--- /dev/null
+From 3c492269e6e6ed79dc8cc70fc19be2d17680e01b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Jan 2025 02:39:02 -0700
+Subject: ACPI: resource: IRQ override for Eluktronics MECH-17
+
+From: Gannon Kolding <gannon.kolding@gmail.com>
+
+[ Upstream commit 607ab6f85f4194b644ea95ac5fe660ef575db3b4 ]
+
+The Eluktronics MECH-17 (GM7RG7N) needs IRQ overriding for the
+keyboard to work.
+
+Adding a DMI_MATCH entry for this laptop model makes the internal
+keyboard function normally.
+
+Signed-off-by: Gannon Kolding <gannon.kolding@gmail.com>
+Link: https://patch.msgid.link/20250127093902.328361-1-gannon.kolding@gmail.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/resource.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index 34cb7894e54ee..d4fb1436f9f57 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -553,6 +553,12 @@ static const struct dmi_system_id maingear_laptop[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "RP-15"),
+ },
+ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Eluktronics Inc."),
++ DMI_MATCH(DMI_BOARD_NAME, "MECH-17"),
++ },
++ },
+ {
+ /* TongFang GM6XGxX/TUXEDO Stellaris 16 Gen5 AMD */
+ .matches = {
+--
+2.39.5
+
--- /dev/null
+From bd664d74f73b346916b355bf70c6b8ccb10fe79f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Jan 2025 23:39:01 -0600
+Subject: alpha/elf: Fix misc/setarch test of util-linux by removing 32bit
+ support
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit b029628be267cba3c7684ec684749fe3e4372398 ]
+
+Richard Henderson <richard.henderson@linaro.org> writes[1]:
+
+> There was a Spec benchmark (I forget which) which was memory bound and ran
+> twice as fast with 32-bit pointers.
+>
+> I copied the idea from DEC to the ELF abi, but never did all the other work
+> to allow the toolchain to take advantage.
+>
+> Amusingly, a later Spec changed the benchmark data sets to not fit into a
+> 32-bit address space, specifically because of this.
+>
+> I expect one could delete the ELF bit and personality and no one would
+> notice. Not even the 10 remaining Alpha users.
+
+In [2] it was pointed out that parts of setarch weren't working
+properly on alpha because it has it's own SET_PERSONALITY
+implementation. In the discussion that followed Richard Henderson
+pointed out that the 32bit pointer support for alpha was never
+completed.
+
+Fix this by removing alpha's 32bit pointer support.
+
+As a bit of paranoia refuse to execute any alpha binaries that have
+the EF_ALPHA_32BIT flag set. Just in case someone somewhere has
+binaries that try to use alpha's 32bit pointer support.
+
+Link: https://lkml.kernel.org/r/CAFXwXrkgu=4Qn-v1PjnOR4SG0oUb9LSa0g6QXpBq4ttm52pJOQ@mail.gmail.com [1]
+Link: https://lkml.kernel.org/r/20250103140148.370368-1-glaubitz@physik.fu-berlin.de [2]
+Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Link: https://lore.kernel.org/r/87y0zfs26i.fsf_-_@email.froward.int.ebiederm.org
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/alpha/include/asm/elf.h | 6 +-----
+ arch/alpha/include/asm/pgtable.h | 2 +-
+ arch/alpha/include/asm/processor.h | 8 ++------
+ arch/alpha/kernel/osf_sys.c | 11 ++---------
+ 4 files changed, 6 insertions(+), 21 deletions(-)
+
+diff --git a/arch/alpha/include/asm/elf.h b/arch/alpha/include/asm/elf.h
+index 8049997fa372a..2039a8c8d5473 100644
+--- a/arch/alpha/include/asm/elf.h
++++ b/arch/alpha/include/asm/elf.h
+@@ -74,7 +74,7 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
+ /*
+ * This is used to ensure we don't load something for the wrong architecture.
+ */
+-#define elf_check_arch(x) ((x)->e_machine == EM_ALPHA)
++#define elf_check_arch(x) (((x)->e_machine == EM_ALPHA) && !((x)->e_flags & EF_ALPHA_32BIT))
+
+ /*
+ * These are used to set parameters in the core dumps.
+@@ -145,10 +145,6 @@ extern int dump_elf_task_fp(elf_fpreg_t *dest, struct task_struct *task);
+ : amask (AMASK_CIX) ? "ev6" : "ev67"); \
+ })
+
+-#define SET_PERSONALITY(EX) \
+- set_personality(((EX).e_flags & EF_ALPHA_32BIT) \
+- ? PER_LINUX_32BIT : PER_LINUX)
+-
+ extern int alpha_l1i_cacheshape;
+ extern int alpha_l1d_cacheshape;
+ extern int alpha_l2_cacheshape;
+diff --git a/arch/alpha/include/asm/pgtable.h b/arch/alpha/include/asm/pgtable.h
+index 9e45f6735d5d2..6fe4e9deeb5ef 100644
+--- a/arch/alpha/include/asm/pgtable.h
++++ b/arch/alpha/include/asm/pgtable.h
+@@ -322,7 +322,7 @@ extern inline pte_t mk_swap_pte(unsigned long type, unsigned long offset)
+
+ extern void paging_init(void);
+
+-/* We have our own get_unmapped_area to cope with ADDR_LIMIT_32BIT. */
++/* We have our own get_unmapped_area */
+ #define HAVE_ARCH_UNMAPPED_AREA
+
+ #endif /* _ALPHA_PGTABLE_H */
+diff --git a/arch/alpha/include/asm/processor.h b/arch/alpha/include/asm/processor.h
+index 714abe494e5fd..916a2dd782c1a 100644
+--- a/arch/alpha/include/asm/processor.h
++++ b/arch/alpha/include/asm/processor.h
+@@ -8,23 +8,19 @@
+ #ifndef __ASM_ALPHA_PROCESSOR_H
+ #define __ASM_ALPHA_PROCESSOR_H
+
+-#include <linux/personality.h> /* for ADDR_LIMIT_32BIT */
+-
+ /*
+ * We have a 42-bit user address space: 4TB user VM...
+ */
+ #define TASK_SIZE (0x40000000000UL)
+
+-#define STACK_TOP \
+- (current->personality & ADDR_LIMIT_32BIT ? 0x80000000 : 0x00120000000UL)
++#define STACK_TOP (0x00120000000UL)
+
+ #define STACK_TOP_MAX 0x00120000000UL
+
+ /* This decides where the kernel will search for a free chunk of vm
+ * space during mmap's.
+ */
+-#define TASK_UNMAPPED_BASE \
+- ((current->personality & ADDR_LIMIT_32BIT) ? 0x40000000 : TASK_SIZE / 2)
++#define TASK_UNMAPPED_BASE (TASK_SIZE / 2)
+
+ /* This is dead. Everything has been moved to thread_info. */
+ struct thread_struct { };
+diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
+index c54469b369cb6..03b70b6c92502 100644
+--- a/arch/alpha/kernel/osf_sys.c
++++ b/arch/alpha/kernel/osf_sys.c
+@@ -1213,8 +1213,7 @@ SYSCALL_DEFINE1(old_adjtimex, struct timex32 __user *, txc_p)
+ return ret;
+ }
+
+-/* Get an address range which is currently unmapped. Similar to the
+- generic version except that we know how to honor ADDR_LIMIT_32BIT. */
++/* Get an address range which is currently unmapped. */
+
+ static unsigned long
+ arch_get_unmapped_area_1(unsigned long addr, unsigned long len,
+@@ -1236,13 +1235,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+ unsigned long len, unsigned long pgoff,
+ unsigned long flags)
+ {
+- unsigned long limit;
+-
+- /* "32 bit" actually means 31 bit, since pointers sign extend. */
+- if (current->personality & ADDR_LIMIT_32BIT)
+- limit = 0x80000000;
+- else
+- limit = TASK_SIZE;
++ unsigned long limit = TASK_SIZE;
+
+ if (len > limit)
+ return -ENOMEM;
+--
+2.39.5
+
--- /dev/null
+From 4e7434affee66fd0a9b009a8bdaccbd01200df37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Feb 2025 11:39:30 -0300
+Subject: ALSA: hda/realtek: Limit mic boost on Positivo ARN50
+
+From: Edson Juliano Drosdeck <edson.drosdeck@gmail.com>
+
+[ Upstream commit 76b0a22d4cf7dc9091129560fdc04e73eb9db4cb ]
+
+The internal mic boost on the Positivo ARN50 is too high.
+Fix this by applying the ALC269_FIXUP_LIMIT_INT_MIC_BOOST fixup to the machine
+to limit the gain.
+
+Signed-off-by: Edson Juliano Drosdeck <edson.drosdeck@gmail.com>
+Link: https://patch.msgid.link/20250201143930.25089-1-edson.drosdeck@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index e5e222e74d783..102af43f74423 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10333,6 +10333,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1d72, 0x1945, "Redmi G", ALC256_FIXUP_ASUS_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1d72, 0x1947, "RedmiBook Air", ALC255_FIXUP_XIAOMI_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1f66, 0x0105, "Ayaneo Portable Game Player", ALC287_FIXUP_CS35L41_I2C_2),
++ SND_PCI_QUIRK(0x2014, 0x800a, "Positivo ARN50", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x2782, 0x0214, "VAIO VJFE-CL", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x2782, 0x0228, "Infinix ZERO BOOK 13", ALC269VB_FIXUP_INFINIX_ZERO_BOOK_13),
+ SND_PCI_QUIRK(0x2782, 0x0232, "CHUWI CoreBook XPro", ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO),
+--
+2.39.5
+
--- /dev/null
+From 3ffc480706f1ce93c074a5e4540569563a959b3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Feb 2025 16:08:46 +0000
+Subject: ASoC: arizona/madera: use fsleep() in up/down DAPM event delays.
+
+From: Vitaly Rodionov <vitalyr@opensource.cirrus.com>
+
+[ Upstream commit 679074942c2502a95842a80471d8fb718165ac77 ]
+
+Using `fsleep` instead of `msleep` resolves some customer complaints
+regarding the precision of up/down DAPM event timing. `fsleep()`
+automatically selects the appropriate sleep function, making the delay
+time more predictable.
+
+Signed-off-by: Vitaly Rodionov <vitalyr@opensource.cirrus.com>
+Link: https://patch.msgid.link/20250205160849.500306-1-vitalyr@opensource.cirrus.com
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/arizona.c | 14 +++++++-------
+ sound/soc/codecs/madera.c | 10 +++++-----
+ sound/soc/codecs/wm5110.c | 8 ++++----
+ 3 files changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/sound/soc/codecs/arizona.c b/sound/soc/codecs/arizona.c
+index 7434aeeda292e..7a74941c608f8 100644
+--- a/sound/soc/codecs/arizona.c
++++ b/sound/soc/codecs/arizona.c
+@@ -967,7 +967,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,
+ case ARIZONA_OUT3L_ENA_SHIFT:
+ case ARIZONA_OUT3R_ENA_SHIFT:
+ priv->out_up_pending++;
+- priv->out_up_delay += 17;
++ priv->out_up_delay += 17000;
+ break;
+ case ARIZONA_OUT4L_ENA_SHIFT:
+ case ARIZONA_OUT4R_ENA_SHIFT:
+@@ -977,7 +977,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,
+ case WM8997:
+ break;
+ default:
+- priv->out_up_delay += 10;
++ priv->out_up_delay += 10000;
+ break;
+ }
+ break;
+@@ -999,7 +999,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,
+ if (!priv->out_up_pending && priv->out_up_delay) {
+ dev_dbg(component->dev, "Power up delay: %d\n",
+ priv->out_up_delay);
+- msleep(priv->out_up_delay);
++ fsleep(priv->out_up_delay);
+ priv->out_up_delay = 0;
+ }
+ break;
+@@ -1017,7 +1017,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,
+ case ARIZONA_OUT3L_ENA_SHIFT:
+ case ARIZONA_OUT3R_ENA_SHIFT:
+ priv->out_down_pending++;
+- priv->out_down_delay++;
++ priv->out_down_delay += 1000;
+ break;
+ case ARIZONA_OUT4L_ENA_SHIFT:
+ case ARIZONA_OUT4R_ENA_SHIFT:
+@@ -1028,10 +1028,10 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,
+ break;
+ case WM8998:
+ case WM1814:
+- priv->out_down_delay += 5;
++ priv->out_down_delay += 5000;
+ break;
+ default:
+- priv->out_down_delay++;
++ priv->out_down_delay += 1000;
+ break;
+ }
+ break;
+@@ -1053,7 +1053,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,
+ if (!priv->out_down_pending && priv->out_down_delay) {
+ dev_dbg(component->dev, "Power down delay: %d\n",
+ priv->out_down_delay);
+- msleep(priv->out_down_delay);
++ fsleep(priv->out_down_delay);
+ priv->out_down_delay = 0;
+ }
+ break;
+diff --git a/sound/soc/codecs/madera.c b/sound/soc/codecs/madera.c
+index b9f19fbd29114..30e680ee10699 100644
+--- a/sound/soc/codecs/madera.c
++++ b/sound/soc/codecs/madera.c
+@@ -2322,10 +2322,10 @@ int madera_out_ev(struct snd_soc_dapm_widget *w,
+ case CS42L92:
+ case CS47L92:
+ case CS47L93:
+- out_up_delay = 6;
++ out_up_delay = 6000;
+ break;
+ default:
+- out_up_delay = 17;
++ out_up_delay = 17000;
+ break;
+ }
+
+@@ -2356,7 +2356,7 @@ int madera_out_ev(struct snd_soc_dapm_widget *w,
+ case MADERA_OUT3R_ENA_SHIFT:
+ priv->out_up_pending--;
+ if (!priv->out_up_pending) {
+- msleep(priv->out_up_delay);
++ fsleep(priv->out_up_delay);
+ priv->out_up_delay = 0;
+ }
+ break;
+@@ -2375,7 +2375,7 @@ int madera_out_ev(struct snd_soc_dapm_widget *w,
+ case MADERA_OUT3L_ENA_SHIFT:
+ case MADERA_OUT3R_ENA_SHIFT:
+ priv->out_down_pending++;
+- priv->out_down_delay++;
++ priv->out_down_delay += 1000;
+ break;
+ default:
+ break;
+@@ -2392,7 +2392,7 @@ int madera_out_ev(struct snd_soc_dapm_widget *w,
+ case MADERA_OUT3R_ENA_SHIFT:
+ priv->out_down_pending--;
+ if (!priv->out_down_pending) {
+- msleep(priv->out_down_delay);
++ fsleep(priv->out_down_delay);
+ priv->out_down_delay = 0;
+ }
+ break;
+diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c
+index e0b971620d0fb..6db17349484ca 100644
+--- a/sound/soc/codecs/wm5110.c
++++ b/sound/soc/codecs/wm5110.c
+@@ -302,7 +302,7 @@ static int wm5110_hp_pre_enable(struct snd_soc_dapm_widget *w)
+ } else {
+ wseq = wm5110_no_dre_left_enable;
+ nregs = ARRAY_SIZE(wm5110_no_dre_left_enable);
+- priv->out_up_delay += 10;
++ priv->out_up_delay += 10000;
+ }
+ break;
+ case ARIZONA_OUT1R_ENA_SHIFT:
+@@ -312,7 +312,7 @@ static int wm5110_hp_pre_enable(struct snd_soc_dapm_widget *w)
+ } else {
+ wseq = wm5110_no_dre_right_enable;
+ nregs = ARRAY_SIZE(wm5110_no_dre_right_enable);
+- priv->out_up_delay += 10;
++ priv->out_up_delay += 10000;
+ }
+ break;
+ default:
+@@ -338,7 +338,7 @@ static int wm5110_hp_pre_disable(struct snd_soc_dapm_widget *w)
+ snd_soc_component_update_bits(component,
+ ARIZONA_SPARE_TRIGGERS,
+ ARIZONA_WS_TRG1, 0);
+- priv->out_down_delay += 27;
++ priv->out_down_delay += 27000;
+ }
+ break;
+ case ARIZONA_OUT1R_ENA_SHIFT:
+@@ -350,7 +350,7 @@ static int wm5110_hp_pre_disable(struct snd_soc_dapm_widget *w)
+ snd_soc_component_update_bits(component,
+ ARIZONA_SPARE_TRIGGERS,
+ ARIZONA_WS_TRG2, 0);
+- priv->out_down_delay += 27;
++ priv->out_down_delay += 27000;
+ }
+ break;
+ default:
+--
+2.39.5
+
--- /dev/null
+From 883185e2519d295e9d0ae9d250e11b9eb8a55e17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Feb 2025 00:20:48 +0000
+Subject: ASoC: rsnd: adjust convert rate limitation
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 89f9cf185885d4358aa92b48e51d0f09b71775aa ]
+
+Current rsnd driver supports Synchronous SRC Mode, but HW allow to update
+rate only within 1% from current rate. Adjust to it.
