- ASUS ROG Z13 keyboard support and other assorted fixes to
  hid-asus (Luke D. Jones)

The hidraw_open() function increments the hidraw device reference
counter. The counter has no dedicated synchronization mechanism,
resulting in a potential data race when concurrently opening a device.

The race is a regression introduced by commit 8590222e ("HID:
hidraw: Replace hidraw device table mutex with a rwsem"). While
minors_rwsem is intended to protect the hidraw_table itself, by instead
acquiring the lock for writing, the reference counter is also protected.
This is symmetrical to hidraw_release().

Link: https://github.com/systemd/systemd/issues/27947
Fixes: 8590222e ("HID: hidraw: Replace hidraw device table mutex with a rwsem")
Cc: stable@vger.kernel.org
Signed-off-by: Ludvig Michaelsson <ludvig.michaelsson@yubico.com>
Link: https://lore.kernel.org/r/20230621-hidraw-race-v1-1-a58e6ac69bab@yubico.comSigned-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>

Add device ID of Arrow Lake-H into ishtp support list.
Signed-off-by: Even Xu <even.xu@intel.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

commit 498ba206 ("HID: logitech-hidpp: Don't restart communication if
not necessary") put restarting communication behind that flag, and this
was apparently necessary on the T651, but the flag was not set for it.

Fixes: 498ba206 ("HID: logitech-hidpp: Don't restart communication if not necessary")
Cc: stable@vger.kernel.org
Signed-off-by: Mike Hommey <mh@glandium.org>
Link: https://lore.kernel.org/r/20230617230957.6mx73th4blv7owqk@glandium.orgSigned-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>

HP Elite Presenter Mouse HID Record Descriptor shows
two mouses (Repord ID 0x1 and 0x2), one keypad (Report ID 0x5),
two Consumer Controls (Report IDs 0x6 and 0x3).
Previous to this commit it registers one mouse, one keypad
and one Consumer Control, and it was usable only as a
digitl laser pointer (one of the two mouses). This patch defines
the 464a USB device ID and enables the HID_QUIRK_MULTI_INPUT
quirk for it, allowing to use the device both as a mouse
and a digital laser pointer.
Signed-off-by: Marco Morandini <marco.morandini@polimi.it>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Adds the USB and Bluetooth IDs for the Logitech G915 TKL keyboard, for device detection
For this device, this provides battery reporting on top of hid-generic
Reviewed-by: Bastien Nocera <hadess@hadess.net>
Signed-off-by: Stuart Hayhurst <stuart.a.hayhurst@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Currently, rumble is only supported via bluetooth on a single xbox
controller, called 'model 1708'. On the back of the device, it's named
'wireless controller for xbox one'. However, in 2021, Microsoft released
a firmware update for this controller. As part of this update, the HID
descriptor of the device changed. The product ID was also changed from
0x02fd to 0x0b20. On this controller, rumble was supported via
hid-microsoft, which matched against the old product id (0x02fd). As a
result, the firmware update broke rumble support on this controller.

See:
https://news.xbox.com/en-us/2021/09/08/xbox-controller-firmware-update-rolling-out-to-insiders-starting-today/

The hid-microsoft driver actually supports rumble on the new firmware,
as well. So simply adding new product id is sufficient to bring back
this support.

After discussing further with the xbox team, it was pointed out that
another xbox controller, xbox elite series 2, can be supported in a
similar way.

Add rumble support for all of these devices in this patch. Two of the
devices have received firmware updates that caused their product id's to
change. Both old and new firmware versions of these devices were tested.

The tested controllers are:

1. 'wireless controller for xbox one', model 1708
2. 'xbox wireless controller', model 1914. This is also sometimes
   referred to as 'xbox series S|X'.
3. 'elite series 2', model 1797.

The tested configurations are:
1. model 1708, pid 0x02fd (old firmware)
2. model 1708, pid 0x0b20 (new firmware)
3. model 1914, pid 0x0b13
4. model 1797, pid 0x0b05 (old firmware)
5. model 1797, pid 0x0b22 (new firmware)

I verified rumble support on both bluetooth and usb.
Reviewed-by: Bastien Nocera <hadess@hadess.net>
Signed-off-by: Siarhei Vishniakou <svv@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

It seems we forgot the normal case to terminate the retry loop,
making us asking 3 times each command, which is probably a little bit
too much.

And remove the ugly "goto exit" that can be replaced by a simpler "break"

Fixes: 586e8fed ("HID: logitech-hidpp: Retry commands when device is busy")
Suggested-by: Mark Lord <mlord@pobox.com>
Tested-by: Mark Lord <mlord@pobox.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

If an attempt at contacting a receiver or a device fails because the
receiver or device never responds, don't restart the communication, only
restart it if the receiver or device answers that it's busy, as originally
intended.

This was the behaviour on communication timeout before commit 586e8fed
("HID: logitech-hidpp: Retry commands when device is busy").

