--- /dev/null
+From 3baa763a182de8152b189ade9656d1d652c466c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jul 2024 12:08:55 -0400
+Subject: ALSA: usb: Fix UBSAN warning in parse_audio_unit()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 2f38cf730caedaeacdefb7ff35b0a3c1168117f9 ]
+
+A malformed USB descriptor may pass the lengthy mixer description with
+a lot of channels, and this may overflow the 32bit integer shift
+size, as caught by syzbot UBSAN test. Although this won't cause any
+real trouble, it's better to address.
+
+This patch introduces a sanity check of the number of channels to bail
+out the parsing when too many channels are found.
+
+Reported-by: syzbot+78d5b129a762182225aa@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/0000000000000adac5061d3c7355@google.com
+Link: https://patch.msgid.link/20240715123619.26612-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 4b979218d3b0..5163d5e7682e 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -2008,6 +2008,13 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid,
+ bmaControls = ftr->bmaControls;
+ }
+
++ if (channels > 32) {
++ usb_audio_info(state->chip,
++ "usbmixer: too many channels (%d) in unit %d\n",
++ channels, unitid);
++ return -EINVAL;
++ }
++
+ /* parse the source unit */
+ err = parse_audio_unit(state, hdr->bSourceID);
+ if (err < 0)
+--
+2.39.5
+
--- /dev/null
+From a7fd4276ab3f25513de8f8a0d17e7510ab487b76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jul 2024 12:08:51 -0400
+Subject: ASoC: Intel: sof_sdw: fix jack detection on ADL-N variant RVP
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 65c90df918205bc84f5448550cde76a54dae5f52 ]
+
+Experimental tests show that JD2_100K is required, otherwise the jack
+is detected always even with nothing plugged-in.
+
+To avoid matching with other known quirks the SKU information is used.
+
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://patch.msgid.link/20240624121119.91552-2-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_sdw.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index 089b6c7994f9..cfa0c3eaffea 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -258,6 +258,15 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
+ SOF_BT_OFFLOAD_SSP(2) |
+ SOF_SSP_BT_OFFLOAD_PRESENT),
+ },
++ {
++ .callback = sof_sdw_quirk_cb,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "Intel Corporation"),
++ DMI_MATCH(DMI_PRODUCT_SKU, "0000000000070000"),
++ },
++ .driver_data = (void *)(SOF_SDW_TGL_HDMI |
++ RT711_JD2_100K),
++ },
+ {
+ .callback = sof_sdw_quirk_cb,
+ .matches = {
+--
+2.39.5
+
--- /dev/null
+From f07cf771efd419c00e30768d076e5285c6dfff00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2024 15:34:02 +0800
+Subject: erofs: fix incorrect symlink detection in fast symlink
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+commit 9ed50b8231e37b1ae863f5dec8153b98d9f389b4 upstream.
+
+Fast symlink can be used if the on-disk symlink data is stored
+in the same block as the on-disk inode, so we don’t need to trigger
+another I/O for symlink data. However, currently fs correction could be
+reported _incorrectly_ if inode xattrs are too large.
+
+In fact, these should be valid images although they cannot be handled as
+fast symlinks.
+
+Many thanks to Colin for reporting this!
