--- /dev/null
+From 6f7e4664e597440dfbdb8b2931c561b717030d07 Mon Sep 17 00:00:00 2001
+From: Bin Li <bin.li@canonical.com>
+Date: Mon, 4 Dec 2023 18:04:50 +0800
+Subject: ALSA: hda/realtek: Enable headset on Lenovo M90 Gen5
+
+From: Bin Li <bin.li@canonical.com>
+
+commit 6f7e4664e597440dfbdb8b2931c561b717030d07 upstream.
+
+Lenovo M90 Gen5 is equipped with ALC897, and it needs
+ALC897_FIXUP_HEADSET_MIC_PIN quirk to make its headset mic work.
+
+Signed-off-by: Bin Li <bin.li@canonical.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20231204100450.642783-1-bin.li@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -11317,6 +11317,7 @@ static const struct snd_pci_quirk alc662
+ SND_PCI_QUIRK(0x17aa, 0x32f7, "Lenovo ThinkCentre M90", ALC897_FIXUP_HEADSET_MIC_PIN),
+ SND_PCI_QUIRK(0x17aa, 0x3321, "Lenovo ThinkCentre M70 Gen4", ALC897_FIXUP_HEADSET_MIC_PIN),
+ SND_PCI_QUIRK(0x17aa, 0x331b, "Lenovo ThinkCentre M90 Gen4", ALC897_FIXUP_HEADSET_MIC_PIN),
++ SND_PCI_QUIRK(0x17aa, 0x3364, "Lenovo ThinkCentre M90 Gen5", ALC897_FIXUP_HEADSET_MIC_PIN),
+ SND_PCI_QUIRK(0x17aa, 0x3742, "Lenovo TianYi510Pro-14IOB", ALC897_FIXUP_HEADSET_MIC_PIN2),
+ SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo Ideapad Y550P", ALC662_FIXUP_IDEAPAD),
+ SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD),
--- /dev/null
+From 2b3a7a302c9804e463f2ea5b54dc3a6ad106a344 Mon Sep 17 00:00:00 2001
+From: Jason Zhang <jason.zhang@rock-chips.com>
+Date: Wed, 6 Dec 2023 09:31:39 +0800
+Subject: ALSA: pcm: fix out-of-bounds in snd_pcm_state_names
+
+From: Jason Zhang <jason.zhang@rock-chips.com>
+
+commit 2b3a7a302c9804e463f2ea5b54dc3a6ad106a344 upstream.
+
+The pcm state can be SNDRV_PCM_STATE_DISCONNECTED at disconnect
+callback, and there is not an entry of SNDRV_PCM_STATE_DISCONNECTED
+in snd_pcm_state_names.
+
+This patch adds the missing entry to resolve this issue.
+
+cat /proc/asound/card2/pcm0p/sub0/status
+That results in stack traces like the following:
+
+[ 99.702732][ T5171] Unexpected kernel BRK exception at EL1
+[ 99.702774][ T5171] Internal error: BRK handler: f2005512 [#1] PREEMPT SMP
+[ 99.703858][ T5171] Modules linked in: bcmdhd(E) (...)
+[ 99.747425][ T5171] CPU: 3 PID: 5171 Comm: cat Tainted: G C OE 5.10.189-android13-4-00003-g4a17384380d8-ab11086999 #1
+[ 99.748447][ T5171] Hardware name: Rockchip RK3588 CVTE V10 Board (DT)
+[ 99.749024][ T5171] pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--)
+[ 99.749616][ T5171] pc : snd_pcm_substream_proc_status_read+0x264/0x2bc
+[ 99.750204][ T5171] lr : snd_pcm_substream_proc_status_read+0xa4/0x2bc
+[ 99.750778][ T5171] sp : ffffffc0175abae0
+[ 99.751132][ T5171] x29: ffffffc0175abb80 x28: ffffffc009a2c498
