--- /dev/null
+From 0a27ebf944c5b6214a9f4401329cd95402493b90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Aug 2024 12:30:52 -0400
+Subject: btrfs: update target inode's ctime on unlink
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit 3bc2ac2f8f0b78a13140fc72022771efe0c9b778 ]
+
+Unlink changes the link count on the target inode. POSIX mandates that
+the ctime must also change when this occurs.
+
+According to https://pubs.opengroup.org/onlinepubs/9699919799/functions/unlink.html:
+
+"Upon successful completion, unlink() shall mark for update the last data
+ modification and last file status change timestamps of the parent
+ directory. Also, if the file's link count is not 0, the last file status
+ change timestamp of the file shall be marked for update."
+
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Reviewed-by: David Sterba <dsterba@suse.com>
+[ add link to the opengroup docs ]
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/inode.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 2951aa0039fc..5d23421b6243 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -4213,6 +4213,7 @@ static int __btrfs_unlink_inode(struct btrfs_trans_handle *trans,
+
+ btrfs_i_size_write(dir, dir->vfs_inode.i_size - name->len * 2);
+ inode_inc_iversion(&inode->vfs_inode);
++ inode_set_ctime_current(&inode->vfs_inode);
+ inode_inc_iversion(&dir->vfs_inode);
+ inode_set_mtime_to_ts(&dir->vfs_inode, inode_set_ctime_current(&dir->vfs_inode));
+ ret = btrfs_update_inode(trans, dir);
+--
+2.43.0
+
--- /dev/null
+From b00d3288123d9e493f3a1efec790e0be83e88ee2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Aug 2024 21:30:17 -0400
+Subject: cgroup/cpuset: Eliminate unncessary sched domains rebuilds in hotplug
+
+From: Waiman Long <longman@redhat.com>
+
+[ Upstream commit ff0ce721ec213499ec5a532041fb3a1db2dc5ecb ]
+
+It was found that some hotplug operations may cause multiple
+rebuild_sched_domains_locked() calls. Some of those intermediate calls
+may use cpuset states not in the final correct form leading to incorrect
+sched domain setting.
+
+Fix this problem by using the existing force_rebuild flag to inhibit
+immediate rebuild_sched_domains_locked() calls if set and only doing
+one final call at the end. Also renaming the force_rebuild flag to
+force_sd_rebuild to make its meaning for clear.
+
+Signed-off-by: Waiman Long <longman@redhat.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/cgroup/cpuset.c | 33 +++++++++++++++++----------------
+ 1 file changed, 17 insertions(+), 16 deletions(-)
+
+diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
+index e8f24483e05f..c03a2bc106d4 100644
+--- a/kernel/cgroup/cpuset.c
++++ b/kernel/cgroup/cpuset.c
+@@ -223,6 +223,13 @@ static cpumask_var_t isolated_cpus;
+ /* List of remote partition root children */
+ static struct list_head remote_children;
+
++/*
++ * A flag to force sched domain rebuild at the end of an operation while
++ * inhibiting it in the intermediate stages when set. Currently it is only
++ * set in hotplug code.
++ */
++static bool force_sd_rebuild;
++
+ /*
+ * Partition root states:
+ *
+@@ -1442,7 +1449,7 @@ static void update_partition_sd_lb(struct cpuset *cs, int old_prs)
+ clear_bit(CS_SCHED_LOAD_BALANCE, &cs->flags);
+ }
+
+- if (rebuild_domains)
++ if (rebuild_domains && !force_sd_rebuild)
+ rebuild_sched_domains_locked();
+ }
+
+@@ -1805,7 +1812,7 @@ static void remote_partition_check(struct cpuset *cs, struct cpumask *newmask,
+ remote_partition_disable(child, tmp);
+ disable_cnt++;
+ }
+- if (disable_cnt)
++ if (disable_cnt && !force_sd_rebuild)
+ rebuild_sched_domains_locked();
+ }
+
+@@ -2415,7 +2422,8 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp,
+ }
+ rcu_read_unlock();
+
+- if (need_rebuild_sched_domains && !(flags & HIER_NO_SD_REBUILD))
++ if (need_rebuild_sched_domains && !(flags & HIER_NO_SD_REBUILD) &&
++ !force_sd_rebuild)
+ rebuild_sched_domains_locked();
+ }
+
+@@ -3077,7 +3085,8 @@ static int update_flag(cpuset_flagbits_t bit, struct cpuset *cs,
+ cs->flags = trialcs->flags;
+ spin_unlock_irq(&callback_lock);
+
+- if (!cpumask_empty(trialcs->cpus_allowed) && balance_flag_changed)
++ if (!cpumask_empty(trialcs->cpus_allowed) && balance_flag_changed &&
++ !force_sd_rebuild)
+ rebuild_sched_domains_locked();
+
+ if (spread_flag_changed)
+@@ -4478,11 +4487,9 @@ hotplug_update_tasks(struct cpuset *cs,
+ update_tasks_nodemask(cs);
+ }
+
+-static bool force_rebuild;
+-
+ void cpuset_force_rebuild(void)
+ {
+- force_rebuild = true;
++ force_sd_rebuild = true;
+ }
+
+ /**
+@@ -4630,15 +4637,9 @@ static void cpuset_handle_hotplug(void)
+ !cpumask_empty(subpartitions_cpus);
+ mems_updated = !nodes_equal(top_cpuset.effective_mems, new_mems);
+
+- /*
+- * In the rare case that hotplug removes all the cpus in
+- * subpartitions_cpus, we assumed that cpus are updated.
+- */
+- if (!cpus_updated && !cpumask_empty(subpartitions_cpus))
+- cpus_updated = true;
+-
+ /* For v1, synchronize cpus_allowed to cpu_active_mask */
+ if (cpus_updated) {
++ cpuset_force_rebuild();
+ spin_lock_irq(&callback_lock);
+ if (!on_dfl)
+ cpumask_copy(top_cpuset.cpus_allowed, &new_cpus);
+@@ -4694,8 +4695,8 @@ static void cpuset_handle_hotplug(void)
+ }
+
+ /* rebuild sched domains if cpus_allowed has changed */
+- if (cpus_updated || force_rebuild) {
+- force_rebuild = false;
++ if (force_sd_rebuild) {
++ force_sd_rebuild = false;
+ rebuild_sched_domains_cpuslocked();
+ }
+
+--
+2.43.0
+
--- /dev/null
+From a960d2f90a5f7ed3f4103b4232ffcf5c0944979f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Aug 2024 17:20:26 -0400
+Subject: drm/amdgpu: Update kmd_fw_shared for VCN5
+
+From: Yinjie Yao <yinjie.yao@amd.com>
+
+[ Upstream commit 507a2286c052919fe416b3daa0f0061d0fc702b9 ]
+
+kmd_fw_shared changed in VCN5
+
+Signed-off-by: Yinjie Yao <yinjie.yao@amd.com>
+Reviewed-by: Ruijing Dong <ruijing.dong@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit aa02486fb18cecbaca0c4fd393d1a03f1d4c3f9a)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h
+index 1a5439abd1a0..c87d68d4be53 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h
+@@ -461,8 +461,11 @@ struct amdgpu_vcn5_fw_shared {
+ struct amdgpu_fw_shared_unified_queue_struct sq;
+ uint8_t pad1[8];
+ struct amdgpu_fw_shared_fw_logging fw_log;
++ uint8_t pad2[20];
+ struct amdgpu_fw_shared_rb_setup rb_setup;
+- uint8_t pad2[4];
++ struct amdgpu_fw_shared_smu_interface_info smu_dpm_interface;
++ struct amdgpu_fw_shared_drm_key_wa drm_key_wa;
++ uint8_t pad3[9];
+ };
+
+ #define VCN_BLOCK_ENCODE_DISABLE_MASK 0x80
+--
+2.43.0
+
--- /dev/null
+From 8158bec1be4d09c0b250a54bbe74e875642b02fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jul 2024 10:24:10 +0200
+Subject: drm/mediatek: Set sensible cursor width/height values to fix crash
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 042b8711a0beafb2c3b888bebe3c300ab4c817fa ]
+
+Hardware-speaking, there is no feature-reduced cursor specific
+plane, so this driver reserves the last all Overlay plane as a
+Cursor plane, but sets the maximum cursor width/height to the
+maximum value that the full overlay plane can use.
+
+While this could be ok, it raises issues with common userspace
+using libdrm (especially Mutter, but other compositors too) which
+will crash upon performing allocations and/or using said cursor
+plane.
+
+Reduce the maximum width/height for the cursor to 512x512 pixels,
+value taken from IGT's maximum cursor size test, which succeeds.
+
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Fei Shao <fshao@chromium.org>
+Tested-by: Fei Shao <fshao@chromium.org>
+Reviewed-by: Daniel Stone <daniels@collabora.com>
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/20240718082410.204459-1-angelogioacchino.delregno@collabora.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_drv.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+index 56f409ad7f39..ab2bace792e4 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+@@ -539,8 +539,8 @@ static int mtk_drm_kms_init(struct drm_device *drm)
+ }
+
+ /* IGT will check if the cursor size is configured */
+- drm->mode_config.cursor_width = drm->mode_config.max_width;
+- drm->mode_config.cursor_height = drm->mode_config.max_height;
++ drm->mode_config.cursor_width = 512;
++ drm->mode_config.cursor_height = 512;
+
+ /* Use OVL device for all DMA memory allocations */
+ crtc = drm_crtc_from_index(drm, 0);
+--
+2.43.0
+
--- /dev/null
+From 9b6e01ffc838153cb929db9751a09dc42525cde2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jul 2024 09:06:30 -0700
+Subject: drm/msm/adreno: Fix error return if missing firmware-name
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit 624ab9cde26a9f150b4fd268b0f3dae3184dc40c ]
+
+-ENODEV is used to signify that there is no zap shader for the platform,
+and the CPU can directly take the GPU out of secure mode. We want to
+use this return code when there is no zap-shader node. But not when
+there is, but without a firmware-name property. This case we want to
+treat as-if the needed fw is not found.
+
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Akhil P Oommen <quic_akhilpo@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/604564/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/adreno_gpu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+index 074fb498706f..b93ed15f04a3 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+@@ -99,7 +99,7 @@ static int zap_shader_load_mdt(struct msm_gpu *gpu, const char *fwname,
+ * was a bad idea, and is only provided for backwards
+ * compatibility for older targets.
+ */
+- return -ENODEV;
++ return -ENOENT;
+ }
+
+ if (IS_ERR(fw)) {
+--
+2.43.0
+
--- /dev/null
+From 36e38a4bf2a9df16bd60077e0ac513070e5f5ea7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jul 2024 14:47:30 +0200
+Subject: drm: panel-orientation-quirks: Add quirk for Ayn Loki Zero
+
+From: Bouke Sybren Haarsma <boukehaarsma23@gmail.com>
+
+[ Upstream commit b86aa4140f6a8f01f35bfb05af60e01a55b48803 ]
+
+Add quirk orientation for the Ayn Loki Zero.
+
+This also has been tested/used by the JELOS team.
+
+Signed-off-by: Bouke Sybren Haarsma <boukehaarsma23@gmail.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240728124731.168452-2-boukehaarsma23@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index 903f4bfea7e8..40473c705562 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -208,6 +208,12 @@ static const struct dmi_system_id orientation_data[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "KUN"),
+ },
+ .driver_data = (void *)&lcd1600x2560_rightside_up,
++ }, { /* AYN Loki Zero */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ayn"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Loki Zero"),
++ },
++ .driver_data = (void *)&lcd1080x1920_leftside_up,
+ }, { /* Chuwi HiBook (CWI514) */
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "Hampoo"),
+--
+2.43.0
+
--- /dev/null
+From 2862ce5a86750d8fcda7d29ad5871ca9e26d4f72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jul 2024 14:47:31 +0200
+Subject: drm: panel-orientation-quirks: Add quirk for Ayn Loki Max
+
+From: Bouke Sybren Haarsma <boukehaarsma23@gmail.com>
+
+[ Upstream commit 2c71c8459c8ca66bd8f597effaac892ee8448a9f ]
+
+Add quirk orientation for Ayn Loki Max model.
+
+This has been tested by JELOS team that uses their
+own patched kernel for a while now and confirmed by
+users in the ChimeraOS discord servers.
+
+Signed-off-by: Bouke Sybren Haarsma <boukehaarsma23@gmail.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240728124731.168452-3-boukehaarsma23@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index 40473c705562..70c9bd25f78d 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -208,6 +208,12 @@ static const struct dmi_system_id orientation_data[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "KUN"),
+ },
+ .driver_data = (void *)&lcd1600x2560_rightside_up,
++ }, { /* AYN Loki Max */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ayn"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Loki Max"),
++ },
++ .driver_data = (void *)&lcd1080x1920_leftside_up,
+ }, { /* AYN Loki Zero */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ayn"),
+--
+2.43.0
+
--- /dev/null
+From e165196186b49d1565f95b1d7a1fa7a935388c1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Aug 2024 16:53:32 -0700
+Subject: drm/xe: fix WA 14018094691
+
+From: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+
+[ Upstream commit f5cb1275c8ce56c7583cb323cfa08a820a7ef6b4 ]
+
+This WA is applied while initializing the media GT, but it a primary
+GT WA (because it modifies a register on the primary GT), so the XE_WA
+macro is returning false even when the WA should be applied.