+
+Becially, this feature is used to fine-tune subtle difference that occur
+during sampling rate conversion in SRC. So, it should be called within 1%
+margin of rate difference.
+
+If there was difference over 1%, it will apply with 1% increments by using
+loop without indicating error message.
+
+Cc: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://patch.msgid.link/871pwd2qe8.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sh/rcar/src.c | 98 ++++++++++++++++++++++++++++++++---------
+ 1 file changed, 76 insertions(+), 22 deletions(-)
+
+diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c
+index 9893839666d7b..e985681363e25 100644
+--- a/sound/soc/sh/rcar/src.c
++++ b/sound/soc/sh/rcar/src.c
+@@ -34,6 +34,7 @@ struct rsnd_src {
+ struct rsnd_mod *dma;
+ struct rsnd_kctrl_cfg_s sen; /* sync convert enable */
+ struct rsnd_kctrl_cfg_s sync; /* sync convert */
++ u32 current_sync_rate;
+ int irq;
+ };
+
+@@ -99,7 +100,7 @@ static u32 rsnd_src_convert_rate(struct rsnd_dai_stream *io,
+ if (!rsnd_src_sync_is_enabled(mod))
+ return rsnd_io_converted_rate(io);
+
+- convert_rate = src->sync.val;
++ convert_rate = src->current_sync_rate;
+
+ if (!convert_rate)
+ convert_rate = rsnd_io_converted_rate(io);
+@@ -200,13 +201,73 @@ static const u32 chan222222[] = {
+ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io,
+ struct rsnd_mod *mod)
+ {
++ struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
+ struct rsnd_priv *priv = rsnd_mod_to_priv(mod);
+- struct device *dev = rsnd_priv_to_dev(priv);
++ struct rsnd_src *src = rsnd_mod_to_src(mod);
++ u32 fin, fout, new_rate;
++ int inc, cnt, rate;
++ u64 base, val;
++
++ if (!runtime)
++ return;
++
++ if (!rsnd_src_sync_is_enabled(mod))
++ return;
++
++ fin = rsnd_src_get_in_rate(priv, io);
++ fout = rsnd_src_get_out_rate(priv, io);
++
++ new_rate = src->sync.val;
++
++ if (!new_rate)
++ new_rate = fout;
++
++ /* Do nothing if no diff */
++ if (new_rate == src->current_sync_rate)
++ return;
++
++ /*
++ * SRCm_IFSVR::INTIFS can change within 1%
++ * see
++ * SRCm_IFSVR::INTIFS Note
++ */
++ inc = fout / 100;
++ cnt = abs(new_rate - fout) / inc;
++ if (fout > new_rate)
++ inc *= -1;
++
++ /*
++ * After start running SRC, we can update only SRC_IFSVR
++ * for Synchronous Mode
++ */
++ base = (u64)0x0400000 * fin;
++ rate = fout;
++ for (int i = 0; i < cnt; i++) {
++ val = base;
++ rate += inc;
++ do_div(val, rate);
++
++ rsnd_mod_write(mod, SRC_IFSVR, val);
++ }
++ val = base;
++ do_div(val, new_rate);
++
++ rsnd_mod_write(mod, SRC_IFSVR, val);
++
++ /* update current_sync_rate */
++ src->current_sync_rate = new_rate;
++}
++
++static void rsnd_src_init_convert_rate(struct rsnd_dai_stream *io,
++ struct rsnd_mod *mod)
++{
+ struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
++ struct rsnd_priv *priv = rsnd_mod_to_priv(mod);
++ struct device *dev = rsnd_priv_to_dev(priv);
+ int is_play = rsnd_io_is_play(io);
+ int use_src = 0;
+ u32 fin, fout;
+- u32 ifscr, fsrate, adinr;
++ u32 ifscr, adinr;
+ u32 cr, route;
+ u32 i_busif, o_busif, tmp;
+ const u32 *bsdsr_table;
+@@ -244,26 +305,15 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io,
+ adinr = rsnd_get_adinr_bit(mod, io) | chan;
+
+ /*
+- * SRC_IFSCR / SRC_IFSVR
+- */
+- ifscr = 0;
+- fsrate = 0;
+- if (use_src) {
+- u64 n;
+-
+- ifscr = 1;
+- n = (u64)0x0400000 * fin;
+- do_div(n, fout);
+- fsrate = n;
+- }
+-
+- /*
++ * SRC_IFSCR
+ * SRC_SRCCR / SRC_ROUTE_MODE0
+ */
++ ifscr = 0;
+ cr = 0x00011110;
+ route = 0x0;
+ if (use_src) {
+ route = 0x1;
++ ifscr = 0x1;
+
+ if (rsnd_src_sync_is_enabled(mod)) {
+ cr |= 0x1;
+@@ -334,7 +384,6 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io,
+ rsnd_mod_write(mod, SRC_SRCIR, 1); /* initialize */
+ rsnd_mod_write(mod, SRC_ADINR, adinr);
+ rsnd_mod_write(mod, SRC_IFSCR, ifscr);
+- rsnd_mod_write(mod, SRC_IFSVR, fsrate);
+ rsnd_mod_write(mod, SRC_SRCCR, cr);
+ rsnd_mod_write(mod, SRC_BSDSR, bsdsr_table[idx]);
+ rsnd_mod_write(mod, SRC_BSISR, bsisr_table[idx]);
+@@ -347,6 +396,9 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io,
+
+ rsnd_adg_set_src_timesel_gen2(mod, io, fin, fout);
+
++ /* update SRC_IFSVR */
++ rsnd_src_set_convert_rate(io, mod);
++
+ return;
+
+ convert_rate_err:
+@@ -466,7 +518,8 @@ static int rsnd_src_init(struct rsnd_mod *mod,
+ int ret;
+
+ /* reset sync convert_rate */
+- src->sync.val = 0;
++ src->sync.val =
++ src->current_sync_rate = 0;
+
+ ret = rsnd_mod_power_on(mod);
+ if (ret < 0)
+@@ -474,7 +527,7 @@ static int rsnd_src_init(struct rsnd_mod *mod,
+
+ rsnd_src_activation(mod);
+
+- rsnd_src_set_convert_rate(io, mod);
++ rsnd_src_init_convert_rate(io, mod);
+
+ rsnd_src_status_clear(mod);
+
+@@ -492,7 +545,8 @@ static int rsnd_src_quit(struct rsnd_mod *mod,
+ rsnd_mod_power_off(mod);
+
+ /* reset sync convert_rate */
+- src->sync.val = 0;
++ src->sync.val =
++ src->current_sync_rate = 0;
+
+ return 0;
+ }
+@@ -600,7 +654,7 @@ static int rsnd_src_pcm_new(struct rsnd_mod *mod,
+ "SRC Out Rate Switch" :
+ "SRC In Rate Switch",
+ rsnd_kctrl_accept_anytime,
+- rsnd_src_set_convert_rate,
++ rsnd_src_init_convert_rate,
+ &src->sen, 1);
+ if (ret < 0)
+ return ret;
+--
+2.39.5
+
--- /dev/null
+From 243c20fb651eba226aa3ac778f2bee867d7116e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Feb 2025 00:20:42 +0000
+Subject: ASoC: rsnd: don't indicate warning on rsnd_kctrl_accept_runtime()
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit c3fc002b206c6c83d1e3702b979733002ba6fb2c ]
+
+rsnd_kctrl_accept_runtime() (1) is used for runtime convert rate
+(= Synchronous SRC Mode). Now, rsnd driver has 2 kctrls for it
+
+(A): "SRC Out Rate Switch"
+(B): "SRC Out Rate" // it calls (1)
+
+(A): can be called anytime
+(B): can be called only runtime, and will indicate warning if it was used
+ at non-runtime.
+
+To use runtime convert rate (= Synchronous SRC Mode), user might uses
+command in below order.
+
+(X): > amixer set "SRC Out Rate" on
+ > aplay xxx.wav &
+(Y): > amixer set "SRC Out Rate" 48010 // convert rate to 48010Hz
+
+(Y): calls B
+(X): calls both A and B.
+
+In this case, when user calls (X), it calls both (A) and (B), but it is not
+yet start running. So, (B) will indicate warning.
+
+This warning was added by commit b5c088689847 ("ASoC: rsnd: add warning
+message to rsnd_kctrl_accept_runtime()"), but the message sounds like the
+operation was not correct. Let's update warning message.
+
+The message is very SRC specific, implement it in src.c
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://patch.msgid.link/8734gt2qed.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sh/rcar/core.c | 14 --------------
+ sound/soc/sh/rcar/rsnd.h | 1 -
+ sound/soc/sh/rcar/src.c | 18 +++++++++++++++++-
+ 3 files changed, 17 insertions(+), 16 deletions(-)
+
+diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
+index 7e380d71b0f88..0964b4e3fbdfb 100644
+--- a/sound/soc/sh/rcar/core.c
++++ b/sound/soc/sh/rcar/core.c
+@@ -1694,20 +1694,6 @@ int rsnd_kctrl_accept_anytime(struct rsnd_dai_stream *io)
+ return 1;
+ }
+
+-int rsnd_kctrl_accept_runtime(struct rsnd_dai_stream *io)
+-{
+- struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
+- struct rsnd_priv *priv = rsnd_io_to_priv(io);
+- struct device *dev = rsnd_priv_to_dev(priv);
+-
+- if (!runtime) {
+- dev_warn(dev, "Can't update kctrl when idle\n");
+- return 0;
+- }
+-
+- return 1;
+-}
+-
+ struct rsnd_kctrl_cfg *rsnd_kctrl_init_m(struct rsnd_kctrl_cfg_m *cfg)
+ {
+ cfg->cfg.val = cfg->val;
+diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h
+index f8ef6836ef84e..690f4932357c1 100644
+--- a/sound/soc/sh/rcar/rsnd.h
++++ b/sound/soc/sh/rcar/rsnd.h
+@@ -742,7 +742,6 @@ struct rsnd_kctrl_cfg_s {
+ #define rsnd_kctrl_vals(x) ((x).val) /* = (x).cfg.val[0] */
+
+ int rsnd_kctrl_accept_anytime(struct rsnd_dai_stream *io);
+-int rsnd_kctrl_accept_runtime(struct rsnd_dai_stream *io);
+ struct rsnd_kctrl_cfg *rsnd_kctrl_init_m(struct rsnd_kctrl_cfg_m *cfg);
+ struct rsnd_kctrl_cfg *rsnd_kctrl_init_s(struct rsnd_kctrl_cfg_s *cfg);
+ int rsnd_kctrl_new(struct rsnd_mod *mod,
+diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c
+index f832165e46bc0..9893839666d7b 100644
+--- a/sound/soc/sh/rcar/src.c
++++ b/sound/soc/sh/rcar/src.c
+@@ -530,6 +530,22 @@ static irqreturn_t rsnd_src_interrupt(int irq, void *data)
+ return IRQ_HANDLED;
+ }
+
++static int rsnd_src_kctrl_accept_runtime(struct rsnd_dai_stream *io)
++{
++ struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
++
++ if (!runtime) {
++ struct rsnd_priv *priv = rsnd_io_to_priv(io);
++ struct device *dev = rsnd_priv_to_dev(priv);
++
++ dev_warn(dev, "\"SRC Out Rate\" can use during running\n");
++
++ return 0;
++ }
++
++ return 1;
++}
++
+ static int rsnd_src_probe_(struct rsnd_mod *mod,
+ struct rsnd_dai_stream *io,
+ struct rsnd_priv *priv)
+@@ -593,7 +609,7 @@ static int rsnd_src_pcm_new(struct rsnd_mod *mod,
+ rsnd_io_is_play(io) ?
