 	       JC_RUMBLE_DATA_SIZE);
+-	spin_unlock_irqrestore(&ctlr->lock, flags);
+ 
+ 	/* don't wait for the periodic send (reduces latency) */
+-	if (schedule_now)
++	if (schedule_now && ctlr->ctlr_state != JOYCON_CTLR_STATE_REMOVED)
+ 		queue_work(ctlr->rumble_queue, &ctlr->rumble_worker);
+ 
++	spin_unlock_irqrestore(&ctlr->lock, flags);
++
+ 	return 0;
+ }
+ 
+-- 
+2.37.3
+
diff --git a/0026-HID-thrustmaster-Add-sparco-wheel-and-fix-array-leng.patch b/0026-HID-thrustmaster-Add-sparco-wheel-and-fix-array-leng.patch
new file mode 100644
index 000000000000..f220eb6f76c5
--- /dev/null
+++ b/0026-HID-thrustmaster-Add-sparco-wheel-and-fix-array-leng.patch
@@ -0,0 +1,44 @@
+From a32046896fe1ad944fd61aec3127485066c4eff4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michael=20H=C3=BCbner?= <michaelh.95@t-online.de>
+Date: Fri, 5 Aug 2022 10:05:23 +0200
+Subject: [PATCH 26/73] HID: thrustmaster: Add sparco wheel and fix array
+ length
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit d9a17651f3749e69890db57ca66e677dfee70829 upstream.
+
+Add device id for the Sparco R383 Mod wheel.
+
+Fix wheel info array length to match actual wheel count present in the array.
+
+Signed-off-by: Michael Hübner <michaelh.95@t-online.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-thrustmaster.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-thrustmaster.c b/drivers/hid/hid-thrustmaster.c
+index c3e6d69fdfbd..cf1679b0d4fb 100644
+--- a/drivers/hid/hid-thrustmaster.c
++++ b/drivers/hid/hid-thrustmaster.c
+@@ -67,12 +67,13 @@ static const struct tm_wheel_info tm_wheels_infos[] = {
+ 	{0x0200, 0x0005, "Thrustmaster T300RS (Missing Attachment)"},
+ 	{0x0206, 0x0005, "Thrustmaster T300RS"},
+ 	{0x0209, 0x0005, "Thrustmaster T300RS (Open Wheel Attachment)"},
++	{0x020a, 0x0005, "Thrustmaster T300RS (Sparco R383 Mod)"},
+ 	{0x0204, 0x0005, "Thrustmaster T300 Ferrari Alcantara Edition"},
+ 	{0x0002, 0x0002, "Thrustmaster T500RS"}
+ 	//{0x0407, 0x0001, "Thrustmaster TMX"}
+ };
+ 
+-static const uint8_t tm_wheels_infos_length = 4;
++static const uint8_t tm_wheels_infos_length = 7;
+ 
+ /*
+  * This structs contains (in little endian) the response data
+-- 
+2.37.3
+
diff --git a/0027-HID-intel-ish-hid-ipc-Add-Meteor-Lake-PCI-device-ID.patch b/0027-HID-intel-ish-hid-ipc-Add-Meteor-Lake-PCI-device-ID.patch
new file mode 100644
index 000000000000..a3574351d744
--- /dev/null
+++ b/0027-HID-intel-ish-hid-ipc-Add-Meteor-Lake-PCI-device-ID.patch
@@ -0,0 +1,45 @@
+From 1d7df13d223b4bdf52ba51eec15d7161235bdde4 Mon Sep 17 00:00:00 2001
+From: Even Xu <even.xu@intel.com>
+Date: Tue, 23 Aug 2022 09:10:59 +0800
+Subject: [PATCH 27/73] HID: intel-ish-hid: ipc: Add Meteor Lake PCI device ID
+
+commit 467249a7dff68451868ca79696aef69764193a8a upstream.
+
+Add device ID of Meteor Lake P into ishtp support list.
+
+Signed-off-by: Even Xu <even.xu@intel.com>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/intel-ish-hid/ipc/hw-ish.h  | 1 +
+ drivers/hid/intel-ish-hid/ipc/pci-ish.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/hid/intel-ish-hid/ipc/hw-ish.h b/drivers/hid/intel-ish-hid/ipc/hw-ish.h
+index e600dbf04dfc..fc108f19a64c 100644
+--- a/drivers/hid/intel-ish-hid/ipc/hw-ish.h
++++ b/drivers/hid/intel-ish-hid/ipc/hw-ish.h
+@@ -32,6 +32,7 @@
+ #define ADL_P_DEVICE_ID		0x51FC
+ #define ADL_N_DEVICE_ID		0x54FC
+ #define RPL_S_DEVICE_ID		0x7A78
++#define MTL_P_DEVICE_ID		0x7E45
+ 
+ #define	REVISION_ID_CHT_A0	0x6
+ #define	REVISION_ID_CHT_Ax_SI	0x0
+diff --git a/drivers/hid/intel-ish-hid/ipc/pci-ish.c b/drivers/hid/intel-ish-hid/ipc/pci-ish.c
+index 2c67ec17bec6..7120b30ac51d 100644
+--- a/drivers/hid/intel-ish-hid/ipc/pci-ish.c
++++ b/drivers/hid/intel-ish-hid/ipc/pci-ish.c
+@@ -43,6 +43,7 @@ static const struct pci_device_id ish_pci_tbl[] = {
+ 	{PCI_DEVICE(PCI_VENDOR_ID_INTEL, ADL_P_DEVICE_ID)},
+ 	{PCI_DEVICE(PCI_VENDOR_ID_INTEL, ADL_N_DEVICE_ID)},
+ 	{PCI_DEVICE(PCI_VENDOR_ID_INTEL, RPL_S_DEVICE_ID)},
++	{PCI_DEVICE(PCI_VENDOR_ID_INTEL, MTL_P_DEVICE_ID)},
+ 	{0, }
+ };
+ MODULE_DEVICE_TABLE(pci, ish_pci_tbl);
+-- 
+2.37.3
+
diff --git a/0028-mmc-mtk-sd-Clear-interrupts-when-cqe-off-disable.patch b/0028-mmc-mtk-sd-Clear-interrupts-when-cqe-off-disable.patch
new file mode 100644
index 000000000000..e2a9459eb7f4
--- /dev/null
+++ b/0028-mmc-mtk-sd-Clear-interrupts-when-cqe-off-disable.patch
@@ -0,0 +1,58 @@
+From 1c137c46d16e33b71ef92daf1882d5443fa2ec93 Mon Sep 17 00:00:00 2001
+From: Wenbin Mei <wenbin.mei@mediatek.com>
+Date: Thu, 28 Jul 2022 16:00:48 +0800
+Subject: [PATCH 28/73] mmc: mtk-sd: Clear interrupts when cqe off/disable
+
+[ Upstream commit cc5d1692600613e72f32af60e27330fe0c79f4fe ]
+
+Currently we don't clear MSDC interrupts when cqe off/disable, which led
+to the data complete interrupt will be reserved for the next command.
+If the next command with data transfer after cqe off/disable, we process
+the CMD ready interrupt and trigger DMA start for data, but the data
+complete interrupt is already exists, then SW assume that the data transfer
+is complete, SW will trigger DMA stop, but the data may not be transmitted
+yet or is transmitting, so we may encounter the following error:
+mtk-msdc 11230000.mmc: CMD bus busy detected.
+
+Signed-off-by: Wenbin Mei <wenbin.mei@mediatek.com>
+Fixes: 88bd652b3c74 ("mmc: mediatek: command queue support")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20220728080048.21336-1-wenbin.mei@mediatek.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/mtk-sd.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
+index 9da4489dc345..378a26a1825c 100644
+--- a/drivers/mmc/host/mtk-sd.c
++++ b/drivers/mmc/host/mtk-sd.c
+@@ -2414,6 +2414,9 @@ static void msdc_cqe_disable(struct mmc_host *mmc, bool recovery)
+ 	/* disable busy check */
+ 	sdr_clr_bits(host->base + MSDC_PATCH_BIT1, MSDC_PB1_BUSY_CHECK_SEL);
+ 
++	val = readl(host->base + MSDC_INT);
++	writel(val, host->base + MSDC_INT);
++
+ 	if (recovery) {
+ 		sdr_set_field(host->base + MSDC_DMA_CTRL,
+ 			      MSDC_DMA_CTRL_STOP, 1);
+@@ -2871,11 +2874,14 @@ static int __maybe_unused msdc_suspend(struct device *dev)
+ {
+ 	struct mmc_host *mmc = dev_get_drvdata(dev);
+ 	int ret;
++	u32 val;
+ 
+ 	if (mmc->caps2 & MMC_CAP2_CQE) {
+ 		ret = cqhci_suspend(mmc);
+ 		if (ret)
+ 			return ret;
++		val = readl(((struct msdc_host *)mmc_priv(mmc))->base + MSDC_INT);
++		writel(val, ((struct msdc_host *)mmc_priv(mmc))->base + MSDC_INT);
+ 	}
+ 
+ 	return pm_runtime_force_suspend(dev);
+-- 
+2.37.3
+
diff --git a/0029-mmc-sdhci-of-dwcmshc-add-reset-call-back-for-rockchi.patch b/0029-mmc-sdhci-of-dwcmshc-add-reset-call-back-for-rockchi.patch
new file mode 100644
index 000000000000..c41845c29e0e
--- /dev/null
+++ b/0029-mmc-sdhci-of-dwcmshc-add-reset-call-back-for-rockchi.patch
@@ -0,0 +1,92 @@
+From d1541cdf5aecb0b85c26624478b154cce920281b Mon Sep 17 00:00:00 2001
+From: Yifeng Zhao <yifeng.zhao@rock-chips.com>
+Date: Wed, 4 May 2022 23:32:39 +0200
+Subject: [PATCH 29/73] mmc: sdhci-of-dwcmshc: add reset call back for rockchip
+ Socs
+
+[ Upstream commit 70f832206fe72e9998b46363e8e59e89b0b757bc ]
+
+The reset function build in the SDHCI will not reset the logic
+circuit related to the tuning function, which may cause data
+reading errors. Resetting the complete SDHCI controller through
+the reset controller fixes the issue.
+
+Signed-off-by: Yifeng Zhao <yifeng.zhao@rock-chips.com>
+[rebase, use optional variant of reset getter]
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Link: https://lore.kernel.org/r/20220504213251.264819-10-sebastian.reichel@collabora.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-of-dwcmshc.c | 26 +++++++++++++++++++++++++-
+ 1 file changed, 25 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/sdhci-of-dwcmshc.c b/drivers/mmc/host/sdhci-of-dwcmshc.c
+index bac874ab0b33..3a1b5ba36405 100644
+--- a/drivers/mmc/host/sdhci-of-dwcmshc.c
++++ b/drivers/mmc/host/sdhci-of-dwcmshc.c
+@@ -15,6 +15,7 @@
+ #include <linux/module.h>
+ #include <linux/of.h>
+ #include <linux/of_device.h>
++#include <linux/reset.h>
+ #include <linux/sizes.h>
+ 
+ #include "sdhci-pltfm.h"
+@@ -63,6 +64,7 @@
+ struct rk3568_priv {
+ 	/* Rockchip specified optional clocks */
+ 	struct clk_bulk_data rockchip_clks[RK3568_MAX_CLKS];
++	struct reset_control *reset;
+ 	u8 txclk_tapnum;
+ };
+ 
+@@ -255,6 +257,21 @@ static void dwcmshc_rk3568_set_clock(struct sdhci_host *host, unsigned int clock
+ 	sdhci_writel(host, extra, DWCMSHC_EMMC_DLL_STRBIN);
+ }
+ 
++static void rk35xx_sdhci_reset(struct sdhci_host *host, u8 mask)
++{
++	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
++	struct dwcmshc_priv *dwc_priv = sdhci_pltfm_priv(pltfm_host);
++	struct rk35xx_priv *priv = dwc_priv->priv;
++
++	if (mask & SDHCI_RESET_ALL && priv->reset) {
++		reset_control_assert(priv->reset);
++		udelay(1);
++		reset_control_deassert(priv->reset);
++	}
++
++	sdhci_reset(host, mask);
++}
++
+ static const struct sdhci_ops sdhci_dwcmshc_ops = {
+ 	.set_clock		= sdhci_set_clock,
+ 	.set_bus_width		= sdhci_set_bus_width,
+@@ -269,7 +286,7 @@ static const struct sdhci_ops sdhci_dwcmshc_rk3568_ops = {
+ 	.set_bus_width		= sdhci_set_bus_width,
+ 	.set_uhs_signaling	= dwcmshc_set_uhs_signaling,
+ 	.get_max_clock		= sdhci_pltfm_clk_get_max_clock,
+-	.reset			= sdhci_reset,
++	.reset			= rk35xx_sdhci_reset,
+ 	.adma_write_desc	= dwcmshc_adma_write_desc,
+ };
+ 
+@@ -292,6 +309,13 @@ static int dwcmshc_rk3568_init(struct sdhci_host *host, struct dwcmshc_priv *dwc
+ 	int err;
+ 	struct rk3568_priv *priv = dwc_priv->priv;
+ 
++	priv->reset = devm_reset_control_array_get_optional_exclusive(mmc_dev(host->mmc));
++	if (IS_ERR(priv->reset)) {
++		err = PTR_ERR(priv->reset);
++		dev_err(mmc_dev(host->mmc), "failed to get reset control %d\n", err);
++		return err;
++	}
++
+ 	priv->rockchip_clks[0].id = "axi";
+ 	priv->rockchip_clks[1].id = "block";
+ 	priv->rockchip_clks[2].id = "timer";
+-- 
+2.37.3
+
diff --git a/0030-mmc-sdhci-of-dwcmshc-rename-rk3568-to-rk35xx.patch b/0030-mmc-sdhci-of-dwcmshc-rename-rk3568-to-rk35xx.patch
new file mode 100644
index 000000000000..6466e967f226
--- /dev/null
+++ b/0030-mmc-sdhci-of-dwcmshc-rename-rk3568-to-rk35xx.patch
@@ -0,0 +1,202 @@
+From 30841ba786ee2e55e05fa98a7c255b83313694f4 Mon Sep 17 00:00:00 2001
+From: Sebastian Reichel <sebastian.reichel@collabora.com>
+Date: Wed, 4 May 2022 23:32:40 +0200
+Subject: [PATCH 30/73] mmc: sdhci-of-dwcmshc: rename rk3568 to rk35xx
+
+[ Upstream commit 86e1a8e1f9b555af342c53ae06284eeeab9a4263 ]
+
+Prepare driver for rk3588 support by renaming the internal data
+structures.
+
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Link: https://lore.kernel.org/r/20220504213251.264819-11-sebastian.reichel@collabora.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-of-dwcmshc.c | 46 ++++++++++++++---------------
+ 1 file changed, 23 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci-of-dwcmshc.c b/drivers/mmc/host/sdhci-of-dwcmshc.c
+index 3a1b5ba36405..f5fd88c7adef 100644
+--- a/drivers/mmc/host/sdhci-of-dwcmshc.c
++++ b/drivers/mmc/host/sdhci-of-dwcmshc.c
+@@ -56,14 +56,14 @@
+ #define DLL_LOCK_WO_TMOUT(x) \
+ 	((((x) & DWCMSHC_EMMC_DLL_LOCKED) == DWCMSHC_EMMC_DLL_LOCKED) && \
+ 	(((x) & DWCMSHC_EMMC_DLL_TIMEOUT) == 0))
+-#define RK3568_MAX_CLKS 3
++#define RK35xx_MAX_CLKS 3
+ 
+ #define BOUNDARY_OK(addr, len) \
+ 	((addr | (SZ_128M - 1)) == ((addr + len - 1) | (SZ_128M - 1)))
+ 
+-struct rk3568_priv {
++struct rk35xx_priv {
+ 	/* Rockchip specified optional clocks */
+-	struct clk_bulk_data rockchip_clks[RK3568_MAX_CLKS];
++	struct clk_bulk_data rockchip_clks[RK35xx_MAX_CLKS];
+ 	struct reset_control *reset;
+ 	u8 txclk_tapnum;
+ };
+@@ -178,7 +178,7 @@ static void dwcmshc_rk3568_set_clock(struct sdhci_host *host, unsigned int clock
+ {
+ 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ 	struct dwcmshc_priv *dwc_priv = sdhci_pltfm_priv(pltfm_host);
+-	struct rk3568_priv *priv = dwc_priv->priv;
++	struct rk35xx_priv *priv = dwc_priv->priv;
+ 	u8 txclk_tapnum = DLL_TXCLK_TAPNUM_DEFAULT;
+ 	u32 extra, reg;
+ 	int err;
+@@ -281,7 +281,7 @@ static const struct sdhci_ops sdhci_dwcmshc_ops = {
+ 	.adma_write_desc	= dwcmshc_adma_write_desc,
+ };
+ 
+-static const struct sdhci_ops sdhci_dwcmshc_rk3568_ops = {
++static const struct sdhci_ops sdhci_dwcmshc_rk35xx_ops = {
+ 	.set_clock		= dwcmshc_rk3568_set_clock,
+ 	.set_bus_width		= sdhci_set_bus_width,
+ 	.set_uhs_signaling	= dwcmshc_set_uhs_signaling,
+@@ -296,18 +296,18 @@ static const struct sdhci_pltfm_data sdhci_dwcmshc_pdata = {
+ 	.quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
+ };
+ 
+-static const struct sdhci_pltfm_data sdhci_dwcmshc_rk3568_pdata = {
+-	.ops = &sdhci_dwcmshc_rk3568_ops,
++static const struct sdhci_pltfm_data sdhci_dwcmshc_rk35xx_pdata = {
++	.ops = &sdhci_dwcmshc_rk35xx_ops,
+ 	.quirks = SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN |
+ 		  SDHCI_QUIRK_BROKEN_TIMEOUT_VAL,
+ 	.quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN |
+ 		   SDHCI_QUIRK2_CLOCK_DIV_ZERO_BROKEN,
+ };
+ 
+-static int dwcmshc_rk3568_init(struct sdhci_host *host, struct dwcmshc_priv *dwc_priv)
++static int dwcmshc_rk35xx_init(struct sdhci_host *host, struct dwcmshc_priv *dwc_priv)
+ {
+ 	int err;
+-	struct rk3568_priv *priv = dwc_priv->priv;
++	struct rk35xx_priv *priv = dwc_priv->priv;
+ 
+ 	priv->reset = devm_reset_control_array_get_optional_exclusive(mmc_dev(host->mmc));
+ 	if (IS_ERR(priv->reset)) {
+@@ -319,14 +319,14 @@ static int dwcmshc_rk3568_init(struct sdhci_host *host, struct dwcmshc_priv *dwc
+ 	priv->rockchip_clks[0].id = "axi";
+ 	priv->rockchip_clks[1].id = "block";
+ 	priv->rockchip_clks[2].id = "timer";
+-	err = devm_clk_bulk_get_optional(mmc_dev(host->mmc), RK3568_MAX_CLKS,
++	err = devm_clk_bulk_get_optional(mmc_dev(host->mmc), RK35xx_MAX_CLKS,
+ 					 priv->rockchip_clks);
+ 	if (err) {
+ 		dev_err(mmc_dev(host->mmc), "failed to get clocks %d\n", err);
+ 		return err;
+ 	}
+ 
+-	err = clk_bulk_prepare_enable(RK3568_MAX_CLKS, priv->rockchip_clks);
++	err = clk_bulk_prepare_enable(RK35xx_MAX_CLKS, priv->rockchip_clks);
+ 	if (err) {
+ 		dev_err(mmc_dev(host->mmc), "failed to enable clocks %d\n", err);
+ 		return err;
+@@ -348,7 +348,7 @@ static int dwcmshc_rk3568_init(struct sdhci_host *host, struct dwcmshc_priv *dwc
+ static const struct of_device_id sdhci_dwcmshc_dt_ids[] = {
+ 	{
+ 		.compatible = "rockchip,rk3568-dwcmshc",
+-		.data = &sdhci_dwcmshc_rk3568_pdata,
++		.data = &sdhci_dwcmshc_rk35xx_pdata,
+ 	},
+ 	{
+ 		.compatible = "snps,dwcmshc-sdhci",
+@@ -371,7 +371,7 @@ static int dwcmshc_probe(struct platform_device *pdev)
+ 	struct sdhci_pltfm_host *pltfm_host;
+ 	struct sdhci_host *host;
+ 	struct dwcmshc_priv *priv;
+-	struct rk3568_priv *rk_priv = NULL;
++	struct rk35xx_priv *rk_priv = NULL;
+ 	const struct sdhci_pltfm_data *pltfm_data;
+ 	int err;
+ 	u32 extra;
+@@ -426,8 +426,8 @@ static int dwcmshc_probe(struct platform_device *pdev)
+ 	host->mmc_host_ops.request = dwcmshc_request;
+ 	host->mmc_host_ops.hs400_enhanced_strobe = dwcmshc_hs400_enhanced_strobe;
+ 
+-	if (pltfm_data == &sdhci_dwcmshc_rk3568_pdata) {
+-		rk_priv = devm_kzalloc(&pdev->dev, sizeof(struct rk3568_priv), GFP_KERNEL);
++	if (pltfm_data == &sdhci_dwcmshc_rk35xx_pdata) {
++		rk_priv = devm_kzalloc(&pdev->dev, sizeof(struct rk35xx_priv), GFP_KERNEL);
+ 		if (!rk_priv) {
+ 			err = -ENOMEM;
+ 			goto err_clk;
+@@ -435,7 +435,7 @@ static int dwcmshc_probe(struct platform_device *pdev)
+ 
+ 		priv->priv = rk_priv;
+ 
+-		err = dwcmshc_rk3568_init(host, priv);
++		err = dwcmshc_rk35xx_init(host, priv);
+ 		if (err)
+ 			goto err_clk;
+ 	}
+@@ -452,7 +452,7 @@ static int dwcmshc_probe(struct platform_device *pdev)
+ 	clk_disable_unprepare(pltfm_host->clk);
+ 	clk_disable_unprepare(priv->bus_clk);
+ 	if (rk_priv)
+-		clk_bulk_disable_unprepare(RK3568_MAX_CLKS,
++		clk_bulk_disable_unprepare(RK35xx_MAX_CLKS,
+ 					   rk_priv->rockchip_clks);
+ free_pltfm:
+ 	sdhci_pltfm_free(pdev);
+@@ -464,14 +464,14 @@ static int dwcmshc_remove(struct platform_device *pdev)
+ 	struct sdhci_host *host = platform_get_drvdata(pdev);
+ 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ 	struct dwcmshc_priv *priv = sdhci_pltfm_priv(pltfm_host);
+-	struct rk3568_priv *rk_priv = priv->priv;
++	struct rk35xx_priv *rk_priv = priv->priv;
+ 
+ 	sdhci_remove_host(host, 0);
+ 
+ 	clk_disable_unprepare(pltfm_host->clk);
+ 	clk_disable_unprepare(priv->bus_clk);
+ 	if (rk_priv)
+-		clk_bulk_disable_unprepare(RK3568_MAX_CLKS,
++		clk_bulk_disable_unprepare(RK35xx_MAX_CLKS,
+ 					   rk_priv->rockchip_clks);
+ 	sdhci_pltfm_free(pdev);
+ 
+@@ -484,7 +484,7 @@ static int dwcmshc_suspend(struct device *dev)
+ 	struct sdhci_host *host = dev_get_drvdata(dev);
+ 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ 	struct dwcmshc_priv *priv = sdhci_pltfm_priv(pltfm_host);
+-	struct rk3568_priv *rk_priv = priv->priv;
++	struct rk35xx_priv *rk_priv = priv->priv;
+ 	int ret;
+ 
+ 	ret = sdhci_suspend_host(host);
+@@ -496,7 +496,7 @@ static int dwcmshc_suspend(struct device *dev)
+ 		clk_disable_unprepare(priv->bus_clk);
+ 
+ 	if (rk_priv)
+-		clk_bulk_disable_unprepare(RK3568_MAX_CLKS,
++		clk_bulk_disable_unprepare(RK35xx_MAX_CLKS,
+ 					   rk_priv->rockchip_clks);
+ 
+ 	return ret;
+@@ -507,7 +507,7 @@ static int dwcmshc_resume(struct device *dev)
+ 	struct sdhci_host *host = dev_get_drvdata(dev);
+ 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+ 	struct dwcmshc_priv *priv = sdhci_pltfm_priv(pltfm_host);
+-	struct rk3568_priv *rk_priv = priv->priv;
++	struct rk35xx_priv *rk_priv = priv->priv;
+ 	int ret;
+ 
+ 	ret = clk_prepare_enable(pltfm_host->clk);
+@@ -521,7 +521,7 @@ static int dwcmshc_resume(struct device *dev)
+ 	}
+ 
+ 	if (rk_priv) {
+-		ret = clk_bulk_prepare_enable(RK3568_MAX_CLKS,
++		ret = clk_bulk_prepare_enable(RK35xx_MAX_CLKS,
+ 					      rk_priv->rockchip_clks);
+ 		if (ret)
+ 			return ret;
+-- 
+2.37.3
+
diff --git a/0031-mmc-sdhci-of-dwcmshc-Re-enable-support-for-the-BlueF.patch b/0031-mmc-sdhci-of-dwcmshc-Re-enable-support-for-the-BlueF.patch
new file mode 100644
index 000000000000..a75f7345c45d
--- /dev/null
+++ b/0031-mmc-sdhci-of-dwcmshc-Re-enable-support-for-the-BlueF.patch
@@ -0,0 +1,72 @@
+From c9215e9018bd17ac5b4dfb1a032268e27f45a819 Mon Sep 17 00:00:00 2001
+From: Liming Sun <limings@nvidia.com>
+Date: Tue, 9 Aug 2022 13:37:42 -0400
+Subject: [PATCH 31/73] mmc: sdhci-of-dwcmshc: Re-enable support for the
+ BlueField-3 SoC
+
+[ Upstream commit a0753ef66c34c1739580219dca664eda648164b7 ]
+
+The commit 08f3dff799d4 (mmc: sdhci-of-dwcmshc: add rockchip platform
+support") introduces the use of_device_get_match_data() to check for some
+chips. Unfortunately, it also breaks the BlueField-3 FW, which uses ACPI.
+
+To fix the problem, let's add the ACPI match data and the corresponding
+quirks to re-enable the support for the BlueField-3 SoC.