+
+Reported-by: Colin Walters <walters@verbum.org>
+Reported-by: https://honggfuzz.dev/
+Link: https://lore.kernel.org/r/bb2dd430-7de0-47da-ae5b-82ab2dd4d945@app.fastmail.com
+Fixes: 431339ba9042 ("staging: erofs: add inode operations")
+[ Note that it's a runtime misbehavior instead of a security issue. ]
+Link: https://lore.kernel.org/r/20240909031911.1174718-1-hsiangkao@linux.alibaba.com
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/inode.c | 20 ++++++--------------
+ 1 file changed, 6 insertions(+), 14 deletions(-)
+
+diff --git a/fs/erofs/inode.c b/fs/erofs/inode.c
+index 638bb70d0d65..c68258ae70d3 100644
+--- a/fs/erofs/inode.c
++++ b/fs/erofs/inode.c
+@@ -219,11 +219,14 @@ static int erofs_fill_symlink(struct inode *inode, void *data,
+ unsigned int m_pofs)
+ {
+ struct erofs_inode *vi = EROFS_I(inode);
++ loff_t off;
+ char *lnk;
+
+- /* if it cannot be handled with fast symlink scheme */
+- if (vi->datalayout != EROFS_INODE_FLAT_INLINE ||
+- inode->i_size >= PAGE_SIZE || inode->i_size < 0) {
++ m_pofs += vi->xattr_isize;
++ /* check if it cannot be handled with fast symlink scheme */
++ if (vi->datalayout != EROFS_INODE_FLAT_INLINE || inode->i_size < 0 ||
++ check_add_overflow(m_pofs, inode->i_size, &off) ||
++ off > i_blocksize(inode)) {
+ inode->i_op = &erofs_symlink_iops;
+ return 0;
+ }
+@@ -232,17 +235,6 @@ static int erofs_fill_symlink(struct inode *inode, void *data,
+ if (!lnk)
+ return -ENOMEM;
+
+- m_pofs += vi->xattr_isize;
+- /* inline symlink data shouldn't cross page boundary as well */
+- if (m_pofs + inode->i_size > PAGE_SIZE) {
+- kfree(lnk);
+- erofs_err(inode->i_sb,
+- "inline data cross block boundary @ nid %llu",
+- vi->nid);
+- DBG_BUGON(1);
+- return -EFSCORRUPTED;
+- }
+-
+ memcpy(lnk, data + m_pofs, inode->i_size);
+ lnk[inode->i_size] = '\0';
+
+--
+2.39.5
+
--- /dev/null
+From 626b42e99746004149a8142558ab37299a6f679c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Dec 2024 00:19:34 +0100
+Subject: i2c: pnx: Fix timeout in wait functions
+
+From: Vladimir Riabchun <ferr.lambarginio@gmail.com>
+
+[ Upstream commit 7363f2d4c18557c99c536b70489187bb4e05c412 ]
+
+Since commit f63b94be6942 ("i2c: pnx: Fix potential deadlock warning
+from del_timer_sync() call in isr") jiffies are stored in
+i2c_pnx_algo_data.timeout, but wait_timeout and wait_reset are still
+using it as milliseconds. Convert jiffies back to milliseconds to wait
+for the expected amount of time.
+
+Fixes: f63b94be6942 ("i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr")
+Signed-off-by: Vladimir Riabchun <ferr.lambarginio@gmail.com>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-pnx.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-pnx.c b/drivers/i2c/busses/i2c-pnx.c
+index d2c09b0fdf52..ab87bef50402 100644
+--- a/drivers/i2c/busses/i2c-pnx.c
++++ b/drivers/i2c/busses/i2c-pnx.c
+@@ -95,7 +95,7 @@ enum {
+
+ static inline int wait_timeout(struct i2c_pnx_algo_data *data)
+ {
+- long timeout = data->timeout;
++ long timeout = jiffies_to_msecs(data->timeout);
+ while (timeout > 0 &&
+ (ioread32(I2C_REG_STS(data)) & mstatus_active)) {
+ mdelay(1);
+@@ -106,7 +106,7 @@ static inline int wait_timeout(struct i2c_pnx_algo_data *data)
+
+ static inline int wait_reset(struct i2c_pnx_algo_data *data)
+ {
+- long timeout = data->timeout;
++ long timeout = jiffies_to_msecs(data->timeout);
+ while (timeout > 0 &&
+ (ioread32(I2C_REG_CTL(data)) & mcntrl_reset)) {
+ mdelay(1);
+--
+2.39.5
+
--- /dev/null
+From 78f01f198c2aef0eb09fb545c4e8038051424a71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jul 2024 12:08:48 -0400
+Subject: MIPS: Loongson64: DTS: Fix msi node for ls7a
