--- /dev/null
+From bda5b7cb4e256a59ce4f9c14da9d35f2ce2ef1e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Mar 2025 18:45:36 +0100
+Subject: ASoC: codecs: wm0010: Fix error handling path in wm0010_spi_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit ed92bc5264c4357d4fca292c769ea9967cd3d3b6 ]
+
+Free some resources in the error handling path of the probe, as already
+done in the remove function.
+
+Fixes: e3523e01869d ("ASoC: wm0010: Add initial wm0010 DSP driver")
+Fixes: fd8b96574456 ("ASoC: wm0010: Clear IRQ as wake source and include missing header")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/5139ba1ab8c4c157ce04e56096a0f54a1683195c.1741549792.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm0010.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/wm0010.c b/sound/soc/codecs/wm0010.c
+index edd2cb185c42c..9e67fbfc2ccaf 100644
+--- a/sound/soc/codecs/wm0010.c
++++ b/sound/soc/codecs/wm0010.c
+@@ -920,7 +920,7 @@ static int wm0010_spi_probe(struct spi_device *spi)
+ if (ret) {
+ dev_err(wm0010->dev, "Failed to set IRQ %d as wake source: %d\n",
+ irq, ret);
+- return ret;
++ goto free_irq;
+ }
+
+ if (spi->max_speed_hz)
+@@ -932,9 +932,18 @@ static int wm0010_spi_probe(struct spi_device *spi)
+ &soc_component_dev_wm0010, wm0010_dai,
+ ARRAY_SIZE(wm0010_dai));
+ if (ret < 0)
+- return ret;
++ goto disable_irq_wake;
+
+ return 0;
++
++disable_irq_wake:
++ irq_set_irq_wake(wm0010->irq, 0);
++
++free_irq:
++ if (wm0010->irq)
++ free_irq(wm0010->irq, wm0010);
++
++ return ret;
+ }
+
+ static void wm0010_spi_remove(struct spi_device *spi)
+--
+2.39.5
+
--- /dev/null
+From 1765803837e9a18a48167384e91adc55d658699c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Mar 2025 13:32:54 +0000
+Subject: ASoC: cs42l43: Fix maximum ADC Volume
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit e26f1cfeac6712516bfeed80890da664f4f2e88a ]
+
+The range of ADC volume is -1 -> 3 (-6 to 18dB) so the number of levels
+should actually be 4.
+
+Fixes: fc918cbe874e ("ASoC: cs42l43: Add support for the cs42l43")
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20250306133254.1861046-1-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs42l43.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/cs42l43.c b/sound/soc/codecs/cs42l43.c
+index 83c21c17fb80b..b1969536862ba 100644
+--- a/sound/soc/codecs/cs42l43.c
++++ b/sound/soc/codecs/cs42l43.c
+@@ -1146,7 +1146,7 @@ static const struct snd_kcontrol_new cs42l43_controls[] = {
+
+ SOC_DOUBLE_R_SX_TLV("ADC Volume", CS42L43_ADC_B_CTRL1, CS42L43_ADC_B_CTRL2,
+ CS42L43_ADC_PGA_GAIN_SHIFT,
+- 0xF, 5, cs42l43_adc_tlv),
++ 0xF, 4, cs42l43_adc_tlv),
+
+ SOC_DOUBLE("PDM1 Invert Switch", CS42L43_DMIC_PDM_CTRL,
+ CS42L43_PDM1L_INV_SHIFT, CS42L43_PDM1R_INV_SHIFT, 1, 0),
+--
+2.39.5
+
--- /dev/null
+From 5cc0a96719171a57372075fc71b7d8a73661ccfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Feb 2025 15:14:56 +0000
+Subject: ASoC: ops: Consistently treat platform_max as control value
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit 0eba2a7e858907a746ba69cd002eb9eb4dbd7bf3 ]
+
+This reverts commit 9bdd10d57a88 ("ASoC: ops: Shift tested values in
+snd_soc_put_volsw() by +min"), and makes some additional related
+updates.
+
+There are two ways the platform_max could be interpreted; the maximum
+register value, or the maximum value the control can be set to. The
+patch moved from treating the value as a control value to a register
+one. When the patch was applied it was technically correct as
+snd_soc_limit_volume() also used the register interpretation. However,
+even then most of the other usages treated platform_max as a
+control value, and snd_soc_limit_volume() has since been updated to
+also do so in commit fb9ad24485087 ("ASoC: ops: add correct range
+check for limiting volume"). That patch however, missed updating
+snd_soc_put_volsw() back to the control interpretation, and fixing
+snd_soc_info_volsw_range(). The control interpretation makes more
+sense as limiting is typically done from the machine driver, so it is
+appropriate to use the customer facing representation rather than the
+internal codec representation. Update all the code to consistently use
+this interpretation of platform_max.
+
+Finally, also add some comments to the soc_mixer_control struct to
+hopefully avoid further patches switching between the two approaches.
+
+Fixes: fb9ad24485087 ("ASoC: ops: add correct range check for limiting volume")
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20250228151456.3703342-1-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/sound/soc.h | 5 ++++-
+ sound/soc/soc-ops.c | 15 +++++++--------
+ 2 files changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/include/sound/soc.h b/include/sound/soc.h
+index 4f5d411e3823f..355575c63a130 100644
+--- a/include/sound/soc.h
++++ b/include/sound/soc.h
+@@ -1251,7 +1251,10 @@ void snd_soc_close_delayed_work(struct snd_soc_pcm_runtime *rtd);
+
+ /* mixer control */
+ struct soc_mixer_control {
+- int min, max, platform_max;
++ /* Minimum and maximum specified as written to the hardware */
++ int min, max;
++ /* Limited maximum value specified as presented through the control */
++ int platform_max;
+ int reg, rreg;
+ unsigned int shift, rshift;
+ unsigned int sign_bit;
+diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
+index 19928f098d8dc..b0e4e4168f38d 100644
+--- a/sound/soc/soc-ops.c
++++ b/sound/soc/soc-ops.c
+@@ -337,7 +337,7 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol,
+ if (ucontrol->value.integer.value[0] < 0)
+ return -EINVAL;
+ val = ucontrol->value.integer.value[0];
+- if (mc->platform_max && ((int)val + min) > mc->platform_max)
++ if (mc->platform_max && val > mc->platform_max)
+ return -EINVAL;
+ if (val > max - min)
+ return -EINVAL;
+@@ -350,7 +350,7 @@ int snd_soc_put_volsw(struct snd_kcontrol *kcontrol,
+ if (ucontrol->value.integer.value[1] < 0)
+ return -EINVAL;
+ val2 = ucontrol->value.integer.value[1];
+- if (mc->platform_max && ((int)val2 + min) > mc->platform_max)
++ if (mc->platform_max && val2 > mc->platform_max)
+ return -EINVAL;
+ if (val2 > max - min)
+ return -EINVAL;
+@@ -503,17 +503,16 @@ int snd_soc_info_volsw_range(struct snd_kcontrol *kcontrol,
+ {
+ struct soc_mixer_control *mc =
+ (struct soc_mixer_control *)kcontrol->private_value;
+- int platform_max;
+- int min = mc->min;
++ int max;
+
+- if (!mc->platform_max)
+- mc->platform_max = mc->max;
+- platform_max = mc->platform_max;
++ max = mc->max - mc->min;
++ if (mc->platform_max && mc->platform_max < max)
++ max = mc->platform_max;
+
+ uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
+ uinfo->count = snd_soc_volsw_is_stereo(mc) ? 2 : 1;
+ uinfo->value.integer.min = 0;
+- uinfo->value.integer.max = platform_max - min;
++ uinfo->value.integer.max = max;
+
+ return 0;
+ }
+--
+2.39.5
+
--- /dev/null
+From cd10cc6a89a7c95b50a8ce8dbc249ea83d128d42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Mar 2025 16:04:40 +0800
+Subject: ASoC: rt722-sdca: add missing readable registers
+
+From: Bard Liao <yung-chuan.liao@linux.intel.com>
+
+[ Upstream commit 247fba13416af65b155949bae582d55c310f58b6 ]
+
+SDW_SDCA_CTL(FUNC_NUM_MIC_ARRAY, RT722_SDCA_ENT_FU15,
+RT722_SDCA_CTL_FU_CH_GAIN, CH_01) ... SDW_SDCA_CTL(FUNC_NUM_MIC_ARRAY,
+RT722_SDCA_ENT_FU15, RT722_SDCA_CTL_FU_CH_GAIN, CH_04) are used by the
+"FU15 Boost Volume" control, but not marked as readable.