+ "SRC Out Rate" :
+ "SRC In Rate",
+- rsnd_kctrl_accept_runtime,
++ rsnd_src_kctrl_accept_runtime,
+ rsnd_src_set_convert_rate,
+ &src->sync, 192000);
+
+--
+2.39.5
+
--- /dev/null
+From 818a5428c1cf2908a1861a73ec727d8cf37a374c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Feb 2025 11:47:23 +0200
+Subject: ASoC: SOF: Intel: hda: add softdep pre to snd-hda-codec-hdmi module
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Terry Cheong <htcheong@chromium.org>
+
+[ Upstream commit 33b7dc7843dbdc9b90c91d11ba30b107f9138ffd ]
+
+In enviornment without KMOD requesting module may fail to load
+snd-hda-codec-hdmi, resulting in HDMI audio not usable.
+Add softdep to loading HDMI codec module first to ensure we can load it
+correctly.
+
+Signed-off-by: Terry Cheong <htcheong@chromium.org>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Johny Lin <lpg76627@gmail.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://patch.msgid.link/20250206094723.18013-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-codec.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/sof/intel/hda-codec.c b/sound/soc/sof/intel/hda-codec.c
+index a0dfd7de431fe..a75f81116643b 100644
+--- a/sound/soc/sof/intel/hda-codec.c
++++ b/sound/soc/sof/intel/hda-codec.c
+@@ -282,6 +282,7 @@ int hda_codec_i915_exit(struct snd_sof_dev *sdev)
+ }
+ EXPORT_SYMBOL_NS(hda_codec_i915_exit, SND_SOC_SOF_HDA_AUDIO_CODEC_I915);
+
++MODULE_SOFTDEP("pre: snd-hda-codec-hdmi");
+ #endif
+
+ MODULE_LICENSE("Dual BSD/GPL");
+--
+2.39.5
+
--- /dev/null
+From d24083e01c7222d779cccfaa802010affc9f15ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Feb 2025 18:35:35 +1000
+Subject: ASoC: tas2764: Fix power control mask
+
+From: Hector Martin <marcan@marcan.st>
+
+[ Upstream commit a3f172359e22b2c11b750d23560481a55bf86af1 ]
+
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Signed-off-by: Hector Martin <marcan@marcan.st>
+Signed-off-by: James Calligeros <jcalligeros99@gmail.com>
+Link: https://patch.msgid.link/20250218-apple-codec-changes-v2-1-932760fd7e07@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tas2764.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/tas2764.h b/sound/soc/codecs/tas2764.h
+index 168af772a898f..d13ecae9c9c2f 100644
+--- a/sound/soc/codecs/tas2764.h
++++ b/sound/soc/codecs/tas2764.h
+@@ -25,7 +25,7 @@
+
+ /* Power Control */
+ #define TAS2764_PWR_CTRL TAS2764_REG(0X0, 0x02)
+-#define TAS2764_PWR_CTRL_MASK GENMASK(1, 0)
++#define TAS2764_PWR_CTRL_MASK GENMASK(2, 0)
+ #define TAS2764_PWR_CTRL_ACTIVE 0x0
+ #define TAS2764_PWR_CTRL_MUTE BIT(0)
+ #define TAS2764_PWR_CTRL_SHUTDOWN BIT(1)
+--
+2.39.5
+
--- /dev/null
+From 9dcde879502b1ee9151061b520a8c77d7eac84dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Feb 2025 18:36:02 +1000
+Subject: ASoC: tas2764: Set the SDOUT polarity correctly
+
+From: Hector Martin <marcan@marcan.st>
+
+[ Upstream commit f5468beeab1b1adfc63c2717b1f29ef3f49a5fab ]
+
+TX launch polarity needs to be the opposite of RX capture polarity, to
+generate the right bit slot alignment.
+
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Signed-off-by: Hector Martin <marcan@marcan.st>
+Signed-off-by: James Calligeros <jcalligeros99@gmail.com>
+Link: https://patch.msgid.link/20250218-apple-codec-changes-v2-28-932760fd7e07@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tas2764.c | 10 +++++++++-
+ sound/soc/codecs/tas2764.h | 6 ++++++
+ 2 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/tas2764.c b/sound/soc/codecs/tas2764.c
+index 2e0ed3e68fa54..fc8479d3d2852 100644
+--- a/sound/soc/codecs/tas2764.c
++++ b/sound/soc/codecs/tas2764.c
+@@ -367,7 +367,7 @@ static int tas2764_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ {
+ struct snd_soc_component *component = dai->component;
+ struct tas2764_priv *tas2764 = snd_soc_component_get_drvdata(component);
+- u8 tdm_rx_start_slot = 0, asi_cfg_0 = 0, asi_cfg_1 = 0;
++ u8 tdm_rx_start_slot = 0, asi_cfg_0 = 0, asi_cfg_1 = 0, asi_cfg_4 = 0;
+ int ret;
+
+ switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+@@ -376,12 +376,14 @@ static int tas2764_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ fallthrough;
+ case SND_SOC_DAIFMT_NB_NF:
+ asi_cfg_1 = TAS2764_TDM_CFG1_RX_RISING;
++ asi_cfg_4 = TAS2764_TDM_CFG4_TX_FALLING;
+ break;
+ case SND_SOC_DAIFMT_IB_IF:
+ asi_cfg_0 ^= TAS2764_TDM_CFG0_FRAME_START;
+ fallthrough;
+ case SND_SOC_DAIFMT_IB_NF:
+ asi_cfg_1 = TAS2764_TDM_CFG1_RX_FALLING;
++ asi_cfg_4 = TAS2764_TDM_CFG4_TX_RISING;
+ break;
+ }
+
+@@ -391,6 +393,12 @@ static int tas2764_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ if (ret < 0)
+ return ret;
+
++ ret = snd_soc_component_update_bits(component, TAS2764_TDM_CFG4,
++ TAS2764_TDM_CFG4_TX_MASK,
++ asi_cfg_4);
++ if (ret < 0)
++ return ret;
++
+ switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+ case SND_SOC_DAIFMT_I2S:
+ asi_cfg_0 ^= TAS2764_TDM_CFG0_FRAME_START;
+diff --git a/sound/soc/codecs/tas2764.h b/sound/soc/codecs/tas2764.h
+index d13ecae9c9c2f..9490f2686e389 100644
+--- a/sound/soc/codecs/tas2764.h
++++ b/sound/soc/codecs/tas2764.h
+@@ -79,6 +79,12 @@
+ #define TAS2764_TDM_CFG3_RXS_SHIFT 0x4
+ #define TAS2764_TDM_CFG3_MASK GENMASK(3, 0)
+
++/* TDM Configuration Reg4 */
++#define TAS2764_TDM_CFG4 TAS2764_REG(0X0, 0x0d)
++#define TAS2764_TDM_CFG4_TX_MASK BIT(0)
++#define TAS2764_TDM_CFG4_TX_RISING 0x0
++#define TAS2764_TDM_CFG4_TX_FALLING BIT(0)
++
+ /* TDM Configuration Reg5 */
+ #define TAS2764_TDM_CFG5 TAS2764_REG(0X0, 0x0e)
+ #define TAS2764_TDM_CFG5_VSNS_MASK BIT(6)
+--
+2.39.5
+
--- /dev/null
+From 6bbc9de4ea4fa79bf194bbdc8c024a2388ed178b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Feb 2025 00:54:35 +0000
+Subject: ASoC: tas2770: Fix volume scale
+
+From: Hector Martin <marcan@marcan.st>
+
+[ Upstream commit 579cd64b9df8a60284ec3422be919c362de40e41 ]
+
+The scale starts at -100dB, not -128dB.
+
+Signed-off-by: Hector Martin <marcan@marcan.st>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Link: https://patch.msgid.link/20250208-asoc-tas2770-v1-1-cf50ff1d59a3@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tas2770.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/tas2770.c b/sound/soc/codecs/tas2770.c
+index 8557759acb1f2..e284a3a854591 100644
+--- a/sound/soc/codecs/tas2770.c
++++ b/sound/soc/codecs/tas2770.c
+@@ -508,7 +508,7 @@ static int tas2770_codec_probe(struct snd_soc_component *component)
+ }
+
+ static DECLARE_TLV_DB_SCALE(tas2770_digital_tlv, 1100, 50, 0);
+-static DECLARE_TLV_DB_SCALE(tas2770_playback_volume, -12750, 50, 0);
++static DECLARE_TLV_DB_SCALE(tas2770_playback_volume, -10050, 50, 0);
+
+ static const struct snd_kcontrol_new tas2770_snd_controls[] = {
+ SOC_SINGLE_TLV("Speaker Playback Volume", TAS2770_PLAY_CFG_REG2,
+--
+2.39.5
+
--- /dev/null
+From e577cc29138d84037d6ffae475739288997d6ff8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Feb 2025 21:26:56 +0800
+Subject: block: fix 'kmem_cache of name 'bio-108' already exists'
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit b654f7a51ffb386131de42aa98ed831f8c126546 ]
+
+Device mapper bioset often has big bio_slab size, which can be more than
+1000, then 8byte can't hold the slab name any more, cause the kmem_cache
+allocation warning of 'kmem_cache of name 'bio-108' already exists'.
+
+Fix the warning by extending bio_slab->name to 12 bytes, but fix output
+of /proc/slabinfo
+
+Reported-by: Guangwu Zhang <guazhang@redhat.com>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20250228132656.2838008-1-ming.lei@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block/bio.c b/block/bio.c
+index 3318e0022fdfd..a7323d567c798 100644
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -73,7 +73,7 @@ struct bio_slab {
+ struct kmem_cache *slab;
+ unsigned int slab_ref;
+ unsigned int slab_size;
+- char name[8];
++ char name[12];
+ };
+ static DEFINE_MUTEX(bio_slab_lock);
+ static DEFINE_XARRAY(bio_slabs);
+--
+2.39.5
+
--- /dev/null
+From 35611132e9e22cbc06d406f844f79dddf9a8c206 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jan 2025 10:57:25 +0100
+Subject: drm/nouveau: Do not override forced connector status
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+[ Upstream commit 01f1d77a2630e774ce33233c4e6723bca3ae9daa ]
+
+Keep user-forced connector status even if it cannot be programmed. Same
+behavior as for the rest of the drivers.
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250114100214.195386-1-tzimmermann@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_connector.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
+index bdf5262ebd35e..5a30d115525ad 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
+@@ -755,7 +755,6 @@ nouveau_connector_force(struct drm_connector *connector)
+ if (!nv_encoder) {
+ NV_ERROR(drm, "can't find encoder to force %s on!\n",
+ connector->name);
+- connector->status = connector_status_disconnected;
+ return;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From e31f0d089f204807b1fdb975b7638bb7a622ff24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Feb 2025 11:02:58 +0100
+Subject: fuse: don't truncate cached, mutated symlink
+
+From: Miklos Szeredi <mszeredi@redhat.com>
+
+[ Upstream commit b4c173dfbb6c78568578ff18f9e8822d7bd0e31b ]
+
+Fuse allows the value of a symlink to change and this property is exploited
+by some filesystems (e.g. CVMFS).
+
+It has been observed, that sometimes after changing the symlink contents,
+the value is truncated to the old size.
+
+This is caused by fuse_getattr() racing with fuse_reverse_inval_inode().
+fuse_reverse_inval_inode() updates the fuse_inode's attr_version, which
+results in fuse_change_attributes() exiting before updating the cached
+attributes
+
+This is okay, as the cached attributes remain invalid and the next call to
+fuse_change_attributes() will likely update the inode with the correct
+values.
+
+The reason this causes problems is that cached symlinks will be
+returned through page_get_link(), which truncates the symlink to
+inode->i_size. This is correct for filesystems that don't mutate
+symlinks, but in this case it causes bad behavior.
+
+The solution is to just remove this truncation. This can cause a
+regression in a filesystem that relies on supplying a symlink larger than
+the file size, but this is unlikely. If that happens we'd need to make
+this behavior conditional.
+
+Reported-by: Laura Promberger <laura.promberger@cern.ch>
+Tested-by: Sam Lewis <samclewis@google.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Link: https://lore.kernel.org/r/20250220100258.793363-1-mszeredi@redhat.com
+Reviewed-by: Bernd Schubert <bschubert@ddn.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fuse/dir.c | 2 +-
+ fs/namei.c | 24 +++++++++++++++++++-----
+ include/linux/fs.h | 2 ++
+ 3 files changed, 22 insertions(+), 6 deletions(-)
+
+diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
+index aa2be4c1ea8f2..de31cb8eb7201 100644
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -1445,7 +1445,7 @@ static const char *fuse_get_link(struct dentry *dentry, struct inode *inode,
+ goto out_err;
+
+ if (fc->cache_symlinks)
+- return page_get_link(dentry, inode, callback);
++ return page_get_link_raw(dentry, inode, callback);
+
+ err = -ECHILD;
+ if (!dentry)
+diff --git a/fs/namei.c b/fs/namei.c
+index 166d71c82d7ac..6ce07cde1c277 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -5156,10 +5156,9 @@ const char *vfs_get_link(struct dentry *dentry, struct delayed_call *done)
+ EXPORT_SYMBOL(vfs_get_link);
+
+ /* get the link contents into pagecache */
+-const char *page_get_link(struct dentry *dentry, struct inode *inode,
+- struct delayed_call *callback)
++static char *__page_get_link(struct dentry *dentry, struct inode *inode,
++ struct delayed_call *callback)
+ {
+- char *kaddr;
+ struct page *page;
+ struct address_space *mapping = inode->i_mapping;
+
+@@ -5178,8 +5177,23 @@ const char *page_get_link(struct dentry *dentry, struct inode *inode,
+ }
+ set_delayed_call(callback, page_put_link, page);
+ BUG_ON(mapping_gfp_mask(mapping) & __GFP_HIGHMEM);
+- kaddr = page_address(page);
+- nd_terminate_link(kaddr, inode->i_size, PAGE_SIZE - 1);
++ return page_address(page);
++}
++
++const char *page_get_link_raw(struct dentry *dentry, struct inode *inode,
++ struct delayed_call *callback)
++{
++ return __page_get_link(dentry, inode, callback);
++}
++EXPORT_SYMBOL_GPL(page_get_link_raw);
++
++const char *page_get_link(struct dentry *dentry, struct inode *inode,
++ struct delayed_call *callback)
++{
++ char *kaddr = __page_get_link(dentry, inode, callback);
++
++ if (!IS_ERR(kaddr))
++ nd_terminate_link(kaddr, inode->i_size, PAGE_SIZE - 1);
+ return kaddr;
+ }
+
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 0d32634c5cf0d..08fba309ddc78 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -3385,6 +3385,8 @@ extern const struct file_operations generic_ro_fops;
+
+ extern int readlink_copy(char __user *, int, const char *);
+ extern int page_readlink(struct dentry *, char __user *, int);
++extern const char *page_get_link_raw(struct dentry *, struct inode *,
++ struct delayed_call *);
+ extern const char *page_get_link(struct dentry *, struct inode *,
+ struct delayed_call *);
+ extern void page_put_link(void *);
+--
+2.39.5
+
--- /dev/null
+From 73cff6f1cd8085c2bcf110fb0e8af1809311f1c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2025 23:12:17 -0700
+Subject: HID: apple: fix up the F6 key on the Omoton KB066 keyboard
+
+From: Alex Henrie <alexhenrie24@gmail.com>
+
+[ Upstream commit 819083cb6eedcc8495cbf84845877bcc741b93b3 ]
+
+The Omoton KB066 is an Apple A1255 keyboard clone (HID product code
+05ac:022c). On both keyboards, the F6 key becomes Num Lock when the Fn
+key is held. But unlike its Apple exemplar, when the Omoton's F6 key is
+pressed without Fn, it sends the usage code 0xC0301 from the reserved
+section of the consumer page instead of the standard F6 usage code
+0x7003F from the keyboard page. The nonstandard code is translated to
+KEY_UNKNOWN and becomes useless on Linux. The Omoton KB066 is a pretty
+popular keyboard, judging from its 29,058 reviews on Amazon at time of
+writing, so let's account for its quirk to make it more usable.
