--- /dev/null
+From 224749be6c23efe7fb8a030854f4fc5d1dd813b3 Mon Sep 17 00:00:00 2001
+From: Ming Lei <ming.lei@redhat.com>
+Date: Wed, 18 Dec 2024 18:16:14 +0800
+Subject: block: Revert "block: Fix potential deadlock while freezing queue and acquiring sysfs_lock"
+
+From: Ming Lei <ming.lei@redhat.com>
+
+commit 224749be6c23efe7fb8a030854f4fc5d1dd813b3 upstream.
+
+This reverts commit be26ba96421ab0a8fa2055ccf7db7832a13c44d2.
+
+Commit be26ba96421a ("block: Fix potential deadlock while freezing queue and
+acquiring sysfs_loc") actually reverts commit 22465bbac53c ("blk-mq: move cpuhp
+callback registering out of q->sysfs_lock"), and causes the original resctrl
+lockdep warning.
+
+So revert it and we need to fix the issue in another way.
+
+Cc: Nilay Shroff <nilay@linux.ibm.com>
+Fixes: be26ba96421a ("block: Fix potential deadlock while freezing queue and acquiring sysfs_loc")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20241218101617.3275704-2-ming.lei@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-mq-sysfs.c | 16 ++++++++++------
+ block/blk-mq.c | 29 +++++++++++------------------
+ block/blk-sysfs.c | 4 ++--
+ 3 files changed, 23 insertions(+), 26 deletions(-)
+
+--- a/block/blk-mq-sysfs.c
++++ b/block/blk-mq-sysfs.c
+@@ -275,13 +275,15 @@ void blk_mq_sysfs_unregister_hctxs(struc
+ struct blk_mq_hw_ctx *hctx;
+ unsigned long i;
+
+- lockdep_assert_held(&q->sysfs_dir_lock);
+-
++ mutex_lock(&q->sysfs_dir_lock);
+ if (!q->mq_sysfs_init_done)
+- return;
++ goto unlock;
+
+ queue_for_each_hw_ctx(q, hctx, i)
+ blk_mq_unregister_hctx(hctx);
++
++unlock:
++ mutex_unlock(&q->sysfs_dir_lock);
+ }
+
+ int blk_mq_sysfs_register_hctxs(struct request_queue *q)
+@@ -290,10 +292,9 @@ int blk_mq_sysfs_register_hctxs(struct r
+ unsigned long i;
+ int ret = 0;
+
+- lockdep_assert_held(&q->sysfs_dir_lock);
+-
++ mutex_lock(&q->sysfs_dir_lock);
+ if (!q->mq_sysfs_init_done)
+- return ret;
++ goto unlock;
+
+ queue_for_each_hw_ctx(q, hctx, i) {
+ ret = blk_mq_register_hctx(hctx);
+@@ -301,5 +302,8 @@ int blk_mq_sysfs_register_hctxs(struct r
+ break;
+ }
+
++unlock:
++ mutex_unlock(&q->sysfs_dir_lock);
++
+ return ret;
+ }
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -4462,8 +4462,7 @@ static void blk_mq_realloc_hw_ctxs(struc
+ unsigned long i, j;
+
+ /* protect against switching io scheduler */
+- lockdep_assert_held(&q->sysfs_lock);
+-
++ mutex_lock(&q->sysfs_lock);
+ for (i = 0; i < set->nr_hw_queues; i++) {
+ int old_node;
+ int node = blk_mq_get_hctx_node(set, i);
+@@ -4496,6 +4495,7 @@ static void blk_mq_realloc_hw_ctxs(struc
+
+ xa_for_each_start(&q->hctx_table, j, hctx, j)
+ blk_mq_exit_hctx(q, set, hctx, j);
++ mutex_unlock(&q->sysfs_lock);
+
+ /* unregister cpuhp callbacks for exited hctxs */
+ blk_mq_remove_hw_queues_cpuhp(q);
+@@ -4527,14 +4527,10 @@ int blk_mq_init_allocated_queue(struct b
+
+ xa_init(&q->hctx_table);
+
+- mutex_lock(&q->sysfs_lock);
+-
+ blk_mq_realloc_hw_ctxs(set, q);
+ if (!q->nr_hw_queues)
+ goto err_hctxs;
+
+- mutex_unlock(&q->sysfs_lock);
+-
+ INIT_WORK(&q->timeout_work, blk_mq_timeout_work);
+ blk_queue_rq_timeout(q, set->timeout ? set->timeout : 30 * HZ);
+
+@@ -4553,7 +4549,6 @@ int blk_mq_init_allocated_queue(struct b
+ return 0;
+
+ err_hctxs:
+- mutex_unlock(&q->sysfs_lock);
+ blk_mq_release(q);
+ err_exit:
+ q->mq_ops = NULL;
+@@ -4934,12 +4929,12 @@ static bool blk_mq_elv_switch_none(struc
+ return false;
+
+ /* q->elevator needs protection from ->sysfs_lock */
+- lockdep_assert_held(&q->sysfs_lock);
++ mutex_lock(&q->sysfs_lock);
+
+ /* the check has to be done with holding sysfs_lock */
+ if (!q->elevator) {
+ kfree(qe);
+- goto out;
++ goto unlock;
+ }
+
+ INIT_LIST_HEAD(&qe->node);
+@@ -4949,7 +4944,9 @@ static bool blk_mq_elv_switch_none(struc
+ __elevator_get(qe->type);
+ list_add(&qe->node, head);
+ elevator_disable(q);
+-out:
++unlock:
++ mutex_unlock(&q->sysfs_lock);
++
+ return true;
+ }
+
+@@ -4978,9 +4975,11 @@ static void blk_mq_elv_switch_back(struc
+ list_del(&qe->node);
+ kfree(qe);
+
++ mutex_lock(&q->sysfs_lock);
+ elevator_switch(q, t);
+ /* drop the reference acquired in blk_mq_elv_switch_none */
+ elevator_put(t);
++ mutex_unlock(&q->sysfs_lock);
+ }
+
+ static void __blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set,
+@@ -5000,11 +4999,8 @@ static void __blk_mq_update_nr_hw_queues
+ if (set->nr_maps == 1 && nr_hw_queues == set->nr_hw_queues)
+ return;
+
+- list_for_each_entry(q, &set->tag_list, tag_set_list) {
+- mutex_lock(&q->sysfs_dir_lock);
+- mutex_lock(&q->sysfs_lock);
++ list_for_each_entry(q, &set->tag_list, tag_set_list)
+ blk_mq_freeze_queue(q);
+- }
+ /*
+ * Switch IO scheduler to 'none', cleaning up the data associated
+ * with the previous scheduler. We will switch back once we are done
+@@ -5060,11 +5056,8 @@ switch_back:
+ list_for_each_entry(q, &set->tag_list, tag_set_list)
+ blk_mq_elv_switch_back(&head, q);
+
+- list_for_each_entry(q, &set->tag_list, tag_set_list) {
++ list_for_each_entry(q, &set->tag_list, tag_set_list)
+ blk_mq_unfreeze_queue(q);
+- mutex_unlock(&q->sysfs_lock);
+- mutex_unlock(&q->sysfs_dir_lock);
+- }
+
+ /* Free the excess tags when nr_hw_queues shrink. */
+ for (i = set->nr_hw_queues; i < prev_nr_hw_queues; i++)
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -690,11 +690,11 @@ queue_attr_store(struct kobject *kobj, s
+ return res;
+ }
+
+- mutex_lock(&q->sysfs_lock);
+ blk_mq_freeze_queue(q);
++ mutex_lock(&q->sysfs_lock);
+ res = entry->store(disk, page, length);
+- blk_mq_unfreeze_queue(q);
+ mutex_unlock(&q->sysfs_lock);
++ blk_mq_unfreeze_queue(q);
+ return res;
+ }
+
--- /dev/null
+From fbbd84af6ba70334335bdeba3ae536cf751c14c6 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@linaro.org>
+Date: Fri, 13 Dec 2024 12:47:27 +0300
+Subject: chelsio/chtls: prevent potential integer overflow on 32bit
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+commit fbbd84af6ba70334335bdeba3ae536cf751c14c6 upstream.
+
+The "gl->tot_len" variable is controlled by the user. It comes from
+process_responses(). On 32bit systems, the "gl->tot_len +
+sizeof(struct cpl_pass_accept_req) + sizeof(struct rss_header)" addition
+could have an integer wrapping bug. Use size_add() to prevent this.
+
+Fixes: a08943947873 ("crypto: chtls - Register chtls with net tls")
+Cc: stable@vger.kernel.org
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/c6bfb23c-2db2-4e1b-b8ab-ba3925c82ef5@stanley.mountain
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_main.c
++++ b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_main.c
+@@ -346,8 +346,9 @@ static struct sk_buff *copy_gl_to_skb_pk
+ * driver. Once driver synthesizes cpl_pass_accpet_req the skb will go
+ * through the regular cpl_pass_accept_req processing in TOM.
+ */
+- skb = alloc_skb(gl->tot_len + sizeof(struct cpl_pass_accept_req)
+- - pktshift, GFP_ATOMIC);
++ skb = alloc_skb(size_add(gl->tot_len,
++ sizeof(struct cpl_pass_accept_req)) -
++ pktshift, GFP_ATOMIC);
+ if (unlikely(!skb))
+ return NULL;
+ __skb_put(skb, gl->tot_len + sizeof(struct cpl_pass_accept_req)
--- /dev/null
+From a7f9d98eb1202132014ba760c26ad8608ffc9caf Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@amd.com>
+Date: Tue, 10 Dec 2024 20:44:14 -0600
+Subject: drm/amd: Update strapping for NBIO 2.5.0
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+commit a7f9d98eb1202132014ba760c26ad8608ffc9caf upstream.
+
+This helps to avoid a spurious PME event on hotplug to Azalia.