+Fix this by using the primary GT in the macro.
+
+Note that this WA only applies to PXP and we don't yet support that in
+Xe, so there are no negative effects to this bug, which is why we didn't
+see any errors in testing.
+
+v2: use the primary GT in the macro instead of marking the WA as
+platform-wide (Lucas, Matt).
+
+Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Cc: Matt Roper <matthew.d.roper@intel.com>
+Cc: Lucas De Marchi <lucas.demarchi@intel.com>
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240807235333.1370915-1-daniele.ceraolospurio@intel.com
+(cherry picked from commit e422c0bfd9e47e399e86bcc483f49d8b54064fc2)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_gsc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_gsc.c b/drivers/gpu/drm/xe/xe_gsc.c
+index 95c17b72fa57..c9a4ffcfdcca 100644
+--- a/drivers/gpu/drm/xe/xe_gsc.c
++++ b/drivers/gpu/drm/xe/xe_gsc.c
+@@ -256,7 +256,7 @@ static int gsc_upload_and_init(struct xe_gsc *gsc)
+ struct xe_tile *tile = gt_to_tile(gt);
+ int ret;
+
+- if (XE_WA(gt, 14018094691)) {
++ if (XE_WA(tile->primary_gt, 14018094691)) {
+ ret = xe_force_wake_get(gt_to_fw(tile->primary_gt), XE_FORCEWAKE_ALL);
+
+ /*
+@@ -274,7 +274,7 @@ static int gsc_upload_and_init(struct xe_gsc *gsc)
+
+ ret = gsc_upload(gsc);
+
+- if (XE_WA(gt, 14018094691))
++ if (XE_WA(tile->primary_gt, 14018094691))
+ xe_force_wake_put(gt_to_fw(tile->primary_gt), XE_FORCEWAKE_ALL);
+
+ if (ret)
+--
+2.43.0
+
--- /dev/null
+From d06b6eb394680700c6b3b8ce33f50afbcf90e446 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Aug 2024 16:12:35 -0700
+Subject: drm/xe: use devm instead of drmm for managed bo
+
+From: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+
+[ Upstream commit 8636a5c29be1f05b5162a5c82c874338b6717759 ]
+
+The BO cleanup touches the GGTT and therefore requires the HW to be
+available, so we need to use devm instead of drmm.
+
+Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/1160
+Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Cc: Lucas De Marchi <lucas.demarchi@intel.com>
+Cc: Matthew Auld <matthew.auld@intel.com>
+Reviewed-by: Matthew Auld <matthew.auld@intel.com>
+Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240809231237.1503796-2-daniele.ceraolospurio@intel.com
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+(cherry picked from commit 8d3a2d3d766a823c7510cdc17e6ff7c042c63b61)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_bo.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
+index b6f3a43d637f..f5e3012eff20 100644
+--- a/drivers/gpu/drm/xe/xe_bo.c
++++ b/drivers/gpu/drm/xe/xe_bo.c
+@@ -1539,7 +1539,7 @@ struct xe_bo *xe_bo_create_from_data(struct xe_device *xe, struct xe_tile *tile,
+ return bo;
+ }
+
+-static void __xe_bo_unpin_map_no_vm(struct drm_device *drm, void *arg)
++static void __xe_bo_unpin_map_no_vm(void *arg)
+ {
+ xe_bo_unpin_map_no_vm(arg);
+ }
+@@ -1554,7 +1554,7 @@ struct xe_bo *xe_managed_bo_create_pin_map(struct xe_device *xe, struct xe_tile
+ if (IS_ERR(bo))
+ return bo;
+
+- ret = drmm_add_action_or_reset(&xe->drm, __xe_bo_unpin_map_no_vm, bo);
++ ret = devm_add_action_or_reset(xe->drm.dev, __xe_bo_unpin_map_no_vm, bo);
+ if (ret)
+ return ERR_PTR(ret);
+
+@@ -1602,7 +1602,7 @@ int xe_managed_bo_reinit_in_vram(struct xe_device *xe, struct xe_tile *tile, str
+ if (IS_ERR(bo))
+ return PTR_ERR(bo);
+
+- drmm_release_action(&xe->drm, __xe_bo_unpin_map_no_vm, *src);
++ devm_release_action(xe->drm.dev, __xe_bo_unpin_map_no_vm, *src);
+ *src = bo;
+
+ return 0;
+--
+2.43.0
+
--- /dev/null
+From d4d657c4af73dd590b2cc1e4ddca8e74a6387960 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Jul 2024 11:46:37 -0700
+Subject: drm/xe/xe2lpm: Extend Wa_16021639441
+
+From: Ngai-Mint Kwan <ngai-mint.kwan@linux.intel.com>
+
+[ Upstream commit 03a2dc84f5c4ef31ac0112b29d51ff103f7c8dd4 ]
+
+Wa_16021639441 applies to Xe2_LPM.
+
+Signed-off-by: Ngai-Mint Kwan <ngai-mint.kwan@linux.intel.com>
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240701184637.531794-1-ngai-mint.kwan@linux.intel.com
+(cherry picked from commit 74e3076800067c6dc0dcff5b75344cec064c20eb)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_wa.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/xe_wa.c b/drivers/gpu/drm/xe/xe_wa.c
+index 66dafe980b9c..1f7699d7fffb 100644
+--- a/drivers/gpu/drm/xe/xe_wa.c
++++ b/drivers/gpu/drm/xe/xe_wa.c
+@@ -542,6 +542,16 @@ static const struct xe_rtp_entry_sr engine_was[] = {
+ XE_RTP_ACTIONS(SET(HALF_SLICE_CHICKEN7, CLEAR_OPTIMIZATION_DISABLE))
+ },
+
++ /* Xe2_LPM */
++
++ { XE_RTP_NAME("16021639441"),
++ XE_RTP_RULES(MEDIA_VERSION(2000)),
++ XE_RTP_ACTIONS(SET(CSFE_CHICKEN1(0),
++ GHWSP_CSB_REPORT_DIS |
++ PPHWSP_CSB_AND_TIMESTAMP_REPORT_DIS,
++ XE_RTP_ACTION_FLAG(ENGINE_BASE)))
++ },
++
+ /* Xe2_HPM */
+
+ { XE_RTP_NAME("16021639441"),
+--
+2.43.0
+
--- /dev/null
+From c5d9a595580fb4ce0d81687c16372f8c965f8900 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jul 2024 10:31:25 +1200
+Subject: hid-asus: add ROG Ally X prod ID to quirk list
+
+From: Luke D. Jones <luke@ljones.dev>
+
+[ Upstream commit d1aa95e86f178dc597e80228cd9bd81fc3510f34 ]
+
+The new ASUS ROG Ally X functions almost exactly the same as the previous
+model, so we can use the same quirks.
+
+Signed-off-by: Luke D. Jones <luke@ljones.dev>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-asus.c | 3 +++
+ drivers/hid/hid-ids.h | 1 +
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
+index 37e6d25593c2..a282388b7aa5 100644
+--- a/drivers/hid/hid-asus.c
++++ b/drivers/hid/hid-asus.c
+@@ -1248,6 +1248,9 @@ static const struct hid_device_id asus_devices[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+ USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY),
+ QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
++ USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X),
++ QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+ USB_DEVICE_ID_ASUSTEK_ROG_CLAYMORE_II_KEYBOARD),
+ QUIRK_ROG_CLAYMORE_II_KEYBOARD },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 72d56ee7ce1b..6e3223389080 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -210,6 +210,7 @@
+ #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD3 0x1a30
+ #define USB_DEVICE_ID_ASUSTEK_ROG_Z13_LIGHTBAR 0x18c6
+ #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY 0x1abe
++#define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X 0x1b4c
+ #define USB_DEVICE_ID_ASUSTEK_ROG_CLAYMORE_II_KEYBOARD 0x196b
+ #define USB_DEVICE_ID_ASUSTEK_FX503VD_KEYBOARD 0x1869
+
+--
+2.43.0
+
--- /dev/null
+From afe768b698a72e768fe4cfeaf75fe82a9cbf9367 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jul 2024 23:27:57 +0100
+Subject: HID: multitouch: Add support for GT7868Q
+
+From: Dmitry Savin <envelsavinds@gmail.com>
+
+[ Upstream commit c8000deb68365b461b324d68c7ea89d730f0bb85 ]
+
+GT7868Q has incorrect data in the report and needs a fixup.
+The change enables haptic touchpad on Lenovo ThinkBook 13x Gen 4
+and has been tested on the device.
+
+Signed-off-by: Dmitry Savin <envelsavinds@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 2 ++
+ drivers/hid/hid-multitouch.c | 33 +++++++++++++++++++++++++++++++++
+ 2 files changed, 35 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 6e3223389080..781c5aa29859 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -521,6 +521,8 @@
+ #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_E100 0xe100
+
+ #define I2C_VENDOR_ID_GOODIX 0x27c6
++#define I2C_DEVICE_ID_GOODIX_01E8 0x01e8
++#define I2C_DEVICE_ID_GOODIX_01E9 0x01e9
+ #define I2C_DEVICE_ID_GOODIX_01F0 0x01f0
+
+ #define USB_VENDOR_ID_GOODTOUCH 0x1aad
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 56fc78841f24..99812c0f830b 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -1441,6 +1441,30 @@ static int mt_event(struct hid_device *hid, struct hid_field *field,
+ return 0;
+ }
+
++static __u8 *mt_report_fixup(struct hid_device *hdev, __u8 *rdesc,
++ unsigned int *size)
++{
++ if (hdev->vendor == I2C_VENDOR_ID_GOODIX &&
++ (hdev->product == I2C_DEVICE_ID_GOODIX_01E8 ||
++ hdev->product == I2C_DEVICE_ID_GOODIX_01E9)) {
++ if (rdesc[607] == 0x15) {
++ rdesc[607] = 0x25;
++ dev_info(
++ &hdev->dev,
++ "GT7868Q report descriptor fixup is applied.\n");
++ } else {
++ dev_info(
++ &hdev->dev,
++ "The byte is not expected for fixing the report descriptor. \
++It's possible that the touchpad firmware is not suitable for applying the fix. \
++got: %x\n",
++ rdesc[607]);
++ }
++ }
++
++ return rdesc;
++}
++
+ static void mt_report(struct hid_device *hid, struct hid_report *report)
+ {
+ struct mt_device *td = hid_get_drvdata(hid);
+@@ -2035,6 +2059,14 @@ static const struct hid_device_id mt_devices[] = {
+ MT_BT_DEVICE(USB_VENDOR_ID_FRUCTEL,
+ USB_DEVICE_ID_GAMETEL_MT_MODE) },
+
++ /* Goodix GT7868Q devices */
++ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU,
++ HID_DEVICE(BUS_I2C, HID_GROUP_ANY, I2C_VENDOR_ID_GOODIX,
++ I2C_DEVICE_ID_GOODIX_01E8) },
++ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU,
++ HID_DEVICE(BUS_I2C, HID_GROUP_ANY, I2C_VENDOR_ID_GOODIX,
++ I2C_DEVICE_ID_GOODIX_01E8) },
++
+ /* GoodTouch panels */
+ { .driver_data = MT_CLS_NSMU,
+ MT_USB_DEVICE(USB_VENDOR_ID_GOODTOUCH,
+@@ -2270,6 +2302,7 @@ static struct hid_driver mt_driver = {
+ .feature_mapping = mt_feature_mapping,
+ .usage_table = mt_grabbed_usages,
+ .event = mt_event,
++ .report_fixup = mt_report_fixup,
+ .report = mt_report,
+ .suspend = pm_ptr(mt_suspend),
+ .reset_resume = pm_ptr(mt_reset_resume),
+--
+2.43.0
+
--- /dev/null
+From 13e8f770c671c051ac218b9cbfbd06e55b54a7bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jul 2024 23:18:57 +0200
+Subject: Input: ads7846 - ratelimit the spi_sync error message
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit ccbfea78adf75d3d9e87aa739dab83254f5333fa ]
+
+In case the touch controller is not connected, this message keeps scrolling
+on the console indefinitelly. Ratelimit it to avoid filling kernel logs.