+And the mbq size are 2 for those registers.
+
+Fixes: 7f5d6036ca005 ("ASoC: rt722-sdca: Add RT722 SDCA driver")
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Shuming Fan <shumingf@realtek.com>
+Link: https://patch.msgid.link/20250310080440.58797-1-yung-chuan.liao@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt722-sdca-sdw.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/soc/codecs/rt722-sdca-sdw.c b/sound/soc/codecs/rt722-sdca-sdw.c
+index 25fc13687bc83..4d3043627bd04 100644
+--- a/sound/soc/codecs/rt722-sdca-sdw.c
++++ b/sound/soc/codecs/rt722-sdca-sdw.c
+@@ -86,6 +86,10 @@ static bool rt722_sdca_mbq_readable_register(struct device *dev, unsigned int re
+ case 0x6100067:
+ case 0x6100070 ... 0x610007c:
+ case 0x6100080:
++ case SDW_SDCA_CTL(FUNC_NUM_MIC_ARRAY, RT722_SDCA_ENT_FU15, RT722_SDCA_CTL_FU_CH_GAIN,
++ CH_01) ...
++ SDW_SDCA_CTL(FUNC_NUM_MIC_ARRAY, RT722_SDCA_ENT_FU15, RT722_SDCA_CTL_FU_CH_GAIN,
++ CH_04):
+ case SDW_SDCA_CTL(FUNC_NUM_MIC_ARRAY, RT722_SDCA_ENT_USER_FU1E, RT722_SDCA_CTL_FU_VOLUME,
+ CH_01):
+ case SDW_SDCA_CTL(FUNC_NUM_MIC_ARRAY, RT722_SDCA_ENT_USER_FU1E, RT722_SDCA_CTL_FU_VOLUME,
+--
+2.39.5
+
--- /dev/null
+From 7130e0d09a2c605883d6efea520327edc4408f1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Mar 2025 19:43:59 +0900
+Subject: block: change blk_mq_add_to_batch() third argument type to bool
+
+From: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+
+[ Upstream commit 9bce6b5f8987678b9c6c1fe433af6b5fe41feadc ]
+
+Commit 1f47ed294a2b ("block: cleanup and fix batch completion adding
+conditions") modified the evaluation criteria for the third argument,
+'ioerror', in the blk_mq_add_to_batch() function. Initially, the
+function had checked if 'ioerror' equals zero. Following the commit, it
+started checking for negative error values, with the presumption that
+such values, for instance -EIO, would be passed in.
+
+However, blk_mq_add_to_batch() callers do not pass negative error
+values. Instead, they pass status codes defined in various ways:
+
+- NVMe PCI and Apple drivers pass NVMe status code
+- virtio_blk driver passes the virtblk request header status byte
+- null_blk driver passes blk_status_t
+
+These codes are either zero or positive, therefore the revised check
+fails to function as intended. Specifically, with the NVMe PCI driver,
+this modification led to the failure of the blktests test case nvme/039.
+In this test scenario, errors are artificially injected to the NVMe
+driver, resulting in positive NVMe status codes passed to
+blk_mq_add_to_batch(), which unexpectedly processes the failed I/O in a
+batch. Hence the failure.
+
+To correct the ioerror check within blk_mq_add_to_batch(), make all
+callers to uniformly pass the argument as boolean. Modify the callers to
+check their specific status codes and pass the boolean value 'is_error'.
+Also describe the arguments of blK_mq_add_to_batch as kerneldoc.
+
+Fixes: 1f47ed294a2b ("block: cleanup and fix batch completion adding conditions")
+Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Link: https://lore.kernel.org/r/20250311104359.1767728-3-shinichiro.kawasaki@wdc.com
+[axboe: fold in documentation update]
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/null_blk/main.c | 4 ++--
+ drivers/block/virtio_blk.c | 5 +++--
+ drivers/nvme/host/apple.c | 3 ++-
+ drivers/nvme/host/pci.c | 5 +++--
+ include/linux/blk-mq.h | 16 ++++++++++++----
+ 5 files changed, 22 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
+index 3c3d8d200abba..f10369ad90f76 100644
+--- a/drivers/block/null_blk/main.c
++++ b/drivers/block/null_blk/main.c
+@@ -1541,8 +1541,8 @@ static int null_poll(struct blk_mq_hw_ctx *hctx, struct io_comp_batch *iob)
+ cmd = blk_mq_rq_to_pdu(req);
+ cmd->error = null_process_cmd(cmd, req_op(req), blk_rq_pos(req),
+ blk_rq_sectors(req));
+- if (!blk_mq_add_to_batch(req, iob, (__force int) cmd->error,
+- blk_mq_end_request_batch))
++ if (!blk_mq_add_to_batch(req, iob, cmd->error != BLK_STS_OK,
++ blk_mq_end_request_batch))
+ blk_mq_end_request(req, cmd->error);
+ nr++;
+ }
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index 5afc8aac62ab9..9515e98292161 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -1207,11 +1207,12 @@ static int virtblk_poll(struct blk_mq_hw_ctx *hctx, struct io_comp_batch *iob)
+
+ while ((vbr = virtqueue_get_buf(vq->vq, &len)) != NULL) {
+ struct request *req = blk_mq_rq_from_pdu(vbr);
++ u8 status = virtblk_vbr_status(vbr);
+
+ found++;
+ if (!blk_mq_complete_request_remote(req) &&
+- !blk_mq_add_to_batch(req, iob, virtblk_vbr_status(vbr),
+- virtblk_complete_batch))
++ !blk_mq_add_to_batch(req, iob, status != VIRTIO_BLK_S_OK,
++ virtblk_complete_batch))
+ virtblk_request_done(req);
+ }
+
+diff --git a/drivers/nvme/host/apple.c b/drivers/nvme/host/apple.c
+index 0bca33dc48cc9..05cd4c4f1ed65 100644
+--- a/drivers/nvme/host/apple.c
++++ b/drivers/nvme/host/apple.c
+@@ -599,7 +599,8 @@ static inline void apple_nvme_handle_cqe(struct apple_nvme_queue *q,
+ }
+
+ if (!nvme_try_complete_req(req, cqe->status, cqe->result) &&
+- !blk_mq_add_to_batch(req, iob, nvme_req(req)->status,
++ !blk_mq_add_to_batch(req, iob,
++ nvme_req(req)->status != NVME_SC_SUCCESS,
+ apple_nvme_complete_batch))
+ apple_nvme_complete_rq(req);
+ }
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index d2eeba15c73b3..0b4ca8e8f9b46 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -1131,8 +1131,9 @@ static inline void nvme_handle_cqe(struct nvme_queue *nvmeq,
+
+ trace_nvme_sq(req, cqe->sq_head, nvmeq->sq_tail);
+ if (!nvme_try_complete_req(req, cqe->status, cqe->result) &&
+- !blk_mq_add_to_batch(req, iob, nvme_req(req)->status,
+- nvme_pci_complete_batch))
++ !blk_mq_add_to_batch(req, iob,
++ nvme_req(req)->status != NVME_SC_SUCCESS,
++ nvme_pci_complete_batch))
+ nvme_pci_complete_rq(req);
+ }
+
+diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
+index 7b19b83349cf8..07af26550a5a9 100644
+--- a/include/linux/blk-mq.h
++++ b/include/linux/blk-mq.h
+@@ -863,12 +863,20 @@ static inline bool blk_mq_is_reserved_rq(struct request *rq)
+ return rq->rq_flags & RQF_RESV;
+ }
+
+-/*
++/**
++ * blk_mq_add_to_batch() - add a request to the completion batch
++ * @req: The request to add to batch
++ * @iob: The batch to add the request
++ * @is_error: Specify true if the request failed with an error
++ * @complete: The completaion handler for the request
++ *
+ * Batched completions only work when there is no I/O error and no special
+ * ->end_io handler.