+
+Cc: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
+Reported-and-tested-by: ionut_n2001@yahoo.com
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=215884
+Tested-by: Gabriel Marcano <gabemarcano@yahoo.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Link: https://lore.kernel.org/r/20241211024414.7840-1-mario.limonciello@amd.com
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 3f6f237b9dd189e1fb85b8a3f7c97a8f27c1e49a)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/nbio_v7_0.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_0.c
+@@ -271,8 +271,19 @@ const struct nbio_hdp_flush_reg nbio_v7_
+ .ref_and_mask_sdma1 = GPU_HDP_FLUSH_DONE__SDMA1_MASK,
+ };
+
++#define regRCC_DEV0_EPF6_STRAP4 0xd304
++#define regRCC_DEV0_EPF6_STRAP4_BASE_IDX 5
++
+ static void nbio_v7_0_init_registers(struct amdgpu_device *adev)
+ {
++ uint32_t data;
++
++ switch (adev->ip_versions[NBIO_HWIP][0]) {
++ case IP_VERSION(2, 5, 0):
++ data = RREG32_SOC15(NBIO, 0, regRCC_DEV0_EPF6_STRAP4) & ~BIT(23);
++ WREG32_SOC15(NBIO, 0, regRCC_DEV0_EPF6_STRAP4, data);
++ break;
++ }
+ }
+
+ #define MMIO_REG_HOLE_OFFSET (0x80000 - PAGE_SIZE)
--- /dev/null
+From 8d1a13816e59254bd3b18f5ae0895230922bd120 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Thu, 12 Dec 2024 16:29:18 +0100
+Subject: drm/amdgpu: fix amdgpu_coredump
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+commit 8d1a13816e59254bd3b18f5ae0895230922bd120 upstream.
+
+The VM pointer might already be outdated when that function is called.
+Use the PASID instead to gather the information instead.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 57f812d171af4ba233d3ed7c94dfa5b8e92dcc04)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c
+@@ -345,11 +345,10 @@ void amdgpu_coredump(struct amdgpu_devic
+ coredump->skip_vram_check = skip_vram_check;
+ coredump->reset_vram_lost = vram_lost;
+
+- if (job && job->vm) {
+- struct amdgpu_vm *vm = job->vm;
++ if (job && job->pasid) {
+ struct amdgpu_task_info *ti;
+
+- ti = amdgpu_vm_get_task_info_vm(vm);
++ ti = amdgpu_vm_get_task_info_pasid(adev, job->pasid);
+ if (ti) {
+ coredump->reset_task_info = *ti;
+ amdgpu_vm_put_task_info(ti);
--- /dev/null
+From 85230ee36d88e7a09fb062d43203035659dd10a5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <mdaenzer@redhat.com>
+Date: Tue, 17 Dec 2024 18:22:56 +0100
+Subject: drm/amdgpu: Handle NULL bo->tbo.resource (again) in amdgpu_vm_bo_update
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michel Dänzer <mdaenzer@redhat.com>
+
+commit 85230ee36d88e7a09fb062d43203035659dd10a5 upstream.
+
+Third time's the charm, I hope?
+
+Fixes: d3116756a710 ("drm/ttm: rename bo->mem and make it a pointer")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3837
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Michel Dänzer <mdaenzer@redhat.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 695c2c745e5dff201b75da8a1d237ce403600d04)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+@@ -1260,10 +1260,9 @@ int amdgpu_vm_bo_update(struct amdgpu_de
+ * next command submission.
+ */
+ if (amdgpu_vm_is_bo_always_valid(vm, bo)) {
+- uint32_t mem_type = bo->tbo.resource->mem_type;
+-
+- if (!(bo->preferred_domains &
+- amdgpu_mem_type_to_domain(mem_type)))
++ if (bo->tbo.resource &&
++ !(bo->preferred_domains &
++ amdgpu_mem_type_to_domain(bo->tbo.resource->mem_type)))
+ amdgpu_vm_bo_evicted(&bo_va->base);
+ else
+ amdgpu_vm_bo_idle(&bo_va->base);
--- /dev/null
+From 080b2e7b5e9ad23343e4b11f0751e4c724a78958 Mon Sep 17 00:00:00 2001
+From: Krzysztof Karas <krzysztof.karas@intel.com>
+Date: Thu, 12 Dec 2024 11:00:41 +0000
+Subject: drm/display: use ERR_PTR on DP tunnel manager creation fail
+
+From: Krzysztof Karas <krzysztof.karas@intel.com>
+
+commit 080b2e7b5e9ad23343e4b11f0751e4c724a78958 upstream.
+
+Instead of returning a generic NULL on error from
+drm_dp_tunnel_mgr_create(), use error pointers with informative codes
+to align the function with stub that is executed when
+CONFIG_DRM_DISPLAY_DP_TUNNEL is unset. This will also trigger IS_ERR()
+in current caller (intel_dp_tunnerl_mgr_init()) instead of bypassing it
+via NULL pointer.
+
+v2: use error codes inside drm_dp_tunnel_mgr_create() instead of handling
+ on caller's side (Michal, Imre)
+
+v3: fixup commit message and add "CC"/"Fixes" lines (Andi),
+ mention aligning function code with stub
+
+Fixes: 91888b5b1ad2 ("drm/i915/dp: Add support for DP tunnel BW allocation")
+Cc: Imre Deak <imre.deak@intel.com>
+Cc: <stable@vger.kernel.org> # v6.9+
+Signed-off-by: Krzysztof Karas <krzysztof.karas@intel.com>
+Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
+Signed-off-by: Imre Deak <imre.deak@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/7q4fpnmmztmchczjewgm6igy55qt6jsm7tfd4fl4ucfq6yg2oy@q4lxtsu6445c
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/display/drm_dp_tunnel.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/display/drm_dp_tunnel.c b/drivers/gpu/drm/display/drm_dp_tunnel.c
+index 48b2df120086..90fe07a89260 100644
+--- a/drivers/gpu/drm/display/drm_dp_tunnel.c
++++ b/drivers/gpu/drm/display/drm_dp_tunnel.c
+@@ -1896,8 +1896,8 @@ static void destroy_mgr(struct drm_dp_tunnel_mgr *mgr)
+ *
+ * Creates a DP tunnel manager for @dev.
+ *
+- * Returns a pointer to the tunnel manager if created successfully or NULL in
+- * case of an error.
++ * Returns a pointer to the tunnel manager if created successfully or error
++ * pointer in case of failure.
+ */
+ struct drm_dp_tunnel_mgr *
+ drm_dp_tunnel_mgr_create(struct drm_device *dev, int max_group_count)
+@@ -1907,7 +1907,7 @@ drm_dp_tunnel_mgr_create(struct drm_device *dev, int max_group_count)
+
+ mgr = kzalloc(sizeof(*mgr), GFP_KERNEL);
+ if (!mgr)
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+
+ mgr->dev = dev;
+ init_waitqueue_head(&mgr->bw_req_queue);
+@@ -1916,7 +1916,7 @@ drm_dp_tunnel_mgr_create(struct drm_device *dev, int max_group_count)
+ if (!mgr->groups) {
+ kfree(mgr);
+
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+ }
+
+ #ifdef CONFIG_DRM_DISPLAY_DP_TUNNEL_STATE_DEBUG
+@@ -1927,7 +1927,7 @@ drm_dp_tunnel_mgr_create(struct drm_device *dev, int max_group_count)
+ if (!init_group(mgr, &mgr->groups[i])) {
+ destroy_mgr(mgr);
+
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+ }
+
+ mgr->group_count++;
+--
+2.47.1
+
--- /dev/null
+From 9398332f23fab10c5ec57c168b44e72997d6318e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Fri, 29 Nov 2024 06:26:28 +0200
+Subject: drm/modes: Avoid divide by zero harder in drm_mode_vrefresh()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 9398332f23fab10c5ec57c168b44e72997d6318e upstream.
+
+drm_mode_vrefresh() is trying to avoid divide by zero
+by checking whether htotal or vtotal are zero. But we may
+still end up with a div-by-zero of vtotal*htotal*...
+
+Cc: stable@vger.kernel.org
+Reported-by: syzbot+622bba18029bcde672e1@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=622bba18029bcde672e1
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241129042629.18280-2-ville.syrjala@linux.intel.com
+Reviewed-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_modes.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/drm_modes.c
++++ b/drivers/gpu/drm/drm_modes.c
+@@ -1287,14 +1287,11 @@ EXPORT_SYMBOL(drm_mode_set_name);
+ */
+ int drm_mode_vrefresh(const struct drm_display_mode *mode)
+ {
+- unsigned int num, den;
++ unsigned int num = 1, den = 1;
+
+ if (mode->htotal == 0 || mode->vtotal == 0)
+ return 0;
+
+- num = mode->clock;
+- den = mode->htotal * mode->vtotal;
+-
+ if (mode->flags & DRM_MODE_FLAG_INTERLACE)
+ num *= 2;
+ if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
+@@ -1302,6 +1299,12 @@ int drm_mode_vrefresh(const struct drm_d
+ if (mode->vscan > 1)
+ den *= mode->vscan;
+
++ if (check_mul_overflow(mode->clock, num, &num))
++ return 0;
++
++ if (check_mul_overflow(mode->htotal * mode->vtotal, den, &den))
++ return 0;
++
+ return DIV_ROUND_CLOSEST_ULL(mul_u32_u32(num, 1000), den);
+ }
+ EXPORT_SYMBOL(drm_mode_vrefresh);
--- /dev/null
+From 747367340ca6b5070728b86ae36ad6747f66b2fb Mon Sep 17 00:00:00 2001
+From: "Borislav Petkov (AMD)" <bp@alien8.de>
+Date: Wed, 11 Dec 2024 12:07:42 +0100
+Subject: EDAC/amd64: Simplify ECC check on unified memory controllers
+
+From: Borislav Petkov (AMD) <bp@alien8.de>
+
+commit 747367340ca6b5070728b86ae36ad6747f66b2fb upstream.
+
+The intent of the check is to see whether at least one UMC has ECC
+enabled. So do that instead of tracking which ones are enabled in masks
+which are too small in size anyway and lead to not loading the driver on
+Zen4 machines with UMCs enabled over UMC8.