This fixes some overly long waits in a critical path on boot, when
checking whether the device is connected by getting its HID++ version.
Signed-off-by: Bastien Nocera <hadess@hadess.net>
Suggested-by: Mark Lord <mlord@pobox.com>
Fixes: 586e8fed ("HID: logitech-hidpp: Retry commands when device is busy")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217412Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Older formatting of this block was beginning to get somewhat cluttered.
Condensing the block and putting comments to the side makes it easier
to read and scan the scancodes plus keycodes.
Signed-off-by: Luke D. Jones <luke@ljones.dev>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

These two keys are found on some models with dual display.
- 0x6a is intended for controlling the secondary screen brightness.
- 0x4b is intended for toggling the arrow keys between arrows and
  page up / page down.
This key is found on a slightly modified keyboard layout.
- 0xc7 is intended to cycle through keybvoard brightnesses (upwards) but
  there is not suitable existing code for this behaviour. Using
  `KEY_KBDILLUMTOGGLE` is different behaviour to Windows but at least
  is picked up by many desktops already.
Signed-off-by: Luke D. Jones <luke@ljones.dev>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Add support for the ROG Z13 keyboard. This is a variant of the last
few ASUS ROG keyboards and has much of the same functionality.
Signed-off-by: Luke D. Jones <luke@ljones.dev>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

   Added a variable check and
   transition in case of an error

Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Denis Arefev <arefev@swemel.ru>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Add 1 additional hammer-like device.
Signed-off-by: Sung-Chi Li <lschyi@chromium.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

If high bit is set to 1 in ((data[3] & 0x0f << 28), after all arithmetic
operations and integer promotions are done, high bits in
wacom->serial[idx] will be filled with 1s as well.
Avoid this, albeit unlikely, issue by specifying left operand's __u64
type for the right operand.

Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.

Fixes: 3bea733a ("USB: wacom tablet driver reorganization")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

The strscpy function is able to return an error code when a copy would
overflow the size of the destination. The copy is stopped and the buffer
terminated before overflow actually occurs so it is safe to continue
execution, but we should still produce a warning should this occur.
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Pull HID updates from Jiri Kosina:

 - import a bunch of HID selftests from out-of-tree hid-tools project
   (Benjamin Tissoires)

 - drastically reducing Bluetooth disconnects on hid-nintendo driven
   devices (Daniel J. Ogorchock)

 - lazy initialization of battery interfaces in wacom driver (Jason
   Gerecke)

 - generic support for all Kye tablets (David Yang)

 - proper rumble queue overrun handling in hid-nintendo (Daniel J.
   Ogorchock)

 - support for ADC measurement in logitech-hidpp driver (Bastien Nocera)

 - reset GPIO support in i2c-hid (Hans de Goede)

 - improved handling of generic "Digitizer" usage (Jason Gerecke)

 - support for KEY_CAMERA_FOCUS (Feng Qi)

 - quirks for Apple Geyser 3 and Apple Geyser 4 (Alex Henrie)

 - assorted functional fixes and device ID additions

* tag 'for-linus-2023042601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (54 commits)
  HID: amd_sfh: Fix max supported HID devices
  HID: wacom: generic: Set battery quirk only when we see battery data
  HID: wacom: Lazy-init batteries
  HID: Ignore battery for ELAN touchscreen on ROG Flow X13 GV301RA
  HID: asus: explicitly include linux/leds.h
  HID: lg-g15: explicitly include linux/leds.h
  HID: steelseries: explicitly include linux/leds.h
  HID: apple: Set the tilde quirk flag on the Geyser 3
  HID: apple: explicitly include linux/leds.h
  HID: mcp2221: fix get and get_direction for gpio
  HID: mcp2221: fix report layout for gpio get
  HID: wacom: Set a default resolution for older tablets
  HID: i2c-hid-of: Add reset GPIO support to i2c-hid-of
  HID: i2c-hid-of: Allow using i2c-hid-of on non OF platforms
  HID: i2c-hid-of: Consistenly use dev local variable in probe()
  HID: kye: Fix rdesc for kye tablets
  HID: amd_sfh: Support for additional light sensor
  HID: amd_sfh: Handle "no sensors" enabled for SFH1.1
  HID: amd_sfh: Increase sensor command timeout for SFH1.1
  HID: amd_sfh: Correct the stop all command
  ...

Pull fbdev updates from Helge Deller:
 "Nothing really exiting in here.

  The majority of lines changed is due to Uwe's preparation patches to
  change the return value of the .remove() callback to void.

  Summary:

   - vt_buffer.h: Fix build on alpha (Randy Dunlap)

   - mmp: Clock handling fix (Christophe JAILLET)

   - 68328fb, ps3fb, vfb: Init .owner field of struct fb_ops (Thomas
     Zimmermann)

   - fbdev: cg14: Convert to platform remove callback returning void

   - Preparation patches to convert drivers to return void in .remove()
     callback (Uwe Kleine-König)

   - Drop Paul Mackerras as rage128 maintainer"

* tag 'fbdev-for-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: (51 commits)
  MAINTAINERS: Remove rage128 framebuffer driver maintainer
  fbdev: vfb: Init owner field of struct fb_ops
  fbdev: ps3fb: Init owner field of struct fb_ops
  fbdev: 68328fb: Init owner field of struct fb_ops
  fbdev: mmp: Fix deferred clk handling in mmphw_probe()
  linux/vt_buffer.h: allow either builtin or modular for macros
  fbdev: xilinxfb: Convert to platform remove callback returning void
  fbdev: wmt_ge_rops: Convert to platform remove callback returning void
  fbdev: wm8505fb: Convert to platform remove callback returning void
  fbdev: vt8500lcdfb: Convert to platform remove callback returning void
  fbdev: via: Convert to platform remove callback returning void
  fbdev: vga16fb: Convert to platform remove callback returning void
  fbdev: vfb: Convert to platform remove callback returning void
  fbdev: vesafb: Convert to platform remove callback returning void
  fbdev: uvesafb: Convert to platform remove callback returning void
  fbdev: tcx: Convert to platform remove callback returning void
  fbdev: sm501fb: Convert to platform remove callback returning void
  fbdev: simplefb: Convert to platform remove callback returning void
  fbdev: sh_mobile_lcdcfb: Convert to platform remove callback returning void
  fbdev: sh7760fb: Convert to platform remove callback returning void
  ...