+
+From: Jiaxun Yang <jiaxun.yang@flygoat.com>
+
+[ Upstream commit 98a9e2ac3755a353eefea8c52e23d5b0c50f3899 ]
+
+Add it to silent warning:
+arch/mips/boot/dts/loongson/ls7a-pch.dtsi:68.16-416.5: Warning (interrupt_provider): /bus@10000000/pci@1a000000: '#interrupt-cells' found, but node is not an interrupt provider
+arch/mips/boot/dts/loongson/loongson64g_4core_ls7a.dts:32.31-40.4: Warning (interrupt_provider): /bus@10000000/msi-controller@2ff00000: Missing '#interrupt-cells' in interrupt provider
+arch/mips/boot/dts/loongson/loongson64g_4core_ls7a.dtb: Warning (interrupt_map): Failed prerequisite 'interrupt_provider'
+
+Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/loongson/loongson64g_4core_ls7a.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/mips/boot/dts/loongson/loongson64g_4core_ls7a.dts b/arch/mips/boot/dts/loongson/loongson64g_4core_ls7a.dts
+index c945f8565d54..fb180cb2b8e2 100644
+--- a/arch/mips/boot/dts/loongson/loongson64g_4core_ls7a.dts
++++ b/arch/mips/boot/dts/loongson/loongson64g_4core_ls7a.dts
+@@ -33,6 +33,7 @@
+ compatible = "loongson,pch-msi-1.0";
+ reg = <0 0x2ff00000 0 0x8>;
+ interrupt-controller;
++ #interrupt-cells = <1>;
+ msi-controller;
+ loongson,msi-base-vec = <64>;
+ loongson,msi-num-vecs = <192>;
+--
+2.39.5
+
--- /dev/null
+From df7f6344bd0a904766f4d3fb2010ab1e835dd574 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jul 2024 12:08:43 -0400
+Subject: PCI: Add ACS quirk for Broadcom BCM5760X NIC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ajit Khaparde <ajit.khaparde@broadcom.com>
+
+[ Upstream commit 524e057b2d66b61f9b63b6db30467ab7b0bb4796 ]
+
+The Broadcom BCM5760X NIC may be a multi-function device.
+
+While it does not advertise an ACS capability, peer-to-peer transactions
+are not possible between the individual functions. So it is ok to treat
+them as fully isolated.
+
+Add an ACS quirk for this device so the functions can be in independent
+IOMMU groups and attached individually to userspace applications using
+VFIO.
+
+[kwilczynski: commit log]
+Link: https://lore.kernel.org/linux-pci/20240510204228.73435-1-ajit.khaparde@broadcom.com
+Signed-off-by: Ajit Khaparde <ajit.khaparde@broadcom.com>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Andy Gospodarek <gospo@broadcom.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 6b76154626e2..24fde99c11a7 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4982,6 +4982,10 @@ static const struct pci_dev_acs_enabled {
+ { PCI_VENDOR_ID_BROADCOM, 0x1750, pci_quirk_mf_endpoint_acs },
+ { PCI_VENDOR_ID_BROADCOM, 0x1751, pci_quirk_mf_endpoint_acs },
+ { PCI_VENDOR_ID_BROADCOM, 0x1752, pci_quirk_mf_endpoint_acs },
++ { PCI_VENDOR_ID_BROADCOM, 0x1760, pci_quirk_mf_endpoint_acs },
++ { PCI_VENDOR_ID_BROADCOM, 0x1761, pci_quirk_mf_endpoint_acs },
++ { PCI_VENDOR_ID_BROADCOM, 0x1762, pci_quirk_mf_endpoint_acs },
++ { PCI_VENDOR_ID_BROADCOM, 0x1763, pci_quirk_mf_endpoint_acs },
+ { PCI_VENDOR_ID_BROADCOM, 0xD714, pci_quirk_brcm_acs },
+ /* Amazon Annapurna Labs */
+ { PCI_VENDOR_ID_AMAZON_ANNAPURNA_LABS, 0x0031, pci_quirk_al_acs },
+--
+2.39.5
+
--- /dev/null
+From 807003919b6c736ebd8821a22d339dcfe36b2983 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jul 2024 12:08:50 -0400
+Subject: PCI/AER: Disable AER service on suspend
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+[ Upstream commit 5afc2f763edc5daae4722ee46fea4e627d01fa90 ]
+
+If the link is powered off during suspend, electrical noise may cause
+errors that are logged via AER. If the AER interrupt is enabled and shares
+an IRQ with PME, that causes a spurious wakeup during suspend.
