--- /dev/null
+From 3e1336457b4e879cdb0978fae4ff7137cb930a55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2024 11:58:52 +0100
+Subject: afs: Fix lock recursion
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 610a79ffea02102899a1373fe226d949944a7ed6 ]
+
+afs_wake_up_async_call() can incur lock recursion. The problem is that it
+is called from AF_RXRPC whilst holding the ->notify_lock, but it tries to
+take a ref on the afs_call struct in order to pass it to a work queue - but
+if the afs_call is already queued, we then have an extraneous ref that must
+be put... calling afs_put_call() may call back down into AF_RXRPC through
+rxrpc_kernel_shutdown_call(), however, which might try taking the
+->notify_lock again.
+
+This case isn't very common, however, so defer it to a workqueue. The oops
+looks something like:
+
+ BUG: spinlock recursion on CPU#0, krxrpcio/7001/1646
+ lock: 0xffff888141399b30, .magic: dead4ead, .owner: krxrpcio/7001/1646, .owner_cpu: 0
+ CPU: 0 UID: 0 PID: 1646 Comm: krxrpcio/7001 Not tainted 6.12.0-rc2-build3+ #4351
+ Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014
+ Call Trace:
+ <TASK>
+ dump_stack_lvl+0x47/0x70
+ do_raw_spin_lock+0x3c/0x90
+ rxrpc_kernel_shutdown_call+0x83/0xb0
+ afs_put_call+0xd7/0x180
+ rxrpc_notify_socket+0xa0/0x190
+ rxrpc_input_split_jumbo+0x198/0x1d0
+ rxrpc_input_data+0x14b/0x1e0
+ ? rxrpc_input_call_packet+0xc2/0x1f0
+ rxrpc_input_call_event+0xad/0x6b0
+ rxrpc_input_packet_on_conn+0x1e1/0x210
+ rxrpc_input_packet+0x3f2/0x4d0
+ rxrpc_io_thread+0x243/0x410
+ ? __pfx_rxrpc_io_thread+0x10/0x10
+ kthread+0xcf/0xe0
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork+0x24/0x40
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork_asm+0x1a/0x30
+ </TASK>
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://lore.kernel.org/r/1394602.1729162732@warthog.procyon.org.uk
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+cc: linux-fsdevel@vger.kernel.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/internal.h | 2 ++
+ fs/afs/rxrpc.c | 83 +++++++++++++++++++++++++++++++++--------------
+ 2 files changed, 61 insertions(+), 24 deletions(-)
+
+diff --git a/fs/afs/internal.h b/fs/afs/internal.h
+index b306c09808706..c9d620175e80c 100644
+--- a/fs/afs/internal.h
++++ b/fs/afs/internal.h
+@@ -130,6 +130,7 @@ struct afs_call {
+ wait_queue_head_t waitq; /* processes awaiting completion */
+ struct work_struct async_work; /* async I/O processor */
+ struct work_struct work; /* actual work processor */
++ struct work_struct free_work; /* Deferred free processor */
+ struct rxrpc_call *rxcall; /* RxRPC call handle */
+ struct rxrpc_peer *peer; /* Remote endpoint */
+ struct key *key; /* security for this call */
+@@ -1333,6 +1334,7 @@ extern int __net_init afs_open_socket(struct afs_net *);
+ extern void __net_exit afs_close_socket(struct afs_net *);
+ extern void afs_charge_preallocation(struct work_struct *);
+ extern void afs_put_call(struct afs_call *);
++void afs_deferred_put_call(struct afs_call *call);
+ void afs_make_call(struct afs_call *call, gfp_t gfp);
+ void afs_wait_for_call_to_complete(struct afs_call *call);
+ extern struct afs_call *afs_alloc_flat_call(struct afs_net *,
+diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
+index c453428f3c8ba..9f2a3bb56ec69 100644
+--- a/fs/afs/rxrpc.c
++++ b/fs/afs/rxrpc.c
+@@ -18,6 +18,7 @@
+
+ struct workqueue_struct *afs_async_calls;
+
++static void afs_deferred_free_worker(struct work_struct *work);
+ static void afs_wake_up_call_waiter(struct sock *, struct rxrpc_call *, unsigned long);
+ static void afs_wake_up_async_call(struct sock *, struct rxrpc_call *, unsigned long);
+ static void afs_process_async_call(struct work_struct *);
+@@ -149,6 +150,7 @@ static struct afs_call *afs_alloc_call(struct afs_net *net,
+ call->debug_id = atomic_inc_return(&rxrpc_debug_id);
+ refcount_set(&call->ref, 1);
+ INIT_WORK(&call->async_work, afs_process_async_call);
++ INIT_WORK(&call->free_work, afs_deferred_free_worker);
+ init_waitqueue_head(&call->waitq);
+ spin_lock_init(&call->state_lock);
+ call->iter = &call->def_iter;
+@@ -159,6 +161,36 @@ static struct afs_call *afs_alloc_call(struct afs_net *net,
+ return call;
+ }
+
++static void afs_free_call(struct afs_call *call)
++{
++ struct afs_net *net = call->net;
++ int o;
++
++ ASSERT(!work_pending(&call->async_work));
++
++ rxrpc_kernel_put_peer(call->peer);
++
++ if (call->rxcall) {
++ rxrpc_kernel_shutdown_call(net->socket, call->rxcall);
++ rxrpc_kernel_put_call(net->socket, call->rxcall);
++ call->rxcall = NULL;
++ }
++ if (call->type->destructor)
++ call->type->destructor(call);
++
++ afs_unuse_server_notime(call->net, call->server, afs_server_trace_put_call);
++ kfree(call->request);
++
++ o = atomic_read(&net->nr_outstanding_calls);
++ trace_afs_call(call->debug_id, afs_call_trace_free, 0, o,
++ __builtin_return_address(0));
++ kfree(call);
++
++ o = atomic_dec_return(&net->nr_outstanding_calls);
++ if (o == 0)
++ wake_up_var(&net->nr_outstanding_calls);
++}
++
+ /*
+ * Dispose of a reference on a call.
+ */
+@@ -173,32 +205,34 @@ void afs_put_call(struct afs_call *call)
+ o = atomic_read(&net->nr_outstanding_calls);
+ trace_afs_call(debug_id, afs_call_trace_put, r - 1, o,
+ __builtin_return_address(0));
++ if (zero)
++ afs_free_call(call);
++}
+
+- if (zero) {
+- ASSERT(!work_pending(&call->async_work));
+- ASSERT(call->type->name != NULL);
+-
+- rxrpc_kernel_put_peer(call->peer);
+-
+- if (call->rxcall) {
+- rxrpc_kernel_shutdown_call(net->socket, call->rxcall);
+- rxrpc_kernel_put_call(net->socket, call->rxcall);
+- call->rxcall = NULL;
+- }
+- if (call->type->destructor)
+- call->type->destructor(call);
++static void afs_deferred_free_worker(struct work_struct *work)
++{
++ struct afs_call *call = container_of(work, struct afs_call, free_work);
+
+- afs_unuse_server_notime(call->net, call->server, afs_server_trace_put_call);
+- kfree(call->request);
++ afs_free_call(call);
++}
+
+- trace_afs_call(call->debug_id, afs_call_trace_free, 0, o,
+- __builtin_return_address(0));
+- kfree(call);
++/*
++ * Dispose of a reference on a call, deferring the cleanup to a workqueue
++ * to avoid lock recursion.
++ */
++void afs_deferred_put_call(struct afs_call *call)
++{
++ struct afs_net *net = call->net;
++ unsigned int debug_id = call->debug_id;
++ bool zero;
++ int r, o;
+
+- o = atomic_dec_return(&net->nr_outstanding_calls);
+- if (o == 0)
+- wake_up_var(&net->nr_outstanding_calls);
+- }
++ zero = __refcount_dec_and_test(&call->ref, &r);
++ o = atomic_read(&net->nr_outstanding_calls);
++ trace_afs_call(debug_id, afs_call_trace_put, r - 1, o,
++ __builtin_return_address(0));
++ if (zero)
++ schedule_work(&call->free_work);
+ }
+
+ static struct afs_call *afs_get_call(struct afs_call *call,
+@@ -640,7 +674,8 @@ static void afs_wake_up_call_waiter(struct sock *sk, struct rxrpc_call *rxcall,
+ }
+
+ /*
+- * wake up an asynchronous call
++ * Wake up an asynchronous call. The caller is holding the call notify
++ * spinlock around this, so we can't call afs_put_call().
+ */
+ static void afs_wake_up_async_call(struct sock *sk, struct rxrpc_call *rxcall,
+ unsigned long call_user_ID)
+@@ -657,7 +692,7 @@ static void afs_wake_up_async_call(struct sock *sk, struct rxrpc_call *rxcall,
+ __builtin_return_address(0));
+
+ if (!queue_work(afs_async_calls, &call->async_work))
+- afs_put_call(call);
++ afs_deferred_put_call(call);
+ }
+ }
+
+--
+2.43.0
+
--- /dev/null
+From cd28ebd28850a4f13480612f2fbc307a1e867579 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Oct 2024 15:32:11 +0200
+Subject: ASoC: amd: yc: Add quirk for ASUS Vivobook S15 M3502RA
+
+From: Christian Heusel <christian@heusel.eu>
+
+[ Upstream commit 182fff3a2aafe4e7f3717a0be9df2fe2ed1a77de ]
+
+As reported the builtin microphone doesn't work on the ASUS Vivobook
+model S15 OLED M3502RA. Therefore add a quirk for it to make it work.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=219345
+Signed-off-by: Christian Heusel <christian@heusel.eu>
+Link: https://patch.msgid.link/20241010-bugzilla-219345-asus-vivobook-v1-1-3bb24834e2c3@heusel.eu
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/yc/acp6x-mach.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c
+index 601785ee2f0b8..275faf25e5a76 100644
+--- a/sound/soc/amd/yc/acp6x-mach.c
++++ b/sound/soc/amd/yc/acp6x-mach.c
+@@ -339,6 +339,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "M7600RE"),
+ }
+ },
++ {
++ .driver_data = &acp6x_card,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "M3502RA"),
++ }
++ },
+ {
+ .driver_data = &acp6x_card,
+ .matches = {
+--
+2.43.0
+
--- /dev/null
+From 2ef987f57c0c1fc45fd4da30162c74548cce9b35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2024 10:40:37 +0700
+Subject: ASoC: amd: yc: Fix non-functional mic on ASUS E1404FA
+
+From: Ilya Dudikov <ilyadud@mail.ru>
+
+[ Upstream commit b0867999e3282378a0b26a7ad200233044d31eca ]
+
+ASUS Vivobook E1404FA needs a quirks-table entry for the internal microphone to function properly.
+
+Signed-off-by: Ilya Dudikov <ilyadud@mail.ru>
+Link: https://patch.msgid.link/20241016034038.13481-1-ilyadud25@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/yc/acp6x-mach.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c
+index 275faf25e5a76..dc476bfb6da40 100644
+--- a/sound/soc/amd/yc/acp6x-mach.c
++++ b/sound/soc/amd/yc/acp6x-mach.c
+@@ -325,6 +325,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "M6500RC"),
+ }
+ },
++ {
++ .driver_data = &acp6x_card,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "E1404FA"),
++ }
++ },
+ {
+ .driver_data = &acp6x_card,
+ .matches = {
+--
+2.43.0
+
--- /dev/null
+From 0033290c8b3f12e34fe1dedaf9df65e2a3c61ccb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2024 00:39:38 -0700
+Subject: ASoC: codecs: Fix error handling in aw_dev_get_dsp_status function
+
+From: Zhu Jun <zhujun2@cmss.chinamobile.com>
+
+[ Upstream commit 251ce34a446ef0e1d6acd65cf5947abd5d10b8b6 ]
+
+Added proper error handling for register value check that
+return -EPERM when register value does not meet expected condition
+
+Signed-off-by: Zhu Jun <zhujun2@cmss.chinamobile.com>
+Link: https://patch.msgid.link/20241009073938.7472-1-zhujun2@cmss.chinamobile.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/aw88399.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/aw88399.c b/sound/soc/codecs/aw88399.c
+index 8dc2b8aa6832d..bba59885242d0 100644
+--- a/sound/soc/codecs/aw88399.c
++++ b/sound/soc/codecs/aw88399.c
+@@ -656,7 +656,7 @@ static int aw_dev_get_dsp_status(struct aw_device *aw_dev)
+ if (ret)
+ return ret;
+ if (!(reg_val & (~AW88399_WDT_CNT_MASK)))
+- ret = -EPERM;
++ return -EPERM;
+
+ return 0;
+ }
+--
+2.43.0
+
--- /dev/null
+From 634b71f4529ca319dd178edf70bbdc5dbb5235ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2024 23:10:49 +0100
+Subject: ASoC: codecs: lpass-rx-macro: fix RXn(rx,n) macro for DSM_CTL and
+ SEC7 regs
+
+From: Alexey Klimov <alexey.klimov@linaro.org>
+
+[ Upstream commit 9fc9ef05727ccb45fd881770f2aa5c3774b2e8e2 ]
+
+Turns out some registers of pre-2.5 version of rxmacro codecs are not
+located at the expected offsets but 0xc further away in memory. So far
+the detected registers are CDC_RX_RX2_RX_PATH_SEC7 and
+CDC_RX_RX2_RX_PATH_DSM_CTL.