+
+By the way, it would be nice if we could automatically set fnmode to 0
+for Omoton keyboards because they handle the Fn key internally and the
+kernel's Fn key handling creates undesirable side effects such as making
+F1 and F2 always Brightness Up and Brightness Down in fnmode=1 (the
+default) or always F1 and F2 in fnmode=2. Unfortunately I don't think
+there's a way to identify Bluetooth keyboards more specifically than the
+HID product code which is obviously inaccurate. Users of Omoton
+keyboards will just have to set fnmode to 0 manually to get full Fn key
+functionality.
+
+Signed-off-by: Alex Henrie <alexhenrie24@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-apple.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index da8751601534f..86a5e09544c4a 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -497,6 +497,9 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input,
+ }
+ }
+
++ if (usage->hid == 0xc0301) /* Omoton KB066 quirk */
++ code = KEY_F6;
++
+ if (usage->code != code) {
+ input_event_with_scancode(input, usage->type, code, usage->hid, value);
+
+--
+2.39.5
+
--- /dev/null
+From b26384c1dbb86628e3575df55bf8caf6ccb9bd0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Jan 2025 13:13:14 +0900
+Subject: HID: hid-apple: Apple Magic Keyboard a3203 USB-C support
+
+From: Ievgen Vovk <YevgenVovk@ukr.net>
+
+[ Upstream commit 2813e00dcd748cef47d2bffaa04071de93fddf00 ]
+
+Add Apple Magic Keyboard 2024 model (with USB-C port) device ID (0320)
+to those recognized by the hid-apple driver. Keyboard is otherwise
+compatible with the existing implementation for its earlier 2021 model.
+
+Signed-off-by: Ievgen Vovk <YevgenVovk@ukr.net>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-apple.c | 5 +++++
+ drivers/hid/hid-ids.h | 1 +
+ 2 files changed, 6 insertions(+)
+
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index 37b2ce9b50fe8..da8751601534f 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -425,6 +425,7 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input,
+ hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_2015)
+ table = magic_keyboard_2015_fn_keys;
+ else if (hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021 ||
++ hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2024 ||
+ hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021 ||
+ hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_2021)
+ table = apple2021_fn_keys;
+@@ -1030,6 +1031,10 @@ static const struct hid_device_id apple_devices[] = {
+ .driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK | APPLE_RDESC_BATTERY },
+ { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021),
+ .driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK },
++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2024),
++ .driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK | APPLE_RDESC_BATTERY },
++ { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2024),
++ .driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK },
+ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021),
+ .driver_data = APPLE_HAS_FN | APPLE_ISO_TILDE_QUIRK | APPLE_RDESC_BATTERY },
+ { HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021),
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 29b8c96ce9f4d..4187d890bcc1a 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -184,6 +184,7 @@
+ #define USB_DEVICE_ID_APPLE_IRCONTROL4 0x8242
+ #define USB_DEVICE_ID_APPLE_IRCONTROL5 0x8243
+ #define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021 0x029c
++#define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2024 0x0320
+ #define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_FINGERPRINT_2021 0x029a
+ #define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_2021 0x029f
+ #define USB_DEVICE_ID_APPLE_TOUCHBAR_BACKLIGHT 0x8102
+--
+2.39.5
+
--- /dev/null
+From db43f29884a8484a3b6a8098a37a9e11f8a41567 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2025 15:00:20 +0800
+Subject: HID: ignore non-functional sensor in HP 5MP Camera
+
+From: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+
+[ Upstream commit 363236d709e75610b628c2a4337ccbe42e454b6d ]
+
+The HP 5MP Camera (USB ID 0408:5473) reports a HID sensor interface that
+is not actually implemented. Attempting to access this non-functional
+sensor via iio_info causes system hangs as runtime PM tries to wake up
+an unresponsive sensor.
+
+ [453] hid-sensor-hub 0003:0408:5473.0003: Report latency attributes: ffffffff:ffffffff
+ [453] hid-sensor-hub 0003:0408:5473.0003: common attributes: 5:1, 2:1, 3:1 ffffffff:ffffffff
+
+Add this device to the HID ignore list since the sensor interface is
+non-functional by design and should not be exposed to userspace.
+
+Signed-off-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-quirks.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index d8c5e24e7d44c..29b8c96ce9f4d 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -1072,6 +1072,7 @@
+ #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001 0x3001
+ #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3003 0x3003
+ #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008 0x3008
++#define USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473 0x5473
+
+ #define I2C_VENDOR_ID_RAYDIUM 0x2386
+ #define I2C_PRODUCT_ID_RAYDIUM_4B33 0x4b33
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index debc49272a5c0..875c44e5cf6c2 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -882,6 +882,7 @@ static const struct hid_device_id hid_ignore_list[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_DPAD) },
+ #endif
+ { HID_USB_DEVICE(USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473) },
+ { }
+ };
+
+--
+2.39.5
+
--- /dev/null
+From 7d4298a49426a4c1218b2e3316f4f7bf2742ceb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2025 09:29:00 +0800
+Subject: HID: intel-ish-hid: fix the length of MNG_SYNC_FW_CLOCK in doorbell
+
+From: Zhang Lixu <lixu.zhang@intel.com>
+
+[ Upstream commit 4b54ae69197b9f416baa0fceadff7e89075f8454 ]
+
+The timestamps in the Firmware log and HID sensor samples are incorrect.
+They show 1970-01-01 because the current IPC driver only uses the first
+8 bytes of bootup time when synchronizing time with the firmware. The
+firmware converts the bootup time to UTC time, which results in the
+display of 1970-01-01.
+
+In write_ipc_from_queue(), when sending the MNG_SYNC_FW_CLOCK message,
+the clock is updated according to the definition of ipc_time_update_msg.
+However, in _ish_sync_fw_clock(), the message length is specified as the
+size of uint64_t when building the doorbell. As a result, the firmware
+only receives the first 8 bytes of struct ipc_time_update_msg.
+This patch corrects the length in the doorbell to ensure the entire
+ipc_time_update_msg is sent, fixing the timestamp issue.
+
+Signed-off-by: Zhang Lixu <lixu.zhang@intel.com>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/intel-ish-hid/ipc/ipc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hid/intel-ish-hid/ipc/ipc.c b/drivers/hid/intel-ish-hid/ipc/ipc.c
+index dd5fc60874ba1..b1a41c90c5741 100644
+--- a/drivers/hid/intel-ish-hid/ipc/ipc.c
++++ b/drivers/hid/intel-ish-hid/ipc/ipc.c
+@@ -577,14 +577,14 @@ static void fw_reset_work_fn(struct work_struct *unused)
+ static void _ish_sync_fw_clock(struct ishtp_device *dev)
+ {
+ static unsigned long prev_sync;
+- uint64_t usec;
++ struct ipc_time_update_msg time = {};
+
+ if (prev_sync && time_before(jiffies, prev_sync + 20 * HZ))
+ return;
+
+ prev_sync = jiffies;
+- usec = ktime_to_us(ktime_get_boottime());
+- ipc_send_mng_msg(dev, MNG_SYNC_FW_CLOCK, &usec, sizeof(uint64_t));
++ /* The fields of time would be updated while sending message */
++ ipc_send_mng_msg(dev, MNG_SYNC_FW_CLOCK, &time, sizeof(time));
+ }
+
+ /**
+--
+2.39.5
+
--- /dev/null
+From 0c7c5b5622b11bc8427d9baa172daa5442096612 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2025 09:29:01 +0800
+Subject: HID: intel-ish-hid: Send clock sync message immediately after reset
+
+From: Zhang Lixu <lixu.zhang@intel.com>
+
+[ Upstream commit 7e0d1cff12b895f44f4ddc8cf50311bc1f775201 ]
+
+The ISH driver performs a clock sync with the firmware once at system
+startup and then every 20 seconds. If a firmware reset occurs right
+after a clock sync, the driver would wait 20 seconds before performing
+another clock sync with the firmware. This is particularly problematic
+with the introduction of the "load firmware from host" feature, where
+the driver performs a clock sync with the bootloader and then has to
+wait 20 seconds before syncing with the main firmware.
+
+This patch clears prev_sync immediately upon receiving an IPC reset,
+so that the main firmware and driver will perform a clock sync
+immediately after completing the IPC handshake.
+
+Signed-off-by: Zhang Lixu <lixu.zhang@intel.com>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/intel-ish-hid/ipc/ipc.c | 9 ++++++---
+ drivers/hid/intel-ish-hid/ishtp/ishtp-dev.h | 2 ++
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hid/intel-ish-hid/ipc/ipc.c b/drivers/hid/intel-ish-hid/ipc/ipc.c
+index b1a41c90c5741..42141a78bdb4b 100644
+--- a/drivers/hid/intel-ish-hid/ipc/ipc.c
++++ b/drivers/hid/intel-ish-hid/ipc/ipc.c
+@@ -517,6 +517,10 @@ static int ish_fw_reset_handler(struct ishtp_device *dev)
+ /* ISH FW is dead */
+ if (!ish_is_input_ready(dev))
+ return -EPIPE;
++
++ /* Send clock sync at once after reset */
++ ishtp_dev->prev_sync = 0;
++
+ /*
+ * Set HOST2ISH.ILUP. Apparently we need this BEFORE sending
+ * RESET_NOTIFY_ACK - FW will be checking for it
+@@ -576,13 +580,12 @@ static void fw_reset_work_fn(struct work_struct *unused)
+ */
+ static void _ish_sync_fw_clock(struct ishtp_device *dev)
+ {
+- static unsigned long prev_sync;
+ struct ipc_time_update_msg time = {};
+
+- if (prev_sync && time_before(jiffies, prev_sync + 20 * HZ))
++ if (dev->prev_sync && time_before(jiffies, dev->prev_sync + 20 * HZ))
+ return;
+
+- prev_sync = jiffies;
++ dev->prev_sync = jiffies;
+ /* The fields of time would be updated while sending message */
+ ipc_send_mng_msg(dev, MNG_SYNC_FW_CLOCK, &time, sizeof(time));
+ }
+diff --git a/drivers/hid/intel-ish-hid/ishtp/ishtp-dev.h b/drivers/hid/intel-ish-hid/ishtp/ishtp-dev.h
+index 32142c7d9a043..9b2ee3fe04b8f 100644
+--- a/drivers/hid/intel-ish-hid/ishtp/ishtp-dev.h
++++ b/drivers/hid/intel-ish-hid/ishtp/ishtp-dev.h
+@@ -212,6 +212,8 @@ struct ishtp_device {
+ unsigned int ipc_tx_cnt;
+ unsigned long long ipc_tx_bytes_cnt;
+
++ /* Time of the last clock sync */
++ unsigned long prev_sync;
+ const struct ishtp_hw_ops *ops;
+ size_t mtu;
+ uint32_t ishtp_msg_hdr;
+--
+2.39.5
+
--- /dev/null
+From 5d1856aa68c10e8c14f1d711ec16f55191f7adb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2025 18:07:45 +0200
+Subject: hrtimers: Mark is_migration_base() with __always_inline
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 27af31e44949fa85550176520ef7086a0d00fd7b ]
+
+When is_migration_base() is unused, it prevents kernel builds
+with clang, `make W=1` and CONFIG_WERROR=y:
+
+kernel/time/hrtimer.c:156:20: error: unused function 'is_migration_base' [-Werror,-Wunused-function]
+ 156 | static inline bool is_migration_base(struct hrtimer_clock_base *base)
+ | ^~~~~~~~~~~~~~~~~
+
+Fix this by marking it with __always_inline.
+
+[ tglx: Use __always_inline instead of __maybe_unused and move it into the
+ usage sites conditional ]
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/all/20250116160745.243358-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/hrtimer.c | 22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
+index f6d799646dd9c..e60863ab74b50 100644
+--- a/kernel/time/hrtimer.c
++++ b/kernel/time/hrtimer.c
+@@ -145,11 +145,6 @@ static struct hrtimer_cpu_base migration_cpu_base = {
+
+ #define migration_base migration_cpu_base.clock_base[0]
+
+-static inline bool is_migration_base(struct hrtimer_clock_base *base)
+-{
+- return base == &migration_base;
+-}
+-
+ /*
+ * We are using hashed locking: holding per_cpu(hrtimer_bases)[n].lock
+ * means that all timers which are tied to this base via timer->base are
+@@ -274,11 +269,6 @@ switch_hrtimer_base(struct hrtimer *timer, struct hrtimer_clock_base *base,
+
+ #else /* CONFIG_SMP */
+
+-static inline bool is_migration_base(struct hrtimer_clock_base *base)
+-{
+- return false;
+-}
+-
+ static inline struct hrtimer_clock_base *
+ lock_hrtimer_base(const struct hrtimer *timer, unsigned long *flags)
+ {
+@@ -1378,6 +1368,18 @@ static void hrtimer_sync_wait_running(struct hrtimer_cpu_base *cpu_base,
+ }
+ }
+
++#ifdef CONFIG_SMP
++static __always_inline bool is_migration_base(struct hrtimer_clock_base *base)
++{
++ return base == &migration_base;
++}
++#else
++static __always_inline bool is_migration_base(struct hrtimer_clock_base *base)
++{
++ return false;
++}
++#endif
++
+ /*
+ * This function is called on PREEMPT_RT kernels when the fast path
+ * deletion of a timer failed because the timer callback function was
+--
+2.39.5
+
--- /dev/null
+From da0cf27d045a15162d6d6d0b6dfaff4d0354af19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jan 2025 12:12:34 +0800
+Subject: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in
+ ibft_attr_show_nic()
+
+From: Chengen Du <chengen.du@canonical.com>
+
+[ Upstream commit 07e0d99a2f701123ad3104c0f1a1e66bce74d6e5 ]
+
+When performing an iSCSI boot using IPv6, iscsistart still reads the
+/sys/firmware/ibft/ethernetX/subnet-mask entry. Since the IPv6 prefix
+length is 64, this causes the shift exponent to become negative,
+triggering a UBSAN warning. As the concept of a subnet mask does not
+apply to IPv6, the value is set to ~0 to suppress the warning message.