+[ 99.751665][ T5171] x27: 0000000000000001 x26: ffffff810cbae6e8
+[ 99.752199][ T5171] x25: 0000000000400cc0 x24: ffffffc0175abc60
+[ 99.752729][ T5171] x23: 0000000000000000 x22: ffffff802f558400
+[ 99.753263][ T5171] x21: ffffff81d8d8ff00 x20: ffffff81020cdc00
+[ 99.753795][ T5171] x19: ffffff802d110000 x18: ffffffc014fbd058
+[ 99.754326][ T5171] x17: 0000000000000000 x16: 0000000000000000
+[ 99.754861][ T5171] x15: 000000000000c276 x14: ffffffff9a976fda
+[ 99.755392][ T5171] x13: 0000000065689089 x12: 000000000000d72e
+[ 99.755923][ T5171] x11: ffffff802d110000 x10: 00000000000000e0
+[ 99.756457][ T5171] x9 : 9c431600c8385d00 x8 : 0000000000000008
+[ 99.756990][ T5171] x7 : 0000000000000000 x6 : 000000000000003f
+[ 99.757522][ T5171] x5 : 0000000000000040 x4 : ffffffc0175abb70
+[ 99.758056][ T5171] x3 : 0000000000000001 x2 : 0000000000000001
+[ 99.758588][ T5171] x1 : 0000000000000000 x0 : 0000000000000000
+[ 99.759123][ T5171] Call trace:
+[ 99.759404][ T5171] snd_pcm_substream_proc_status_read+0x264/0x2bc
+[ 99.759958][ T5171] snd_info_seq_show+0x54/0xa4
+[ 99.760370][ T5171] seq_read_iter+0x19c/0x7d4
+[ 99.760770][ T5171] seq_read+0xf0/0x128
+[ 99.761117][ T5171] proc_reg_read+0x100/0x1f8
+[ 99.761515][ T5171] vfs_read+0xf4/0x354
+[ 99.761869][ T5171] ksys_read+0x7c/0x148
+[ 99.762226][ T5171] __arm64_sys_read+0x20/0x30
+[ 99.762625][ T5171] el0_svc_common+0xd0/0x1e4
+[ 99.763023][ T5171] el0_svc+0x28/0x98
+[ 99.763358][ T5171] el0_sync_handler+0x8c/0xf0
+[ 99.763759][ T5171] el0_sync+0x1b8/0x1c0
+[ 99.764118][ T5171] Code: d65f03c0 b9406102 17ffffae 94191565 (d42aa240)
+[ 99.764715][ T5171] ---[ end trace 1eeffa3e17c58e10 ]---
+[ 99.780720][ T5171] Kernel panic - not syncing: BRK handler: Fatal exception
+
+Signed-off-by: Jason Zhang <jason.zhang@rock-chips.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20231206013139.20506-1-jason.zhang@rock-chips.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/pcm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/core/pcm.c
++++ b/sound/core/pcm.c
+@@ -251,6 +251,7 @@ static const char * const snd_pcm_state_
+ STATE(DRAINING),
+ STATE(PAUSED),
+ STATE(SUSPENDED),
++ STATE(DISCONNECTED),
+ };
+
+ static const char * const snd_pcm_access_names[] = {
--- /dev/null
+From bbb8e71965c3737bdc691afd803a34bfd61cfbeb Mon Sep 17 00:00:00 2001
+From: Sarah Grant <s@srd.tw>
+Date: Fri, 1 Dec 2023 18:16:54 +0000
+Subject: ALSA: usb-audio: Add Pioneer DJM-450 mixer controls
+
+From: Sarah Grant <s@srd.tw>
+
+commit bbb8e71965c3737bdc691afd803a34bfd61cfbeb upstream.
+
+These values mirror those of the Pioneer DJM-250MK2 as the channel layout
+appears identical based on my observations. This duplication could be removed in
+later contributions if desired.