+
+Fixes: e2be5955a886 ("EDAC/amd64: Add support for AMD Family 19h Models 10h-1Fh and A0h-AFh")
+Reported-by: Avadhut Naik <avadhut.naik@amd.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Tested-by: Avadhut Naik <avadhut.naik@amd.com>
+Reviewed-by: Avadhut Naik <avadhut.naik@amd.com>
+Cc: <stable@kernel.org>
+Link: https://lore.kernel.org/r/20241210212054.3895697-1-avadhut.naik@amd.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/edac/amd64_edac.c | 34 +++++++++++-----------------------
+ 1 file changed, 11 insertions(+), 23 deletions(-)
+
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -3362,36 +3362,24 @@ static bool dct_ecc_enabled(struct amd64
+
+ static bool umc_ecc_enabled(struct amd64_pvt *pvt)
+ {
+- u8 umc_en_mask = 0, ecc_en_mask = 0;
+- u16 nid = pvt->mc_node_id;
+ struct amd64_umc *umc;
+- u8 ecc_en = 0, i;
++ bool ecc_en = false;
++ int i;
+
++ /* Check whether at least one UMC is enabled: */
+ for_each_umc(i) {
+ umc = &pvt->umc[i];
+
+- /* Only check enabled UMCs. */
+- if (!(umc->sdp_ctrl & UMC_SDP_INIT))
+- continue;
+-
+- umc_en_mask |= BIT(i);
+-
+- if (umc->umc_cap_hi & UMC_ECC_ENABLED)
+- ecc_en_mask |= BIT(i);
++ if (umc->sdp_ctrl & UMC_SDP_INIT &&
++ umc->umc_cap_hi & UMC_ECC_ENABLED) {
++ ecc_en = true;
++ break;
++ }
+ }
+
+- /* Check whether at least one UMC is enabled: */
+- if (umc_en_mask)
+- ecc_en = umc_en_mask == ecc_en_mask;
+- else
+- edac_dbg(0, "Node %d: No enabled UMCs.\n", nid);
+-
+- edac_dbg(3, "Node %d: DRAM ECC %s.\n", nid, (ecc_en ? "enabled" : "disabled"));
+-
+- if (!ecc_en)
+- return false;
+- else
+- return true;
++ edac_dbg(3, "Node %d: DRAM ECC %s.\n", pvt->mc_node_id, (ecc_en ? "enabled" : "disabled"));
++
++ return ecc_en;
+ }
+
+ static inline void
--- /dev/null
+From 2ab0837cb91b7de507daa145d17b3b6b2efb3abf Mon Sep 17 00:00:00 2001
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+Date: Sun, 8 Dec 2024 13:34:13 -0500
+Subject: efivarfs: Fix error on non-existent file
+
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+
+commit 2ab0837cb91b7de507daa145d17b3b6b2efb3abf upstream.
+
+When looking up a non-existent file, efivarfs returns -EINVAL if the
+file does not conform to the NAME-GUID format and -ENOENT if it does.
+This is caused by efivars_d_hash() returning -EINVAL if the name is not
+formatted correctly. This error is returned before simple_lookup()
+returns a negative dentry, and is the error value that the user sees.
+
+Fix by removing this check. If the file does not exist, simple_lookup()
+will return a negative dentry leading to -ENOENT and efivarfs_create()
+already has a validity check before it creates an entry (and will
+correctly return -EINVAL)
+
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Cc: <stable@vger.kernel.org>
+[ardb: make efivarfs_valid_name() static]
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/efivarfs/inode.c | 2 +-
+ fs/efivarfs/internal.h | 1 -
+ fs/efivarfs/super.c | 3 ---
+ 3 files changed, 1 insertion(+), 5 deletions(-)
+
+--- a/fs/efivarfs/inode.c
++++ b/fs/efivarfs/inode.c
+@@ -51,7 +51,7 @@ struct inode *efivarfs_get_inode(struct
+ *
+ * VariableName-12345678-1234-1234-1234-1234567891bc
+ */
+-bool efivarfs_valid_name(const char *str, int len)
++static bool efivarfs_valid_name(const char *str, int len)
+ {
+ const char *s = str + len - EFI_VARIABLE_GUID_LEN;
+
+--- a/fs/efivarfs/internal.h
++++ b/fs/efivarfs/internal.h
+@@ -60,7 +60,6 @@ bool efivar_variable_is_removable(efi_gu
+
+ extern const struct file_operations efivarfs_file_operations;
+ extern const struct inode_operations efivarfs_dir_inode_operations;
+-extern bool efivarfs_valid_name(const char *str, int len);
+ extern struct inode *efivarfs_get_inode(struct super_block *sb,
+ const struct inode *dir, int mode, dev_t dev,
+ bool is_removable);
+--- a/fs/efivarfs/super.c
++++ b/fs/efivarfs/super.c
+@@ -144,9 +144,6 @@ static int efivarfs_d_hash(const struct
+ const unsigned char *s = qstr->name;
+ unsigned int len = qstr->len;
+
+- if (!efivarfs_valid_name(s, len))
+- return -EINVAL;
+-
+ while (len-- > EFI_VARIABLE_GUID_LEN)
+ hash = partial_name_hash(*s++, hash);
+
--- /dev/null
+From aef25be35d23ec768eed08bfcf7ca3cf9685bc28 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Thu, 21 Nov 2024 11:22:18 -0700
+Subject: hexagon: Disable constant extender optimization for LLVM prior to 19.1.0
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+commit aef25be35d23ec768eed08bfcf7ca3cf9685bc28 upstream.
+
+The Hexagon-specific constant extender optimization in LLVM may crash on
+Linux kernel code [1], such as fs/bcache/btree_io.c after
+commit 32ed4a620c54 ("bcachefs: Btree path tracepoints") in 6.12:
+
+ clang: llvm/lib/Target/Hexagon/HexagonConstExtenders.cpp:745: bool (anonymous namespace)::HexagonConstExtenders::ExtRoot::operator<(const HCE::ExtRoot &) const: Assertion `ThisB->getParent() == OtherB->getParent()' failed.
+ Stack dump:
+ 0. Program arguments: clang --target=hexagon-linux-musl ... fs/bcachefs/btree_io.c
+ 1. <eof> parser at end of file
+ 2. Code generation
+ 3. Running pass 'Function Pass Manager' on module 'fs/bcachefs/btree_io.c'.
+ 4. Running pass 'Hexagon constant-extender optimization' on function '@__btree_node_lock_nopath'
+
+Without assertions enabled, there is just a hang during compilation.
+
+This has been resolved in LLVM main (20.0.0) [2] and backported to LLVM
+19.1.0 but the kernel supports LLVM 13.0.1 and newer, so disable the
+constant expander optimization using the '-mllvm' option when using a
+toolchain that is not fixed.
+
+Cc: stable@vger.kernel.org
+Link: https://github.com/llvm/llvm-project/issues/99714 [1]
+Link: https://github.com/llvm/llvm-project/commit/68df06a0b2998765cb0a41353fcf0919bbf57ddb [2]
+Link: https://github.com/llvm/llvm-project/commit/2ab8d93061581edad3501561722ebd5632d73892 [3]
+Reviewed-by: Brian Cain <bcain@quicinc.com>
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/hexagon/Makefile | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/arch/hexagon/Makefile
++++ b/arch/hexagon/Makefile
+@@ -32,3 +32,9 @@ KBUILD_LDFLAGS += $(ldflags-y)
+ TIR_NAME := r19
+ KBUILD_CFLAGS += -ffixed-$(TIR_NAME) -DTHREADINFO_REG=$(TIR_NAME) -D__linux__
+ KBUILD_AFLAGS += -DTHREADINFO_REG=$(TIR_NAME)
++
++# Disable HexagonConstExtenders pass for LLVM versions prior to 19.1.0
++# https://github.com/llvm/llvm-project/issues/99714
++ifneq ($(call clang-min-version, 190100),y)
++KBUILD_CFLAGS += -mllvm -hexagon-cext=false
++endif
--- /dev/null
+From de6b43798d9043a7c749a0428dbb02d5fff156e5 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 22 Nov 2024 15:14:35 +0100
+Subject: i2c: riic: Always round-up when calculating bus period
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit de6b43798d9043a7c749a0428dbb02d5fff156e5 upstream.
+
+Currently, the RIIC driver may run the I2C bus faster than requested,
+which may cause subtle failures. E.g. Biju reported a measured bus
+speed of 450 kHz instead of the expected maximum of 400 kHz on RZ/G2L.
+
+The initial calculation of the bus period uses DIV_ROUND_UP(), to make
+sure the actual bus speed never becomes faster than the requested bus
+speed. However, the subsequent division-by-two steps do not use
+round-up, which may lead to a too-small period, hence a too-fast and
+possible out-of-spec bus speed. E.g. on RZ/Five, requesting a bus speed
+of 100 resp. 400 kHz will yield too-fast target bus speeds of 100806
+resp. 403226 Hz instead of 97656 resp. 390625 Hz.
+
+Fix this by using DIV_ROUND_UP() in the subsequent divisions, too.
+
+Tested on RZ/A1H, RZ/A2M, and RZ/Five.
+
+Fixes: d982d66514192cdb ("i2c: riic: remove clock and frequency restrictions")
+Reported-by: Biju Das <biju.das.jz@bp.renesas.com>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Cc: <stable@vger.kernel.org> # v4.15+
+Link: https://lore.kernel.org/r/c59aea77998dfea1b4456c4b33b55ab216fcbf5e.1732284746.git.geert+renesas@glider.be
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-riic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-riic.c
++++ b/drivers/i2c/busses/i2c-riic.c
+@@ -352,7 +352,7 @@ static int riic_init_hw(struct riic_dev
+ if (brl <= (0x1F + 3))
+ break;
+
+- total_ticks /= 2;
++ total_ticks = DIV_ROUND_UP(total_ticks, 2);
+ rate /= 2;
+ }
+
--- /dev/null
+From 773c05f417fa14e1ac94776619e9c978ec001f0b Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <maz@kernel.org>
+Date: Fri, 13 Dec 2024 14:10:37 +0000
+Subject: irqchip/gic-v3: Work around insecure GIC integrations
+
+From: Marc Zyngier <maz@kernel.org>
+
+commit 773c05f417fa14e1ac94776619e9c978ec001f0b upstream.
+
+It appears that the relatively popular RK3399 SoC has been put together
+using a large amount of illicit substances, as experiments reveal that its
+integration of GIC500 exposes the *secure* programming interface to
+non-secure.
+
+This has some pretty bad effects on the way priorities are handled, and
+results in a dead machine if booting with pseudo-NMI enabled
+(irqchip.gicv3_pseudo_nmi=1) if the kernel contains 18fdb6348c480 ("arm64:
+irqchip/gic-v3: Select priorities at boot time"), which relies on the
+priorities being programmed using the NS view.
+
+Let's restore some sanity by going one step further and disable security
+altogether in this case. This is not any worse, and puts us in a mode where
+priorities actually make some sense.