+
+Signed-off-by: Chengen Du <chengen.du@canonical.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/iscsi_ibft.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c
+index 6e9788324fea5..371f24569b3b2 100644
+--- a/drivers/firmware/iscsi_ibft.c
++++ b/drivers/firmware/iscsi_ibft.c
+@@ -310,7 +310,10 @@ static ssize_t ibft_attr_show_nic(void *data, int type, char *buf)
+ str += sprintf_ipaddr(str, nic->ip_addr);
+ break;
+ case ISCSI_BOOT_ETH_SUBNET_MASK:
+- val = cpu_to_be32(~((1 << (32-nic->subnet_mask_prefix))-1));
++ if (nic->subnet_mask_prefix > 32)
++ val = cpu_to_be32(~0);
++ else
++ val = cpu_to_be32(~((1 << (32-nic->subnet_mask_prefix))-1));
+ str += sprintf(str, "%pI4", &val);
+ break;
+ case ISCSI_BOOT_ETH_PREFIX_LEN:
+--
+2.39.5
+
--- /dev/null
+From ab2ecf92c2287983a0e0ca3a4479161698fb012f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Feb 2025 19:11:52 +0100
+Subject: mptcp: safety check before fallback
+
+From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+
+[ Upstream commit db75a16813aabae3b78c06b1b99f5e314c1f55d3 ]
+
+Recently, some fallback have been initiated, while the connection was
+not supposed to fallback.
+
+Add a safety check with a warning to detect when an wrong attempt to
+fallback is being done. This should help detecting any future issues
+quicker.
+
+Acked-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20250224-net-mptcp-misc-fixes-v1-3-f550f636b435@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mptcp/protocol.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
+index 77e727d81cc24..25c1cda5c1bcf 100644
+--- a/net/mptcp/protocol.h
++++ b/net/mptcp/protocol.h
+@@ -981,6 +981,8 @@ static inline void __mptcp_do_fallback(struct mptcp_sock *msk)
+ pr_debug("TCP fallback already done (msk=%p)\n", msk);
+ return;
+ }
++ if (WARN_ON_ONCE(!READ_ONCE(msk->allow_infinite_fallback)))
++ return;
+ set_bit(MPTCP_FALLBACK_DONE, &msk->flags);
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 07b0d0f04fc39c056da8ef2632433a1d5ac7ac81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Feb 2025 12:15:35 +0100
+Subject: net: wwan: mhi_wwan_mbim: Silence sequence number glitch errors
+
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+
+[ Upstream commit 0d1fac6d26aff5df21bb4ec980d9b7a11c410b96 ]
+
+When using the Qualcomm X55 modem on the ThinkPad X13s, the kernel log is
+constantly being filled with errors related to a "sequence number glitch",
+e.g.:
+
+ [ 1903.284538] sequence number glitch prev=16 curr=0
+ [ 1913.812205] sequence number glitch prev=50 curr=0
+ [ 1923.698219] sequence number glitch prev=142 curr=0
+ [ 2029.248276] sequence number glitch prev=1555 curr=0
+ [ 2046.333059] sequence number glitch prev=70 curr=0
+ [ 2076.520067] sequence number glitch prev=272 curr=0
+ [ 2158.704202] sequence number glitch prev=2655 curr=0
+ [ 2218.530776] sequence number glitch prev=2349 curr=0
+ [ 2225.579092] sequence number glitch prev=6 curr=0
+
+Internet connectivity is working fine, so this error seems harmless. It
+looks like modem does not preserve the sequence number when entering low
+power state; the amount of errors depends on how actively the modem is
+being used.
+
+A similar issue has also been seen on USB-based MBIM modems [1]. However,
+in cdc_ncm.c the "sequence number glitch" message is a debug message
+instead of an error. Apply the same to the mhi_wwan_mbim.c driver to
+silence these errors when using the modem.
+
+[1]: https://lists.freedesktop.org/archives/libmbim-devel/2016-November/000781.html
+
+Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Reviewed-by: Loic Poulain <loic.poulain@linaro.org>
+Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://patch.msgid.link/20250212-mhi-wwan-mbim-sequence-glitch-v1-1-503735977cbd@linaro.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wwan/mhi_wwan_mbim.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wwan/mhi_wwan_mbim.c b/drivers/net/wwan/mhi_wwan_mbim.c
+index ef70bb7c88ad6..43c20deab3189 100644
+--- a/drivers/net/wwan/mhi_wwan_mbim.c
++++ b/drivers/net/wwan/mhi_wwan_mbim.c
+@@ -209,7 +209,7 @@ static int mbim_rx_verify_nth16(struct mhi_mbim_context *mbim, struct sk_buff *s
+ if (mbim->rx_seq + 1 != le16_to_cpu(nth16->wSequence) &&
+ (mbim->rx_seq || le16_to_cpu(nth16->wSequence)) &&
+ !(mbim->rx_seq == 0xffff && !le16_to_cpu(nth16->wSequence))) {
+- net_err_ratelimited("sequence number glitch prev=%d curr=%d\n",
++ net_dbg_ratelimited("sequence number glitch prev=%d curr=%d\n",
+ mbim->rx_seq, le16_to_cpu(nth16->wSequence));
+ }
+ mbim->rx_seq = le16_to_cpu(nth16->wSequence);
+--
+2.39.5
+
--- /dev/null
+From 6f636fb2f6f64c218e71075f69c84b5ca9f51ef1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jan 2025 14:30:47 +0100
+Subject: nvme-fc: go straight to connecting state when initializing
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit d3d380eded7ee5fc2fc53b3b0e72365ded025c4a ]
+
+The initial controller initialization mimiks the reconnect loop
+behavior by switching from NEW to RESETTING and then to CONNECTING.
+
+The transition from NEW to CONNECTING is a valid transition, so there is
+no point entering the RESETTING state. TCP and RDMA also transition
+directly to CONNECTING state.
+
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 3dbf926fd99fd..2b0f15de77111 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -3525,8 +3525,7 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
+ list_add_tail(&ctrl->ctrl_list, &rport->ctrl_list);
+ spin_unlock_irqrestore(&rport->lock, flags);
+
+- if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RESETTING) ||
+- !nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
++ if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
+ dev_err(ctrl->ctrl.device,
+ "NVME-FC{%d}: failed to init ctrl state\n", ctrl->cnum);
+ goto fail_ctrl;
+--
+2.39.5
+
--- /dev/null
+From 10452c1344887cf449b2c5becc61cf6c4254b3d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Feb 2025 09:02:03 +0100
+Subject: nvme: only allow entering LIVE from CONNECTING state
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit d2fe192348f93fe3a0cb1e33e4aba58e646397f4 ]
+
+The fabric transports and also the PCI transport are not entering the
+LIVE state from NEW or RESETTING. This makes the state machine more
+restrictive and allows to catch not supported state transitions, e.g.
+directly switching from RESETTING to LIVE.
+
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index ba76cd3b5f852..6a636fe6506b4 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -501,8 +501,6 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
+ switch (new_state) {
+ case NVME_CTRL_LIVE:
+ switch (old_state) {
+- case NVME_CTRL_NEW:
+- case NVME_CTRL_RESETTING:
+ case NVME_CTRL_CONNECTING:
+ changed = true;
+ fallthrough;
+--
+2.39.5
+
--- /dev/null
+From dc4dabdcd75e1e60f5fc280ec7c6a1666445f1ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Feb 2025 08:59:29 -0500
+Subject: nvme-pci: quirk Acer FA100 for non-uniqueue identifiers
+
+From: Christopher Lentocha <christopherericlentocha@gmail.com>
+
+[ Upstream commit fcd875445866a5219cf2be3101e276b21fc843f3 ]
+
+In order for two Acer FA100 SSDs to work in one PC (in the case of
+myself, a Lenovo Legion T5 28IMB05), and not show one drive and not
+the other, and sometimes mix up what drive shows up (randomly), these
+two lines of code need to be added, and then both of the SSDs will
+show up and not conflict when booting off of one of them. If you boot
+up your computer with both SSDs installed without this patch, you may
+also randomly get into a kernel panic (if the initrd is not set up) or
+stuck in the initrd "/init" process, it is set up, however, if you do
+apply this patch, there should not be problems with booting or seeing
+both contents of the drive. Tested with the btrfs filesystem with a
+RAID configuration of having the root drive '/' combined to make two
+256GB Acer FA100 SSDs become 512GB in total storage.
+
+Kernel Logs with patch applied (`dmesg -t | grep -i nvm`):
+
+```
+...
+nvme 0000:04:00.0: platform quirk: setting simple suspend
+nvme nvme0: pci function 0000:04:00.0
+nvme 0000:05:00.0: platform quirk: setting simple suspend
+nvme nvme1: pci function 0000:05:00.0
+nvme nvme1: missing or invalid SUBNQN field.
+nvme nvme1: allocated 64 MiB host memory buffer.
+nvme nvme0: missing or invalid SUBNQN field.
+nvme nvme0: allocated 64 MiB host memory buffer.
+nvme nvme1: 8/0/0 default/read/poll queues
+nvme nvme1: Ignoring bogus Namespace Identifiers
+nvme nvme0: 8/0/0 default/read/poll queues
+nvme nvme0: Ignoring bogus Namespace Identifiers
+nvme0n1: p1 p2
+...
+```
+
+Kernel Logs with patch not applied (`dmesg -t | grep -i nvm`):
+
+```
+...
+nvme 0000:04:00.0: platform quirk: setting simple suspend
+nvme nvme0: pci function 0000:04:00.0
+nvme 0000:05:00.0: platform quirk: setting simple suspend
+nvme nvme1: pci function 0000:05:00.0
+nvme nvme0: missing or invalid SUBNQN field.
+nvme nvme1: missing or invalid SUBNQN field.
+nvme nvme0: allocated 64 MiB host memory buffer.
+nvme nvme1: allocated 64 MiB host memory buffer.
+nvme nvme0: 8/0/0 default/read/poll queues
+nvme nvme1: 8/0/0 default/read/poll queues
+nvme nvme1: globally duplicate IDs for nsid 1
+nvme nvme1: VID:DID 1dbe:5216 model:Acer SSD FA100 256GB firmware:1.Z.J.2X
+nvme0n1: p1 p2
+...
+```
+
+Signed-off-by: Christopher Lentocha <christopherericlentocha@gmail.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index f939b6dc295e6..afcb9668dad98 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -3577,6 +3577,8 @@ static const struct pci_device_id nvme_id_table[] = {
+ .driver_data = NVME_QUIRK_BOGUS_NID, },
+ { PCI_DEVICE(0x1cc1, 0x5350), /* ADATA XPG GAMMIX S50 */
+ .driver_data = NVME_QUIRK_BOGUS_NID, },
++ { PCI_DEVICE(0x1dbe, 0x5216), /* Acer/INNOGRIT FA100/5216 NVMe SSD */
++ .driver_data = NVME_QUIRK_BOGUS_NID, },
+ { PCI_DEVICE(0x1dbe, 0x5236), /* ADATA XPG GAMMIX S70 */
+ .driver_data = NVME_QUIRK_BOGUS_NID, },
+ { PCI_DEVICE(0x1e49, 0x0021), /* ZHITAI TiPro5000 NVMe SSD */
+--
+2.39.5
+
--- /dev/null
+From 69279ade9d3ed4358df29217a0ccf7dd223d9229 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Feb 2025 17:08:27 +0100
+Subject: nvme-tcp: add basic support for the C2HTermReq PDU
+
+From: Maurizio Lombardi <mlombard@redhat.com>
+
+[ Upstream commit 84e009042d0f3dfe91bec60bcd208ee3f866cbcd ]
+
+Previously, the NVMe/TCP host driver did not handle the C2HTermReq PDU,
+instead printing "unsupported pdu type (3)" when received. This patch adds
+support for processing the C2HTermReq PDU, allowing the driver
+to print the Fatal Error Status field.
+
+Example of output:
+nvme nvme4: Received C2HTermReq (FES = Invalid PDU Header Field)
+
+Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/tcp.c | 43 ++++++++++++++++++++++++++++++++++++++++
+ include/linux/nvme-tcp.h | 2 ++
+ 2 files changed, 45 insertions(+)
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index 29489c2c52fb9..f7ef727ee44e3 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -694,6 +694,40 @@ static int nvme_tcp_handle_r2t(struct nvme_tcp_queue *queue,
+ return 0;
+ }
+
++static void nvme_tcp_handle_c2h_term(struct nvme_tcp_queue *queue,
++ struct nvme_tcp_term_pdu *pdu)
++{
++ u16 fes;
++ const char *msg;
++ u32 plen = le32_to_cpu(pdu->hdr.plen);
++
++ static const char * const msg_table[] = {
++ [NVME_TCP_FES_INVALID_PDU_HDR] = "Invalid PDU Header Field",
++ [NVME_TCP_FES_PDU_SEQ_ERR] = "PDU Sequence Error",
++ [NVME_TCP_FES_HDR_DIGEST_ERR] = "Header Digest Error",
++ [NVME_TCP_FES_DATA_OUT_OF_RANGE] = "Data Transfer Out Of Range",
++ [NVME_TCP_FES_R2T_LIMIT_EXCEEDED] = "R2T Limit Exceeded",
++ [NVME_TCP_FES_UNSUPPORTED_PARAM] = "Unsupported Parameter",
++ };
++
++ if (plen < NVME_TCP_MIN_C2HTERM_PLEN ||
++ plen > NVME_TCP_MAX_C2HTERM_PLEN) {
++ dev_err(queue->ctrl->ctrl.device,
++ "Received a malformed C2HTermReq PDU (plen = %u)\n",
++ plen);
++ return;
++ }
++
++ fes = le16_to_cpu(pdu->fes);
++ if (fes && fes < ARRAY_SIZE(msg_table))
++ msg = msg_table[fes];
++ else
++ msg = "Unknown";
++
++ dev_err(queue->ctrl->ctrl.device,
++ "Received C2HTermReq (FES = %s)\n", msg);
++}
++
+ static int nvme_tcp_recv_pdu(struct nvme_tcp_queue *queue, struct sk_buff *skb,
+ unsigned int *offset, size_t *len)
+ {
+@@ -715,6 +749,15 @@ static int nvme_tcp_recv_pdu(struct nvme_tcp_queue *queue, struct sk_buff *skb,
+ return 0;
+
+ hdr = queue->pdu;
++ if (unlikely(hdr->type == nvme_tcp_c2h_term)) {
++ /*
++ * C2HTermReq never includes Header or Data digests.