+
+Disable the AER interrupt during suspend to prevent this. Clear error
+status before re-enabling IRQ interrupts during resume so we don't get an
+interrupt for errors that occurred during the suspend/resume process.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=209149
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=216295
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=218090
+Link: https://lore.kernel.org/r/20240416043225.1462548-2-kai.heng.feng@canonical.com
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+[bhelgaas: drop pci_ancestor_pr3_present() etc, commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/aer.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c
+index 4f7744aab6c7..2908bfda8880 100644
+--- a/drivers/pci/pcie/aer.c
++++ b/drivers/pci/pcie/aer.c
+@@ -1382,6 +1382,22 @@ static int aer_probe(struct pcie_device *dev)
+ return 0;
+ }
+
++static int aer_suspend(struct pcie_device *dev)
++{
++ struct aer_rpc *rpc = get_service_data(dev);
++
++ aer_disable_rootport(rpc);
++ return 0;
++}
++
++static int aer_resume(struct pcie_device *dev)
++{
++ struct aer_rpc *rpc = get_service_data(dev);
++
++ aer_enable_rootport(rpc);
++ return 0;
++}
++
+ /**
+ * aer_root_reset - reset Root Port hierarchy, RCEC, or RCiEP
+ * @dev: pointer to Root Port, RCEC, or RCiEP
+@@ -1453,6 +1469,8 @@ static struct pcie_port_service_driver aerdriver = {
+ .service = PCIE_PORT_SERVICE_AER,
+
+ .probe = aer_probe,
++ .suspend = aer_suspend,
++ .resume = aer_resume,
+ .remove = aer_remove,
+ };
+
+--
+2.39.5
+
--- /dev/null
+From 26f03dcf6bce6466396433aa078a6aace173e7e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jul 2024 12:08:44 -0400
+Subject: PCI: Use preserve_config in place of pci_flags
+
+From: Vidya Sagar <vidyas@nvidia.com>
+
+[ Upstream commit 7246a4520b4bf1494d7d030166a11b5226f6d508 ]
+
+Use preserve_config in place of checking for PCI_PROBE_ONLY flag to enable
+support for "linux,pci-probe-only" on a per host bridge basis.
+
+This also obviates the use of adding PCI_REASSIGN_ALL_BUS flag if
+!PCI_PROBE_ONLY, as pci_assign_unassigned_root_bus_resources() takes care
+of reassigning the resources that are not already claimed.
+
+Link: https://lore.kernel.org/r/20240508174138.3630283-5-vidyas@nvidia.com
+Signed-off-by: Vidya Sagar <vidyas@nvidia.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-host-common.c | 4 ----
+ drivers/pci/probe.c | 20 +++++++++-----------
+ 2 files changed, 9 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/pci/controller/pci-host-common.c b/drivers/pci/controller/pci-host-common.c
+index d3924a44db02..fd3020a399cf 100644
+--- a/drivers/pci/controller/pci-host-common.c
++++ b/drivers/pci/controller/pci-host-common.c
+@@ -73,10 +73,6 @@ int pci_host_common_probe(struct platform_device *pdev)
+ if (IS_ERR(cfg))
+ return PTR_ERR(cfg);
+
+- /* Do not reassign resources if probe only */
+- if (!pci_has_flag(PCI_PROBE_ONLY))
+- pci_add_flags(PCI_REASSIGN_ALL_BUS);
+-
+ bridge->sysdata = cfg;
+ bridge->ops = (struct pci_ops *)&ops->pci_ops;
+ bridge->msi_domain = true;
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index dd2134c7c419..cda6650aa3b1 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -3048,20 +3048,18 @@ int pci_host_probe(struct pci_host_bridge *bridge)
+
+ bus = bridge->bus;
+
++ /* If we must preserve the resource configuration, claim now */
++ if (bridge->preserve_config)
++ pci_bus_claim_resources(bus);
++
+ /*
+- * We insert PCI resources into the iomem_resource and
+- * ioport_resource trees in either pci_bus_claim_resources()
+- * or pci_bus_assign_resources().
++ * Assign whatever was left unassigned. If we didn't claim above,
++ * this will reassign everything.
+ */
+- if (pci_has_flag(PCI_PROBE_ONLY)) {
+- pci_bus_claim_resources(bus);
+- } else {
+- pci_bus_size_bridges(bus);
+- pci_bus_assign_resources(bus);
++ pci_assign_unassigned_root_bus_resources(bus);
+
+- list_for_each_entry(child, &bus->children, node)
+- pcie_bus_configure_settings(child);
+- }
++ list_for_each_entry(child, &bus->children, node)
++ pcie_bus_configure_settings(child);
+
+ pci_bus_add_devices(bus);
+ return 0;
+--
+2.39.5
+
--- /dev/null
+From 070ae57c1e5982cca1f52156bbf786e19ff67481 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jul 2024 12:08:53 -0400
+Subject: PCI: vmd: Create domain symlink before pci_bus_add_devices()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jiwei Sun <sunjw10@lenovo.com>
+
+[ Upstream commit f24c9bfcd423e2b2bb0d198456412f614ec2030a ]
+
+The vmd driver creates a "domain" symlink in sysfs for each VMD bridge.