+
+Signed-off-by: Sarah Grant <s@srd.tw>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20231201181654.5058-1-s@srd.tw
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/mixer_quirks.c | 30 ++++++++++++++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -2796,6 +2796,7 @@ static int snd_bbfpro_controls_create(st
+ #define SND_DJM_850_IDX 0x2
+ #define SND_DJM_900NXS2_IDX 0x3
+ #define SND_DJM_750MK2_IDX 0x4
++#define SND_DJM_450_IDX 0x5
+
+
+ #define SND_DJM_CTL(_name, suffix, _default_value, _windex) { \
+@@ -2926,6 +2927,31 @@ static const struct snd_djm_ctl snd_djm_
+ };
+
+
++// DJM-450
++static const u16 snd_djm_opts_450_cap1[] = {
++ 0x0103, 0x0100, 0x0106, 0x0107, 0x0108, 0x0109, 0x010d, 0x010a };
++
++static const u16 snd_djm_opts_450_cap2[] = {
++ 0x0203, 0x0200, 0x0206, 0x0207, 0x0208, 0x0209, 0x020d, 0x020a };
++
++static const u16 snd_djm_opts_450_cap3[] = {
++ 0x030a, 0x0311, 0x0312, 0x0307, 0x0308, 0x0309, 0x030d };
++
++static const u16 snd_djm_opts_450_pb1[] = { 0x0100, 0x0101, 0x0104 };
++static const u16 snd_djm_opts_450_pb2[] = { 0x0200, 0x0201, 0x0204 };
++static const u16 snd_djm_opts_450_pb3[] = { 0x0300, 0x0301, 0x0304 };
++
++static const struct snd_djm_ctl snd_djm_ctls_450[] = {
++ SND_DJM_CTL("Capture Level", cap_level, 0, SND_DJM_WINDEX_CAPLVL),
++ SND_DJM_CTL("Ch1 Input", 450_cap1, 2, SND_DJM_WINDEX_CAP),
++ SND_DJM_CTL("Ch2 Input", 450_cap2, 2, SND_DJM_WINDEX_CAP),
++ SND_DJM_CTL("Ch3 Input", 450_cap3, 0, SND_DJM_WINDEX_CAP),
++ SND_DJM_CTL("Ch1 Output", 450_pb1, 0, SND_DJM_WINDEX_PB),
++ SND_DJM_CTL("Ch2 Output", 450_pb2, 1, SND_DJM_WINDEX_PB),
++ SND_DJM_CTL("Ch3 Output", 450_pb3, 2, SND_DJM_WINDEX_PB)
++};
++
++
+ // DJM-750
+ static const u16 snd_djm_opts_750_cap1[] = {
+ 0x0101, 0x0103, 0x0106, 0x0107, 0x0108, 0x0109, 0x010a, 0x010f };
+@@ -3021,6 +3047,7 @@ static const struct snd_djm_device snd_d
+ [SND_DJM_850_IDX] = SND_DJM_DEVICE(850),
+ [SND_DJM_900NXS2_IDX] = SND_DJM_DEVICE(900nxs2),
+ [SND_DJM_750MK2_IDX] = SND_DJM_DEVICE(750mk2),
++ [SND_DJM_450_IDX] = SND_DJM_DEVICE(450),
+ };
+
+
+@@ -3263,6 +3290,9 @@ int snd_usb_mixer_apply_create_quirk(str
+ case USB_ID(0x2b73, 0x0017): /* Pioneer DJ DJM-250MK2 */
+ err = snd_djm_controls_create(mixer, SND_DJM_250MK2_IDX);
+ break;
++ case USB_ID(0x2b73, 0x0013): /* Pioneer DJ DJM-450 */
++ err = snd_djm_controls_create(mixer, SND_DJM_450_IDX);
++ break;
+ case USB_ID(0x08e4, 0x017f): /* Pioneer DJ DJM-750 */
+ err = snd_djm_controls_create(mixer, SND_DJM_750_IDX);
+ break;
--- /dev/null
+From f7b32e785042d2357c5abc23ca6db1b92c91a070 Mon Sep 17 00:00:00 2001
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Sun, 3 Dec 2023 15:37:53 +0000
+Subject: io_uring: fix mutex_unlock with unreferenced ctx
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+commit f7b32e785042d2357c5abc23ca6db1b92c91a070 upstream.
+
+Callers of mutex_unlock() have to make sure that the mutex stays alive
+for the whole duration of the function call. For io_uring that means
+that the following pattern is not valid unless we ensure that the
+context outlives the mutex_unlock() call.
+
+mutex_lock(&ctx->uring_lock);
+req_put(req); // typically via io_req_task_submit()
+mutex_unlock(&ctx->uring_lock);
+
+Most contexts are fine: io-wq pins requests, syscalls hold the file,
+task works are taking ctx references and so on. However, the task work
+fallback path doesn't follow the rule.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 04fc6c802d ("io_uring: save ctx put/get for task_work submit")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Link: https://lore.kernel.org/io-uring/CAG48ez3xSoYb+45f1RLtktROJrpiDQ1otNvdR+YLQf7m+Krj5Q@mail.gmail.com/
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/io_uring.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/io_uring/io_uring.c
++++ b/io_uring/io_uring.c
+@@ -2601,6 +2601,7 @@ static void io_iopoll_try_reap_events(st
+ if (!(ctx->flags & IORING_SETUP_IOPOLL))
+ return;
+
++ percpu_ref_get(&ctx->refs);
+ mutex_lock(&ctx->uring_lock);
+ while (!list_empty(&ctx->iopoll_list)) {
+ unsigned int nr_events = 0;
+@@ -2622,6 +2623,7 @@ static void io_iopoll_try_reap_events(st
+ }
+ }
+ mutex_unlock(&ctx->uring_lock);
++ percpu_ref_put(&ctx->refs);
+ }
+
+ static int io_iopoll_check(struct io_ring_ctx *ctx, long min)
+@@ -9771,12 +9773,7 @@ static void io_ring_exit_work(struct wor
+ init_completion(&exit.completion);
+ init_task_work(&exit.task_work, io_tctx_exit_cb);
+ exit.ctx = ctx;
+- /*
+- * Some may use context even when all refs and requests have been put,
+- * and they are free to do so while still holding uring_lock or
+- * completion_lock, see io_req_task_submit(). Apart from other work,
+- * this lock/unlock section also waits them to finish.