++ * Skip the checks.
++ */
++ nvme_tcp_handle_c2h_term(queue, (void *)queue->pdu);
++ return -EINVAL;
++ }
++
+ if (queue->hdr_digest) {
+ ret = nvme_tcp_verify_hdgst(queue, queue->pdu, hdr->hlen);
+ if (unlikely(ret))
+diff --git a/include/linux/nvme-tcp.h b/include/linux/nvme-tcp.h
+index 57ebe1267f7fb..0278ce3ad1fbd 100644
+--- a/include/linux/nvme-tcp.h
++++ b/include/linux/nvme-tcp.h
+@@ -13,6 +13,8 @@
+ #define NVME_TCP_ADMIN_CCSZ SZ_8K
+ #define NVME_TCP_DIGEST_LENGTH 4
+ #define NVME_TCP_MIN_MAXH2CDATA 4096
++#define NVME_TCP_MIN_C2HTERM_PLEN 24
++#define NVME_TCP_MAX_C2HTERM_PLEN 152
+
+ enum nvme_tcp_pfv {
+ NVME_TCP_PFV_1_0 = 0x0,
+--
+2.39.5
+
--- /dev/null
+From 50515494d6757a23282a7df6effd103784ce2e3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Feb 2025 20:49:56 +0800
+Subject: nvmet-rdma: recheck queue state is LIVE in state lock in recv done
+
+From: Ruozhu Li <david.li@jaguarmicro.com>
+
+[ Upstream commit 3988ac1c67e6e84d2feb987d7b36d5791174b3da ]
+
+The queue state checking in nvmet_rdma_recv_done is not in queue state
+lock.Queue state can transfer to LIVE in cm establish handler between
+state checking and state lock here, cause a silent drop of nvme connect
+cmd.
+Recheck queue state whether in LIVE state in state lock to prevent this
+issue.
+
+Signed-off-by: Ruozhu Li <david.li@jaguarmicro.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/rdma.c | 33 +++++++++++++++++++++++----------
+ 1 file changed, 23 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
+index a6d55ebb82382..298c46834a539 100644
+--- a/drivers/nvme/target/rdma.c
++++ b/drivers/nvme/target/rdma.c
+@@ -997,6 +997,27 @@ static void nvmet_rdma_handle_command(struct nvmet_rdma_queue *queue,
+ nvmet_req_complete(&cmd->req, status);
+ }
+
++static bool nvmet_rdma_recv_not_live(struct nvmet_rdma_queue *queue,
++ struct nvmet_rdma_rsp *rsp)
++{
++ unsigned long flags;
++ bool ret = true;
++
++ spin_lock_irqsave(&queue->state_lock, flags);
++ /*
++ * recheck queue state is not live to prevent a race condition
++ * with RDMA_CM_EVENT_ESTABLISHED handler.
++ */
++ if (queue->state == NVMET_RDMA_Q_LIVE)
++ ret = false;
++ else if (queue->state == NVMET_RDMA_Q_CONNECTING)
++ list_add_tail(&rsp->wait_list, &queue->rsp_wait_list);
++ else
++ nvmet_rdma_put_rsp(rsp);
++ spin_unlock_irqrestore(&queue->state_lock, flags);
++ return ret;
++}
++
+ static void nvmet_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc)
+ {
+ struct nvmet_rdma_cmd *cmd =
+@@ -1038,17 +1059,9 @@ static void nvmet_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc)
+ rsp->req.port = queue->port;
+ rsp->n_rdma = 0;
+
+- if (unlikely(queue->state != NVMET_RDMA_Q_LIVE)) {
+- unsigned long flags;
+-
+- spin_lock_irqsave(&queue->state_lock, flags);
+- if (queue->state == NVMET_RDMA_Q_CONNECTING)
+- list_add_tail(&rsp->wait_list, &queue->rsp_wait_list);
+- else
+- nvmet_rdma_put_rsp(rsp);
+- spin_unlock_irqrestore(&queue->state_lock, flags);
++ if (unlikely(queue->state != NVMET_RDMA_Q_LIVE) &&
++ nvmet_rdma_recv_not_live(queue, rsp))
+ return;
+- }
+
+ nvmet_rdma_handle_command(queue, rsp);
+ }
+--
+2.39.5
+
--- /dev/null
+From dbb90fad33a7c4507e8c537cffe3853e866373a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jan 2025 07:19:13 -0800
+Subject: perf/x86/intel: Use better start period for frequency mode
+
+From: Kan Liang <kan.liang@linux.intel.com>
+
+[ Upstream commit a26b24b2e21f6222635a95426b9ef9eec63d69b1 ]
+
+Freqency mode is the current default mode of Linux perf. A period of 1 is
+used as a starting period. The period is auto-adjusted on each tick or an
+overflow, to meet the frequency target.
+
+The start period of 1 is too low and may trigger some issues:
+
+- Many HWs do not support period 1 well.
+ https://lore.kernel.org/lkml/875xs2oh69.ffs@tglx/
+
+- For an event that occurs frequently, period 1 is too far away from the
+ real period. Lots of samples are generated at the beginning.
+ The distribution of samples may not be even.
+
+- A low starting period for frequently occurring events also challenges
+ virtualization, which has a longer path to handle a PMI.
+
+The limit_period value only checks the minimum acceptable value for HW.
+It cannot be used to set the start period, because some events may
+need a very low period. The limit_period cannot be set too high. It
+doesn't help with the events that occur frequently.
+
+It's hard to find a universal starting period for all events. The idea
+implemented by this patch is to only give an estimate for the popular
+HW and HW cache events. For the rest of the events, start from the lowest
+possible recommended value.
+
+Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20250117151913.3043942-3-kan.liang@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/core.c | 85 ++++++++++++++++++++++++++++++++++++
+ 1 file changed, 85 insertions(+)
+
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index 117f86283183f..b9dde37694120 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -3852,6 +3852,85 @@ static inline bool intel_pmu_has_cap(struct perf_event *event, int idx)
+ return test_bit(idx, (unsigned long *)&intel_cap->capabilities);
+ }
+
++static u64 intel_pmu_freq_start_period(struct perf_event *event)
++{
++ int type = event->attr.type;
++ u64 config, factor;
++ s64 start;
++
++ /*
++ * The 127 is the lowest possible recommended SAV (sample after value)
++ * for a 4000 freq (default freq), according to the event list JSON file.
++ * Also, assume the workload is idle 50% time.
++ */
++ factor = 64 * 4000;
++ if (type != PERF_TYPE_HARDWARE && type != PERF_TYPE_HW_CACHE)
++ goto end;
++
++ /*
++ * The estimation of the start period in the freq mode is
++ * based on the below assumption.
++ *
++ * For a cycles or an instructions event, 1GHZ of the
++ * underlying platform, 1 IPC. The workload is idle 50% time.
++ * The start period = 1,000,000,000 * 1 / freq / 2.
++ * = 500,000,000 / freq
++ *
++ * Usually, the branch-related events occur less than the
++ * instructions event. According to the Intel event list JSON
++ * file, the SAV (sample after value) of a branch-related event
++ * is usually 1/4 of an instruction event.
++ * The start period of branch-related events = 125,000,000 / freq.
++ *
++ * The cache-related events occurs even less. The SAV is usually
++ * 1/20 of an instruction event.
++ * The start period of cache-related events = 25,000,000 / freq.
++ */
++ config = event->attr.config & PERF_HW_EVENT_MASK;
++ if (type == PERF_TYPE_HARDWARE) {
++ switch (config) {
++ case PERF_COUNT_HW_CPU_CYCLES:
++ case PERF_COUNT_HW_INSTRUCTIONS:
++ case PERF_COUNT_HW_BUS_CYCLES:
++ case PERF_COUNT_HW_STALLED_CYCLES_FRONTEND:
++ case PERF_COUNT_HW_STALLED_CYCLES_BACKEND:
++ case PERF_COUNT_HW_REF_CPU_CYCLES:
++ factor = 500000000;
++ break;
++ case PERF_COUNT_HW_BRANCH_INSTRUCTIONS:
++ case PERF_COUNT_HW_BRANCH_MISSES:
++ factor = 125000000;
++ break;
++ case PERF_COUNT_HW_CACHE_REFERENCES:
++ case PERF_COUNT_HW_CACHE_MISSES:
++ factor = 25000000;
++ break;
++ default:
++ goto end;
++ }
++ }
++
++ if (type == PERF_TYPE_HW_CACHE)
++ factor = 25000000;
++end:
++ /*
++ * Usually, a prime or a number with less factors (close to prime)
++ * is chosen as an SAV, which makes it less likely that the sampling
++ * period synchronizes with some periodic event in the workload.
++ * Minus 1 to make it at least avoiding values near power of twos
++ * for the default freq.
++ */
++ start = DIV_ROUND_UP_ULL(factor, event->attr.sample_freq) - 1;
++
++ if (start > x86_pmu.max_period)
++ start = x86_pmu.max_period;
++
++ if (x86_pmu.limit_period)
++ x86_pmu.limit_period(event, &start);
++
++ return start;
++}
++
+ static int intel_pmu_hw_config(struct perf_event *event)
+ {
+ int ret = x86_pmu_hw_config(event);
+@@ -3863,6 +3942,12 @@ static int intel_pmu_hw_config(struct perf_event *event)
+ if (ret)
+ return ret;
+
++ if (event->attr.freq && event->attr.sample_freq) {
++ event->hw.sample_period = intel_pmu_freq_start_period(event);
++ event->hw.last_period = event->hw.sample_period;
++ local64_set(&event->hw.period_left, event->hw.sample_period);
++ }
++
+ if (event->attr.precise_ip) {
+ if ((event->attr.config & INTEL_ARCH_EVENT_MASK) == INTEL_FIXED_VLBR_EVENT)
+ return -EINVAL;
+--
+2.39.5
+
--- /dev/null
+From 8fa7b6301aefc6c690d5de44c0090d184c41a01f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Feb 2025 16:33:15 +0000
+Subject: platform/x86: thinkpad_acpi: Fix invalid fan speed on ThinkPad X120e
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sybil Isabel Dorsett <sybdorsett@proton.me>
+
+[ Upstream commit 1046cac109225eda0973b898e053aeb3d6c10e1d ]
+
+On ThinkPad X120e, fan speed is reported in ticks per revolution
+rather than RPM.
+
+Recalculate the fan speed value reported for ThinkPad X120e
+to RPM based on a 22.5 kHz clock.
+
+Based on the information on
+https://www.thinkwiki.org/wiki/How_to_control_fan_speed,
+the same problem is highly likely to be relevant to at least Edge11,
+but Edge11 is not addressed in this patch.
+
+Signed-off-by: Sybil Isabel Dorsett <sybdorsett@proton.me>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Link: https://lore.kernel.org/r/20250203163255.5525-1-sybdorsett@proton.me
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/thinkpad_acpi.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index a57e236be0504..a8b6f38d344fd 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -8161,6 +8161,7 @@ static struct ibm_struct volume_driver_data = {
+
+ #define FAN_NS_CTRL_STATUS BIT(2) /* Bit which determines control is enabled or not */
+ #define FAN_NS_CTRL BIT(4) /* Bit which determines control is by host or EC */
++#define FAN_CLOCK_TPM (22500*60) /* Ticks per minute for a 22.5 kHz clock */
+
+ enum { /* Fan control constants */
+ fan_status_offset = 0x2f, /* EC register 0x2f */
+@@ -8214,6 +8215,7 @@ static int fan_watchdog_maxinterval;
+
+ static bool fan_with_ns_addr;
+ static bool ecfw_with_fan_dec_rpm;
++static bool fan_speed_in_tpr;
+
+ static struct mutex fan_mutex;
+
+@@ -8396,8 +8398,11 @@ static int fan_get_speed(unsigned int *speed)
+ !acpi_ec_read(fan_rpm_offset + 1, &hi)))
+ return -EIO;
+
+- if (likely(speed))
++ if (likely(speed)) {
+ *speed = (hi << 8) | lo;
++ if (fan_speed_in_tpr && *speed != 0)
++ *speed = FAN_CLOCK_TPM / *speed;
++ }
+ break;
+ case TPACPI_FAN_RD_TPEC_NS:
+ if (!acpi_ec_read(fan_rpm_status_ns, &lo))
+@@ -8430,8 +8435,11 @@ static int fan2_get_speed(unsigned int *speed)
+ if (rc)
+ return -EIO;
+
+- if (likely(speed))
++ if (likely(speed)) {
+ *speed = (hi << 8) | lo;
++ if (fan_speed_in_tpr && *speed != 0)
++ *speed = FAN_CLOCK_TPM / *speed;
++ }
+ break;
+
+ case TPACPI_FAN_RD_TPEC_NS:
+@@ -8959,6 +8967,7 @@ static const struct attribute_group fan_driver_attr_group = {
+ #define TPACPI_FAN_NOFAN 0x0008 /* no fan available */
+ #define TPACPI_FAN_NS 0x0010 /* For EC with non-Standard register addresses */
+ #define TPACPI_FAN_DECRPM 0x0020 /* For ECFW's with RPM in register as decimal */
++#define TPACPI_FAN_TPR 0x0040 /* Fan speed is in Ticks Per Revolution */
+
+ static const struct tpacpi_quirk fan_quirk_table[] __initconst = {
+ TPACPI_QEC_IBM('1', 'Y', TPACPI_FAN_Q1),
+@@ -8981,6 +8990,7 @@ static const struct tpacpi_quirk fan_quirk_table[] __initconst = {
+ TPACPI_Q_LNV3('N', '2', 'U', TPACPI_FAN_NS), /* X13 Yoga Gen 2*/
+ TPACPI_Q_LNV3('N', '1', 'O', TPACPI_FAN_NOFAN), /* X1 Tablet (2nd gen) */
+ TPACPI_Q_LNV3('R', '0', 'Q', TPACPI_FAN_DECRPM),/* L480 */
++ TPACPI_Q_LNV('8', 'F', TPACPI_FAN_TPR), /* ThinkPad x120e */
+ };
+
+ static int __init fan_init(struct ibm_init_struct *iibm)
+@@ -9044,6 +9054,8 @@ static int __init fan_init(struct ibm_init_struct *iibm)
+
+ if (quirks & TPACPI_FAN_Q1)
+ fan_quirk1_setup();
++ if (quirks & TPACPI_FAN_TPR)
++ fan_speed_in_tpr = true;
+ /* Try and probe the 2nd fan */
+ tp_features.second_fan = 1; /* needed for get_speed to work */
+ res = fan2_get_speed(&speed);
+--
+2.39.5
+
--- /dev/null
+From 6aceb64e37f1f444c6bf083617681a5621b71478 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Feb 2025 14:39:41 -0500
+Subject: platform/x86: thinkpad_acpi: Support for V9 DYTC platform profiles
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mark Pearson <mpearson-lenovo@squebb.ca>
+
+[ Upstream commit 9cff907cbf8c7fb5345918dbcc7b74a01656f34f ]
+
+Newer Thinkpad AMD platforms are using V9 DYTC and this changes the
+profiles used for PSC mode. Add support for this update.