++ *
++ * Return: true when the request was added to the batch, otherwise false
+ */
+ static inline bool blk_mq_add_to_batch(struct request *req,
+- struct io_comp_batch *iob, int ioerror,
++ struct io_comp_batch *iob, bool is_error,
+ void (*complete)(struct io_comp_batch *))
+ {
+ /*
+@@ -876,7 +884,7 @@ static inline bool blk_mq_add_to_batch(struct request *req,
+ * 1) No batch container
+ * 2) Has scheduler data attached
+ * 3) Not a passthrough request and end_io set
+- * 4) Not a passthrough request and an ioerror
++ * 4) Not a passthrough request and failed with an error
+ */
+ if (!iob)
+ return false;
+@@ -885,7 +893,7 @@ static inline bool blk_mq_add_to_batch(struct request *req,
+ if (!blk_rq_is_passthrough(req)) {
+ if (req->end_io)
+ return false;
+- if (ioerror < 0)
++ if (is_error)
+ return false;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 2b3339b0d4bb210f7fc09e6331935b015a9c3846 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Mar 2025 17:22:04 +0300
+Subject: cifs: Fix integer overflow while processing acdirmax mount option
+
+From: Murad Masimov <m.masimov@mt-integration.ru>
+
+[ Upstream commit 5b29891f91dfb8758baf1e2217bef4b16b2b165b ]
+
+User-provided mount parameter acdirmax of type u32 is intended to have
+an upper limit, but before it is validated, the value is converted from
+seconds to jiffies which can lead to an integer overflow.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 4c9f948142a5 ("cifs: Add new mount parameter "acdirmax" to allow caching directory metadata")
+Signed-off-by: Murad Masimov <m.masimov@mt-integration.ru>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/fs_context.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c
+index 0fae0afa12626..6d7091ddec16e 100644
+--- a/fs/smb/client/fs_context.c
++++ b/fs/smb/client/fs_context.c
+@@ -1291,11 +1291,11 @@ static int smb3_fs_context_parse_param(struct fs_context *fc,
+ ctx->acregmax = HZ * result.uint_32;
+ break;
+ case Opt_acdirmax:
+- ctx->acdirmax = HZ * result.uint_32;
+- if (ctx->acdirmax > CIFS_MAX_ACTIMEO) {
++ if (result.uint_32 > CIFS_MAX_ACTIMEO / HZ) {
+ cifs_errorf(fc, "acdirmax too large\n");
+ goto cifs_parse_mount_err;
+ }
++ ctx->acdirmax = HZ * result.uint_32;
+ break;
+ case Opt_actimeo:
+ if (HZ * result.uint_32 > CIFS_MAX_ACTIMEO) {
+--
+2.39.5
+
--- /dev/null
+From 693bf42db1bf5d6acb825de72017dac3292f8da2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Mar 2025 17:22:03 +0300
+Subject: cifs: Fix integer overflow while processing acregmax mount option
+
+From: Murad Masimov <m.masimov@mt-integration.ru>
+
+[ Upstream commit 7489161b1852390b4413d57f2457cd40b34da6cc ]
+
+User-provided mount parameter acregmax of type u32 is intended to have
+an upper limit, but before it is validated, the value is converted from
+seconds to jiffies which can lead to an integer overflow.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 5780464614f6 ("cifs: Add new parameter "acregmax" for distinct file and directory metadata timeout")
+Signed-off-by: Murad Masimov <m.masimov@mt-integration.ru>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/fs_context.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c
+index 2d307dd03fbc4..0fae0afa12626 100644
+--- a/fs/smb/client/fs_context.c
++++ b/fs/smb/client/fs_context.c
+@@ -1284,11 +1284,11 @@ static int smb3_fs_context_parse_param(struct fs_context *fc,
+ }
+ break;
+ case Opt_acregmax:
+- ctx->acregmax = HZ * result.uint_32;
+- if (ctx->acregmax > CIFS_MAX_ACTIMEO) {
++ if (result.uint_32 > CIFS_MAX_ACTIMEO / HZ) {
+ cifs_errorf(fc, "acregmax too large\n");
+ goto cifs_parse_mount_err;
+ }
++ ctx->acregmax = HZ * result.uint_32;
+ break;
+ case Opt_acdirmax:
+ ctx->acdirmax = HZ * result.uint_32;
+--
+2.39.5
+
--- /dev/null
+From e26b739bf41f2bd2415ec4a47f36e19b785dd859 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Mar 2025 17:22:05 +0300
+Subject: cifs: Fix integer overflow while processing actimeo mount option
+
+From: Murad Masimov <m.masimov@mt-integration.ru>
+
+[ Upstream commit 64f690ee22c99e16084e0e45181b2a1eed2fa149 ]
+
+User-provided mount parameter actimeo of type u32 is intended to have
+an upper limit, but before it is validated, the value is converted from
+seconds to jiffies which can lead to an integer overflow.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 6d20e8406f09 ("cifs: add attribute cache timeout (actimeo) tunable")
+Signed-off-by: Murad Masimov <m.masimov@mt-integration.ru>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/fs_context.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c
+index 6d7091ddec16e..55bc036b243e4 100644
+--- a/fs/smb/client/fs_context.c
++++ b/fs/smb/client/fs_context.c
+@@ -1298,7 +1298,7 @@ static int smb3_fs_context_parse_param(struct fs_context *fc,
+ ctx->acdirmax = HZ * result.uint_32;
+ break;
+ case Opt_actimeo:
+- if (HZ * result.uint_32 > CIFS_MAX_ACTIMEO) {
++ if (result.uint_32 > CIFS_MAX_ACTIMEO / HZ) {
+ cifs_errorf(fc, "timeout too large\n");
+ goto cifs_parse_mount_err;
+ }
+--
+2.39.5
+
--- /dev/null
+From 8327d11fe68ef61d8bd269cccfdcb857c848b117 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Mar 2025 17:22:06 +0300
+Subject: cifs: Fix integer overflow while processing closetimeo mount option
+
+From: Murad Masimov <m.masimov@mt-integration.ru>
+
+[ Upstream commit d5a30fddfe2f2e540f6c43b59cf701809995faef ]
+
+User-provided mount parameter closetimeo of type u32 is intended to have