+
+"
+ads7846 spi2.1: spi_sync --> -22
+"
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Link: https://lore.kernel.org/r/20240708211913.171243-1-marex@denx.de
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/ads7846.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
+index 4d13db13b9e5..b42096c797bf 100644
+--- a/drivers/input/touchscreen/ads7846.c
++++ b/drivers/input/touchscreen/ads7846.c
+@@ -805,7 +805,7 @@ static void ads7846_read_state(struct ads7846 *ts)
+ m = &ts->msg[msg_idx];
+ error = spi_sync(ts->spi, m);
+ if (error) {
+- dev_err(&ts->spi->dev, "spi_sync --> %d\n", error);
++ dev_err_ratelimited(&ts->spi->dev, "spi_sync --> %d\n", error);
+ packet->ignore = true;
+ return;
+ }
+--
+2.43.0
+
--- /dev/null
+From ea544f8843a50ab0c7ce23ba2cc900a3bfd318f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Aug 2024 23:13:10 -0400
+Subject: Input: edt-ft5x06 - add support for FocalTech FT8201
+
+From: Felix Kaechele <felix@kaechele.ca>
+
+[ Upstream commit fc289d3e8698f9b11edad6d73f371ebf35944c57 ]
+
+The driver supports the FT8201 chip as well. It registers up to 10 touch
+points.
+
+Tested on: Lenovo ThinkSmart View (CD-18781Y), LCM: BOE TV080WXM-LL4
+
+Signed-off-by: Felix Kaechele <felix@kaechele.ca>
+Link: https://lore.kernel.org/r/20240804031310.331871-3-felix@kaechele.ca
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/edt-ft5x06.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/input/touchscreen/edt-ft5x06.c b/drivers/input/touchscreen/edt-ft5x06.c
+index 06ec0f2e18ae..b0b5b6241b44 100644
+--- a/drivers/input/touchscreen/edt-ft5x06.c
++++ b/drivers/input/touchscreen/edt-ft5x06.c
+@@ -1474,6 +1474,10 @@ static const struct edt_i2c_chip_data edt_ft6236_data = {
+ .max_support_points = 2,
+ };
+
++static const struct edt_i2c_chip_data edt_ft8201_data = {
++ .max_support_points = 10,
++};
++
+ static const struct edt_i2c_chip_data edt_ft8719_data = {
+ .max_support_points = 10,
+ };
+@@ -1485,6 +1489,7 @@ static const struct i2c_device_id edt_ft5x06_ts_id[] = {
+ { .name = "ft5452", .driver_data = (long)&edt_ft5452_data },
+ /* Note no edt- prefix for compatibility with the ft6236.c driver */
+ { .name = "ft6236", .driver_data = (long)&edt_ft6236_data },
++ { .name = "ft8201", .driver_data = (long)&edt_ft8201_data },
+ { .name = "ft8719", .driver_data = (long)&edt_ft8719_data },
+ { /* sentinel */ }
+ };
+@@ -1499,6 +1504,7 @@ static const struct of_device_id edt_ft5x06_of_match[] = {
+ { .compatible = "focaltech,ft5452", .data = &edt_ft5452_data },
+ /* Note focaltech vendor prefix for compatibility with ft6236.c */
+ { .compatible = "focaltech,ft6236", .data = &edt_ft6236_data },
++ { .compatible = "focaltech,ft8201", .data = &edt_ft8201_data },
+ { .compatible = "focaltech,ft8719", .data = &edt_ft8719_data },
+ { /* sentinel */ }
+ };
+--
+2.43.0
+
--- /dev/null
+From e6ecb3589f50a5106b5dad3af12e48ee35f1dc64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Aug 2024 12:06:19 +0200
+Subject: Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 7ce7c2283fa6843ab3c2adfeb83dcc504a107858 ]
+
+Yet another quirk entry for Fujitsu laptop. Lifebook E756 requires
+i8041.nomux for keeping the touchpad working after suspend/resume.
+
+Link: https://bugzilla.suse.com/show_bug.cgi?id=1229056
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/20240814100630.2048-1-tiwai@suse.de
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/serio/i8042-acpipnpio.h | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/input/serio/i8042-acpipnpio.h b/drivers/input/serio/i8042-acpipnpio.h
+index e9eb9554dd7b..bad238f69a7a 100644
+--- a/drivers/input/serio/i8042-acpipnpio.h
++++ b/drivers/input/serio/i8042-acpipnpio.h
+@@ -627,6 +627,15 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = {
+ },
+ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
++ {
++ /* Fujitsu Lifebook E756 */
++ /* https://bugzilla.suse.com/show_bug.cgi?id=1229056 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E756"),
++ },
++ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
++ },
+ {
+ /* Fujitsu Lifebook E5411 */
+ .matches = {
+--
+2.43.0
+
--- /dev/null
+From 520fb3826918d3fa64472f6423597a56fa91c8b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jul 2024 21:33:30 -0700
+Subject: Input: synaptics - enable SMBus for HP Elitebook 840 G2
+
+From: Jonathan Denose <jdenose@google.com>
+
+[ Upstream commit da897484557b34a54fabb81f6c223c19a69e546d ]
+
+The kernel reports that the touchpad for this device can support a
+different bus.
+
+With SMBus enabled the touchpad movement is smoother and three-finger
+gestures are recognized.
+
+Signed-off-by: Jonathan Denose <jdenose@google.com>
+Link: https://lore.kernel.org/r/20240719180612.1.Ib652dd808c274076f32cd7fc6c1160d2cf71753b@changeid
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/mouse/synaptics.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 7a303a9d6bf7..cff3393f0dd0 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -189,6 +189,7 @@ static const char * const smbus_pnp_ids[] = {
+ "LEN2054", /* E480 */
+ "LEN2055", /* E580 */
+ "LEN2068", /* T14 Gen 1 */
++ "SYN3015", /* HP EliteBook 840 G2 */
+ "SYN3052", /* HP EliteBook 840 G4 */
+ "SYN3221", /* HP 15-ay000 */
+ "SYN323d", /* HP Spectre X360 13-w013dx */
+--
+2.43.0
+
--- /dev/null
+From e07e35ea13f2ebaada5a1ff2083bb2ce600ac298 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Aug 2024 08:56:18 +0900
+Subject: ksmbd: override fsids for share path check
+
+From: Namjae Jeon <linkinjeon@kernel.org>
+
+[ Upstream commit a018c1b636e79b60149b41151ded7c2606d8606e ]
+
+Sangsoo reported that a DAC denial error occurred when accessing
+files through the ksmbd thread. This patch override fsids for share
+path check.
+
+Reported-by: Sangsoo Lee <constant.lee@samsung.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/mgmt/share_config.c | 15 ++++++++++++---
+ fs/smb/server/mgmt/share_config.h | 4 +++-
+ fs/smb/server/mgmt/tree_connect.c | 9 +++++----
+ fs/smb/server/mgmt/tree_connect.h | 4 ++--
+ fs/smb/server/smb2pdu.c | 2 +-
+ fs/smb/server/smb_common.c | 9 +++++++--
+ fs/smb/server/smb_common.h | 2 ++
+ 7 files changed, 32 insertions(+), 13 deletions(-)
+
+diff --git a/fs/smb/server/mgmt/share_config.c b/fs/smb/server/mgmt/share_config.c
+index e0a6b758094f..d8d03070ae44 100644
+--- a/fs/smb/server/mgmt/share_config.c
++++ b/fs/smb/server/mgmt/share_config.c
+@@ -15,6 +15,7 @@
+ #include "share_config.h"
+ #include "user_config.h"
+ #include "user_session.h"
++#include "../connection.h"
+ #include "../transport_ipc.h"
+ #include "../misc.h"
+
+@@ -120,12 +121,13 @@ static int parse_veto_list(struct ksmbd_share_config *share,
+ return 0;
+ }
+
+-static struct ksmbd_share_config *share_config_request(struct unicode_map *um,
++static struct ksmbd_share_config *share_config_request(struct ksmbd_work *work,
+ const char *name)
+ {
+ struct ksmbd_share_config_response *resp;
+ struct ksmbd_share_config *share = NULL;
+ struct ksmbd_share_config *lookup;
++ struct unicode_map *um = work->conn->um;
+ int ret;
+
+ resp = ksmbd_ipc_share_config_request(name);
+@@ -181,7 +183,14 @@ static struct ksmbd_share_config *share_config_request(struct unicode_map *um,
+ KSMBD_SHARE_CONFIG_VETO_LIST(resp),
+ resp->veto_list_sz);
+ if (!ret && share->path) {
++ if (__ksmbd_override_fsids(work, share)) {
++ kill_share(share);
++ share = NULL;
++ goto out;
++ }
++
+ ret = kern_path(share->path, 0, &share->vfs_path);
++ ksmbd_revert_fsids(work);
+ if (ret) {
+ ksmbd_debug(SMB, "failed to access '%s'\n",
+ share->path);
+@@ -214,7 +223,7 @@ static struct ksmbd_share_config *share_config_request(struct unicode_map *um,
+ return share;
+ }
+
+-struct ksmbd_share_config *ksmbd_share_config_get(struct unicode_map *um,
++struct ksmbd_share_config *ksmbd_share_config_get(struct ksmbd_work *work,
+ const char *name)
+ {
+ struct ksmbd_share_config *share;
+@@ -227,7 +236,7 @@ struct ksmbd_share_config *ksmbd_share_config_get(struct unicode_map *um,
+
+ if (share)
+ return share;
+- return share_config_request(um, name);
++ return share_config_request(work, name);
+ }
+
+ bool ksmbd_share_veto_filename(struct ksmbd_share_config *share,
+diff --git a/fs/smb/server/mgmt/share_config.h b/fs/smb/server/mgmt/share_config.h
+index 5f591751b923..d4ac2dd4de20 100644
+--- a/fs/smb/server/mgmt/share_config.h
++++ b/fs/smb/server/mgmt/share_config.h
+@@ -11,6 +11,8 @@
+ #include <linux/path.h>
+ #include <linux/unicode.h>
+
++struct ksmbd_work;
++
+ struct ksmbd_share_config {
+ char *name;
+ char *path;
+@@ -68,7 +70,7 @@ static inline void ksmbd_share_config_put(struct ksmbd_share_config *share)
+ __ksmbd_share_config_put(share);
+ }
+
+-struct ksmbd_share_config *ksmbd_share_config_get(struct unicode_map *um,
++struct ksmbd_share_config *ksmbd_share_config_get(struct ksmbd_work *work,
+ const char *name);
+ bool ksmbd_share_veto_filename(struct ksmbd_share_config *share,
+ const char *filename);
+diff --git a/fs/smb/server/mgmt/tree_connect.c b/fs/smb/server/mgmt/tree_connect.c
+index d2c81a8a11dd..94a52a75014a 100644
+--- a/fs/smb/server/mgmt/tree_connect.c
++++ b/fs/smb/server/mgmt/tree_connect.c
+@@ -16,17 +16,18 @@
+ #include "user_session.h"
+
+ struct ksmbd_tree_conn_status
+-ksmbd_tree_conn_connect(struct ksmbd_conn *conn, struct ksmbd_session *sess,
+- const char *share_name)
++ksmbd_tree_conn_connect(struct ksmbd_work *work, const char *share_name)
+ {
+ struct ksmbd_tree_conn_status status = {-ENOENT, NULL};
+ struct ksmbd_tree_connect_response *resp = NULL;
+ struct ksmbd_share_config *sc;
+ struct ksmbd_tree_connect *tree_conn = NULL;
+ struct sockaddr *peer_addr;
++ struct ksmbd_conn *conn = work->conn;
++ struct ksmbd_session *sess = work->sess;
+ int ret;
+
+- sc = ksmbd_share_config_get(conn->um, share_name);
++ sc = ksmbd_share_config_get(work, share_name);
+ if (!sc)
+ return status;
+
+@@ -61,7 +62,7 @@ ksmbd_tree_conn_connect(struct ksmbd_conn *conn, struct ksmbd_session *sess,
+ struct ksmbd_share_config *new_sc;
+
+ ksmbd_share_config_del(sc);
+- new_sc = ksmbd_share_config_get(conn->um, share_name);
++ new_sc = ksmbd_share_config_get(work, share_name);
+ if (!new_sc) {
+ pr_err("Failed to update stale share config\n");
+ status.ret = -ESTALE;
+diff --git a/fs/smb/server/mgmt/tree_connect.h b/fs/smb/server/mgmt/tree_connect.h
+index 6377a70b811c..a42cdd051041 100644
+--- a/fs/smb/server/mgmt/tree_connect.h
++++ b/fs/smb/server/mgmt/tree_connect.h
+@@ -13,6 +13,7 @@
+ struct ksmbd_share_config;
+ struct ksmbd_user;
+ struct ksmbd_conn;
++struct ksmbd_work;
+
+ enum {
+ TREE_NEW = 0,
+@@ -50,8 +51,7 @@ static inline int test_tree_conn_flag(struct ksmbd_tree_connect *tree_conn,
+ struct ksmbd_session;
+
+ struct ksmbd_tree_conn_status
+-ksmbd_tree_conn_connect(struct ksmbd_conn *conn, struct ksmbd_session *sess,
+- const char *share_name);
++ksmbd_tree_conn_connect(struct ksmbd_work *work, const char *share_name);
+ void ksmbd_tree_connect_put(struct ksmbd_tree_connect *tcon);
+
+ int ksmbd_tree_conn_disconnect(struct ksmbd_session *sess,
+diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
+index 39dfecf082ba..65cb35ed36c6 100644
+--- a/fs/smb/server/smb2pdu.c
++++ b/fs/smb/server/smb2pdu.c
+@@ -1959,7 +1959,7 @@ int smb2_tree_connect(struct ksmbd_work *work)
+ ksmbd_debug(SMB, "tree connect request for tree %s treename %s\n",
+ name, treename);
+
+- status = ksmbd_tree_conn_connect(conn, sess, name);
++ status = ksmbd_tree_conn_connect(work, name);
+ if (status.ret == KSMBD_TREE_CONN_STATUS_OK)
+ rsp->hdr.Id.SyncId.TreeId = cpu_to_le32(status.tree_conn->id);
+ else
+diff --git a/fs/smb/server/smb_common.c b/fs/smb/server/smb_common.c
+index 474dadf6b7b8..13818ecb6e1b 100644
+--- a/fs/smb/server/smb_common.c
++++ b/fs/smb/server/smb_common.c
+@@ -732,10 +732,10 @@ bool is_asterisk(char *p)
+ return p && p[0] == '*';
+ }
+
+-int ksmbd_override_fsids(struct ksmbd_work *work)
++int __ksmbd_override_fsids(struct ksmbd_work *work,
++ struct ksmbd_share_config *share)
+ {
+ struct ksmbd_session *sess = work->sess;
+- struct ksmbd_share_config *share = work->tcon->share_conf;
+ struct cred *cred;
+ struct group_info *gi;
+ unsigned int uid;
+@@ -775,6 +775,11 @@ int ksmbd_override_fsids(struct ksmbd_work *work)
+ return 0;
+ }
+
++int ksmbd_override_fsids(struct ksmbd_work *work)
++{
++ return __ksmbd_override_fsids(work, work->tcon->share_conf);
++}
++
+ void ksmbd_revert_fsids(struct ksmbd_work *work)
+ {
+ const struct cred *cred;
+diff --git a/fs/smb/server/smb_common.h b/fs/smb/server/smb_common.h
+index f1092519c0c2..4a3148b0167f 100644
+--- a/fs/smb/server/smb_common.h
++++ b/fs/smb/server/smb_common.h
+@@ -447,6 +447,8 @@ int ksmbd_extract_shortname(struct ksmbd_conn *conn,
+ int ksmbd_smb_negotiate_common(struct ksmbd_work *work, unsigned int command);
+
+ int ksmbd_smb_check_shared_mode(struct file *filp, struct ksmbd_file *curr_fp);
++int __ksmbd_override_fsids(struct ksmbd_work *work,
++ struct ksmbd_share_config *share);
+ int ksmbd_override_fsids(struct ksmbd_work *work);
+ void ksmbd_revert_fsids(struct ksmbd_work *work);
+
+--
+2.43.0
+
--- /dev/null
+From 49c12d18588f089109aafa79b8f16936bd95d539 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Aug 2024 08:57:03 +0900
+Subject: ksmbd: override fsids for smb2_query_info()
+
+From: Namjae Jeon <linkinjeon@kernel.org>
+
+[ Upstream commit f6bd41280a44dcc2e0a25ed72617d25f586974a7 ]
+
+Sangsoo reported that a DAC denial error occurred when accessing
+files through the ksmbd thread. This patch override fsids for
+smb2_query_info().