+
+Reviewed-by: David Woods <davwoods@nvidia.com>
+Signed-off-by: Liming Sun <limings@nvidia.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Fixes: 08f3dff799d4 ("mmc: sdhci-of-dwcmshc: add rockchip platform support")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20220809173742.178440-1-limings@nvidia.com
+[Ulf: Clarified the commit message a bit]
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-of-dwcmshc.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci-of-dwcmshc.c b/drivers/mmc/host/sdhci-of-dwcmshc.c
+index f5fd88c7adef..335c88fd849c 100644
+--- a/drivers/mmc/host/sdhci-of-dwcmshc.c
++++ b/drivers/mmc/host/sdhci-of-dwcmshc.c
+@@ -296,6 +296,15 @@ static const struct sdhci_pltfm_data sdhci_dwcmshc_pdata = {
+ 	.quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
+ };
+ 
++#ifdef CONFIG_ACPI
++static const struct sdhci_pltfm_data sdhci_dwcmshc_bf3_pdata = {
++	.ops = &sdhci_dwcmshc_ops,
++	.quirks = SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN,
++	.quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN |
++		   SDHCI_QUIRK2_ACMD23_BROKEN,
++};
++#endif
++
+ static const struct sdhci_pltfm_data sdhci_dwcmshc_rk35xx_pdata = {
+ 	.ops = &sdhci_dwcmshc_rk35xx_ops,
+ 	.quirks = SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN |
+@@ -360,7 +369,10 @@ MODULE_DEVICE_TABLE(of, sdhci_dwcmshc_dt_ids);
+ 
+ #ifdef CONFIG_ACPI
+ static const struct acpi_device_id sdhci_dwcmshc_acpi_ids[] = {
+-	{ .id = "MLNXBF30" },
++	{
++		.id = "MLNXBF30",
++		.driver_data = (kernel_ulong_t)&sdhci_dwcmshc_bf3_pdata,
++	},
+ 	{}
+ };
+ #endif
+@@ -376,7 +388,7 @@ static int dwcmshc_probe(struct platform_device *pdev)
+ 	int err;
+ 	u32 extra;
+ 
+-	pltfm_data = of_device_get_match_data(&pdev->dev);
++	pltfm_data = device_get_match_data(&pdev->dev);
+ 	if (!pltfm_data) {
+ 		dev_err(&pdev->dev, "Error: No device match data found\n");
+ 		return -ENODEV;
+-- 
+2.37.3
+
diff --git a/0032-fs-ntfs3-Fix-work-with-fragmented-xattr.patch b/0032-fs-ntfs3-Fix-work-with-fragmented-xattr.patch
new file mode 100644
index 000000000000..d7a1e8b3f91b
--- /dev/null
+++ b/0032-fs-ntfs3-Fix-work-with-fragmented-xattr.patch
@@ -0,0 +1,44 @@
+From d875be57a21586f2ebdacb04afa134932b4d4d91 Mon Sep 17 00:00:00 2001
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Date: Fri, 13 May 2022 19:54:23 +0300
+Subject: [PATCH 32/73] fs/ntfs3: Fix work with fragmented xattr
+
+[ Upstream commit 42f86b1226a42bfc79a7125af435432ad4680a32 ]
+
+In some cases xattr is too fragmented,
+so we need to load it before writing.
+
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/xattr.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c
+index 3629049decac..e3d443ccb9be 100644
+--- a/fs/ntfs3/xattr.c
++++ b/fs/ntfs3/xattr.c
+@@ -118,7 +118,7 @@ static int ntfs_read_ea(struct ntfs_inode *ni, struct EA_FULL **ea,
+ 
+ 		run_init(&run);
+ 
+-		err = attr_load_runs(attr_ea, ni, &run, NULL);
++		err = attr_load_runs_range(ni, ATTR_EA, NULL, 0, &run, 0, size);
+ 		if (!err)
+ 			err = ntfs_read_run_nb(sbi, &run, 0, ea_p, size, NULL);
+ 		run_close(&run);
+@@ -444,6 +444,11 @@ static noinline int ntfs_set_ea(struct inode *inode, const char *name,
+ 		/* Delete xattr, ATTR_EA */
+ 		ni_remove_attr_le(ni, attr, mi, le);
+ 	} else if (attr->non_res) {
++		err = attr_load_runs_range(ni, ATTR_EA, NULL, 0, &ea_run, 0,
++					   size);
++		if (err)
++			goto out;
++
+ 		err = ntfs_sb_write_run(sbi, &ea_run, 0, ea_all, size, 0);
+ 		if (err)
+ 			goto out;
+-- 
+2.37.3
+
diff --git a/0033-ASoC-sh-rz-ssi-Improve-error-handling-in-rz_ssi_prob.patch b/0033-ASoC-sh-rz-ssi-Improve-error-handling-in-rz_ssi_prob.patch
new file mode 100644
index 000000000000..77c32942d5ba
--- /dev/null
+++ b/0033-ASoC-sh-rz-ssi-Improve-error-handling-in-rz_ssi_prob.patch
@@ -0,0 +1,78 @@
+From dc4351487a55899ad73a286391c1b58604754956 Mon Sep 17 00:00:00 2001
+From: Biju Das <biju.das.jz@bp.renesas.com>
+Date: Thu, 28 Jul 2022 10:26:12 +0100
+Subject: [PATCH 33/73] ASoC: sh: rz-ssi: Improve error handling in
+ rz_ssi_probe() error path
+
+[ Upstream commit c75ed9f54ce8d349fee557f2b471a4d637ed2a6b ]
+
+We usually do cleanup in reverse order of init. Currently in case of
+error rz_ssi_release_dma_channels() done in the reverse order. This
+patch improves error handling in rz_ssi_probe() error path.
+
+While at it, use "goto cleanup" style to reduce code duplication.
+
+Reported-by: Pavel Machek <pavel@denx.de>
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Link: https://lore.kernel.org/r/20220728092612.38858-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sh/rz-ssi.c | 26 +++++++++++++++-----------
+ 1 file changed, 15 insertions(+), 11 deletions(-)
+
+diff --git a/sound/soc/sh/rz-ssi.c b/sound/soc/sh/rz-ssi.c
+index e392de7a262e..3d74acffec11 100644
+--- a/sound/soc/sh/rz-ssi.c
++++ b/sound/soc/sh/rz-ssi.c
+@@ -1016,32 +1016,36 @@ static int rz_ssi_probe(struct platform_device *pdev)
+ 
+ 	ssi->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL);
+ 	if (IS_ERR(ssi->rstc)) {
+-		rz_ssi_release_dma_channels(ssi);
+-		return PTR_ERR(ssi->rstc);
++		ret = PTR_ERR(ssi->rstc);
++		goto err_reset;
+ 	}
+ 
+ 	reset_control_deassert(ssi->rstc);
+ 	pm_runtime_enable(&pdev->dev);
+ 	ret = pm_runtime_resume_and_get(&pdev->dev);
+ 	if (ret < 0) {
+-		rz_ssi_release_dma_channels(ssi);
+-		pm_runtime_disable(ssi->dev);
+-		reset_control_assert(ssi->rstc);
+-		return dev_err_probe(ssi->dev, ret, "pm_runtime_resume_and_get failed\n");
++		dev_err(&pdev->dev, "pm_runtime_resume_and_get failed\n");
++		goto err_pm;
+ 	}
+ 
+ 	ret = devm_snd_soc_register_component(&pdev->dev, &rz_ssi_soc_component,
+ 					      rz_ssi_soc_dai,
+ 					      ARRAY_SIZE(rz_ssi_soc_dai));
+ 	if (ret < 0) {
+-		rz_ssi_release_dma_channels(ssi);
+-
+-		pm_runtime_put(ssi->dev);
+-		pm_runtime_disable(ssi->dev);
+-		reset_control_assert(ssi->rstc);
+ 		dev_err(&pdev->dev, "failed to register snd component\n");
++		goto err_snd_soc;
+ 	}
+ 
++	return 0;
++
++err_snd_soc:
++	pm_runtime_put(ssi->dev);
++err_pm:
++	pm_runtime_disable(ssi->dev);
++	reset_control_assert(ssi->rstc);
++err_reset:
++	rz_ssi_release_dma_channels(ssi);
++
+ 	return ret;
+ }
+ 
+-- 
+2.37.3
+
diff --git a/0034-ASoC-rt5640-Fix-the-JD-voltage-dropping-issue.patch b/0034-ASoC-rt5640-Fix-the-JD-voltage-dropping-issue.patch
new file mode 100644
index 000000000000..169d6292104d
--- /dev/null
+++ b/0034-ASoC-rt5640-Fix-the-JD-voltage-dropping-issue.patch
@@ -0,0 +1,44 @@
+From 33f15a70fe9d26554d6b8f306f088a5e3ae31e49 Mon Sep 17 00:00:00 2001
+From: Oder Chiou <oder_chiou@realtek.com>
+Date: Mon, 8 Aug 2022 13:28:36 +0800
+Subject: [PATCH 34/73] ASoC: rt5640: Fix the JD voltage dropping issue
+
+[ Upstream commit afb176d45870048eea540991b082208270824037 ]
+
+The patch fixes the JD voltage dropping issue in the HDA JD using.
+
+Signed-off-by: Oder Chiou <oder_chiou@realtek.com>
+Reported-by: Mohan Kumar D <mkumard@nvidia.com>
+Link: https://lore.kernel.org/r/20220808052836.25791-1-oder_chiou@realtek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5640.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/rt5640.c b/sound/soc/codecs/rt5640.c
+index 18b3da9211e3..5ada0d318d0f 100644
+--- a/sound/soc/codecs/rt5640.c
++++ b/sound/soc/codecs/rt5640.c
+@@ -1986,7 +1986,7 @@ static int rt5640_set_bias_level(struct snd_soc_component *component,
+ 		snd_soc_component_write(component, RT5640_PWR_MIXER, 0x0000);
+ 		if (rt5640->jd_src == RT5640_JD_SRC_HDA_HEADER)
+ 			snd_soc_component_write(component, RT5640_PWR_ANLG1,
+-				0x0018);
++				0x2818);
+ 		else
+ 			snd_soc_component_write(component, RT5640_PWR_ANLG1,
+ 				0x0000);
+@@ -2592,7 +2592,8 @@ static void rt5640_enable_hda_jack_detect(
+ 	snd_soc_component_update_bits(component, RT5640_DUMMY1, 0x400, 0x0);
+ 
+ 	snd_soc_component_update_bits(component, RT5640_PWR_ANLG1,
+-		RT5640_PWR_VREF2, RT5640_PWR_VREF2);
++		RT5640_PWR_VREF2 | RT5640_PWR_MB | RT5640_PWR_BG,
++		RT5640_PWR_VREF2 | RT5640_PWR_MB | RT5640_PWR_BG);
+ 	usleep_range(10000, 15000);
+ 	snd_soc_component_update_bits(component, RT5640_PWR_ANLG1,
+ 		RT5640_PWR_FV2, RT5640_PWR_FV2);
+-- 
+2.37.3
+
diff --git a/0035-rtla-Fix-tracer-name.patch b/0035-rtla-Fix-tracer-name.patch
new file mode 100644
index 000000000000..01c9acd6208b
--- /dev/null
+++ b/0035-rtla-Fix-tracer-name.patch
@@ -0,0 +1,62 @@
+From de3f7eb0b8642ded71fae5bbf4db584933da6c7d Mon Sep 17 00:00:00 2001
+From: Alexandre Vicenzi <alexandre.vicenzi@suse.com>
+Date: Mon, 8 Aug 2022 20:03:43 +0200
+Subject: [PATCH 35/73] rtla: Fix tracer name
+
+[ Upstream commit f1432cd24c240cedf78c0d026631e3b10052c8e1 ]
+
+The correct tracer name is timerlat and not timelat.
+
+Link: https://lore.kernel.org/linux-trace-devel/20220808180343.22262-1-alexandre.vicenzi@suse.com
+
+Signed-off-by: Alexandre Vicenzi <alexandre.vicenzi@suse.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/tools/rtla/rtla-timerlat-hist.rst | 2 +-
+ tools/tracing/rtla/src/timerlat_hist.c          | 2 +-
+ tools/tracing/rtla/src/timerlat_top.c           | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/Documentation/tools/rtla/rtla-timerlat-hist.rst b/Documentation/tools/rtla/rtla-timerlat-hist.rst
+index e12eae1f3301..6bf7f0ca4556 100644
+--- a/Documentation/tools/rtla/rtla-timerlat-hist.rst
++++ b/Documentation/tools/rtla/rtla-timerlat-hist.rst
+@@ -33,7 +33,7 @@ EXAMPLE
+ =======
+ In the example below, **rtla timerlat hist** is set to run for *10* minutes,
+ in the cpus *0-4*, *skipping zero* only lines. Moreover, **rtla timerlat
+-hist** will change the priority of the *timelat* threads to run under
++hist** will change the priority of the *timerlat* threads to run under
+ *SCHED_DEADLINE* priority, with a *10us* runtime every *1ms* period. The
+ *1ms* period is also passed to the *timerlat* tracer::
+ 
+diff --git a/tools/tracing/rtla/src/timerlat_hist.c b/tools/tracing/rtla/src/timerlat_hist.c
+index f3ec628f5e51..4b48af8a8309 100644
+--- a/tools/tracing/rtla/src/timerlat_hist.c
++++ b/tools/tracing/rtla/src/timerlat_hist.c
+@@ -892,7 +892,7 @@ int timerlat_hist_main(int argc, char *argv[])
+ 	return_value = 0;
+ 
+ 	if (trace_is_off(&tool->trace, &record->trace)) {
+-		printf("rtla timelat hit stop tracing\n");
++		printf("rtla timerlat hit stop tracing\n");
+ 		if (params->trace_output) {
+ 			printf("  Saving trace to %s\n", params->trace_output);
+ 			save_trace_to_file(record->trace.inst, params->trace_output);
+diff --git a/tools/tracing/rtla/src/timerlat_top.c b/tools/tracing/rtla/src/timerlat_top.c
+index 35452a1d45e9..334271935222 100644
+--- a/tools/tracing/rtla/src/timerlat_top.c
++++ b/tools/tracing/rtla/src/timerlat_top.c
+@@ -687,7 +687,7 @@ int timerlat_top_main(int argc, char *argv[])
+ 	return_value = 0;
+ 
+ 	if (trace_is_off(&top->trace, &record->trace)) {
+-		printf("rtla timelat hit stop tracing\n");
++		printf("rtla timerlat hit stop tracing\n");
+ 		if (params->trace_output) {
+ 			printf("  Saving trace to %s\n", params->trace_output);
+ 			save_trace_to_file(record->trace.inst, params->trace_output);
+-- 
+2.37.3
+
diff --git a/0036-drm-amd-display-Add-a-missing-register-field-for-HPO.patch b/0036-drm-amd-display-Add-a-missing-register-field-for-HPO.patch
new file mode 100644
index 000000000000..07a600c3ae85
--- /dev/null
+++ b/0036-drm-amd-display-Add-a-missing-register-field-for-HPO.patch
@@ -0,0 +1,37 @@
+From ae29c0c466812726347813ab44bc144f0b4644b6 Mon Sep 17 00:00:00 2001
+From: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Date: Fri, 29 Jul 2022 13:36:31 -0400
+Subject: [PATCH 36/73] drm/amd/display: Add a missing register field for HPO
+ DP stream encoder
+
+[ Upstream commit 37bc31f0e7da4fbad4664e64d906ae7b9009e550 ]
+
+[Why&How]
+Add the missing definition to set the register field
+HBLANK_MINIMUM_SYMBOL_WIDTH
+
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/dcn31/dcn31_hpo_dp_stream_encoder.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hpo_dp_stream_encoder.h b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hpo_dp_stream_encoder.h
+index 7c77c71591a0..82c3b3ac1f0d 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hpo_dp_stream_encoder.h
++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_hpo_dp_stream_encoder.h
+@@ -162,7 +162,8 @@
+ 	SE_SF(DP_SYM32_ENC0_DP_SYM32_ENC_SDP_AUDIO_CONTROL0, AIP_ENABLE, mask_sh),\
+ 	SE_SF(DP_SYM32_ENC0_DP_SYM32_ENC_SDP_AUDIO_CONTROL0, ACM_ENABLE, mask_sh),\
+ 	SE_SF(DP_SYM32_ENC0_DP_SYM32_ENC_VID_CRC_CONTROL, CRC_ENABLE, mask_sh),\
+-	SE_SF(DP_SYM32_ENC0_DP_SYM32_ENC_VID_CRC_CONTROL, CRC_CONT_MODE_ENABLE, mask_sh)
++	SE_SF(DP_SYM32_ENC0_DP_SYM32_ENC_VID_CRC_CONTROL, CRC_CONT_MODE_ENABLE, mask_sh),\
++	SE_SF(DP_SYM32_ENC0_DP_SYM32_ENC_HBLANK_CONTROL, HBLANK_MINIMUM_SYMBOL_WIDTH, mask_sh)
+ 
+ 
+ #define DCN3_1_HPO_DP_STREAM_ENC_REG_FIELD_LIST(type) \
+-- 
+2.37.3
+
diff --git a/0037-drm-amd-display-Device-flash-garbage-before-get-in-O.patch b/0037-drm-amd-display-Device-flash-garbage-before-get-in-O.patch
new file mode 100644
index 000000000000..f0107e81fb83
--- /dev/null
+++ b/0037-drm-amd-display-Device-flash-garbage-before-get-in-O.patch
@@ -0,0 +1,40 @@
+From ab01ac7fa985755e29663283ec13179e99bf8fcf Mon Sep 17 00:00:00 2001
+From: Chiawen Huang <chiawen.huang@amd.com>
+Date: Thu, 21 Jul 2022 21:57:05 +0800
+Subject: [PATCH 37/73] drm/amd/display: Device flash garbage before get in OS
+
+[ Upstream commit 9c580e8f6cd6524d4e2c3490c440110526f7ddd6 ]
+
+[Why]
+Enabling stream with tg lock makes config settings
+pending causing the garbage until tg unlock.
+
+[How]
+Keep the original lock mechanism
+The driver doesn't lock tg if plane_state is null.
+
+Reviewed-by: Anthony Koo <Anthony.Koo@amd.com>
+Acked-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Chiawen Huang <chiawen.huang@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+index e3a62873c0e7..d9ab27991535 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+@@ -108,6 +108,7 @@ void dcn10_lock_all_pipes(struct dc *dc,
+ 		 */
+ 		if (pipe_ctx->top_pipe ||
+ 		    !pipe_ctx->stream ||
++		    !pipe_ctx->plane_state ||
+ 		    !tg->funcs->is_tg_enabled(tg))
+ 			continue;
+ 
+-- 
+2.37.3
+
diff --git a/0038-drm-amd-display-Avoid-MPC-infinite-loop.patch b/0038-drm-amd-display-Avoid-MPC-infinite-loop.patch
new file mode 100644
index 000000000000..cef646076e47
--- /dev/null
+++ b/0038-drm-amd-display-Avoid-MPC-infinite-loop.patch
@@ -0,0 +1,64 @@
+From b26218b2349ac2b2141fd07430ded3786bee6910 Mon Sep 17 00:00:00 2001
+From: Josip Pavic <Josip.Pavic@amd.com>
+Date: Thu, 21 Jul 2022 15:33:00 -0400
+Subject: [PATCH 38/73] drm/amd/display: Avoid MPC infinite loop
+
+[ Upstream commit 8de297dc046c180651c0500f8611663ae1c3828a ]
+
+[why]
+In some cases MPC tree bottom pipe ends up point to itself.  This causes
+iterating from top to bottom to hang the system in an infinite loop.
+
+[how]
+When looping to next MPC bottom pipe, check that the pointer is not same
+as current to avoid infinite loop.
+
+Reviewed-by: Josip Pavic <Josip.Pavic@amd.com>
+Reviewed-by: Jun Lei <Jun.Lei@amd.com>
+Acked-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Aric Cyr <aric.cyr@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c | 6 ++++++
+ drivers/gpu/drm/amd/display/dc/dcn20/dcn20_mpc.c | 6 ++++++
+ 2 files changed, 12 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c
+index 11019c2c62cc..8192f1967e92 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c
+@@ -126,6 +126,12 @@ struct mpcc *mpc1_get_mpcc_for_dpp(struct mpc_tree *tree, int dpp_id)
+ 	while (tmp_mpcc != NULL) {
+ 		if (tmp_mpcc->dpp_id == dpp_id)
+ 			return tmp_mpcc;
++
++		/* avoid circular linked list */
++		ASSERT(tmp_mpcc != tmp_mpcc->mpcc_bot);
++		if (tmp_mpcc == tmp_mpcc->mpcc_bot)
++			break;
++
+ 		tmp_mpcc = tmp_mpcc->mpcc_bot;
+ 	}
+ 	return NULL;
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_mpc.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_mpc.c
+index 15734db0cdea..f3c311d09319 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_mpc.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_mpc.c
+@@ -531,6 +531,12 @@ static struct mpcc *mpc2_get_mpcc_for_dpp(struct mpc_tree *tree, int dpp_id)
+ 	while (tmp_mpcc != NULL) {
+ 		if (tmp_mpcc->dpp_id == 0xf || tmp_mpcc->dpp_id == dpp_id)
+ 			return tmp_mpcc;
++
++		/* avoid circular linked list */
++		ASSERT(tmp_mpcc != tmp_mpcc->mpcc_bot);
++		if (tmp_mpcc == tmp_mpcc->mpcc_bot)
++			break;
++
+ 		tmp_mpcc = tmp_mpcc->mpcc_bot;
+ 	}
+ 	return NULL;
+-- 
+2.37.3
+
diff --git a/0039-drm-amd-display-Fix-HDMI-VSIF-V3-incorrect-issue.patch b/0039-drm-amd-display-Fix-HDMI-VSIF-V3-incorrect-issue.patch
new file mode 100644
index 000000000000..70d2f1797d54
--- /dev/null
+++ b/0039-drm-amd-display-Fix-HDMI-VSIF-V3-incorrect-issue.patch
@@ -0,0 +1,75 @@
+From 71f2cb739a3cbcda4612889ce660fd8c380e3e1d Mon Sep 17 00:00:00 2001
+From: Leo Ma <hanghong.ma@amd.com>
+Date: Fri, 22 Jul 2022 13:42:58 -0400
+Subject: [PATCH 39/73] drm/amd/display: Fix HDMI VSIF V3 incorrect issue
+
+[ Upstream commit 0591183699fceeafb4c4141072d47775de83ecfb ]
+
+[Why]
+Reported from customer the checksum in AMD VSIF V3 is incorrect and
+causing blank screen issue.
+
+[How]
+Fix the packet length issue on AMD HDMI VSIF V3.
+
+Reviewed-by: Anthony Koo <Anthony.Koo@amd.com>
+Acked-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Leo Ma <hanghong.ma@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/modules/freesync/freesync.c   | 15 +++------------
+ 1 file changed, 3 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
+index 03fa63d56fa6..948151e73573 100644
+--- a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
++++ b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
+@@ -615,10 +615,6 @@ static void build_vrr_infopacket_data_v1(const struct mod_vrr_params *vrr,
+ 	 * Note: We should never go above the field rate of the mode timing set.
+ 	 */
+ 	infopacket->sb[8] = (unsigned char)((vrr->max_refresh_in_uhz + 500000) / 1000000);
+-
+-	/* FreeSync HDR */
+-	infopacket->sb[9] = 0;
+-	infopacket->sb[10] = 0;
+ }
+ 
+ static void build_vrr_infopacket_data_v3(const struct mod_vrr_params *vrr,
+@@ -686,10 +682,6 @@ static void build_vrr_infopacket_data_v3(const struct mod_vrr_params *vrr,
+ 
+ 	/* PB16 : Reserved bits 7:1, FixedRate bit 0 */
+ 	infopacket->sb[16] = (vrr->state == VRR_STATE_ACTIVE_FIXED) ? 1 : 0;
+-
+-	//FreeSync HDR
+-	infopacket->sb[9] = 0;
+-	infopacket->sb[10] = 0;
+ }
+ 
+ static void build_vrr_infopacket_fs2_data(enum color_transfer_func app_tf,
+@@ -774,8 +766,7 @@ static void build_vrr_infopacket_header_v2(enum signal_type signal,
+ 		/* HB2  = [Bits 7:5 = 0] [Bits 4:0 = Length = 0x09] */
+ 		infopacket->hb2 = 0x09;
+ 
+-		*payload_size = 0x0A;
+-
++		*payload_size = 0x09;
+ 	} else if (dc_is_dp_signal(signal)) {
+ 
+ 		/* HEADER */
+@@ -824,9 +815,9 @@ static void build_vrr_infopacket_header_v3(enum signal_type signal,
+ 		infopacket->hb1 = version;
+ 
+ 		/* HB2  = [Bits 7:5 = 0] [Bits 4:0 = Length] */
+-		*payload_size = 0x10;
+-		infopacket->hb2 = *payload_size - 1; //-1 for checksum
++		infopacket->hb2 = 0x10;
+ 
++		*payload_size = 0x10;
+ 	} else if (dc_is_dp_signal(signal)) {
+ 
+ 		/* HEADER */
+-- 
+2.37.3
+
diff --git a/0040-drm-amd-display-For-stereo-keep-FLIP_ANY_FRAME.patch b/0040-drm-amd-display-For-stereo-keep-FLIP_ANY_FRAME.patch
new file mode 100644
index 000000000000..9708bf39d1da
--- /dev/null
+++ b/0040-drm-amd-display-For-stereo-keep-FLIP_ANY_FRAME.patch
@@ -0,0 +1,38 @@
+From c6f7ba837efc8f12c51aecaf9570d86adb80ab90 Mon Sep 17 00:00:00 2001
+From: Alvin Lee <alvin.lee2@amd.com>
+Date: Thu, 28 Jul 2022 09:51:05 -0400
+Subject: [PATCH 40/73] drm/amd/display: For stereo keep "FLIP_ANY_FRAME"
+
+[ Upstream commit 84ef99c728079dfd21d6bc70b4c3e4af20602b3c ]
+
+[Description]
+Observed in stereomode that programming FLIP_LEFT_EYE
+can cause hangs. Keep FLIP_ANY_FRAME in stereo mode so
+the surface flip can take place before left or right eye
+
+Reviewed-by: Martin Leung <Martin.Leung@amd.com>
+Acked-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Alvin Lee <alvin.lee2@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c
+index 6a4dcafb9bba..dc3e8df706b3 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c
+@@ -86,7 +86,7 @@ bool hubp3_program_surface_flip_and_addr(
+ 			VMID, address->vmid);
+ 
+ 	if (address->type == PLN_ADDR_TYPE_GRPH_STEREO) {
+-		REG_UPDATE(DCSURF_FLIP_CONTROL, SURFACE_FLIP_MODE_FOR_STEREOSYNC, 0x1);
++		REG_UPDATE(DCSURF_FLIP_CONTROL, SURFACE_FLIP_MODE_FOR_STEREOSYNC, 0);
+ 		REG_UPDATE(DCSURF_FLIP_CONTROL, SURFACE_FLIP_IN_STEREOSYNC, 0x1);
+ 
+ 	} else {
+-- 
+2.37.3
+
diff --git a/0041-drm-amd-display-clear-optc-underflow-before-turn-off.patch b/0041-drm-amd-display-clear-optc-underflow-before-turn-off.patch
new file mode 100644
index 000000000000..1eb0e65821bb
--- /dev/null
+++ b/0041-drm-amd-display-clear-optc-underflow-before-turn-off.patch
@@ -0,0 +1,44 @@
+From 3101839b080137c367f3f88c2a040f791de880aa Mon Sep 17 00:00:00 2001
+From: Fudong Wang <Fudong.Wang@amd.com>
+Date: Wed, 27 Jul 2022 12:01:29 +0800
+Subject: [PATCH 41/73] drm/amd/display: clear optc underflow before turn off
+ odm clock
+
+[ Upstream commit b2a93490201300a749ad261b5c5d05cb50179c44 ]
+
+[Why]
+After ODM clock off, optc underflow bit will be kept there always and clear not work.