Pull i2c updates from Wolfram Sang:
 "Mostly fixes for DTs or DT handling this time. And a few driver
  bugfixes"

* tag 'i2c-for-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (28 commits)
  i2c: xiic: xiic_xfer(): Fix runtime PM leak on error path
  i2c: cadence: cdns_i2c_master_xfer(): Fix runtime PM leak on error path
  i2c: omap: Improve error reporting for problems during .remove()
  i2c: cadence: Add reset controller support
  dt-bindings: i2c: cadence: Document `resets` property
  i2c: mediatek: add support for MT7981 SoC
  dt-bindings: i2c: i2c-mt65xx: add MediaTek MT7981 SoC
  dt-bindings: i2c: Drop unneeded quotes
  i2c: brcmstb: use devm_platform_ioremap_resource_byname()
  i2c: cadence: Detect maximum transfer size
  i2c: cadence: Allow to specify the FIFO depth
  dt-bindings: i2c: cadence: Document `fifo-depth` property
  i2c: xiic: Use devm_platform_get_and_ioremap_resource()
  i2c: mpc: Use i2c-scl-clk-low-timeout-us i2c property
  i2c: mpc: Use of_property_read_u32 instead of of_get_property
  dt-bindings: i2c: mpc: Mark "fsl,timeout" as deprecated
  i2c: xiic: hide OF related data for COMPILE_TEST
  i2c: synquacer: mark OF related data as maybe unused
  dt-bindings: i2c: i2c-mt65xx: Add compatible for MT6795 Helio X10
  i2c: imx: Simplify using devm_clk_get_enabled()
  ...

Pull IPMI updates from Corey Minyard:
 "Minor bug fixes for the IPMI driver

  There was a bug in the SSIF driver where in certain conditions it
  could stop working.

  Outside of that: spelling fixes, removing some dead code, re-adding a
  missing statistic increment, and removal of register_sysctl_table()"

* tag 'for-linus-6.4-1' of https://github.com/cminyard/linux-ipmi:
  ipmi:ssif: Drop if blocks with always false condition
  ipmi: fix SSIF not responding under certain cond.
  ipmi:ssif: Add send_retries increment
  char:ipmi:Fix spelling mistake "asychronously" -> "asynchronously"
  ipmi: simplify sysctl registration
  ipmi: ASPEED_BT_IPMI_BMC: select REGMAP_MMIO instead of depending on it

Pull spi updates from Mark Brown:
 "A fairly standard release for SPI with the exception of a change to
  the API for specifying chip selects done in preparation for supporting
  devices with more than one chip select, this required some mechanical
  changes throughout the tree which have been cooking in -next happily
  for a while.

  There's also a new API to allow us to support TPM chips on half duplex
  controllers.

  Summary:

   - Refactoring in preparation for supporting multiple chip selects for
     a single device, needed by some flash devices, which required a
     change in the SPI device API visible throughout the tree

   - Support for hardware assisted interaction with SPI TPMs on half
     duplex controllers, implemented on nVidia Tedra210 QuadSPI

   - Optimisation for large transfers on fsl-cpm devices

   - Cleanups around device property use which fix some sisues with
     fwnode

   - Use of both void remove() and devm_platform_.*ioremap_resource()

   - Support for AMD Pensando Elba, Amlogic A1, Cadence device mode,
     Intel MetorLake-S and StarFive J7110 QuadSPI"

* tag 'spi-v6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (185 commits)
  spi: bcm63xx: use macro DEFINE_SIMPLE_DEV_PM_OPS
  spi: tegra210-quad: Enable TPM wait polling
  spi: Add TPM HW flow flag
  spi: bcm63xx: remove PM_SLEEP based conditional compilation
  spi: cadence-quadspi: use macro DEFINE_SIMPLE_DEV_PM_OPS
  spi: spi-cadence: Add support for Slave mode
  spi: spi-cadence: Switch to spi_controller structure
  spi: cadence-quadspi: fix suspend-resume implementations
  spi: dw: Add support for AMD Pensando Elba SoC
  spi: dw: Add AMD Pensando Elba SoC SPI Controller
  spi: cadence-quadspi: Disable the SPI before reconfiguring
  spi: cadence-quadspi: Update the read timeout based on the length
  spi: spi-loopback-test: Add module param for iteration length
  spi: add support for Amlogic A1 SPI Flash Controller
  dt-bindings: spi: add Amlogic A1 SPI controller
  spi: fsl-spi: No need to check transfer length versus word size
  spi: fsl-spi: Change mspi_apply_cpu_mode_quirks() to void
  spi: fsl-cpm: Use 16 bit mode for large transfers with even size
  spi: fsl-spi: Re-organise transfer bits_per_word adaptation
  spi: fsl-spi: Fix CPM/QE mode Litte Endian
  ...

Pull sound updates from Takashi Iwai:
 "At this time, it's an interesting mixture of changes for both old and
  new stuff. Majority of changes are about ASoC (lots of systematic
  changes for converting remove callbacks to void, and cleanups), while
  we got the fixes and the enhancements of very old PCI cards, too.