+
+CDC_RX_RXn_RX_PATH_DSM_CTL(rx, n) macro incorrectly generates the address
+0x540 for RX2 but it should be 0x54C and it also overwrites
+CDC_RX_RX2_RX_PATH_SEC7 which is located at 0x540.
+The same goes for CDC_RX_RXn_RX_PATH_SEC7(rx, n).
+
+Fix this by introducing additional rxn_reg_stride2 offset. For 2.5 version
+and above this offset will be equal to 0.
+With such change the corresponding RXn() macros will generate the same
+values for 2.5 codec version for all RX paths and the same old values
+for pre-2.5 version for RX0 and RX1. However for the latter case with
+RX2 path it will also add rxn_reg_stride2 on top.
+
+While at this, also remove specific if-check for INTERP_AUX from
+rx_macro_digital_mute() and rx_macro_enable_interp_clk(). These if-check
+was used to handle such special offset for AUX interpolator but since
+CDC_RX_RXn_RX_PATH_SEC7(rx, n) and CDC_RX_RXn_RX_PATH_DSM_CTL(rx, n)
+macros will generate the correst addresses of dsm register, they are no
+longer needed.
+
+Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Cc: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://patch.msgid.link/20241016221049.1145101-1-alexey.klimov@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/lpass-rx-macro.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/sound/soc/codecs/lpass-rx-macro.c b/sound/soc/codecs/lpass-rx-macro.c
+index ac759f4a880d0..3be83c74d4099 100644
+--- a/sound/soc/codecs/lpass-rx-macro.c
++++ b/sound/soc/codecs/lpass-rx-macro.c
+@@ -202,12 +202,14 @@
+ #define CDC_RX_RXn_RX_PATH_SEC3(rx, n) (0x042c + rx->rxn_reg_stride * n)
+ #define CDC_RX_RX0_RX_PATH_SEC4 (0x0430)
+ #define CDC_RX_RX0_RX_PATH_SEC7 (0x0434)
+-#define CDC_RX_RXn_RX_PATH_SEC7(rx, n) (0x0434 + rx->rxn_reg_stride * n)
++#define CDC_RX_RXn_RX_PATH_SEC7(rx, n) \
++ (0x0434 + (rx->rxn_reg_stride * n) + ((n > 1) ? rx->rxn_reg_stride2 : 0))
+ #define CDC_RX_DSM_OUT_DELAY_SEL_MASK GENMASK(2, 0)
+ #define CDC_RX_DSM_OUT_DELAY_TWO_SAMPLE 0x2
+ #define CDC_RX_RX0_RX_PATH_MIX_SEC0 (0x0438)
+ #define CDC_RX_RX0_RX_PATH_MIX_SEC1 (0x043C)
+-#define CDC_RX_RXn_RX_PATH_DSM_CTL(rx, n) (0x0440 + rx->rxn_reg_stride * n)
++#define CDC_RX_RXn_RX_PATH_DSM_CTL(rx, n) \
++ (0x0440 + (rx->rxn_reg_stride * n) + ((n > 1) ? rx->rxn_reg_stride2 : 0))
+ #define CDC_RX_RXn_DSM_CLK_EN_MASK BIT(0)
+ #define CDC_RX_RX0_RX_PATH_DSM_CTL (0x0440)
+ #define CDC_RX_RX0_RX_PATH_DSM_DATA1 (0x0444)
+@@ -645,6 +647,7 @@ struct rx_macro {
+ int rx_mclk_cnt;
+ enum lpass_codec_version codec_version;
+ int rxn_reg_stride;
++ int rxn_reg_stride2;
+ bool is_ear_mode_on;
+ bool hph_pwr_mode;
+ bool hph_hd2_mode;
+@@ -1929,9 +1932,6 @@ static int rx_macro_digital_mute(struct snd_soc_dai *dai, int mute, int stream)
+ CDC_RX_PATH_PGA_MUTE_MASK, 0x0);
+ }
+
+- if (j == INTERP_AUX)
+- dsm_reg = CDC_RX_RXn_RX_PATH_DSM_CTL(rx, 2);
+-
+ int_mux_cfg0 = CDC_RX_INP_MUX_RX_INT0_CFG0 + j * 8;
+ int_mux_cfg1 = int_mux_cfg0 + 4;
+ int_mux_cfg0_val = snd_soc_component_read(component, int_mux_cfg0);
+@@ -2702,9 +2702,6 @@ static int rx_macro_enable_interp_clk(struct snd_soc_component *component,
+
+ main_reg = CDC_RX_RXn_RX_PATH_CTL(rx, interp_idx);
+ dsm_reg = CDC_RX_RXn_RX_PATH_DSM_CTL(rx, interp_idx);
+- if (interp_idx == INTERP_AUX)
+- dsm_reg = CDC_RX_RXn_RX_PATH_DSM_CTL(rx, 2);
+-
+ rx_cfg2_reg = CDC_RX_RXn_RX_PATH_CFG2(rx, interp_idx);
+
+ if (SND_SOC_DAPM_EVENT_ON(event)) {
+@@ -3821,6 +3818,7 @@ static int rx_macro_probe(struct platform_device *pdev)
+ case LPASS_CODEC_VERSION_2_0:
+ case LPASS_CODEC_VERSION_2_1:
+ rx->rxn_reg_stride = 0x80;
++ rx->rxn_reg_stride2 = 0xc;
+ def_count = ARRAY_SIZE(rx_defaults) + ARRAY_SIZE(rx_pre_2_5_defaults);
+ reg_defaults = kmalloc_array(def_count, sizeof(struct reg_default), GFP_KERNEL);
+ if (!reg_defaults)
+@@ -3834,6 +3832,7 @@ static int rx_macro_probe(struct platform_device *pdev)
+ case LPASS_CODEC_VERSION_2_7:
+ case LPASS_CODEC_VERSION_2_8:
+ rx->rxn_reg_stride = 0xc0;
++ rx->rxn_reg_stride2 = 0x0;
+ def_count = ARRAY_SIZE(rx_defaults) + ARRAY_SIZE(rx_2_5_defaults);
+ reg_defaults = kmalloc_array(def_count, sizeof(struct reg_default), GFP_KERNEL);
+ if (!reg_defaults)
+--
+2.43.0
+
--- /dev/null
+From 4101f6868cfa5e1d55c939452697907fdc9acfe8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2024 13:38:33 +0800
+Subject: ASoC: fsl_micfil: Add sample rate constraint
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit b9a8ecf81066e01e8a3de35517481bc5aa0439e5 ]
+
+On some platforms, for example i.MX93, there is only one
+audio PLL source, so some sample rate can't be supported.
+If the PLL source is used for 8kHz series rates, then 11kHz
+series rates can't be supported.
+
+So add constraints according to the frequency of available
+clock sources, then alsa-lib will help to convert the
+unsupported rate for the driver.
+
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://patch.msgid.link/1728884313-6778-1-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_micfil.c | 38 ++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 38 insertions(+)
+
+diff --git a/sound/soc/fsl/fsl_micfil.c b/sound/soc/fsl/fsl_micfil.c
+index a3d580b2bbf46..1ecfa1184adac 100644
+--- a/sound/soc/fsl/fsl_micfil.c
++++ b/sound/soc/fsl/fsl_micfil.c
+@@ -28,6 +28,13 @@
+
+ #define MICFIL_OSR_DEFAULT 16
+
++#define MICFIL_NUM_RATES 7
++#define MICFIL_CLK_SRC_NUM 3
++/* clock source ids */
++#define MICFIL_AUDIO_PLL1 0
++#define MICFIL_AUDIO_PLL2 1
++#define MICFIL_CLK_EXT3 2
++
+ enum quality {
+ QUALITY_HIGH,
+ QUALITY_MEDIUM,
+@@ -45,9 +52,12 @@ struct fsl_micfil {
+ struct clk *mclk;
+ struct clk *pll8k_clk;
+ struct clk *pll11k_clk;
++ struct clk *clk_src[MICFIL_CLK_SRC_NUM];
+ struct snd_dmaengine_dai_dma_data dma_params_rx;
+ struct sdma_peripheral_config sdmacfg;
+ struct snd_soc_card *card;
++ struct snd_pcm_hw_constraint_list constraint_rates;
++ unsigned int constraint_rates_list[MICFIL_NUM_RATES];
+ unsigned int dataline;
+ char name[32];
+ int irq[MICFIL_IRQ_LINES];
+@@ -475,12 +485,34 @@ static int fsl_micfil_startup(struct snd_pcm_substream *substream,
+ struct snd_soc_dai *dai)
+ {
+ struct fsl_micfil *micfil = snd_soc_dai_get_drvdata(dai);
++ unsigned int rates[MICFIL_NUM_RATES] = {8000, 11025, 16000, 22050, 32000, 44100, 48000};
++ int i, j, k = 0;
++ u64 clk_rate;
+
+ if (!micfil) {
+ dev_err(dai->dev, "micfil dai priv_data not set\n");
+ return -EINVAL;
+ }
+
++ micfil->constraint_rates.list = micfil->constraint_rates_list;
++ micfil->constraint_rates.count = 0;
++
++ for (j = 0; j < MICFIL_NUM_RATES; j++) {
++ for (i = 0; i < MICFIL_CLK_SRC_NUM; i++) {
++ clk_rate = clk_get_rate(micfil->clk_src[i]);
++ if (clk_rate != 0 && do_div(clk_rate, rates[j]) == 0) {
++ micfil->constraint_rates_list[k++] = rates[j];
++ micfil->constraint_rates.count++;
++ break;
++ }
++ }
++ }
++
++ if (micfil->constraint_rates.count > 0)
++ snd_pcm_hw_constraint_list(substream->runtime, 0,
++ SNDRV_PCM_HW_PARAM_RATE,
++ &micfil->constraint_rates);
++
+ return 0;
+ }
+
+@@ -1175,6 +1207,12 @@ static int fsl_micfil_probe(struct platform_device *pdev)
+ fsl_asoc_get_pll_clocks(&pdev->dev, &micfil->pll8k_clk,
+ &micfil->pll11k_clk);
+
++ micfil->clk_src[MICFIL_AUDIO_PLL1] = micfil->pll8k_clk;
++ micfil->clk_src[MICFIL_AUDIO_PLL2] = micfil->pll11k_clk;
++ micfil->clk_src[MICFIL_CLK_EXT3] = devm_clk_get(&pdev->dev, "clkext3");
++ if (IS_ERR(micfil->clk_src[MICFIL_CLK_EXT3]))
++ micfil->clk_src[MICFIL_CLK_EXT3] = NULL;
++
+ /* init regmap */
+ regs = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
+ if (IS_ERR(regs))
+--
+2.43.0
+
--- /dev/null
+From 77d05d30f916fd53bcdccf1393701e52e147770f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 10:37:58 +0200
+Subject: ASoC: Intel: avs: Update stream status in a separate thread
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+
+[ Upstream commit 0dbb186c3510cad4e9f443e801bf2e6ab5770c00 ]
+
+Function snd_pcm_period_elapsed() is part of sequence servicing HDAudio
+stream IRQs. It's called under Global Interrupt Enable (GIE) disabled -
+no HDAudio interrupts will be raised. At the same time, the function may
+end up calling __snd_pcm_xrun() or snd_pcm_drain_done(). On the
+avs-driver side, this translates to IPCs and as GIE is disabled, these
+will never complete successfully.