+an upper limit, but before it is validated, the value is converted from
+seconds to jiffies which can lead to an integer overflow.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 5efdd9122eff ("smb3: allow deferred close timeout to be configurable")
+Signed-off-by: Murad Masimov <m.masimov@mt-integration.ru>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/fs_context.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c
+index 55bc036b243e4..c85285bf730e9 100644
+--- a/fs/smb/client/fs_context.c
++++ b/fs/smb/client/fs_context.c
+@@ -1310,11 +1310,11 @@ static int smb3_fs_context_parse_param(struct fs_context *fc,
+ ctx->acdirmax = ctx->acregmax = HZ * result.uint_32;
+ break;
+ case Opt_closetimeo:
+- ctx->closetimeo = HZ * result.uint_32;
+- if (ctx->closetimeo > SMB3_MAX_DCLOSETIMEO) {
++ if (result.uint_32 > SMB3_MAX_DCLOSETIMEO / HZ) {
+ cifs_errorf(fc, "closetimeo too large\n");
+ goto cifs_parse_mount_err;
+ }
++ ctx->closetimeo = HZ * result.uint_32;
+ break;
+ case Opt_echo_interval:
+ ctx->echo_interval = result.uint_32;
+--
+2.39.5
+
--- /dev/null
+From 5ea4908f78e3c66dcda30a7e82f05cd46c43c72c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Mar 2025 14:20:45 +0300
+Subject: drm/gma500: Add NULL check for pci_gfx_root in mid_get_vbt_data()
+
+From: Ivan Abramov <i.abramov@mt-integration.ru>
+
+[ Upstream commit 9af152dcf1a06f589f44a74da4ad67e365d4db9a ]
+
+Since pci_get_domain_bus_and_slot() can return NULL, add NULL check for
+pci_gfx_root in the mid_get_vbt_data().
+
+This change is similar to the checks implemented in mid_get_fuse_settings()
+and mid_get_pci_revID(), which were introduced by commit 0cecdd818cd7
+("gma500: Final enables for Oaktrail") as "additional minor
+bulletproofing".
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: f910b411053f ("gma500: Add the glue to the various BIOS and firmware interfaces")
+Signed-off-by: Ivan Abramov <i.abramov@mt-integration.ru>
+Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250306112046.17144-1-i.abramov@mt-integration.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/gma500/mid_bios.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/gma500/mid_bios.c b/drivers/gpu/drm/gma500/mid_bios.c
+index 7e76790c6a81f..cba97d7db131d 100644
+--- a/drivers/gpu/drm/gma500/mid_bios.c
++++ b/drivers/gpu/drm/gma500/mid_bios.c
+@@ -279,6 +279,11 @@ static void mid_get_vbt_data(struct drm_psb_private *dev_priv)
+ 0, PCI_DEVFN(2, 0));
+ int ret = -1;
+
++ if (pci_gfx_root == NULL) {
++ WARN_ON(1);
++ return;
++ }
++
+ /* Get the address of the platform config vbt */
+ pci_read_config_dword(pci_gfx_root, 0xFC, &addr);
+ pci_dev_put(pci_gfx_root);
+--
+2.39.5
+
--- /dev/null
+From f8a5c5d76a770c068c5a9095658d5d18cef03a5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Mar 2025 13:08:27 -0800
+Subject: drm/i915: Increase I915_PARAM_MMAP_GTT_VERSION version to indicate
+ support for partial mmaps
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: José Roberto de Souza <jose.souza@intel.com>
+
+[ Upstream commit a8045e46c508b70fe4b30cc020fd0a2b0709b2e5 ]
+
+Commit 255fc1703e42 ("drm/i915/gem: Calculate object page offset for partial memory mapping")
+was the last patch of several patches fixing multiple partial mmaps.
+But without a bump in I915_PARAM_MMAP_GTT_VERSION there is no clean
+way for UMD to know if it can do multiple partial mmaps.
+
+Fixes: 255fc1703e42 ("drm/i915/gem: Calculate object page offset for partial memory mapping")
+Cc: Andi Shyti <andi.shyti@linux.intel.com>
+Cc: Nirmoy Das <nirmoy.das@intel.com>
+Cc: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
+Signed-off-by: José Roberto de Souza <jose.souza@intel.com>
+Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250306210827.171147-1-jose.souza@intel.com
+(cherry picked from commit bfef148f3680e6b9d28e7fca46d9520f80c5e50e)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gem/i915_gem_mman.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/gem/i915_gem_mman.c b/drivers/gpu/drm/i915/gem/i915_gem_mman.c
+index 21274aa9bdddc..c3dabb8579605 100644
+--- a/drivers/gpu/drm/i915/gem/i915_gem_mman.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_mman.c
+@@ -164,6 +164,9 @@ static unsigned int tile_row_pages(const struct drm_i915_gem_object *obj)
+ * 4 - Support multiple fault handlers per object depending on object's
+ * backing storage (a.k.a. MMAP_OFFSET).
+ *
++ * 5 - Support multiple partial mmaps(mmap part of BO + unmap a offset, multiple
++ * times with different size and offset).
++ *
+ * Restrictions:
+ *
+ * * snoopable objects cannot be accessed via the GTT. It can cause machine
+@@ -191,7 +194,7 @@ static unsigned int tile_row_pages(const struct drm_i915_gem_object *obj)
+ */
+ int i915_gem_mmap_gtt_version(void)
+ {
+- return 4;
++ return 5;
+ }
+
+ static inline struct i915_gtt_view
+--
+2.39.5
+
--- /dev/null
+From ec55c69e806340014db8a3a03c7eed7c15d1056f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Feb 2025 10:27:54 +0530
+Subject: drm/xe: cancel pending job timer before freeing scheduler
+
+From: Tejas Upadhyay <tejas.upadhyay@intel.com>
+
+[ Upstream commit 12c2f962fe71f390951d9242725bc7e608f55927 ]
+
+The async call to __guc_exec_queue_fini_async frees the scheduler
+while a submission may time out and restart. To prevent this race
+condition, the pending job timer should be canceled before freeing
+the scheduler.