+
+Huge thanks to Mark Kettenis who initially identified this issue on
+OpenBSD, and to Chen-Yu Tsai who reported the problem in Linux.
+
+Fixes: 18fdb6348c480 ("arm64: irqchip/gic-v3: Select priorities at boot time")
+Reported-by: Mark Kettenis <mark.kettenis@xs4all.nl>
+Reported-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Chen-Yu Tsai <wens@csie.org>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/all/20241213141037.3995049-1-maz@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/irqchip/irq-gic-v3.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index 34db379d066a..79d8cc80693c 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -161,7 +161,22 @@ static bool cpus_have_group0 __ro_after_init;
+
+ static void __init gic_prio_init(void)
+ {
+- cpus_have_security_disabled = gic_dist_security_disabled();
++ bool ds;
++
++ ds = gic_dist_security_disabled();
++ if (!ds) {
++ u32 val;
++
++ val = readl_relaxed(gic_data.dist_base + GICD_CTLR);
++ val |= GICD_CTLR_DS;
++ writel_relaxed(val, gic_data.dist_base + GICD_CTLR);
++
++ ds = gic_dist_security_disabled();
++ if (ds)
++ pr_warn("Broken GIC integration, security disabled");
++ }
++
++ cpus_have_security_disabled = ds;
+ cpus_have_group0 = gic_has_group0();
+
+ /*
+--
+2.47.1
+
--- /dev/null
+From 03c7527e97f73081633d773f9f8c2373f9854b25 Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <maz@kernel.org>
+Date: Tue, 3 Dec 2024 19:02:36 +0000
+Subject: KVM: arm64: Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden
+
+From: Marc Zyngier <maz@kernel.org>
+
+commit 03c7527e97f73081633d773f9f8c2373f9854b25 upstream.
+
+Catalin reports that a hypervisor lying to a guest about the size
+of the ASID field may result in unexpected issues:
+
+- if the underlying HW does only supports 8 bit ASIDs, the ASID
+ field in a TLBI VAE1* operation is only 8 bits, and the HW will
+ ignore the other 8 bits
+
+- if on the contrary the HW is 16 bit capable, the ASID field
+ in the same TLBI operation is always 16 bits, irrespective of
+ the value of TCR_ELx.AS.
+
+This could lead to missed invalidations if the guest was lead to
+assume that the HW had 8 bit ASIDs while they really are 16 bit wide.
+
+In order to avoid any potential disaster that would be hard to debug,
+prenent the migration between a host with 8 bit ASIDs to one with
+wider ASIDs (the converse was obviously always forbidden). This is
+also consistent with what we already do for VMIDs.
+
+If it becomes absolutely mandatory to support such a migration path
+in the future, we will have to trap and emulate all TLBIs, something
+that nobody should look forward to.
+
+Fixes: d5a32b60dc18 ("KVM: arm64: Allow userspace to change ID_AA64MMFR{0-2}_EL1")
+Reported-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Cc: stable@vger.kernel.org
+Cc: Will Deacon <will@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Marc Zyngier <maz@kernel.org>
+Cc: James Morse <james.morse@arm.com>
+Cc: Oliver Upton <oliver.upton@linux.dev>
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Link: https://lore.kernel.org/r/20241203190236.505759-1-maz@kernel.org
+Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kvm/sys_regs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arm64/kvm/sys_regs.c
++++ b/arch/arm64/kvm/sys_regs.c
+@@ -2503,7 +2503,8 @@ static const struct sys_reg_desc sys_reg
+ ID_WRITABLE(ID_AA64MMFR0_EL1, ~(ID_AA64MMFR0_EL1_RES0 |
+ ID_AA64MMFR0_EL1_TGRAN4_2 |
+ ID_AA64MMFR0_EL1_TGRAN64_2 |
+- ID_AA64MMFR0_EL1_TGRAN16_2)),
++ ID_AA64MMFR0_EL1_TGRAN16_2 |
++ ID_AA64MMFR0_EL1_ASIDBITS)),
+ ID_WRITABLE(ID_AA64MMFR1_EL1, ~(ID_AA64MMFR1_EL1_RES0 |
+ ID_AA64MMFR1_EL1_HCX |
+ ID_AA64MMFR1_EL1_TWED |
--- /dev/null
+From 1201f226c863b7da739f7420ddba818cedf372fc Mon Sep 17 00:00:00 2001
+From: Sean Christopherson <seanjc@google.com>
+Date: Tue, 10 Dec 2024 17:32:58 -0800
+Subject: KVM: x86: Cache CPUID.0xD XSTATE offsets+sizes during module init
+
+From: Sean Christopherson <seanjc@google.com>
+
+commit 1201f226c863b7da739f7420ddba818cedf372fc upstream.
+
+Snapshot the output of CPUID.0xD.[1..n] during kvm.ko initiliaization to
+avoid the overead of CPUID during runtime. The offset, size, and metadata
+for CPUID.0xD.[1..n] sub-leaves does not depend on XCR0 or XSS values, i.e.
+is constant for a given CPU, and thus can be cached during module load.
+
+On Intel's Emerald Rapids, CPUID is *wildly* expensive, to the point where
+recomputing XSAVE offsets and sizes results in a 4x increase in latency of
+nested VM-Enter and VM-Exit (nested transitions can trigger
+xstate_required_size() multiple times per transition), relative to using
+cached values. The issue is easily visible by running `perf top` while
+triggering nested transitions: kvm_update_cpuid_runtime() shows up at a
+whopping 50%.
+
+As measured via RDTSC from L2 (using KVM-Unit-Test's CPUID VM-Exit test
+and a slightly modified L1 KVM to handle CPUID in the fastpath), a nested
+roundtrip to emulate CPUID on Skylake (SKX), Icelake (ICX), and Emerald
+Rapids (EMR) takes:
+
+ SKX 11650
+ ICX 22350
+ EMR 28850
+
+Using cached values, the latency drops to:
+
+ SKX 6850
+ ICX 9000
+ EMR 7900
+
+The underlying issue is that CPUID itself is slow on ICX, and comically
+slow on EMR. The problem is exacerbated on CPUs which support XSAVES
+and/or XSAVEC, as KVM invokes xstate_required_size() twice on each
+runtime CPUID update, and because there are more supported XSAVE features
+(CPUID for supported XSAVE feature sub-leafs is significantly slower).
+
+ SKX:
+ CPUID.0xD.2 = 348 cycles
+ CPUID.0xD.3 = 400 cycles
+ CPUID.0xD.4 = 276 cycles
+ CPUID.0xD.5 = 236 cycles
+ <other sub-leaves are similar>
+
+ EMR:
+ CPUID.0xD.2 = 1138 cycles
+ CPUID.0xD.3 = 1362 cycles
+ CPUID.0xD.4 = 1068 cycles
+ CPUID.0xD.5 = 910 cycles
+ CPUID.0xD.6 = 914 cycles
+ CPUID.0xD.7 = 1350 cycles
+ CPUID.0xD.8 = 734 cycles
+ CPUID.0xD.9 = 766 cycles
+ CPUID.0xD.10 = 732 cycles
+ CPUID.0xD.11 = 718 cycles
+ CPUID.0xD.12 = 734 cycles
+ CPUID.0xD.13 = 1700 cycles
+ CPUID.0xD.14 = 1126 cycles
+ CPUID.0xD.15 = 898 cycles
+ CPUID.0xD.16 = 716 cycles
+ CPUID.0xD.17 = 748 cycles
+ CPUID.0xD.18 = 776 cycles
+
+Note, updating runtime CPUID information multiple times per nested
+transition is itself a flaw, especially since CPUID is a mandotory
+intercept on both Intel and AMD. E.g. KVM doesn't need to ensure emulated
+CPUID state is up-to-date while running L2. That flaw will be fixed in a
+future patch, as deferring runtime CPUID updates is more subtle than it
+appears at first glance, the benefits aren't super critical to have once
+the XSAVE issue is resolved, and caching CPUID output is desirable even if
+KVM's updates are deferred.
+
+Cc: Jim Mattson <jmattson@google.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Message-ID: <20241211013302.1347853-2-seanjc@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/cpuid.c | 31 ++++++++++++++++++++++++++-----
+ arch/x86/kvm/cpuid.h | 1 +
+ arch/x86/kvm/x86.c | 2 ++
+ 3 files changed, 29 insertions(+), 5 deletions(-)
+
+--- a/arch/x86/kvm/cpuid.c
++++ b/arch/x86/kvm/cpuid.c
+@@ -36,6 +36,26 @@
+ u32 kvm_cpu_caps[NR_KVM_CPU_CAPS] __read_mostly;
+ EXPORT_SYMBOL_GPL(kvm_cpu_caps);
+
++struct cpuid_xstate_sizes {
++ u32 eax;
++ u32 ebx;
++ u32 ecx;
++};
++
++static struct cpuid_xstate_sizes xstate_sizes[XFEATURE_MAX] __ro_after_init;
++
++void __init kvm_init_xstate_sizes(void)
++{
++ u32 ign;
++ int i;
++
++ for (i = XFEATURE_YMM; i < ARRAY_SIZE(xstate_sizes); i++) {
++ struct cpuid_xstate_sizes *xs = &xstate_sizes[i];
++
++ cpuid_count(0xD, i, &xs->eax, &xs->ebx, &xs->ecx, &ign);
++ }
++}
++
+ u32 xstate_required_size(u64 xstate_bv, bool compacted)
+ {
+ int feature_bit = 0;
+@@ -44,14 +64,15 @@ u32 xstate_required_size(u64 xstate_bv,
+ xstate_bv &= XFEATURE_MASK_EXTEND;
+ while (xstate_bv) {
+ if (xstate_bv & 0x1) {
+- u32 eax, ebx, ecx, edx, offset;
+- cpuid_count(0xD, feature_bit, &eax, &ebx, &ecx, &edx);
++ struct cpuid_xstate_sizes *xs = &xstate_sizes[feature_bit];
++ u32 offset;
++
+ /* ECX[1]: 64B alignment in compacted form */
+ if (compacted)
+- offset = (ecx & 0x2) ? ALIGN(ret, 64) : ret;
++ offset = (xs->ecx & 0x2) ? ALIGN(ret, 64) : ret;
+ else
+- offset = ebx;
+- ret = max(ret, offset + eax);
++ offset = xs->ebx;
++ ret = max(ret, offset + xs->eax);
+ }
+
+ xstate_bv >>= 1;
+--- a/arch/x86/kvm/cpuid.h
++++ b/arch/x86/kvm/cpuid.h
+@@ -32,6 +32,7 @@ int kvm_vcpu_ioctl_get_cpuid2(struct kvm
+ bool kvm_cpuid(struct kvm_vcpu *vcpu, u32 *eax, u32 *ebx,
+ u32 *ecx, u32 *edx, bool exact_only);
+
++void __init kvm_init_xstate_sizes(void);
+ u32 xstate_required_size(u64 xstate_bv, bool compacted);
+
+ int cpuid_query_maxphyaddr(struct kvm_vcpu *vcpu);
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -14010,6 +14010,8 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_rmp_fau
+
+ static int __init kvm_x86_init(void)
+ {
++ kvm_init_xstate_sizes();
++
+ kvm_mmu_x86_module_init();
+ mitigate_smt_rsb &= boot_cpu_has_bug(X86_BUG_SMT_RSB) && cpu_smt_possible();
+ return 0;
--- /dev/null
+From f3d87abe11ed04d1b23a474a212f0e5deeb50892 Mon Sep 17 00:00:00 2001
+From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+Date: Tue, 3 Dec 2024 11:34:42 +0900
+Subject: mmc: mtk-sd: disable wakeup in .remove() and in the error path of .probe()
+
+From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+
+commit f3d87abe11ed04d1b23a474a212f0e5deeb50892 upstream.