+
+Improve system stability by scheduling stream-IRQ handling in a separate
+thread.
+
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Link: https://patch.msgid.link/20241008083758.756578-1-amadeuszx.slawinski@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/avs/core.c | 3 ++-
+ sound/soc/intel/avs/pcm.c | 19 +++++++++++++++++++
+ sound/soc/intel/avs/pcm.h | 16 ++++++++++++++++
+ 3 files changed, 37 insertions(+), 1 deletion(-)
+ create mode 100644 sound/soc/intel/avs/pcm.h
+
+diff --git a/sound/soc/intel/avs/core.c b/sound/soc/intel/avs/core.c
+index f2dc82a2abc71..4d1e6c84918c6 100644
+--- a/sound/soc/intel/avs/core.c
++++ b/sound/soc/intel/avs/core.c
+@@ -28,6 +28,7 @@
+ #include "avs.h"
+ #include "cldma.h"
+ #include "messages.h"
++#include "pcm.h"
+
+ static u32 pgctl_mask = AZX_PGCTL_LSRMD_MASK;
+ module_param(pgctl_mask, uint, 0444);
+@@ -247,7 +248,7 @@ static void hdac_stream_update_pos(struct hdac_stream *stream, u64 buffer_size)
+ static void hdac_update_stream(struct hdac_bus *bus, struct hdac_stream *stream)
+ {
+ if (stream->substream) {
+- snd_pcm_period_elapsed(stream->substream);
++ avs_period_elapsed(stream->substream);
+ } else if (stream->cstream) {
+ u64 buffer_size = stream->cstream->runtime->buffer_size;
+
+diff --git a/sound/soc/intel/avs/pcm.c b/sound/soc/intel/avs/pcm.c
+index c76b86254a8b4..37b1880c81141 100644
+--- a/sound/soc/intel/avs/pcm.c
++++ b/sound/soc/intel/avs/pcm.c
+@@ -16,6 +16,7 @@
+ #include <sound/soc-component.h>
+ #include "avs.h"
+ #include "path.h"
++#include "pcm.h"
+ #include "topology.h"
+ #include "../../codecs/hda.h"
+
+@@ -30,6 +31,7 @@ struct avs_dma_data {
+ struct hdac_ext_stream *host_stream;
+ };
+
++ struct work_struct period_elapsed_work;
+ struct snd_pcm_substream *substream;
+ };
+
+@@ -56,6 +58,22 @@ avs_dai_find_path_template(struct snd_soc_dai *dai, bool is_fe, int direction)
+ return dw->priv;
+ }
+
++static void avs_period_elapsed_work(struct work_struct *work)
++{
++ struct avs_dma_data *data = container_of(work, struct avs_dma_data, period_elapsed_work);
++
++ snd_pcm_period_elapsed(data->substream);
++}
++
++void avs_period_elapsed(struct snd_pcm_substream *substream)
++{
++ struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream);
++ struct snd_soc_dai *dai = snd_soc_rtd_to_cpu(rtd, 0);
++ struct avs_dma_data *data = snd_soc_dai_get_dma_data(dai, substream);
++
++ schedule_work(&data->period_elapsed_work);
++}
++
+ static int avs_dai_startup(struct snd_pcm_substream *substream, struct snd_soc_dai *dai)
+ {
+ struct snd_soc_pcm_runtime *rtd = snd_soc_substream_to_rtd(substream);
+@@ -77,6 +95,7 @@ static int avs_dai_startup(struct snd_pcm_substream *substream, struct snd_soc_d
+ data->substream = substream;
+ data->template = template;
+ data->adev = adev;
++ INIT_WORK(&data->period_elapsed_work, avs_period_elapsed_work);
+ snd_soc_dai_set_dma_data(dai, substream, data);
+
+ if (rtd->dai_link->ignore_suspend)
+diff --git a/sound/soc/intel/avs/pcm.h b/sound/soc/intel/avs/pcm.h
+new file mode 100644
+index 0000000000000..0f3615c903982
+--- /dev/null
++++ b/sound/soc/intel/avs/pcm.h
+@@ -0,0 +1,16 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++/*
++ * Copyright(c) 2024 Intel Corporation
++ *
++ * Authors: Cezary Rojewski <cezary.rojewski@intel.com>
++ * Amadeusz Slawinski <amadeuszx.slawinski@linux.intel.com>
++ */
++
++#ifndef __SOUND_SOC_INTEL_AVS_PCM_H
++#define __SOUND_SOC_INTEL_AVS_PCM_H
++
++#include <sound/pcm.h>
++
++void avs_period_elapsed(struct snd_pcm_substream *substream);
++
++#endif
+--
+2.43.0
+
--- /dev/null
+From a1243a1e4c7483dfb4bf656da30de0ab648d1cf9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2024 11:07:03 +0800
+Subject: ASoC: Intel: soc-acpi: lnl: Add match entry for TM2 laptops
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Derek Fang <derek.fang@realtek.com>
+
+[ Upstream commit 6924565a04e5f424c95e6d894584e3059f257373 ]
+
+Add a new match table entry on Lunarlake for the TM2 laptops
+with rt713 and rt1318.
+
+Signed-off-by: Derek Fang <derek.fang@realtek.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://patch.msgid.link/20241016030703.13669-1-yung-chuan.liao@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../intel/common/soc-acpi-intel-lnl-match.c | 38 +++++++++++++++++++
+ 1 file changed, 38 insertions(+)
+
+diff --git a/sound/soc/intel/common/soc-acpi-intel-lnl-match.c b/sound/soc/intel/common/soc-acpi-intel-lnl-match.c
+index edfb668d0580d..8452b66149119 100644
+--- a/sound/soc/intel/common/soc-acpi-intel-lnl-match.c
++++ b/sound/soc/intel/common/soc-acpi-intel-lnl-match.c
+@@ -166,6 +166,15 @@ static const struct snd_soc_acpi_adr_device rt1316_3_group1_adr[] = {
+ }
+ };
+
++static const struct snd_soc_acpi_adr_device rt1318_1_adr[] = {
++ {
++ .adr = 0x000133025D131801ull,
++ .num_endpoints = 1,
++ .endpoints = &single_endpoint,
++ .name_prefix = "rt1318-1"
++ }
++};
++
+ static const struct snd_soc_acpi_adr_device rt1318_1_group1_adr[] = {
+ {
+ .adr = 0x000130025D131801ull,
+@@ -184,6 +193,15 @@ static const struct snd_soc_acpi_adr_device rt1318_2_group1_adr[] = {
+ }
+ };
+
++static const struct snd_soc_acpi_adr_device rt713_0_adr[] = {
++ {
++ .adr = 0x000031025D071301ull,
++ .num_endpoints = 1,
++ .endpoints = &single_endpoint,
++ .name_prefix = "rt713"
++ }
++};
++
+ static const struct snd_soc_acpi_adr_device rt714_0_adr[] = {
+ {
+ .adr = 0x000030025D071401ull,
+@@ -286,6 +304,20 @@ static const struct snd_soc_acpi_link_adr lnl_sdw_rt1318_l12_rt714_l0[] = {
+ {}
+ };
+
++static const struct snd_soc_acpi_link_adr lnl_sdw_rt713_l0_rt1318_l1[] = {
++ {
++ .mask = BIT(0),
++ .num_adr = ARRAY_SIZE(rt713_0_adr),
++ .adr_d = rt713_0_adr,
++ },
++ {
++ .mask = BIT(1),
++ .num_adr = ARRAY_SIZE(rt1318_1_adr),
++ .adr_d = rt1318_1_adr,
++ },
++ {}
++};
++
+ /* this table is used when there is no I2S codec present */
+ struct snd_soc_acpi_mach snd_soc_acpi_intel_lnl_sdw_machines[] = {
+ /* mockup tests need to be first */
+@@ -343,6 +375,12 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_lnl_sdw_machines[] = {
+ .drv_name = "sof_sdw",
+ .sof_tplg_filename = "sof-lnl-rt1318-l12-rt714-l0.tplg"
+ },
++ {
++ .link_mask = BIT(0) | BIT(1),
++ .links = lnl_sdw_rt713_l0_rt1318_l1,
++ .drv_name = "sof_sdw",
++ .sof_tplg_filename = "sof-lnl-rt713-l0-rt1318-l1.tplg"
++ },
+ {},
+ };
+ EXPORT_SYMBOL_GPL(snd_soc_acpi_intel_lnl_sdw_machines);
+--
+2.43.0
+
--- /dev/null
+From 73231eb100b796ce2db9ac23b2bc2f109adfbce2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2024 06:15:44 +0000
+Subject: ASoC: rt722-sdca: increase clk_stop_timeout to fix clock stop issue
+
+From: Jack Yu <jack.yu@realtek.com>
+
+[ Upstream commit 038fa6ddf5d22694f61ff7a7a53c8887c6b08c45 ]
+
+clk_stop_timeout should be increased to 900ms to fix clock stop issue.
+
+Signed-off-by: Jack Yu <jack.yu@realtek.com>
+Link: https://patch.msgid.link/cd26275d9fc54374a18dc016755cb72d@realtek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt722-sdca-sdw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/rt722-sdca-sdw.c b/sound/soc/codecs/rt722-sdca-sdw.c
+index 87354bb1564e8..d5c985ff5ac55 100644
+--- a/sound/soc/codecs/rt722-sdca-sdw.c
++++ b/sound/soc/codecs/rt722-sdca-sdw.c
+@@ -253,7 +253,7 @@ static int rt722_sdca_read_prop(struct sdw_slave *slave)
+ }
+
+ /* set the timeout values */
+- prop->clk_stop_timeout = 200;
++ prop->clk_stop_timeout = 900;
+
+ /* wake-up event */
+ prop->wake_capable = 1;
+--
+2.43.0
+
--- /dev/null
+From 732c0df5fd383726b768098c83979ccebb8c6b90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2024 00:37:42 +0000
+Subject: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx
+
+From: Zijian Zhang <zijianzhang@bytedance.com>
+
+[ Upstream commit 44d0469f79bd3d0b3433732877358df7dc6b17b1 ]
+
+As the introduction of the support for vsock and unix sockets in sockmap,
+tls_sw_has_ctx_tx/rx cannot presume the socket passed in must be IS_ICSK.
+vsock and af_unix sockets have vsock_sock and unix_sock instead of
+inet_connection_sock. For these sockets, tls_get_ctx may return an invalid
+pointer and cause page fault in function tls_sw_ctx_rx.