  Here are some highlights:

  ALSA/ASoC Core:
   - Continued effort of more ASoC core cleanups
   - Minor improvements for XRUN handling in indirect PCM helpers
   - Code refactoring of PCM core code

  ASoC:
   - Continued feature and simplification work on SOF, including
     addition of a no-DSP mode for bringup, HDA MLink and extensions to
     the IPC4 protocol
   - Hibernation support for CS35L45
   - More DT binding conversions
   - Support for Cirrus Logic CS35L56, Freescale QMC, Maxim MAX98363,
     nVidia systems with MAX9809x and RT5631, Realtek RT712, Renesas
     R-Car Gen4, Rockchip RK3588 and TI TAS5733

  ALSA:
   - Lots of works for legacy emu10k1 and ymfpci PCI drivers
   - PCM kselftest fixes and enhancements"

* tag 'sound-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (586 commits)
  ALSA: emu10k1: use high-level I/O in set_filterQ()
  ALSA: emu10k1: use high-level I/O functions also during init
  ALSA: emu10k1: fix error handling in snd_audigy_i2c_volume_put()
  ALSA: emu10k1: don't stop DSP in _snd_emu10k1_{,audigy_}init_efx()
  ALSA: emu10k1: fix SNDRV_EMU10K1_IOCTL_SINGLE_STEP
  ALSA: emu10k1: skip Sound Blaster-specific hacks for E-MU cards
  ALSA: emu10k1: fixup DSP defines
  ALSA: emu10k1: pull in some register definitions from kX-project
  ALSA: emu10k1: remove some bogus defines
  ALSA: emu10k1: eliminate some unused defines
  ALSA: emu10k1: fix lineup of EMU_HANA_* defines
  ALSA: emu10k1: comment updates
  ALSA: emu10k1: fix snd_emu1010_fpga_read() input masking for rev2 cards
  ALSA: emu10k1: remove unused emu->pcm_playback_efx_substream field
  ALSA: emu10k1: remove unused `resume` parameter from snd_emu10k1_init()
  ALSA: emu10k1: minor optimizations
  ALSA: emu10k1: remove remaining cruft from snd_emu10k1_emu1010_init()
  ALSA: emu10k1: remove apparently pointless EMU_HANA_OPTION_CARDS reads
  ALSA: emu10k1: remove apparently pointless FPGA reads
  ALSA: emu10k1: stop doing weird things with HCFG in snd_emu10k1_emu1010_init()
  ...

Pull pci updates from Bjorn Helgaas:
 "Resource management:

   - Add pci_dev_for_each_resource() and pci_bus_for_each_resource()
     iterators

  PCIe native device hotplug:

   - Fix AB-BA deadlock between reset_lock and device_lock

  Power management:

   - Wait longer for devices to become ready after resume (as we do for
     reset) to accommodate Intel Titan Ridge xHCI devices

   - Extend D3hot delay for NVIDIA HDA controllers to avoid
     unrecoverable devices after a bus reset

  Error handling:

   - Clear PCIe Device Status after EDR since generic error recovery now
     only clears it when AER is native

  ASPM:

   - Work around Chromebook firmware defect that clobbers Capability
     list (including ASPM L1 PM Substates Cap) when returning from
     D3cold to D0

  Freescale i.MX6 PCIe controller driver:

   - Install imprecise external abort handler only when DT indicates
     PCIe support

  Freescale Layerscape PCIe controller driver:

   - Add ls1028a endpoint mode support

  Qualcomm PCIe controller driver:

   - Add SM8550 DT binding and driver support

   - Add SDX55 DT binding and driver support

   - Use bulk APIs for clocks of IP 1.0.0, 2.3.2, 2.3.3

   - Use bulk APIs for reset of IP 2.1.0, 2.3.3, 2.4.0

   - Add DT "mhi" register region for supported SoCs

   - Expose link transition counts via debugfs to help debug low power
     issues

   - Support system suspend and resume; reduce interconnect bandwidth
     and turn off clock and PHY if there are no active devices

   - Enable async probe by default to reduce boot time

  Miscellaneous:

   - Sort controller Kconfig entries by vendor"

* tag 'pci-v6.4-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (56 commits)
  PCI: xilinx: Drop obsolete dependency on COMPILE_TEST
  PCI: mobiveil: Sort Kconfig entries by vendor
  PCI: dwc: Sort Kconfig entries by vendor
  PCI: Sort controller Kconfig entries by vendor
  PCI: Use consistent controller Kconfig menu entry language
  PCI: xilinx-nwl: Add 'Xilinx' to Kconfig prompt
  PCI: hv: Add 'Microsoft' to Kconfig prompt
  PCI: meson: Add 'Amlogic' to Kconfig prompt
  PCI: Use of_property_present() for testing DT property presence
  PCI/PM: Extend D3hot delay for NVIDIA HDA controllers
  dt-bindings: PCI: qcom: Document msi-map and msi-map-mask properties
  PCI: qcom: Add SM8550 PCIe support
  dt-bindings: PCI: qcom: Add SM8550 compatible
  PCI: qcom: Add support for SDX55 SoC
  dt-bindings: PCI: qcom-ep: Fix the unit address used in example
  dt-bindings: PCI: qcom: Add SDX55 SoC
  dt-bindings: PCI: qcom: Update maintainers entry
  PCI: qcom: Enable async probe by default
  PCI: qcom: Add support for system suspend and resume
  PCI/PM: Drop pci_bridge_wait_for_secondary_bus() timeout parameter
  ...

Pull more devicetree updates from Rob Herring:

 - First part of DT header detangling dropping cpu.h from of_device.h
   and replacing some includes with forward declarations. A handful of
   drivers needed some adjustment to their includes as a result.

 - Refactor of_device.h to be used by bus drivers rather than various
   device drivers. This moves non-bus related functions out of
   of_device.h. The end goal is for of_platform.h and of_device.h to
   stop including each other.