+
+V3(MattB):
+ - Adjust position of cancel pending job
+ - Remove gitlab issue# from commit message
+V2(MattB):
+ - Cancel pending jobs before scheduler finish
+
+Fixes: a20c75dba192 ("drm/xe: Call __guc_exec_queue_fini_async direct for KERNEL exec_queues")
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250225045754.600905-1-tejas.upadhyay@intel.com
+Signed-off-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
+(cherry picked from commit 18fbd567e75f9b97b699b2ab4f1fa76b7cf268f6)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Stable-dep-of: 10c7988418d8 ("drm/xe: Release guc ids before cancelling work")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_guc_submit.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
+index 6f4a9812b4f4a..fe17e9ba86725 100644
+--- a/drivers/gpu/drm/xe/xe_guc_submit.c
++++ b/drivers/gpu/drm/xe/xe_guc_submit.c
+@@ -1238,6 +1238,8 @@ static void __guc_exec_queue_fini_async(struct work_struct *w)
+
+ if (xe_exec_queue_is_lr(q))
+ cancel_work_sync(&ge->lr_tdr);
++ /* Confirm no work left behind accessing device structures */
++ cancel_delayed_work_sync(&ge->sched.base.work_tdr);
+ release_guc_id(guc, q);
+ xe_sched_entity_fini(&ge->entity);
+ xe_sched_fini(&ge->sched);
+--
+2.39.5
+
--- /dev/null
+From 820acc44728343b37810d1acd9251ffbaec83e67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Mar 2025 19:56:35 -0500
+Subject: drm/xe/pm: Temporarily disable D3Cold on BMG
+
+From: Rodrigo Vivi <rodrigo.vivi@intel.com>
+
+[ Upstream commit 3e331a6715ee26f2fabc59dad6bb36d810707028 ]
+
+Currently, many instability cases related to D3Cold -> D0 transition
+on BMG are under investigation. Among them some bad cases where
+the device is lost after 1 to 3 transitions from D3Cold to D0
+on the runtime pm, with pcieport upstream bridge port link retrain
+failure.
+
+In other cases, it works fine, but with some sudden random memory
+corruptions after D3cold, that could be 0xffff missed ack on GT
+forcewake or GuC reload related failures.
+
+In some other cases though, D3Cold -> D0 works pretty reliably.
+It looks like it is a combination of GPU cards and Host boards at
+this point. So, there is no possible/available quirk at this time.
+
+This patch disables the D3Cold by default on BMG by reducing the
+vram_d3cold_threshold to 0. Users and developers who wants to enable
+it are still able to via
+$ echo 300 > /sys/bus/pci/devices/<addr>/vram_d3cold_threshold
+
+Fixes: 3adcf970dc7e ("drm/xe/bmg: Drop force_probe requirement")
+Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4037
+Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4395
+Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4396
+Cc: Karthik Poosa <karthik.poosa@intel.com>
+Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250308005636.1475420-1-rodrigo.vivi@intel.com
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+(cherry picked from commit d945cc876277851053c0cf37927c8d7bd9d0e880)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_pm.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_pm.c b/drivers/gpu/drm/xe/xe_pm.c
+index 40f7c844ed44a..f13bccfa09e2c 100644
+--- a/drivers/gpu/drm/xe/xe_pm.c
++++ b/drivers/gpu/drm/xe/xe_pm.c
+@@ -266,6 +266,15 @@ int xe_pm_init_early(struct xe_device *xe)
+ }
+ ALLOW_ERROR_INJECTION(xe_pm_init_early, ERRNO); /* See xe_pci_probe() */
+
++static u32 vram_threshold_value(struct xe_device *xe)
++{
++ /* FIXME: D3Cold temporarily disabled by default on BMG */
++ if (xe->info.platform == XE_BATTLEMAGE)
++ return 0;
++
++ return DEFAULT_VRAM_THRESHOLD;
++}
++
+ /**
+ * xe_pm_init - Initialize Xe Power Management
+ * @xe: xe device instance
+@@ -276,6 +285,7 @@ ALLOW_ERROR_INJECTION(xe_pm_init_early, ERRNO); /* See xe_pci_probe() */
+ */
+ int xe_pm_init(struct xe_device *xe)
+ {
++ u32 vram_threshold;
+ int err;
+
+ /* For now suspend/resume is only allowed with GuC */
+@@ -289,7 +299,8 @@ int xe_pm_init(struct xe_device *xe)
+ if (err)
+ return err;
+
+- err = xe_pm_set_vram_threshold(xe, DEFAULT_VRAM_THRESHOLD);
++ vram_threshold = vram_threshold_value(xe);
++ err = xe_pm_set_vram_threshold(xe, vram_threshold);
+ if (err)
+ return err;
+ }
+--
+2.39.5
+
--- /dev/null
+From 7b990100e4685d2d3dceb292258f7c08c6017c05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Mar 2025 18:42:11 +0530
+Subject: drm/xe: Release guc ids before cancelling work
+
+From: Tejas Upadhyay <tejas.upadhyay@intel.com>
+
+[ Upstream commit 10c7988418d8f759ba70c4a558961e0bfa74647f ]
+
+A GT resets can be occurring in parallel while cancelling
+work in async call which can requeue these workers.
+to avoid that, lets first release guc ids and then cancel
+work so they don't requeued.
+
+Fixes: 8ae8a2e8dd21 ("drm/xe: Long running job update")
+Fixes: 12c2f962fe71 ("drm/xe: cancel pending job timer before freeing scheduler")
+Signed-off-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
+Suggested-by: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250306131211.975503-1-tejas.upadhyay@intel.com
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+(cherry picked from commit 8e8d76f62329127b31c64a034b052fb9e30e92af)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_guc_submit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
+index fe17e9ba86725..d2b1fce121a84 100644
+--- a/drivers/gpu/drm/xe/xe_guc_submit.c
++++ b/drivers/gpu/drm/xe/xe_guc_submit.c
+@@ -1236,11 +1236,11 @@ static void __guc_exec_queue_fini_async(struct work_struct *w)
+ xe_pm_runtime_get(guc_to_xe(guc));
+ trace_xe_exec_queue_destroy(q);
+
++ release_guc_id(guc, q);
+ if (xe_exec_queue_is_lr(q))
+ cancel_work_sync(&ge->lr_tdr);
+ /* Confirm no work left behind accessing device structures */
+ cancel_delayed_work_sync(&ge->sched.base.work_tdr);
+- release_guc_id(guc, q);
+ xe_sched_entity_fini(&ge->entity);
+ xe_sched_fini(&ge->sched);
+
+--
+2.39.5
+
--- /dev/null
+From cd462558ffcfe523bd383bdeccf91f8b5b39c32e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Mar 2025 11:01:09 +0100
+Subject: drm/xe/userptr: Fix an incorrect assert
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+
+[ Upstream commit 9106713bd2ab0cacd380cda0d3f0219f2e488086 ]
+
+The assert incorrectly checks the total length processed which
+can in fact be greater than the number of pages. Fix.