+We need to clear that before clock off.
+
+[How]
+Clear that if have when clock off.
+
+Reviewed-by: Alvin Lee <alvin.lee2@amd.com>
+Acked-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Fudong Wang <Fudong.Wang@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c
+index b1671b00ce40..2349977b0abb 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c
+@@ -464,6 +464,11 @@ void optc1_enable_optc_clock(struct timing_generator *optc, bool enable)
+ 				OTG_CLOCK_ON, 1,
+ 				1, 1000);
+ 	} else  {
++
++		//last chance to clear underflow, otherwise, it will always there due to clock is off.
++		if (optc->funcs->is_optc_underflow_occurred(optc) == true)
++			optc->funcs->clear_optc_underflow(optc);
++
+ 		REG_UPDATE_2(OTG_CLOCK_CONTROL,
+ 				OTG_CLOCK_GATE_DIS, 0,
+ 				OTG_CLOCK_EN, 0);
+-- 
+2.37.3
+
diff --git a/0042-drm-amd-display-Fix-TDR-eDP-and-USB4-display-light-u.patch b/0042-drm-amd-display-Fix-TDR-eDP-and-USB4-display-light-u.patch
new file mode 100644
index 000000000000..5b36705e89ef
--- /dev/null
+++ b/0042-drm-amd-display-Fix-TDR-eDP-and-USB4-display-light-u.patch
@@ -0,0 +1,58 @@
+From 909dae582c8f3a9a231c7bc41594787b1620a5f1 Mon Sep 17 00:00:00 2001
+From: Meenakshikumar Somasundaram <meenakshikumar.somasundaram@amd.com>
+Date: Mon, 11 Jul 2022 18:37:41 -0400
+Subject: [PATCH 42/73] drm/amd/display: Fix TDR eDP and USB4 display light up
+ issue
+
+[ Upstream commit 30456ffa65469d1d2e5e1da05017e6728d24c11c ]
+
+[Why]
+After TDR recovery, eDP and USB4 display does not light up. Because
+dmub outbox notifications are not enabled after dmub reload and link
+encoder assignments for the streams are not cleared before dc state
+reset.
+
+[How]
+- Dmub outbox notification is enabled after tdr recovery by issuing
+  inbox command to dmub.
+- Link encoders for the streams are unassigned before dc state reset.
+
+Reviewed-by: Jimmy Kizito <Jimmy.Kizito@amd.com>
+Reviewed-by: Jun Lei <Jun.Lei@amd.com>
+Acked-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Meenakshikumar Somasundaram <meenakshikumar.somasundaram@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 1 +
+ drivers/gpu/drm/amd/display/dc/dc_link.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index f14449401188..7d69341acca0 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -3783,6 +3783,7 @@ void dc_enable_dmub_outbox(struct dc *dc)
+ 	struct dc_context *dc_ctx = dc->ctx;
+ 
+ 	dmub_enable_outbox_notification(dc_ctx->dmub_srv);
++	DC_LOG_DC("%s: dmub outbox notifications enabled\n", __func__);
+ }
+ 
+ /**
+diff --git a/drivers/gpu/drm/amd/display/dc/dc_link.h b/drivers/gpu/drm/amd/display/dc/dc_link.h
+index a3c37ee3f849..f96f53c1bc25 100644
+--- a/drivers/gpu/drm/amd/display/dc/dc_link.h
++++ b/drivers/gpu/drm/amd/display/dc/dc_link.h
+@@ -337,6 +337,7 @@ enum dc_detect_reason {
+ 	DETECT_REASON_HPDRX,
+ 	DETECT_REASON_FALLBACK,
+ 	DETECT_REASON_RETRAIN,
++	DETECT_REASON_TDR,
+ };
+ 
+ bool dc_link_detect(struct dc_link *dc_link, enum dc_detect_reason reason);
+-- 
+2.37.3
+
diff --git a/0043-drm-amd-pm-skip-pptable-override-for-smu_v13_0_7.patch b/0043-drm-amd-pm-skip-pptable-override-for-smu_v13_0_7.patch
new file mode 100644
index 000000000000..df96307872b4
--- /dev/null
+++ b/0043-drm-amd-pm-skip-pptable-override-for-smu_v13_0_7.patch
@@ -0,0 +1,48 @@
+From 952d4c72d9032eec5c38249ca353d31c43be06e0 Mon Sep 17 00:00:00 2001
+From: Kenneth Feng <kenneth.feng@amd.com>
+Date: Tue, 9 Aug 2022 10:13:54 +0800
+Subject: [PATCH 43/73] drm/amd/pm: skip pptable override for smu_v13_0_7
+
+[ Upstream commit 4e64b529c5b04e7944b41de554ee686ecab00744 ]
+
+skip pptable override for smu_v13_0_7 secure boards only.
+
+Signed-off-by: Kenneth Feng <kenneth.feng@amd.com>
+Reviewed-by: Feifei Xu <Feifei.Xu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
+index 5aa08c031f72..1d8a9e5b3cc0 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c
+@@ -203,6 +203,9 @@ int smu_v13_0_init_pptable_microcode(struct smu_context *smu)
+ 	if (!adev->scpm_enabled)
+ 		return 0;
+ 
++	if (adev->ip_versions[MP1_HWIP][0] == IP_VERSION(13, 0, 7))
++		return 0;
++
+ 	/* override pptable_id from driver parameter */
+ 	if (amdgpu_smu_pptable_id >= 0) {
+ 		pptable_id = amdgpu_smu_pptable_id;
+@@ -210,13 +213,6 @@ int smu_v13_0_init_pptable_microcode(struct smu_context *smu)
+ 	} else {
+ 		pptable_id = smu->smu_table.boot_values.pp_table_id;
+ 
+-		if (adev->ip_versions[MP1_HWIP][0] == IP_VERSION(13, 0, 7) &&
+-			pptable_id == 3667)
+-			pptable_id = 36671;
+-
+-		if (adev->ip_versions[MP1_HWIP][0] == IP_VERSION(13, 0, 7) &&
+-			pptable_id == 3688)
+-			pptable_id = 36881;
+ 		/*
+ 		 * Temporary solution for SMU V13.0.0 with SCPM enabled:
+ 		 *   - use 36831 signed pptable when pp_table_id is 3683
+-- 
+2.37.3
+
diff --git a/0044-drm-amdkfd-Handle-restart-of-kfd_ioctl_wait_events.patch b/0044-drm-amdkfd-Handle-restart-of-kfd_ioctl_wait_events.patch
new file mode 100644
index 000000000000..98c1497dea94
--- /dev/null
+++ b/0044-drm-amdkfd-Handle-restart-of-kfd_ioctl_wait_events.patch
@@ -0,0 +1,125 @@
+From 21e3891abc83f2d5482c67cca2fb7f228635daaf Mon Sep 17 00:00:00 2001
+From: Felix Kuehling <Felix.Kuehling@amd.com>
+Date: Thu, 4 Aug 2022 18:19:38 -0400
+Subject: [PATCH 44/73] drm/amdkfd: Handle restart of kfd_ioctl_wait_events
+
+[ Upstream commit bea9a56afbc4b5a41ea579b8b0dc5e189b439504 ]
+
+When kfd_ioctl_wait_events needs to restart due to a signal, we need to
+update the timeout to account for the time already elapsed. We also need
+to undo auto_reset of events that have signaled already, so that the
+restarted ioctl will be able to count those signals again.
+
+This fixes infinite hangs when kfd_ioctl_wait_events is interrupted by a
+signal.
+
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Reviewed-and-tested-by: Xiaogang Chen <Xiaogang.Chen@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_chardev.c |  2 +-
+ drivers/gpu/drm/amd/amdkfd/kfd_events.c  | 24 ++++++++++++------------
+ drivers/gpu/drm/amd/amdkfd/kfd_priv.h    |  2 +-
+ 3 files changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+index 1c7016958d6d..bfca17ca399c 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+@@ -814,7 +814,7 @@ static int kfd_ioctl_wait_events(struct file *filp, struct kfd_process *p,
+ 	err = kfd_wait_on_events(p, args->num_events,
+ 			(void __user *)args->events_ptr,
+ 			(args->wait_for_all != 0),
+-			args->timeout, &args->wait_result);
++			&args->timeout, &args->wait_result);
+ 
+ 	return err;
+ }
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
+index 4df9c36146ba..cbc20d779e5a 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
+@@ -895,7 +895,8 @@ static long user_timeout_to_jiffies(uint32_t user_timeout_ms)
+ 	return msecs_to_jiffies(user_timeout_ms) + 1;
+ }
+ 
+-static void free_waiters(uint32_t num_events, struct kfd_event_waiter *waiters)
++static void free_waiters(uint32_t num_events, struct kfd_event_waiter *waiters,
++			 bool undo_auto_reset)
+ {
+ 	uint32_t i;
+ 
+@@ -904,6 +905,9 @@ static void free_waiters(uint32_t num_events, struct kfd_event_waiter *waiters)
+ 			spin_lock(&waiters[i].event->lock);
+ 			remove_wait_queue(&waiters[i].event->wq,
+ 					  &waiters[i].wait);
++			if (undo_auto_reset && waiters[i].activated &&
++			    waiters[i].event && waiters[i].event->auto_reset)
++				set_event(waiters[i].event);
+ 			spin_unlock(&waiters[i].event->lock);
+ 		}
+ 
+@@ -912,7 +916,7 @@ static void free_waiters(uint32_t num_events, struct kfd_event_waiter *waiters)
+ 
+ int kfd_wait_on_events(struct kfd_process *p,
+ 		       uint32_t num_events, void __user *data,
+-		       bool all, uint32_t user_timeout_ms,
++		       bool all, uint32_t *user_timeout_ms,
+ 		       uint32_t *wait_result)
+ {
+ 	struct kfd_event_data __user *events =
+@@ -921,7 +925,7 @@ int kfd_wait_on_events(struct kfd_process *p,
+ 	int ret = 0;
+ 
+ 	struct kfd_event_waiter *event_waiters = NULL;
+-	long timeout = user_timeout_to_jiffies(user_timeout_ms);
++	long timeout = user_timeout_to_jiffies(*user_timeout_ms);
+ 
+ 	event_waiters = alloc_event_waiters(num_events);
+ 	if (!event_waiters) {
+@@ -971,15 +975,11 @@ int kfd_wait_on_events(struct kfd_process *p,
+ 		}
+ 
+ 		if (signal_pending(current)) {
+-			/*
+-			 * This is wrong when a nonzero, non-infinite timeout
+-			 * is specified. We need to use
+-			 * ERESTARTSYS_RESTARTBLOCK, but struct restart_block
+-			 * contains a union with data for each user and it's
+-			 * in generic kernel code that I don't want to
+-			 * touch yet.
+-			 */
+ 			ret = -ERESTARTSYS;
++			if (*user_timeout_ms != KFD_EVENT_TIMEOUT_IMMEDIATE &&
++			    *user_timeout_ms != KFD_EVENT_TIMEOUT_INFINITE)
++				*user_timeout_ms = jiffies_to_msecs(
++					max(0l, timeout-1));
+ 			break;
+ 		}
+ 
+@@ -1020,7 +1020,7 @@ int kfd_wait_on_events(struct kfd_process *p,
+ 					       event_waiters, events);
+ 
+ out_unlock:
+-	free_waiters(num_events, event_waiters);
++	free_waiters(num_events, event_waiters, ret == -ERESTARTSYS);
+ 	mutex_unlock(&p->event_mutex);
+ out:
+ 	if (ret)
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+index 2585d6e61d42..c6eec54b8102 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+@@ -1314,7 +1314,7 @@ void kfd_event_free_process(struct kfd_process *p);
+ int kfd_event_mmap(struct kfd_process *process, struct vm_area_struct *vma);
+ int kfd_wait_on_events(struct kfd_process *p,
+ 		       uint32_t num_events, void __user *data,
+-		       bool all, uint32_t user_timeout_ms,
++		       bool all, uint32_t *user_timeout_ms,
+ 		       uint32_t *wait_result);
+ void kfd_signal_event_interrupt(u32 pasid, uint32_t partial_id,
+ 				uint32_t valid_id_bits);
+-- 
+2.37.3
+
diff --git a/0045-drm-amd-pm-Fix-a-potential-gpu_metrics_table-memory-.patch b/0045-drm-amd-pm-Fix-a-potential-gpu_metrics_table-memory-.patch
new file mode 100644
index 000000000000..5748b221b79d
--- /dev/null
+++ b/0045-drm-amd-pm-Fix-a-potential-gpu_metrics_table-memory-.patch
@@ -0,0 +1,37 @@
+From 4b25bdb54578f3b96ff055e5d27bc1cb82950e51 Mon Sep 17 00:00:00 2001
+From: Zhen Ni <nizhen@uniontech.com>
+Date: Wed, 3 Aug 2022 17:19:58 +0800
+Subject: [PATCH 45/73] drm/amd/pm: Fix a potential gpu_metrics_table memory
+ leak
+
+[ Upstream commit 5afb76522a0af0513b6dc01f84128a73206b051b ]
+
+Memory is allocated for gpu_metrics_table in
+smu_v13_0_4_init_smc_tables(), but not freed in
+smu_v13_0_4_fini_smc_tables(). This may cause memory leaks, fix it.
+
+Reviewed-by: Evan Quan <evan.quan@amd.com>
+Signed-off-by: Zhen Ni <nizhen@uniontech.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c
+index 5a17b51aa0f9..7df360c25d51 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c
+@@ -190,6 +190,9 @@ static int smu_v13_0_4_fini_smc_tables(struct smu_context *smu)
+ 	kfree(smu_table->watermarks_table);
+ 	smu_table->watermarks_table = NULL;
+ 
++	kfree(smu_table->gpu_metrics_table);
++	smu_table->gpu_metrics_table = NULL;
++
+ 	return 0;
+ }
+ 
+-- 
+2.37.3
+
diff --git a/0046-ksmbd-return-STATUS_BAD_NETWORK_NAME-error-status-if.patch b/0046-ksmbd-return-STATUS_BAD_NETWORK_NAME-error-status-if.patch
new file mode 100644
index 000000000000..111f96df5969
--- /dev/null
+++ b/0046-ksmbd-return-STATUS_BAD_NETWORK_NAME-error-status-if.patch
@@ -0,0 +1,51 @@
+From 40f424dc1ee328832ec86df29b8939e2e1618153 Mon Sep 17 00:00:00 2001
+From: Namjae Jeon <linkinjeon@kernel.org>
+Date: Mon, 8 Aug 2022 21:56:48 +0900
+Subject: [PATCH 46/73] ksmbd: return STATUS_BAD_NETWORK_NAME error status if
+ share is not configured
+
+[ Upstream commit fe54833dc8d97ef387e86f7c80537d51c503ca75 ]
+
+If share is not configured in smb.conf, smb2 tree connect should return
+STATUS_BAD_NETWORK_NAME instead of STATUS_BAD_NETWORK_PATH.
+
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ksmbd/mgmt/tree_connect.c | 2 +-
+ fs/ksmbd/smb2pdu.c           | 3 ++-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ksmbd/mgmt/tree_connect.c b/fs/ksmbd/mgmt/tree_connect.c
+index 0d28e723a28c..940385c6a913 100644
+--- a/fs/ksmbd/mgmt/tree_connect.c
++++ b/fs/ksmbd/mgmt/tree_connect.c
+@@ -18,7 +18,7 @@
+ struct ksmbd_tree_conn_status
+ ksmbd_tree_conn_connect(struct ksmbd_session *sess, char *share_name)
+ {
+-	struct ksmbd_tree_conn_status status = {-EINVAL, NULL};
++	struct ksmbd_tree_conn_status status = {-ENOENT, NULL};
+ 	struct ksmbd_tree_connect_response *resp = NULL;
+ 	struct ksmbd_share_config *sc;
+ 	struct ksmbd_tree_connect *tree_conn = NULL;
+diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c
+index a9c33d15ca1f..bbb3958b6469 100644
+--- a/fs/ksmbd/smb2pdu.c
++++ b/fs/ksmbd/smb2pdu.c
+@@ -1930,8 +1930,9 @@ int smb2_tree_connect(struct ksmbd_work *work)
+ 		rsp->hdr.Status = STATUS_SUCCESS;
+ 		rc = 0;
+ 		break;
++	case -ENOENT:
+ 	case KSMBD_TREE_CONN_STATUS_NO_SHARE:
+-		rsp->hdr.Status = STATUS_BAD_NETWORK_PATH;
++		rsp->hdr.Status = STATUS_BAD_NETWORK_NAME;
+ 		break;
+ 	case -ENOMEM:
+ 	case KSMBD_TREE_CONN_STATUS_NOMEM:
+-- 
+2.37.3
+
diff --git a/0047-net-lan966x-fix-checking-for-return-value-of-platfor.patch b/0047-net-lan966x-fix-checking-for-return-value-of-platfor.patch
new file mode 100644
index 000000000000..3470948aca6d
--- /dev/null
+++ b/0047-net-lan966x-fix-checking-for-return-value-of-platfor.patch
@@ -0,0 +1,57 @@
+From 0d462a681d7d98ecb1b48605f6625802acd85d31 Mon Sep 17 00:00:00 2001
+From: Li Qiong <liqiong@nfschina.com>
+Date: Fri, 12 Aug 2022 11:09:54 +0800
+Subject: [PATCH 47/73] net: lan966x: fix checking for return value of
+ platform_get_irq_byname()
+
+[ Upstream commit 40b4ac880e21d917da7f3752332fa57564a4c202 ]
+
+The platform_get_irq_byname() returns non-zero IRQ number
+or negative error number. "if (irq)" always true, chang it
+to "if (irq > 0)"
+
+Signed-off-by: Li Qiong <liqiong@nfschina.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microchip/lan966x/lan966x_main.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_main.c b/drivers/net/ethernet/microchip/lan966x/lan966x_main.c
+index 1d6e3b641b2e..d928b75f3780 100644
+--- a/drivers/net/ethernet/microchip/lan966x/lan966x_main.c
++++ b/drivers/net/ethernet/microchip/lan966x/lan966x_main.c
+@@ -710,7 +710,7 @@ static void lan966x_cleanup_ports(struct lan966x *lan966x)
+ 	disable_irq(lan966x->xtr_irq);
+ 	lan966x->xtr_irq = -ENXIO;
+ 
+-	if (lan966x->ana_irq) {
++	if (lan966x->ana_irq > 0) {
+ 		disable_irq(lan966x->ana_irq);
+ 		lan966x->ana_irq = -ENXIO;
+ 	}
+@@ -718,10 +718,10 @@ static void lan966x_cleanup_ports(struct lan966x *lan966x)
+ 	if (lan966x->fdma)
+ 		devm_free_irq(lan966x->dev, lan966x->fdma_irq, lan966x);
+ 
+-	if (lan966x->ptp_irq)
++	if (lan966x->ptp_irq > 0)
+ 		devm_free_irq(lan966x->dev, lan966x->ptp_irq, lan966x);
+ 
+-	if (lan966x->ptp_ext_irq)
++	if (lan966x->ptp_ext_irq > 0)
+ 		devm_free_irq(lan966x->dev, lan966x->ptp_ext_irq, lan966x);
+ }
+ 
+@@ -1049,7 +1049,7 @@ static int lan966x_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	lan966x->ana_irq = platform_get_irq_byname(pdev, "ana");
+-	if (lan966x->ana_irq) {
++	if (lan966x->ana_irq > 0) {
+ 		err = devm_request_threaded_irq(&pdev->dev, lan966x->ana_irq, NULL,
+ 						lan966x_ana_irq_handler, IRQF_ONESHOT,
+ 						"ana irq", lan966x);
+-- 
+2.37.3
+
diff --git a/0048-neigh-fix-possible-DoS-due-to-net-iface-start-stop-l.patch b/0048-neigh-fix-possible-DoS-due-to-net-iface-start-stop-l.patch
new file mode 100644
index 000000000000..8e1a8dd0ecd3
--- /dev/null
+++ b/0048-neigh-fix-possible-DoS-due-to-net-iface-start-stop-l.patch
@@ -0,0 +1,128 @@
+From 2dd5ed474115150d8175825bc3b56c6385c3a83b Mon Sep 17 00:00:00 2001
+From: "Denis V. Lunev" <den@openvz.org>
+Date: Thu, 11 Aug 2022 18:20:11 +0300
+Subject: [PATCH 48/73] neigh: fix possible DoS due to net iface start/stop
+ loop
+
+[ Upstream commit 66ba215cb51323e4e55e38fd5f250e0fae0cbc94 ]
+
+Normal processing of ARP request (usually this is Ethernet broadcast
+packet) coming to the host is looking like the following:
+* the packet comes to arp_process() call and is passed through routing
+  procedure
+* the request is put into the queue using pneigh_enqueue() if
+  corresponding ARP record is not local (common case for container
+  records on the host)
+* the request is processed by timer (within 80 jiffies by default) and
+  ARP reply is sent from the same arp_process() using
+  NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED condition (flag is set inside
+  pneigh_enqueue())
+
+And here the problem comes. Linux kernel calls pneigh_queue_purge()
+which destroys the whole queue of ARP requests on ANY network interface
+start/stop event through __neigh_ifdown().
+
+This is actually not a problem within the original world as network
+interface start/stop was accessible to the host 'root' only, which
+could do more destructive things. But the world is changed and there
+are Linux containers available. Here container 'root' has an access
+to this API and could be considered as untrusted user in the hosting
+(container's) world.
+
+Thus there is an attack vector to other containers on node when
+container's root will endlessly start/stop interfaces. We have observed
+similar situation on a real production node when docker container was
+doing such activity and thus other containers on the node become not
+accessible.
+
+The patch proposed doing very simple thing. It drops only packets from
+the same namespace in the pneigh_queue_purge() where network interface
+state change is detected. This is enough to prevent the problem for the
+whole node preserving original semantics of the code.
+
+v2:
+	- do del_timer_sync() if queue is empty after pneigh_queue_purge()
+v3:
+	- rebase to net tree
+
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: David Ahern <dsahern@kernel.org>
+Cc: Yajun Deng <yajun.deng@linux.dev>
+Cc: Roopa Prabhu <roopa@nvidia.com>
+Cc: Christian Brauner <brauner@kernel.org>
+Cc: netdev@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
+Cc: Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com>
+Cc: Konstantin Khorenko <khorenko@virtuozzo.com>
+Cc: kernel@openvz.org
+Cc: devel@openvz.org
+Investigated-by: Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com>
+Signed-off-by: Denis V. Lunev <den@openvz.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/neighbour.c | 25 +++++++++++++++++--------
+ 1 file changed, 17 insertions(+), 8 deletions(-)
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 54625287ee5b..19d99d1eff53 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -307,14 +307,23 @@ static int neigh_del_timer(struct neighbour *n)
+ 	return 0;
+ }
+ 
+-static void pneigh_queue_purge(struct sk_buff_head *list)
++static void pneigh_queue_purge(struct sk_buff_head *list, struct net *net)
+ {
++	unsigned long flags;
+ 	struct sk_buff *skb;
+ 
+-	while ((skb = skb_dequeue(list)) != NULL) {
+-		dev_put(skb->dev);
+-		kfree_skb(skb);
++	spin_lock_irqsave(&list->lock, flags);
++	skb = skb_peek(list);
++	while (skb != NULL) {
++		struct sk_buff *skb_next = skb_peek_next(skb, list);
++		if (net == NULL || net_eq(dev_net(skb->dev), net)) {
++			__skb_unlink(skb, list);
++			dev_put(skb->dev);
++			kfree_skb(skb);
++		}
++		skb = skb_next;
+ 	}
++	spin_unlock_irqrestore(&list->lock, flags);
+ }
+ 
+ static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev,
+@@ -385,9 +394,9 @@ static int __neigh_ifdown(struct neigh_table *tbl, struct net_device *dev,
+ 	write_lock_bh(&tbl->lock);
+ 	neigh_flush_dev(tbl, dev, skip_perm);
+ 	pneigh_ifdown_and_unlock(tbl, dev);
+-
+-	del_timer_sync(&tbl->proxy_timer);
+-	pneigh_queue_purge(&tbl->proxy_queue);
++	pneigh_queue_purge(&tbl->proxy_queue, dev_net(dev));
++	if (skb_queue_empty_lockless(&tbl->proxy_queue))
++		del_timer_sync(&tbl->proxy_timer);
+ 	return 0;
+ }
+ 
+@@ -1787,7 +1796,7 @@ int neigh_table_clear(int index, struct neigh_table *tbl)
+ 	cancel_delayed_work_sync(&tbl->managed_work);
+ 	cancel_delayed_work_sync(&tbl->gc_work);
+ 	del_timer_sync(&tbl->proxy_timer);
+-	pneigh_queue_purge(&tbl->proxy_queue);
++	pneigh_queue_purge(&tbl->proxy_queue, NULL);
+ 	neigh_ifdown(tbl, NULL);
+ 	if (atomic_read(&tbl->entries))
+ 		pr_crit("neighbour leakage\n");
+-- 
+2.37.3
+
diff --git a/0049-ALSA-hda-realtek-Add-quirks-for-ASUS-Zenbooks-using-.patch b/0049-ALSA-hda-realtek-Add-quirks-for-ASUS-Zenbooks-using-.patch
new file mode 100644
index 000000000000..68f89b34c3a8
--- /dev/null
+++ b/0049-ALSA-hda-realtek-Add-quirks-for-ASUS-Zenbooks-using-.patch
@@ -0,0 +1,42 @@
+From 2432f152c175c149b6365b07d110701ca1df988e Mon Sep 17 00:00:00 2001
+From: Stefan Binding <sbinding@opensource.cirrus.com>
+Date: Mon, 15 Aug 2022 15:19:53 +0100
+Subject: [PATCH 49/73] ALSA: hda/realtek: Add quirks for ASUS Zenbooks using
+ CS35L41
+
+[ Upstream commit 461122b999bda2ebef2086a35d8990f9ccac5ab8 ]
+
+These Asus Zenbook laptop use Realtek HDA codec combined with
+2xCS35L41 Amplifiers using SPI.