 - Refactor open coded parsing of "ranges" in some bus drivers to use DT
   address parsing functions

 - Add some new address parsing functions of_property_read_reg(),
   of_range_count(), and of_range_to_resource() in preparation to
   convert more open coded parsing of DT addresses to use them.

 - Treewide clean-ups to use of_property_read_bool() and
   of_property_present() as appropriate. The ones here are the ones that
   didn't get picked up elsewhere.

* tag 'devicetree-for-6.4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (34 commits)
  bus: tegra-gmi: Replace of_platform.h with explicit includes
  hte: Use of_property_present() for testing DT property presence
  w1: w1-gpio: Use of_property_read_bool() for boolean properties
  virt: fsl: Use of_property_present() for testing DT property presence
  soc: fsl: Use of_property_present() for testing DT property presence
  sbus: display7seg: Use of_property_read_bool() for boolean properties
  sparc: Use of_property_read_bool() for boolean properties
  sparc: Use of_property_present() for testing DT property presence
  bus: mvebu-mbus: Remove open coded "ranges" parsing
  of/address: Add of_property_read_reg() helper
  of/address: Add of_range_count() helper
  of/address: Add support for 3 address cell bus
  of/address: Add of_range_to_resource() helper
  of: unittest: Add bus address range parsing tests
  of: Drop cpu.h include from of_device.h
  OPP: Adjust includes to remove of_device.h
  irqchip: loongson-eiointc: Add explicit include for cpuhotplug.h
  cpuidle: Adjust includes to remove of_device.h
  cpufreq: sun50i: Add explicit include for cpu.h
  cpufreq: Adjust includes to remove of_device.h
  ...

Pull devicetree updates from Rob Herring:
 "Bindings:

   - Convert Qcom IOMMU, Amlogic timer, Freescale sec-v4.0, Toshiba
     TC358764 display bridge, Parade PS8622 display bridge, and Xilinx
     FPGA bindings to DT schema format

   - Add qdu1000 and sa8775p SoC support to Qcom PDC interrupt
     controller

   - Add MediaTek MT8365 UART and SYSIRQ bindings

   - Add Arm Cortex-A78C and X1C core compatibles

   - Add vendor prefix for Novatek

   - Remove bindings for stih415, sti416, stid127 platforms

   - Drop uneeded quotes in schema files. This is preparation for
     yamllint checking quoting for us.

   - Add missing (unevaluated|additional)Properties constraints on child
     node schemas

   - Clean-up schema comments formatting

   - Fix I2C and SPI node bus names in schema examples

   - Clean-up some display compatibles schema syntax

   - Fix incorrect references to lvds.yaml

   - Gather all cache controller bindings in a common directory

  DT core:

   - Convert unittest to new void .remove platform device hook

   - kerneldoc fixes for DT address of_pci_range_to_resource/
     of_address_to_resource functions"

* tag 'devicetree-for-6.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (46 commits)
  dt-bindings: rng: Drop unneeded quotes
  dt-bindings: arm/soc: mediatek: Drop unneeded quotes
  dt-bindings: soc: qcom: Drop unneeded quotes
  dt-bindings: i2c: samsung: Fix 'deprecated' value
  dt-bindings: display: Fix lvds.yaml references
  dt-bindings: display: simplify compatibles syntax
  dt-bindings: display: mediatek: simplify compatibles syntax
  dt-bindings: drm/bridge: ti-sn65dsi86: Fix the video-interfaces.yaml references
  dt-bindings: timer: Drop unneeded quotes
  dt-bindings: interrupt-controller: qcom,pdc: document qcom,qdu1000-pdc
  dt-bindings: interrupt-controller: qcom-pdc: add compatible for sa8775p
  dt-bindings: reset: remove stih415/stih416 reset
  dt-bindings: net: dwmac: sti: remove stih415/sti416/stid127
  dt-bindings: irqchip: sti: remove stih415/stih416 and stid127
  dt-bindings: iommu: Convert QCOM IOMMU to YAML
  dt-bindings: irqchip: ti,sci-inta: Add optional power-domains property
  dt-bindings: Add missing (unevaluated|additional)Properties on child node schemas
  of: address: Reshuffle to remove forward declarations
  of: address: Fix documented return value of of_pci_range_to_resource()
  of: address: Document return value of of_address_to_resource()
  ...

Pull iommufd updates from Jason Gunthorpe:
 "Two series:

   - Reorganize how the hardware page table objects are managed,
     particularly their destruction flow. Increase the selftest test
     coverage in this area by creating a more complete mock iommu
     driver.

     This is preparation to add a replace operation for HWPT binding,
     which is done but waiting for the VFIO parts to complete so there
     is a user.

   - Split the iommufd support for "access" to make it two step -
     allocate an access then link it to an IOAS. Update VFIO and have
     VFIO always create an access even for the VFIO mdevs that never do
     DMA.

     This is also preperation for the replace VFIO series that will
     allow replace to work on access types as well.