+Tested on P14s G5 AMD
+
+Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Link: https://lore.kernel.org/r/20250206193953.58365-1-mpearson-lenovo@squebb.ca
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/thinkpad_acpi.c | 34 ++++++++++++++++++----------
+ 1 file changed, 22 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index a8b6f38d344fd..26ca9c453a59c 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -10485,6 +10485,10 @@ static struct ibm_struct proxsensor_driver_data = {
+ #define DYTC_MODE_PSC_BALANCE 5 /* Default mode aka balanced */
+ #define DYTC_MODE_PSC_PERFORM 7 /* High power mode aka performance */
+
++#define DYTC_MODE_PSCV9_LOWPOWER 1 /* Low power mode */
++#define DYTC_MODE_PSCV9_BALANCE 3 /* Default mode aka balanced */
++#define DYTC_MODE_PSCV9_PERFORM 4 /* High power mode aka performance */
++
+ #define DYTC_ERR_MASK 0xF /* Bits 0-3 in cmd result are the error result */
+ #define DYTC_ERR_SUCCESS 1 /* CMD completed successful */
+
+@@ -10505,6 +10509,10 @@ static int dytc_capabilities;
+ static bool dytc_mmc_get_available;
+ static int profile_force;
+
++static int platform_psc_profile_lowpower = DYTC_MODE_PSC_LOWPOWER;
++static int platform_psc_profile_balanced = DYTC_MODE_PSC_BALANCE;
++static int platform_psc_profile_performance = DYTC_MODE_PSC_PERFORM;
++
+ static int convert_dytc_to_profile(int funcmode, int dytcmode,
+ enum platform_profile_option *profile)
+ {
+@@ -10526,19 +10534,15 @@ static int convert_dytc_to_profile(int funcmode, int dytcmode,
+ }
+ return 0;
+ case DYTC_FUNCTION_PSC:
+- switch (dytcmode) {
+- case DYTC_MODE_PSC_LOWPOWER:
++ if (dytcmode == platform_psc_profile_lowpower)
+ *profile = PLATFORM_PROFILE_LOW_POWER;
+- break;
+- case DYTC_MODE_PSC_BALANCE:
++ else if (dytcmode == platform_psc_profile_balanced)
+ *profile = PLATFORM_PROFILE_BALANCED;
+- break;
+- case DYTC_MODE_PSC_PERFORM:
++ else if (dytcmode == platform_psc_profile_performance)
+ *profile = PLATFORM_PROFILE_PERFORMANCE;
+- break;
+- default: /* Unknown mode */
++ else
+ return -EINVAL;
+- }
++
+ return 0;
+ case DYTC_FUNCTION_AMT:
+ /* For now return balanced. It's the closest we have to 'auto' */
+@@ -10559,19 +10563,19 @@ static int convert_profile_to_dytc(enum platform_profile_option profile, int *pe
+ if (dytc_capabilities & BIT(DYTC_FC_MMC))
+ *perfmode = DYTC_MODE_MMC_LOWPOWER;
+ else if (dytc_capabilities & BIT(DYTC_FC_PSC))
+- *perfmode = DYTC_MODE_PSC_LOWPOWER;
++ *perfmode = platform_psc_profile_lowpower;
+ break;
+ case PLATFORM_PROFILE_BALANCED:
+ if (dytc_capabilities & BIT(DYTC_FC_MMC))
+ *perfmode = DYTC_MODE_MMC_BALANCE;
+ else if (dytc_capabilities & BIT(DYTC_FC_PSC))
+- *perfmode = DYTC_MODE_PSC_BALANCE;
++ *perfmode = platform_psc_profile_balanced;
+ break;
+ case PLATFORM_PROFILE_PERFORMANCE:
+ if (dytc_capabilities & BIT(DYTC_FC_MMC))
+ *perfmode = DYTC_MODE_MMC_PERFORM;
+ else if (dytc_capabilities & BIT(DYTC_FC_PSC))
+- *perfmode = DYTC_MODE_PSC_PERFORM;
++ *perfmode = platform_psc_profile_performance;
+ break;
+ default: /* Unknown profile */
+ return -EOPNOTSUPP;
+@@ -10760,6 +10764,7 @@ static int tpacpi_dytc_profile_init(struct ibm_init_struct *iibm)
+ if (output & BIT(DYTC_QUERY_ENABLE_BIT))
+ dytc_version = (output >> DYTC_QUERY_REV_BIT) & 0xF;
+
++ dbg_printk(TPACPI_DBG_INIT, "DYTC version %d\n", dytc_version);
+ /* Check DYTC is enabled and supports mode setting */
+ if (dytc_version < 5)
+ return -ENODEV;
+@@ -10798,6 +10803,11 @@ static int tpacpi_dytc_profile_init(struct ibm_init_struct *iibm)
+ }
+ } else if (dytc_capabilities & BIT(DYTC_FC_PSC)) { /* PSC MODE */
+ pr_debug("PSC is supported\n");
++ if (dytc_version >= 9) { /* update profiles for DYTC 9 and up */
++ platform_psc_profile_lowpower = DYTC_MODE_PSCV9_LOWPOWER;
++ platform_psc_profile_balanced = DYTC_MODE_PSCV9_BALANCE;
++ platform_psc_profile_performance = DYTC_MODE_PSCV9_PERFORM;
++ }
+ } else {
+ dbg_printk(TPACPI_DBG_INIT, "No DYTC support available\n");
+ return -ENODEV;
+--
+2.39.5
+
--- /dev/null
+From 6f9b15b2f3391788815aeaa028adcc2cce4b32f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2025 10:05:54 +0900
+Subject: powercap: call put_device() on an error path in
+ powercap_register_control_type()
+
+From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+
+[ Upstream commit 93c66fbc280747ea700bd6199633d661e3c819b3 ]
+
+powercap_register_control_type() calls device_register(), but does not
+release the refcount of the device when it fails.
+
+Call put_device() before returning an error to balance the refcount.
+
+Since the kfree(control_type) will be done by powercap_release(), remove
+the lines in powercap_register_control_type() before returning the error.
+
+This bug was found by an experimental verifier that I am developing.
+
+Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+Link: https://patch.msgid.link/20250110010554.1583411-1-joe@pf.is.s.u-tokyo.ac.jp
+[ rjw: Changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/powercap/powercap_sys.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c
+index ff736b006198f..fd475e463d1fa 100644
+--- a/drivers/powercap/powercap_sys.c
++++ b/drivers/powercap/powercap_sys.c
+@@ -626,8 +626,7 @@ struct powercap_control_type *powercap_register_control_type(
+ dev_set_name(&control_type->dev, "%s", name);
+ result = device_register(&control_type->dev);
+ if (result) {
+- if (control_type->allocated)
+- kfree(control_type);
++ put_device(&control_type->dev);
+ return ERR_PTR(result);
+ }
+ idr_init(&control_type->idr);
+--
+2.39.5
+
--- /dev/null
+From 068d7c7474b73c6983923d2b2a9069caaac889ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Jan 2025 12:02:55 +0100
+Subject: s390/cio: Fix CHPID "configure" attribute caching
+
+From: Peter Oberparleiter <oberpar@linux.ibm.com>
+
+[ Upstream commit 32ae4a2992529e2c7934e422035fad1d9b0f1fb5 ]
+
+In some environments, the SCLP firmware interface used to query a
+CHPID's configured state is not supported. On these environments,
+rapidly reading the corresponding sysfs attribute produces inconsistent
+results:
+
+ $ cat /sys/devices/css0/chp0.00/configure
+ cat: /sys/devices/css0/chp0.00/configure: Operation not supported
+ $ cat /sys/devices/css0/chp0.00/configure
+ 3
+
+This occurs for example when Linux is run as a KVM guest. The
+inconsistency is a result of CIO using cached results for generating
+the value of the "configure" attribute while failing to handle the
+situation where no data was returned by SCLP.
+
+Fix this by not updating the cache-expiration timestamp when SCLP
+returns no data. With the fix applied, the system response is
+consistent:
+
+ $ cat /sys/devices/css0/chp0.00/configure
+ cat: /sys/devices/css0/chp0.00/configure: Operation not supported
+ $ cat /sys/devices/css0/chp0.00/configure
+ cat: /sys/devices/css0/chp0.00/configure: Operation not supported
+
+Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
+Reviewed-by: Eric Farman <farman@linux.ibm.com>
+Tested-by: Eric Farman <farman@linux.ibm.com>
+Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/cio/chp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/s390/cio/chp.c b/drivers/s390/cio/chp.c
+index 5440f285f3494..7e00c061538db 100644
+--- a/drivers/s390/cio/chp.c
++++ b/drivers/s390/cio/chp.c
+@@ -661,7 +661,8 @@ static int info_update(void)
+ if (time_after(jiffies, chp_info_expires)) {
+ /* Data is too old, update. */
+ rc = sclp_chp_read_info(&chp_info);
+- chp_info_expires = jiffies + CHP_INFO_UPDATE_INTERVAL ;
++ if (!rc)
++ chp_info_expires = jiffies + CHP_INFO_UPDATE_INTERVAL;
+ }
+ mutex_unlock(&info_lock);
+
+--
+2.39.5
+
--- /dev/null
+From 9f185c9fe29122fcdc8fb1587578507aeb840a64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jan 2025 20:53:03 +0100
+Subject: sched: Clarify wake_up_q()'s write to task->wake_q.next
+
+From: Jann Horn <jannh@google.com>
+
+[ Upstream commit bcc6244e13b4d4903511a1ea84368abf925031c0 ]
+
+Clarify that wake_up_q() does an atomic write to task->wake_q.next, after
+which a concurrent __wake_q_add() can immediately overwrite
+task->wake_q.next again.
+
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20250129-sched-wakeup-prettier-v1-1-2f51f5f663fa@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/core.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 9be8a509b5f3f..9b01fdceb6220 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -997,9 +997,10 @@ void wake_up_q(struct wake_q_head *head)
+ struct task_struct *task;
+
+ task = container_of(node, struct task_struct, wake_q);
+- /* Task can safely be re-inserted now: */
+ node = node->next;
+- task->wake_q.next = NULL;
++ /* pairs with cmpxchg_relaxed() in __wake_q_add() */
++ WRITE_ONCE(task->wake_q.next, NULL);
++ /* Task can safely be re-inserted now. */
+
+ /*
+ * wake_up_process() executes a full barrier, which pairs with
+--
+2.39.5
+
--- /dev/null
+From 86d0e9d033ede12f261a1d41df32c7821d474263 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2025 16:35:39 -0500
+Subject: scsi: core: Use GFP_NOIO to avoid circular locking dependency
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rik van Riel <riel@surriel.com>
+
+[ Upstream commit 5363ee9d110e139584c2d92a0b640bc210588506 ]
+
+Filesystems can write to disk from page reclaim with __GFP_FS
+set. Marc found a case where scsi_realloc_sdev_budget_map() ends up in
+page reclaim with GFP_KERNEL, where it could try to take filesystem
+locks again, leading to a deadlock.
+
+WARNING: possible circular locking dependency detected
+6.13.0 #1 Not tainted
+------------------------------------------------------
+kswapd0/70 is trying to acquire lock:
+ffff8881025d5d78 (&q->q_usage_counter(io)){++++}-{0:0}, at: blk_mq_submit_bio+0x461/0x6e0
+
+but task is already holding lock:
+ffffffff81ef5f40 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x9f/0x760
+
+The full lockdep splat can be found in Marc's report:
+
+https://lkml.org/lkml/2025/1/24/1101
+
+Avoid the potential deadlock by doing the allocation with GFP_NOIO, which
+prevents both filesystem and block layer recursion.
+
+Reported-by: Marc Aurèle La France <tsi@tuyoix.net>
+Signed-off-by: Rik van Riel <riel@surriel.com>
+Link: https://lore.kernel.org/r/20250129104525.0ae8421e@fangorn
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_scan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
+index 852d509b19b2b..69288303e6004 100644
+--- a/drivers/scsi/scsi_scan.c
++++ b/drivers/scsi/scsi_scan.c
+@@ -245,7 +245,7 @@ static int scsi_realloc_sdev_budget_map(struct scsi_device *sdev,
+ }
+ ret = sbitmap_init_node(&sdev->budget_map,
+ scsi_device_max_queue_depth(sdev),
+- new_shift, GFP_KERNEL,
++ new_shift, GFP_NOIO,
+ sdev->request_queue->node, false, true);
+ if (!ret)
+ sbitmap_resize(&sdev->budget_map, depth);
+--
+2.39.5
+
--- /dev/null
+From d1b95d7743720e936b23f999d497191427c33e4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Jan 2025 10:49:22 +0100
+Subject: scsi: qla1280: Fix kernel oops when debug level > 2
+
+From: Magnus Lindholm <linmag7@gmail.com>
+
+[ Upstream commit 5233e3235dec3065ccc632729675575dbe3c6b8a ]
+
+A null dereference or oops exception will eventually occur when qla1280.c
+driver is compiled with DEBUG_QLA1280 enabled and ql_debug_level > 2. I
+think its clear from the code that the intention here is sg_dma_len(s) not
+length of sg_next(s) when printing the debug info.