+Previously this symlink was created after pci_bus_add_devices() added
+devices below the VMD bridge and emitted udev events to announce them to
+userspace.
+
+This led to a race between userspace consumers of the udev events and the
+kernel creation of the symlink. One such consumer is mdadm, which
+assembles block devices into a RAID array, and for devices below a VMD
+bridge, mdadm depends on the "domain" symlink.
+
+If mdadm loses the race, it may be unable to assemble a RAID array, which
+may cause a boot failure or other issues, with complaints like this:
+
+ (udev-worker)[2149]: nvme1n1: '/sbin/mdadm -I /dev/nvme1n1'(err) 'mdadm: Unable to get real path for '/sys/bus/pci/drivers/vmd/0000:c7:00.5/domain/device''
+ (udev-worker)[2149]: nvme1n1: '/sbin/mdadm -I /dev/nvme1n1'(err) 'mdadm: /dev/nvme1n1 is not attached to Intel(R) RAID controller.'
+ (udev-worker)[2149]: nvme1n1: '/sbin/mdadm -I /dev/nvme1n1'(err) 'mdadm: No OROM/EFI properties for /dev/nvme1n1'
+ (udev-worker)[2149]: nvme1n1: '/sbin/mdadm -I /dev/nvme1n1'(err) 'mdadm: no RAID superblock on /dev/nvme1n1.'
+ (udev-worker)[2149]: nvme1n1: Process '/sbin/mdadm -I /dev/nvme1n1' failed with exit code 1.
+
+This symptom prevents the OS from booting successfully.
+
+After a NVMe disk is probed/added by the nvme driver, udevd invokes mdadm
+to detect if there is a mdraid associated with this NVMe disk, and mdadm
+determines if a NVMe device is connected to a particular VMD domain by
+checking the "domain" symlink. For example:
+
+ Thread A Thread B Thread mdadm
+ vmd_enable_domain
+ pci_bus_add_devices
+ __driver_probe_device
+ ...
+ work_on_cpu
+ schedule_work_on
+ : wakeup Thread B
+ nvme_probe
+ : wakeup scan_work
+ to scan nvme disk
+ and add nvme disk
+ then wakeup udevd
+ : udevd executes
+ mdadm command
+ flush_work main
+ : wait for nvme_probe done ...
+ __driver_probe_device find_driver_devices
+ : probe next nvme device : 1) Detect domain symlink
+ ... 2) Find domain symlink
+ ... from vmd sysfs
+ ... 3) Domain symlink not
+ ... created yet; failed
+ sysfs_create_link
+ : create domain symlink
+
+Create the VMD "domain" symlink before invoking pci_bus_add_devices() to
+avoid this race.