+
+Reported-by: Sangsoo Lee <constant.lee@samsung.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/smb2pdu.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
+index 65cb35ed36c6..0687083bcc3f 100644
+--- a/fs/smb/server/smb2pdu.c
++++ b/fs/smb/server/smb2pdu.c
+@@ -5601,6 +5601,11 @@ int smb2_query_info(struct ksmbd_work *work)
+
+ ksmbd_debug(SMB, "GOT query info request\n");
+
++ if (ksmbd_override_fsids(work)) {
++ rc = -ENOMEM;
++ goto err_out;
++ }
++
+ switch (req->InfoType) {
+ case SMB2_O_INFO_FILE:
+ ksmbd_debug(SMB, "GOT SMB2_O_INFO_FILE\n");
+@@ -5619,6 +5624,7 @@ int smb2_query_info(struct ksmbd_work *work)
+ req->InfoType);
+ rc = -EOPNOTSUPP;
+ }
++ ksmbd_revert_fsids(work);
+
+ if (!rc) {
+ rsp->StructureSize = cpu_to_le16(9);
+@@ -5628,6 +5634,7 @@ int smb2_query_info(struct ksmbd_work *work)
+ le32_to_cpu(rsp->OutputBufferLength));
+ }
+
++err_out:
+ if (rc < 0) {
+ if (rc == -EACCES)
+ rsp->hdr.Status = STATUS_ACCESS_DENIED;
+--
+2.43.0
+
--- /dev/null
+From e9a542ddf849f6ff151c086a744563aa15ece735 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Aug 2024 19:07:21 +0900
+Subject: net: ethernet: use ip_hdrlen() instead of bit shift
+
+From: Moon Yeounsu <yyyynoom@gmail.com>
+
+[ Upstream commit 9a039eeb71a42c8b13408a1976e300f3898e1be0 ]
+
+`ip_hdr(skb)->ihl << 2` is the same as `ip_hdrlen(skb)`
+Therefore, we should use a well-defined function not a bit shift
+to find the header length.
+
+It also compresses two lines to a single line.
+
+Signed-off-by: Moon Yeounsu <yyyynoom@gmail.com>
+Reviewed-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/jme.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c
+index b06e24562973..d8be0e4dcb07 100644
+--- a/drivers/net/ethernet/jme.c
++++ b/drivers/net/ethernet/jme.c
+@@ -946,15 +946,13 @@ jme_udpsum(struct sk_buff *skb)
+ if (skb->protocol != htons(ETH_P_IP))
+ return csum;
+ skb_set_network_header(skb, ETH_HLEN);
+- if ((ip_hdr(skb)->protocol != IPPROTO_UDP) ||
+- (skb->len < (ETH_HLEN +
+- (ip_hdr(skb)->ihl << 2) +
+- sizeof(struct udphdr)))) {
++
++ if (ip_hdr(skb)->protocol != IPPROTO_UDP ||
++ skb->len < (ETH_HLEN + ip_hdrlen(skb) + sizeof(struct udphdr))) {
+ skb_reset_network_header(skb);
+ return csum;
+ }
+- skb_set_transport_header(skb,
+- ETH_HLEN + (ip_hdr(skb)->ihl << 2));
++ skb_set_transport_header(skb, ETH_HLEN + ip_hdrlen(skb));
+ csum = udp_hdr(skb)->check;
+ skb_reset_transport_header(skb);
+ skb_reset_network_header(skb);
+--
+2.43.0
+
--- /dev/null
+From 62e4c158ed0808a65c5a4ad550bfa080525f12b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Aug 2024 22:10:24 +0800
+Subject: net: hns3: use correct release function during uninitialization
+
+From: Peiyang Wang <wangpeiyang1@huawei.com>
+
+[ Upstream commit 7660833d217528c8f2385528951ab820a031e4e3 ]
+
+pci_request_regions is called to apply for PCI I/O and memory resources
+when the driver is initialized, Therefore, when the driver is uninstalled,
+pci_release_regions should be used to release PCI I/O and memory resources
+instead of pci_release_mem_regions is used to release memory reasouces
+only.
+
+Signed-off-by: Peiyang Wang <wangpeiyang1@huawei.com>
+Signed-off-by: Jijie Shao <shaojijie@huawei.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 465f0d582283..6c33195a1168 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -11456,7 +11456,7 @@ static void hclge_pci_uninit(struct hclge_dev *hdev)
+
+ pcim_iounmap(pdev, hdev->hw.hw.io_base);
+ pci_free_irq_vectors(pdev);
+- pci_release_mem_regions(pdev);
++ pci_release_regions(pdev);
+ pci_disable_device(pdev);
+ }
+
+--
+2.43.0
+
--- /dev/null
+From d3d19b5320a317864142b308ac7669d591399fb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Aug 2024 21:38:06 +0200
+Subject: net: phy: vitesse: repair vsc73xx autonegotiation
+
+From: Pawel Dembicki <paweldembicki@gmail.com>
+
+[ Upstream commit de7a670f8defe4ed2115552ad23dea0f432f7be4 ]
+
+When the vsc73xx mdio bus work properly, the generic autonegotiation
+configuration works well.
+
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/vitesse.c | 14 --------------
+ 1 file changed, 14 deletions(-)
+
+diff --git a/drivers/net/phy/vitesse.c b/drivers/net/phy/vitesse.c
+index 897b979ec03c..3b5fcaf0dd36 100644
+--- a/drivers/net/phy/vitesse.c
++++ b/drivers/net/phy/vitesse.c
+@@ -237,16 +237,6 @@ static int vsc739x_config_init(struct phy_device *phydev)
+ return 0;
+ }
+
+-static int vsc73xx_config_aneg(struct phy_device *phydev)
+-{
+- /* The VSC73xx switches does not like to be instructed to
+- * do autonegotiation in any way, it prefers that you just go
+- * with the power-on/reset defaults. Writing some registers will
+- * just make autonegotiation permanently fail.
+- */
+- return 0;
+-}
+-
+ /* This adds a skew for both TX and RX clocks, so the skew should only be
+ * applied to "rgmii-id" interfaces. It may not work as expected
+ * on "rgmii-txid", "rgmii-rxid" or "rgmii" interfaces.
+@@ -444,7 +434,6 @@ static struct phy_driver vsc82xx_driver[] = {
+ .phy_id_mask = 0x000ffff0,
+ /* PHY_GBIT_FEATURES */
+ .config_init = vsc738x_config_init,
+- .config_aneg = vsc73xx_config_aneg,
+ .read_page = vsc73xx_read_page,
+ .write_page = vsc73xx_write_page,
+ }, {
+@@ -453,7 +442,6 @@ static struct phy_driver vsc82xx_driver[] = {
+ .phy_id_mask = 0x000ffff0,
+ /* PHY_GBIT_FEATURES */
+ .config_init = vsc738x_config_init,
+- .config_aneg = vsc73xx_config_aneg,
+ .read_page = vsc73xx_read_page,
+ .write_page = vsc73xx_write_page,
+ }, {
+@@ -462,7 +450,6 @@ static struct phy_driver vsc82xx_driver[] = {
+ .phy_id_mask = 0x000ffff0,
+ /* PHY_GBIT_FEATURES */
+ .config_init = vsc739x_config_init,
+- .config_aneg = vsc73xx_config_aneg,
+ .read_page = vsc73xx_read_page,
+ .write_page = vsc73xx_write_page,
+ }, {
+@@ -471,7 +458,6 @@ static struct phy_driver vsc82xx_driver[] = {
+ .phy_id_mask = 0x000ffff0,
+ /* PHY_GBIT_FEATURES */
+ .config_init = vsc739x_config_init,
+- .config_aneg = vsc73xx_config_aneg,
+ .read_page = vsc73xx_read_page,
+ .write_page = vsc73xx_write_page,
+ }, {
+--
+2.43.0
+
--- /dev/null
+From fbaaf7a02fb7c791f83c0d72c571206cbf65138e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Aug 2024 14:05:02 -0400
+Subject: NFS: Avoid unnecessary rescanning of the per-server delegation list
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit f92214e4c312f6ea9d78650cc6291d200f17abb6 ]
+
+If the call to nfs_delegation_grab_inode() fails, we will not have
+dropped any locks that require us to rescan the list.
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/delegation.c | 15 +++++----------
+ 1 file changed, 5 insertions(+), 10 deletions(-)
+
+diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
+index 6bace5fece04..ed362d291b90 100644
+--- a/fs/nfs/delegation.c
++++ b/fs/nfs/delegation.c
+@@ -624,6 +624,9 @@ static int nfs_server_return_marked_delegations(struct nfs_server *server,
+ prev = delegation;
+ continue;
+ }
++ inode = nfs_delegation_grab_inode(delegation);
++ if (inode == NULL)
++ continue;
+
+ if (prev) {
+ struct inode *tmp = nfs_delegation_grab_inode(prev);
+@@ -634,12 +637,6 @@ static int nfs_server_return_marked_delegations(struct nfs_server *server,
+ }
+ }
+
+- inode = nfs_delegation_grab_inode(delegation);
+- if (inode == NULL) {
+- rcu_read_unlock();
+- iput(to_put);
+- goto restart;
+- }
+ delegation = nfs_start_delegation_return_locked(NFS_I(inode));
+ rcu_read_unlock();
+
+@@ -1161,7 +1158,6 @@ static int nfs_server_reap_unclaimed_delegations(struct nfs_server *server,
+ struct inode *inode;
+ restart:
+ rcu_read_lock();
+-restart_locked:
+ list_for_each_entry_rcu(delegation, &server->delegations, super_list) {
+ if (test_bit(NFS_DELEGATION_INODE_FREEING,
+ &delegation->flags) ||
+@@ -1172,7 +1168,7 @@ static int nfs_server_reap_unclaimed_delegations(struct nfs_server *server,
+ continue;
+ inode = nfs_delegation_grab_inode(delegation);
+ if (inode == NULL)
+- goto restart_locked;
++ continue;
+ delegation = nfs_start_delegation_return_locked(NFS_I(inode));
+ rcu_read_unlock();
+ if (delegation != NULL) {
+@@ -1295,7 +1291,6 @@ static int nfs_server_reap_expired_delegations(struct nfs_server *server,
+
+ restart:
+ rcu_read_lock();
+-restart_locked:
+ list_for_each_entry_rcu(delegation, &server->delegations, super_list) {
+ if (test_bit(NFS_DELEGATION_INODE_FREEING,
+ &delegation->flags) ||
+@@ -1307,7 +1302,7 @@ static int nfs_server_reap_expired_delegations(struct nfs_server *server,
+ continue;
+ inode = nfs_delegation_grab_inode(delegation);
+ if (inode == NULL)
+- goto restart_locked;
++ continue;
+ spin_lock(&delegation->lock);
+ cred = get_cred_rcu(delegation->cred);
+ nfs4_stateid_copy(&stateid, &delegation->stateid);
+--
+2.43.0
+
--- /dev/null
+From e6b7e8c7cfc5644117a9b67a7e4d515bca0b7f0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Aug 2024 14:05:01 -0400
+Subject: NFSv4: Fix clearing of layout segments in layoutreturn
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit d72b7963115bea971a28eaa2cb76722c023f9fdf ]
+
+Make sure that we clear the layout segments in cases where we see a
+fatal error, and also in the case where the layout is invalid.