+- */
++
+ mutex_lock(&ctx->uring_lock);
+ while (!list_empty(&ctx->tctx_list)) {
+ WARN_ON_ONCE(time_after(jiffies, timeout));
--- /dev/null
+From d839a656d0f3caca9f96e9bf912fd394ac6a11bc Mon Sep 17 00:00:00 2001
+From: JP Kobryn <inwardvessel@gmail.com>
+Date: Fri, 1 Dec 2023 14:53:55 +0900
+Subject: kprobes: consistent rcu api usage for kretprobe holder
+
+From: JP Kobryn <inwardvessel@gmail.com>
+
+commit d839a656d0f3caca9f96e9bf912fd394ac6a11bc upstream.
+
+It seems that the pointer-to-kretprobe "rp" within the kretprobe_holder is
+RCU-managed, based on the (non-rethook) implementation of get_kretprobe().
+The thought behind this patch is to make use of the RCU API where possible
+when accessing this pointer so that the needed barriers are always in place
+and to self-document the code.
+
+The __rcu annotation to "rp" allows for sparse RCU checking. Plain writes
+done to the "rp" pointer are changed to make use of the RCU macro for
+assignment. For the single read, the implementation of get_kretprobe()
+is simplified by making use of an RCU macro which accomplishes the same,
+but note that the log warning text will be more generic.
+
+I did find that there is a difference in assembly generated between the
+usage of the RCU macros vs without. For example, on arm64, when using
+rcu_assign_pointer(), the corresponding store instruction is a
+store-release (STLR) which has an implicit barrier. When normal assignment
+is done, a regular store (STR) is found. In the macro case, this seems to
+be a result of rcu_assign_pointer() using smp_store_release() when the
+value to write is not NULL.
+
+Link: https://lore.kernel.org/all/20231122132058.3359-1-inwardvessel@gmail.com/
+
+Fixes: d741bf41d7c7 ("kprobes: Remove kretprobe hash")
+Cc: stable@vger.kernel.org
+Signed-off-by: JP Kobryn <inwardvessel@gmail.com>
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/kprobes.h | 7 ++-----
+ kernel/kprobes.c | 4 ++--
+ 2 files changed, 4 insertions(+), 7 deletions(-)
+
+--- a/include/linux/kprobes.h
++++ b/include/linux/kprobes.h
+@@ -139,7 +139,7 @@ static inline int kprobe_ftrace(struct k
+ *
+ */
+ struct kretprobe_holder {
+- struct kretprobe *rp;
++ struct kretprobe __rcu *rp;
+ refcount_t ref;
+ };
+
+@@ -224,10 +224,7 @@ unsigned long kretprobe_trampoline_handl
+
+ static nokprobe_inline struct kretprobe *get_kretprobe(struct kretprobe_instance *ri)
+ {
+- RCU_LOCKDEP_WARN(!rcu_read_lock_any_held(),
+- "Kretprobe is accessed from instance under preemptive context");
+-
+- return READ_ONCE(ri->rph->rp);
++ return rcu_dereference_check(ri->rph->rp, rcu_read_lock_any_held());
+ }
+
+ #else /* CONFIG_KRETPROBES */
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -2044,7 +2044,7 @@ int register_kretprobe(struct kretprobe
+ if (!rp->rph)
+ return -ENOMEM;
+
+- rp->rph->rp = rp;
++ rcu_assign_pointer(rp->rph->rp, rp);
+ for (i = 0; i < rp->maxactive; i++) {
+ inst = kzalloc(sizeof(struct kretprobe_instance) +
+ rp->data_size, GFP_KERNEL);
+@@ -2101,7 +2101,7 @@ void unregister_kretprobes(struct kretpr
+ for (i = 0; i < num; i++) {
+ if (__unregister_kprobe_top(&rps[i]->kp) < 0)
+ rps[i]->kp.addr = NULL;
+- rps[i]->rph->rp = NULL;
++ rcu_assign_pointer(rps[i]->rph->rp, NULL);
+ }
+ mutex_unlock(&kprobe_mutex);
+
--- /dev/null
+From 107b4e063d78c300b21e2d5291b1aa94c514ea5b Mon Sep 17 00:00:00 2001
+From: Georg Gottleuber <ggo@tuxedocomputers.com>
+Date: Wed, 20 Sep 2023 10:52:10 +0200
+Subject: nvme-pci: Add sleep quirk for Kingston drives
+
+From: Georg Gottleuber <ggo@tuxedocomputers.com>
+
+commit 107b4e063d78c300b21e2d5291b1aa94c514ea5b upstream.