+
+Suggested-by: Adrian Huang <ahuang12@lenovo.com>
+Link: https://lore.kernel.org/linux-pci/20240605124844.24293-1-sjiwei@163.com
+Signed-off-by: Jiwei Sun <sunjw10@lenovo.com>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+[bhelgaas: commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Nirmal Patel <nirmal.patel@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/vmd.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
+index f49001ba96c7..10a078ef4799 100644
+--- a/drivers/pci/controller/vmd.c
++++ b/drivers/pci/controller/vmd.c
+@@ -798,6 +798,9 @@ static int vmd_enable_domain(struct vmd_dev *vmd, unsigned long features)
+ if (vmd->irq_domain)
+ dev_set_msi_domain(&vmd->bus->dev, vmd->irq_domain);
+
++ WARN(sysfs_create_link(&vmd->dev->dev.kobj, &vmd->bus->dev.kobj,
++ "domain"), "Can't create symlink to domain\n");
++
+ vmd_acpi_begin();
+
+ pci_scan_child_bus(vmd->bus);
+@@ -814,9 +817,6 @@ static int vmd_enable_domain(struct vmd_dev *vmd, unsigned long features)
+ pci_bus_add_devices(vmd->bus);
+
+ vmd_acpi_end();
+-
+- WARN(sysfs_create_link(&vmd->dev->dev.kobj, &vmd->bus->dev.kobj,
+- "domain"), "Can't create symlink to domain\n");
+ return 0;
+ }
+
+@@ -873,8 +873,8 @@ static void vmd_remove(struct pci_dev *dev)
+ {
+ struct vmd_dev *vmd = pci_get_drvdata(dev);
+
+- sysfs_remove_link(&vmd->dev->dev.kobj, "domain");
+ pci_stop_root_bus(vmd->bus);
++ sysfs_remove_link(&vmd->dev->dev.kobj, "domain");
+ pci_remove_root_bus(vmd->bus);
+ vmd_cleanup_srcu(vmd);
+ vmd_detach_resources(vmd);
+--
+2.39.5
+
net-sched-fix-ordering-of-qlen-adjustment.patch
+pci-use-preserve_config-in-place-of-pci_flags.patch
+pci-aer-disable-aer-service-on-suspend.patch
+alsa-usb-fix-ubsan-warning-in-parse_audio_unit.patch
+usb-cdns3-add-quirk-flag-to-enable-suspend-residency.patch
+asoc-intel-sof_sdw-fix-jack-detection-on-adl-n-varia.patch
+pci-vmd-create-domain-symlink-before-pci_bus_add_dev.patch
+pci-add-acs-quirk-for-broadcom-bcm5760x-nic.patch
+mips-loongson64-dts-fix-msi-node-for-ls7a.patch
+usb-dwc2-gadget-don-t-write-invalid-mapped-sg-entrie.patch
+i2c-pnx-fix-timeout-in-wait-functions.patch
+erofs-fix-incorrect-symlink-detection-in-fast-symlin.patch
--- /dev/null
+From 12e5ccb490ee9ad19a7f18766321e0b65cb2bd06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jul 2024 12:08:45 -0400
+Subject: usb: cdns3: Add quirk flag to enable suspend residency
+
+From: Roger Quadros <rogerq@kernel.org>
+
+[ Upstream commit 0aca19e4037a4143273e90f1b44666b78b4dde9b ]
+
+Some platforms (e.g. ti,j721e-usb, ti,am64-usb) require
+this bit to be set to workaround a lockup issue with PHY
+short suspend intervals [1]. Add a platform quirk flag
+to indicate if Suspend Residency should be enabled.
+
+[1] - https://www.ti.com/lit/er/sprz457h/sprz457h.pdf
+i2409 - USB: USB2 PHY locks up due to short suspend
+
+Signed-off-by: Roger Quadros <rogerq@kernel.org>
+Signed-off-by: Ravi Gunasekaran <r-gunasekaran@ti.com>
+Acked-by: Peter Chen <peter.chen@kernel.org>
+Link: https://lore.kernel.org/r/20240516044537.16801-2-r-gunasekaran@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/cdns3/core.h | 1 +
+ drivers/usb/cdns3/drd.c | 10 +++++++++-
+ drivers/usb/cdns3/drd.h | 3 +++
+ 3 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/cdns3/core.h b/drivers/usb/cdns3/core.h
+index 1726799367d1..7d4b8311051d 100644
+--- a/drivers/usb/cdns3/core.h
++++ b/drivers/usb/cdns3/core.h
+@@ -44,6 +44,7 @@ struct cdns3_platform_data {
+ bool suspend, bool wakeup);
+ unsigned long quirks;
+ #define CDNS3_DEFAULT_PM_RUNTIME_ALLOW BIT(0)
++#define CDNS3_DRD_SUSPEND_RESIDENCY_ENABLE BIT(1)