  Three minor fixes:

   - Sykzaller found the selftest code didn't check for overflow when
     processing user VAs

   - smatch noted a .data item should have been static

   - Add a selftest that reproduces a syzkaller bug for batch carry
     already fixed in rc"

* tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: (21 commits)
  iommufd/selftest: Cover domain unmap with huge pages and access
  iommufd/selftest: Set varaiable mock_iommu_device storage-class-specifier to static
  vfio: Check the presence for iommufd callbacks in __vfio_register_dev()
  vfio/mdev: Uses the vfio emulated iommufd ops set in the mdev sample drivers
  vfio-iommufd: Make vfio_iommufd_emulated_bind() return iommufd_access ID
  vfio-iommufd: No need to record iommufd_ctx in vfio_device
  iommufd: Create access in vfio_iommufd_emulated_bind()
  iommu/iommufd: Pass iommufd_ctx pointer in iommufd_get_ioas()
  iommufd/selftest: Catch overflow of uptr and length
  iommufd/selftest: Add a selftest for iommufd_device_attach() with a hwpt argument
  iommufd/selftest: Make selftest create a more complete mock device
  iommufd/selftest: Rename the remaining mock device_id's to stdev_id
  iommufd/selftest: Rename domain_id to hwpt_id for FIXTURE iommufd_mock_domain
  iommufd/selftest: Rename domain_id to stdev_id for FIXTURE iommufd_ioas
  iommufd/selftest: Rename the sefltest 'device_id' to 'stdev_id'
  iommufd: Make iommufd_hw_pagetable_alloc() do iopt_table_add_domain()
  iommufd: Move iommufd_device to iommufd_private.h
  iommufd: Move ioas related HWPT destruction into iommufd_hw_pagetable_destroy()
  iommufd: Consistently manage hwpt_item
  iommufd: Add iommufd_lock_obj() around the auto-domains hwpts
  ...

Pull drm fixes from Dave Airlie:
 "A bit out of routine fixes pull for rc1.

  There's a build breakage on some platforms due to ttm, this has that
  fix + qaic uapi removal + minor panel fixes.

  ttm:
   - Fix TTM build on archs where PMD_SHIFT is not constant

  qaic:
   - Revert uAPI from accel/qaic

  panel:
   - Improve error handling in nt35950
   - Fix double unregister in otm8009a when removing the driver"

* tag 'drm-next-2023-04-27' of git://anongit.freedesktop.org/drm/drm:
  drm/panel: novatek-nt35950: Only unregister DSI1 if it exists
  drm/panel: otm8009a: Set backlight parent to panel device
  drm/panel: novatek-nt35950: Improve error handling
  drm/ttm: revert "Reduce the number of used allocation orders for TTM pages"
  Revert "accel/qaic: Add mhi_qaic_cntl"

After upgrading build guests to v6.3, rpm started segfaulting for
specific packages, which was bisected to commit 0503ea8f ("mm/mmap:
remove __vma_adjust()"). rpm is doing many mremap() operations with file
mappings of its db. The problem is that in vma_merge() case 3 (we merge
with the next vma, expanding it downwards) vm_pgoff is not adjusted as
it should when vm_start changes. As a result the rpm process most likely
sees data from the wrong offset of the file. Fix the vm_pgoff
calculation.

For case 8 this is a non-functional change as the resulting vm_pgoff is
the same.
Reported-and-bisected-by: Jiri Slaby <jirislaby@kernel.org>
Reported-and-tested-by: Fabian Vogt <fvogt@suse.com>
Link: https://bugzilla.suse.com/show_bug.cgi?id=1210903
Fixes: 0503ea8f ("mm/mmap: remove __vma_adjust()")
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Merge tag 'drm-misc-next-fixes-2023-04-26' of git://anongit.freedesktop.org/drm/drm-misc into drm-next

drm-misc-next-fixes for v6.4-rc1:
- Revert uAPI from accel/qaic.
- Fix TTM build on archs where PMD_SHIFT is not constant.
- Improve error handling in nt35950.
- Fix double unregister in otm8009a when removing the driver.
Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/45757de9-75d8-5b41-f1f9-562a7c4675b9@linux.intel.com

Pull networking updates from Paolo Abeni:
 "Core:

   - Introduce a config option to tweak MAX_SKB_FRAGS. Increasing the
     default value allows for better BIG TCP performances

   - Reduce compound page head access for zero-copy data transfers

   - RPS/RFS improvements, avoiding unneeded NET_RX_SOFTIRQ when
     possible

   - Threaded NAPI improvements, adding defer skb free support and
     unneeded softirq avoidance

   - Address dst_entry reference count scalability issues, via false
     sharing avoidance and optimize refcount tracking

   - Add lockless accesses annotation to sk_err[_soft]

   - Optimize again the skb struct layout

   - Extends the skb drop reasons to make it usable by multiple
     subsystems

   - Better const qualifier awareness for socket casts

  BPF:

   - Add skb and XDP typed dynptrs which allow BPF programs for more
     ergonomic and less brittle iteration through data and
     variable-sized accesses

   - Add a new BPF netfilter program type and minimal support to hook
     BPF programs to netfilter hooks such as prerouting or forward

   - Add more precise memory usage reporting for all BPF map types

   - Adds support for using {FOU,GUE} encap with an ipip device
     operating in collect_md mode and add a set of BPF kfuncs for
     controlling encap params

   - Allow BPF programs to detect at load time whether a particular
     kfunc exists or not, and also add support for this in light
     skeleton

   - Bigger batch of BPF verifier improvements to prepare for upcoming
     BPF open-coded iterators allowing for less restrictive looping
     capabilities

   - Rework RCU enforcement in the verifier, add kptr_rcu and enforce
     BPF programs to NULL-check before passing such pointers into kfunc

   - Add support for kptrs in percpu hashmaps, percpu LRU hashmaps and
     in local storage maps

   - Enable RCU semantics for task BPF kptrs and allow referenced kptr
     tasks to be stored in BPF maps

   - Add support for refcounted local kptrs to the verifier for allowing
     shared ownership, useful for adding a node to both the BPF list and
     rbtree

   - Add BPF verifier support for ST instructions in
     convert_ctx_access() which will help new -mcpu=v4 clang flag to
     start emitting them