+
+Some Kingston NV1 and A2000 are wasting a lot of power on specific TUXEDO
+platforms in s2idle sleep if 'Simple Suspend' is used.
+
+This patch applies a new quirk 'Force No Simple Suspend' to achieve a
+low power sleep without 'Simple Suspend'.
+
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Signed-off-by: Georg Gottleuber <ggo@tuxedocomputers.com>
+Cc: <stable@vger.kernel.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/nvme.h | 5 +++++
+ drivers/nvme/host/pci.c | 16 +++++++++++++++-
+ 2 files changed, 20 insertions(+), 1 deletion(-)
+
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -154,6 +154,11 @@ enum nvme_quirks {
+ * No temperature thresholds for channels other than 0 (Composite).
+ */
+ NVME_QUIRK_NO_SECONDARY_TEMP_THRESH = (1 << 19),
++
++ /*
++ * Disables simple suspend/resume path.
++ */
++ NVME_QUIRK_FORCE_NO_SIMPLE_SUSPEND = (1 << 20),
+ };
+
+ /*
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -2953,6 +2953,18 @@ static unsigned long check_vendor_combin
+ if ((dmi_match(DMI_BOARD_VENDOR, "LENOVO")) &&
+ dmi_match(DMI_BOARD_NAME, "LNVNB161216"))
+ return NVME_QUIRK_SIMPLE_SUSPEND;
++ } else if (pdev->vendor == 0x2646 && (pdev->device == 0x2263 ||
++ pdev->device == 0x500f)) {
++ /*
++ * Exclude some Kingston NV1 and A2000 devices from
++ * NVME_QUIRK_SIMPLE_SUSPEND. Do a full suspend to save a
++ * lot fo energy with s2idle sleep on some TUXEDO platforms.
++ */
++ if (dmi_match(DMI_BOARD_NAME, "NS5X_NS7XAU") ||
++ dmi_match(DMI_BOARD_NAME, "NS5x_7xAU") ||
++ dmi_match(DMI_BOARD_NAME, "NS5x_7xPU") ||
++ dmi_match(DMI_BOARD_NAME, "PH4PRX1_PH6PRX1"))
++ return NVME_QUIRK_FORCE_NO_SIMPLE_SUSPEND;
+ }
+
+ return 0;
+@@ -2993,7 +3005,9 @@ static struct nvme_dev *nvme_pci_alloc_d
+ dev->dev = get_device(&pdev->dev);
+
+ quirks |= check_vendor_combination_bug(pdev);
+- if (!noacpi && acpi_storage_d3(&pdev->dev)) {
++ if (!noacpi &&
++ !(quirks & NVME_QUIRK_FORCE_NO_SIMPLE_SUSPEND) &&
++ acpi_storage_d3(&pdev->dev)) {
+ /*
+ * Some systems use a bios work around to ask for D3 on
+ * platforms that support kernel managed suspend.
riscv-fix-misaligned-access-handling-of-c.swsp-and-c.patch
md-introduce-md_ro_state.patch
md-don-t-leave-md_recovery_frozen-in-error-path-of-m.patch
+kprobes-consistent-rcu-api-usage-for-kretprobe-holder.patch
+nvme-pci-add-sleep-quirk-for-kingston-drives.patch
+io_uring-fix-mutex_unlock-with-unreferenced-ctx.patch
+alsa-usb-audio-add-pioneer-djm-450-mixer-controls.patch
+alsa-pcm-fix-out-of-bounds-in-snd_pcm_state_names.patch
+alsa-hda-realtek-enable-headset-on-lenovo-m90-gen5.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