+
+Fixes: 0a98219bcc96 ("drm/xe/hmm: Don't dereference struct page pointers without notifier lock")
+Cc: Matthew Auld <matthew.auld@intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Reviewed-by: Matthew Auld <matthew.auld@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250307100109.21397-1-thomas.hellstrom@linux.intel.com
+(cherry picked from commit 70e5043ba85eae199b232e39921abd706b5c1fa4)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_hmm.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_hmm.c b/drivers/gpu/drm/xe/xe_hmm.c
+index d7a9408b3a97c..f6bc4f29d7538 100644
+--- a/drivers/gpu/drm/xe/xe_hmm.c
++++ b/drivers/gpu/drm/xe/xe_hmm.c
+@@ -138,13 +138,17 @@ static int xe_build_sg(struct xe_device *xe, struct hmm_range *range,
+ i += size;
+
+ if (unlikely(j == st->nents - 1)) {
++ xe_assert(xe, i >= npages);
+ if (i > npages)
+ size -= (i - npages);
++
+ sg_mark_end(sgl);
++ } else {
++ xe_assert(xe, i < npages);
+ }
++
+ sg_set_page(sgl, page, size << PAGE_SHIFT, 0);
+ }
+- xe_assert(xe, i == npages);
+
+ return dma_map_sgtable(dev, st, write ? DMA_BIDIRECTIONAL : DMA_TO_DEVICE,
+ DMA_ATTR_SKIP_CPU_SYNC | DMA_ATTR_NO_KERNEL_MAPPING);
+--
+2.39.5
+
--- /dev/null
+From d6f8c2470e41db96ad446c37840f5cfd75cbe29f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Mar 2025 15:31:43 +0100
+Subject: gpio: cdev: use raw notifier for line state events
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit dcb73cbaaeb39c9fd00bf2e019f911725945e2fe ]
+
+We use a notifier to implement the mechanism of informing the user-space
+about changes in GPIO line status. We register with the notifier when
+the GPIO character device file is opened and unregister when the last
+reference to the associated file descriptor is dropped.
+
+Since commit fcc8b637c542 ("gpiolib: switch the line state notifier to
+atomic") we use the atomic notifier variant. Atomic notifiers call
+rcu_synchronize in atomic_notifier_chain_unregister() which caused a
+significant performance regression in some circumstances, observed by
+user-space when calling close() on the GPIO device file descriptor.
+
+Replace the atomic notifier with the raw variant and provide
+synchronization with a read-write spinlock.
+
+Fixes: fcc8b637c542 ("gpiolib: switch the line state notifier to atomic")
+Reported-by: David Jander <david@protonic.nl>
+Closes: https://lore.kernel.org/all/20250311110034.53959031@erd003.prtnl/
+Tested-by: David Jander <david@protonic.nl>
+Tested-by: Kent Gibson <warthog618@gmail.com>
+Link: https://lore.kernel.org/r/20250311-gpiolib-line-state-raw-notifier-v2-1-138374581e1e@linaro.org
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-cdev.c | 15 +++++++++------
+ drivers/gpio/gpiolib.c | 8 +++++---
+ drivers/gpio/gpiolib.h | 5 ++++-
+ 3 files changed, 18 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c
+index 40f76a90fd7db..107d75558b5a8 100644
+--- a/drivers/gpio/gpiolib-cdev.c
++++ b/drivers/gpio/gpiolib-cdev.c
+@@ -2729,8 +2729,9 @@ static int gpio_chrdev_open(struct inode *inode, struct file *file)
+ cdev->gdev = gpio_device_get(gdev);
+
+ cdev->lineinfo_changed_nb.notifier_call = lineinfo_changed_notify;
+- ret = atomic_notifier_chain_register(&gdev->line_state_notifier,
+- &cdev->lineinfo_changed_nb);
++ scoped_guard(write_lock_irqsave, &gdev->line_state_lock)
++ ret = raw_notifier_chain_register(&gdev->line_state_notifier,
++ &cdev->lineinfo_changed_nb);
+ if (ret)
+ goto out_free_bitmap;
+
+@@ -2754,8 +2755,9 @@ static int gpio_chrdev_open(struct inode *inode, struct file *file)
+ blocking_notifier_chain_unregister(&gdev->device_notifier,
+ &cdev->device_unregistered_nb);
+ out_unregister_line_notifier:
+- atomic_notifier_chain_unregister(&gdev->line_state_notifier,
+- &cdev->lineinfo_changed_nb);
++ scoped_guard(write_lock_irqsave, &gdev->line_state_lock)
++ raw_notifier_chain_unregister(&gdev->line_state_notifier,
++ &cdev->lineinfo_changed_nb);
+ out_free_bitmap:
+ gpio_device_put(gdev);
+ bitmap_free(cdev->watched_lines);
+@@ -2779,8 +2781,9 @@ static int gpio_chrdev_release(struct inode *inode, struct file *file)
+
+ blocking_notifier_chain_unregister(&gdev->device_notifier,
+ &cdev->device_unregistered_nb);
+- atomic_notifier_chain_unregister(&gdev->line_state_notifier,
+- &cdev->lineinfo_changed_nb);
++ scoped_guard(write_lock_irqsave, &gdev->line_state_lock)
++ raw_notifier_chain_unregister(&gdev->line_state_notifier,
++ &cdev->lineinfo_changed_nb);
+ bitmap_free(cdev->watched_lines);
+ gpio_device_put(gdev);
+ kfree(cdev);
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 19878bc75e94c..2509b723b34db 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -1025,7 +1025,8 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data,
+ }
+ }
+
+- ATOMIC_INIT_NOTIFIER_HEAD(&gdev->line_state_notifier);
++ rwlock_init(&gdev->line_state_lock);
++ RAW_INIT_NOTIFIER_HEAD(&gdev->line_state_notifier);
+ BLOCKING_INIT_NOTIFIER_HEAD(&gdev->device_notifier);
+
+ ret = init_srcu_struct(&gdev->srcu);
+@@ -4171,8 +4172,9 @@ EXPORT_SYMBOL_GPL(gpiod_set_array_value_cansleep);
+
+ void gpiod_line_state_notify(struct gpio_desc *desc, unsigned long action)
+ {
+- atomic_notifier_call_chain(&desc->gdev->line_state_notifier,
+- action, desc);
++ guard(read_lock_irqsave)(&desc->gdev->line_state_lock);
++
++ raw_notifier_call_chain(&desc->gdev->line_state_notifier, action, desc);
+ }
+
+ /**
+diff --git a/drivers/gpio/gpiolib.h b/drivers/gpio/gpiolib.h
+index 147156ec502b2..c129a03e20408 100644
+--- a/drivers/gpio/gpiolib.h
++++ b/drivers/gpio/gpiolib.h
+@@ -16,6 +16,7 @@
+ #include <linux/gpio/driver.h>
+ #include <linux/module.h>
+ #include <linux/notifier.h>
++#include <linux/spinlock.h>
+ #include <linux/srcu.h>
+ #include <linux/workqueue.h>
+
+@@ -45,6 +46,7 @@
+ * @list: links gpio_device:s together for traversal
+ * @line_state_notifier: used to notify subscribers about lines being
+ * requested, released or reconfigured
++ * @line_state_lock: RW-spinlock protecting the line state notifier
+ * @line_state_wq: used to emit line state events from a separate thread in
+ * process context
+ * @device_notifier: used to notify character device wait queues about the GPIO
+@@ -72,7 +74,8 @@ struct gpio_device {
+ const char *label;
+ void *data;
+ struct list_head list;
+- struct atomic_notifier_head line_state_notifier;
++ struct raw_notifier_head line_state_notifier;
++ rwlock_t line_state_lock;
+ struct workqueue_struct *line_state_wq;
+ struct blocking_notifier_head device_notifier;
+ struct srcu_struct srcu;
+--
+2.39.5
+
--- /dev/null
+From 40363b57751dbb61875fc4302231943c871b3a22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Mar 2025 19:43:58 +0900
+Subject: nvme: move error logging from nvme_end_req() to __nvme_end_req()
+
+From: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+
+[ Upstream commit e5c2bcc0cd47321d78bb4e865d7857304139f95d ]
+
+Before the Commit 1f47ed294a2b ("block: cleanup and fix batch completion
+adding conditions"), blk_mq_add_to_batch() did not add failed
+passthrough requests to batch, and returned false. After the commit,
+blk_mq_add_to_batch() always adds passthrough requests to batch
+regardless of whether the request failed or not, and returns true. This
+affected error logging feature in the NVME driver.