+
+BUG: unable to handle page fault for address: 0000000000040030
+Workqueue: vsock-loopback vsock_loopback_work
+RIP: 0010:sk_psock_strp_data_ready+0x23/0x60
+Call Trace:
+ ? __die+0x81/0xc3
+ ? no_context+0x194/0x350
+ ? do_page_fault+0x30/0x110
+ ? async_page_fault+0x3e/0x50
+ ? sk_psock_strp_data_ready+0x23/0x60
+ virtio_transport_recv_pkt+0x750/0x800
+ ? update_load_avg+0x7e/0x620
+ vsock_loopback_work+0xd0/0x100
+ process_one_work+0x1a7/0x360
+ worker_thread+0x30/0x390
+ ? create_worker+0x1a0/0x1a0
+ kthread+0x112/0x130
+ ? __kthread_cancel_work+0x40/0x40
+ ret_from_fork+0x1f/0x40
+
+v2:
+ - Add IS_ICSK check
+v3:
+ - Update the commits in Fixes
+
+Fixes: 634f1a7110b4 ("vsock: support sockmap")
+Fixes: 94531cfcbe79 ("af_unix: Add unix_stream_proto for sockmap")
+Signed-off-by: Zijian Zhang <zijianzhang@bytedance.com>
+Acked-by: Stanislav Fomichev <sdf@fomichev.me>
+Acked-by: Jakub Kicinski <kuba@kernel.org>
+Reviewed-by: Cong Wang <cong.wang@bytedance.com>
+Acked-by: Stefano Garzarella <sgarzare@redhat.com>
+Link: https://lore.kernel.org/r/20241106003742.399240-1-zijianzhang@bytedance.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/tls.h | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/tls.h b/include/net/tls.h
+index 3a33924db2bc7..61fef28801140 100644
+--- a/include/net/tls.h
++++ b/include/net/tls.h
+@@ -390,8 +390,12 @@ tls_offload_ctx_tx(const struct tls_context *tls_ctx)
+
+ static inline bool tls_sw_has_ctx_tx(const struct sock *sk)
+ {
+- struct tls_context *ctx = tls_get_ctx(sk);
++ struct tls_context *ctx;
++
++ if (!sk_is_inet(sk) || !inet_test_bit(IS_ICSK, sk))
++ return false;
+
++ ctx = tls_get_ctx(sk);
+ if (!ctx)
+ return false;
+ return !!tls_sw_ctx_tx(ctx);
+@@ -399,8 +403,12 @@ static inline bool tls_sw_has_ctx_tx(const struct sock *sk)
+
+ static inline bool tls_sw_has_ctx_rx(const struct sock *sk)
+ {
+- struct tls_context *ctx = tls_get_ctx(sk);
++ struct tls_context *ctx;
++
++ if (!sk_is_inet(sk) || !inet_test_bit(IS_ICSK, sk))
++ return false;
+
++ ctx = tls_get_ctx(sk);
+ if (!ctx)
+ return false;
+ return !!tls_sw_ctx_rx(ctx);
+--
+2.43.0
+
--- /dev/null
+From 4a9ec83a28aa89ec4299fc8cdbd37ee01cb6353c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2024 09:35:58 +0800
+Subject: bpf: Check validity of link->type in bpf_link_show_fdinfo()
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit 8421d4c8762bd022cb491f2f0f7019ef51b4f0a7 ]
+
+If a newly-added link type doesn't invoke BPF_LINK_TYPE(), accessing
+bpf_link_type_strs[link->type] may result in an out-of-bounds access.
+
+To spot such missed invocations early in the future, checking the
+validity of link->type in bpf_link_show_fdinfo() and emitting a warning
+when such invocations are missed.
+
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20241024013558.1135167-3-houtao@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/syscall.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 19b590b5aaec9..b282ed1250358 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -3136,13 +3136,17 @@ static void bpf_link_show_fdinfo(struct seq_file *m, struct file *filp)
+ {
+ const struct bpf_link *link = filp->private_data;
+ const struct bpf_prog *prog = link->prog;
++ enum bpf_link_type type = link->type;
+ char prog_tag[sizeof(prog->tag) * 2 + 1] = { };
+
+- seq_printf(m,
+- "link_type:\t%s\n"
+- "link_id:\t%u\n",
+- bpf_link_type_strs[link->type],
+- link->id);
++ if (type < ARRAY_SIZE(bpf_link_type_strs) && bpf_link_type_strs[type]) {
++ seq_printf(m, "link_type:\t%s\n", bpf_link_type_strs[type]);
++ } else {
++ WARN_ONCE(1, "missing BPF_LINK_TYPE(...) for link type %u\n", type);
++ seq_printf(m, "link_type:\t<%u>\n", type);
++ }
++ seq_printf(m, "link_id:\t%u\n", link->id);
++
+ if (prog) {
+ bin2hex(prog_tag, prog->tag, sizeof(prog->tag));
+ seq_printf(m,
+--
+2.43.0
+
--- /dev/null
+From ab3bbb39c05e00dd2ba548e5bb14acbb316288e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Nov 2024 08:18:52 +0000
+Subject: bpf: Fix mismatched RCU unlock flavour in bpf_out_neigh_v6
+
+From: Jiawei Ye <jiawei.ye@foxmail.com>
+
+[ Upstream commit fb86c42a2a5d44e849ddfbc98b8d2f4f40d36ee3 ]
+
+In the bpf_out_neigh_v6 function, rcu_read_lock() is used to begin an RCU
+read-side critical section. However, when unlocking, one branch
+incorrectly uses a different RCU unlock flavour rcu_read_unlock_bh()
+instead of rcu_read_unlock(). This mismatch in RCU locking flavours can
+lead to unexpected behavior and potential concurrency issues.
+
+This possible bug was identified using a static analysis tool developed
+by myself, specifically designed to detect RCU-related issues.
+
+This patch corrects the mismatched unlock flavour by replacing the
+incorrect rcu_read_unlock_bh() with the appropriate rcu_read_unlock(),
+ensuring that the RCU critical section is properly exited. This change
+prevents potential synchronization issues and aligns with proper RCU
+usage patterns.
+
+Fixes: 09eed1192cec ("neighbour: switch to standard rcu, instead of rcu_bh")
+Signed-off-by: Jiawei Ye <jiawei.ye@foxmail.com>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Link: https://lore.kernel.org/r/tencent_CFD3D1C3D68B45EA9F52D8EC76D2C4134306@qq.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index b2b551401bc29..fe5ac8da5022f 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -2248,7 +2248,7 @@ static int bpf_out_neigh_v6(struct net *net, struct sk_buff *skb,
+ rcu_read_unlock();
+ return ret;
+ }
+- rcu_read_unlock_bh();
++ rcu_read_unlock();
+ if (dst)
+ IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
+ out_drop:
+--
+2.43.0
+
--- /dev/null
+From 0713714fadc370b52210d1a06bc24ade218edefb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2024 12:35:55 +0200
+Subject: drm/xe: Don't restart parallel queues multiple times on GT reset
+
+From: Nirmoy Das <nirmoy.das@intel.com>
+
+[ Upstream commit cdc21021f0351226a4845715564afd5dc50ed44b ]
+
+In case of parallel submissions multiple GuC id will point to the
+same exec queue and on GT reset such exec queues will get restarted
+multiple times which is not desirable.
+
+v2: don't use exec_queue_enabled() which could race,
+ do the same for xe_guc_submit_stop (Matt B)
+
+Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2295
+Cc: Jonathan Cavitt <jonathan.cavitt@intel.com>
+Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
+Cc: Matthew Auld <matthew.auld@intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Cc: Tejas Upadhyay <tejas.upadhyay@intel.com>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241022103555.731557-1-nirmoy.das@intel.com
+Signed-off-by: Nirmoy Das <nirmoy.das@intel.com>
+(cherry picked from commit c8b0acd6d8745fd7e6450f5acc38f0227bd253b3)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_guc_submit.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
+index cbdd44567d107..792024c28da86 100644
+--- a/drivers/gpu/drm/xe/xe_guc_submit.c
++++ b/drivers/gpu/drm/xe/xe_guc_submit.c
+@@ -1771,8 +1771,13 @@ void xe_guc_submit_stop(struct xe_guc *guc)
+
+ mutex_lock(&guc->submission_state.lock);
+
+- xa_for_each(&guc->submission_state.exec_queue_lookup, index, q)
++ xa_for_each(&guc->submission_state.exec_queue_lookup, index, q) {
++ /* Prevent redundant attempts to stop parallel queues */
++ if (q->guc->id != index)
++ continue;
++
+ guc_exec_queue_stop(guc, q);
++ }
+
+ mutex_unlock(&guc->submission_state.lock);
+
+@@ -1810,8 +1815,13 @@ int xe_guc_submit_start(struct xe_guc *guc)
+
+ mutex_lock(&guc->submission_state.lock);
+ atomic_dec(&guc->submission_state.stopped);
+- xa_for_each(&guc->submission_state.exec_queue_lookup, index, q)
++ xa_for_each(&guc->submission_state.exec_queue_lookup, index, q) {
++ /* Prevent redundant attempts to start parallel queues */
++ if (q->guc->id != index)
++ continue;
++
+ guc_exec_queue_start(q);
++ }
+ mutex_unlock(&guc->submission_state.lock);
+
+ wake_up_all(&guc->ct.wq);
+--
+2.43.0
+
--- /dev/null
+From 7a6e2ac974af4db9a277c0a479c9cbb4d79645dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Oct 2024 16:12:07 +0000
+Subject: drm/xe: Enlarge the invalidation timeout from 150 to 500
+
+From: Shuicheng Lin <shuicheng.lin@intel.com>
+
+[ Upstream commit c8fb95e7a54315460b45090f0968167a332e1657 ]
+
+There are error messages like below that are occurring during stress
+testing: "[ 31.004009] xe 0000:03:00.0: [drm] ERROR GT0: Global
+invalidation timeout". Previously it was hitting this 3 out of 1000
+executions of warm reboot. After raising it to 500, 1000 warm reboot
+executions passed and it didn't fail.
+
+Due to the way xe_mmio_wait32() is implemented, the timeout is able to
+expire early when the register matches the expected value due to the
+wait increments starting small. So, the larger timeout value should have
+no effect during normal use cases.
+
+v2 (Jonathan):
+ - rework the commit message
+v3 (Lucas):
+ - add conclusive message for the fail rate and test case
+v4:
+ - add suggested-by
+
+Suggested-by: Jia Yao <jia.yao@intel.com>
+Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
+Cc: Lucas De Marchi <lucas.demarchi@intel.com>
+Cc: Matthew Auld <matthew.auld@intel.com>
+Cc: Nirmoy Das <nirmoy.das@intel.com>
+Reviewed-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
+Tested-by: Zongyao Bai <zongyao.bai@intel.com>
+Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
+Signed-off-by: Matthew Auld <matthew.auld@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241015161207.1373401-1-shuicheng.lin@intel.com
+(cherry picked from commit 2eb460ab9f4bc5b575f52568d17936da0af681d8)
+[ Fix conflict with gt->mmio ]
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_device.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_device.c b/drivers/gpu/drm/xe/xe_device.c
+index fb394189d9e23..13213f39e52f9 100644
+--- a/drivers/gpu/drm/xe/xe_device.c
++++ b/drivers/gpu/drm/xe/xe_device.c
+@@ -870,7 +870,7 @@ void xe_device_l2_flush(struct xe_device *xe)
+ spin_lock(>->global_invl_lock);
+ xe_mmio_write32(gt, XE2_GLOBAL_INVAL, 0x1);
+
+- if (xe_mmio_wait32(gt, XE2_GLOBAL_INVAL, 0x1, 0x0, 150, NULL, true))
++ if (xe_mmio_wait32(gt, XE2_GLOBAL_INVAL, 0x1, 0x0, 500, NULL, true))
+ xe_gt_err_once(gt, "Global invalidation timeout\n");
+ spin_unlock(>->global_invl_lock);
+
+--
+2.43.0
+
--- /dev/null
+From b13f3b3fae2bbbf169a173dca10d7b7b28e7da25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2024 16:44:10 +0530
+Subject: drm/xe/guc/ct: Flush g2h worker in case of g2h response timeout
+
+From: Badal Nilawar <badal.nilawar@intel.com>
+
+[ Upstream commit 22ef43c78647dd37b0dafe2182b8650b99dbbe59 ]
+
+In case if g2h worker doesn't get opportunity to within specified
+timeout delay then flush the g2h worker explicitly.
+
+v2:
+ - Describe change in the comment and add TODO (Matt B/John H)
+ - Add xe_gt_warn on fence done after G2H flush (John H)
+v3:
+ - Updated the comment with root cause
+ - Clean up xe_gt_warn message (John H)
+
+Closes: https://gitlab.freedesktop.org/drm/xe/kernel/issues/1620
+Closes: https://gitlab.freedesktop.org/drm/xe/kernel/issues/2902
+Signed-off-by: Badal Nilawar <badal.nilawar@intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Cc: Matthew Auld <matthew.auld@intel.com>
+Cc: John Harrison <John.C.Harrison@Intel.com>
+Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
+Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
+Acked-by: Matthew Brost <matthew.brost@intel.com>
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241017111410.2553784-2-badal.nilawar@intel.com
+(cherry picked from commit e5152723380404acb8175e0777b1cea57f319a01)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_guc_ct.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/xe_guc_ct.c b/drivers/gpu/drm/xe/xe_guc_ct.c
+index 12e1fe6a8da28..1e8bb8b28a23e 100644
+--- a/drivers/gpu/drm/xe/xe_guc_ct.c
++++ b/drivers/gpu/drm/xe/xe_guc_ct.c
+@@ -897,6 +897,24 @@ static int guc_ct_send_recv(struct xe_guc_ct *ct, const u32 *action, u32 len,
+ }
+ }
+
++ /*
++ * Occasionally it is seen that the G2H worker starts running after a delay of more than
++ * a second even after being queued and activated by the Linux workqueue subsystem. This
++ * leads to G2H timeout error. The root cause of issue lies with scheduling latency of
++ * Lunarlake Hybrid CPU. Issue dissappears if we disable Lunarlake atom cores from BIOS
++ * and this is beyond xe kmd.