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 9 ++++++---
+ fs/nfs/pnfs.c | 5 ++---
+ 2 files changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index bff9d6600741..3b76e89b6d02 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -9873,13 +9873,16 @@ static void nfs4_layoutreturn_done(struct rpc_task *task, void *calldata)
+ fallthrough;
+ default:
+ task->tk_status = 0;
++ lrp->res.lrs_present = 0;
+ fallthrough;
+ case 0:
+ break;
+ case -NFS4ERR_DELAY:
+- if (nfs4_async_handle_error(task, server, NULL, NULL) != -EAGAIN)
+- break;
+- goto out_restart;
++ if (nfs4_async_handle_error(task, server, NULL, NULL) ==
++ -EAGAIN)
++ goto out_restart;
++ lrp->res.lrs_present = 0;
++ break;
+ }
+ return;
+ out_restart:
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index b5834728f31b..d1e3c17dcceb 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1172,10 +1172,9 @@ void pnfs_layoutreturn_free_lsegs(struct pnfs_layout_hdr *lo,
+ LIST_HEAD(freeme);
+
+ spin_lock(&inode->i_lock);
+- if (!pnfs_layout_is_valid(lo) ||
+- !nfs4_stateid_match_other(&lo->plh_stateid, arg_stateid))
++ if (!nfs4_stateid_match_other(&lo->plh_stateid, arg_stateid))
+ goto out_unlock;
+- if (stateid) {
++ if (stateid && pnfs_layout_is_valid(lo)) {
+ u32 seq = be32_to_cpu(arg_stateid->seqid);
+
+ pnfs_mark_matching_lsegs_invalid(lo, &freeme, range, seq);
+--
+2.43.0
+
--- /dev/null
+From cd6c26c7bd6f5bb7f1d5b81ddccbaf61fc11bc06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Aug 2024 15:19:47 +0200
+Subject: platform/surface: aggregator_registry: Add fan and thermal sensor
+ support for Surface Laptop 5
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maximilian Luz <luzmaximilian@gmail.com>
+
+[ Upstream commit 002adda09bc1c983c75c82a7e12285c7423aec31 ]
+
+The EC on the Surface Laptop 5 exposes the fan interface. With the
+recently introduced driver for it, we can now also enable it here. In
+addition, also enable the thermal sensor interface.
+
+Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Link: https://lore.kernel.org/r/20240811131948.261806-5-luzmaximilian@gmail.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/surface/surface_aggregator_registry.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/surface/surface_aggregator_registry.c b/drivers/platform/surface/surface_aggregator_registry.c
+index 892ba9549f6a..4d3f5b3111ba 100644
+--- a/drivers/platform/surface/surface_aggregator_registry.c
++++ b/drivers/platform/surface/surface_aggregator_registry.c
+@@ -265,7 +265,9 @@ static const struct software_node *ssam_node_group_sl5[] = {
+ &ssam_node_root,
+ &ssam_node_bat_ac,
+ &ssam_node_bat_main,
+- &ssam_node_tmp_perf_profile,
++ &ssam_node_tmp_perf_profile_with_fan,
++ &ssam_node_tmp_sensors,
++ &ssam_node_fan_speed,
+ &ssam_node_hid_main_keyboard,
+ &ssam_node_hid_main_touchpad,
+ &ssam_node_hid_main_iid5,
+--
+2.43.0
+
--- /dev/null
+From 2e4b177225ec89b48437f5daa258c8e306511a96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Aug 2024 15:19:44 +0200
+Subject: platform/surface: aggregator_registry: Add Support for Surface Pro 10
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maximilian Luz <luzmaximilian@gmail.com>
+
+[ Upstream commit 9c8e022567bbec53bee8ae75c44b3d6cd2080d42 ]
+
+Add SAM client device nodes for the Surface Pro 10. It seems to use the
+same SAM client devices as the Surface Pro 9, so re-use its node group.
+
+Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Link: https://lore.kernel.org/r/20240811131948.261806-2-luzmaximilian@gmail.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/surface/surface_aggregator_registry.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/surface/surface_aggregator_registry.c b/drivers/platform/surface/surface_aggregator_registry.c
+index 1c4d74db08c9..fa5b896e5f4e 100644
+--- a/drivers/platform/surface/surface_aggregator_registry.c
++++ b/drivers/platform/surface/surface_aggregator_registry.c
+@@ -324,7 +324,7 @@ static const struct software_node *ssam_node_group_sp8[] = {
+ NULL,
+ };
+
+-/* Devices for Surface Pro 9 */
++/* Devices for Surface Pro 9 and 10 */
+ static const struct software_node *ssam_node_group_sp9[] = {
+ &ssam_node_root,
+ &ssam_node_hub_kip,
+@@ -365,6 +365,9 @@ static const struct acpi_device_id ssam_platform_hub_match[] = {
+ /* Surface Pro 9 */
+ { "MSHW0343", (unsigned long)ssam_node_group_sp9 },
+
++ /* Surface Pro 10 */
++ { "MSHW0510", (unsigned long)ssam_node_group_sp9 },
++
+ /* Surface Book 2 */
+ { "MSHW0107", (unsigned long)ssam_node_group_gen5 },
+
+--
+2.43.0
+
--- /dev/null
+From f987090f6bf68ace626398bceec99855d2acc9d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Aug 2024 15:19:48 +0200
+Subject: platform/surface: aggregator_registry: Add support for Surface Laptop
+ 6
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maximilian Luz <luzmaximilian@gmail.com>
+
+[ Upstream commit 99ae7b9ba047ad029a0a23b2bd51608ce79c8e97 ]
+
+Add SAM client device nodes for the Surface Laptop Studio 6 (SL6). The
+SL6 is similar to the SL5, with the typical battery/AC, platform
+profile, and HID nodes. It also has support for the newly supported fan
+interface.
+
+Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Link: https://lore.kernel.org/r/20240811131948.261806-6-luzmaximilian@gmail.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../surface/surface_aggregator_registry.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/drivers/platform/surface/surface_aggregator_registry.c b/drivers/platform/surface/surface_aggregator_registry.c
+index 4d3f5b3111ba..a23dff35f8ca 100644
+--- a/drivers/platform/surface/surface_aggregator_registry.c
++++ b/drivers/platform/surface/surface_aggregator_registry.c
+@@ -275,6 +275,22 @@ static const struct software_node *ssam_node_group_sl5[] = {
+ NULL,
+ };
+
++/* Devices for Surface Laptop 6. */
++static const struct software_node *ssam_node_group_sl6[] = {
++ &ssam_node_root,
++ &ssam_node_bat_ac,
++ &ssam_node_bat_main,
++ &ssam_node_tmp_perf_profile_with_fan,
++ &ssam_node_tmp_sensors,
++ &ssam_node_fan_speed,
++ &ssam_node_hid_main_keyboard,
++ &ssam_node_hid_main_touchpad,
++ &ssam_node_hid_main_iid5,
++ &ssam_node_hid_sam_sensors,
++ &ssam_node_hid_sam_ucm_ucsi,
++ NULL,
++};
++
+ /* Devices for Surface Laptop Studio 1. */
+ static const struct software_node *ssam_node_group_sls1[] = {
+ &ssam_node_root,
+@@ -410,6 +426,9 @@ static const struct acpi_device_id ssam_platform_hub_match[] = {
+ /* Surface Laptop 5 */
+ { "MSHW0350", (unsigned long)ssam_node_group_sl5 },
+
++ /* Surface Laptop 6 */
++ { "MSHW0530", (unsigned long)ssam_node_group_sl6 },
++
+ /* Surface Laptop Go 1 */
+ { "MSHW0118", (unsigned long)ssam_node_group_slg1 },
+
+--
+2.43.0
+
--- /dev/null
+From 6bc7ae4a3025cbd572dd7cbc7d29a64942bea315 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Aug 2024 15:19:46 +0200
+Subject: platform/surface: aggregator_registry: Add support for Surface Laptop
+ Studio 2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maximilian Luz <luzmaximilian@gmail.com>
+
+[ Upstream commit 28d04b4a2cc20981c95787f9c449e6fc51d904f9 ]
+
+Add SAM client device nodes for the Surface Laptop Studio 2 (SLS2). The
+SLS2 is quite similar to the SLS1, but it does not provide the touchpad
+as a SAM-HID device. Therefore, add a new node group for the SLS2 and
+update the comments accordingly. In addition, it uses the new fan
+control interface.
+
+Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Link: https://lore.kernel.org/r/20240811131948.261806-4-luzmaximilian@gmail.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../surface/surface_aggregator_registry.c | 27 ++++++++++++++++---
+ 1 file changed, 23 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/platform/surface/surface_aggregator_registry.c b/drivers/platform/surface/surface_aggregator_registry.c
+index 4d36810c2308..892ba9549f6a 100644
+--- a/drivers/platform/surface/surface_aggregator_registry.c
++++ b/drivers/platform/surface/surface_aggregator_registry.c
+@@ -273,8 +273,8 @@ static const struct software_node *ssam_node_group_sl5[] = {
+ NULL,
+ };
+
+-/* Devices for Surface Laptop Studio. */
+-static const struct software_node *ssam_node_group_sls[] = {
++/* Devices for Surface Laptop Studio 1. */
++static const struct software_node *ssam_node_group_sls1[] = {
+ &ssam_node_root,
+ &ssam_node_bat_ac,
+ &ssam_node_bat_main,
+@@ -289,6 +289,22 @@ static const struct software_node *ssam_node_group_sls[] = {
+ NULL,
+ };
+
++/* Devices for Surface Laptop Studio 2. */
++static const struct software_node *ssam_node_group_sls2[] = {
++ &ssam_node_root,
++ &ssam_node_bat_ac,
++ &ssam_node_bat_main,
++ &ssam_node_tmp_perf_profile_with_fan,
++ &ssam_node_tmp_sensors,
++ &ssam_node_fan_speed,
++ &ssam_node_pos_tablet_switch,
++ &ssam_node_hid_sam_keyboard,
++ &ssam_node_hid_sam_penstash,
++ &ssam_node_hid_sam_sensors,
++ &ssam_node_hid_sam_ucm_ucsi,
++ NULL,
++};
++
+ /* Devices for Surface Laptop Go. */
+ static const struct software_node *ssam_node_group_slg1[] = {
+ &ssam_node_root,
+@@ -401,8 +417,11 @@ static const struct acpi_device_id ssam_platform_hub_match[] = {
+ /* Surface Laptop Go 3 */
+ { "MSHW0440", (unsigned long)ssam_node_group_slg1 },
+
+- /* Surface Laptop Studio */
+- { "MSHW0123", (unsigned long)ssam_node_group_sls },
++ /* Surface Laptop Studio 1 */
++ { "MSHW0123", (unsigned long)ssam_node_group_sls1 },
++
++ /* Surface Laptop Studio 2 */
++ { "MSHW0360", (unsigned long)ssam_node_group_sls2 },
+
+ { },
+ };
+--
+2.43.0
+
--- /dev/null
+From 9d114e35033f021a04c72f674cfab861060edc1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Aug 2024 15:19:45 +0200
+Subject: platform/surface: aggregator_registry: Add support for Surface Laptop
+ Go 3
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maximilian Luz <luzmaximilian@gmail.com>
+
+[ Upstream commit ed235163c3f02329d5e37ed4485bbc39ed2568d4 ]
+
+Add SAM client device nodes for the Surface Laptop Go 3. It seems to use
+the same SAM client devices as the Surface Laptop Go 1 and 2, so re-use
+their node group.