   - Add ARM32 USDT support to libbpf

   - Improve bpftool's visual program dump which produces the control
     flow graph in a DOT format by adding C source inline annotations

  Protocols:

   - IPv4: Allow adding to IPv4 address a 'protocol' tag. Such value
     indicates the provenance of the IP address

   - IPv6: optimize route lookup, dropping unneeded R/W lock acquisition

   - Add the handshake upcall mechanism, allowing the user-space to
     implement generic TLS handshake on kernel's behalf

   - Bridge: support per-{Port, VLAN} neighbor suppression, increasing
     resilience to nodes failures

   - SCTP: add support for Fair Capacity and Weighted Fair Queueing
     schedulers

   - MPTCP: delay first subflow allocation up to its first usage. This
     will allow for later better LSM interaction

   - xfrm: Remove inner/outer modes from input/output path. These are
     not needed anymore

   - WiFi:
      - reduced neighbor report (RNR) handling for AP mode
      - HW timestamping support
      - support for randomized auth/deauth TA for PASN privacy
      - per-link debugfs for multi-link
      - TC offload support for mac80211 drivers
      - mac80211 mesh fast-xmit and fast-rx support
      - enable Wi-Fi 7 (EHT) mesh support

  Netfilter:

   - Add nf_tables 'brouting' support, to force a packet to be routed
     instead of being bridged

   - Update bridge netfilter and ovs conntrack helpers to handle IPv6
     Jumbo packets properly, i.e. fetch the packet length from
     hop-by-hop extension header. This is needed for BIT TCP support

   - The iptables 32bit compat interface isn't compiled in by default
     anymore

   - Move ip(6)tables builtin icmp matches to the udptcp one. This has
     the advantage that icmp/icmpv6 match doesn't load the
     iptables/ip6tables modules anymore when iptables-nft is used

   - Extended netlink error report for netdevice in flowtables and
     netdev/chains. Allow for incrementally add/delete devices to netdev
     basechain. Allow to create netdev chain without device

  Driver API:

   - Remove redundant Device Control Error Reporting Enable, as PCI core
     has already error reporting enabled at enumeration time

   - Move Multicast DB netlink handlers to core, allowing devices other
     then bridge to use them

   - Allow the page_pool to directly recycle the pages from safely
     localized NAPI

   - Implement lockless TX queue stop/wake combo macros, allowing for
     further code de-duplication and sanitization

   - Add YNL support for user headers and struct attrs

   - Add partial YNL specification for devlink

   - Add partial YNL specification for ethtool

   - Add tc-mqprio and tc-taprio support for preemptible traffic classes

   - Add tx push buf len param to ethtool, specifies the maximum number
     of bytes of a transmitted packet a driver can push directly to the
     underlying device

   - Add basic LED support for switch/phy

   - Add NAPI documentation, stop relaying on external links

   - Convert dsa_master_ioctl() to netdev notifier. This is a
     preparatory work to make the hardware timestamping layer selectable
     by user space

   - Add transceiver support and improve the error messages for CAN-FD
     controllers

  New hardware / drivers:

   - Ethernet:
      - AMD/Pensando core device support
      - MediaTek MT7981 SoC
      - MediaTek MT7988 SoC
      - Broadcom BCM53134 embedded switch
      - Texas Instruments CPSW9G ethernet switch
      - Qualcomm EMAC3 DWMAC ethernet
      - StarFive JH7110 SoC
      - NXP CBTX ethernet PHY

   - WiFi:
      - Apple M1 Pro/Max devices
      - RealTek rtl8710bu/rtl8188gu
      - RealTek rtl8822bs, rtl8822cs and rtl8821cs SDIO chipset

   - Bluetooth:
      - Realtek RTL8821CS, RTL8851B, RTL8852BS
      - Mediatek MT7663, MT7922
      - NXP w8997
      - Actions Semi ATS2851
      - QTI WCN6855
      - Marvell 88W8997

   - Can:
      - STMicroelectronics bxcan stm32f429

  Drivers:

   - Ethernet NICs:
      - Intel (1G, icg):
         - add tracking and reporting of QBV config errors
         - add support for configuring max SDU for each Tx queue
      - Intel (100G, ice):
         - refactor mailbox overflow detection to support Scalable IOV
         - GNSS interface optimization
      - Intel (i40e):
         - support XDP multi-buffer
      - nVidia/Mellanox:
         - add the support for linux bridge multicast offload
         - enable TC offload for egress and engress MACVLAN over bond
         - add support for VxLAN GBP encap/decap flows offload
         - extend packet offload to fully support libreswan
         - support tunnel mode in mlx5 IPsec packet offload
         - extend XDP multi-buffer support
         - support MACsec VLAN offload
         - add support for dynamic msix vectors allocation
         - drop RX page_cache and fully use page_pool
         - implement thermal zone to report NIC temperature
      - Netronome/Corigine:
         - add support for multi-zone conntrack offload
      - Solarflare/Xilinx:
         - support offloading TC VLAN push/pop actions to the MAE
         - support TC decap rules
         - support unicast PTP

   - Other NICs:
      - Broadcom (bnxt): enforce software based freq adjustments only on
        shared PHC NIC
      - RealTek (r8169): refactor to addess ASPM issues during NAPI poll
      - Micrel (lan8841): add support for PTP_PF_PEROUT
      - Cadence (macb): enable PTP unicast
      - Engleder (tsnep): add XDP socket zero-copy support
      - virtio-net: implement exact header length guest feature
      - veth: add page_pool support for page recycling
      - vxlan: add MDB data path support
      - gve: add XDP support for GQI-QPL format
      - geneve: accept every ethertype
      - macvlan: allow some packets to bypass broadcast queue
      - mana: add support for jumbo frame