+
+Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20220815141953.25197-1-sbinding@opensource.cirrus.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 1ae9674fa8a3..b44b882f8378 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9248,6 +9248,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1043, 0x1271, "ASUS X430UN", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1043, 0x1290, "ASUS X441SA", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1043, 0x12a0, "ASUS X441UV", ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE),
++	SND_PCI_QUIRK(0x1043, 0x12af, "ASUS UX582ZS", ALC245_FIXUP_CS35L41_SPI_2),
+ 	SND_PCI_QUIRK(0x1043, 0x12e0, "ASUS X541SA", ALC256_FIXUP_ASUS_MIC),
+ 	SND_PCI_QUIRK(0x1043, 0x12f0, "ASUS X541UV", ALC256_FIXUP_ASUS_MIC),
+ 	SND_PCI_QUIRK(0x1043, 0x1313, "Asus K42JZ", ALC269VB_FIXUP_ASUS_MIC_NO_PRESENCE),
+@@ -9268,6 +9269,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1043, 0x19e1, "ASUS UX581LV", ALC295_FIXUP_ASUS_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
+ 	SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC),
++	SND_PCI_QUIRK(0x1043, 0x1a8f, "ASUS UX582ZS", ALC245_FIXUP_CS35L41_SPI_2),
+ 	SND_PCI_QUIRK(0x1043, 0x1b11, "ASUS UX431DA", ALC294_FIXUP_ASUS_COEF_1B),
+ 	SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC),
+ 	SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+-- 
+2.37.3
+
diff --git a/0050-s390-hypfs-avoid-error-message-under-KVM.patch b/0050-s390-hypfs-avoid-error-message-under-KVM.patch
new file mode 100644
index 000000000000..4c19b1c6fb88
--- /dev/null
+++ b/0050-s390-hypfs-avoid-error-message-under-KVM.patch
@@ -0,0 +1,58 @@
+From 895096784ab9eb17126e3099a6ef2649e96f8d84 Mon Sep 17 00:00:00 2001
+From: Juergen Gross <jgross@suse.com>
+Date: Mon, 20 Jun 2022 11:45:34 +0200
+Subject: [PATCH 50/73] s390/hypfs: avoid error message under KVM
+
+[ Upstream commit 7b6670b03641ac308aaa6fa2e6f964ac993b5ea3 ]
+
+When booting under KVM the following error messages are issued:
+
+hypfs.7f5705: The hardware system does not support hypfs
+hypfs.7a79f0: Initialization of hypfs failed with rc=-61
+
+Demote the severity of first message from "error" to "info" and issue
+the second message only in other error cases.
+
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Acked-by: Heiko Carstens <hca@linux.ibm.com>
+Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+Link: https://lore.kernel.org/r/20220620094534.18967-1-jgross@suse.com
+[arch/s390/hypfs/hypfs_diag.c changed description]
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/hypfs/hypfs_diag.c | 2 +-
+ arch/s390/hypfs/inode.c      | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/hypfs/hypfs_diag.c b/arch/s390/hypfs/hypfs_diag.c
+index f0bc4dc3e9bf..6511d15ace45 100644
+--- a/arch/s390/hypfs/hypfs_diag.c
++++ b/arch/s390/hypfs/hypfs_diag.c
+@@ -437,7 +437,7 @@ __init int hypfs_diag_init(void)
+ 	int rc;
+ 
+ 	if (diag204_probe()) {
+-		pr_err("The hardware system does not support hypfs\n");
++		pr_info("The hardware system does not support hypfs\n");
+ 		return -ENODATA;
+ 	}
+ 
+diff --git a/arch/s390/hypfs/inode.c b/arch/s390/hypfs/inode.c
+index 5c97f48cea91..ee919bfc8186 100644
+--- a/arch/s390/hypfs/inode.c
++++ b/arch/s390/hypfs/inode.c
+@@ -496,9 +496,9 @@ static int __init hypfs_init(void)
+ 	hypfs_vm_exit();
+ fail_hypfs_diag_exit:
+ 	hypfs_diag_exit();
++	pr_err("Initialization of hypfs failed with rc=%i\n", rc);
+ fail_dbfs_exit:
+ 	hypfs_dbfs_exit();
+-	pr_err("Initialization of hypfs failed with rc=%i\n", rc);
+ 	return rc;
+ }
+ device_initcall(hypfs_init)
+-- 
+2.37.3
+
diff --git a/0051-ksmbd-don-t-remove-dos-attribute-xattr-on-O_TRUNC-op.patch b/0051-ksmbd-don-t-remove-dos-attribute-xattr-on-O_TRUNC-op.patch
new file mode 100644
index 000000000000..33a4046babf4
--- /dev/null
+++ b/0051-ksmbd-don-t-remove-dos-attribute-xattr-on-O_TRUNC-op.patch
@@ -0,0 +1,53 @@
+From dc441eda061720bab0117c45e30a2eb065b858ec Mon Sep 17 00:00:00 2001
+From: Namjae Jeon <linkinjeon@kernel.org>
+Date: Sun, 14 Aug 2022 22:40:25 +0900
+Subject: [PATCH 51/73] ksmbd: don't remove dos attribute xattr on O_TRUNC open
+
+[ Upstream commit 17661ecf6a64eb11ae7f1108fe88686388b2acd5 ]
+
+When smb client open file in ksmbd share with O_TRUNC, dos attribute
+xattr is removed as well as data in file. This cause the FSCTL_SET_SPARSE
+request from the client fails because ksmbd can't update the dos attribute
+after setting ATTR_SPARSE_FILE. And this patch fix xfstests generic/469
+test also.
+
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ksmbd/smb2pdu.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c
+index bbb3958b6469..35f5ea1c9dfc 100644
+--- a/fs/ksmbd/smb2pdu.c
++++ b/fs/ksmbd/smb2pdu.c
+@@ -2315,15 +2315,15 @@ static int smb2_remove_smb_xattrs(struct path *path)
+ 			name += strlen(name) + 1) {
+ 		ksmbd_debug(SMB, "%s, len %zd\n", name, strlen(name));
+ 
+-		if (strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN) &&
+-		    strncmp(&name[XATTR_USER_PREFIX_LEN], DOS_ATTRIBUTE_PREFIX,
+-			    DOS_ATTRIBUTE_PREFIX_LEN) &&
+-		    strncmp(&name[XATTR_USER_PREFIX_LEN], STREAM_PREFIX, STREAM_PREFIX_LEN))
+-			continue;
+-
+-		err = ksmbd_vfs_remove_xattr(user_ns, path->dentry, name);
+-		if (err)
+-			ksmbd_debug(SMB, "remove xattr failed : %s\n", name);
++		if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN) &&
++		    !strncmp(&name[XATTR_USER_PREFIX_LEN], STREAM_PREFIX,
++			     STREAM_PREFIX_LEN)) {
++			err = ksmbd_vfs_remove_xattr(user_ns, path->dentry,
++						     name);
++			if (err)
++				ksmbd_debug(SMB, "remove xattr failed : %s\n",
++					    name);
++		}
+ 	}
+ out:
+ 	kvfree(xattr_list);
+-- 
+2.37.3
+
diff --git a/0052-drm-amdgpu-disable-3DCGCG-CGLS-temporarily-due-to-st.patch b/0052-drm-amdgpu-disable-3DCGCG-CGLS-temporarily-due-to-st.patch
new file mode 100644
index 000000000000..38f1c654cc52
--- /dev/null
+++ b/0052-drm-amdgpu-disable-3DCGCG-CGLS-temporarily-due-to-st.patch
@@ -0,0 +1,36 @@
+From d9d70547cba1d88fe52bfb37655d09a12926a0f3 Mon Sep 17 00:00:00 2001
+From: Evan Quan <evan.quan@amd.com>
+Date: Wed, 3 Aug 2022 16:13:56 +0800
+Subject: [PATCH 52/73] drm/amdgpu: disable 3DCGCG/CGLS temporarily due to
+ stability issue
+
+[ Upstream commit 1b586595df6d04c27088ef348b8202204ce26d45 ]
+
+Some stability issues were reported with these features.
+
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/soc21.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/soc21.c b/drivers/gpu/drm/amd/amdgpu/soc21.c
+index 9e18a2b22607..8d5c452a9100 100644
+--- a/drivers/gpu/drm/amd/amdgpu/soc21.c
++++ b/drivers/gpu/drm/amd/amdgpu/soc21.c
+@@ -530,8 +530,10 @@ static int soc21_common_early_init(void *handle)
+ 	case IP_VERSION(11, 0, 0):
+ 		adev->cg_flags = AMD_CG_SUPPORT_GFX_CGCG |
+ 			AMD_CG_SUPPORT_GFX_CGLS |
++#if 0
+ 			AMD_CG_SUPPORT_GFX_3D_CGCG |
+ 			AMD_CG_SUPPORT_GFX_3D_CGLS |
++#endif
+ 			AMD_CG_SUPPORT_GFX_MGCG |
+ 			AMD_CG_SUPPORT_REPEATER_FGCG |
+ 			AMD_CG_SUPPORT_GFX_FGCG |
+-- 
+2.37.3
+
diff --git a/0053-drm-amd-pm-add-missing-fini_microcode-interface-for-.patch b/0053-drm-amd-pm-add-missing-fini_microcode-interface-for-.patch
new file mode 100644
index 000000000000..8c91cde44bd2
--- /dev/null
+++ b/0053-drm-amd-pm-add-missing-fini_microcode-interface-for-.patch
@@ -0,0 +1,33 @@
+From 4d21584ac6392aa66171b7efd647ecd1a447556b Mon Sep 17 00:00:00 2001
+From: Evan Quan <evan.quan@amd.com>
+Date: Wed, 10 Aug 2022 11:08:31 +0800
+Subject: [PATCH 53/73] drm/amd/pm: add missing ->fini_microcode interface for
+ Sienna Cichlid
+
+[ Upstream commit 0a2d922a5618377cdf8fa476351362733ef55342 ]
+
+To avoid any potential memory leak.
+
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+index 78f3d9e722bb..32bb6b1d9526 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+@@ -4281,6 +4281,7 @@ static const struct pptable_funcs sienna_cichlid_ppt_funcs = {
+ 	.dump_pptable = sienna_cichlid_dump_pptable,
+ 	.init_microcode = smu_v11_0_init_microcode,
+ 	.load_microcode = smu_v11_0_load_microcode,
++	.fini_microcode = smu_v11_0_fini_microcode,
+ 	.init_smc_tables = sienna_cichlid_init_smc_tables,
+ 	.fini_smc_tables = smu_v11_0_fini_smc_tables,
+ 	.init_power = smu_v11_0_init_power,
+-- 
+2.37.3
+
diff --git a/0054-drm-amd-pm-add-missing-fini_xxxx-interfaces-for-some.patch b/0054-drm-amd-pm-add-missing-fini_xxxx-interfaces-for-some.patch
new file mode 100644
index 000000000000..1ec128ca27cf
--- /dev/null
+++ b/0054-drm-amd-pm-add-missing-fini_xxxx-interfaces-for-some.patch
@@ -0,0 +1,50 @@
+From 22a75c616f1971c23838506b14971a4ef4a66bd7 Mon Sep 17 00:00:00 2001
+From: Evan Quan <evan.quan@amd.com>
+Date: Wed, 10 Aug 2022 11:11:16 +0800
+Subject: [PATCH 54/73] drm/amd/pm: add missing ->fini_xxxx interfaces for some
+ SMU13 asics
+
+[ Upstream commit 4bac1c846eff8042dd59ddecd0a43f3b9de5fd23 ]
+
+Without these, potential memory leak may be induced.
+
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 2 ++
+ drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
+index 7432b3e76d3d..201546c36994 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c
+@@ -1583,7 +1583,9 @@ static const struct pptable_funcs smu_v13_0_0_ppt_funcs = {
+ 	.dump_pptable = smu_v13_0_0_dump_pptable,
+ 	.init_microcode = smu_v13_0_init_microcode,
+ 	.load_microcode = smu_v13_0_load_microcode,
++	.fini_microcode = smu_v13_0_fini_microcode,
+ 	.init_smc_tables = smu_v13_0_0_init_smc_tables,
++	.fini_smc_tables = smu_v13_0_fini_smc_tables,
+ 	.init_power = smu_v13_0_init_power,
+ 	.fini_power = smu_v13_0_fini_power,
+ 	.check_fw_status = smu_v13_0_check_fw_status,
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
+index 4e1861fb2c6a..9cde13b07dd2 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
+@@ -1539,7 +1539,9 @@ static const struct pptable_funcs smu_v13_0_7_ppt_funcs = {
+ 	.dump_pptable = smu_v13_0_7_dump_pptable,
+ 	.init_microcode = smu_v13_0_init_microcode,
+ 	.load_microcode = smu_v13_0_load_microcode,
++	.fini_microcode = smu_v13_0_fini_microcode,
+ 	.init_smc_tables = smu_v13_0_7_init_smc_tables,
++	.fini_smc_tables = smu_v13_0_fini_smc_tables,
+ 	.init_power = smu_v13_0_init_power,
+ 	.check_fw_status = smu_v13_0_7_check_fw_status,
+ 	.setup_pptable = smu_v13_0_7_setup_pptable,
+-- 
+2.37.3
+
diff --git a/0055-drm-amd-display-Fix-pixel-clock-programming.patch b/0055-drm-amd-display-Fix-pixel-clock-programming.patch
new file mode 100644
index 000000000000..569598780a71
--- /dev/null
+++ b/0055-drm-amd-display-Fix-pixel-clock-programming.patch
@@ -0,0 +1,48 @@
+From db0669c9731b849dee3dcaa6a0b4a891a0055338 Mon Sep 17 00:00:00 2001
+From: Ilya Bakoulin <Ilya.Bakoulin@amd.com>
+Date: Tue, 26 Jul 2022 16:19:38 -0400
+Subject: [PATCH 55/73] drm/amd/display: Fix pixel clock programming
+
+[ Upstream commit 04fb918bf421b299feaee1006e82921d7d381f18 ]
+
+[Why]
+Some pixel clock values could cause HDMI TMDS SSCPs to be misaligned
+between different HDMI lanes when using YCbCr420 10-bit pixel format.
+
+BIOS functions for transmitter/encoder control take pixel clock in kHz
+increments, whereas the function for setting the pixel clock is in 100Hz
+increments. Setting pixel clock to a value that is not on a kHz boundary
+will cause the issue.
+
+[How]
+Round pixel clock down to nearest kHz in 10/12-bpc cases.
+
+Reviewed-by: Aric Cyr <Aric.Cyr@amd.com>
+Acked-by: Brian Chang <Brian.Chang@amd.com>
+Signed-off-by: Ilya Bakoulin <Ilya.Bakoulin@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
+index 845aa8a1027d..c4040adb88b0 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
+@@ -545,9 +545,11 @@ static void dce112_get_pix_clk_dividers_helper (
+ 		switch (pix_clk_params->color_depth) {
+ 		case COLOR_DEPTH_101010:
+ 			actual_pixel_clock_100hz = (actual_pixel_clock_100hz * 5) >> 2;
++			actual_pixel_clock_100hz -= actual_pixel_clock_100hz % 10;
+ 			break;
+ 		case COLOR_DEPTH_121212:
+ 			actual_pixel_clock_100hz = (actual_pixel_clock_100hz * 6) >> 2;
++			actual_pixel_clock_100hz -= actual_pixel_clock_100hz % 10;
+ 			break;
+ 		case COLOR_DEPTH_161616:
+ 			actual_pixel_clock_100hz = actual_pixel_clock_100hz * 2;
+-- 
+2.37.3
+
diff --git a/0056-drm-amdgpu-Increase-tlb-flush-timeout-for-sriov.patch b/0056-drm-amdgpu-Increase-tlb-flush-timeout-for-sriov.patch
new file mode 100644
index 000000000000..d32af93acff5
--- /dev/null
+++ b/0056-drm-amdgpu-Increase-tlb-flush-timeout-for-sriov.patch
@@ -0,0 +1,85 @@
+From db1d9deb84d7870486688a5d13602962443a5500 Mon Sep 17 00:00:00 2001
+From: Dusica Milinkovic <Dusica.Milinkovic@amd.com>
+Date: Wed, 10 Aug 2022 09:43:15 +0200
+Subject: [PATCH 56/73] drm/amdgpu: Increase tlb flush timeout for sriov
+
+[ Upstream commit 373008bfc9cdb0f050258947fa5a095f0657e1bc ]
+
+[Why]
+During multi-vf executing benchmark (Luxmark) observed kiq error timeout.
+It happenes because all of VFs do the tlb invalidation at the same time.
+Although each VF has the invalidate register set, from hardware side
+the invalidate requests are queue to execute.
+
+[How]
+In case of 12 VF increase timeout on 12*100ms
+
+Signed-off-by: Dusica Milinkovic <Dusica.Milinkovic@amd.com>
+Acked-by: Shaoyun Liu <shaoyun.liu@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu.h    | 2 +-
+ drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c | 3 ++-
+ drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c  | 3 ++-
+ 3 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+index 30ce6bb6fa77..310754b1f670 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+@@ -313,7 +313,7 @@ enum amdgpu_kiq_irq {
+ 	AMDGPU_CP_KIQ_IRQ_DRIVER0 = 0,
+ 	AMDGPU_CP_KIQ_IRQ_LAST
+ };
+-
++#define SRIOV_USEC_TIMEOUT  1200000 /* wait 12 * 100ms for SRIOV */
+ #define MAX_KIQ_REG_WAIT       5000 /* in usecs, 5ms */
+ #define MAX_KIQ_REG_BAILOUT_INTERVAL   5 /* in msecs, 5ms */
+ #define MAX_KIQ_REG_TRY 1000
+diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c
+index 9077dfccaf3c..809408c8c79a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c
+@@ -416,6 +416,7 @@ static int gmc_v10_0_flush_gpu_tlb_pasid(struct amdgpu_device *adev,
+ 	uint32_t seq;
+ 	uint16_t queried_pasid;
+ 	bool ret;
++	u32 usec_timeout = amdgpu_sriov_vf(adev) ? SRIOV_USEC_TIMEOUT : adev->usec_timeout;
+ 	struct amdgpu_ring *ring = &adev->gfx.kiq.ring;
+ 	struct amdgpu_kiq *kiq = &adev->gfx.kiq;
+ 
+@@ -434,7 +435,7 @@ static int gmc_v10_0_flush_gpu_tlb_pasid(struct amdgpu_device *adev,
+ 
+ 		amdgpu_ring_commit(ring);
+ 		spin_unlock(&adev->gfx.kiq.ring_lock);
+-		r = amdgpu_fence_wait_polling(ring, seq, adev->usec_timeout);
++		r = amdgpu_fence_wait_polling(ring, seq, usec_timeout);
+ 		if (r < 1) {
+ 			dev_err(adev->dev, "wait for kiq fence error: %ld.\n", r);
+ 			return -ETIME;
+diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+index 22761a3bb818..566c1243c051 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+@@ -896,6 +896,7 @@ static int gmc_v9_0_flush_gpu_tlb_pasid(struct amdgpu_device *adev,
+ 	uint32_t seq;
+ 	uint16_t queried_pasid;
+ 	bool ret;
++	u32 usec_timeout = amdgpu_sriov_vf(adev) ? SRIOV_USEC_TIMEOUT : adev->usec_timeout;
+ 	struct amdgpu_ring *ring = &adev->gfx.kiq.ring;
+ 	struct amdgpu_kiq *kiq = &adev->gfx.kiq;
+ 
+@@ -935,7 +936,7 @@ static int gmc_v9_0_flush_gpu_tlb_pasid(struct amdgpu_device *adev,
+ 
+ 		amdgpu_ring_commit(ring);
+ 		spin_unlock(&adev->gfx.kiq.ring_lock);
+-		r = amdgpu_fence_wait_polling(ring, seq, adev->usec_timeout);
++		r = amdgpu_fence_wait_polling(ring, seq, usec_timeout);
+ 		if (r < 1) {
+ 			dev_err(adev->dev, "wait for kiq fence error: %ld.\n", r);
+ 			up_read(&adev->reset_domain->sem);
+-- 
+2.37.3
+
diff --git a/0057-drm-amd-display-Fix-plug-unplug-external-monitor-wil.patch b/0057-drm-amd-display-Fix-plug-unplug-external-monitor-wil.patch
new file mode 100644
index 000000000000..dd055cd10378
--- /dev/null
+++ b/0057-drm-amd-display-Fix-plug-unplug-external-monitor-wil.patch
@@ -0,0 +1,54 @@
+From bd71ef2c30244c25243d84b593ea0ba88164ebb6 Mon Sep 17 00:00:00 2001
+From: Tom Chung <chiahsuan.chung@amd.com>
+Date: Wed, 3 Aug 2022 15:15:17 +0800
+Subject: [PATCH 57/73] drm/amd/display: Fix plug/unplug external monitor will
+ hang while playback MPO video
+
+[ Upstream commit e98459c06e3d45c2229b097f7b8cdd412357fa2f ]
+
+[Why]
+Pipes for MPO primary and overlay will be power down and power up during
+plug/unplug external monitor while MPO video playback.
+But the pipes were the same after plug/unplug and should not need to be
+power down and power up or it will make page flip interrupt disabled and
+cause hang issue.
+
+[How]
+Add pipe split change condition that not only check the top pipe pointer
+but also check the index of top pipe if both top pipes are available.
+
+Reviewed-by: Sun peng Li <Sunpeng.Li@amd.com>
+Acked-by: Brian Chang <Brian.Chang@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index 7d69341acca0..9dbd965d8afb 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -1067,8 +1067,15 @@ static void disable_dangling_plane(struct dc *dc, struct dc_state *context)
+ 		struct dc_stream_state *old_stream =
+ 				dc->current_state->res_ctx.pipe_ctx[i].stream;
+ 		bool should_disable = true;
+-		bool pipe_split_change =
+-			context->res_ctx.pipe_ctx[i].top_pipe != dc->current_state->res_ctx.pipe_ctx[i].top_pipe;
++		bool pipe_split_change = false;
++
++		if ((context->res_ctx.pipe_ctx[i].top_pipe) &&
++			(dc->current_state->res_ctx.pipe_ctx[i].top_pipe))
++			pipe_split_change = context->res_ctx.pipe_ctx[i].top_pipe->pipe_idx !=
++				dc->current_state->res_ctx.pipe_ctx[i].top_pipe->pipe_idx;
++		else
++			pipe_split_change = context->res_ctx.pipe_ctx[i].top_pipe !=
++				dc->current_state->res_ctx.pipe_ctx[i].top_pipe;
+ 
+ 		for (j = 0; j < context->stream_count; j++) {
+ 			if (old_stream == context->streams[j]) {
+-- 
+2.37.3
+
diff --git a/0058-drm-amd-display-avoid-doing-vm_init-multiple-time.patch b/0058-drm-amd-display-avoid-doing-vm_init-multiple-time.patch
new file mode 100644
index 000000000000..6d4ca53ac968
--- /dev/null
+++ b/0058-drm-amd-display-avoid-doing-vm_init-multiple-time.patch
@@ -0,0 +1,45 @@
+From 4eb2be1d0827627b5878b26dfa21d68ffe677fd0 Mon Sep 17 00:00:00 2001
+From: Charlene Liu <Charlene.Liu@amd.com>
+Date: Fri, 5 Aug 2022 12:59:47 -0400
+Subject: [PATCH 58/73] drm/amd/display: avoid doing vm_init multiple time
+
+[ Upstream commit 5544a7b5a07480192eb5fd3536462faed2c21528 ]
+
+[why]
+this is to ensure that driver will not reprogram hvm_prefetch_req again if
+it is done.
+
+Reviewed-by: Martin Leung <Martin.Leung@amd.com>
+Acked-by: Brian Chang <Brian.Chang@amd.com>
+Signed-off-by: Charlene Liu <Charlene.Liu@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubbub.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubbub.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubbub.c
+index c5e200d09038..5752271f22df 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubbub.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubbub.c
+@@ -67,9 +67,15 @@ static uint32_t convert_and_clamp(
+ void dcn21_dchvm_init(struct hubbub *hubbub)
+ {
+ 	struct dcn20_hubbub *hubbub1 = TO_DCN20_HUBBUB(hubbub);
+-	uint32_t riommu_active;
++	uint32_t riommu_active, prefetch_done;
+ 	int i;
+ 
++	REG_GET(DCHVM_RIOMMU_STAT0, HOSTVM_PREFETCH_DONE, &prefetch_done);
++
++	if (prefetch_done) {
++		hubbub->riommu_active = true;
++		return;
++	}
+ 	//Init DCHVM block
+ 	REG_UPDATE(DCHVM_CTRL0, HOSTVM_INIT_REQ, 1);
+ 
+-- 
+2.37.3
+
diff --git a/0059-drm-amdgpu-Add-decode_iv_ts-helper-for-ih_v6-block.patch b/0059-drm-amdgpu-Add-decode_iv_ts-helper-for-ih_v6-block.patch
new file mode 100644
index 000000000000..d65c9e46e9c8
--- /dev/null
+++ b/0059-drm-amdgpu-Add-decode_iv_ts-helper-for-ih_v6-block.patch
@@ -0,0 +1,32 @@
+From d278f332d105d3340179965dc14d6f7157fb9450 Mon Sep 17 00:00:00 2001
+From: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Date: Fri, 5 Aug 2022 18:04:08 -0400
+Subject: [PATCH 59/73] drm/amdgpu: Add decode_iv_ts helper for ih_v6 block
+
+[ Upstream commit 1af9add1f1512b10d9ce44ec7137612bc81ff069 ]
+
+Was missing.  Add it.
+
+Signed-off-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/ih_v6_0.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/ih_v6_0.c b/drivers/gpu/drm/amd/amdgpu/ih_v6_0.c
+index 92dc60a9d209..085e613f3646 100644
+--- a/drivers/gpu/drm/amd/amdgpu/ih_v6_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/ih_v6_0.c
+@@ -727,6 +727,7 @@ static const struct amd_ip_funcs ih_v6_0_ip_funcs = {
+ static const struct amdgpu_ih_funcs ih_v6_0_funcs = {
+ 	.get_wptr = ih_v6_0_get_wptr,
+ 	.decode_iv = amdgpu_ih_decode_iv_helper,
++	.decode_iv_ts = amdgpu_ih_decode_iv_ts_helper,
+ 	.set_rptr = ih_v6_0_set_rptr
+ };
+ 
+-- 
+2.37.3
+
diff --git a/0060-drm-amdgpu-Add-secure-display-TA-load-for-Renoir.patch b/0060-drm-amdgpu-Add-secure-display-TA-load-for-Renoir.patch
new file mode 100644
index 000000000000..0c5d9486b20f
--- /dev/null
+++ b/0060-drm-amdgpu-Add-secure-display-TA-load-for-Renoir.patch
@@ -0,0 +1,41 @@
+From 09186eeffd3949a7e6ed39085bc151c1396a99a8 Mon Sep 17 00:00:00 2001
+From: Shane Xiao <shane.xiao@amd.com>
+Date: Mon, 15 Aug 2022 16:32:15 +0800
+Subject: [PATCH 60/73] drm/amdgpu: Add secure display TA load for Renoir
+
+[ Upstream commit e42dfa66d59240afbdd8d4b47b87486db39504aa ]
+
+Add secure display TA load for Renoir
+
+Signed-off-by: Shane Xiao <shane.xiao@amd.com>
+Reviewed-by: Aaron Liu <aaron.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/psp_v12_0.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/psp_v12_0.c b/drivers/gpu/drm/amd/amdgpu/psp_v12_0.c
+index a2588200ea58..0b2ac418e4ac 100644
+--- a/drivers/gpu/drm/amd/amdgpu/psp_v12_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/psp_v12_0.c
+@@ -101,6 +101,16 @@ static int psp_v12_0_init_microcode(struct psp_context *psp)
+ 		adev->psp.dtm_context.context.bin_desc.start_addr =
+ 			(uint8_t *)adev->psp.hdcp_context.context.bin_desc.start_addr +
+ 			le32_to_cpu(ta_hdr->dtm.offset_bytes);
++
++		if (adev->apu_flags & AMD_APU_IS_RENOIR) {
++			adev->psp.securedisplay_context.context.bin_desc.fw_version =
++				le32_to_cpu(ta_hdr->securedisplay.fw_version);
++			adev->psp.securedisplay_context.context.bin_desc.size_bytes =
++				le32_to_cpu(ta_hdr->securedisplay.size_bytes);
++			adev->psp.securedisplay_context.context.bin_desc.start_addr =
++				(uint8_t *)adev->psp.hdcp_context.context.bin_desc.start_addr +
++				le32_to_cpu(ta_hdr->securedisplay.offset_bytes);
++		}
+ 	}
+ 
+ 	return 0;
+-- 
+2.37.3
+
diff --git a/0061-drm-amdgpu-Fix-interrupt-handling-on-ih_soft-ring.patch b/0061-drm-amdgpu-Fix-interrupt-handling-on-ih_soft-ring.patch
new file mode 100644
index 000000000000..7d913e5e08d5
--- /dev/null
+++ b/0061-drm-amdgpu-Fix-interrupt-handling-on-ih_soft-ring.patch
@@ -0,0 +1,110 @@
+From 933020e6d0572f9997e8faaed8c082fda0825718 Mon Sep 17 00:00:00 2001
+From: Mukul Joshi <mukul.joshi@amd.com>
+Date: Fri, 12 Aug 2022 15:23:51 -0400
+Subject: [PATCH 61/73] drm/amdgpu: Fix interrupt handling on ih_soft ring
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit de8341ee3ce7316883e836a2c4e9bf01ab651e0f ]
+
+There are no backing hardware registers for ih_soft ring.