++ *
++ * TODO: Drop this change once workqueue scheduling delay issue is fixed on LNL Hybrid CPU.
++ */
++ if (!ret) {
++ flush_work(&ct->g2h_worker);
++ if (g2h_fence.done) {
++ xe_gt_warn(gt, "G2H fence %u, action %04x, done\n",
++ g2h_fence.seqno, action[0]);
++ ret = 1;
++ }
++ }
++
+ /*
+ * Ensure we serialize with completion side to prevent UAF with fence going out of scope on
+ * the stack, since we have no clue if it will fire after the timeout before we can erase
+--
+2.43.0
+
--- /dev/null
+From fde7df4e95b9569fd290013b6186f0b5010fd50d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2024 22:15:47 +0000
+Subject: drm/xe: Handle unreliable MMIO reads during forcewake
+
+From: Shuicheng Lin <shuicheng.lin@intel.com>
+
+[ Upstream commit 69418db678567bdf9a4992c83d448da462ffa78c ]
+
+In some cases, when the driver attempts to read an MMIO register,
+the hardware may return 0xFFFFFFFF. The current force wake path
+code treats this as a valid response, as it only checks the BIT.
+However, 0xFFFFFFFF should be considered an invalid value, indicating
+a potential issue. To address this, we should add a log entry to
+highlight this condition and return failure.
+The force wake failure log level is changed from notice to err
+to match the failure return value.
+
+v2 (Matt Brost):
+ - set ret value (-EIO) to kick the error to upper layers
+v3 (Rodrigo):
+ - add commit message for the log level promotion from notice to err
+v4:
+ - update reviewed info
+
+Suggested-by: Alex Zuo <alex.zuo@intel.com>
+Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Cc: Michal Wajdeczko <michal.wajdeczko@intel.com>
+Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
+Acked-by: Badal Nilawar <badal.nilawar@intel.com>
+Cc: Anshuman Gupta <anshuman.gupta@intel.com>
+Cc: Matt Roper <matthew.d.roper@intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241017221547.1564029-1-shuicheng.lin@intel.com
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+(cherry picked from commit a9fbeabe7226a3bf90f82d0e28a02c18e3c67447)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_force_wake.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_force_wake.c b/drivers/gpu/drm/xe/xe_force_wake.c
+index b263fff152737..7d9fc489dcb81 100644
+--- a/drivers/gpu/drm/xe/xe_force_wake.c
++++ b/drivers/gpu/drm/xe/xe_force_wake.c
+@@ -115,9 +115,15 @@ static int __domain_wait(struct xe_gt *gt, struct xe_force_wake_domain *domain,
+ XE_FORCE_WAKE_ACK_TIMEOUT_MS * USEC_PER_MSEC,
+ &value, true);
+ if (ret)
+- xe_gt_notice(gt, "Force wake domain %d failed to ack %s (%pe) reg[%#x] = %#x\n",
+- domain->id, str_wake_sleep(wake), ERR_PTR(ret),
+- domain->reg_ack.addr, value);
++ xe_gt_err(gt, "Force wake domain %d failed to ack %s (%pe) reg[%#x] = %#x\n",
++ domain->id, str_wake_sleep(wake), ERR_PTR(ret),
++ domain->reg_ack.addr, value);
++ if (value == ~0) {
++ xe_gt_err(gt,
++ "Force wake domain %d: %s. MMIO unreliable (forcewake register returns 0xFFFFFFFF)!\n",
++ domain->id, str_wake_sleep(wake));
++ ret = -EIO;
++ }
+
+ return ret;
+ }
+--
+2.43.0
+
--- /dev/null
+From 035c3926fabf10689cb99170abb11d8f202f9730 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2024 10:23:03 +0200
+Subject: drm/xe/ufence: Prefetch ufence addr to catch bogus address
+
+From: Nirmoy Das <nirmoy.das@intel.com>
+
+[ Upstream commit 9c1813b3253480b30604c680026c7dc721ce86d1 ]
+
+access_ok() only checks for addr overflow so also try to read the addr
+to catch invalid addr sent from userspace.
+
+Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/1630
+Cc: Francois Dugast <francois.dugast@intel.com>
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Matthew Auld <matthew.auld@intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241016082304.66009-2-nirmoy.das@intel.com
+Signed-off-by: Nirmoy Das <nirmoy.das@intel.com>
+(cherry picked from commit 9408c4508483ffc60811e910a93d6425b8e63928)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_sync.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_sync.c b/drivers/gpu/drm/xe/xe_sync.c
+index de80c8b7c8913..9d77f2d4096f5 100644
+--- a/drivers/gpu/drm/xe/xe_sync.c
++++ b/drivers/gpu/drm/xe/xe_sync.c
+@@ -54,8 +54,9 @@ static struct xe_user_fence *user_fence_create(struct xe_device *xe, u64 addr,
+ {
+ struct xe_user_fence *ufence;
+ u64 __user *ptr = u64_to_user_ptr(addr);
++ u64 __maybe_unused prefetch_val;
+
+- if (!access_ok(ptr, sizeof(*ptr)))
++ if (get_user(prefetch_val, ptr))
+ return ERR_PTR(-EFAULT);
+
+ ufence = kzalloc(sizeof(*ufence), GFP_KERNEL);
+--
+2.43.0
+
--- /dev/null
+From 9e17649e51db8f3b3e617e99a6832b5b2d5b6ac0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2024 14:05:51 +0200
+Subject: fs: Fix uninitialized value issue in from_kuid and from_kgid
+
+From: Alessandro Zanni <alessandro.zanni87@gmail.com>
+
+[ Upstream commit 15f34347481648a567db67fb473c23befb796af5 ]
+
+ocfs2_setattr() uses attr->ia_mode, attr->ia_uid and attr->ia_gid in
+a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set.
+
+Initialize all fields of newattrs to avoid uninitialized variables, by
+checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0.
+
+Reported-by: syzbot+6c55f725d1bdc8c52058@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=6c55f725d1bdc8c52058
+Signed-off-by: Alessandro Zanni <alessandro.zanni87@gmail.com>
+Link: https://lore.kernel.org/r/20241017120553.55331-1-alessandro.zanni87@gmail.com
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/file.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
+index 02d2beb7ddb95..c6d0d17a759c1 100644
+--- a/fs/ocfs2/file.c
++++ b/fs/ocfs2/file.c
+@@ -1128,9 +1128,12 @@ int ocfs2_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
+ trace_ocfs2_setattr(inode, dentry,
+ (unsigned long long)OCFS2_I(inode)->ip_blkno,
+ dentry->d_name.len, dentry->d_name.name,
+- attr->ia_valid, attr->ia_mode,
+- from_kuid(&init_user_ns, attr->ia_uid),
+- from_kgid(&init_user_ns, attr->ia_gid));
++ attr->ia_valid,
++ attr->ia_valid & ATTR_MODE ? attr->ia_mode : 0,
++ attr->ia_valid & ATTR_UID ?
++ from_kuid(&init_user_ns, attr->ia_uid) : 0,
++ attr->ia_valid & ATTR_GID ?
++ from_kgid(&init_user_ns, attr->ia_gid) : 0);
+
+ /* ensuring we don't even attempt to truncate a symlink */
+ if (S_ISLNK(inode->i_mode))
+--
+2.43.0
+
--- /dev/null
+From 89282be1c7ffa686db1fa39c7d7b0edd1e2a948b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2024 00:25:42 +0200
+Subject: HID: i2c-hid: Delayed i2c resume wakeup for 0x0d42 Goodix touchpad
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bartłomiej Maryńczak <marynczakbartlomiej@gmail.com>
+
+[ Upstream commit 293c485cbac2607595fdaae2b1fb390fc7b2d014 ]
+
+Patch for Goodix 27c6:0d42 touchpads found in Inspiron 5515 laptops.
+
+After resume from suspend, one can communicate with this device just fine.
+We can read data from it or request a reset,
+but for some reason the interrupt line will not go up
+when new events are available.
+(it can correctly respond to a reset with an interrupt tho)
+
+The only way I found to wake this device up
+is to send anything to it after ~1.5s mark,
+for example a simple read request, or power mode change.
+
+In this patch, I simply delay the resume steps with msleep,
+this will cause the set_power request to happen after
+the ~1.5s barrier causing the device to resume its event interrupts.
+
+Sleep was used rather than delayed_work
+to make this workaround as non-invasive as possible.
+
+[jkosina@suse.com: shortlog update]
+Signed-off-by: Bartłomiej Maryńczak <marynczakbartlomiej@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/i2c-hid/i2c-hid-core.c | 10 ++++++++++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 8a991b30e3c6d..25f96494700d8 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -509,6 +509,7 @@
+ #define I2C_DEVICE_ID_GOODIX_01E8 0x01e8
+ #define I2C_DEVICE_ID_GOODIX_01E9 0x01e9
+ #define I2C_DEVICE_ID_GOODIX_01F0 0x01f0
++#define I2C_DEVICE_ID_GOODIX_0D42 0x0d42
+
+ #define USB_VENDOR_ID_GOODTOUCH 0x1aad
+ #define USB_DEVICE_ID_GOODTOUCH_000f 0x000f
+diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
+index 2f8a9d3f1e861..8914c7db94718 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-core.c
++++ b/drivers/hid/i2c-hid/i2c-hid-core.c
+@@ -50,6 +50,7 @@
+ #define I2C_HID_QUIRK_BAD_INPUT_SIZE BIT(3)
+ #define I2C_HID_QUIRK_NO_WAKEUP_AFTER_RESET BIT(4)
+ #define I2C_HID_QUIRK_NO_SLEEP_ON_SUSPEND BIT(5)
++#define I2C_HID_QUIRK_DELAY_WAKEUP_AFTER_RESUME BIT(6)
+
+ /* Command opcodes */
+ #define I2C_HID_OPCODE_RESET 0x01
+@@ -140,6 +141,8 @@ static const struct i2c_hid_quirks {
+ { USB_VENDOR_ID_ELAN, HID_ANY_ID,
+ I2C_HID_QUIRK_NO_WAKEUP_AFTER_RESET |
+ I2C_HID_QUIRK_BOGUS_IRQ },
++ { I2C_VENDOR_ID_GOODIX, I2C_DEVICE_ID_GOODIX_0D42,
++ I2C_HID_QUIRK_DELAY_WAKEUP_AFTER_RESUME },
+ { 0, 0 }
+ };
+
+@@ -981,6 +984,13 @@ static int i2c_hid_core_resume(struct i2c_hid *ihid)
+ return -ENXIO;
+ }
+
++ /* On Goodix 27c6:0d42 wait extra time before device wakeup.
++ * It's not clear why but if we send wakeup too early, the device will
++ * never trigger input interrupts.
++ */
++ if (ihid->quirks & I2C_HID_QUIRK_DELAY_WAKEUP_AFTER_RESUME)
++ msleep(1500);
++
+ /* Instead of resetting device, simply powers the device on. This
+ * solves "incomplete reports" on Raydium devices 2386:3118 and
+ * 2386:4B33 and fixes various SIS touchscreens no longer sending
+--
+2.43.0
+
--- /dev/null
+From 67fc3450db9146f9940be73158305623ae346a6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Oct 2024 11:45:12 +0200
+Subject: HID: lenovo: Add support for Thinkpad X1 Tablet Gen 3 keyboard
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 51268879eb2bfc563a91cdce69362d9dbf707e7e ]
+
+The Thinkpad X1 Tablet Gen 3 keyboard has the same Lenovo specific quirks
+as the original Thinkpad X1 Tablet keyboard.
+
+Add the PID for the "Thinkpad X1 Tablet Gen 3 keyboard" to the hid-lenovo
+driver to fix the FnLock, Mute and media buttons not working.