+
+Current implementation leaves pdev->dev as a wakeup source. Add a
+device_init_wakeup(&pdev->dev, false) call in the .remove() function and
+in the error path of the .probe() function.
+
+Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+Fixes: 527f36f5efa4 ("mmc: mediatek: add support for SDIO eint wakup IRQ")
+Cc: stable@vger.kernel.org
+Message-ID: <20241203023442.2434018-1-joe@pf.is.s.u-tokyo.ac.jp>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/mtk-sd.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/mmc/host/mtk-sd.c
++++ b/drivers/mmc/host/mtk-sd.c
+@@ -2924,6 +2924,7 @@ release_clk:
+ msdc_gate_clock(host);
+ platform_set_drvdata(pdev, NULL);
+ release_mem:
++ device_init_wakeup(&pdev->dev, false);
+ if (host->dma.gpd)
+ dma_free_coherent(&pdev->dev,
+ 2 * sizeof(struct mt_gpdma_desc),
+@@ -2957,6 +2958,7 @@ static void msdc_drv_remove(struct platf
+ host->dma.gpd, host->dma.gpd_addr);
+ dma_free_coherent(&pdev->dev, MAX_BD_NUM * sizeof(struct mt_bdma_desc),
+ host->dma.bd, host->dma.bd_addr);
++ device_init_wakeup(&pdev->dev, false);
+ }
+
+ static void msdc_save_reg(struct msdc_host *host)
--- /dev/null
+From a56335c85b592cb2833db0a71f7112b7d9f0d56b Mon Sep 17 00:00:00 2001
+From: Prathamesh Shete <pshete@nvidia.com>
+Date: Mon, 9 Dec 2024 15:40:09 +0530
+Subject: mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk
+
+From: Prathamesh Shete <pshete@nvidia.com>
+
+commit a56335c85b592cb2833db0a71f7112b7d9f0d56b upstream.
+
+Value 0 in ADMA length descriptor is interpreted as 65536 on new Tegra
+chips, remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk to make sure max
+ADMA2 length is 65536.
+
+Fixes: 4346b7c7941d ("mmc: tegra: Add Tegra186 support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Prathamesh Shete <pshete@nvidia.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Message-ID: <20241209101009.22710-1-pshete@nvidia.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci-tegra.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/mmc/host/sdhci-tegra.c
++++ b/drivers/mmc/host/sdhci-tegra.c
+@@ -1525,7 +1525,6 @@ static const struct sdhci_pltfm_data sdh
+ .quirks = SDHCI_QUIRK_BROKEN_TIMEOUT_VAL |
+ SDHCI_QUIRK_SINGLE_POWER_WRITE |
+ SDHCI_QUIRK_NO_HISPD_BIT |
+- SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC |
+ SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN,
+ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN |
+ SDHCI_QUIRK2_ISSUE_CMD_DAT_RESET_TOGETHER,
--- /dev/null
+From ce1219c3f76bb131d095e90521506d3c6ccfa086 Mon Sep 17 00:00:00 2001
+From: Jeremy Kerr <jk@codeconstruct.com.au>
+Date: Wed, 18 Dec 2024 11:53:01 +0800
+Subject: net: mctp: handle skb cleanup on sock_queue failures
+
+From: Jeremy Kerr <jk@codeconstruct.com.au>
+
+commit ce1219c3f76bb131d095e90521506d3c6ccfa086 upstream.
+
+Currently, we don't use the return value from sock_queue_rcv_skb, which
+means we may leak skbs if a message is not successfully queued to a
+socket.
+
+Instead, ensure that we're freeing the skb where the sock hasn't
+otherwise taken ownership of the skb by adding checks on the
+sock_queue_rcv_skb() to invoke a kfree on failure.
+
+In doing so, rather than using the 'rc' value to trigger the
+kfree_skb(), use the skb pointer itself, which is more explicit.
+
+Also, add a kunit test for the sock delivery failure cases.
+
+Fixes: 4a992bbd3650 ("mctp: Implement message fragmentation & reassembly")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
+Link: https://patch.msgid.link/20241218-mctp-next-v2-1-1c1729645eaa@codeconstruct.com.au
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mctp/route.c | 36 +++++++++++++-----
+ net/mctp/test/route-test.c | 86 +++++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 112 insertions(+), 10 deletions(-)
+
+--- a/net/mctp/route.c
++++ b/net/mctp/route.c
+@@ -374,8 +374,13 @@ static int mctp_route_input(struct mctp_
+ msk = NULL;
+ rc = -EINVAL;
+
+- /* we may be receiving a locally-routed packet; drop source sk
+- * accounting
++ /* We may be receiving a locally-routed packet; drop source sk
++ * accounting.
++ *
++ * From here, we will either queue the skb - either to a frag_queue, or
++ * to a receiving socket. When that succeeds, we clear the skb pointer;
++ * a non-NULL skb on exit will be otherwise unowned, and hence
++ * kfree_skb()-ed.
+ */
+ skb_orphan(skb);
+
+@@ -434,7 +439,9 @@ static int mctp_route_input(struct mctp_
+ * pending key.
+ */
+ if (flags & MCTP_HDR_FLAG_EOM) {
+- sock_queue_rcv_skb(&msk->sk, skb);
++ rc = sock_queue_rcv_skb(&msk->sk, skb);
++ if (!rc)
++ skb = NULL;
+ if (key) {
+ /* we've hit a pending reassembly; not much we
+ * can do but drop it
+@@ -443,7 +450,6 @@ static int mctp_route_input(struct mctp_
+ MCTP_TRACE_KEY_REPLIED);
+ key = NULL;
+ }
+- rc = 0;
+ goto out_unlock;
+ }
+
+@@ -470,8 +476,10 @@ static int mctp_route_input(struct mctp_
+ * this function.
+ */
+ rc = mctp_key_add(key, msk);
+- if (!rc)
++ if (!rc) {
+ trace_mctp_key_acquire(key);
++ skb = NULL;
++ }
+
+ /* we don't need to release key->lock on exit, so
+ * clean up here and suppress the unlock via
+@@ -489,6 +497,8 @@ static int mctp_route_input(struct mctp_
+ key = NULL;
+ } else {
+ rc = mctp_frag_queue(key, skb);
++ if (!rc)
++ skb = NULL;
+ }
+ }
+
+@@ -503,12 +513,19 @@ static int mctp_route_input(struct mctp_
+ else
+ rc = mctp_frag_queue(key, skb);
+
++ if (rc)
++ goto out_unlock;
++
++ /* we've queued; the queue owns the skb now */
++ skb = NULL;
++
+ /* end of message? deliver to socket, and we're done with
+ * the reassembly/response key
+ */
+- if (!rc && flags & MCTP_HDR_FLAG_EOM) {
+- sock_queue_rcv_skb(key->sk, key->reasm_head);
+- key->reasm_head = NULL;
++ if (flags & MCTP_HDR_FLAG_EOM) {
++ rc = sock_queue_rcv_skb(key->sk, key->reasm_head);
++ if (!rc)
++ key->reasm_head = NULL;
+ __mctp_key_done_in(key, net, f, MCTP_TRACE_KEY_REPLIED);
+ key = NULL;
+ }
+@@ -527,8 +544,7 @@ out_unlock:
+ if (any_key)
+ mctp_key_unref(any_key);
+ out:
+- if (rc)
+- kfree_skb(skb);
++ kfree_skb(skb);
+ return rc;
+ }
+
+--- a/net/mctp/test/route-test.c
++++ b/net/mctp/test/route-test.c
+@@ -837,6 +837,90 @@ static void mctp_test_route_input_multip
+ mctp_test_route_input_multiple_nets_key_fini(test, &t2);
+ }
+
++/* Input route to socket, using a single-packet message, where sock delivery
++ * fails. Ensure we're handling the failure appropriately.
++ */
++static void mctp_test_route_input_sk_fail_single(struct kunit *test)
++{
++ const struct mctp_hdr hdr = RX_HDR(1, 10, 8, FL_S | FL_E | FL_TO);
++ struct mctp_test_route *rt;
++ struct mctp_test_dev *dev;
++ struct socket *sock;
++ struct sk_buff *skb;
++ int rc;
++
++ __mctp_route_test_init(test, &dev, &rt, &sock, MCTP_NET_ANY);
++
++ /* No rcvbuf space, so delivery should fail. __sock_set_rcvbuf will
++ * clamp the minimum to SOCK_MIN_RCVBUF, so we open-code this.
++ */
++ lock_sock(sock->sk);
++ WRITE_ONCE(sock->sk->sk_rcvbuf, 0);
++ release_sock(sock->sk);
++
++ skb = mctp_test_create_skb(&hdr, 10);
++ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, skb);
++ skb_get(skb);
++
++ mctp_test_skb_set_dev(skb, dev);
++
++ /* do route input, which should fail */
++ rc = mctp_route_input(&rt->rt, skb);
++ KUNIT_EXPECT_NE(test, rc, 0);
++
++ /* we should hold the only reference to skb */
++ KUNIT_EXPECT_EQ(test, refcount_read(&skb->users), 1);
++ kfree_skb(skb);
++
++ __mctp_route_test_fini(test, dev, rt, sock);
++}
++
++/* Input route to socket, using a fragmented message, where sock delivery fails.