+
+Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
+Link: https://lore.kernel.org/r/20250125095033.26188-1-linmag7@gmail.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla1280.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/qla1280.c b/drivers/scsi/qla1280.c
+index 1e7f4d138e06c..0bb80d135f560 100644
+--- a/drivers/scsi/qla1280.c
++++ b/drivers/scsi/qla1280.c
+@@ -2866,7 +2866,7 @@ qla1280_64bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp)
+ dprintk(3, "S/G Segment phys_addr=%x %x, len=0x%x\n",
+ cpu_to_le32(upper_32_bits(dma_handle)),
+ cpu_to_le32(lower_32_bits(dma_handle)),
+- cpu_to_le32(sg_dma_len(sg_next(s))));
++ cpu_to_le32(sg_dma_len(s)));
+ remseg--;
+ }
+ dprintk(5, "qla1280_64bit_start_scsi: Scatter/gather "
+--
+2.39.5
+
--- /dev/null
+From ca2931ef94942e94e6fc8e99853313913b997d8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Feb 2025 16:12:16 +0800
+Subject: sctp: Fix undefined behavior in left shift operation
+
+From: Yu-Chun Lin <eleanor15x@gmail.com>
+
+[ Upstream commit 606572eb22c1786a3957d24307f5760bb058ca19 ]
+
+According to the C11 standard (ISO/IEC 9899:2011, 6.5.7):
+"If E1 has a signed type and E1 x 2^E2 is not representable in the result
+type, the behavior is undefined."
+
+Shifting 1 << 31 causes signed integer overflow, which leads to undefined
+behavior.
+
+Fix this by explicitly using '1U << 31' to ensure the shift operates on
+an unsigned type, avoiding undefined behavior.
+
+Signed-off-by: Yu-Chun Lin <eleanor15x@gmail.com>
+Link: https://patch.msgid.link/20250218081217.3468369-1-eleanor15x@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/stream.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sctp/stream.c b/net/sctp/stream.c
+index ee6514af830f7..0527728aee986 100644
+--- a/net/sctp/stream.c
++++ b/net/sctp/stream.c
+@@ -735,7 +735,7 @@ struct sctp_chunk *sctp_process_strreset_tsnreq(
+ * value SHOULD be the smallest TSN not acknowledged by the
+ * receiver of the request plus 2^31.
+ */
+- init_tsn = sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map) + (1 << 31);
++ init_tsn = sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map) + (1U << 31);
+ sctp_tsnmap_init(&asoc->peer.tsn_map, SCTP_TSN_MAP_INITIAL,
+ init_tsn, GFP_ATOMIC);
+
+--
+2.39.5
+
net-openvswitch-remove-misbehaving-actions-length-ch.patch
net-mlx5-bridge-fix-the-crash-caused-by-lag-state-ch.patch
net-mlx5e-prevent-bridge-link-show-failure-for-non-e.patch
+nvme-fc-go-straight-to-connecting-state-when-initial.patch
+hrtimers-mark-is_migration_base-with-__always_inline.patch
+powercap-call-put_device-on-an-error-path-in-powerca.patch
+iscsi_ibft-fix-ubsan-shift-out-of-bounds-warning-in-.patch
+scsi-core-use-gfp_noio-to-avoid-circular-locking-dep.patch
+scsi-qla1280-fix-kernel-oops-when-debug-level-2.patch
+acpi-resource-irq-override-for-eluktronics-mech-17.patch
+smb-client-fix-noisy-when-tree-connecting-to-dfs-int.patch
+alpha-elf-fix-misc-setarch-test-of-util-linux-by-rem.patch
+vboxsf-fix-building-with-gcc-15.patch
+hid-intel-ish-hid-fix-the-length-of-mng_sync_fw_cloc.patch
+hid-intel-ish-hid-send-clock-sync-message-immediatel.patch
+hid-ignore-non-functional-sensor-in-hp-5mp-camera.patch
+hid-hid-apple-apple-magic-keyboard-a3203-usb-c-suppo.patch
+hid-apple-fix-up-the-f6-key-on-the-omoton-kb066-keyb.patch
+sched-clarify-wake_up_q-s-write-to-task-wake_q.next.patch
+platform-x86-thinkpad_acpi-fix-invalid-fan-speed-on-.patch
+platform-x86-thinkpad_acpi-support-for-v9-dytc-platf.patch
+s390-cio-fix-chpid-configure-attribute-caching.patch
+thermal-cpufreq_cooling-remove-structure-member-docu.patch
+xen-swiotlb-mark-xen_swiotlb_fixup-__init.patch
+alsa-hda-realtek-limit-mic-boost-on-positivo-arn50.patch
+asoc-rsnd-don-t-indicate-warning-on-rsnd_kctrl_accep.patch
+asoc-rsnd-adjust-convert-rate-limitation.patch
+asoc-arizona-madera-use-fsleep-in-up-down-dapm-event.patch
+asoc-sof-intel-hda-add-softdep-pre-to-snd-hda-codec-.patch
+net-wwan-mhi_wwan_mbim-silence-sequence-number-glitc.patch
+nvme-pci-quirk-acer-fa100-for-non-uniqueue-identifie.patch
+nvme-tcp-add-basic-support-for-the-c2htermreq-pdu.patch
+nvmet-rdma-recheck-queue-state-is-live-in-state-lock.patch
+sctp-fix-undefined-behavior-in-left-shift-operation.patch
+nvme-only-allow-entering-live-from-connecting-state.patch
+asoc-tas2770-fix-volume-scale.patch
+asoc-tas2764-fix-power-control-mask.patch
+asoc-tas2764-set-the-sdout-polarity-correctly.patch
+fuse-don-t-truncate-cached-mutated-symlink.patch
+perf-x86-intel-use-better-start-period-for-frequency.patch
+x86-irq-define-trace-events-conditionally.patch
+mptcp-safety-check-before-fallback.patch
+drm-nouveau-do-not-override-forced-connector-status.patch
+block-fix-kmem_cache-of-name-bio-108-already-exists.patch
--- /dev/null
+From e3be38553592f078af2b555ea6fa86c0a4174679 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Feb 2025 13:22:11 -0300
+Subject: smb: client: fix noisy when tree connecting to DFS interlink targets
+
+From: Paulo Alcantara <pc@manguebit.com>
+
+[ Upstream commit 773dc23ff81838b6f74d7fabba5a441cc6a93982 ]
+
+When the client attempts to tree connect to a domain-based DFS
+namespace from a DFS interlink target, the server will return
+STATUS_BAD_NETWORK_NAME and the following will appear on dmesg:
+
+ CIFS: VFS: BAD_NETWORK_NAME: \\dom\dfs
+
+Since a DFS share might contain several DFS interlinks and they expire
+after 10 minutes, the above message might end up being flooded on
+dmesg when mounting or accessing them.
+
+Print this only once per share.
+
+Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/smb2pdu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c
+index 217d381eb9fea..0ae931e023cee 100644
+--- a/fs/smb/client/smb2pdu.c
++++ b/fs/smb/client/smb2pdu.c
+@@ -1999,7 +1999,7 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
+
+ tcon_error_exit:
+ if (rsp && rsp->hdr.Status == STATUS_BAD_NETWORK_NAME)
+- cifs_tcon_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree);
++ cifs_dbg(VFS | ONCE, "BAD_NETWORK_NAME: %s\n", tree);
+ goto tcon_exit;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 6c0ee4b3bd5009b1a19919ba64283db1d07850b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Feb 2025 09:47:11 +0100
+Subject: thermal/cpufreq_cooling: Remove structure member documentation
+
+From: Daniel Lezcano <daniel.lezcano@linaro.org>
+
+[ Upstream commit a6768c4f92e152265590371975d44c071a5279c7 ]
+
+The structure member documentation refers to a member which does not
+exist any more. Remove it.
+
+Link: https://lore.kernel.org/all/202501220046.h3PMBCti-lkp@intel.com/
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202501220046.h3PMBCti-lkp@intel.com/
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Link: https://patch.msgid.link/20250211084712.2746705-1-daniel.lezcano@linaro.org
+[ rjw: Minor changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/cpufreq_cooling.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/thermal/cpufreq_cooling.c b/drivers/thermal/cpufreq_cooling.c
+index 9f8b438fcf8f8..bac0f52a361bd 100644
+--- a/drivers/thermal/cpufreq_cooling.c
++++ b/drivers/thermal/cpufreq_cooling.c
+@@ -57,8 +57,6 @@ struct time_in_idle {
+ * @max_level: maximum cooling level. One less than total number of valid
+ * cpufreq frequencies.
+ * @em: Reference on the Energy Model of the device
+- * @cdev: thermal_cooling_device pointer to keep track of the
+- * registered cooling device.
+ * @policy: cpufreq policy.
+ * @cooling_ops: cpufreq callbacks to thermal cooling device ops
+ * @idle_time: idle time stats
+--
+2.39.5
+
--- /dev/null
+From 43ddf0651c095b38726c909fb7181ff580545d59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jan 2025 21:56:48 +0530
+Subject: vboxsf: fix building with GCC 15
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Brahmajit Das <brahmajit.xyz@gmail.com>
+
+[ Upstream commit 4e7487245abcbc5a1a1aea54e4d3b33c53804bda ]
+
+Building with GCC 15 results in build error
+fs/vboxsf/super.c:24:54: error: initializer-string for array of ‘unsigned char’ is too long [-Werror=unterminated-string-initialization]
+ 24 | static const unsigned char VBSF_MOUNT_SIGNATURE[4] = "\000\377\376\375";
+ | ^~~~~~~~~~~~~~~~~~
+cc1: all warnings being treated as errors
+
+Due to GCC having enabled -Werror=unterminated-string-initialization[0]
+by default. Separately initializing each array element of
+VBSF_MOUNT_SIGNATURE to ensure NUL termination, thus satisfying GCC 15
+and fixing the build error.
+
+[0]: https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wno-unterminated-string-initialization
+
+Signed-off-by: Brahmajit Das <brahmajit.xyz@gmail.com>
+Link: https://lore.kernel.org/r/20250121162648.1408743-1-brahmajit.xyz@gmail.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/vboxsf/super.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/vboxsf/super.c b/fs/vboxsf/super.c
+index 74952e58cca06..48f33d4994dc8 100644
+--- a/fs/vboxsf/super.c
++++ b/fs/vboxsf/super.c
+@@ -21,7 +21,8 @@
+
+ #define VBOXSF_SUPER_MAGIC 0x786f4256 /* 'VBox' little endian */
+
+-static const unsigned char VBSF_MOUNT_SIGNATURE[4] = "\000\377\376\375";
++static const unsigned char VBSF_MOUNT_SIGNATURE[4] = { '\000', '\377', '\376',
++ '\375' };
+
+ static int follow_symlinks;
+ module_param(follow_symlinks, int, 0444);
+--
+2.39.5
+
--- /dev/null
+From 23ec089b16d0faa0d7feb3f430cabcc9df261913 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Feb 2025 22:32:33 +0100
+Subject: x86/irq: Define trace events conditionally
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 9de7695925d5d2d2085681ba935857246eb2817d ]
+
+When both of X86_LOCAL_APIC and X86_THERMAL_VECTOR are disabled,
+the irq tracing produces a W=1 build warning for the tracing
+definitions:
+
+ In file included from include/trace/trace_events.h:27,
+ from include/trace/define_trace.h:113,
+ from arch/x86/include/asm/trace/irq_vectors.h:383,
+ from arch/x86/kernel/irq.c:29:
+ include/trace/stages/init.h:2:23: error: 'str__irq_vectors__trace_system_name' defined but not used [-Werror=unused-const-variable=]
+
+Make the tracepoints conditional on the same symbosl that guard
+their usage.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20250225213236.3141752-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/irq.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
+index 766ffe3ba3137..439fdb3f5fdf1 100644
+--- a/arch/x86/kernel/irq.c
++++ b/arch/x86/kernel/irq.c
+@@ -23,8 +23,10 @@
+ #include <asm/traps.h>
+ #include <asm/thermal.h>
+
++#if defined(CONFIG_X86_LOCAL_APIC) || defined(CONFIG_X86_THERMAL_VECTOR)
+ #define CREATE_TRACE_POINTS
+ #include <asm/trace/irq_vectors.h>
++#endif
+
+ DEFINE_PER_CPU_SHARED_ALIGNED(irq_cpustat_t, irq_stat);
+ EXPORT_PER_CPU_SYMBOL(irq_stat);
+--
+2.39.5
+
--- /dev/null
+From 7e8aaf14ecc42d2b5c9eb8222c2d09b074b7e4b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Feb 2025 16:14:38 +0100
+Subject: Xen/swiotlb: mark xen_swiotlb_fixup() __init
+
+From: Jan Beulich <jbeulich@suse.com>
+
+[ Upstream commit 75ad02318af2e4ae669e26a79f001bd5e1f97472 ]
+
+It's sole user (pci_xen_swiotlb_init()) is __init, too.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
+
+Message-ID: <e1198286-99ec-41c1-b5ad-e04e285836c9@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/swiotlb-xen.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
+index 0893c1012de62..fe52c8cbf1364 100644
+--- a/drivers/xen/swiotlb-xen.c
++++ b/drivers/xen/swiotlb-xen.c
+@@ -112,7 +112,7 @@ static int is_xen_swiotlb_buffer(struct device *dev, dma_addr_t dma_addr)
+ }
+
+ #ifdef CONFIG_X86
+-int xen_swiotlb_fixup(void *buf, unsigned long nslabs)
++int __init xen_swiotlb_fixup(void *buf, unsigned long nslabs)
+ {
+ int rc;
+ unsigned int order = get_order(IO_TLB_SEGSIZE << IO_TLB_SHIFT);
+--
+2.39.5
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