+
+Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Link: https://lore.kernel.org/r/20240811131948.261806-3-luzmaximilian@gmail.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/surface/surface_aggregator_registry.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/platform/surface/surface_aggregator_registry.c b/drivers/platform/surface/surface_aggregator_registry.c
+index fa5b896e5f4e..4d36810c2308 100644
+--- a/drivers/platform/surface/surface_aggregator_registry.c
++++ b/drivers/platform/surface/surface_aggregator_registry.c
+@@ -398,6 +398,9 @@ static const struct acpi_device_id ssam_platform_hub_match[] = {
+ /* Surface Laptop Go 2 */
+ { "MSHW0290", (unsigned long)ssam_node_group_slg1 },
+
++ /* Surface Laptop Go 3 */
++ { "MSHW0440", (unsigned long)ssam_node_group_slg1 },
++
+ /* Surface Laptop Studio */
+ { "MSHW0123", (unsigned long)ssam_node_group_sls },
+
+--
+2.43.0
+
--- /dev/null
+From d70a2107bc917154642118aa3b48249466912076 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Aug 2024 11:46:03 +1200
+Subject: platform/x86: asus-wmi: Add quirk for ROG Ally X
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Luke D. Jones <luke@ljones.dev>
+
+[ Upstream commit d2dfed310aae0739dc87b68c660357e6a4f29819 ]
+
+The new ROG Ally X functions the same as the previus model so we can use
+the same method to ensure the MCU USB devices wake and reconnect
+correctly.
+
+Given that two devices marks the start of a trend, this patch also adds
+a quirk table to make future additions easier if the MCU is the same.
+
+Signed-off-by: Luke D. Jones <luke@ljones.dev>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Link: https://lore.kernel.org/r/20240805234603.38736-1-luke@ljones.dev
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/asus-wmi.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
+index bc9c5db38324..5fe5149549cc 100644
+--- a/drivers/platform/x86/asus-wmi.c
++++ b/drivers/platform/x86/asus-wmi.c
+@@ -146,6 +146,20 @@ static const char * const ashs_ids[] = { "ATK4001", "ATK4002", NULL };
+
+ static int throttle_thermal_policy_write(struct asus_wmi *);
+
++static const struct dmi_system_id asus_ally_mcu_quirk[] = {
++ {
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "RC71L"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "RC72L"),
++ },
++ },
++ { },
++};
++
+ static bool ashs_present(void)
+ {
+ int i = 0;
+@@ -4650,7 +4664,7 @@ static int asus_wmi_add(struct platform_device *pdev)
+ asus->dgpu_disable_available = asus_wmi_dev_is_present(asus, ASUS_WMI_DEVID_DGPU);
+ asus->kbd_rgb_state_available = asus_wmi_dev_is_present(asus, ASUS_WMI_DEVID_TUF_RGB_STATE);
+ asus->ally_mcu_usb_switch = acpi_has_method(NULL, ASUS_USB0_PWR_EC0_CSEE)
+- && dmi_match(DMI_BOARD_NAME, "RC71L");
++ && dmi_check_system(asus_ally_mcu_quirk);
+
+ if (asus_wmi_dev_is_present(asus, ASUS_WMI_DEVID_MINI_LED_MODE))
+ asus->mini_led_dev_id = ASUS_WMI_DEVID_MINI_LED_MODE;
+--
+2.43.0
+
--- /dev/null
+From a0f4b496351555824c02ac0812794371ece8d22d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Aug 2024 09:05:08 +0200
+Subject: powerpc/mm: Fix boot warning with hugepages and CONFIG_DEBUG_VIRTUAL
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit e7e846dc6c73fbc94ae8b4ec20d05627646416f2 ]
+
+Booting with CONFIG_DEBUG_VIRTUAL leads to following warning when
+passing hugepage reservation on command line:
+
+ Kernel command line: hugepagesz=1g hugepages=1 hugepagesz=64m hugepages=1 hugepagesz=256m hugepages=1 noreboot
+ HugeTLB: allocating 1 of page size 1.00 GiB failed. Only allocated 0 hugepages.
+ ------------[ cut here ]------------
+ WARNING: CPU: 0 PID: 0 at arch/powerpc/include/asm/io.h:948 __alloc_bootmem_huge_page+0xd4/0x284
+ Modules linked in:
+ CPU: 0 PID: 0 Comm: swapper Not tainted 6.10.0-rc6-00396-g6b0e82791bd0-dirty #936
+ Hardware name: MPC8544DS e500v2 0x80210030 MPC8544 DS
+ NIP: c1020240 LR: c10201d0 CTR: 00000000
+ REGS: c13fdd30 TRAP: 0700 Not tainted (6.10.0-rc6-00396-g6b0e82791bd0-dirty)
+ MSR: 00021000 <CE,ME> CR: 44084288 XER: 20000000
+
+ GPR00: c10201d0 c13fde20 c130b560 e8000000 e8001000 00000000 00000000 c1420000
+ GPR08: 00000000 00028001 00000000 00000004 44084282 01066ac0 c0eb7c9c efffe149
+ GPR16: c0fc4228 0000005f ffffffff c0eb7d0c c0eb7cc0 c0eb7ce0 ffffffff 00000000
+ GPR24: c1441cec efffe153 e8001000 c14240c0 00000000 c1441d64 00000000 e8000000
+ NIP [c1020240] __alloc_bootmem_huge_page+0xd4/0x284
+ LR [c10201d0] __alloc_bootmem_huge_page+0x64/0x284
+ Call Trace:
+ [c13fde20] [c10201d0] __alloc_bootmem_huge_page+0x64/0x284 (unreliable)
+ [c13fde50] [c10207b8] hugetlb_hstate_alloc_pages+0x8c/0x3e8
+ [c13fdeb0] [c1021384] hugepages_setup+0x240/0x2cc
+ [c13fdef0] [c1000574] unknown_bootoption+0xfc/0x280
+ [c13fdf30] [c0078904] parse_args+0x200/0x4c4
+ [c13fdfa0] [c1000d9c] start_kernel+0x238/0x7d0
+ [c13fdff0] [c0000434] set_ivor+0x12c/0x168
+ Code: 554aa33e 7c042840 3ce0c142 80a7427c 5109a016 50caa016 7c9a2378 7fdcf378 4180000c 7c052040 41810160 7c095040 <0fe00000> 38c00000 40800108 3c60c0eb
+ ---[ end trace 0000000000000000 ]---
+
+This is due to virt_addr_valid() using high_memory before it is set.
+
+high_memory is set in mem_init() using max_low_pfn, but max_low_pfn
+is available long before, it is set in mem_topology_setup(). So just
+like commit daa9ada2093e ("powerpc/mm: Fix boot crash with FLATMEM")
+moved the setting of max_mapnr immediately after the call to
+mem_topology_setup(), the same can be done for high_memory.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/62b69c4baad067093f39e7e60df0fe27a86b8d2a.1723100702.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/setup-common.c | 1 +
+ arch/powerpc/mm/mem.c | 2 --
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
+index 4bd2f87616ba..943430077375 100644
+--- a/arch/powerpc/kernel/setup-common.c
++++ b/arch/powerpc/kernel/setup-common.c
+@@ -959,6 +959,7 @@ void __init setup_arch(char **cmdline_p)
+ mem_topology_setup();
+ /* Set max_mapnr before paging_init() */
+ set_max_mapnr(max_pfn);
++ high_memory = (void *)__va(max_low_pfn * PAGE_SIZE);
+
+ /*
+ * Release secondary cpus out of their spinloops at 0x60 now that
+diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
+index d325217ab201..da21cb018984 100644
+--- a/arch/powerpc/mm/mem.c
++++ b/arch/powerpc/mm/mem.c
+@@ -290,8 +290,6 @@ void __init mem_init(void)
+ swiotlb_init(ppc_swiotlb_enable, ppc_swiotlb_flags);
+ #endif
+
+- high_memory = (void *) __va(max_low_pfn * PAGE_SIZE);
+-
+ kasan_late_init();
+
+ memblock_free_all();
+--
+2.43.0
+
--- /dev/null
+From 546570a22284c8099bbb0fc23fee32d11e87094b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Aug 2024 08:47:16 +0200
+Subject: s390/mm: Pin identity mapping base to zero
+
+From: Alexander Gordeev <agordeev@linux.ibm.com>
+
+[ Upstream commit 32db401965f165f7c44447d0508097f070c8f576 ]
+
+SIE instruction performs faster when the virtual address of
+SIE block matches the physical one. Pin the identity mapping
+base to zero for the benefit of SIE and other instructions
+that have similar performance impact. Still, randomize the
+base when DEBUG_VM kernel configuration option is enabled.
+
+Suggested-by: Vasily Gorbik <gor@linux.ibm.com>
+Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/Kconfig | 13 +++++++++++++
+ arch/s390/boot/startup.c | 3 ++-
+ 2 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
+index c59d2b54df49..4f7ed0cd12cc 100644
+--- a/arch/s390/Kconfig
++++ b/arch/s390/Kconfig
+@@ -602,6 +602,19 @@ config RANDOMIZE_BASE
+ as a security feature that deters exploit attempts relying on
+ knowledge of the location of kernel internals.
+
++config RANDOMIZE_IDENTITY_BASE
++ bool "Randomize the address of the identity mapping base"
++ depends on RANDOMIZE_BASE
++ default DEBUG_VM
++ help
++ The identity mapping base address is pinned to zero by default.
++ Allow randomization of that base to expose otherwise missed
++ notion of physical and virtual addresses of data structures.
++ That does not have any impact on the base address at which the
++ kernel image is loaded.
++
++ If unsure, say N
++
+ config KERNEL_IMAGE_BASE
+ hex "Kernel image base address"
+ range 0x100000 0x1FFFFFE0000000 if !KASAN
+diff --git a/arch/s390/boot/startup.c b/arch/s390/boot/startup.c
+index 66ee97ac803d..90c51368f933 100644
+--- a/arch/s390/boot/startup.c
++++ b/arch/s390/boot/startup.c
+@@ -333,7 +333,8 @@ static unsigned long setup_kernel_memory_layout(unsigned long kernel_size)
+ BUILD_BUG_ON(MAX_DCSS_ADDR > (1UL << MAX_PHYSMEM_BITS));
+ max_mappable = max(ident_map_size, MAX_DCSS_ADDR);
+ max_mappable = min(max_mappable, vmemmap_start);
+- __identity_base = round_down(vmemmap_start - max_mappable, rte_size);
++ if (IS_ENABLED(CONFIG_RANDOMIZE_IDENTITY_BASE))
++ __identity_base = round_down(vmemmap_start - max_mappable, rte_size);
+
+ return asce_limit;
+ }
+--
+2.43.0
+
--- /dev/null
+From f099121f10218f5869c62e7c3d6b122a35c64b90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Aug 2024 08:47:15 +0200
+Subject: s390/mm: Prevent lowcore vs identity mapping overlap
+
+From: Alexander Gordeev <agordeev@linux.ibm.com>
+
+[ Upstream commit a3ca27c405faad584af6e8e38cdafe5be73230a1 ]
+
+The identity mapping position in virtual memory is randomized
+together with the kernel mapping. That position can never
+overlap with the lowcore even when the lowcore is relocated.
+
+Prevent overlapping with the lowcore to allow independent
+positioning of the identity mapping. With the current value
+of the alternative lowcore address of 0x70000 the overlap
+could happen in case the identity mapping is placed at zero.
+
+This is a prerequisite for uncoupling of randomization base
+of kernel image and identity mapping in virtual memory.
+
+Acked-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/setup.c | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
+index 610e6f794511..4b1afd8ac3ee 100644
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -734,7 +734,23 @@ static void __init memblock_add_physmem_info(void)
+ }
+
+ /*
+- * Reserve memory used for lowcore/command line/kernel image.
++ * Reserve memory used for lowcore.
++ */
++static void __init reserve_lowcore(void)
++{
++ void *lowcore_start = get_lowcore();
++ void *lowcore_end = lowcore_start + sizeof(struct lowcore);
++ void *start, *end;
++
++ if ((void *)__identity_base < lowcore_end) {
++ start = max(lowcore_start, (void *)__identity_base);
++ end = min(lowcore_end, (void *)(__identity_base + ident_map_size));
++ memblock_reserve(__pa(start), __pa(end));
++ }
++}
++
++/*
++ * Reserve memory used for absolute lowcore/command line/kernel image.
+ */
+ static void __init reserve_kernel(void)
+ {
+@@ -915,6 +931,7 @@ void __init setup_arch(char **cmdline_p)
+
+ /* Do some memory reservations *before* memory is added to memblock */
+ reserve_pgtables();
++ reserve_lowcore();
+ reserve_kernel();
+ reserve_initrd();
+ reserve_certificate_list();
+--
+2.43.0
+
--- /dev/null
+From d9150278e1ebc008b2a4b36509b52ed2142526ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Aug 2024 11:22:34 +0200
+Subject: scripts: kconfig: merge_config: config files: add a trailing newline
+
+From: Anders Roxell <anders.roxell@linaro.org>
+
+[ Upstream commit 33330bcf031818e60a816db0cfd3add9eecc3b28 ]
+
+When merging files without trailing newlines at the end of the file, two
+config fragments end up at the same row if file1.config doens't have a
+trailing newline at the end of the file.