+
+Before the commit, the call chain of failed passthrough request was as
+follows:
+
+nvme_handle_cqe()
+ blk_mq_add_to_batch() .. false is returned, then call nvme_pci_complete_rq()
+ nvme_pci_complete_rq()
+ nvme_complete_rq()
+ nvme_end_req()
+ nvme_log_err_passthru() .. error logging
+ __nvme_end_req() .. end of the rqeuest
+
+After the commit, the call chain is as follows:
+
+nvme_handle_cqe()
+ blk_mq_add_to_batch() .. true is returned, then set nvme_pci_complete_batch()
+ ..
+ nvme_pci_complete_batch()
+ nvme_complete_batch()
+ nvme_complete_batch_req()
+ __nvme_end_req() .. end of the request, without error logging
+
+To make the error logging feature work again for passthrough requests, move the
+nvme_log_err_passthru() call from nvme_end_req() to __nvme_end_req().
+
+While at it, move nvme_log_error() call for non-passthrough requests together
+with nvme_log_err_passthru(). Even though the trigger commit does not affect
+non-passthrough requests, move it together for code simplicity.
+
+Fixes: 1f47ed294a2b ("block: cleanup and fix batch completion adding conditions")
+Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20250311104359.1767728-2-shinichiro.kawasaki@wdc.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index cf0e7c6d5502b..e4034cec59237 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -431,6 +431,12 @@ static inline void nvme_end_req_zoned(struct request *req)
+
+ static inline void __nvme_end_req(struct request *req)
+ {
++ if (unlikely(nvme_req(req)->status && !(req->rq_flags & RQF_QUIET))) {
++ if (blk_rq_is_passthrough(req))
++ nvme_log_err_passthru(req);
++ else
++ nvme_log_error(req);
++ }
+ nvme_end_req_zoned(req);
+ nvme_trace_bio_complete(req);
+ if (req->cmd_flags & REQ_NVME_MPATH)
+@@ -441,12 +447,6 @@ void nvme_end_req(struct request *req)
+ {
+ blk_status_t status = nvme_error_status(nvme_req(req)->status);
+
+- if (unlikely(nvme_req(req)->status && !(req->rq_flags & RQF_QUIET))) {
+- if (blk_rq_is_passthrough(req))
+- nvme_log_err_passthru(req);
+- else
+- nvme_log_error(req);
+- }
+ __nvme_end_req(req);
+ blk_mq_end_request(req, status);
+ }
+--
+2.39.5
+
--- /dev/null
+From 100e541c40c4fc090fd38b8ed3c03204ceaca4b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Feb 2025 21:07:53 +0000
+Subject: rust: error: add missing newline to pr_warn! calls
+
+From: Alban Kurti <kurti@invicto.ai>
+
+[ Upstream commit 6f5c36f56d475732981dcf624e0ac0cc7c8984c8 ]
+
+Added missing newline at the end of pr_warn! usage
+so the log is not missed.
+
+Fixes: 6551a7fe0acb ("rust: error: Add Error::from_errno{_unchecked}()")
+Reported-by: Miguel Ojeda <ojeda@kernel.org>
+Link: https://github.com/Rust-for-Linux/linux/issues/1139
+Signed-off-by: Alban Kurti <kurti@invicto.ai>
+Link: https://lore.kernel.org/r/20250206-printing_fix-v3-2-a85273b501ae@invicto.ai
+[ Replaced Closes with Link since it fixes part of the issue. - Miguel ]
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ rust/kernel/error.rs | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/rust/kernel/error.rs b/rust/kernel/error.rs
+index 5fece574ec023..4911b294bfe66 100644
+--- a/rust/kernel/error.rs
++++ b/rust/kernel/error.rs
+@@ -104,7 +104,7 @@ impl Error {
+ if errno < -(bindings::MAX_ERRNO as i32) || errno >= 0 {
+ // TODO: Make it a `WARN_ONCE` once available.
+ crate::pr_warn!(
+- "attempted to create `Error` with out of range `errno`: {}",
++ "attempted to create `Error` with out of range `errno`: {}\n",
+ errno
+ );
+ return code::EINVAL;
+--
+2.39.5
+
--- /dev/null
+From 495508e6b169c73d105138b1442ba18d3dfac5f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Feb 2025 21:07:54 +0000
+Subject: rust: init: add missing newline to pr_info! calls
+
+From: Alban Kurti <kurti@invicto.ai>
+
+[ Upstream commit 6933c1067fe6df8ddb34dd68bdb2aa172cbd08c8 ]
+
+Several pr_info! calls in rust/kernel/init.rs (both in code examples
+and macro documentation) were missing a newline, causing logs to
+run together. This commit updates these calls to include a trailing
+newline, improving readability and consistency with the C side.