+
+Suggested-by: Izhar Firdaus <izhar@fedoraproject.org>
+Closes https://bugzilla.redhat.com/show_bug.cgi?id=2315395
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-lenovo.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c
+index e5e72aa5260a9..24654c7ecb04e 100644
+--- a/drivers/hid/hid-lenovo.c
++++ b/drivers/hid/hid-lenovo.c
+@@ -473,6 +473,7 @@ static int lenovo_input_mapping(struct hid_device *hdev,
+ return lenovo_input_mapping_tp10_ultrabook_kbd(hdev, hi, field,
+ usage, bit, max);
+ case USB_DEVICE_ID_LENOVO_X1_TAB:
++ case USB_DEVICE_ID_LENOVO_X1_TAB3:
+ return lenovo_input_mapping_x1_tab_kbd(hdev, hi, field, usage, bit, max);
+ default:
+ return 0;
+@@ -583,6 +584,7 @@ static ssize_t attr_fn_lock_store(struct device *dev,
+ break;
+ case USB_DEVICE_ID_LENOVO_TP10UBKBD:
+ case USB_DEVICE_ID_LENOVO_X1_TAB:
++ case USB_DEVICE_ID_LENOVO_X1_TAB3:
+ ret = lenovo_led_set_tp10ubkbd(hdev, TP10UBKBD_FN_LOCK_LED, value);
+ if (ret)
+ return ret;
+@@ -776,6 +778,7 @@ static int lenovo_event(struct hid_device *hdev, struct hid_field *field,
+ return lenovo_event_cptkbd(hdev, field, usage, value);
+ case USB_DEVICE_ID_LENOVO_TP10UBKBD:
+ case USB_DEVICE_ID_LENOVO_X1_TAB:
++ case USB_DEVICE_ID_LENOVO_X1_TAB3:
+ return lenovo_event_tp10ubkbd(hdev, field, usage, value);
+ default:
+ return 0;
+@@ -1056,6 +1059,7 @@ static int lenovo_led_brightness_set(struct led_classdev *led_cdev,
+ break;
+ case USB_DEVICE_ID_LENOVO_TP10UBKBD:
+ case USB_DEVICE_ID_LENOVO_X1_TAB:
++ case USB_DEVICE_ID_LENOVO_X1_TAB3:
+ ret = lenovo_led_set_tp10ubkbd(hdev, tp10ubkbd_led[led_nr], value);
+ break;
+ }
+@@ -1286,6 +1290,7 @@ static int lenovo_probe(struct hid_device *hdev,
+ break;
+ case USB_DEVICE_ID_LENOVO_TP10UBKBD:
+ case USB_DEVICE_ID_LENOVO_X1_TAB:
++ case USB_DEVICE_ID_LENOVO_X1_TAB3:
+ ret = lenovo_probe_tp10ubkbd(hdev);
+ break;
+ default:
+@@ -1372,6 +1377,7 @@ static void lenovo_remove(struct hid_device *hdev)
+ break;
+ case USB_DEVICE_ID_LENOVO_TP10UBKBD:
+ case USB_DEVICE_ID_LENOVO_X1_TAB:
++ case USB_DEVICE_ID_LENOVO_X1_TAB3:
+ lenovo_remove_tp10ubkbd(hdev);
+ break;
+ }
+@@ -1421,6 +1427,8 @@ static const struct hid_device_id lenovo_devices[] = {
+ */
+ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+ USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X1_TAB) },
++ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
++ USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X1_TAB3) },
+ { }
+ };
+
+--
+2.43.0
+
--- /dev/null
+From 3b87252fc5d2b8602e834147d3d8469963b66710 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2024 10:24:29 -0700
+Subject: HID: multitouch: Add quirk for Logitech Bolt receiver w/ Casa
+ touchpad
+
+From: Kenneth Albanowski <kenalba@chromium.org>
+
+[ Upstream commit 526748b925185e95f1415900ee13c2469d4b64cc ]
+
+The Logitech Casa Touchpad does not reliably send touch release signals
+when communicating through the Logitech Bolt wireless-to-USB receiver.
+
+Adjusting the device class to add MT_QUIRK_NOT_SEEN_MEANS_UP to make
+sure that no touches become stuck, MT_QUIRK_FORCE_MULTI_INPUT is not
+needed, but harmless.
+
+Linux does not have information on which devices are connected to the
+Bolt receiver, so we have to enable this for the entire device.
+
+Signed-off-by: Kenneth Albanowski <kenalba@chromium.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-multitouch.c | 4 ++++
+ 2 files changed, 5 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 25f96494700d8..92cff3f2658cf 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -869,6 +869,7 @@
+ #define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1 0xc539
+ #define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_LIGHTSPEED_1_1 0xc53f
+ #define USB_DEVICE_ID_LOGITECH_NANO_RECEIVER_POWERPLAY 0xc53a
++#define USB_DEVICE_ID_LOGITECH_BOLT_RECEIVER 0xc548
+ #define USB_DEVICE_ID_SPACETRAVELLER 0xc623
+ #define USB_DEVICE_ID_SPACENAVIGATOR 0xc626
+ #define USB_DEVICE_ID_DINOVO_DESKTOP 0xc704
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 871d7417824b8..24da739647635 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -2137,6 +2137,10 @@ static const struct hid_device_id mt_devices[] = {
+ HID_DEVICE(BUS_BLUETOOTH, HID_GROUP_MULTITOUCH_WIN_8,
+ USB_VENDOR_ID_LOGITECH,
+ USB_DEVICE_ID_LOGITECH_CASA_TOUCHPAD) },
++ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU,
++ HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8,
++ USB_VENDOR_ID_LOGITECH,
++ USB_DEVICE_ID_LOGITECH_BOLT_RECEIVER) },
+
+ /* MosArt panels */
+ { .driver_data = MT_CLS_CONFIDENCE_MINUS_ONE,
+--
+2.43.0
+
--- /dev/null
+From b63e5757bb41a6fff846b116104a3c9b7770eabc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2024 22:15:44 +0800
+Subject: LoongArch: KVM: Mark hrtimer to expire in hard interrupt context
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit 73adbd92f3223dc0c3506822b71c6b259d5d537b ]
+
+Like commit 2c0d278f3293f ("KVM: LAPIC: Mark hrtimer to expire in hard
+interrupt context") and commit 9090825fa9974 ("KVM: arm/arm64: Let the
+timer expire in hardirq context on RT"), On PREEMPT_RT enabled kernels
+unmarked hrtimers are moved into soft interrupt expiry mode by default.
+Then the timers are canceled from an preempt-notifier which is invoked
+with disabled preemption which is not allowed on PREEMPT_RT.
+
+The timer callback is short so in could be invoked in hard-IRQ context.
+So let the timer expire on hard-IRQ context even on -RT.
+
+This fix a "scheduling while atomic" bug for PREEMPT_RT enabled kernels:
+
+ BUG: scheduling while atomic: qemu-system-loo/1011/0x00000002
+ Modules linked in: amdgpu rfkill nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat ns
+ CPU: 1 UID: 0 PID: 1011 Comm: qemu-system-loo Tainted: G W 6.12.0-rc2+ #1774
+ Tainted: [W]=WARN
+ Hardware name: Loongson Loongson-3A5000-7A1000-1w-CRB/Loongson-LS3A5000-7A1000-1w-CRB, BIOS vUDK2018-LoongArch-V2.0.0-prebeta9 10/21/2022
+ Stack : ffffffffffffffff 0000000000000000 9000000004e3ea38 9000000116744000
+ 90000001167475a0 0000000000000000 90000001167475a8 9000000005644830
+ 90000000058dc000 90000000058dbff8 9000000116747420 0000000000000001
+ 0000000000000001 6a613fc938313980 000000000790c000 90000001001c1140
+ 00000000000003fe 0000000000000001 000000000000000d 0000000000000003
+ 0000000000000030 00000000000003f3 000000000790c000 9000000116747830
+ 90000000057ef000 0000000000000000 9000000005644830 0000000000000004
+ 0000000000000000 90000000057f4b58 0000000000000001 9000000116747868
+ 900000000451b600 9000000005644830 9000000003a13998 0000000010000020
+ 00000000000000b0 0000000000000004 0000000000000000 0000000000071c1d
+ ...
+ Call Trace:
+ [<9000000003a13998>] show_stack+0x38/0x180
+ [<9000000004e3ea34>] dump_stack_lvl+0x84/0xc0
+ [<9000000003a71708>] __schedule_bug+0x48/0x60
+ [<9000000004e45734>] __schedule+0x1114/0x1660
+ [<9000000004e46040>] schedule_rtlock+0x20/0x60
+ [<9000000004e4e330>] rtlock_slowlock_locked+0x3f0/0x10a0
+ [<9000000004e4f038>] rt_spin_lock+0x58/0x80
+ [<9000000003b02d68>] hrtimer_cancel_wait_running+0x68/0xc0
+ [<9000000003b02e30>] hrtimer_cancel+0x70/0x80
+ [<ffff80000235eb70>] kvm_restore_timer+0x50/0x1a0 [kvm]
+ [<ffff8000023616c8>] kvm_arch_vcpu_load+0x68/0x2a0 [kvm]
+ [<ffff80000234c2d4>] kvm_sched_in+0x34/0x60 [kvm]
+ [<9000000003a749a0>] finish_task_switch.isra.0+0x140/0x2e0
+ [<9000000004e44a70>] __schedule+0x450/0x1660
+ [<9000000004e45cb0>] schedule+0x30/0x180
+ [<ffff800002354c70>] kvm_vcpu_block+0x70/0x120 [kvm]
+ [<ffff800002354d80>] kvm_vcpu_halt+0x60/0x3e0 [kvm]
+ [<ffff80000235b194>] kvm_handle_gspr+0x3f4/0x4e0 [kvm]
+ [<ffff80000235f548>] kvm_handle_exit+0x1c8/0x260 [kvm]
+
+Reviewed-by: Bibo Mao <maobibo@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/kvm/timer.c | 7 ++++---
+ arch/loongarch/kvm/vcpu.c | 2 +-
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/arch/loongarch/kvm/timer.c b/arch/loongarch/kvm/timer.c
+index 74a4b5c272d60..32dc213374bea 100644
+--- a/arch/loongarch/kvm/timer.c
++++ b/arch/loongarch/kvm/timer.c
+@@ -161,10 +161,11 @@ static void _kvm_save_timer(struct kvm_vcpu *vcpu)
+ if (kvm_vcpu_is_blocking(vcpu)) {
+
+ /*
+- * HRTIMER_MODE_PINNED is suggested since vcpu may run in
+- * the same physical cpu in next time
++ * HRTIMER_MODE_PINNED_HARD is suggested since vcpu may run in
++ * the same physical cpu in next time, and the timer should run
++ * in hardirq context even in the PREEMPT_RT case.
+ */
+- hrtimer_start(&vcpu->arch.swtimer, expire, HRTIMER_MODE_ABS_PINNED);
++ hrtimer_start(&vcpu->arch.swtimer, expire, HRTIMER_MODE_ABS_PINNED_HARD);
+ }
+ }
+
+diff --git a/arch/loongarch/kvm/vcpu.c b/arch/loongarch/kvm/vcpu.c
+index 6905283f535b9..9218fc521c22d 100644
+--- a/arch/loongarch/kvm/vcpu.c
++++ b/arch/loongarch/kvm/vcpu.c
+@@ -1144,7 +1144,7 @@ int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu)
+ vcpu->arch.vpid = 0;
+ vcpu->arch.flush_gpa = INVALID_GPA;
+
+- hrtimer_init(&vcpu->arch.swtimer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS_PINNED);
++ hrtimer_init(&vcpu->arch.swtimer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS_PINNED_HARD);
+ vcpu->arch.swtimer.function = kvm_swtimer_wakeup;
+
+ vcpu->arch.handle_exit = kvm_handle_exit;
+--
+2.43.0
+
--- /dev/null
+From b634b8952bb2ca0772da3871119a22ee1dcbabe6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2024 22:11:18 +0800
+Subject: LoongArch: Use "Exception return address" to comment ERA
+
+From: Yanteng Si <siyanteng@cqsoftware.com.cn>
+
+[ Upstream commit b69269c870ece1bc7d2e3e39ca76f4602f2cb0dd ]
+
+The information contained in the comment for LOONGARCH_CSR_ERA is even
+less informative than the macro itself, which can cause confusion for
+junior developers. Let's use the full English term.