+
+file1.config "CONFIG_1=y"
+file2.config "CONFIG_2=y"
+./scripts/kconfig/merge_config.sh -m .config file1.config file2.config
+
+This will generate a .config looking like this.
+cat .config
+...
+CONFIG_1=yCONFIG_2=y"
+
+Making sure so we add a newline at the end of every config file that is
+passed into the script.
+
+Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/kconfig/merge_config.sh | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/scripts/kconfig/merge_config.sh b/scripts/kconfig/merge_config.sh
+index 902eb429b9db..0b7952471c18 100755
+--- a/scripts/kconfig/merge_config.sh
++++ b/scripts/kconfig/merge_config.sh
+@@ -167,6 +167,8 @@ for ORIG_MERGE_FILE in $MERGE_LIST ; do
+ sed -i "/$CFG[ =]/d" $MERGE_FILE
+ fi
+ done
++ # In case the previous file lacks a new line at the end
++ echo >> $TMP_FILE
+ cat $MERGE_FILE >> $TMP_FILE
+ done
+
+--
+2.43.0
+
--- /dev/null
+usb-typec-ucsi-always-set-number-of-alternate-modes.patch
+usb-typec-ucsi-fix-cable-registration.patch
+drm-mediatek-set-sensible-cursor-width-height-values.patch
+ksmbd-override-fsids-for-share-path-check.patch
+ksmbd-override-fsids-for-smb2_query_info.patch
+usbnet-ipheth-remove-extraneous-rx-urb-length-check.patch
+usbnet-ipheth-drop-rx-urbs-with-no-payload.patch
+usbnet-ipheth-do-not-stop-rx-on-failing-rx-callback.patch
+usbnet-ipheth-fix-carrier-detection-in-modes-1-and-4.patch
+net-ethernet-use-ip_hdrlen-instead-of-bit-shift.patch
+drm-panel-orientation-quirks-add-quirk-for-ayn-loki-.patch
+drm-panel-orientation-quirks-add-quirk-for-ayn-loki-.patch-21215
+net-phy-vitesse-repair-vsc73xx-autonegotiation.patch
+powerpc-mm-fix-boot-warning-with-hugepages-and-confi.patch
+wifi-mt76-mt7921-fix-null-pointer-access-in-mt7921_i.patch
+drm-amdgpu-update-kmd_fw_shared-for-vcn5.patch
+net-hns3-use-correct-release-function-during-uniniti.patch
+btrfs-update-target-inode-s-ctime-on-unlink.patch
+input-ads7846-ratelimit-the-spi_sync-error-message.patch
+input-synaptics-enable-smbus-for-hp-elitebook-840-g2.patch
+hid-asus-add-rog-ally-x-prod-id-to-quirk-list.patch
+hid-multitouch-add-support-for-gt7868q.patch
+input-edt-ft5x06-add-support-for-focaltech-ft8201.patch
+cgroup-cpuset-eliminate-unncessary-sched-domains-reb.patch
+scripts-kconfig-merge_config-config-files-add-a-trai.patch
+platform-x86-asus-wmi-add-quirk-for-rog-ally-x.patch
+platform-surface-aggregator_registry-add-support-for.patch
+platform-surface-aggregator_registry-add-support-for.patch-9026
+platform-surface-aggregator_registry-add-support-for.patch-29141
+platform-surface-aggregator_registry-add-fan-and-the.patch
+platform-surface-aggregator_registry-add-support-for.patch-26748
+spi-zynqmp-gqspi-scale-timeout-by-data-size.patch
+drm-msm-adreno-fix-error-return-if-missing-firmware-.patch
+input-i8042-add-fujitsu-lifebook-e756-to-i8042-quirk.patch
+drm-xe-xe2lpm-extend-wa_16021639441.patch
+drm-xe-fix-wa-14018094691.patch
+drm-xe-use-devm-instead-of-drmm-for-managed-bo.patch
+s390-mm-prevent-lowcore-vs-identity-mapping-overlap.patch
+s390-mm-pin-identity-mapping-base-to-zero.patch
+smb-server-fix-return-value-of-smb2_open.patch
+nfsv4-fix-clearing-of-layout-segments-in-layoutretur.patch
+nfs-avoid-unnecessary-rescanning-of-the-per-server-d.patch
--- /dev/null
+From cad17a4058a75849bb6da18ff271a9ffb5ef68b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Aug 2024 08:20:50 +0000
+Subject: smb/server: fix return value of smb2_open()
+
+From: ChenXiaoSong <chenxiaosong@kylinos.cn>
+
+[ Upstream commit 2186a116538a715b20e15f84fdd3545e5fe0a39b ]
+
+In most error cases, error code is not returned in smb2_open(),
+__process_request() will not print error message.
+
+Fix this by returning the correct value at the end of smb2_open().
+
+Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/smb2pdu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
+index 0687083bcc3f..adfd6046275a 100644
+--- a/fs/smb/server/smb2pdu.c
++++ b/fs/smb/server/smb2pdu.c
+@@ -3714,7 +3714,7 @@ int smb2_open(struct ksmbd_work *work)
+ kfree(name);
+ kfree(lc);
+
+- return 0;
++ return rc;
+ }
+
+ static int readdir_info_level_struct_sz(int info_level)
+--
+2.43.0
+
--- /dev/null
+From 83b83811132747b55708e1047fb09fbd3cf8f3bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Aug 2024 16:15:39 -0400
+Subject: spi: zynqmp-gqspi: Scale timeout by data size
+
+From: Sean Anderson <sean.anderson@linux.dev>
+
+[ Upstream commit 5d61841c74db8b5bbbf9403f1bd4879f614617d2 ]
+
+Large blocks of data time out when reading because we don't wait long
+enough for the transfer to complete. Scale our timeouts based on the
+amount of data we are tranferring, with a healthy dose of pessimism.
+
+Signed-off-by: Sean Anderson <sean.anderson@linux.dev>
+Link: https://patch.msgid.link/20240809201540.3363243-1-sean.anderson@linux.dev
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-zynqmp-gqspi.c | 30 ++++++++++++++++++++++++------
+ 1 file changed, 24 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
+index 99524a3c9f38..558c466135a5 100644
+--- a/drivers/spi/spi-zynqmp-gqspi.c
++++ b/drivers/spi/spi-zynqmp-gqspi.c
+@@ -1033,6 +1033,18 @@ static int __maybe_unused zynqmp_runtime_resume(struct device *dev)
+ return 0;
+ }
+
++static unsigned long zynqmp_qspi_timeout(struct zynqmp_qspi *xqspi, u8 bits,
++ unsigned long bytes)
++{
++ unsigned long timeout;
++
++ /* Assume we are at most 2x slower than the nominal bus speed */
++ timeout = mult_frac(bytes, 2 * 8 * MSEC_PER_SEC,
++ bits * xqspi->speed_hz);
++ /* And add 100 ms for scheduling delays */
++ return msecs_to_jiffies(timeout + 100);
++}
++
+ /**
+ * zynqmp_qspi_exec_op() - Initiates the QSPI transfer
+ * @mem: The SPI memory
+@@ -1049,6 +1061,7 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem,
+ {
+ struct zynqmp_qspi *xqspi = spi_controller_get_devdata
+ (mem->spi->controller);
++ unsigned long timeout;
+ int err = 0, i;
+ u32 genfifoentry = 0;
+ u16 opcode = op->cmd.opcode;
+@@ -1077,8 +1090,10 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem,
+ zynqmp_gqspi_write(xqspi, GQSPI_IER_OFST,
+ GQSPI_IER_GENFIFOEMPTY_MASK |
+ GQSPI_IER_TXNOT_FULL_MASK);
+- if (!wait_for_completion_timeout
+- (&xqspi->data_completion, msecs_to_jiffies(1000))) {
++ timeout = zynqmp_qspi_timeout(xqspi, op->cmd.buswidth,
++ op->cmd.nbytes);
++ if (!wait_for_completion_timeout(&xqspi->data_completion,
++ timeout)) {
+ err = -ETIMEDOUT;
+ goto return_err;
+ }
+@@ -1104,8 +1119,10 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem,
+ GQSPI_IER_TXEMPTY_MASK |
+ GQSPI_IER_GENFIFOEMPTY_MASK |
+ GQSPI_IER_TXNOT_FULL_MASK);
+- if (!wait_for_completion_timeout
+- (&xqspi->data_completion, msecs_to_jiffies(1000))) {
++ timeout = zynqmp_qspi_timeout(xqspi, op->addr.buswidth,
++ op->addr.nbytes);
++ if (!wait_for_completion_timeout(&xqspi->data_completion,
++ timeout)) {
+ err = -ETIMEDOUT;
+ goto return_err;
+ }
+@@ -1173,8 +1190,9 @@ static int zynqmp_qspi_exec_op(struct spi_mem *mem,
+ GQSPI_IER_RXEMPTY_MASK);
+ }
+ }
+- if (!wait_for_completion_timeout
+- (&xqspi->data_completion, msecs_to_jiffies(1000)))
++ timeout = zynqmp_qspi_timeout(xqspi, op->data.buswidth,
++ op->data.nbytes);
++ if (!wait_for_completion_timeout(&xqspi->data_completion, timeout))
+ err = -ETIMEDOUT;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From d98a1811fba9b7d3807953e7a675874aa0db1bc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 May 2024 20:12:44 +0000
+Subject: usb: typec: ucsi: Always set number of alternate modes
+
+From: Jameson Thies <jthies@google.com>
+
+[ Upstream commit c313a44ac9cda60431bdc7dcdb4b135eaef31785 ]
+
+Providing the number of known alternate modes allows user space to
+determine when device registration has completed. Always register a
+number of known alternate modes for the partner and cable plug, even
+when the number of supported alternate modes is 0.
+
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Reviewed-by: Benson Leung <bleung@chromium.org>
+Signed-off-by: Jameson Thies <jthies@google.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20240510201244.2968152-5-jthies@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 87eb3cb4ec61 ("usb: typec: ucsi: Fix cable registration")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/ucsi/ucsi.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
+index 45e91d065b3b..7a127ea57b5a 100644
+--- a/drivers/usb/typec/ucsi/ucsi.c
++++ b/drivers/usb/typec/ucsi/ucsi.c
+@@ -817,10 +817,11 @@ static int ucsi_check_altmodes(struct ucsi_connector *con)
+ /* Ignoring the errors in this case. */
+ if (con->partner_altmode[0]) {
+ num_partner_am = ucsi_get_num_altmode(con->partner_altmode);
+- if (num_partner_am > 0)
+- typec_partner_set_num_altmodes(con->partner, num_partner_am);
++ typec_partner_set_num_altmodes(con->partner, num_partner_am);
+ ucsi_altmode_update_active(con);
+ return 0;
++ } else {
++ typec_partner_set_num_altmodes(con->partner, 0);
+ }
+
+ return ret;
+@@ -1143,7 +1144,7 @@ static int ucsi_check_connection(struct ucsi_connector *con)
+ static int ucsi_check_cable(struct ucsi_connector *con)
+ {
+ u64 command;
+- int ret;
++ int ret, num_plug_am;
+
+ if (con->cable)
+ return 0;
+@@ -1177,6 +1178,13 @@ static int ucsi_check_cable(struct ucsi_connector *con)
+ return ret;
+ }
+
++ if (con->plug_altmode[0]) {
++ num_plug_am = ucsi_get_num_altmode(con->plug_altmode);
++ typec_plug_set_num_altmodes(con->plug, num_plug_am);
++ } else {
++ typec_plug_set_num_altmodes(con->plug, 0);
++ }
++
+ return 0;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From cbecb9ffec88253caf4d38185fea0aeb96be67d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2024 16:09:44 +0300
+Subject: usb: typec: ucsi: Fix cable registration
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+[ Upstream commit 87eb3cb4ec619299cd5572e1d5eb68aef4074ac2 ]
+
+The Cable PD Revision field in GET_CABLE_PROPERTY was
+introduced in UCSI v2.1, so adding check for that.
+
+The cable properties are also not used anywhere after the
+cable is registered, so removing the cable_prop member
+from struct ucsi_connector while at it.