++ */
++static void mctp_test_route_input_sk_fail_frag(struct kunit *test)
++{
++ const struct mctp_hdr hdrs[2] = { RX_FRAG(FL_S, 0), RX_FRAG(FL_E, 1) };
++ struct mctp_test_route *rt;
++ struct mctp_test_dev *dev;
++ struct sk_buff *skbs[2];
++ struct socket *sock;
++ unsigned int i;
++ int rc;
++
++ __mctp_route_test_init(test, &dev, &rt, &sock, MCTP_NET_ANY);
++
++ lock_sock(sock->sk);
++ WRITE_ONCE(sock->sk->sk_rcvbuf, 0);
++ release_sock(sock->sk);
++
++ for (i = 0; i < ARRAY_SIZE(skbs); i++) {
++ skbs[i] = mctp_test_create_skb(&hdrs[i], 10);
++ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, skbs[i]);
++ skb_get(skbs[i]);
++
++ mctp_test_skb_set_dev(skbs[i], dev);
++ }
++
++ /* first route input should succeed, we're only queueing to the
++ * frag list
++ */
++ rc = mctp_route_input(&rt->rt, skbs[0]);
++ KUNIT_EXPECT_EQ(test, rc, 0);
++
++ /* final route input should fail to deliver to the socket */
++ rc = mctp_route_input(&rt->rt, skbs[1]);
++ KUNIT_EXPECT_NE(test, rc, 0);
++
++ /* we should hold the only reference to both skbs */
++ KUNIT_EXPECT_EQ(test, refcount_read(&skbs[0]->users), 1);
++ kfree_skb(skbs[0]);
++
++ KUNIT_EXPECT_EQ(test, refcount_read(&skbs[1]->users), 1);
++ kfree_skb(skbs[1]);
++
++ __mctp_route_test_fini(test, dev, rt, sock);
++}
++
+ #if IS_ENABLED(CONFIG_MCTP_FLOWS)
+
+ static void mctp_test_flow_init(struct kunit *test,
+@@ -1053,6 +1137,8 @@ static struct kunit_case mctp_test_cases
+ mctp_route_input_sk_reasm_gen_params),
+ KUNIT_CASE_PARAM(mctp_test_route_input_sk_keys,
+ mctp_route_input_sk_keys_gen_params),
++ KUNIT_CASE(mctp_test_route_input_sk_fail_single),
++ KUNIT_CASE(mctp_test_route_input_sk_fail_frag),
+ KUNIT_CASE(mctp_test_route_input_multiple_nets_bind),
+ KUNIT_CASE(mctp_test_route_input_multiple_nets_key),
+ KUNIT_CASE(mctp_test_packet_flow),
--- /dev/null
+From 429fde2d81bcef0ebab002215358955704586457 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 12 Dec 2024 22:22:47 +0000
+Subject: net: tun: fix tun_napi_alloc_frags()
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 429fde2d81bcef0ebab002215358955704586457 upstream.
+
+syzbot reported the following crash [1]
+
+Issue came with the blamed commit. Instead of going through
+all the iov components, we keep using the first one
+and end up with a malformed skb.
+
+[1]
+
+kernel BUG at net/core/skbuff.c:2849 !
+Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
+CPU: 0 UID: 0 PID: 6230 Comm: syz-executor132 Not tainted 6.13.0-rc1-syzkaller-00407-g96b6fcc0ee41 #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
+ RIP: 0010:__pskb_pull_tail+0x1568/0x1570 net/core/skbuff.c:2848
+Code: 38 c1 0f 8c 32 f1 ff ff 4c 89 f7 e8 92 96 74 f8 e9 25 f1 ff ff e8 e8 ae 09 f8 48 8b 5c 24 08 e9 eb fb ff ff e8 d9 ae 09 f8 90 <0f> 0b 66 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90
+RSP: 0018:ffffc90004cbef30 EFLAGS: 00010293
+RAX: ffffffff8995c347 RBX: 00000000fffffff2 RCX: ffff88802cf45a00
+RDX: 0000000000000000 RSI: 00000000fffffff2 RDI: 0000000000000000
+RBP: ffff88807df0c06a R08: ffffffff8995b084 R09: 1ffff1100fbe185c
+R10: dffffc0000000000 R11: ffffed100fbe185d R12: ffff888076e85d50
+R13: ffff888076e85c80 R14: ffff888076e85cf4 R15: ffff888076e85c80
+FS: 00007f0dca6ea6c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007f0dca6ead58 CR3: 00000000119da000 CR4: 00000000003526f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ <TASK>
+ skb_cow_data+0x2da/0xcb0 net/core/skbuff.c:5284
+ tipc_aead_decrypt net/tipc/crypto.c:894 [inline]
+ tipc_crypto_rcv+0x402/0x24e0 net/tipc/crypto.c:1844
+ tipc_rcv+0x57e/0x12a0 net/tipc/node.c:2109
+ tipc_l2_rcv_msg+0x2bd/0x450 net/tipc/bearer.c:668
+ __netif_receive_skb_list_ptype net/core/dev.c:5720 [inline]
+ __netif_receive_skb_list_core+0x8b7/0x980 net/core/dev.c:5762
+ __netif_receive_skb_list net/core/dev.c:5814 [inline]
+ netif_receive_skb_list_internal+0xa51/0xe30 net/core/dev.c:5905
+ gro_normal_list include/net/gro.h:515 [inline]
+ napi_complete_done+0x2b5/0x870 net/core/dev.c:6256
+ napi_complete include/linux/netdevice.h:567 [inline]
+ tun_get_user+0x2ea0/0x4890 drivers/net/tun.c:1982
+ tun_chr_write_iter+0x10d/0x1f0 drivers/net/tun.c:2057
+ do_iter_readv_writev+0x600/0x880
+ vfs_writev+0x376/0xba0 fs/read_write.c:1050
+ do_writev+0x1b6/0x360 fs/read_write.c:1096
+ do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+ do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Fixes: de4f5fed3f23 ("iov_iter: add iter_iovec() helper")
+Reported-by: syzbot+4f66250f6663c0c1d67e@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/netdev/675b61aa.050a0220.599f4.00bb.GAE@google.com/T/#u
+Cc: stable@vger.kernel.org
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Joe Damato <jdamato@fastly.com>
+Reviewed-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Willem de Bruijn <willemb@google.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Link: https://patch.msgid.link/20241212222247.724674-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/tun.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1481,7 +1481,7 @@ static struct sk_buff *tun_napi_alloc_fr
+ skb->truesize += skb->data_len;
+
+ for (i = 1; i < it->nr_segs; i++) {
+- const struct iovec *iov = iter_iov(it);
++ const struct iovec *iov = iter_iov(it) + i;
+ size_t fragsz = iov->iov_len;
+ struct page *page;
+ void *frag;
netdev-genl-avoid-empty-messages-in-queue-dump.patch
psample-adjust-size-if-rate_as_probability-is-set.patch
net-mdiobus-fix-an-of-node-reference-leak.patch
+mmc-sdhci-tegra-remove-sdhci_quirk_broken_adma_zerolen_desc-quirk.patch
+mmc-mtk-sd-disable-wakeup-in-.remove-and-in-the-error-path-of-.probe.patch
+irqchip-gic-v3-work-around-insecure-gic-integrations.patch
+edac-amd64-simplify-ecc-check-on-unified-memory-controllers.patch
+kvm-arm64-do-not-allow-id_aa64mmfr0_el1.asidbits-to-be-overridden.patch
+kvm-x86-cache-cpuid.0xd-xstate-offsets-sizes-during-module-init.patch
+net-tun-fix-tun_napi_alloc_frags.patch
+chelsio-chtls-prevent-potential-integer-overflow-on-32bit.patch
+net-mctp-handle-skb-cleanup-on-sock_queue-failures.patch
+block-revert-block-fix-potential-deadlock-while-freezing-queue-and-acquiring-sysfs_lock.patch
+i2c-riic-always-round-up-when-calculating-bus-period.patch
+efivarfs-fix-error-on-non-existent-file.patch
+hexagon-disable-constant-extender-optimization-for-llvm-prior-to-19.1.0.patch
+usb-serial-option-add-tcl-ik512-mbim-ecm.patch
+usb-serial-option-add-meig-smart-slm770a.patch
+usb-serial-option-add-netprisma-lcuk54-modules-for-wwan-ready.patch
+usb-serial-option-add-mediatek-t7xx-compositions.patch
+usb-serial-option-add-telit-fe910c04-rmnet-compositions.patch
+xhci-turn-nec-specific-quirk-for-handling-stop-endpoint-errors-generic.patch
+thunderbolt-add-support-for-intel-panther-lake-m-p.patch
+thunderbolt-improve-redrive-mode-handling.patch
+thunderbolt-don-t-display-nvm_version-unless-upgrade-supported.patch
+drm-display-use-err_ptr-on-dp-tunnel-manager-creation-fail.patch
+drm-amd-update-strapping-for-nbio-2.5.0.patch
+drm-modes-avoid-divide-by-zero-harder-in-drm_mode_vrefresh.patch
+drm-amdgpu-fix-amdgpu_coredump.patch
+drm-amdgpu-handle-null-bo-tbo.resource-again-in-amdgpu_vm_bo_update.patch
--- /dev/null
+From 8644b48714dca8bf2f42a4ff8311de8efc9bd8c3 Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Tue, 14 May 2024 10:15:14 +0300
+Subject: thunderbolt: Add support for Intel Panther Lake-M/P
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+commit 8644b48714dca8bf2f42a4ff8311de8efc9bd8c3 upstream.