+ };
+
+ /**
+diff --git a/drivers/usb/cdns3/drd.c b/drivers/usb/cdns3/drd.c
+index 33ba30f79b33..8e19ee72c120 100644
+--- a/drivers/usb/cdns3/drd.c
++++ b/drivers/usb/cdns3/drd.c
+@@ -385,7 +385,7 @@ static irqreturn_t cdns_drd_irq(int irq, void *data)
+ int cdns_drd_init(struct cdns *cdns)
+ {
+ void __iomem *regs;
+- u32 state;
++ u32 state, reg;
+ int ret;
+
+ regs = devm_ioremap_resource(cdns->dev, &cdns->otg_res);
+@@ -429,6 +429,14 @@ int cdns_drd_init(struct cdns *cdns)
+ cdns->otg_irq_regs = (struct cdns_otg_irq_regs __iomem *)
+ &cdns->otg_v1_regs->ien;
+ writel(1, &cdns->otg_v1_regs->simulate);
++
++ if (cdns->pdata &&
++ (cdns->pdata->quirks & CDNS3_DRD_SUSPEND_RESIDENCY_ENABLE)) {
++ reg = readl(&cdns->otg_v1_regs->susp_ctrl);
++ reg |= SUSP_CTRL_SUSPEND_RESIDENCY_ENABLE;
++ writel(reg, &cdns->otg_v1_regs->susp_ctrl);
++ }
++
+ cdns->version = CDNS3_CONTROLLER_V1;
+ } else {
+ dev_err(cdns->dev, "not supporte DID=0x%08x\n", state);
+diff --git a/drivers/usb/cdns3/drd.h b/drivers/usb/cdns3/drd.h
+index d72370c321d3..1e2aee14d629 100644
+--- a/drivers/usb/cdns3/drd.h
++++ b/drivers/usb/cdns3/drd.h
+@@ -193,6 +193,9 @@ struct cdns_otg_irq_regs {
+ /* OTGREFCLK - bitmasks */
+ #define OTGREFCLK_STB_CLK_SWITCH_EN BIT(31)
+
++/* SUPS_CTRL - bitmasks */
++#define SUSP_CTRL_SUSPEND_RESIDENCY_ENABLE BIT(17)
++
+ /* OVERRIDE - bitmasks */
+ #define OVERRIDE_IDPULLUP BIT(0)
+ /* Only for CDNS3_CONTROLLER_V0 version */
+--
+2.39.5
+
--- /dev/null
+From a6d85a482ea65e8739b0334403da8905445cef18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jul 2024 12:08:46 -0400
+Subject: usb: dwc2: gadget: Don't write invalid mapped sg entries into
+ dma_desc with iommu enabled
+
+From: Peng Hongchi <hongchi.peng@siengine.com>
+
+[ Upstream commit 1134289b6b93d73721340b66c310fd985385e8fa ]
+
+When using dma_map_sg() to map the scatterlist with iommu enabled,
+the entries in the scatterlist can be mergerd into less but longer
+entries in the function __finalise_sg(). So that the number of
+valid mapped entries is actually smaller than ureq->num_reqs,and
+there are still some invalid entries in the scatterlist with
+dma_addr=0xffffffff and len=0. Writing these invalid sg entries
+into the dma_desc can cause a data transmission error.
+
+The function dma_map_sg() returns the number of valid map entries
+and the return value is assigned to usb_request::num_mapped_sgs in
+function usb_gadget_map_request_by_dev(). So that just write valid
+mapped entries into dma_desc according to the usb_request::num_mapped_sgs,
+and set the IOC bit if it's the last valid mapped entry.
+
+This patch poses no risk to no-iommu situation, cause
+ureq->num_mapped_sgs equals ureq->num_sgs while using dma_direct_map_sg()
+to map the scatterlist whith iommu disabled.
+
+Signed-off-by: Peng Hongchi <hongchi.peng@siengine.com>
+Link: https://lore.kernel.org/r/20240523100315.7226-1-hongchi.peng@siengine.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/gadget.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index f6b2a4f2e59d..4422da561365 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -886,10 +886,10 @@ static void dwc2_gadget_config_nonisoc_xfer_ddma(struct dwc2_hsotg_ep *hs_ep,
+ }
+
+ /* DMA sg buffer */
+- for_each_sg(ureq->sg, sg, ureq->num_sgs, i) {
++ for_each_sg(ureq->sg, sg, ureq->num_mapped_sgs, i) {
+ dwc2_gadget_fill_nonisoc_xfer_ddma_one(hs_ep, &desc,
+ sg_dma_address(sg) + sg->offset, sg_dma_len(sg),
+- sg_is_last(sg));
++ (i == (ureq->num_mapped_sgs - 1)));
+ desc_count += hs_ep->desc_count;
+ }
+
+--
+2.39.5
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