+As a result, don't try to access hardware registers for read
+and write pointers when processing interrupts on the IH soft
+ring.
+
+Signed-off-by: Mukul Joshi <mukul.joshi@amd.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/navi10_ih.c | 7 ++++++-
+ drivers/gpu/drm/amd/amdgpu/vega10_ih.c | 7 ++++++-
+ drivers/gpu/drm/amd/amdgpu/vega20_ih.c | 7 ++++++-
+ 3 files changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/navi10_ih.c b/drivers/gpu/drm/amd/amdgpu/navi10_ih.c
+index 4b5396d3e60f..eec13cb5bf75 100644
+--- a/drivers/gpu/drm/amd/amdgpu/navi10_ih.c
++++ b/drivers/gpu/drm/amd/amdgpu/navi10_ih.c
+@@ -409,9 +409,11 @@ static u32 navi10_ih_get_wptr(struct amdgpu_device *adev,
+ 	u32 wptr, tmp;
+ 	struct amdgpu_ih_regs *ih_regs;
+ 
+-	if (ih == &adev->irq.ih) {
++	if (ih == &adev->irq.ih || ih == &adev->irq.ih_soft) {
+ 		/* Only ring0 supports writeback. On other rings fall back
+ 		 * to register-based code with overflow checking below.
++		 * ih_soft ring doesn't have any backing hardware registers,
++		 * update wptr and return.
+ 		 */
+ 		wptr = le32_to_cpu(*ih->wptr_cpu);
+ 
+@@ -483,6 +485,9 @@ static void navi10_ih_set_rptr(struct amdgpu_device *adev,
+ {
+ 	struct amdgpu_ih_regs *ih_regs;
+ 
++	if (ih == &adev->irq.ih_soft)
++		return;
++
+ 	if (ih->use_doorbell) {
+ 		/* XXX check if swapping is necessary on BE */
+ 		*ih->rptr_cpu = ih->rptr;
+diff --git a/drivers/gpu/drm/amd/amdgpu/vega10_ih.c b/drivers/gpu/drm/amd/amdgpu/vega10_ih.c
+index cdd599a08125..03b7066471f9 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vega10_ih.c
++++ b/drivers/gpu/drm/amd/amdgpu/vega10_ih.c
+@@ -334,9 +334,11 @@ static u32 vega10_ih_get_wptr(struct amdgpu_device *adev,
+ 	u32 wptr, tmp;
+ 	struct amdgpu_ih_regs *ih_regs;
+ 
+-	if (ih == &adev->irq.ih) {
++	if (ih == &adev->irq.ih || ih == &adev->irq.ih_soft) {
+ 		/* Only ring0 supports writeback. On other rings fall back
+ 		 * to register-based code with overflow checking below.
++		 * ih_soft ring doesn't have any backing hardware registers,
++		 * update wptr and return.
+ 		 */
+ 		wptr = le32_to_cpu(*ih->wptr_cpu);
+ 
+@@ -409,6 +411,9 @@ static void vega10_ih_set_rptr(struct amdgpu_device *adev,
+ {
+ 	struct amdgpu_ih_regs *ih_regs;
+ 
++	if (ih == &adev->irq.ih_soft)
++		return;
++
+ 	if (ih->use_doorbell) {
+ 		/* XXX check if swapping is necessary on BE */
+ 		*ih->rptr_cpu = ih->rptr;
+diff --git a/drivers/gpu/drm/amd/amdgpu/vega20_ih.c b/drivers/gpu/drm/amd/amdgpu/vega20_ih.c
+index 3b4eb8285943..2022ffbb8dba 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vega20_ih.c
++++ b/drivers/gpu/drm/amd/amdgpu/vega20_ih.c
+@@ -385,9 +385,11 @@ static u32 vega20_ih_get_wptr(struct amdgpu_device *adev,
+ 	u32 wptr, tmp;
+ 	struct amdgpu_ih_regs *ih_regs;
+ 
+-	if (ih == &adev->irq.ih) {
++	if (ih == &adev->irq.ih || ih == &adev->irq.ih_soft) {
+ 		/* Only ring0 supports writeback. On other rings fall back
+ 		 * to register-based code with overflow checking below.
++		 * ih_soft ring doesn't have any backing hardware registers,
++		 * update wptr and return.
+ 		 */
+ 		wptr = le32_to_cpu(*ih->wptr_cpu);
+ 
+@@ -461,6 +463,9 @@ static void vega20_ih_set_rptr(struct amdgpu_device *adev,
+ {
+ 	struct amdgpu_ih_regs *ih_regs;
+ 
++	if (ih == &adev->irq.ih_soft)
++		return;
++
+ 	if (ih->use_doorbell) {
+ 		/* XXX check if swapping is necessary on BE */
+ 		*ih->rptr_cpu = ih->rptr;
+-- 
+2.37.3
+
diff --git a/0062-netfilter-conntrack-NF_CONNTRACK_PROCFS-should-no-lo.patch b/0062-netfilter-conntrack-NF_CONNTRACK_PROCFS-should-no-lo.patch
new file mode 100644
index 000000000000..77bce9429d7e
--- /dev/null
+++ b/0062-netfilter-conntrack-NF_CONNTRACK_PROCFS-should-no-lo.patch
@@ -0,0 +1,34 @@
+From 7d4bfe34b9cbb0395cb9508fa64324d4a1379e00 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+Date: Mon, 15 Aug 2022 12:39:20 +0200
+Subject: [PATCH 62/73] netfilter: conntrack: NF_CONNTRACK_PROCFS should no
+ longer default to y
+
+[ Upstream commit aa5762c34213aba7a72dc58e70601370805fa794 ]
+
+NF_CONNTRACK_PROCFS was marked obsolete in commit 54b07dca68557b09
+("netfilter: provide config option to disable ancient procfs parts") in
+v3.3.
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
+index ddc54b6d18ee..8c0fea1bdc8d 100644
+--- a/net/netfilter/Kconfig
++++ b/net/netfilter/Kconfig
+@@ -144,7 +144,6 @@ config NF_CONNTRACK_ZONES
+ 
+ config NF_CONNTRACK_PROCFS
+ 	bool "Supply CT list in procfs (OBSOLETE)"
+-	default y
+ 	depends on PROC_FS
+ 	help
+ 	This option enables for the list of known conntrack entries
+-- 
+2.37.3
+
diff --git a/0063-testing-selftests-nft_flowtable.sh-use-random-netns-.patch b/0063-testing-selftests-nft_flowtable.sh-use-random-netns-.patch
new file mode 100644
index 000000000000..f8796362ab4c
--- /dev/null
+++ b/0063-testing-selftests-nft_flowtable.sh-use-random-netns-.patch
@@ -0,0 +1,428 @@
+From 503728838bdf9b8fd50ff1f89d47668e922880aa Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Tue, 16 Aug 2022 14:15:21 +0200
+Subject: [PATCH 63/73] testing: selftests: nft_flowtable.sh: use random netns
+ names
+
+[ Upstream commit b71b7bfeac38c7a21c423ddafb29aa6258949df8 ]
+
+"ns1" is a too generic name, use a random suffix to avoid
+errors when such a netns exists.  Also allows to run multiple
+instances of the script in parallel.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/netfilter/nft_flowtable.sh      | 246 +++++++++---------
+ 1 file changed, 128 insertions(+), 118 deletions(-)
+
+diff --git a/tools/testing/selftests/netfilter/nft_flowtable.sh b/tools/testing/selftests/netfilter/nft_flowtable.sh
+index d4ffebb989f8..c336e6c148d1 100755
+--- a/tools/testing/selftests/netfilter/nft_flowtable.sh
++++ b/tools/testing/selftests/netfilter/nft_flowtable.sh
+@@ -14,6 +14,11 @@
+ # nft_flowtable.sh -o8000 -l1500 -r2000
+ #
+ 
++sfx=$(mktemp -u "XXXXXXXX")
++ns1="ns1-$sfx"
++ns2="ns2-$sfx"
++nsr1="nsr1-$sfx"
++nsr2="nsr2-$sfx"
+ 
+ # Kselftest framework requirement - SKIP code is 4.
+ ksft_skip=4
+@@ -36,18 +41,17 @@ checktool (){
+ checktool "nft --version" "run test without nft tool"
+ checktool "ip -Version" "run test without ip tool"
+ checktool "which nc" "run test without nc (netcat)"
+-checktool "ip netns add nsr1" "create net namespace"
++checktool "ip netns add $nsr1" "create net namespace $nsr1"
+ 
+-ip netns add ns1
+-ip netns add ns2
+-
+-ip netns add nsr2
++ip netns add $ns1
++ip netns add $ns2
++ip netns add $nsr2
+ 
+ cleanup() {
+-	for i in 1 2; do
+-		ip netns del ns$i
+-		ip netns del nsr$i
+-	done
++	ip netns del $ns1
++	ip netns del $ns2
++	ip netns del $nsr1
++	ip netns del $nsr2
+ 
+ 	rm -f "$ns1in" "$ns1out"
+ 	rm -f "$ns2in" "$ns2out"
+@@ -59,22 +63,21 @@ trap cleanup EXIT
+ 
+ sysctl -q net.netfilter.nf_log_all_netns=1
+ 
+-ip link add veth0 netns nsr1 type veth peer name eth0 netns ns1
+-ip link add veth1 netns nsr1 type veth peer name veth0 netns nsr2
++ip link add veth0 netns $nsr1 type veth peer name eth0 netns $ns1
++ip link add veth1 netns $nsr1 type veth peer name veth0 netns $nsr2
+ 
+-ip link add veth1 netns nsr2 type veth peer name eth0 netns ns2
++ip link add veth1 netns $nsr2 type veth peer name eth0 netns $ns2
+ 
+ for dev in lo veth0 veth1; do
+-  for i in 1 2; do
+-    ip -net nsr$i link set $dev up
+-  done
++    ip -net $nsr1 link set $dev up
++    ip -net $nsr2 link set $dev up
+ done
+ 
+-ip -net nsr1 addr add 10.0.1.1/24 dev veth0
+-ip -net nsr1 addr add dead:1::1/64 dev veth0
++ip -net $nsr1 addr add 10.0.1.1/24 dev veth0
++ip -net $nsr1 addr add dead:1::1/64 dev veth0
+ 
+-ip -net nsr2 addr add 10.0.2.1/24 dev veth1
+-ip -net nsr2 addr add dead:2::1/64 dev veth1
++ip -net $nsr2 addr add 10.0.2.1/24 dev veth1
++ip -net $nsr2 addr add dead:2::1/64 dev veth1
+ 
+ # set different MTUs so we need to push packets coming from ns1 (large MTU)
+ # to ns2 (smaller MTU) to stack either to perform fragmentation (ip_no_pmtu_disc=1),
+@@ -106,49 +109,56 @@ do
+ 	esac
+ done
+ 
+-if ! ip -net nsr1 link set veth0 mtu $omtu; then
++if ! ip -net $nsr1 link set veth0 mtu $omtu; then
+ 	exit 1
+ fi
+ 
+-ip -net ns1 link set eth0 mtu $omtu
++ip -net $ns1 link set eth0 mtu $omtu
+ 
+-if ! ip -net nsr2 link set veth1 mtu $rmtu; then
++if ! ip -net $nsr2 link set veth1 mtu $rmtu; then
+ 	exit 1
+ fi
+ 
+-ip -net ns2 link set eth0 mtu $rmtu
++ip -net $ns2 link set eth0 mtu $rmtu
+ 
+ # transfer-net between nsr1 and nsr2.
+ # these addresses are not used for connections.
+-ip -net nsr1 addr add 192.168.10.1/24 dev veth1
+-ip -net nsr1 addr add fee1:2::1/64 dev veth1
+-
+-ip -net nsr2 addr add 192.168.10.2/24 dev veth0
+-ip -net nsr2 addr add fee1:2::2/64 dev veth0
+-
+-for i in 1 2; do
+-  ip netns exec nsr$i sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
+-  ip netns exec nsr$i sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
+-
+-  ip -net ns$i link set lo up
+-  ip -net ns$i link set eth0 up
+-  ip -net ns$i addr add 10.0.$i.99/24 dev eth0
+-  ip -net ns$i route add default via 10.0.$i.1
+-  ip -net ns$i addr add dead:$i::99/64 dev eth0
+-  ip -net ns$i route add default via dead:$i::1
+-  if ! ip netns exec ns$i sysctl net.ipv4.tcp_no_metrics_save=1 > /dev/null; then
++ip -net $nsr1 addr add 192.168.10.1/24 dev veth1
++ip -net $nsr1 addr add fee1:2::1/64 dev veth1
++
++ip -net $nsr2 addr add 192.168.10.2/24 dev veth0
++ip -net $nsr2 addr add fee1:2::2/64 dev veth0
++
++for i in 0 1; do
++  ip netns exec $nsr1 sysctl net.ipv4.conf.veth$i.forwarding=1 > /dev/null
++  ip netns exec $nsr2 sysctl net.ipv4.conf.veth$i.forwarding=1 > /dev/null
++done
++
++for ns in $ns1 $ns2;do
++  ip -net $ns link set lo up
++  ip -net $ns link set eth0 up
++
++  if ! ip netns exec $ns sysctl net.ipv4.tcp_no_metrics_save=1 > /dev/null; then
+ 	echo "ERROR: Check Originator/Responder values (problem during address addition)"
+ 	exit 1
+   fi
+-
+   # don't set ip DF bit for first two tests
+-  ip netns exec ns$i sysctl net.ipv4.ip_no_pmtu_disc=1 > /dev/null
++  ip netns exec $ns sysctl net.ipv4.ip_no_pmtu_disc=1 > /dev/null
+ done
+ 
+-ip -net nsr1 route add default via 192.168.10.2
+-ip -net nsr2 route add default via 192.168.10.1
++ip -net $ns1 addr add 10.0.1.99/24 dev eth0
++ip -net $ns2 addr add 10.0.2.99/24 dev eth0
++ip -net $ns1 route add default via 10.0.1.1
++ip -net $ns2 route add default via 10.0.2.1
++ip -net $ns1 addr add dead:1::99/64 dev eth0
++ip -net $ns2 addr add dead:2::99/64 dev eth0
++ip -net $ns1 route add default via dead:1::1
++ip -net $ns2 route add default via dead:2::1
++
++ip -net $nsr1 route add default via 192.168.10.2
++ip -net $nsr2 route add default via 192.168.10.1
+ 
+-ip netns exec nsr1 nft -f - <<EOF
++ip netns exec $nsr1 nft -f - <<EOF
+ table inet filter {
+   flowtable f1 {
+      hook ingress priority 0
+@@ -197,18 +207,18 @@ if [ $? -ne 0 ]; then
+ fi
+ 
+ # test basic connectivity
+-if ! ip netns exec ns1 ping -c 1 -q 10.0.2.99 > /dev/null; then
+-  echo "ERROR: ns1 cannot reach ns2" 1>&2
++if ! ip netns exec $ns1 ping -c 1 -q 10.0.2.99 > /dev/null; then
++  echo "ERROR: $ns1 cannot reach ns2" 1>&2
+   exit 1
+ fi
+ 
+-if ! ip netns exec ns2 ping -c 1 -q 10.0.1.99 > /dev/null; then
+-  echo "ERROR: ns2 cannot reach ns1" 1>&2
++if ! ip netns exec $ns2 ping -c 1 -q 10.0.1.99 > /dev/null; then
++  echo "ERROR: $ns2 cannot reach $ns1" 1>&2
+   exit 1
+ fi
+ 
+ if [ $ret -eq 0 ];then
+-	echo "PASS: netns routing/connectivity: ns1 can reach ns2"
++	echo "PASS: netns routing/connectivity: $ns1 can reach $ns2"
+ fi
+ 
+ ns1in=$(mktemp)
+@@ -312,24 +322,24 @@ make_file "$ns2in"
+ 
+ # First test:
+ # No PMTU discovery, nsr1 is expected to fragment packets from ns1 to ns2 as needed.
+-if test_tcp_forwarding ns1 ns2; then
++if test_tcp_forwarding $ns1 $ns2; then
+ 	echo "PASS: flow offloaded for ns1/ns2"
+ else
+ 	echo "FAIL: flow offload for ns1/ns2:" 1>&2
+-	ip netns exec nsr1 nft list ruleset
++	ip netns exec $nsr1 nft list ruleset
+ 	ret=1
+ fi
+ 
+ # delete default route, i.e. ns2 won't be able to reach ns1 and
+ # will depend on ns1 being masqueraded in nsr1.
+ # expect ns1 has nsr1 address.
+-ip -net ns2 route del default via 10.0.2.1
+-ip -net ns2 route del default via dead:2::1
+-ip -net ns2 route add 192.168.10.1 via 10.0.2.1
++ip -net $ns2 route del default via 10.0.2.1
++ip -net $ns2 route del default via dead:2::1
++ip -net $ns2 route add 192.168.10.1 via 10.0.2.1
+ 
+ # Second test:
+ # Same, but with NAT enabled.
+-ip netns exec nsr1 nft -f - <<EOF
++ip netns exec $nsr1 nft -f - <<EOF
+ table ip nat {
+    chain prerouting {
+       type nat hook prerouting priority 0; policy accept;
+@@ -343,47 +353,47 @@ table ip nat {
+ }
+ EOF
+ 
+-if test_tcp_forwarding_nat ns1 ns2; then
++if test_tcp_forwarding_nat $ns1 $ns2; then
+ 	echo "PASS: flow offloaded for ns1/ns2 with NAT"
+ else
+ 	echo "FAIL: flow offload for ns1/ns2 with NAT" 1>&2
+-	ip netns exec nsr1 nft list ruleset
++	ip netns exec $nsr1 nft list ruleset
+ 	ret=1
+ fi
+ 
+ # Third test:
+ # Same as second test, but with PMTU discovery enabled.
+-handle=$(ip netns exec nsr1 nft -a list table inet filter | grep something-to-grep-for | cut -d \# -f 2)
++handle=$(ip netns exec $nsr1 nft -a list table inet filter | grep something-to-grep-for | cut -d \# -f 2)
+ 
+-if ! ip netns exec nsr1 nft delete rule inet filter forward $handle; then
++if ! ip netns exec $nsr1 nft delete rule inet filter forward $handle; then
+ 	echo "FAIL: Could not delete large-packet accept rule"
+ 	exit 1
+ fi
+ 
+-ip netns exec ns1 sysctl net.ipv4.ip_no_pmtu_disc=0 > /dev/null
+-ip netns exec ns2 sysctl net.ipv4.ip_no_pmtu_disc=0 > /dev/null
++ip netns exec $ns1 sysctl net.ipv4.ip_no_pmtu_disc=0 > /dev/null
++ip netns exec $ns2 sysctl net.ipv4.ip_no_pmtu_disc=0 > /dev/null
+ 
+-if test_tcp_forwarding_nat ns1 ns2; then
++if test_tcp_forwarding_nat $ns1 $ns2; then
+ 	echo "PASS: flow offloaded for ns1/ns2 with NAT and pmtu discovery"
+ else
+ 	echo "FAIL: flow offload for ns1/ns2 with NAT and pmtu discovery" 1>&2
+-	ip netns exec nsr1 nft list ruleset
++	ip netns exec $nsr1 nft list ruleset
+ fi
+ 
+ # Another test:
+ # Add bridge interface br0 to Router1, with NAT enabled.
+-ip -net nsr1 link add name br0 type bridge
+-ip -net nsr1 addr flush dev veth0
+-ip -net nsr1 link set up dev veth0
+-ip -net nsr1 link set veth0 master br0
+-ip -net nsr1 addr add 10.0.1.1/24 dev br0
+-ip -net nsr1 addr add dead:1::1/64 dev br0
+-ip -net nsr1 link set up dev br0
++ip -net $nsr1 link add name br0 type bridge
++ip -net $nsr1 addr flush dev veth0
++ip -net $nsr1 link set up dev veth0
++ip -net $nsr1 link set veth0 master br0
++ip -net $nsr1 addr add 10.0.1.1/24 dev br0
++ip -net $nsr1 addr add dead:1::1/64 dev br0
++ip -net $nsr1 link set up dev br0
+ 
+-ip netns exec nsr1 sysctl net.ipv4.conf.br0.forwarding=1 > /dev/null
++ip netns exec $nsr1 sysctl net.ipv4.conf.br0.forwarding=1 > /dev/null
+ 
+ # br0 with NAT enabled.
+-ip netns exec nsr1 nft -f - <<EOF
++ip netns exec $nsr1 nft -f - <<EOF
+ flush table ip nat
+ table ip nat {
+    chain prerouting {
+@@ -398,59 +408,59 @@ table ip nat {
+ }
+ EOF
+ 
+-if test_tcp_forwarding_nat ns1 ns2; then
++if test_tcp_forwarding_nat $ns1 $ns2; then
+ 	echo "PASS: flow offloaded for ns1/ns2 with bridge NAT"
+ else
+ 	echo "FAIL: flow offload for ns1/ns2 with bridge NAT" 1>&2
+-	ip netns exec nsr1 nft list ruleset
++	ip netns exec $nsr1 nft list ruleset
+ 	ret=1
+ fi
+ 
+ # Another test:
+ # Add bridge interface br0 to Router1, with NAT and VLAN.
+-ip -net nsr1 link set veth0 nomaster
+-ip -net nsr1 link set down dev veth0
+-ip -net nsr1 link add link veth0 name veth0.10 type vlan id 10
+-ip -net nsr1 link set up dev veth0
+-ip -net nsr1 link set up dev veth0.10
+-ip -net nsr1 link set veth0.10 master br0
+-
+-ip -net ns1 addr flush dev eth0
+-ip -net ns1 link add link eth0 name eth0.10 type vlan id 10
+-ip -net ns1 link set eth0 up
+-ip -net ns1 link set eth0.10 up
+-ip -net ns1 addr add 10.0.1.99/24 dev eth0.10
+-ip -net ns1 route add default via 10.0.1.1
+-ip -net ns1 addr add dead:1::99/64 dev eth0.10
+-
+-if test_tcp_forwarding_nat ns1 ns2; then
++ip -net $nsr1 link set veth0 nomaster
++ip -net $nsr1 link set down dev veth0
++ip -net $nsr1 link add link veth0 name veth0.10 type vlan id 10
++ip -net $nsr1 link set up dev veth0
++ip -net $nsr1 link set up dev veth0.10
++ip -net $nsr1 link set veth0.10 master br0
++
++ip -net $ns1 addr flush dev eth0
++ip -net $ns1 link add link eth0 name eth0.10 type vlan id 10
++ip -net $ns1 link set eth0 up
++ip -net $ns1 link set eth0.10 up
++ip -net $ns1 addr add 10.0.1.99/24 dev eth0.10
++ip -net $ns1 route add default via 10.0.1.1
++ip -net $ns1 addr add dead:1::99/64 dev eth0.10
++
++if test_tcp_forwarding_nat $ns1 $ns2; then
+ 	echo "PASS: flow offloaded for ns1/ns2 with bridge NAT and VLAN"
+ else
+ 	echo "FAIL: flow offload for ns1/ns2 with bridge NAT and VLAN" 1>&2
+-	ip netns exec nsr1 nft list ruleset
++	ip netns exec $nsr1 nft list ruleset
+ 	ret=1
+ fi
+ 
+ # restore test topology (remove bridge and VLAN)
+-ip -net nsr1 link set veth0 nomaster
+-ip -net nsr1 link set veth0 down
+-ip -net nsr1 link set veth0.10 down
+-ip -net nsr1 link delete veth0.10 type vlan
+-ip -net nsr1 link delete br0 type bridge
+-ip -net ns1 addr flush dev eth0.10
+-ip -net ns1 link set eth0.10 down
+-ip -net ns1 link set eth0 down
+-ip -net ns1 link delete eth0.10 type vlan
++ip -net $nsr1 link set veth0 nomaster
++ip -net $nsr1 link set veth0 down
++ip -net $nsr1 link set veth0.10 down
++ip -net $nsr1 link delete veth0.10 type vlan
++ip -net $nsr1 link delete br0 type bridge
++ip -net $ns1 addr flush dev eth0.10
++ip -net $ns1 link set eth0.10 down
++ip -net $ns1 link set eth0 down
++ip -net $ns1 link delete eth0.10 type vlan
+ 
+ # restore address in ns1 and nsr1
+-ip -net ns1 link set eth0 up
+-ip -net ns1 addr add 10.0.1.99/24 dev eth0
+-ip -net ns1 route add default via 10.0.1.1
+-ip -net ns1 addr add dead:1::99/64 dev eth0
+-ip -net ns1 route add default via dead:1::1
+-ip -net nsr1 addr add 10.0.1.1/24 dev veth0
+-ip -net nsr1 addr add dead:1::1/64 dev veth0
+-ip -net nsr1 link set up dev veth0
++ip -net $ns1 link set eth0 up
++ip -net $ns1 addr add 10.0.1.99/24 dev eth0
++ip -net $ns1 route add default via 10.0.1.1
++ip -net $ns1 addr add dead:1::99/64 dev eth0
++ip -net $ns1 route add default via dead:1::1
++ip -net $nsr1 addr add 10.0.1.1/24 dev veth0
++ip -net $nsr1 addr add dead:1::1/64 dev veth0
++ip -net $nsr1 link set up dev veth0
+ 
+ KEY_SHA="0x"$(ps -xaf | sha1sum | cut -d " " -f 1)
+ KEY_AES="0x"$(ps -xaf | md5sum | cut -d " " -f 1)
+@@ -480,23 +490,23 @@ do_esp() {
+ 
+ }
+ 
+-do_esp nsr1 192.168.10.1 192.168.10.2 10.0.1.0/24 10.0.2.0/24 $SPI1 $SPI2
++do_esp $nsr1 192.168.10.1 192.168.10.2 10.0.1.0/24 10.0.2.0/24 $SPI1 $SPI2
+ 
+-do_esp nsr2 192.168.10.2 192.168.10.1 10.0.2.0/24 10.0.1.0/24 $SPI2 $SPI1
++do_esp $nsr2 192.168.10.2 192.168.10.1 10.0.2.0/24 10.0.1.0/24 $SPI2 $SPI1
+ 
+-ip netns exec nsr1 nft delete table ip nat
++ip netns exec $nsr1 nft delete table ip nat
+ 
+ # restore default routes
+-ip -net ns2 route del 192.168.10.1 via 10.0.2.1
+-ip -net ns2 route add default via 10.0.2.1
+-ip -net ns2 route add default via dead:2::1
++ip -net $ns2 route del 192.168.10.1 via 10.0.2.1
++ip -net $ns2 route add default via 10.0.2.1
++ip -net $ns2 route add default via dead:2::1
+ 
+-if test_tcp_forwarding ns1 ns2; then
++if test_tcp_forwarding $ns1 $ns2; then
+ 	echo "PASS: ipsec tunnel mode for ns1/ns2"
+ else
+ 	echo "FAIL: ipsec tunnel mode for ns1/ns2"
+-	ip netns exec nsr1 nft list ruleset 1>&2
+-	ip netns exec nsr1 cat /proc/net/xfrm_stat 1>&2
++	ip netns exec $nsr1 nft list ruleset 1>&2
++	ip netns exec $nsr1 cat /proc/net/xfrm_stat 1>&2
+ fi
+ 
+ exit $ret
+-- 
+2.37.3
+
diff --git a/0064-platform-x86-serial-multi-instantiate-Add-CLSA0101-L.patch b/0064-platform-x86-serial-multi-instantiate-Add-CLSA0101-L.patch
new file mode 100644
index 000000000000..3f9d9a1de53a
--- /dev/null
+++ b/0064-platform-x86-serial-multi-instantiate-Add-CLSA0101-L.patch
@@ -0,0 +1,35 @@
+From 0f31a350fd9a7c750bcde02f92eec3293b6bb667 Mon Sep 17 00:00:00 2001
+From: Lucas Tanure <tanureal@opensource.cirrus.com>
+Date: Wed, 27 Jul 2022 10:59:24 +0100
+Subject: [PATCH 64/73] platform/x86: serial-multi-instantiate: Add CLSA0101
+ Laptop
+
+[ Upstream commit 88392a0dd0ab263edb4ca416ebdecabd8289158a ]
+
+The device CLSA0101 has two instances of CS35L41
+connected by I2C.