+
+Signed-off-by: Yanteng Si <siyanteng@cqsoftware.com.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/include/asm/loongarch.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/loongarch/include/asm/loongarch.h b/arch/loongarch/include/asm/loongarch.h
+index 04a78010fc725..ab6985d9e49f0 100644
+--- a/arch/loongarch/include/asm/loongarch.h
++++ b/arch/loongarch/include/asm/loongarch.h
+@@ -256,7 +256,7 @@
+ #define CSR_ESTAT_IS_WIDTH 14
+ #define CSR_ESTAT_IS (_ULCAST_(0x3fff) << CSR_ESTAT_IS_SHIFT)
+
+-#define LOONGARCH_CSR_ERA 0x6 /* ERA */
++#define LOONGARCH_CSR_ERA 0x6 /* Exception return address */
+
+ #define LOONGARCH_CSR_BADV 0x7 /* Bad virtual address */
+
+--
+2.43.0
+
--- /dev/null
+From 1e57699bf194fea776096a698e737ecefd5a7ac6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2024 22:52:55 +0200
+Subject: net: usb: qmi_wwan: add Fibocom FG132 0x0112 composition
+
+From: Reinhard Speyerer <rspmn@arcor.de>
+
+[ Upstream commit 64761c980cbf71fb7a532a8c7299907ea972a88c ]
+
+Add Fibocom FG132 0x0112 composition:
+
+T: Bus=03 Lev=02 Prnt=06 Port=01 Cnt=02 Dev#= 10 Spd=12 MxCh= 0
+D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=2cb7 ProdID=0112 Rev= 5.15
+S: Manufacturer=Fibocom Wireless Inc.
+S: Product=Fibocom Module
+S: SerialNumber=xxxxxxxx
+C:* #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
+E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
+E: Ad=81(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=01(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=83(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=84(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=03(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=86(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=04(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+
+Signed-off-by: Reinhard Speyerer <rspmn@arcor.de>
+
+Link: https://patch.msgid.link/ZxLKp5YZDy-OM0-e@arcor.de
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/qmi_wwan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 4823dbdf54656..f137c82f1c0f7 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1426,6 +1426,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)}, /* Quectel BG96 */
+ {QMI_QUIRK_SET_DTR(0x2c7c, 0x030e, 4)}, /* Quectel EM05GV2 */
+ {QMI_QUIRK_SET_DTR(0x2cb7, 0x0104, 4)}, /* Fibocom NL678 series */
++ {QMI_QUIRK_SET_DTR(0x2cb7, 0x0112, 0)}, /* Fibocom FG132 */
+ {QMI_FIXED_INTF(0x0489, 0xe0b4, 0)}, /* Foxconn T77W968 LTE */
+ {QMI_FIXED_INTF(0x0489, 0xe0b5, 0)}, /* Foxconn T77W968 LTE with eSIM support*/
+ {QMI_FIXED_INTF(0x2692, 0x9025, 4)}, /* Cellient MPL200 (rebranded Qualcomm 05c6:9025) */
+--
+2.43.0
+
--- /dev/null
+From 0745bbe17bfe17f2696d4d6436dc344aede6a630 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2024 17:28:33 +0100
+Subject: netfs: Downgrade i_rwsem for a buffered write
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit d6a77668a708f0b5ca6713b39c178c9d9563c35b ]
+
+In the I/O locking code borrowed from NFS into netfslib, i_rwsem is held
+locked across a buffered write - but this causes a performance regression
+in cifs as it excludes buffered reads for the duration (cifs didn't use any
+locking for buffered reads).
+
+Mitigate this somewhat by downgrading the i_rwsem to a read lock across the
+buffered write. This at least allows parallel reads to occur whilst
+excluding other writes, DIO, truncate and setattr.
+
+Note that this shouldn't be a problem for a buffered write as a read
+through an mmap can circumvent i_rwsem anyway.
+
+Also note that we might want to make this change in NFS also.
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://lore.kernel.org/r/1317958.1729096113@warthog.procyon.org.uk
+cc: Steve French <sfrench@samba.org>
+cc: Paulo Alcantara <pc@manguebit.com>
+cc: Trond Myklebust <trondmy@kernel.org>
+cc: Jeff Layton <jlayton@kernel.org>
+cc: netfs@lists.linux.dev
+cc: linux-cifs@vger.kernel.org
+cc: linux-nfs@vger.kernel.org
+cc: linux-fsdevel@vger.kernel.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/netfs/locking.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/netfs/locking.c b/fs/netfs/locking.c
+index 75dc52a49b3a4..709a6aa101028 100644
+--- a/fs/netfs/locking.c
++++ b/fs/netfs/locking.c
+@@ -121,6 +121,7 @@ int netfs_start_io_write(struct inode *inode)
+ up_write(&inode->i_rwsem);
+ return -ERESTARTSYS;
+ }
++ downgrade_write(&inode->i_rwsem);
+ return 0;
+ }
+ EXPORT_SYMBOL(netfs_start_io_write);
+@@ -135,7 +136,7 @@ EXPORT_SYMBOL(netfs_start_io_write);
+ void netfs_end_io_write(struct inode *inode)
+ __releases(inode->i_rwsem)
+ {
+- up_write(&inode->i_rwsem);
++ up_read(&inode->i_rwsem);
+ }
+ EXPORT_SYMBOL(netfs_end_io_write);
+
+--
+2.43.0
+
--- /dev/null
+From 6000a1a00d5fd05d935adf0019db91c4628caf65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Sep 2024 00:01:26 +0800
+Subject: RISCV: KVM: use raw_spinlock for critical section in imsic
+
+From: Cyan Yang <cyan.yang@sifive.com>
+
+[ Upstream commit 3ec4350d4efb5ccb6bd0e11d9cf7f2be4f47297d ]
+
+For the external interrupt updating procedure in imsic, there was a
+spinlock to protect it already. But since it should not be preempted in
+any cases, we should turn to use raw_spinlock to prevent any preemption
+in case PREEMPT_RT was enabled.
+
+Signed-off-by: Cyan Yang <cyan.yang@sifive.com>
+Reviewed-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
+Reviewed-by: Anup Patel <anup@brainfault.org>
+Message-ID: <20240919160126.44487-1-cyan.yang@sifive.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kvm/aia_imsic.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/riscv/kvm/aia_imsic.c b/arch/riscv/kvm/aia_imsic.c
+index 0a1e859323b45..a8085cd8215e3 100644
+--- a/arch/riscv/kvm/aia_imsic.c
++++ b/arch/riscv/kvm/aia_imsic.c
+@@ -55,7 +55,7 @@ struct imsic {
+ /* IMSIC SW-file */
+ struct imsic_mrif *swfile;
+ phys_addr_t swfile_pa;
+- spinlock_t swfile_extirq_lock;
++ raw_spinlock_t swfile_extirq_lock;
+ };
+
+ #define imsic_vs_csr_read(__c) \
+@@ -622,7 +622,7 @@ static void imsic_swfile_extirq_update(struct kvm_vcpu *vcpu)
+ * interruptions between reading topei and updating pending status.
+ */
+
+- spin_lock_irqsave(&imsic->swfile_extirq_lock, flags);
++ raw_spin_lock_irqsave(&imsic->swfile_extirq_lock, flags);
+
+ if (imsic_mrif_atomic_read(mrif, &mrif->eidelivery) &&
+ imsic_mrif_topei(mrif, imsic->nr_eix, imsic->nr_msis))
+@@ -630,7 +630,7 @@ static void imsic_swfile_extirq_update(struct kvm_vcpu *vcpu)
+ else
+ kvm_riscv_vcpu_unset_interrupt(vcpu, IRQ_VS_EXT);
+
+- spin_unlock_irqrestore(&imsic->swfile_extirq_lock, flags);
++ raw_spin_unlock_irqrestore(&imsic->swfile_extirq_lock, flags);
+ }
+
+ static void imsic_swfile_read(struct kvm_vcpu *vcpu, bool clear,
+@@ -1051,7 +1051,7 @@ int kvm_riscv_vcpu_aia_imsic_init(struct kvm_vcpu *vcpu)
+ }
+ imsic->swfile = page_to_virt(swfile_page);
+ imsic->swfile_pa = page_to_phys(swfile_page);
+- spin_lock_init(&imsic->swfile_extirq_lock);
++ raw_spin_lock_init(&imsic->swfile_extirq_lock);
+
+ /* Setup IO device */
+ kvm_iodevice_init(&imsic->iodev, &imsic_iodoev_ops);
+--
+2.43.0
+
--- /dev/null
+From 8c6cefc885112c6abe92890cd3b586f338267cf7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Oct 2024 17:15:32 +0200
+Subject: samples/landlock: Fix port parsing in sandboxer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Matthieu Buffet <matthieu@buffet.re>
+
+[ Upstream commit 387285530d1d4bdba8c5dff5aeabd8d71638173f ]
+
+If you want to specify that no port can be bind()ed, you would think
+(looking quickly at both help message and code) that setting
+LL_TCP_BIND="" would do it.
+
+However the code splits on ":" then applies atoi(), which does not allow
+checking for errors. Passing an empty string returns 0, which is
+interpreted as "allow bind(0)", which means bind to any ephemeral port.
+This bug occurs whenever passing an empty string or when leaving a
+trailing/leading colon, making it impossible to completely deny bind().
+
+To reproduce:
+export LL_FS_RO="/" LL_FS_RW="" LL_TCP_BIND=""
+./sandboxer strace -e bind nc -n -vvv -l -p 0
+Executing the sandboxed command...
+bind(3, {sa_family=AF_INET, sin_port=htons(0),
+ sin_addr=inet_addr("0.0.0.0")}, 16) = 0
+Listening on 0.0.0.0 37629
+
+Use strtoull(3) instead, which allows error checking. Check that the
+entire string has been parsed correctly without overflows/underflows,
+but not that the __u64 (the type of struct landlock_net_port_attr.port)
+is a valid __u16 port: that is already done by the kernel.