+
+Intel Panther Lake-M/P has the same integrated Thunderbolt/USB4
+controller as Lunar Lake. Add these PCI IDs to the driver list of
+supported devices.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/thunderbolt/nhi.c | 8 ++++++++
+ drivers/thunderbolt/nhi.h | 4 ++++
+ 2 files changed, 12 insertions(+)
+
+--- a/drivers/thunderbolt/nhi.c
++++ b/drivers/thunderbolt/nhi.c
+@@ -1520,6 +1520,14 @@ static struct pci_device_id nhi_ids[] =
+ .driver_data = (kernel_ulong_t)&icl_nhi_ops },
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_LNL_NHI1),
+ .driver_data = (kernel_ulong_t)&icl_nhi_ops },
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_PTL_M_NHI0),
++ .driver_data = (kernel_ulong_t)&icl_nhi_ops },
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_PTL_M_NHI1),
++ .driver_data = (kernel_ulong_t)&icl_nhi_ops },
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_PTL_P_NHI0),
++ .driver_data = (kernel_ulong_t)&icl_nhi_ops },
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_PTL_P_NHI1),
++ .driver_data = (kernel_ulong_t)&icl_nhi_ops },
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI) },
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI) },
+
+--- a/drivers/thunderbolt/nhi.h
++++ b/drivers/thunderbolt/nhi.h
+@@ -92,6 +92,10 @@ extern const struct tb_nhi_ops icl_nhi_o
+ #define PCI_DEVICE_ID_INTEL_RPL_NHI1 0xa76d
+ #define PCI_DEVICE_ID_INTEL_LNL_NHI0 0xa833
+ #define PCI_DEVICE_ID_INTEL_LNL_NHI1 0xa834
++#define PCI_DEVICE_ID_INTEL_PTL_M_NHI0 0xe333
++#define PCI_DEVICE_ID_INTEL_PTL_M_NHI1 0xe334
++#define PCI_DEVICE_ID_INTEL_PTL_P_NHI0 0xe433
++#define PCI_DEVICE_ID_INTEL_PTL_P_NHI1 0xe434
+
+ #define PCI_CLASS_SERIAL_USB_USB4 0x0c0340
+
--- /dev/null
+From e34f1717ef0632fcec5cb827e5e0e9f223d70c9b Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@amd.com>
+Date: Mon, 9 Dec 2024 10:25:51 -0600
+Subject: thunderbolt: Don't display nvm_version unless upgrade supported
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+commit e34f1717ef0632fcec5cb827e5e0e9f223d70c9b upstream.
+
+The read will never succeed if NVM wasn't initialized due to an unknown
+format.
+
+Add a new callback for visibility to only show when supported.
+
+Cc: stable@vger.kernel.org
+Fixes: aef9c693e7e5 ("thunderbolt: Move vendor specific NVM handling into nvm.c")
+Reported-by: Richard Hughes <hughsient@gmail.com>
+Closes: https://github.com/fwupd/fwupd/issues/8200
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/thunderbolt/retimer.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+--- a/drivers/thunderbolt/retimer.c
++++ b/drivers/thunderbolt/retimer.c
+@@ -103,6 +103,7 @@ static int tb_retimer_nvm_add(struct tb_
+
+ err_nvm:
+ dev_dbg(&rt->dev, "NVM upgrade disabled\n");
++ rt->no_nvm_upgrade = true;
+ if (!IS_ERR(nvm))
+ tb_nvm_free(nvm);
+
+@@ -182,8 +183,6 @@ static ssize_t nvm_authenticate_show(str
+
+ if (!rt->nvm)
+ ret = -EAGAIN;
+- else if (rt->no_nvm_upgrade)
+- ret = -EOPNOTSUPP;
+ else
+ ret = sysfs_emit(buf, "%#x\n", rt->auth_status);
+
+@@ -323,8 +322,6 @@ static ssize_t nvm_version_show(struct d
+
+ if (!rt->nvm)
+ ret = -EAGAIN;
+- else if (rt->no_nvm_upgrade)
+- ret = -EOPNOTSUPP;
+ else
+ ret = sysfs_emit(buf, "%x.%x\n", rt->nvm->major, rt->nvm->minor);
+
+@@ -342,6 +339,19 @@ static ssize_t vendor_show(struct device
+ }
+ static DEVICE_ATTR_RO(vendor);
+
++static umode_t retimer_is_visible(struct kobject *kobj, struct attribute *attr,
++ int n)
++{
++ struct device *dev = kobj_to_dev(kobj);
++ struct tb_retimer *rt = tb_to_retimer(dev);
++
++ if (attr == &dev_attr_nvm_authenticate.attr ||
++ attr == &dev_attr_nvm_version.attr)
++ return rt->no_nvm_upgrade ? 0 : attr->mode;
++
++ return attr->mode;
++}
++
+ static struct attribute *retimer_attrs[] = {
+ &dev_attr_device.attr,
+ &dev_attr_nvm_authenticate.attr,
+@@ -351,6 +361,7 @@ static struct attribute *retimer_attrs[]
+ };
+
+ static const struct attribute_group retimer_group = {
++ .is_visible = retimer_is_visible,
+ .attrs = retimer_attrs,
+ };
+
--- /dev/null
+From 24740385cb0d6d22ab7fa7adf36546d5b3cdcf73 Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Fri, 15 Nov 2024 11:54:40 +0200
+Subject: thunderbolt: Improve redrive mode handling
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+commit 24740385cb0d6d22ab7fa7adf36546d5b3cdcf73 upstream.
+
+When USB-C monitor is connected directly to Intel Barlow Ridge host, it
+goes into "redrive" mode that basically routes the DisplayPort signals
+directly from the GPU to the USB-C monitor without any tunneling needed.
+However, the host router must be powered on for this to work. Aaron
+reported that there are a couple of cases where this will not work with
+the current code:
+
+ - Booting with USB-C monitor plugged in.
+ - Plugging in USB-C monitor when the host router is in sleep state
+ (runtime suspended).
+ - Plugging in USB-C device while the system is in system sleep state.
+
+In all these cases once the host router is runtime suspended the picture
+on the connected USB-C display disappears too. This is certainly not
+what the user expected.
+
+For this reason improve the redrive mode handling to keep the host
+router from runtime suspending when detect that any of the above cases
+is happening.
+
+Fixes: a75e0684efe5 ("thunderbolt: Keep the domain powered when USB4 port is in redrive mode")
+Reported-by: Aaron Rainbolt <arainbolt@kfocus.org>
+Closes: https://lore.kernel.org/linux-usb/20241009220118.70bfedd0@kf-ir16/
+Cc: stable@vger.kernel.org
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/thunderbolt/tb.c | 41 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 41 insertions(+)
+
+--- a/drivers/thunderbolt/tb.c
++++ b/drivers/thunderbolt/tb.c
+@@ -2059,6 +2059,37 @@ static void tb_exit_redrive(struct tb_po
+ }
+ }
+
++static void tb_switch_enter_redrive(struct tb_switch *sw)
++{
++ struct tb_port *port;
++
++ tb_switch_for_each_port(sw, port)
++ tb_enter_redrive(port);
++}
++
++/*
++ * Called during system and runtime suspend to forcefully exit redrive
++ * mode without querying whether the resource is available.
++ */
++static void tb_switch_exit_redrive(struct tb_switch *sw)
++{
++ struct tb_port *port;
++
++ if (!(sw->quirks & QUIRK_KEEP_POWER_IN_DP_REDRIVE))
++ return;
++
++ tb_switch_for_each_port(sw, port) {
++ if (!tb_port_is_dpin(port))
++ continue;
++
++ if (port->redrive) {
++ port->redrive = false;
++ pm_runtime_put(&sw->dev);
++ tb_port_dbg(port, "exit redrive mode\n");
++ }
++ }
++}
++
+ static void tb_dp_resource_unavailable(struct tb *tb, struct tb_port *port)
+ {
+ struct tb_port *in, *out;
+@@ -2909,6 +2940,7 @@ static int tb_start(struct tb *tb, bool
+ tb_create_usb3_tunnels(tb->root_switch);
+ /* Add DP IN resources for the root switch */
+ tb_add_dp_resources(tb->root_switch);
++ tb_switch_enter_redrive(tb->root_switch);
+ /* Make the discovered switches available to the userspace */
+ device_for_each_child(&tb->root_switch->dev, NULL,
+ tb_scan_finalize_switch);
+@@ -2924,6 +2956,7 @@ static int tb_suspend_noirq(struct tb *t
+
+ tb_dbg(tb, "suspending...\n");
+ tb_disconnect_and_release_dp(tb);
++ tb_switch_exit_redrive(tb->root_switch);
+ tb_switch_suspend(tb->root_switch, false);
+ tcm->hotplug_active = false; /* signal tb_handle_hotplug to quit */
+ tb_dbg(tb, "suspend finished\n");
+@@ -3016,6 +3049,7 @@ static int tb_resume_noirq(struct tb *tb
+ tb_dbg(tb, "tunnels restarted, sleeping for 100ms\n");
+ msleep(100);
+ }
++ tb_switch_enter_redrive(tb->root_switch);
+ /* Allow tb_handle_hotplug to progress events */
+ tcm->hotplug_active = true;
+ tb_dbg(tb, "resume finished\n");
+@@ -3079,6 +3113,12 @@ static int tb_runtime_suspend(struct tb
+ struct tb_cm *tcm = tb_priv(tb);
+
+ mutex_lock(&tb->lock);
++ /*
++ * The below call only releases DP resources to allow exiting and
++ * re-entering redrive mode.
++ */
++ tb_disconnect_and_release_dp(tb);
++ tb_switch_exit_redrive(tb->root_switch);
+ tb_switch_suspend(tb->root_switch, true);
+ tcm->hotplug_active = false;
+ mutex_unlock(&tb->lock);
+@@ -3110,6 +3150,7 @@ static int tb_runtime_resume(struct tb *
+ tb_restore_children(tb->root_switch);
+ list_for_each_entry_safe(tunnel, n, &tcm->tunnel_list, list)
+ tb_tunnel_restart(tunnel);
++ tb_switch_enter_redrive(tb->root_switch);
+ tcm->hotplug_active = true;
+ mutex_unlock(&tb->lock);
+
--- /dev/null
+From f07dfa6a1b65034a5c3ba3a555950d972f252757 Mon Sep 17 00:00:00 2001
+From: Jack Wu <wojackbb@gmail.com>
+Date: Thu, 28 Nov 2024 10:22:27 +0800
+Subject: USB: serial: option: add MediaTek T7XX compositions
+
+From: Jack Wu <wojackbb@gmail.com>
+
+commit f07dfa6a1b65034a5c3ba3a555950d972f252757 upstream.
+
+Add the MediaTek T7XX compositions:
+
+T: Bus=03 Lev=01 Prnt=01 Port=05 Cnt=01 Dev#= 74 Spd=480 MxCh= 0
+D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=0e8d ProdID=7129 Rev= 0.01
+S: Manufacturer=MediaTek Inc.