+
+Signed-off-by: Lucas Tanure <tanureal@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20220727095924.80884-5-tanureal@opensource.cirrus.com
+Link: https://lore.kernel.org/r/20220816194639.13870-1-cam@neo-zeon.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/serial-multi-instantiate.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/serial-multi-instantiate.c b/drivers/platform/x86/serial-multi-instantiate.c
+index 1e8063b7c169..e98007197cf5 100644
+--- a/drivers/platform/x86/serial-multi-instantiate.c
++++ b/drivers/platform/x86/serial-multi-instantiate.c
+@@ -329,6 +329,7 @@ static const struct acpi_device_id smi_acpi_ids[] = {
+ 	{ "CSC3551", (unsigned long)&cs35l41_hda },
+ 	/* Non-conforming _HID for Cirrus Logic already released */
+ 	{ "CLSA0100", (unsigned long)&cs35l41_hda },
++	{ "CLSA0101", (unsigned long)&cs35l41_hda },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(acpi, smi_acpi_ids);
+-- 
+2.37.3
+
diff --git a/0065-ALSA-hda-cs8409-Support-new-Dolphin-Variants.patch b/0065-ALSA-hda-cs8409-Support-new-Dolphin-Variants.patch
new file mode 100644
index 000000000000..12997992dcb3
--- /dev/null
+++ b/0065-ALSA-hda-cs8409-Support-new-Dolphin-Variants.patch
@@ -0,0 +1,35 @@
+From 82af833b99dc51c8795d171dfd376b451506544a Mon Sep 17 00:00:00 2001
+From: Stefan Binding <sbinding@opensource.cirrus.com>
+Date: Tue, 16 Aug 2022 16:19:01 +0100
+Subject: [PATCH 65/73] ALSA: hda/cs8409: Support new Dolphin Variants
+
+[ Upstream commit 1ff954f9ab054675b9eb02dd14add8f7aa376d71 ]
+
+Add 4 new Dolphin Systems, same configuration as older systems.
+
+Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20220816151901.1398007-1-sbinding@opensource.cirrus.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_cs8409-tables.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/pci/hda/patch_cs8409-tables.c b/sound/pci/hda/patch_cs8409-tables.c
+index 4f4cc8215917..5b140301ca66 100644
+--- a/sound/pci/hda/patch_cs8409-tables.c
++++ b/sound/pci/hda/patch_cs8409-tables.c
+@@ -546,6 +546,10 @@ const struct snd_pci_quirk cs8409_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1028, 0x0BD6, "Dolphin", CS8409_DOLPHIN),
+ 	SND_PCI_QUIRK(0x1028, 0x0BD7, "Dolphin", CS8409_DOLPHIN),
+ 	SND_PCI_QUIRK(0x1028, 0x0BD8, "Dolphin", CS8409_DOLPHIN),
++	SND_PCI_QUIRK(0x1028, 0x0C43, "Dolphin", CS8409_DOLPHIN),
++	SND_PCI_QUIRK(0x1028, 0x0C50, "Dolphin", CS8409_DOLPHIN),
++	SND_PCI_QUIRK(0x1028, 0x0C51, "Dolphin", CS8409_DOLPHIN),
++	SND_PCI_QUIRK(0x1028, 0x0C52, "Dolphin", CS8409_DOLPHIN),
+ 	{} /* terminator */
+ };
+ 
+-- 
+2.37.3
+
diff --git a/0066-btrfs-move-lockdep-class-helpers-to-locking.c.patch b/0066-btrfs-move-lockdep-class-helpers-to-locking.c.patch
new file mode 100644
index 000000000000..2a42f10c05ba
--- /dev/null
+++ b/0066-btrfs-move-lockdep-class-helpers-to-locking.c.patch
@@ -0,0 +1,246 @@
+From 98f803acf8ac18a1cc159473137d563db4df0aa8 Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Date: Tue, 26 Jul 2022 16:24:03 -0400
+Subject: [PATCH 66/73] btrfs: move lockdep class helpers to locking.c
+
+[ Upstream commit 0a27a0474d146eb79e09ec88bf0d4229f4cfc1b8 ]
+
+These definitions exist in disk-io.c, which is not related to the
+locking.  Move this over to locking.h/c where it makes more sense.
+
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/disk-io.c | 82 ----------------------------------------------
+ fs/btrfs/disk-io.h | 10 ------
+ fs/btrfs/locking.c | 80 ++++++++++++++++++++++++++++++++++++++++++++
+ fs/btrfs/locking.h |  9 +++++
+ 4 files changed, 89 insertions(+), 92 deletions(-)
+
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index bc3030661583..a2505cfc6bc1 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -121,88 +121,6 @@ struct async_submit_bio {
+ 	blk_status_t status;
+ };
+ 
+-/*
+- * Lockdep class keys for extent_buffer->lock's in this root.  For a given
+- * eb, the lockdep key is determined by the btrfs_root it belongs to and
+- * the level the eb occupies in the tree.
+- *
+- * Different roots are used for different purposes and may nest inside each
+- * other and they require separate keysets.  As lockdep keys should be
+- * static, assign keysets according to the purpose of the root as indicated
+- * by btrfs_root->root_key.objectid.  This ensures that all special purpose
+- * roots have separate keysets.
+- *
+- * Lock-nesting across peer nodes is always done with the immediate parent
+- * node locked thus preventing deadlock.  As lockdep doesn't know this, use
+- * subclass to avoid triggering lockdep warning in such cases.
+- *
+- * The key is set by the readpage_end_io_hook after the buffer has passed
+- * csum validation but before the pages are unlocked.  It is also set by
+- * btrfs_init_new_buffer on freshly allocated blocks.
+- *
+- * We also add a check to make sure the highest level of the tree is the
+- * same as our lockdep setup here.  If BTRFS_MAX_LEVEL changes, this code
+- * needs update as well.
+- */
+-#ifdef CONFIG_DEBUG_LOCK_ALLOC
+-# if BTRFS_MAX_LEVEL != 8
+-#  error
+-# endif
+-
+-#define DEFINE_LEVEL(stem, level)					\
+-	.names[level] = "btrfs-" stem "-0" #level,
+-
+-#define DEFINE_NAME(stem)						\
+-	DEFINE_LEVEL(stem, 0)						\
+-	DEFINE_LEVEL(stem, 1)						\
+-	DEFINE_LEVEL(stem, 2)						\
+-	DEFINE_LEVEL(stem, 3)						\
+-	DEFINE_LEVEL(stem, 4)						\
+-	DEFINE_LEVEL(stem, 5)						\
+-	DEFINE_LEVEL(stem, 6)						\
+-	DEFINE_LEVEL(stem, 7)
+-
+-static struct btrfs_lockdep_keyset {
+-	u64			id;		/* root objectid */
+-	/* Longest entry: btrfs-free-space-00 */
+-	char			names[BTRFS_MAX_LEVEL][20];
+-	struct lock_class_key	keys[BTRFS_MAX_LEVEL];
+-} btrfs_lockdep_keysets[] = {
+-	{ .id = BTRFS_ROOT_TREE_OBJECTID,	DEFINE_NAME("root")	},
+-	{ .id = BTRFS_EXTENT_TREE_OBJECTID,	DEFINE_NAME("extent")	},
+-	{ .id = BTRFS_CHUNK_TREE_OBJECTID,	DEFINE_NAME("chunk")	},
+-	{ .id = BTRFS_DEV_TREE_OBJECTID,	DEFINE_NAME("dev")	},
+-	{ .id = BTRFS_CSUM_TREE_OBJECTID,	DEFINE_NAME("csum")	},
+-	{ .id = BTRFS_QUOTA_TREE_OBJECTID,	DEFINE_NAME("quota")	},
+-	{ .id = BTRFS_TREE_LOG_OBJECTID,	DEFINE_NAME("log")	},
+-	{ .id = BTRFS_TREE_RELOC_OBJECTID,	DEFINE_NAME("treloc")	},
+-	{ .id = BTRFS_DATA_RELOC_TREE_OBJECTID,	DEFINE_NAME("dreloc")	},
+-	{ .id = BTRFS_UUID_TREE_OBJECTID,	DEFINE_NAME("uuid")	},
+-	{ .id = BTRFS_FREE_SPACE_TREE_OBJECTID,	DEFINE_NAME("free-space") },
+-	{ .id = 0,				DEFINE_NAME("tree")	},
+-};
+-
+-#undef DEFINE_LEVEL
+-#undef DEFINE_NAME
+-
+-void btrfs_set_buffer_lockdep_class(u64 objectid, struct extent_buffer *eb,
+-				    int level)
+-{
+-	struct btrfs_lockdep_keyset *ks;
+-
+-	BUG_ON(level >= ARRAY_SIZE(ks->keys));
+-
+-	/* find the matching keyset, id 0 is the default entry */
+-	for (ks = btrfs_lockdep_keysets; ks->id; ks++)
+-		if (ks->id == objectid)
+-			break;
+-
+-	lockdep_set_class_and_name(&eb->lock,
+-				   &ks->keys[level], ks->names[level]);
+-}
+-
+-#endif
+-
+ /*
+  * Compute the csum of a btree block and store the result to provided buffer.
+  */
+diff --git a/fs/btrfs/disk-io.h b/fs/btrfs/disk-io.h
+index 4ee8c42c9f78..b4962b7d7117 100644
+--- a/fs/btrfs/disk-io.h
++++ b/fs/btrfs/disk-io.h
+@@ -148,14 +148,4 @@ int btrfs_init_root_free_objectid(struct btrfs_root *root);
+ int __init btrfs_end_io_wq_init(void);
+ void __cold btrfs_end_io_wq_exit(void);
+ 
+-#ifdef CONFIG_DEBUG_LOCK_ALLOC
+-void btrfs_set_buffer_lockdep_class(u64 objectid,
+-			            struct extent_buffer *eb, int level);
+-#else
+-static inline void btrfs_set_buffer_lockdep_class(u64 objectid,
+-					struct extent_buffer *eb, int level)
+-{
+-}
+-#endif
+-
+ #endif
+diff --git a/fs/btrfs/locking.c b/fs/btrfs/locking.c
+index 33461b4f9c8b..5747c63929df 100644
+--- a/fs/btrfs/locking.c
++++ b/fs/btrfs/locking.c
+@@ -13,6 +13,86 @@
+ #include "extent_io.h"
+ #include "locking.h"
+ 
++/*
++ * Lockdep class keys for extent_buffer->lock's in this root.  For a given
++ * eb, the lockdep key is determined by the btrfs_root it belongs to and
++ * the level the eb occupies in the tree.
++ *
++ * Different roots are used for different purposes and may nest inside each
++ * other and they require separate keysets.  As lockdep keys should be
++ * static, assign keysets according to the purpose of the root as indicated
++ * by btrfs_root->root_key.objectid.  This ensures that all special purpose
++ * roots have separate keysets.
++ *
++ * Lock-nesting across peer nodes is always done with the immediate parent
++ * node locked thus preventing deadlock.  As lockdep doesn't know this, use
++ * subclass to avoid triggering lockdep warning in such cases.
++ *
++ * The key is set by the readpage_end_io_hook after the buffer has passed
++ * csum validation but before the pages are unlocked.  It is also set by
++ * btrfs_init_new_buffer on freshly allocated blocks.
++ *
++ * We also add a check to make sure the highest level of the tree is the
++ * same as our lockdep setup here.  If BTRFS_MAX_LEVEL changes, this code
++ * needs update as well.
++ */
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++#if BTRFS_MAX_LEVEL != 8
++#error
++#endif
++
++#define DEFINE_LEVEL(stem, level)					\
++	.names[level] = "btrfs-" stem "-0" #level,
++
++#define DEFINE_NAME(stem)						\
++	DEFINE_LEVEL(stem, 0)						\
++	DEFINE_LEVEL(stem, 1)						\
++	DEFINE_LEVEL(stem, 2)						\
++	DEFINE_LEVEL(stem, 3)						\
++	DEFINE_LEVEL(stem, 4)						\
++	DEFINE_LEVEL(stem, 5)						\
++	DEFINE_LEVEL(stem, 6)						\
++	DEFINE_LEVEL(stem, 7)
++
++static struct btrfs_lockdep_keyset {
++	u64			id;		/* root objectid */
++	/* Longest entry: btrfs-free-space-00 */
++	char			names[BTRFS_MAX_LEVEL][20];
++	struct lock_class_key	keys[BTRFS_MAX_LEVEL];
++} btrfs_lockdep_keysets[] = {
++	{ .id = BTRFS_ROOT_TREE_OBJECTID,	DEFINE_NAME("root")	},
++	{ .id = BTRFS_EXTENT_TREE_OBJECTID,	DEFINE_NAME("extent")	},
++	{ .id = BTRFS_CHUNK_TREE_OBJECTID,	DEFINE_NAME("chunk")	},
++	{ .id = BTRFS_DEV_TREE_OBJECTID,	DEFINE_NAME("dev")	},
++	{ .id = BTRFS_CSUM_TREE_OBJECTID,	DEFINE_NAME("csum")	},
++	{ .id = BTRFS_QUOTA_TREE_OBJECTID,	DEFINE_NAME("quota")	},
++	{ .id = BTRFS_TREE_LOG_OBJECTID,	DEFINE_NAME("log")	},
++	{ .id = BTRFS_TREE_RELOC_OBJECTID,	DEFINE_NAME("treloc")	},
++	{ .id = BTRFS_DATA_RELOC_TREE_OBJECTID,	DEFINE_NAME("dreloc")	},
++	{ .id = BTRFS_UUID_TREE_OBJECTID,	DEFINE_NAME("uuid")	},
++	{ .id = BTRFS_FREE_SPACE_TREE_OBJECTID,	DEFINE_NAME("free-space") },
++	{ .id = 0,				DEFINE_NAME("tree")	},
++};
++
++#undef DEFINE_LEVEL
++#undef DEFINE_NAME
++
++void btrfs_set_buffer_lockdep_class(u64 objectid, struct extent_buffer *eb, int level)
++{
++	struct btrfs_lockdep_keyset *ks;
++
++	BUG_ON(level >= ARRAY_SIZE(ks->keys));
++
++	/* Find the matching keyset, id 0 is the default entry */
++	for (ks = btrfs_lockdep_keysets; ks->id; ks++)
++		if (ks->id == objectid)
++			break;
++
++	lockdep_set_class_and_name(&eb->lock, &ks->keys[level], ks->names[level]);
++}
++
++#endif
++
+ /*
+  * Extent buffer locking
+  * =====================
+diff --git a/fs/btrfs/locking.h b/fs/btrfs/locking.h
+index bbc45534ae9a..b21372cab840 100644
+--- a/fs/btrfs/locking.h
++++ b/fs/btrfs/locking.h
+@@ -131,4 +131,13 @@ void btrfs_drew_write_unlock(struct btrfs_drew_lock *lock);
+ void btrfs_drew_read_lock(struct btrfs_drew_lock *lock);
+ void btrfs_drew_read_unlock(struct btrfs_drew_lock *lock);
+ 
++#ifdef CONFIG_DEBUG_LOCK_ALLOC
++void btrfs_set_buffer_lockdep_class(u64 objectid, struct extent_buffer *eb, int level);
++#else
++static inline void btrfs_set_buffer_lockdep_class(u64 objectid,
++					struct extent_buffer *eb, int level)
++{
++}
++#endif
++
+ #endif
+-- 
+2.37.3
+
diff --git a/0067-btrfs-fix-lockdep-splat-with-reloc-root-extent-buffe.patch b/0067-btrfs-fix-lockdep-splat-with-reloc-root-extent-buffe.patch
new file mode 100644
index 000000000000..51f5185f8596
--- /dev/null
+++ b/0067-btrfs-fix-lockdep-splat-with-reloc-root-extent-buffe.patch
@@ -0,0 +1,365 @@
+From b83e1567af28055b9a0bb7b10fcdd58b02d00954 Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Date: Tue, 26 Jul 2022 16:24:04 -0400
+Subject: [PATCH 67/73] btrfs: fix lockdep splat with reloc root extent buffers
+
+[ Upstream commit b40130b23ca4a08c5785d5a3559805916bddba3c ]
+
+We have been hitting the following lockdep splat with btrfs/187 recently
+
+  WARNING: possible circular locking dependency detected
+  5.19.0-rc8+ #775 Not tainted
+  ------------------------------------------------------
+  btrfs/752500 is trying to acquire lock:
+  ffff97e1875a97b8 (btrfs-treloc-02#2){+.+.}-{3:3}, at: __btrfs_tree_lock+0x24/0x110
+
+  but task is already holding lock:
+  ffff97e1875a9278 (btrfs-tree-01/1){+.+.}-{3:3}, at: __btrfs_tree_lock+0x24/0x110
+
+  which lock already depends on the new lock.
+
+  the existing dependency chain (in reverse order) is:
+
+  -> #2 (btrfs-tree-01/1){+.+.}-{3:3}:
+	 down_write_nested+0x41/0x80
+	 __btrfs_tree_lock+0x24/0x110
+	 btrfs_init_new_buffer+0x7d/0x2c0
+	 btrfs_alloc_tree_block+0x120/0x3b0
+	 __btrfs_cow_block+0x136/0x600
+	 btrfs_cow_block+0x10b/0x230
+	 btrfs_search_slot+0x53b/0xb70
+	 btrfs_lookup_inode+0x2a/0xa0
+	 __btrfs_update_delayed_inode+0x5f/0x280
+	 btrfs_async_run_delayed_root+0x24c/0x290
+	 btrfs_work_helper+0xf2/0x3e0
+	 process_one_work+0x271/0x590
+	 worker_thread+0x52/0x3b0
+	 kthread+0xf0/0x120
+	 ret_from_fork+0x1f/0x30
+
+  -> #1 (btrfs-tree-01){++++}-{3:3}:
+	 down_write_nested+0x41/0x80
+	 __btrfs_tree_lock+0x24/0x110
+	 btrfs_search_slot+0x3c3/0xb70
+	 do_relocation+0x10c/0x6b0
+	 relocate_tree_blocks+0x317/0x6d0
+	 relocate_block_group+0x1f1/0x560
+	 btrfs_relocate_block_group+0x23e/0x400
+	 btrfs_relocate_chunk+0x4c/0x140
+	 btrfs_balance+0x755/0xe40
+	 btrfs_ioctl+0x1ea2/0x2c90
+	 __x64_sys_ioctl+0x88/0xc0
+	 do_syscall_64+0x38/0x90
+	 entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+  -> #0 (btrfs-treloc-02#2){+.+.}-{3:3}:
+	 __lock_acquire+0x1122/0x1e10
+	 lock_acquire+0xc2/0x2d0
+	 down_write_nested+0x41/0x80
+	 __btrfs_tree_lock+0x24/0x110
+	 btrfs_lock_root_node+0x31/0x50
+	 btrfs_search_slot+0x1cb/0xb70
+	 replace_path+0x541/0x9f0
+	 merge_reloc_root+0x1d6/0x610
+	 merge_reloc_roots+0xe2/0x260
+	 relocate_block_group+0x2c8/0x560
+	 btrfs_relocate_block_group+0x23e/0x400
+	 btrfs_relocate_chunk+0x4c/0x140
+	 btrfs_balance+0x755/0xe40
+	 btrfs_ioctl+0x1ea2/0x2c90
+	 __x64_sys_ioctl+0x88/0xc0
+	 do_syscall_64+0x38/0x90
+	 entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+  other info that might help us debug this:
+
+  Chain exists of:
+    btrfs-treloc-02#2 --> btrfs-tree-01 --> btrfs-tree-01/1
+
+   Possible unsafe locking scenario:
+
+	 CPU0                    CPU1
+	 ----                    ----
+    lock(btrfs-tree-01/1);
+				 lock(btrfs-tree-01);
+				 lock(btrfs-tree-01/1);
+    lock(btrfs-treloc-02#2);
+
+   *** DEADLOCK ***
+
+  7 locks held by btrfs/752500:
+   #0: ffff97e292fdf460 (sb_writers#12){.+.+}-{0:0}, at: btrfs_ioctl+0x208/0x2c90
+   #1: ffff97e284c02050 (&fs_info->reclaim_bgs_lock){+.+.}-{3:3}, at: btrfs_balance+0x55f/0xe40
+   #2: ffff97e284c00878 (&fs_info->cleaner_mutex){+.+.}-{3:3}, at: btrfs_relocate_block_group+0x236/0x400
+   #3: ffff97e292fdf650 (sb_internal#2){.+.+}-{0:0}, at: merge_reloc_root+0xef/0x610
+   #4: ffff97e284c02378 (btrfs_trans_num_writers){++++}-{0:0}, at: join_transaction+0x1a8/0x5a0
+   #5: ffff97e284c023a0 (btrfs_trans_num_extwriters){++++}-{0:0}, at: join_transaction+0x1a8/0x5a0
+   #6: ffff97e1875a9278 (btrfs-tree-01/1){+.+.}-{3:3}, at: __btrfs_tree_lock+0x24/0x110
+
+  stack backtrace:
+  CPU: 1 PID: 752500 Comm: btrfs Not tainted 5.19.0-rc8+ #775
+  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014
+  Call Trace:
+
+   dump_stack_lvl+0x56/0x73
+   check_noncircular+0xd6/0x100
+   ? lock_is_held_type+0xe2/0x140
+   __lock_acquire+0x1122/0x1e10
+   lock_acquire+0xc2/0x2d0
+   ? __btrfs_tree_lock+0x24/0x110
+   down_write_nested+0x41/0x80
+   ? __btrfs_tree_lock+0x24/0x110
+   __btrfs_tree_lock+0x24/0x110
+   btrfs_lock_root_node+0x31/0x50
+   btrfs_search_slot+0x1cb/0xb70
+   ? lock_release+0x137/0x2d0
+   ? _raw_spin_unlock+0x29/0x50
+   ? release_extent_buffer+0x128/0x180
+   replace_path+0x541/0x9f0
+   merge_reloc_root+0x1d6/0x610
+   merge_reloc_roots+0xe2/0x260
+   relocate_block_group+0x2c8/0x560
+   btrfs_relocate_block_group+0x23e/0x400
+   btrfs_relocate_chunk+0x4c/0x140
+   btrfs_balance+0x755/0xe40
+   btrfs_ioctl+0x1ea2/0x2c90
+   ? lock_is_held_type+0xe2/0x140
+   ? lock_is_held_type+0xe2/0x140
+   ? __x64_sys_ioctl+0x88/0xc0
+   __x64_sys_ioctl+0x88/0xc0
+   do_syscall_64+0x38/0x90
+   entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+This isn't necessarily new, it's just tricky to hit in practice.  There
+are two competing things going on here.  With relocation we create a
+snapshot of every fs tree with a reloc tree.  Any extent buffers that
+get initialized here are initialized with the reloc root lockdep key.
+However since it is a snapshot, any blocks that are currently in cache
+that originally belonged to the fs tree will have the normal tree
+lockdep key set.  This creates the lock dependency of
+
+  reloc tree -> normal tree
+
+for the extent buffer locking during the first phase of the relocation
+as we walk down the reloc root to relocate blocks.
+
+However this is problematic because the final phase of the relocation is
+merging the reloc root into the original fs root.  This involves
+searching down to any keys that exist in the original fs root and then
+swapping the relocated block and the original fs root block.  We have to
+search down to the fs root first, and then go search the reloc root for
+the block we need to replace.  This creates the dependency of
+
+  normal tree -> reloc tree
+
+which is why lockdep complains.
+
+Additionally even if we were to fix this particular mismatch with a
+different nesting for the merge case, we're still slotting in a block
+that has a owner of the reloc root objectid into a normal tree, so that
+block will have its lockdep key set to the tree reloc root, and create a
+lockdep splat later on when we wander into that block from the fs root.
+
+Unfortunately the only solution here is to make sure we do not set the
+lockdep key to the reloc tree lockdep key normally, and then reset any
+blocks we wander into from the reloc root when we're doing the merged.
+
+This solves the problem of having mixed tree reloc keys intermixed with
+normal tree keys, and then allows us to make sure in the merge case we
+maintain the lock order of
+
+  normal tree -> reloc tree
+
+We handle this by setting a bit on the reloc root when we do the search
+for the block we want to relocate, and any block we search into or COW
+at that point gets set to the reloc tree key.  This works correctly
+because we only ever COW down to the parent node, so we aren't resetting
+the key for the block we're linking into the fs root.