+
+Fixes: 5e990dcef12e ("samples/landlock: Support TCP restrictions")
+Signed-off-by: Matthieu Buffet <matthieu@buffet.re>
+Link: https://lore.kernel.org/r/20241019151534.1400605-2-matthieu@buffet.re
+Signed-off-by: Mickaël Salaün <mic@digikod.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/landlock/sandboxer.c | 32 ++++++++++++++++++++++++++++++--
+ 1 file changed, 30 insertions(+), 2 deletions(-)
+
+diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c
+index e8223c3e781ab..5d8a9df5273f5 100644
+--- a/samples/landlock/sandboxer.c
++++ b/samples/landlock/sandboxer.c
+@@ -57,6 +57,25 @@ static inline int landlock_restrict_self(const int ruleset_fd,
+ #define ENV_TCP_CONNECT_NAME "LL_TCP_CONNECT"
+ #define ENV_DELIMITER ":"
+
++static int str2num(const char *numstr, __u64 *num_dst)
++{
++ char *endptr = NULL;
++ int err = 0;
++ __u64 num;
++
++ errno = 0;
++ num = strtoull(numstr, &endptr, 10);
++ if (errno != 0)
++ err = errno;
++ /* Was the string empty, or not entirely parsed successfully? */
++ else if ((*numstr == '\0') || (*endptr != '\0'))
++ err = EINVAL;
++ else
++ *num_dst = num;
++
++ return err;
++}
++
+ static int parse_path(char *env_path, const char ***const path_list)
+ {
+ int i, num_paths = 0;
+@@ -157,7 +176,6 @@ static int populate_ruleset_net(const char *const env_var, const int ruleset_fd,
+ char *env_port_name, *env_port_name_next, *strport;
+ struct landlock_net_port_attr net_port = {
+ .allowed_access = allowed_access,
+- .port = 0,
+ };
+
+ env_port_name = getenv(env_var);
+@@ -168,7 +186,17 @@ static int populate_ruleset_net(const char *const env_var, const int ruleset_fd,
+
+ env_port_name_next = env_port_name;
+ while ((strport = strsep(&env_port_name_next, ENV_DELIMITER))) {
+- net_port.port = atoi(strport);
++ __u64 port;
++
++ if (strcmp(strport, "") == 0)
++ continue;
++
++ if (str2num(strport, &port)) {
++ fprintf(stderr, "Failed to parse port at \"%s\"\n",
++ strport);
++ goto out_free_name;
++ }
++ net_port.port = port;
+ if (landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,
+ &net_port, 0)) {
+ fprintf(stderr,
+--
+2.43.0
+
drm-xe-query-increase-timestamp-width.patch
nvme-loop-flush-off-pending-i-o-while-shutting-down-.patch
nvme-make-keep-alive-synchronous-operation.patch
+samples-landlock-fix-port-parsing-in-sandboxer.patch
+vdpa-ifcvf-fix-pci_read_config_byte-return-code-hand.patch
+virtio_pci-fix-admin-vq-cleanup-by-using-correct-inf.patch
+bpf-add-sk_is_inet-and-is_icsk-check-in-tls_sw_has_c.patch
+bpf-fix-mismatched-rcu-unlock-flavour-in-bpf_out_nei.patch
+asoc-intel-avs-update-stream-status-in-a-separate-th.patch
+asoc-codecs-fix-error-handling-in-aw_dev_get_dsp_sta.patch
+asoc-amd-yc-add-quirk-for-asus-vivobook-s15-m3502ra.patch
+asoc-amd-yc-fix-non-functional-mic-on-asus-e1404fa.patch
+asoc-intel-soc-acpi-lnl-add-match-entry-for-tm2-lapt.patch
+netfs-downgrade-i_rwsem-for-a-buffered-write.patch
+fs-fix-uninitialized-value-issue-in-from_kuid-and-fr.patch
+afs-fix-lock-recursion.patch
+hid-i2c-hid-delayed-i2c-resume-wakeup-for-0x0d42-goo.patch
+hid-multitouch-add-quirk-for-logitech-bolt-receiver-.patch
+hid-lenovo-add-support-for-thinkpad-x1-tablet-gen-3-.patch
+asoc-codecs-lpass-rx-macro-fix-rxn-rx-n-macro-for-ds.patch
+riscv-kvm-use-raw_spinlock-for-critical-section-in-i.patch
+asoc-rt722-sdca-increase-clk_stop_timeout-to-fix-clo.patch
+loongarch-use-exception-return-address-to-comment-er.patch
+asoc-fsl_micfil-add-sample-rate-constraint.patch
+loongarch-kvm-mark-hrtimer-to-expire-in-hard-interru.patch
+net-usb-qmi_wwan-add-fibocom-fg132-0x0112-compositio.patch
+bpf-check-validity-of-link-type-in-bpf_link_show_fdi.patch
+drm-xe-enlarge-the-invalidation-timeout-from-150-to-.patch
+drm-xe-guc-ct-flush-g2h-worker-in-case-of-g2h-respon.patch
+drm-xe-handle-unreliable-mmio-reads-during-forcewake.patch
+drm-xe-ufence-prefetch-ufence-addr-to-catch-bogus-ad.patch
+drm-xe-don-t-restart-parallel-queues-multiple-times-.patch
--- /dev/null
+From 641b96aa7a501f997980023b3ec7e7ee05e541e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2024 09:38:12 +0800
+Subject: vDPA/ifcvf: Fix pci_read_config_byte() return code handling
+
+From: Yuan Can <yuancan@huawei.com>
+
+[ Upstream commit 7f8825b2a78ac392d3fbb3a2e65e56d9e39d75e9 ]
+
+ifcvf_init_hw() uses pci_read_config_byte() that returns
+PCIBIOS_* codes. The error handling, however, assumes the codes are
+normal errnos because it checks for < 0.
+Convert the error check to plain non-zero check.
+
+Fixes: 5a2414bc454e ("virtio: Intel IFC VF driver for VDPA")
+Signed-off-by: Yuan Can <yuancan@huawei.com>
+Message-Id: <20241017013812.129952-1-yuancan@huawei.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Acked-by: Zhu Lingshan <lingshan.zhu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vdpa/ifcvf/ifcvf_base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/vdpa/ifcvf/ifcvf_base.c b/drivers/vdpa/ifcvf/ifcvf_base.c
+index 472daa588a9d2..d5507b63b6cdb 100644
+--- a/drivers/vdpa/ifcvf/ifcvf_base.c
++++ b/drivers/vdpa/ifcvf/ifcvf_base.c
+@@ -108,7 +108,7 @@ int ifcvf_init_hw(struct ifcvf_hw *hw, struct pci_dev *pdev)
+ u32 i;
+
+ ret = pci_read_config_byte(pdev, PCI_CAPABILITY_LIST, &pos);
+- if (ret < 0) {
++ if (ret) {
+ IFCVF_ERR(pdev, "Failed to read PCI capability list\n");
+ return -EIO;
+ }
+--
+2.43.0
+
--- /dev/null
+From 96d5eac73a8bac30d7f57358fb03d69c38cc8ac5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2024 09:54:06 -0400
+Subject: virtio_pci: Fix admin vq cleanup by using correct info pointer
+
+From: Feng Liu <feliu@nvidia.com>
+
+[ Upstream commit 97ee04feb682c906a1fa973ebe586fe91567d165 ]
+
+vp_modern_avq_cleanup() and vp_del_vqs() clean up admin vq
+resources by virtio_pci_vq_info pointer. The info pointer of admin
+vq is stored in vp_dev->admin_vq.info instead of vp_dev->vqs[].
+Using the info pointer from vp_dev->vqs[] for admin vq causes a
+kernel NULL pointer dereference bug.
+In vp_modern_avq_cleanup() and vp_del_vqs(), get the info pointer
+from vp_dev->admin_vq.info for admin vq to clean up the resources.
+Also make info ptr as argument of vp_del_vq() to be symmetric with
+vp_setup_vq().
+
+vp_reset calls vp_modern_avq_cleanup, and causes the Call Trace:
+==================================================================
+BUG: kernel NULL pointer dereference, address:0000000000000000
+...
+CPU: 49 UID: 0 PID: 4439 Comm: modprobe Not tainted 6.11.0-rc5 #1
+RIP: 0010:vp_reset+0x57/0x90 [virtio_pci]
+Call Trace:
+ <TASK>
+...
+ ? vp_reset+0x57/0x90 [virtio_pci]
+ ? vp_reset+0x38/0x90 [virtio_pci]
+ virtio_reset_device+0x1d/0x30
+ remove_vq_common+0x1c/0x1a0 [virtio_net]
+ virtnet_remove+0xa1/0xc0 [virtio_net]
+ virtio_dev_remove+0x46/0xa0
+...
+ virtio_pci_driver_exit+0x14/0x810 [virtio_pci]
+==================================================================
+
+Fixes: 4c3b54af907e ("virtio_pci_modern: use completion instead of busy loop to wait on admin cmd result")
+Signed-off-by: Feng Liu <feliu@nvidia.com>
+Signed-off-by: Jiri Pirko <jiri@nvidia.com>
+Reviewed-by: Parav Pandit <parav@nvidia.com>
+Message-Id: <20241024135406.81388-1-feliu@nvidia.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virtio/virtio_pci_common.c | 24 ++++++++++++++++++------
+ drivers/virtio/virtio_pci_common.h | 1 +
+ drivers/virtio/virtio_pci_modern.c | 12 +-----------
+ 3 files changed, 20 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
+index c44d8ba00c02c..88074451dd615 100644
+--- a/drivers/virtio/virtio_pci_common.c
++++ b/drivers/virtio/virtio_pci_common.c
+@@ -24,6 +24,16 @@ MODULE_PARM_DESC(force_legacy,
+ "Force legacy mode for transitional virtio 1 devices");
+ #endif
+
++bool vp_is_avq(struct virtio_device *vdev, unsigned int index)
++{
++ struct virtio_pci_device *vp_dev = to_vp_device(vdev);
++
++ if (!virtio_has_feature(vdev, VIRTIO_F_ADMIN_VQ))
++ return false;
++
++ return index == vp_dev->admin_vq.vq_index;
++}
++
+ /* wait for pending irq handlers */
+ void vp_synchronize_vectors(struct virtio_device *vdev)
+ {
+@@ -234,10 +244,9 @@ static struct virtqueue *vp_setup_vq(struct virtio_device *vdev, unsigned int in
+ return vq;
+ }
+
+-static void vp_del_vq(struct virtqueue *vq)
++static void vp_del_vq(struct virtqueue *vq, struct virtio_pci_vq_info *info)
+ {
+ struct virtio_pci_device *vp_dev = to_vp_device(vq->vdev);
+- struct virtio_pci_vq_info *info = vp_dev->vqs[vq->index];
+ unsigned long flags;
+
+ /*
+@@ -258,13 +267,16 @@ static void vp_del_vq(struct virtqueue *vq)
+ void vp_del_vqs(struct virtio_device *vdev)
+ {
+ struct virtio_pci_device *vp_dev = to_vp_device(vdev);
++ struct virtio_pci_vq_info *info;
+ struct virtqueue *vq, *n;
+ int i;
+
+ list_for_each_entry_safe(vq, n, &vdev->vqs, list) {
+- if (vp_dev->per_vq_vectors) {
+- int v = vp_dev->vqs[vq->index]->msix_vector;
++ info = vp_is_avq(vdev, vq->index) ? vp_dev->admin_vq.info :
++ vp_dev->vqs[vq->index];
+
++ if (vp_dev->per_vq_vectors) {
++ int v = info->msix_vector;
+ if (v != VIRTIO_MSI_NO_VECTOR &&
+ !vp_is_slow_path_vector(v)) {
+ int irq = pci_irq_vector(vp_dev->pci_dev, v);
+@@ -273,7 +285,7 @@ void vp_del_vqs(struct virtio_device *vdev)
+ free_irq(irq, vq);
+ }
+ }
+- vp_del_vq(vq);
++ vp_del_vq(vq, info);
+ }
+ vp_dev->per_vq_vectors = false;
+
+@@ -354,7 +366,7 @@ vp_find_one_vq_msix(struct virtio_device *vdev, int queue_idx,
+ vring_interrupt, 0,
+ vp_dev->msix_names[msix_vec], vq);
+ if (err) {
+- vp_del_vq(vq);
++ vp_del_vq(vq, *p_info);
+ return ERR_PTR(err);
+ }
+
+diff --git a/drivers/virtio/virtio_pci_common.h b/drivers/virtio/virtio_pci_common.h
+index 1d9c49947f52d..8beecf23ec85e 100644
+--- a/drivers/virtio/virtio_pci_common.h
++++ b/drivers/virtio/virtio_pci_common.h
+@@ -178,6 +178,7 @@ struct virtio_device *virtio_pci_vf_get_pf_dev(struct pci_dev *pdev);
+ #define VIRTIO_ADMIN_CMD_BITMAP 0
+ #endif
+
++bool vp_is_avq(struct virtio_device *vdev, unsigned int index);
+ void vp_modern_avq_done(struct virtqueue *vq);
+ int vp_modern_admin_cmd_exec(struct virtio_device *vdev,
+ struct virtio_admin_cmd *cmd);
+diff --git a/drivers/virtio/virtio_pci_modern.c b/drivers/virtio/virtio_pci_modern.c
+index 9193c30d640ae..4fbcbc7a9ae1c 100644
+--- a/drivers/virtio/virtio_pci_modern.c
++++ b/drivers/virtio/virtio_pci_modern.c
+@@ -43,16 +43,6 @@ static int vp_avq_index(struct virtio_device *vdev, u16 *index, u16 *num)
+ return 0;
+ }
+
+-static bool vp_is_avq(struct virtio_device *vdev, unsigned int index)
+-{
+- struct virtio_pci_device *vp_dev = to_vp_device(vdev);
+-
+- if (!virtio_has_feature(vdev, VIRTIO_F_ADMIN_VQ))
+- return false;
+-
+- return index == vp_dev->admin_vq.vq_index;
+-}
+-
+ void vp_modern_avq_done(struct virtqueue *vq)
+ {
+ struct virtio_pci_device *vp_dev = to_vp_device(vq->vdev);
+@@ -245,7 +235,7 @@ static void vp_modern_avq_cleanup(struct virtio_device *vdev)
+ if (!virtio_has_feature(vdev, VIRTIO_F_ADMIN_VQ))
+ return;
+
+- vq = vp_dev->vqs[vp_dev->admin_vq.vq_index]->vq;
++ vq = vp_dev->admin_vq.info->vq;
+ if (!vq)
+ return;
+
+--
+2.43.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