+S: Product=USB DATA CARD
+S: SerialNumber=004402459035402
+C:* #Ifs=10 Cfg#= 1 Atr=a0 MxPwr=500mA
+A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00
+I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim
+E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
+I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+-------------------------------
+| If Number | Function |
+-------------------------------
+| 2 | USB AP Log Port |
+-------------------------------
+| 3 | USB AP GNSS Port|
+-------------------------------
+| 4 | USB AP META Port|
+-------------------------------
+| 5 | ADB port |
+-------------------------------
+| 6 | USB MD AT Port |
+------------------------------
+| 7 | USB MD META Port|
+-------------------------------
+| 8 | USB NTZ Port |
+-------------------------------
+| 9 | USB Debug port |
+-------------------------------
+
+Signed-off-by: Jack Wu <wojackbb@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -2249,6 +2249,8 @@ static const struct usb_device_id option
+ .driver_info = NCTRL(2) },
+ { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x7127, 0xff, 0x00, 0x00),
+ .driver_info = NCTRL(2) | NCTRL(3) | NCTRL(4) },
++ { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 0x7129, 0xff, 0x00, 0x00), /* MediaTek T7XX */
++ .driver_info = NCTRL(2) | NCTRL(3) | NCTRL(4) },
+ { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) },
+ { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MPL200),
+ .driver_info = RSVD(1) | RSVD(4) },
--- /dev/null
+From 724d461e44dfc0815624d2a9792f2f2beb7ee46d Mon Sep 17 00:00:00 2001
+From: Michal Hrusecky <michal.hrusecky@turris.com>
+Date: Tue, 19 Nov 2024 14:00:18 +0100
+Subject: USB: serial: option: add MeiG Smart SLM770A
+
+From: Michal Hrusecky <michal.hrusecky@turris.com>
+
+commit 724d461e44dfc0815624d2a9792f2f2beb7ee46d upstream.
+
+Update the USB serial option driver to support MeiG Smart SLM770A.
+
+ID 2dee:4d57 Marvell Mobile Composite Device Bus
+
+T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=2dee ProdID=4d57 Rev= 1.00
+S: Manufacturer=Marvell
+S: Product=Mobile Composite Device Bus
+C:* #Ifs= 6 Cfg#= 1 Atr=c0 MxPwr=500mA
+A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=03
+I:* If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host
+E: Ad=87(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=88(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms
+E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=0e(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+Tested successfully connecting to the Internet via rndis interface after
+dialing via AT commands on If#=3 or If#=4.
+Not sure of the purpose of the other serial interfaces.
+
+Signed-off-by: Michal Hrusecky <michal.hrusecky@turris.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -625,6 +625,8 @@ static void option_instat_callback(struc
+ #define MEIGSMART_PRODUCT_SRM825L 0x4d22
+ /* MeiG Smart SLM320 based on UNISOC UIS8910 */
+ #define MEIGSMART_PRODUCT_SLM320 0x4d41
++/* MeiG Smart SLM770A based on ASR1803 */
++#define MEIGSMART_PRODUCT_SLM770A 0x4d57
+
+ /* Device flags */
+
+@@ -2382,6 +2384,7 @@ static const struct usb_device_id option
+ { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) },
++ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM770A, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x30) },
+ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x60) },
--- /dev/null
+From aa954ae08262bb5cd6ab18dd56a0b58c1315db8b Mon Sep 17 00:00:00 2001
+From: Mank Wang <mank.wang@netprisma.com>
+Date: Fri, 22 Nov 2024 09:06:00 +0000
+Subject: USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready
+
+From: Mank Wang <mank.wang@netprisma.com>
+
+commit aa954ae08262bb5cd6ab18dd56a0b58c1315db8b upstream.
+
+LCUK54-WRD's pid/vid
+0x3731/0x010a
+0x3731/0x010c
+
+LCUK54-WWD's pid/vid
+0x3731/0x010b
+0x3731/0x010d
+
+Above products use the exact same interface layout and option
+driver:
+MBIM + GNSS + DIAG + NMEA + AT + QDSS + DPL
+
+T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 5 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=3731 ProdID=0101 Rev= 5.04
+S: Manufacturer=NetPrisma
+S: Product=LCUK54-WRD
+S: SerialNumber=feeba631
+C:* #Ifs= 8 Cfg#= 1 Atr=a0 MxPwr=500mA
+A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00
+I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim
+E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
+I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 2 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
+I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
+E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
+E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
+E: Ad=8f(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+Signed-off-by: Mank Wang <mank.wang@netprisma.com>
+[ johan: use lower case hex notation ]
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -2377,6 +2377,18 @@ static const struct usb_device_id option
+ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Golbal EDU */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0x00, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0116, 0xff, 0xff, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010a, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WRD for WWAN Ready */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010a, 0xff, 0x00, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010a, 0xff, 0xff, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010b, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for WWAN Ready */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010b, 0xff, 0x00, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010b, 0xff, 0xff, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010c, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WRD for WWAN Ready */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010c, 0xff, 0x00, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010c, 0xff, 0xff, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010d, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for WWAN Ready */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010d, 0xff, 0x00, 0x40) },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x010d, 0xff, 0xff, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) },
+ { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) },
+ { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x40) },
--- /dev/null
+From fdad4fb7c506bea8b419f70ff2163d99962e8ede Mon Sep 17 00:00:00 2001
+From: Daniel Swanemar <d.swanemar@gmail.com>
+Date: Mon, 4 Nov 2024 14:42:17 +0100
+Subject: USB: serial: option: add TCL IK512 MBIM & ECM
+
+From: Daniel Swanemar <d.swanemar@gmail.com>
+
+commit fdad4fb7c506bea8b419f70ff2163d99962e8ede upstream.
+
+Add the following TCL IK512 compositions:
+
+0x0530: Modem + Diag + AT + MBIM
+T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=10000 MxCh= 0
+D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
+P: Vendor=1bbb ProdID=0530 Rev=05.04
+S: Manufacturer=TCL
+S: Product=TCL 5G USB Dongle
+S: SerialNumber=3136b91a
+C: #Ifs= 5 Cfg#= 1 Atr=80 MxPwr=896mA
+I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=82(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
+E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
+I: If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+
+0x0640: ECM + Modem + Diag + AT
+T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 4 Spd=10000 MxCh= 0
+D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
+P: Vendor=1bbb ProdID=0640 Rev=05.04
+S: Manufacturer=TCL
+S: Product=TCL 5G USB Dongle
+S: SerialNumber=3136b91a
+C: #Ifs= 5 Cfg#= 1 Atr=80 MxPwr=896mA
+I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=32ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
+E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+
+Signed-off-by: Daniel Swanemar <d.swanemar@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -2385,6 +2385,10 @@ static const struct usb_device_id option
+ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x30) },
+ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x60) },
++ { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0530, 0xff), /* TCL IK512 MBIM */
++ .driver_info = NCTRL(1) },
++ { USB_DEVICE_INTERFACE_CLASS(0x1bbb, 0x0640, 0xff), /* TCL IK512 ECM */
++ .driver_info = NCTRL(3) },
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
--- /dev/null
+From 8366e64a4454481339e7c56a8ad280161f2e441d Mon Sep 17 00:00:00 2001
+From: Daniele Palmas <dnlplm@gmail.com>
+Date: Mon, 9 Dec 2024 16:32:54 +0100
+Subject: USB: serial: option: add Telit FE910C04 rmnet compositions
+
+From: Daniele Palmas <dnlplm@gmail.com>
+
+commit 8366e64a4454481339e7c56a8ad280161f2e441d upstream.
+
+Add the following Telit FE910C04 compositions:
+
+0x10c0: rmnet + tty (AT/NMEA) + tty (AT) + tty (diag)
+T: Bus=02 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 13 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1bc7 ProdID=10c0 Rev=05.15
+S: Manufacturer=Telit Cinterion
+S: Product=FE910
+S: SerialNumber=f71b8b32
+C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+0x10c4: rmnet + tty (AT) + tty (AT) + tty (diag)
+T: Bus=02 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 14 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1bc7 ProdID=10c4 Rev=05.15
+S: Manufacturer=Telit Cinterion
+S: Product=FE910
+S: SerialNumber=f71b8b32
+C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+0x10c8: rmnet + tty (AT) + tty (diag) + DPL (data packet logging) + adb
+T: Bus=02 Lev=01 Prnt=03 Port=06 Cnt=01 Dev#= 17 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1bc7 ProdID=10c8 Rev=05.15
+S: Manufacturer=Telit Cinterion
+S: Product=FE910
+S: SerialNumber=f71b8b32
+C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
+E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1397,6 +1397,12 @@ static const struct usb_device_id option
+ .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10aa, 0xff), /* Telit FN920C04 (MBIM) */
+ .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c0, 0xff), /* Telit FE910C04 (rmnet) */
++ .driver_info = RSVD(0) | NCTRL(3) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c4, 0xff), /* Telit FE910C04 (rmnet) */
++ .driver_info = RSVD(0) | NCTRL(3) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c8, 0xff), /* Telit FE910C04 (rmnet) */
++ .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
--- /dev/null
+From e21ebe51af688eb98fd6269240212a3c7300deea Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Tue, 17 Dec 2024 12:21:21 +0200
+Subject: xhci: Turn NEC specific quirk for handling Stop Endpoint errors generic
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit e21ebe51af688eb98fd6269240212a3c7300deea upstream.
+
+xHC hosts from several vendors have the same issue where endpoints start
+so slowly that a later queued 'Stop Endpoint' command may complete before
+endpoint is up and running.
+
+The 'Stop Endpoint' command fails with context state error as the endpoint
+still appears as stopped.
+
+See commit 42b758137601 ("usb: xhci: Limit Stop Endpoint retries") for
+details
+
+CC: stable@vger.kernel.org
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20241217102122.2316814-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-ring.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1192,8 +1192,6 @@ static void xhci_handle_cmd_stop_ep(stru
+ * Keep retrying until the EP starts and stops again, on
+ * chips where this is known to help. Wait for 100ms.
+ */
+- if (!(xhci->quirks & XHCI_NEC_HOST))
+- break;
+ if (time_is_before_jiffies(ep->stop_time + msecs_to_jiffies(100)))
+ break;
+ fallthrough;
projects / thirdparty / kernel / stable-queue.git / commitdiff