+
+With this patch we no longer have the lockdep splat in btrfs/187.
+
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/ctree.c       |  3 +++
+ fs/btrfs/ctree.h       |  2 ++
+ fs/btrfs/extent-tree.c | 18 +++++++++++++++++-
+ fs/btrfs/extent_io.c   | 11 ++++++++++-
+ fs/btrfs/locking.c     | 11 +++++++++++
+ fs/btrfs/locking.h     |  5 +++++
+ fs/btrfs/relocation.c  |  2 ++
+ 7 files changed, 50 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index 6e556031a8f3..ebfa35fe1c38 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -2075,6 +2075,9 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root *root,
+ 
+ 		if (!p->skip_locking) {
+ 			level = btrfs_header_level(b);
++
++			btrfs_maybe_reset_lockdep_class(root, b);
++
+ 			if (level <= write_lock_level) {
+ 				btrfs_tree_lock(b);
+ 				p->locks[level] = BTRFS_WRITE_LOCK;
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index 7d3ca3ea0bce..4d8acd7e63eb 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -1146,6 +1146,8 @@ enum {
+ 	BTRFS_ROOT_ORPHAN_CLEANUP,
+ 	/* This root has a drop operation that was started previously. */
+ 	BTRFS_ROOT_UNFINISHED_DROP,
++	/* This reloc root needs to have its buffers lockdep class reset. */
++	BTRFS_ROOT_RESET_LOCKDEP_CLASS,
+ };
+ 
+ static inline void btrfs_wake_unfinished_drop(struct btrfs_fs_info *fs_info)
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index ced3fc76063f..92f3f5ed8bf1 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -4871,6 +4871,7 @@ btrfs_init_new_buffer(struct btrfs_trans_handle *trans, struct btrfs_root *root,
+ {
+ 	struct btrfs_fs_info *fs_info = root->fs_info;
+ 	struct extent_buffer *buf;
++	u64 lockdep_owner = owner;
+ 
+ 	buf = btrfs_find_create_tree_block(fs_info, bytenr, owner, level);
+ 	if (IS_ERR(buf))
+@@ -4889,12 +4890,27 @@ btrfs_init_new_buffer(struct btrfs_trans_handle *trans, struct btrfs_root *root,
+ 		return ERR_PTR(-EUCLEAN);
+ 	}
+ 
++	/*
++	 * The reloc trees are just snapshots, so we need them to appear to be
++	 * just like any other fs tree WRT lockdep.
++	 *
++	 * The exception however is in replace_path() in relocation, where we
++	 * hold the lock on the original fs root and then search for the reloc
++	 * root.  At that point we need to make sure any reloc root buffers are
++	 * set to the BTRFS_TREE_RELOC_OBJECTID lockdep class in order to make
++	 * lockdep happy.
++	 */
++	if (lockdep_owner == BTRFS_TREE_RELOC_OBJECTID &&
++	    !test_bit(BTRFS_ROOT_RESET_LOCKDEP_CLASS, &root->state))
++		lockdep_owner = BTRFS_FS_TREE_OBJECTID;
++
+ 	/*
+ 	 * This needs to stay, because we could allocate a freed block from an
+ 	 * old tree into a new tree, so we need to make sure this new block is
+ 	 * set to the appropriate level and owner.
+ 	 */
+-	btrfs_set_buffer_lockdep_class(owner, buf, level);
++	btrfs_set_buffer_lockdep_class(lockdep_owner, buf, level);
++
+ 	__btrfs_tree_lock(buf, nest);
+ 	btrfs_clean_tree_block(buf);
+ 	clear_bit(EXTENT_BUFFER_STALE, &buf->bflags);
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index cda25018ebd7..5785ed241f6f 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -6228,6 +6228,7 @@ struct extent_buffer *alloc_extent_buffer(struct btrfs_fs_info *fs_info,
+ 	struct extent_buffer *exists = NULL;
+ 	struct page *p;
+ 	struct address_space *mapping = fs_info->btree_inode->i_mapping;
++	u64 lockdep_owner = owner_root;
+ 	int uptodate = 1;
+ 	int ret;
+ 
+@@ -6252,7 +6253,15 @@ struct extent_buffer *alloc_extent_buffer(struct btrfs_fs_info *fs_info,
+ 	eb = __alloc_extent_buffer(fs_info, start, len);
+ 	if (!eb)
+ 		return ERR_PTR(-ENOMEM);
+-	btrfs_set_buffer_lockdep_class(owner_root, eb, level);
++
++	/*
++	 * The reloc trees are just snapshots, so we need them to appear to be
++	 * just like any other fs tree WRT lockdep.
++	 */
++	if (lockdep_owner == BTRFS_TREE_RELOC_OBJECTID)
++		lockdep_owner = BTRFS_FS_TREE_OBJECTID;
++
++	btrfs_set_buffer_lockdep_class(lockdep_owner, eb, level);
+ 
+ 	num_pages = num_extent_pages(eb);
+ 	for (i = 0; i < num_pages; i++, index++) {
+diff --git a/fs/btrfs/locking.c b/fs/btrfs/locking.c
+index 5747c63929df..9063072b399b 100644
+--- a/fs/btrfs/locking.c
++++ b/fs/btrfs/locking.c
+@@ -91,6 +91,13 @@ void btrfs_set_buffer_lockdep_class(u64 objectid, struct extent_buffer *eb, int
+ 	lockdep_set_class_and_name(&eb->lock, &ks->keys[level], ks->names[level]);
+ }
+ 
++void btrfs_maybe_reset_lockdep_class(struct btrfs_root *root, struct extent_buffer *eb)
++{
++	if (test_bit(BTRFS_ROOT_RESET_LOCKDEP_CLASS, &root->state))
++		btrfs_set_buffer_lockdep_class(root->root_key.objectid,
++					       eb, btrfs_header_level(eb));
++}
++
+ #endif
+ 
+ /*
+@@ -244,6 +251,8 @@ struct extent_buffer *btrfs_lock_root_node(struct btrfs_root *root)
+ 
+ 	while (1) {
+ 		eb = btrfs_root_node(root);
++
++		btrfs_maybe_reset_lockdep_class(root, eb);
+ 		btrfs_tree_lock(eb);
+ 		if (eb == root->node)
+ 			break;
+@@ -265,6 +274,8 @@ struct extent_buffer *btrfs_read_lock_root_node(struct btrfs_root *root)
+ 
+ 	while (1) {
+ 		eb = btrfs_root_node(root);
++
++		btrfs_maybe_reset_lockdep_class(root, eb);
+ 		btrfs_tree_read_lock(eb);
+ 		if (eb == root->node)
+ 			break;
+diff --git a/fs/btrfs/locking.h b/fs/btrfs/locking.h
+index b21372cab840..ab268be09bb5 100644
+--- a/fs/btrfs/locking.h
++++ b/fs/btrfs/locking.h
+@@ -133,11 +133,16 @@ void btrfs_drew_read_unlock(struct btrfs_drew_lock *lock);
+ 
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+ void btrfs_set_buffer_lockdep_class(u64 objectid, struct extent_buffer *eb, int level);
++void btrfs_maybe_reset_lockdep_class(struct btrfs_root *root, struct extent_buffer *eb);
+ #else
+ static inline void btrfs_set_buffer_lockdep_class(u64 objectid,
+ 					struct extent_buffer *eb, int level)
+ {
+ }
++static inline void btrfs_maybe_reset_lockdep_class(struct btrfs_root *root,
++						   struct extent_buffer *eb)
++{
++}
+ #endif
+ 
+ #endif
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index 33411baf5c7a..45c02aba2492 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -1326,7 +1326,9 @@ int replace_path(struct btrfs_trans_handle *trans, struct reloc_control *rc,
+ 		btrfs_release_path(path);
+ 
+ 		path->lowest_level = level;
++		set_bit(BTRFS_ROOT_RESET_LOCKDEP_CLASS, &src->state);
+ 		ret = btrfs_search_slot(trans, src, &key, path, 0, 1);
++		clear_bit(BTRFS_ROOT_RESET_LOCKDEP_CLASS, &src->state);
+ 		path->lowest_level = 0;
+ 		if (ret) {
+ 			if (ret > 0)
+-- 
+2.37.3
+
diff --git a/0068-btrfs-tree-checker-check-for-overlapping-extent-item.patch b/0068-btrfs-tree-checker-check-for-overlapping-extent-item.patch
new file mode 100644
index 000000000000..26afc28bb264
--- /dev/null
+++ b/0068-btrfs-tree-checker-check-for-overlapping-extent-item.patch
@@ -0,0 +1,75 @@
+From 8a239dd886e25d03bb2581c8ab30e8a1a12446b1 Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Date: Wed, 3 Aug 2022 14:28:47 -0400
+Subject: [PATCH 68/73] btrfs: tree-checker: check for overlapping extent items
+
+[ Upstream commit 899b7f69f244e539ea5df1b4d756046337de44a5 ]
+
+We're seeing a weird problem in production where we have overlapping
+extent items in the extent tree.  It's unclear where these are coming
+from, and in debugging we realized there's no check in the tree checker
+for this sort of problem.  Add a check to the tree-checker to make sure
+that the extents do not overlap each other.
+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/tree-checker.c | 25 +++++++++++++++++++++++--
+ 1 file changed, 23 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
+index 9e0e0ae2288c..43f905ab0a18 100644
+--- a/fs/btrfs/tree-checker.c
++++ b/fs/btrfs/tree-checker.c
+@@ -1233,7 +1233,8 @@ static void extent_err(const struct extent_buffer *eb, int slot,
+ }
+ 
+ static int check_extent_item(struct extent_buffer *leaf,
+-			     struct btrfs_key *key, int slot)
++			     struct btrfs_key *key, int slot,
++			     struct btrfs_key *prev_key)
+ {
+ 	struct btrfs_fs_info *fs_info = leaf->fs_info;
+ 	struct btrfs_extent_item *ei;
+@@ -1453,6 +1454,26 @@ static int check_extent_item(struct extent_buffer *leaf,
+ 			   total_refs, inline_refs);
+ 		return -EUCLEAN;
+ 	}
++
++	if ((prev_key->type == BTRFS_EXTENT_ITEM_KEY) ||
++	    (prev_key->type == BTRFS_METADATA_ITEM_KEY)) {
++		u64 prev_end = prev_key->objectid;
++
++		if (prev_key->type == BTRFS_METADATA_ITEM_KEY)
++			prev_end += fs_info->nodesize;
++		else
++			prev_end += prev_key->offset;
++
++		if (unlikely(prev_end > key->objectid)) {
++			extent_err(leaf, slot,
++	"previous extent [%llu %u %llu] overlaps current extent [%llu %u %llu]",
++				   prev_key->objectid, prev_key->type,
++				   prev_key->offset, key->objectid, key->type,
++				   key->offset);
++			return -EUCLEAN;
++		}
++	}
++
+ 	return 0;
+ }
+ 
+@@ -1621,7 +1642,7 @@ static int check_leaf_item(struct extent_buffer *leaf,
+ 		break;
+ 	case BTRFS_EXTENT_ITEM_KEY:
+ 	case BTRFS_METADATA_ITEM_KEY:
+-		ret = check_extent_item(leaf, key, slot);
++		ret = check_extent_item(leaf, key, slot, prev_key);
+ 		break;
+ 	case BTRFS_TREE_BLOCK_REF_KEY:
+ 	case BTRFS_SHARED_DATA_REF_KEY:
+-- 
+2.37.3
+
diff --git a/0069-android-binder-fix-lockdep-check-on-clearing-vma.patch b/0069-android-binder-fix-lockdep-check-on-clearing-vma.patch
new file mode 100644
index 000000000000..175dbc128735
--- /dev/null
+++ b/0069-android-binder-fix-lockdep-check-on-clearing-vma.patch
@@ -0,0 +1,63 @@
+From d25d6744c46b8289d61180bafb30f3140fef24a4 Mon Sep 17 00:00:00 2001
+From: Liam Howlett <liam.howlett@oracle.com>
+Date: Mon, 27 Jun 2022 15:18:59 +0000
+Subject: [PATCH 69/73] android: binder: fix lockdep check on clearing vma
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit b0cab80ecd54ae3b2356bb081af0bffd538c8265 upstream.
+
+When munmapping a vma, the mmap_lock can be degraded to a write before
+calling close() on the file handle.  The binder close() function calls
+binder_alloc_set_vma() to clear the vma address, which now has a lock dep
+check for writing on the mmap_lock.  Change the lockdep check to ensure
+the reading lock is held while clearing and keep the write check while
+writing.
+
+Link: https://lkml.kernel.org/r/20220627151857.2316964-1-Liam.Howlett@oracle.com
+Fixes: 472a68df605b ("android: binder: stop saving a pointer to the VMA")
+Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>
+Reported-by: syzbot+da54fa8d793ca89c741f@syzkaller.appspotmail.com
+Acked-by: Todd Kjos <tkjos@google.com>
+Cc: "Arve Hjønnevåg" <arve@android.com>
+Cc: Christian Brauner (Microsoft) <brauner@kernel.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Hridya Valsaraju <hridya@google.com>
+Cc: Joel Fernandes <joel@joelfernandes.org>
+Cc: Martijn Coenen <maco@android.com>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/android/binder_alloc.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
+index 7981a2598376..5d437c0c842c 100644
+--- a/drivers/android/binder_alloc.c
++++ b/drivers/android/binder_alloc.c
+@@ -315,12 +315,19 @@ static inline void binder_alloc_set_vma(struct binder_alloc *alloc,
+ {
+ 	unsigned long vm_start = 0;
+ 
++	/*
++	 * Allow clearing the vma with holding just the read lock to allow
++	 * munmapping downgrade of the write lock before freeing and closing the
++	 * file using binder_alloc_vma_close().
++	 */
+ 	if (vma) {
+ 		vm_start = vma->vm_start;
+ 		alloc->vma_vm_mm = vma->vm_mm;
++		mmap_assert_write_locked(alloc->vma_vm_mm);
++	} else {
++		mmap_assert_locked(alloc->vma_vm_mm);
+ 	}
+ 
+-	mmap_assert_write_locked(alloc->vma_vm_mm);
+ 	alloc->vma_addr = vm_start;
+ }
+ 
+-- 
+2.37.3
+
diff --git a/0070-net-af_packet-check-len-when-min_header_len-equals-t.patch b/0070-net-af_packet-check-len-when-min_header_len-equals-t.patch
new file mode 100644
index 000000000000..3fca7bfd275d
--- /dev/null
+++ b/0070-net-af_packet-check-len-when-min_header_len-equals-t.patch
@@ -0,0 +1,39 @@
+From ec274d8f1e649b12530bbba3f01478e20bf8bc23 Mon Sep 17 00:00:00 2001
+From: Zhengchao Shao <shaozhengchao@huawei.com>
+Date: Wed, 27 Jul 2022 17:33:12 +0800
+Subject: [PATCH 70/73] net/af_packet: check len when min_header_len equals to
+ 0
+
+commit dc633700f00f726e027846a318c5ffeb8deaaeda upstream.
+
+User can use AF_PACKET socket to send packets with the length of 0.
+When min_header_len equals to 0, packet_snd will call __dev_queue_xmit
+to send packets, and sock->type can be any type.
+
+Reported-by: syzbot+5ea725c25d06fb9114c4@syzkaller.appspotmail.com
+Fixes: fd1894224407 ("bpf: Don't redirect packets with invalid pkt_len")
+Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/packet/af_packet.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index ca6e92a22923..492bd35cccc0 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3037,8 +3037,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
+ 	if (err)
+ 		goto out_free;
+ 
+-	if (sock->type == SOCK_RAW &&
+-	    !dev_validate_header(dev, skb->data, len)) {
++	if ((sock->type == SOCK_RAW &&
++	     !dev_validate_header(dev, skb->data, len)) || !skb->len) {
+ 		err = -EINVAL;
+ 		goto out_free;
+ 	}
+-- 
+2.37.3
+
diff --git a/0071-net-neigh-don-t-call-kfree_skb-under-spin_lock_irqsa.patch b/0071-net-neigh-don-t-call-kfree_skb-under-spin_lock_irqsa.patch
new file mode 100644
index 000000000000..91d931e50697
--- /dev/null
+++ b/0071-net-neigh-don-t-call-kfree_skb-under-spin_lock_irqsa.patch
@@ -0,0 +1,60 @@
+From 123bf15c1a15f8dc7b5aceb5186bed37f2e80af5 Mon Sep 17 00:00:00 2001
+From: Yang Yingliang <yangyingliang@huawei.com>
+Date: Mon, 22 Aug 2022 10:53:46 +0800
+Subject: [PATCH 71/73] net: neigh: don't call kfree_skb() under
+ spin_lock_irqsave()
+
+commit d5485d9dd24e1d04e5509916515260186eb1455c upstream.
+
+It is not allowed to call kfree_skb() from hardware interrupt
+context or with interrupts being disabled. So add all skb to
+a tmp list, then free them after spin_unlock_irqrestore() at
+once.
+
+Fixes: 66ba215cb513 ("neigh: fix possible DoS due to net iface start/stop loop")
+Suggested-by: Denis V. Lunev <den@openvz.org>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/neighbour.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 19d99d1eff53..fbaa557ed7ec 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -309,21 +309,27 @@ static int neigh_del_timer(struct neighbour *n)
+ 
+ static void pneigh_queue_purge(struct sk_buff_head *list, struct net *net)
+ {
++	struct sk_buff_head tmp;
+ 	unsigned long flags;
+ 	struct sk_buff *skb;
+ 
++	skb_queue_head_init(&tmp);
+ 	spin_lock_irqsave(&list->lock, flags);
+ 	skb = skb_peek(list);
+ 	while (skb != NULL) {
+ 		struct sk_buff *skb_next = skb_peek_next(skb, list);
+ 		if (net == NULL || net_eq(dev_net(skb->dev), net)) {
+ 			__skb_unlink(skb, list);
+-			dev_put(skb->dev);
+-			kfree_skb(skb);
++			__skb_queue_tail(&tmp, skb);
+ 		}
+ 		skb = skb_next;
+ 	}
+ 	spin_unlock_irqrestore(&list->lock, flags);
++
++	while ((skb = __skb_dequeue(&tmp))) {
++		dev_put(skb->dev);
++		kfree_skb(skb);
++	}
+ }
+ 
+ static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev,
+-- 
+2.37.3
+
diff --git a/0072-arm64-cacheinfo-Fix-incorrect-assignment-of-signed-e.patch b/0072-arm64-cacheinfo-Fix-incorrect-assignment-of-signed-e.patch
new file mode 100644
index 000000000000..89ceb0132ccd
--- /dev/null
+++ b/0072-arm64-cacheinfo-Fix-incorrect-assignment-of-signed-e.patch
@@ -0,0 +1,80 @@
+From a754ee1c66bd0a23e613f0bf865053b29cb90e16 Mon Sep 17 00:00:00 2001
+From: Sudeep Holla <sudeep.holla@arm.com>
+Date: Mon, 8 Aug 2022 09:46:40 +0100
+Subject: [PATCH 72/73] arm64: cacheinfo: Fix incorrect assignment of signed
+ error value to unsigned fw_level
+
+commit e75d18cecbb3805895d8ed64da4f78575ec96043 upstream.
+
+Though acpi_find_last_cache_level() always returned signed value and the
+document states it will return any errors caused by lack of a PPTT table,
+it never returned negative values before.
+
+Commit 0c80f9e165f8 ("ACPI: PPTT: Leave the table mapped for the runtime usage")
+however changed it by returning -ENOENT if no PPTT was found. The value
+returned from acpi_find_last_cache_level() is then assigned to unsigned
+fw_level.
+
+It will result in the number of cache leaves calculated incorrectly as
+a huge value which will then cause the following warning from __alloc_pages
+as the order would be great than MAX_ORDER because of incorrect and huge
+cache leaves value.
+
+  |  WARNING: CPU: 0 PID: 1 at mm/page_alloc.c:5407 __alloc_pages+0x74/0x314
+  |  Modules linked in:
+  |  CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-10393-g7c2a8d3ac4c0 #73
+  |  pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+  |  pc : __alloc_pages+0x74/0x314
+  |  lr : alloc_pages+0xe8/0x318
+  |  Call trace:
+  |   __alloc_pages+0x74/0x314
+  |   alloc_pages+0xe8/0x318
+  |   kmalloc_order_trace+0x68/0x1dc
+  |   __kmalloc+0x240/0x338
+  |   detect_cache_attributes+0xe0/0x56c
+  |   update_siblings_masks+0x38/0x284
+  |   store_cpu_topology+0x78/0x84
+  |   smp_prepare_cpus+0x48/0x134
+  |   kernel_init_freeable+0xc4/0x14c
+  |   kernel_init+0x2c/0x1b4
+  |   ret_from_fork+0x10/0x20
+
+Fix the same by changing fw_level to be signed integer and return the
+error from init_cache_level() early in case of error.