   - Ethernet high-speed switches:
      - Microchip (sparx5): Add support for TC flower templates

   - Ethernet embedded switches:
      - Broadcom (b54):
         - configure 6318 and 63268 RGMII ports
      - Marvell (mv88e6xxx):
         - faster C45 bus scan
      - Microchip:
         - lan966x:
            - add support for IS1 VCAP
            - better TX/RX from/to CPU performances
         - ksz9477: add ETS Qdisc support
         - ksz8: enhance static MAC table operations and error handling
         - sama7g5: add PTP capability
      - NXP (ocelot):
         - add support for external ports
         - add support for preemptible traffic classes
      - Texas Instruments:
         - add CPSWxG SGMII support for J7200 and J721E

   - Intel WiFi (iwlwifi):
      - preparation for Wi-Fi 7 EHT and multi-link support
      - EHT (Wi-Fi 7) sniffer support
      - hardware timestamping support for some devices/firwmares
      - TX beacon protection on newer hardware

   - Qualcomm 802.11ax WiFi (ath11k):
      - MU-MIMO parameters support
      - ack signal support for management packets

   - RealTek WiFi (rtw88):
      - SDIO bus support
      - better support for some SDIO devices (e.g. MAC address from
        efuse)

   - RealTek WiFi (rtw89):
      - HW scan support for 8852b
      - better support for 6 GHz scanning
      - support for various newer firmware APIs
      - framework firmware backwards compatibility

   - MediaTek WiFi (mt76):
      - P2P support
      - mesh A-MSDU support
      - EHT (Wi-Fi 7) support
      - coredump support"

* tag 'net-next-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (2078 commits)
  net: phy: hide the PHYLIB_LEDS knob
  net: phy: marvell-88x2222: remove unnecessary (void*) conversions
  tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.
  net: amd: Fix link leak when verifying config failed
  net: phy: marvell: Fix inconsistent indenting in led_blink_set
  lan966x: Don't use xdp_frame when action is XDP_TX
  tsnep: Add XDP socket zero-copy TX support
  tsnep: Add XDP socket zero-copy RX support
  tsnep: Move skb receive action to separate function
  tsnep: Add functions for queue enable/disable
  tsnep: Rework TX/RX queue initialization
  tsnep: Replace modulo operation with mask
  net: phy: dp83867: Add led_brightness_set support
  net: phy: Fix reading LED reg property
  drivers: nfc: nfcsim: remove return value check of `dev_dir`
  net: phy: dp83867: Remove unnecessary (void*) conversions
  net: ethtool: coalesce: try to make user settings stick twice
  net: mana: Check if netdev/napi_alloc_frag returns single page
  net: mana: Rename mana_refill_rxoob and remove some empty lines
  net: veth: add page_pool stats
  ...

Pull SCSI updates from James Bottomley:
 "Updates to the usual drivers (megaraid_sas, scsi_debug, lpfc, target,
  mpi3mr, hisi_sas, arcmsr).

  The major core change is the constification of the host templates
  (which touches everything) along with other minor fixups and clean
  ups"

* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (207 commits)
  scsi: ufs: mcq: Use pointer arithmetic in ufshcd_send_command()
  scsi: ufs: mcq: Annotate ufshcd_inc_sq_tail() appropriately
  scsi: cxlflash: s/semahpore/semaphore/
  scsi: lpfc: Silence an incorrect device output
  scsi: mpi3mr: Use IRQ save variants of spinlock to protect chain frame allocation
  scsi: scsi_debug: Fix missing error code in scsi_debug_init()
  scsi: hisi_sas: Work around build failure in suspend function
  scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()
  scsi: mpt3sas: Fix an issue when driver is being removed
  scsi: mpt3sas: Remove HBA BIOS version in the kernel log
  scsi: target: core: Fix invalid memory access
  scsi: scsi_debug: Drop sdebug_queue
  scsi: scsi_debug: Only allow sdebug_max_queue be modified when no shosts
  scsi: scsi_debug: Use scsi_host_busy() in delay_store() and ndelay_store()
  scsi: scsi_debug: Use blk_mq_tagset_busy_iter() in stop_all_queued()
  scsi: scsi_debug: Use blk_mq_tagset_busy_iter() in sdebug_blk_mq_poll()
  scsi: scsi_debug: Dynamically allocate sdebug_queued_cmd
  scsi: scsi_debug: Use scsi_block_requests() to block queues
  scsi: scsi_debug: Protect block_unblock_all_queues() with mutex
  scsi: scsi_debug: Change shost list lock to a mutex
  ...

- improved handling of battery quirk (Jason Gerecke)
- lazy initialization of battery interfaces (Jason Gerecke)

- import of bunch of HID selftests from out-of-tree hid-tools project
  (Benjamin Tissoires)

- drastically reducing Bluetooth disconnects on hid-nintendo
  driven devices (Daniel J. Ogorchock)
- proper rumble queue overrun handling (Daniel J. Ogorchock)

- generic code improvements for mcp2221 driver (Louis Morhet)

- support for ADC measurement (Bastien Nocera)
- support for Logitech G935 (Bastien Nocera)

- explicit include fixes (Thomas Weißschuh)

- generic support for all Kye tablets (David Yang)

- reset GPIO support (Hans de Goede)

- improve handling of generic "Digitizer" usage (Jason Gerecke)
- support for KEY_CAMERA_FOCUS (Feng Qi)