+
+Fixes: 38ca416597b0 ("usb: typec: ucsi: Register cables based on GET_CABLE_PROPERTY")
+Cc: stable@vger.kernel.org
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20240903130945.3395291-1-heikki.krogerus@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/ucsi/ucsi.c | 30 +++++++++++++++---------------
+ drivers/usb/typec/ucsi/ucsi.h | 1 -
+ 2 files changed, 15 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
+index 7a127ea57b5a..bf349ad95dcd 100644
+--- a/drivers/usb/typec/ucsi/ucsi.c
++++ b/drivers/usb/typec/ucsi/ucsi.c
+@@ -915,10 +915,20 @@ static void ucsi_unregister_plug(struct ucsi_connector *con)
+
+ static int ucsi_register_cable(struct ucsi_connector *con)
+ {
++ struct ucsi_cable_property cable_prop;
+ struct typec_cable *cable;
+ struct typec_cable_desc desc = {};
++ u64 command;
++ int ret;
++
++ command = UCSI_GET_CABLE_PROPERTY | UCSI_CONNECTOR_NUMBER(con->num);
++ ret = ucsi_send_command(con->ucsi, command, &cable_prop, sizeof(cable_prop));
++ if (ret < 0) {
++ dev_err(con->ucsi->dev, "GET_CABLE_PROPERTY failed (%d)\n", ret);
++ return ret;
++ }
+
+- switch (UCSI_CABLE_PROP_FLAG_PLUG_TYPE(con->cable_prop.flags)) {
++ switch (UCSI_CABLE_PROP_FLAG_PLUG_TYPE(cable_prop.flags)) {
+ case UCSI_CABLE_PROPERTY_PLUG_TYPE_A:
+ desc.type = USB_PLUG_TYPE_A;
+ break;
+@@ -934,10 +944,10 @@ static int ucsi_register_cable(struct ucsi_connector *con)
+ }
+
+ desc.identity = &con->cable_identity;
+- desc.active = !!(UCSI_CABLE_PROP_FLAG_ACTIVE_CABLE &
+- con->cable_prop.flags);
+- desc.pd_revision = UCSI_CABLE_PROP_FLAG_PD_MAJOR_REV_AS_BCD(
+- con->cable_prop.flags);
++ desc.active = !!(UCSI_CABLE_PROP_FLAG_ACTIVE_CABLE & cable_prop.flags);
++
++ if (con->ucsi->version >= UCSI_VERSION_2_1)
++ desc.pd_revision = UCSI_CABLE_PROP_FLAG_PD_MAJOR_REV_AS_BCD(cable_prop.flags);
+
+ cable = typec_register_cable(con->port, &desc);
+ if (IS_ERR(cable)) {
+@@ -1143,21 +1153,11 @@ static int ucsi_check_connection(struct ucsi_connector *con)
+
+ static int ucsi_check_cable(struct ucsi_connector *con)
+ {
+- u64 command;
+ int ret, num_plug_am;
+
+ if (con->cable)
+ return 0;
+
+- command = UCSI_GET_CABLE_PROPERTY | UCSI_CONNECTOR_NUMBER(con->num);
+- ret = ucsi_send_command(con->ucsi, command, &con->cable_prop,
+- sizeof(con->cable_prop));
+- if (ret < 0) {
+- dev_err(con->ucsi->dev, "GET_CABLE_PROPERTY failed (%d)\n",
+- ret);
+- return ret;
+- }
+-
+ ret = ucsi_register_cable(con);
+ if (ret < 0)
+ return ret;
+diff --git a/drivers/usb/typec/ucsi/ucsi.h b/drivers/usb/typec/ucsi/ucsi.h
+index f66224a270bc..46c37643b59c 100644
+--- a/drivers/usb/typec/ucsi/ucsi.h
++++ b/drivers/usb/typec/ucsi/ucsi.h
+@@ -444,7 +444,6 @@ struct ucsi_connector {
+
+ struct ucsi_connector_status status;
+ struct ucsi_connector_capability cap;
+- struct ucsi_cable_property cable_prop;
+ struct power_supply *psy;
+ struct power_supply_desc psy_desc;
+ u32 rdo;
+--
+2.43.0
+
--- /dev/null
+From b5ffad7651abc3e0e4c1c7ab94e4d3553e5702da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Aug 2024 19:28:08 +0200
+Subject: usbnet: ipheth: do not stop RX on failing RX callback
+
+From: Foster Snowhill <forst@pen.gy>
+
+[ Upstream commit 74efed51e0a4d62f998f806c307778b47fc73395 ]
+
+RX callbacks can fail for multiple reasons:
+
+* Payload too short
+* Payload formatted incorrecly (e.g. bad NCM framing)
+* Lack of memory
+
+None of these should cause the driver to seize up.
+
+Make such failures non-critical and continue processing further
+incoming URBs.
+
+Signed-off-by: Foster Snowhill <forst@pen.gy>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/ipheth.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
+index f04c7bf79665..cdc72559790a 100644
+--- a/drivers/net/usb/ipheth.c
++++ b/drivers/net/usb/ipheth.c
+@@ -308,7 +308,6 @@ static void ipheth_rcvbulk_callback(struct urb *urb)
+ if (retval != 0) {
+ dev_err(&dev->intf->dev, "%s: callback retval: %d\n",
+ __func__, retval);
+- return;
+ }
+
+ rx_submit:
+--
+2.43.0
+
--- /dev/null
+From ace7ca9379fbd7f757b59952e46c479a73ec98d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Aug 2024 19:28:07 +0200
+Subject: usbnet: ipheth: drop RX URBs with no payload
+
+From: Foster Snowhill <forst@pen.gy>
+
+[ Upstream commit 94d7eeb6c0ef0310992944f0d0296929816a2cb0 ]
+
+On iPhone 15 Pro Max one can observe periodic URBs with no payload
+on the "bulk in" (RX) endpoint. These don't seem to do anything
+meaningful. Reproduced on iOS 17.5.1 and 17.6.
+
+This behaviour isn't observed on iPhone 11 on the same iOS version. The
+nature of these zero-length URBs is so far unknown.
+
+Drop RX URBs with no payload.
+
+Signed-off-by: Foster Snowhill <forst@pen.gy>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/ipheth.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
+index 017255615508..f04c7bf79665 100644
+--- a/drivers/net/usb/ipheth.c
++++ b/drivers/net/usb/ipheth.c
+@@ -286,6 +286,12 @@ static void ipheth_rcvbulk_callback(struct urb *urb)
+ return;
+ }
+
++ /* iPhone may periodically send URBs with no payload
++ * on the "bulk in" endpoint. It is safe to ignore them.
++ */
++ if (urb->actual_length == 0)
++ goto rx_submit;
++
+ /* RX URBs starting with 0x00 0x01 do not encapsulate Ethernet frames,
+ * but rather are control frames. Their purpose is not documented, and
+ * they don't affect driver functionality, okay to drop them.
+--
+2.43.0
+
--- /dev/null
+From 246f5fa2cbc8b52c3034ff9611a2e6f4c30475ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Aug 2024 19:28:09 +0200
+Subject: usbnet: ipheth: fix carrier detection in modes 1 and 4
+
+From: Foster Snowhill <forst@pen.gy>
+
+[ Upstream commit 67927a1b255d883881be9467508e0af9a5e0be9d ]
+
+Apart from the standard "configurations", "interfaces" and "alternate
+interface settings" in USB, iOS devices also have a notion of
+"modes". In different modes, the device exposes a different set of
+available configurations.
+
+Depending on the iOS version, and depending on the current mode, the
+length and contents of the carrier state control message differs:
+
+* 1 byte (seen on iOS 4.2.1, 8.4):
+ * 03: carrier off (mode 0)
+ * 04: carrier on (mode 0)
+* 3 bytes (seen on iOS 10.3.4, 15.7.6):
+ * 03 03 03: carrier off (mode 0)
+ * 04 04 03: carrier on (mode 0)
+* 4 bytes (seen on iOS 16.5, 17.6):
+ * 03 03 03 00: carrier off (mode 0)
+ * 04 03 03 00: carrier off (mode 1)
+ * 06 03 03 00: carrier off (mode 4)
+ * 04 04 03 04: carrier on (mode 0 and 1)
+ * 06 04 03 04: carrier on (mode 4)
+
+Before this change, the driver always used the first byte of the
+response to determine carrier state.
+
+From this larger sample, the first byte seems to indicate the number of
+available USB configurations in the current mode (with the exception of
+the default mode 0), and in some cases (namely mode 1 and 4) does not
+correlate with the carrier state.
+
+Previous logic erroneously counted `04 03 03 00` as "carrier on" and
+`06 04 03 04` as "carrier off" on iOS versions that support mode 1 and
+mode 4 respectively.
+
+Only modes 0, 1 and 4 expose the USB Ethernet interfaces necessary for
+the ipheth driver.
+
+Check the second byte of the control message where possible, and fall
+back to checking the first byte on older iOS versions.
+
+Signed-off-by: Foster Snowhill <forst@pen.gy>
+Tested-by: Georgi Valkov <gvalkov@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/ipheth.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
+index cdc72559790a..46afb95ffabe 100644
+--- a/drivers/net/usb/ipheth.c
++++ b/drivers/net/usb/ipheth.c
+@@ -355,13 +355,14 @@ static int ipheth_carrier_set(struct ipheth_device *dev)
+ 0x02, /* index */
+ dev->ctrl_buf, IPHETH_CTRL_BUF_SIZE,
+ IPHETH_CTRL_TIMEOUT);
+- if (retval < 0) {
++ if (retval <= 0) {
+ dev_err(&dev->intf->dev, "%s: usb_control_msg: %d\n",
+ __func__, retval);
+ return retval;
+ }
+
+- if (dev->ctrl_buf[0] == IPHETH_CARRIER_ON) {
++ if ((retval == 1 && dev->ctrl_buf[0] == IPHETH_CARRIER_ON) ||
++ (retval >= 2 && dev->ctrl_buf[1] == IPHETH_CARRIER_ON)) {
+ netif_carrier_on(dev->net);
+ if (dev->tx_urb->status != -EINPROGRESS)
+ netif_wake_queue(dev->net);
+--
+2.43.0
+
--- /dev/null
+From 329f357f07fe0ff5375f511f5d4e341b8fcf990b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Aug 2024 19:28:06 +0200
+Subject: usbnet: ipheth: remove extraneous rx URB length check
+
+From: Foster Snowhill <forst@pen.gy>
+
+[ Upstream commit 655b46d7a39ac6f049698b27c1568c0f7ff85d1e ]
+
+Rx URB length was already checked in ipheth_rcvbulk_callback_legacy()
+and ipheth_rcvbulk_callback_ncm(), depending on the current mode.
+The check in ipheth_rcvbulk_callback() was thus mostly a duplicate.
+
+The only place in ipheth_rcvbulk_callback() where we care about the URB
+length is for the initial control frame. These frames are always 4 bytes
+long. This has been checked as far back as iOS 4.2.1 on iPhone 3G.
+
+Remove the extraneous URB length check. For control frames, check for
+the specific 4-byte length instead.
+
+Signed-off-by: Foster Snowhill <forst@pen.gy>
+Tested-by: Georgi Valkov <gvalkov@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/ipheth.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
+index 6eeef10edada..017255615508 100644
+--- a/drivers/net/usb/ipheth.c
++++ b/drivers/net/usb/ipheth.c
+@@ -286,11 +286,6 @@ static void ipheth_rcvbulk_callback(struct urb *urb)
+ return;
+ }
+
+- if (urb->actual_length <= IPHETH_IP_ALIGN) {
+- dev->net->stats.rx_length_errors++;
+- return;
+- }
+-
+ /* RX URBs starting with 0x00 0x01 do not encapsulate Ethernet frames,
+ * but rather are control frames. Their purpose is not documented, and
+ * they don't affect driver functionality, okay to drop them.
+@@ -298,7 +293,8 @@ static void ipheth_rcvbulk_callback(struct urb *urb)
+ * URB received from the bulk IN endpoint.
+ */
+ if (unlikely
+- (((char *)urb->transfer_buffer)[0] == 0 &&
++ (urb->actual_length == 4 &&
++ ((char *)urb->transfer_buffer)[0] == 0 &&
+ ((char *)urb->transfer_buffer)[1] == 1))
+ goto rx_submit;
+
+--
+2.43.0
+
--- /dev/null
+From de9b2892088f1e2a8d11c3c1f27d5c9b22d43a4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Aug 2024 12:45:41 +0200
+Subject: wifi: mt76: mt7921: fix NULL pointer access in
+ mt7921_ipv6_addr_change
+
+From: Bert Karwatzki <spasswolf@web.de>
+
+[ Upstream commit 479ffee68d59c599f8aed8fa2dcc8e13e7bd13c3 ]
+
+When disabling wifi mt7921_ipv6_addr_change() is called as a notifier.
+At this point mvif->phy is already NULL so we cannot use it here.
+
+Signed-off-by: Bert Karwatzki <spasswolf@web.de>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://patch.msgid.link/20240812104542.80760-1-spasswolf@web.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+index 3e3ad3518d85..cca7132ed6ab 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+@@ -1182,7 +1182,7 @@ static void mt7921_ipv6_addr_change(struct ieee80211_hw *hw,
+ struct inet6_dev *idev)
+ {
+ struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
+- struct mt792x_dev *dev = mvif->phy->dev;
++ struct mt792x_dev *dev = mt792x_hw_dev(hw);
+ struct inet6_ifaddr *ifa;
+ struct in6_addr ns_addrs[IEEE80211_BSS_ARP_ADDR_LIST_LEN];
+ struct sk_buff *skb;
+--
+2.43.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