+
+Reported-and-Tested-by: Bruno Goncalves <bgoncalv@redhat.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Link: https://lore.kernel.org/r/20220808084640.3165368-1-sudeep.holla@arm.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kernel/cacheinfo.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c
+index 587543c6c51c..97c42be71338 100644
+--- a/arch/arm64/kernel/cacheinfo.c
++++ b/arch/arm64/kernel/cacheinfo.c
+@@ -45,7 +45,8 @@ static void ci_leaf_init(struct cacheinfo *this_leaf,
+ 
+ int init_cache_level(unsigned int cpu)
+ {
+-	unsigned int ctype, level, leaves, fw_level;
++	unsigned int ctype, level, leaves;
++	int fw_level;
+ 	struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
+ 
+ 	for (level = 1, leaves = 0; level <= MAX_CACHE_LEVEL; level++) {
+@@ -63,6 +64,9 @@ int init_cache_level(unsigned int cpu)
+ 	else
+ 		fw_level = acpi_find_last_cache_level(cpu);
+ 
++	if (fw_level < 0)
++		return fw_level;
++
+ 	if (level < fw_level) {
+ 		/*
+ 		 * some external caches not specified in CLIDR_EL1
+-- 
+2.37.3
+
diff --git a/PKGBUILD b/PKGBUILD
index 0d2373efcafc..cfe8e108a7d8 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -62,8 +62,8 @@ _minor=19
 _basekernel=${_major}.${_minor}
 _srcname=linux-pf
 pkgbase=linux-pf
-_unpatched_sublevel=1
-_pfrel=2
+_unpatched_sublevel=7
+_pfrel=3
 _kernelname=pf
 _projectcpatchname=prjc_v5.15-r1.patch
 _CPUSUFFIXES_KBUILD=(
@@ -124,8 +124,80 @@ source=("linux-pf::git+https://codeberg.org/pf-kernel/linux.git#tag=v${_major}.$
         0028-ZEN-INTERACTIVE-mm-Disable-proactive-compaction-by-d.patch
         0029-ZEN-INTERACTIVE-dm-crypt-Disable-workqueues-for-cryp.patch
         # ZEN END
-        # https://bugzilla.kernel.org/show_bug.cgi?id=211005
-        'asus_zenith_ii_map.patch::https://bugzilla.kernel.org/attachment.cgi?id=294489'
+        # 5.19.7
+        0001-drm-vc4-hdmi-Rework-power-up.patch
+        0002-drm-vc4-hdmi-Depends-on-CONFIG_PM.patch
+        0003-firmware-tegra-bpmp-Do-only-aligned-access-to-IPC-me.patch
+        0004-crypto-lib-remove-unneeded-selection-of-XOR_BLOCKS.patch
+        0005-docs-kerneldoc-preamble-Test-xeCJK.sty-before-loadin.patch
+        0006-arm64-errata-Add-Cortex-A510-to-the-repeat-tlbi-list.patch
+        0007-Bluetooth-L2CAP-Fix-build-errors-in-some-archs.patch
+        0008-Revert-PCI-portdrv-Don-t-disable-AER-reporting-in-ge.patch
+        0009-HID-steam-Prevent-NULL-pointer-dereference-in-steam_.patch
+        0010-udmabuf-Set-the-DMA-mask-for-the-udmabuf-device-v2.patch
+        0011-media-pvrusb2-fix-memory-leak-in-pvr_probe.patch
+        0012-USB-gadget-Fix-use-after-free-Read-in-usb_udc_uevent.patch
+        0013-HID-hidraw-fix-memory-leak-in-hidraw_release.patch
+        0014-net-fix-refcount-bug-in-sk_psock_get-2.patch
+        0015-fbdev-fb_pm2fb-Avoid-potential-divide-by-zero-error.patch
+        0016-ftrace-Fix-NULL-pointer-dereference-in-is_ftrace_tra.patch
+        0017-bpf-Don-t-redirect-packets-with-invalid-pkt_len.patch
+        0018-mm-rmap-Fix-anon_vma-degree-ambiguity-leading-to-dou.patch
+        0019-ALSA-usb-audio-Add-quirk-for-LH-Labs-Geek-Out-HD-Aud.patch
+        0020-HID-input-fix-uclogic-tablets.patch
+        0021-HID-add-Lenovo-Yoga-C630-battery-quirk.patch
+        0022-HID-AMD_SFH-Add-a-DMI-quirk-entry-for-Chromebooks.patch
+        0023-HID-Add-Apple-Touchbar-on-T2-Macs-in-hid_have_specia.patch
+        0024-HID-asus-ROG-NKey-Ignore-portion-of-0x5a-report.patch
+        0025-HID-nintendo-fix-rumble-worker-null-pointer-deref.patch
+        0026-HID-thrustmaster-Add-sparco-wheel-and-fix-array-leng.patch
+        0027-HID-intel-ish-hid-ipc-Add-Meteor-Lake-PCI-device-ID.patch
+        0028-mmc-mtk-sd-Clear-interrupts-when-cqe-off-disable.patch
+        0029-mmc-sdhci-of-dwcmshc-add-reset-call-back-for-rockchi.patch
+        0030-mmc-sdhci-of-dwcmshc-rename-rk3568-to-rk35xx.patch
+        0031-mmc-sdhci-of-dwcmshc-Re-enable-support-for-the-BlueF.patch
+        0032-fs-ntfs3-Fix-work-with-fragmented-xattr.patch
+        0033-ASoC-sh-rz-ssi-Improve-error-handling-in-rz_ssi_prob.patch
+        0034-ASoC-rt5640-Fix-the-JD-voltage-dropping-issue.patch
+        0035-rtla-Fix-tracer-name.patch
+        0036-drm-amd-display-Add-a-missing-register-field-for-HPO.patch
+        0037-drm-amd-display-Device-flash-garbage-before-get-in-O.patch
+        0038-drm-amd-display-Avoid-MPC-infinite-loop.patch
+        0039-drm-amd-display-Fix-HDMI-VSIF-V3-incorrect-issue.patch
+        0040-drm-amd-display-For-stereo-keep-FLIP_ANY_FRAME.patch
+        0041-drm-amd-display-clear-optc-underflow-before-turn-off.patch
+        0042-drm-amd-display-Fix-TDR-eDP-and-USB4-display-light-u.patch
+        0043-drm-amd-pm-skip-pptable-override-for-smu_v13_0_7.patch
+        0044-drm-amdkfd-Handle-restart-of-kfd_ioctl_wait_events.patch
+        0045-drm-amd-pm-Fix-a-potential-gpu_metrics_table-memory-.patch
+        0046-ksmbd-return-STATUS_BAD_NETWORK_NAME-error-status-if.patch
+        0047-net-lan966x-fix-checking-for-return-value-of-platfor.patch
+        0048-neigh-fix-possible-DoS-due-to-net-iface-start-stop-l.patch
+        0049-ALSA-hda-realtek-Add-quirks-for-ASUS-Zenbooks-using-.patch
+        0050-s390-hypfs-avoid-error-message-under-KVM.patch
+        0051-ksmbd-don-t-remove-dos-attribute-xattr-on-O_TRUNC-op.patch
+        0052-drm-amdgpu-disable-3DCGCG-CGLS-temporarily-due-to-st.patch
+        0053-drm-amd-pm-add-missing-fini_microcode-interface-for-.patch
+        0054-drm-amd-pm-add-missing-fini_xxxx-interfaces-for-some.patch
+        0055-drm-amd-display-Fix-pixel-clock-programming.patch
+        0056-drm-amdgpu-Increase-tlb-flush-timeout-for-sriov.patch
+        0057-drm-amd-display-Fix-plug-unplug-external-monitor-wil.patch
+        0058-drm-amd-display-avoid-doing-vm_init-multiple-time.patch
+        0059-drm-amdgpu-Add-decode_iv_ts-helper-for-ih_v6-block.patch
+        0060-drm-amdgpu-Add-secure-display-TA-load-for-Renoir.patch
+        0061-drm-amdgpu-Fix-interrupt-handling-on-ih_soft-ring.patch
+        0062-netfilter-conntrack-NF_CONNTRACK_PROCFS-should-no-lo.patch
+        0063-testing-selftests-nft_flowtable.sh-use-random-netns-.patch
+        0064-platform-x86-serial-multi-instantiate-Add-CLSA0101-L.patch
+        0065-ALSA-hda-cs8409-Support-new-Dolphin-Variants.patch
+        0066-btrfs-move-lockdep-class-helpers-to-locking.c.patch
+        0067-btrfs-fix-lockdep-splat-with-reloc-root-extent-buffe.patch
+        0068-btrfs-tree-checker-check-for-overlapping-extent-item.patch
+        0069-android-binder-fix-lockdep-check-on-clearing-vma.patch
+        0070-net-af_packet-check-len-when-min_header_len-equals-t.patch
+        0071-net-neigh-don-t-call-kfree_skb-under-spin_lock_irqsa.patch
+        0072-arm64-cacheinfo-Fix-incorrect-assignment-of-signed-e.patch
+        # 5.19.7 END
        )
 # 	'cx23885_move_CI_AC_registration_to_a_separate_function.patch'
 
@@ -166,9 +238,80 @@ prepare() {
   patch -p1 -i ${srcdir}/0028-ZEN-INTERACTIVE-mm-Disable-proactive-compaction-by-d.patch
   patch -p1 -i ${srcdir}/0029-ZEN-INTERACTIVE-dm-crypt-Disable-workqueues-for-cryp.patch
 
-
-  # Add port map for ASUS Zenith II
-  patch -p1 -i ${srcdir}/asus_zenith_ii_map.patch
+  # 5.19.7
+  patch -p1 -i ${srcdir}/0001-drm-vc4-hdmi-Rework-power-up.patch
+  patch -p1 -i ${srcdir}/0002-drm-vc4-hdmi-Depends-on-CONFIG_PM.patch
+  patch -p1 -i ${srcdir}/0003-firmware-tegra-bpmp-Do-only-aligned-access-to-IPC-me.patch
+  patch -p1 -i ${srcdir}/0004-crypto-lib-remove-unneeded-selection-of-XOR_BLOCKS.patch
+  patch -p1 -i ${srcdir}/0005-docs-kerneldoc-preamble-Test-xeCJK.sty-before-loadin.patch
+  patch -p1 -i ${srcdir}/0006-arm64-errata-Add-Cortex-A510-to-the-repeat-tlbi-list.patch
+  patch -p1 -i ${srcdir}/0007-Bluetooth-L2CAP-Fix-build-errors-in-some-archs.patch
+  patch -p1 -i ${srcdir}/0008-Revert-PCI-portdrv-Don-t-disable-AER-reporting-in-ge.patch
+  patch -p1 -i ${srcdir}/0009-HID-steam-Prevent-NULL-pointer-dereference-in-steam_.patch
+  patch -p1 -i ${srcdir}/0010-udmabuf-Set-the-DMA-mask-for-the-udmabuf-device-v2.patch
+  patch -p1 -i ${srcdir}/0011-media-pvrusb2-fix-memory-leak-in-pvr_probe.patch
+  patch -p1 -i ${srcdir}/0012-USB-gadget-Fix-use-after-free-Read-in-usb_udc_uevent.patch
+  patch -p1 -i ${srcdir}/0013-HID-hidraw-fix-memory-leak-in-hidraw_release.patch
+  patch -p1 -i ${srcdir}/0014-net-fix-refcount-bug-in-sk_psock_get-2.patch
+  patch -p1 -i ${srcdir}/0015-fbdev-fb_pm2fb-Avoid-potential-divide-by-zero-error.patch
+  patch -p1 -i ${srcdir}/0016-ftrace-Fix-NULL-pointer-dereference-in-is_ftrace_tra.patch
+  patch -p1 -i ${srcdir}/0017-bpf-Don-t-redirect-packets-with-invalid-pkt_len.patch
+  patch -p1 -i ${srcdir}/0018-mm-rmap-Fix-anon_vma-degree-ambiguity-leading-to-dou.patch
+  patch -p1 -i ${srcdir}/0019-ALSA-usb-audio-Add-quirk-for-LH-Labs-Geek-Out-HD-Aud.patch
+  patch -p1 -i ${srcdir}/0020-HID-input-fix-uclogic-tablets.patch
+  patch -p1 -i ${srcdir}/0021-HID-add-Lenovo-Yoga-C630-battery-quirk.patch
+  patch -p1 -i ${srcdir}/0022-HID-AMD_SFH-Add-a-DMI-quirk-entry-for-Chromebooks.patch
+  patch -p1 -i ${srcdir}/0023-HID-Add-Apple-Touchbar-on-T2-Macs-in-hid_have_specia.patch
+  patch -p1 -i ${srcdir}/0024-HID-asus-ROG-NKey-Ignore-portion-of-0x5a-report.patch
+  patch -p1 -i ${srcdir}/0025-HID-nintendo-fix-rumble-worker-null-pointer-deref.patch
+  patch -p1 -i ${srcdir}/0026-HID-thrustmaster-Add-sparco-wheel-and-fix-array-leng.patch
+  patch -p1 -i ${srcdir}/0027-HID-intel-ish-hid-ipc-Add-Meteor-Lake-PCI-device-ID.patch
+  patch -p1 -i ${srcdir}/0028-mmc-mtk-sd-Clear-interrupts-when-cqe-off-disable.patch
+  patch -p1 -i ${srcdir}/0029-mmc-sdhci-of-dwcmshc-add-reset-call-back-for-rockchi.patch
+  patch -p1 -i ${srcdir}/0030-mmc-sdhci-of-dwcmshc-rename-rk3568-to-rk35xx.patch
+  patch -p1 -i ${srcdir}/0031-mmc-sdhci-of-dwcmshc-Re-enable-support-for-the-BlueF.patch
+  patch -p1 -i ${srcdir}/0032-fs-ntfs3-Fix-work-with-fragmented-xattr.patch
+  patch -p1 -i ${srcdir}/0033-ASoC-sh-rz-ssi-Improve-error-handling-in-rz_ssi_prob.patch
+  patch -p1 -i ${srcdir}/0034-ASoC-rt5640-Fix-the-JD-voltage-dropping-issue.patch
+  patch -p1 -i ${srcdir}/0035-rtla-Fix-tracer-name.patch
+  patch -p1 -i ${srcdir}/0036-drm-amd-display-Add-a-missing-register-field-for-HPO.patch
+  patch -p1 -i ${srcdir}/0037-drm-amd-display-Device-flash-garbage-before-get-in-O.patch
+  patch -p1 -i ${srcdir}/0038-drm-amd-display-Avoid-MPC-infinite-loop.patch
+  patch -p1 -i ${srcdir}/0039-drm-amd-display-Fix-HDMI-VSIF-V3-incorrect-issue.patch
+  patch -p1 -i ${srcdir}/0040-drm-amd-display-For-stereo-keep-FLIP_ANY_FRAME.patch
+  patch -p1 -i ${srcdir}/0041-drm-amd-display-clear-optc-underflow-before-turn-off.patch
+  patch -p1 -i ${srcdir}/0042-drm-amd-display-Fix-TDR-eDP-and-USB4-display-light-u.patch
+  patch -p1 -i ${srcdir}/0043-drm-amd-pm-skip-pptable-override-for-smu_v13_0_7.patch
+  patch -p1 -i ${srcdir}/0044-drm-amdkfd-Handle-restart-of-kfd_ioctl_wait_events.patch
+  patch -p1 -i ${srcdir}/0045-drm-amd-pm-Fix-a-potential-gpu_metrics_table-memory-.patch
+  patch -p1 -i ${srcdir}/0046-ksmbd-return-STATUS_BAD_NETWORK_NAME-error-status-if.patch
+  patch -p1 -i ${srcdir}/0047-net-lan966x-fix-checking-for-return-value-of-platfor.patch
+  patch -p1 -i ${srcdir}/0048-neigh-fix-possible-DoS-due-to-net-iface-start-stop-l.patch
+  patch -p1 -i ${srcdir}/0049-ALSA-hda-realtek-Add-quirks-for-ASUS-Zenbooks-using-.patch
+  patch -p1 -i ${srcdir}/0050-s390-hypfs-avoid-error-message-under-KVM.patch
+  patch -p1 -i ${srcdir}/0051-ksmbd-don-t-remove-dos-attribute-xattr-on-O_TRUNC-op.patch
+  patch -p1 -i ${srcdir}/0052-drm-amdgpu-disable-3DCGCG-CGLS-temporarily-due-to-st.patch
+  patch -p1 -i ${srcdir}/0053-drm-amd-pm-add-missing-fini_microcode-interface-for-.patch
+  patch -p1 -i ${srcdir}/0054-drm-amd-pm-add-missing-fini_xxxx-interfaces-for-some.patch
+  patch -p1 -i ${srcdir}/0055-drm-amd-display-Fix-pixel-clock-programming.patch
+  patch -p1 -i ${srcdir}/0056-drm-amdgpu-Increase-tlb-flush-timeout-for-sriov.patch
+  patch -p1 -i ${srcdir}/0057-drm-amd-display-Fix-plug-unplug-external-monitor-wil.patch
+  patch -p1 -i ${srcdir}/0058-drm-amd-display-avoid-doing-vm_init-multiple-time.patch
+  patch -p1 -i ${srcdir}/0059-drm-amdgpu-Add-decode_iv_ts-helper-for-ih_v6-block.patch
+  patch -p1 -i ${srcdir}/0060-drm-amdgpu-Add-secure-display-TA-load-for-Renoir.patch
+  patch -p1 -i ${srcdir}/0061-drm-amdgpu-Fix-interrupt-handling-on-ih_soft-ring.patch
+  patch -p1 -i ${srcdir}/0062-netfilter-conntrack-NF_CONNTRACK_PROCFS-should-no-lo.patch
+  patch -p1 -i ${srcdir}/0063-testing-selftests-nft_flowtable.sh-use-random-netns-.patch
+  patch -p1 -i ${srcdir}/0064-platform-x86-serial-multi-instantiate-Add-CLSA0101-L.patch
+  patch -p1 -i ${srcdir}/0065-ALSA-hda-cs8409-Support-new-Dolphin-Variants.patch
+  patch -p1 -i ${srcdir}/0066-btrfs-move-lockdep-class-helpers-to-locking.c.patch
+  patch -p1 -i ${srcdir}/0067-btrfs-fix-lockdep-splat-with-reloc-root-extent-buffe.patch
+  patch -p1 -i ${srcdir}/0068-btrfs-tree-checker-check-for-overlapping-extent-item.patch
+  patch -p1 -i ${srcdir}/0069-android-binder-fix-lockdep-check-on-clearing-vma.patch
+  patch -p1 -i ${srcdir}/0070-net-af_packet-check-len-when-min_header_len-equals-t.patch
+  patch -p1 -i ${srcdir}/0071-net-neigh-don-t-call-kfree_skb-under-spin_lock_irqsa.patch
+  patch -p1 -i ${srcdir}/0072-arm64-cacheinfo-Fix-incorrect-assignment-of-signed-e.patch
+  # 5.19.7 end
 
   if [ "$CARCH" = "x86_64" ]; then
 	  cat "${startdir}/config.x86_64" >| .config
@@ -645,10 +788,7 @@ _package-headers() {
   local _builddir="${pkgdir}/usr/lib/modules/$(<version)/build"
 
 
-  # only install objtool when stack validation is enabled
-  if grep -q CONFIG_STACK_VALIDATION=y .config   ; then
-    install -Dt "${_builddir}/tools/objtool" tools/objtool/objtool
-  fi
+  install -Dt "${_builddir}/tools/objtool" tools/objtool/objtool
 
   # required when DEBUG_INFO_BTF_MODULES is enabled
   if grep -q CONFIG_DEBUG_INFO_BTF_MODULES=y .config ; then
@@ -783,7 +923,7 @@ eval "package_linux-pf-headers-variant${LCPU+-$LCPU}() {
      }"
 
 sha256sums=('SKIP'
-            '28b4a6f7655079ff4a9cfe48763fae4c1e26be6956273d832062ceccddf23997'
+            '49c471ab3cf341c6333f08957c0c3cfccc38a7cef2c9ca1895888f4674b441ec'
             '2b4b6887e75c9e6d40d1fa00e4405745da4c0649f7bf8c48e1bb35d511270443'
             '30566498a4f549e972fcd430d2fc44b2bd643c55bae20096f083f8837d8c43e4'
             '82d660caa11db0cd34fd550a049d7296b4a9dcd28f2a50c81418066d6e598864'
@@ -814,5 +954,76 @@ sha256sums=('SKIP'
             '1a2598a00966da4e9985644edb900af7204409411464771c31d67d472595d817'
             '3d329b5153230184e270355f61697f5f7248787a4da045ac7b660e837c088630'
             'c6730df729723340475fa64cf0ce4fee02ff0a1739f355166324bb2abeca5168'
-            '67558840c3e1f1de229b23a54342cb126735282353a4d0a8cd10e4d582e6d9d6')
+            'e44a5e123fb22092a009630a8d80c496b70feaf9f9e244d76760290608edf277'
+            '54676e48e43b41351e3e7e195c5e752f855f44db7a3fe0d4bd66499344da8386'
+            '33bc73315a5f5757a093bd21fcc68e7a37a9c86ee2b731a85ef3c5067729199a'
+            'f84e76eca884191d9abc0b1876f9d9587e8bfde6a19a4d194445528d5b084f9b'
+            'b5a2082541aeec7162c6e673ea2dd0098f36d97c5deb03059afbf723b6789faa'
+            '20a3c119838e4487bcc7fc28d4301f39e016afc24c76a33c25a84b9c911e3eed'
+            '0bbaaf956dcc460bafe874c23b8ed495a46ced76918b044764b172b5719c9d44'
+            'e9a7b6ef185818f1472a15a98bbeb7be020e38c4d25ad3d9fead11961602bc03'
+            'c15ea9caacb98a4d61de2e3c6ecf1fcd083a8ed5a5ee69dc6a05b4583463badc'
+            '70353d1e4bec0bc3c895887c4b1557e2222b257c34cf0c303781e5ac6b0efec9'
+            '84301e69155a2404c24f18d8f2cc4986f355a86b9c072d59df9aca787e1abac2'
+            '9c405a65a4d5d532fc1517e8c67e5d6703cc5bad7daf4c38a3771216fc1719ad'
+            '96766d4ec6bae908fe6048f39e93fbc8627531daf6b5986cec99edd056581fac'
+            '05995c977c1cc77fbc49b220d95390147fa448aae2bfa9698a402e8a56b41877'
+            '9e16ce1da7499d2351dac47649c44a57ac1ec813f2d678d6da270e98359a51e4'
+            '0c99d880164142334e7b4e0eb87f073ff4d6d15ec7d4490ee5e046b44e20562d'
+            '83967bcd17746052db9cd95c92456658e51b22a717dfee004a9f34dc7fa26dfb'
+            'a307e5269cee8ae850997b93c14a4e3abb220a553dd7ece5337422c2e8770cfb'
+            '83c68bdd89892c9c1b747de8eaee210ae6578881a0d5c79431148e8712046493'
+            '2adff7cf24c62c13343e4821627c0a482ca139166147a76a76f520632d526cff'
+            'e9579fe46b98590d61d89cff16f719fe2b7eae88509c1ee168d85639a3cf2c0e'
+            '8dab0a83aafbd2374696ced71d8fd53db35423d6db52340c8991e4e1ba134249'
+            'a8f65f98ae26eb5039e4998634a11b6ef43d9f632596b5a291e2c9107bc45901'
+            '492191b1cd02c7f30ef0c77fb8ac8658cc1571a8953b7dae115ff90932b7391e'
+            '348c3d85a8942f3b9e9b7ba1e33ad33f5454277badfa17baede5e7ee0623a85a'
+            '809ad3f9f8a3b7933a8f5a174273b81fbd7ca875790a862984550bd53f08379d'
+            '244cce4734c37ba829580e21ca7f828433653d79260d9e20ebc524f05aa0fdb2'
+            '2b8fca8395d936999a41d3a5ed1d58931222fabed89f8748dba0ef8ce6e3b51a'
+            'cf06c51563c0eb21e2596cb516ce6cf0dbf3ece5573259ea59291a9b5a8cc40d'
+            'a6d9099008a7d4e90f91a417bbb8d42b6ac8ae3c4dc1a713530a24c78b90b06f'
+            '8a569cb9a6df4b6833234690931461620c4759c6f8591f163648a250bb97c2eb'
+            '1cb5fadc9854b97419a909ebf72dae3a2def66ee316c73292d42d85a60604757'
+            '2274585298c76b59dfb5b0f27d0e51f44e6dd0f0cd10627c5a3c51fa893d7bc0'
+            '02567508d03043eee5a0b2c4fe00db21873fc280c29e75942233b522dafe7234'
+            'ad574f61903c6db66110f4c607cd1ead2ce173e3dd95c5287aa392cb550dc973'
+            'b17687196d098311e7cc58af9e7f434cbc96c7075e6c24ed36362a24473b547e'
+            '150487680af2d7da5731b045d764d3501f6188e083cb5299a163edd894f9eb73'
+            '34ba987a290a3779a47f92468e834275925abaa11b008a846e5689e173128844'
+            '3267cf5af76e8253263220536b51c8203287148f2d1b564c41de151a9c3ff41e'
+            'dc6505ce152095aa7048977d2a4457918b8ba780bc4ae6d4188cf81321592068'
+            '71a27a759b2a8b990386b4d52ca95417205bb1674123f874b89fd17a929370fa'
+            'e2f6cc6c4a3443d26b852e252438564fe1fa80ab02a93b1bd325204da67663ae'
+            '6d87fb84681433d5508e1c225fbd54d9b606b1a0f4c6d54b1d3970fb69fae881'
+            '29f17c6768ee91706d1772758ddfabc9242331efef8d8a7eecb4b8c04deae394'
+            'dd88a730ac985b8c015ced758c7445f966acb0509e61296448b45d65d8d630a2'
+            '9fe796c6177a9faf99b1edc4656be8ec2303e8757600b557e9dde3258952bc7e'
+            '9ef664c55663f953ffb37087da1f1ad4b9a9f2519c84b1ac1add97178169095a'
+            '42ac5d9000ef8e2ff7ab5f88f6203c559ce727766cc2b2f4f089041b0d9e6ee8'
+            '3bbd0a5869969297ec2d5d8f062e346978be47e43480daf8255c67fe4c661ccf'
+            'ba79c549d798540c50ed17912eacc1f1651293b345f6aae8bd59cbe9633b4d0c'
+            '851f44e92b6266bfa79f4acdd860f44f95c6ab327b685998a9ae68e9e75a08cf'
+            'aa0d9b3c7225d664b5faa3385d3f3f736956d7f61052154c6b0ea0ec09bbbc89'
+            '60fe115a02d56ef029df6313f9e1c14a98da34ad742968845fbeaebc9237140f'
+            '17017d9d552d36e27cf11ac07c3ae678bb0c1f45761ef9796acf106c86234d95'
+            '73416c7b125bd78ceab3b3c0bb213a666976f7db3208b52d8735f81669d16650'
+            '6c7e2bcb0823892fffc1a6f86a01928e5931e1fc37cb3cfad911740d3f7d1854'
+            'f3dbd4095f7cbafb2f8f7407d6f5a2f592ef8aef1270f3c6ab10e0c666262ba9'
+            '1e8a5eb92ac2b5ecc17fdbfc7b5885a5991cdb2af5300817954102f1c5bfb5ec'
+            'b308b21874ca0b86cfb95ddcc76432daa2d4cc6d0053981367ab66fdeea6a01c'
+            'e0956a1f8785fdae0b68e2ac79d9187499662e9f6b8347be8eecb36717f8a63d'
+            '03bee283b4ec139b2722c1531ad566ff0d674e44a2ec49689686ca85a89c7f82'
+            '154c5f66ae84300ab69a4c9502a5893d9563f8b774887bda6959b930e3bbc6e0'
+            'd73dda2abcc118ea197cc3a61b5487b28d0fc584b0eb9deecba7d4b98b19f4ae'
+            '10c74ccc91d7b993c91dea5ec1f6d3710e642d35dce6001a27aa6d8bc4404dde'
+            '7c734ed61313ec21dc1c2c5adc6b828fac60f5a6f67de8869d2e7acfccbf4867'
+            'cb21bf8906fa812e46405269bf7e78361d05082dc63dfbf1c9719205768e49ac'
+            'c1f7da7edfb26701817a1fb3bb9b592e8966cf4b79b6305a1a3761bc8a4d2ab7'
+            '676cfac9acbf8ed66d2e90ff5127ae5920aaa0eece3f512d9e43fb06e6e83495'
+            'e151e8dc209e32a584a5b96752073f976acf823d758c34cbef5955e1172e50d5'
+            'd4903b81e4102ccaed88f7605c7208f57048cf087edbcc03a64e64580f404cae'
+            '15ff60a67694331a54435a4bb8d75c60d4e1c2895bd4fdb82401fe76da87e45d'
+            '08ba24891b0115a2b355b5b17da2b485c6e8c7fadabe08d7fb71716ae0d2d05e')
 # vim:set ts=2 sw=2 tw=0 et:
diff --git a/config.x86_64 b/config.x86_64
index cb6c2ebbf12e..5a0f8b3efabb 100644
--- a/config.x86_64
+++ b/config.x86_64
@@ -1,15 +1,15 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 5.19.1-zen1 Kernel Configuration
+# Linux/x86 5.19.6-zen1 Kernel Configuration
 #
-CONFIG_CC_VERSION_TEXT="gcc (GCC) 12.1.0"
+CONFIG_CC_VERSION_TEXT="gcc (GCC) 12.2.0"
 CONFIG_CC_IS_GCC=y
-CONFIG_GCC_VERSION=120100
+CONFIG_GCC_VERSION=120200
 CONFIG_CLANG_VERSION=0
 CONFIG_AS_IS_GNU=y
-CONFIG_AS_VERSION=23800
+CONFIG_AS_VERSION=23900
 CONFIG_LD_IS_BFD=y
-CONFIG_LD_VERSION=23800
+CONFIG_LD_VERSION=23900
 CONFIG_LLD_VERSION=0
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
@@ -802,6 +802,7 @@ CONFIG_ARCH_CORRECT_STACKTRACE_ON_KRETPROBE=y
 CONFIG_HAVE_FUNCTION_ERROR_INJECTION=y
 CONFIG_HAVE_NMI=y
 CONFIG_TRACE_IRQFLAGS_SUPPORT=y
+CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT=y
 CONFIG_HAVE_ARCH_TRACEHOOK=y
 CONFIG_HAVE_DMA_CONTIGUOUS=y
 CONFIG_GENERIC_SMP_IDLE_THREAD=y
@@ -8541,11 +8542,11 @@ CONFIG_NITRO_ENCLAVES=m
 CONFIG_ACRN_HSM=m
 CONFIG_EFI_SECRET=m
 CONFIG_SEV_GUEST=m
+CONFIG_VIRTIO_ANCHOR=y
 CONFIG_VIRTIO=y
 CONFIG_VIRTIO_PCI_LIB=m
 CONFIG_VIRTIO_PCI_LIB_LEGACY=m
 CONFIG_VIRTIO_MENU=y
-# CONFIG_VIRTIO_HARDEN_NOTIFICATION is not set
 CONFIG_VIRTIO_PCI=m
 CONFIG_VIRTIO_PCI_LEGACY=y
 CONFIG_VIRTIO_VDPA=m
@@ -8621,6 +8622,7 @@ CONFIG_XEN_FRONT_PGDIR_SHBUF=m
 CONFIG_XEN_UNPOPULATED_ALLOC=y
 CONFIG_XEN_GRANT_DMA_OPS=y
 CONFIG_XEN_VIRTIO=y
+# CONFIG_XEN_VIRTIO_FORCE_GRANT is not set
 # end of Xen driver support
 
 # CONFIG_GREYBUS is not set
@@ -10484,8 +10486,7 @@ CONFIG_CRYPTO_CRC32=m
 CONFIG_CRYPTO_CRC32_PCLMUL=m
 CONFIG_CRYPTO_XXHASH=m
 CONFIG_CRYPTO_BLAKE2B=m
-CONFIG_CRYPTO_BLAKE2S=m
-CONFIG_CRYPTO_BLAKE2S_X86=m
+CONFIG_CRYPTO_BLAKE2S_X86=y
 CONFIG_CRYPTO_CRCT10DIF=y
 CONFIG_CRYPTO_CRCT10DIF_PCLMUL=m
 CONFIG_CRYPTO_CRC64_ROCKSOFT=y
@@ -11100,7 +11101,6 @@ CONFIG_IO_STRICT_DEVMEM=y
 #
 # x86 Debugging
 #
-CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT=y
 CONFIG_EARLY_PRINTK_USB=y
 # CONFIG_X86_VERBOSE_BOOTUP is not set
 CONFIG_EARLY_PRINTK=y
author	Björn Bidar	2022-09-06 03:05:45 +0300
committer	Björn Bidar	2022-09-06 15:55:49 +0300
commit	dafa8d62d3f6493d66afc5d568273f5a7e7b8924 (patch)
tree	e41709bc271bbf6671ce34c491a455ff08547e34
parent	0c2ed81feac01240fdc5ed571ed3b563ec0dbec2 (diff)
download	aur-dafa8d62d3f6493d66afc5d568273f5a7e7b8924.tar.gz