+
+Fixes: 6841d45a3030 ("rust: init: add `stack_pin_init!` macro")
+Fixes: 7f8977a7fe6d ("rust: init: add `{pin_}chain` functions to `{Pin}Init<T, E>`")
+Fixes: d0fdc3961270 ("rust: init: add `PinnedDrop` trait and macros")
+Fixes: 4af84c6a85c6 ("rust: init: update expanded macro explanation")
+Reported-by: Miguel Ojeda <ojeda@kernel.org>
+Link: https://github.com/Rust-for-Linux/linux/issues/1139
+Signed-off-by: Alban Kurti <kurti@invicto.ai>
+Link: https://lore.kernel.org/r/20250206-printing_fix-v3-3-a85273b501ae@invicto.ai
+[ Replaced Closes with Link since it fixes part of the issue. Added
+ one more Fixes tag (still same set of stable kernels). - Miguel ]
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ rust/kernel/init.rs | 12 ++++++------
+ rust/kernel/init/macros.rs | 6 +++---
+ 2 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/rust/kernel/init.rs b/rust/kernel/init.rs
+index d201954bd43f0..90bfb5cb26cd7 100644
+--- a/rust/kernel/init.rs
++++ b/rust/kernel/init.rs
+@@ -259,7 +259,7 @@ pub mod macros;
+ /// },
+ /// }));
+ /// let foo: Pin<&mut Foo> = foo;
+-/// pr_info!("a: {}", &*foo.a.lock());
++/// pr_info!("a: {}\n", &*foo.a.lock());
+ /// ```
+ ///
+ /// # Syntax
+@@ -311,7 +311,7 @@ macro_rules! stack_pin_init {
+ /// }, GFP_KERNEL)?,
+ /// }));
+ /// let foo = foo.unwrap();
+-/// pr_info!("a: {}", &*foo.a.lock());
++/// pr_info!("a: {}\n", &*foo.a.lock());
+ /// ```
+ ///
+ /// ```rust,ignore
+@@ -336,7 +336,7 @@ macro_rules! stack_pin_init {
+ /// x: 64,
+ /// }, GFP_KERNEL)?,
+ /// }));
+-/// pr_info!("a: {}", &*foo.a.lock());
++/// pr_info!("a: {}\n", &*foo.a.lock());
+ /// # Ok::<_, AllocError>(())
+ /// ```
+ ///
+@@ -866,7 +866,7 @@ pub unsafe trait PinInit<T: ?Sized, E = Infallible>: Sized {
+ ///
+ /// impl Foo {
+ /// fn setup(self: Pin<&mut Self>) {
+- /// pr_info!("Setting up foo");
++ /// pr_info!("Setting up foo\n");
+ /// }
+ /// }
+ ///
+@@ -970,7 +970,7 @@ pub unsafe trait Init<T: ?Sized, E = Infallible>: PinInit<T, E> {
+ ///
+ /// impl Foo {
+ /// fn setup(&mut self) {
+- /// pr_info!("Setting up foo");
++ /// pr_info!("Setting up foo\n");
+ /// }
+ /// }
+ ///
+@@ -1318,7 +1318,7 @@ impl<T> InPlaceWrite<T> for UniqueArc<MaybeUninit<T>> {
+ /// #[pinned_drop]
+ /// impl PinnedDrop for Foo {
+ /// fn drop(self: Pin<&mut Self>) {
+-/// pr_info!("Foo is being dropped!");
++/// pr_info!("Foo is being dropped!\n");
+ /// }
+ /// }
+ /// ```
+diff --git a/rust/kernel/init/macros.rs b/rust/kernel/init/macros.rs
+index 1fd146a832416..b7213962a6a5a 100644
+--- a/rust/kernel/init/macros.rs
++++ b/rust/kernel/init/macros.rs
+@@ -45,7 +45,7 @@
+ //! #[pinned_drop]
+ //! impl PinnedDrop for Foo {
+ //! fn drop(self: Pin<&mut Self>) {
+-//! pr_info!("{self:p} is getting dropped.");
++//! pr_info!("{self:p} is getting dropped.\n");
+ //! }
+ //! }
+ //!
+@@ -412,7 +412,7 @@
+ //! #[pinned_drop]
+ //! impl PinnedDrop for Foo {
+ //! fn drop(self: Pin<&mut Self>) {
+-//! pr_info!("{self:p} is getting dropped.");
++//! pr_info!("{self:p} is getting dropped.\n");
+ //! }
+ //! }
+ //! ```
+@@ -423,7 +423,7 @@
+ //! // `unsafe`, full path and the token parameter are added, everything else stays the same.
+ //! unsafe impl ::kernel::init::PinnedDrop for Foo {
+ //! fn drop(self: Pin<&mut Self>, _: ::kernel::init::__internal::OnlyCallFromDrop) {
+-//! pr_info!("{self:p} is getting dropped.");
++//! pr_info!("{self:p} is getting dropped.\n");
+ //! }
+ //! }
+ //! ```
+--
+2.39.5
+
--- /dev/null
+From d313510567e7a9b6ee377024d3595fa89cedaa01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Feb 2025 13:04:16 -0500
+Subject: scripts: generate_rust_analyzer: add missing include_dirs
+
+From: Tamir Duberstein <tamird@gmail.com>
+
+[ Upstream commit d1f928052439cad028438a8b8b34c1f01bc06068 ]
+
+Commit 8c4555ccc55c ("scripts: add `generate_rust_analyzer.py`")
+specified OBJTREE for the bindings crate, and `source.include_dirs` for
+the kernel crate, likely in an attempt to support out-of-source builds
+for those crates where the generated files reside in `objtree` rather
+than `srctree`. This was insufficient because both bits of configuration
+are required for each crate; the result is that rust-analyzer is unable
+to resolve generated files for either crate in an out-of-source build.
+
+ [ Originally we were not using `OBJTREE` in the `kernel` crate, but
+ we did pass the variable anyway, so conceptually it could have been
+ there since then.
+
+ Regarding `include_dirs`, it started in `kernel` before being in
+ mainline because we included the bindings directly there (i.e.
+ there was no `bindings` crate). However, when that crate got
+ created, we moved the `OBJTREE` there but not the `include_dirs`.
+ Nowadays, though, we happen to need the `include_dirs` also in
+ the `kernel` crate for `generated_arch_static_branch_asm.rs` which
+ was not there back then -- Tamir confirms it is indeed required
+ for that reason. - Miguel ]
+
+Add the missing bits to improve the developer experience.
+
+Fixes: 8c4555ccc55c ("scripts: add `generate_rust_analyzer.py`")
+Signed-off-by: Tamir Duberstein <tamird@gmail.com>
+Tested-by: Andreas Hindborg <a.hindborg@kernel.org>
+Link: https://lore.kernel.org/r/20250210-rust-analyzer-bindings-include-v2-1-23dff845edc3@gmail.com
+[ Slightly reworded title. - Miguel ]
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/generate_rust_analyzer.py | 42 +++++++++++++++----------------
+ 1 file changed, 21 insertions(+), 21 deletions(-)
+
+diff --git a/scripts/generate_rust_analyzer.py b/scripts/generate_rust_analyzer.py
+index 8cf278aceba7b..2a64067b09b0c 100755
+--- a/scripts/generate_rust_analyzer.py
++++ b/scripts/generate_rust_analyzer.py
+@@ -90,27 +90,27 @@ def generate_crates(srctree, objtree, sysroot_src, external_src, cfgs):
+ ["core", "compiler_builtins"],
+ )
+
+- append_crate(
+- "bindings",
+- srctree / "rust"/ "bindings" / "lib.rs",
+- ["core"],
+- cfg=cfg,
+- )
+- crates[-1]["env"]["OBJTREE"] = str(objtree.resolve(True))
+-
+- append_crate(
+- "kernel",
+- srctree / "rust" / "kernel" / "lib.rs",
+- ["core", "macros", "build_error", "bindings"],
+- cfg=cfg,
+- )
+- crates[-1]["source"] = {
+- "include_dirs": [
+- str(srctree / "rust" / "kernel"),
+- str(objtree / "rust")
+- ],
+- "exclude_dirs": [],
+- }
++ def append_crate_with_generated(
++ display_name,
++ deps,
++ ):
++ append_crate(
++ display_name,
++ srctree / "rust"/ display_name / "lib.rs",
++ deps,
++ cfg=cfg,
++ )
++ crates[-1]["env"]["OBJTREE"] = str(objtree.resolve(True))
++ crates[-1]["source"] = {
++ "include_dirs": [
++ str(srctree / "rust" / display_name),
++ str(objtree / "rust")
++ ],
++ "exclude_dirs": [],
++ }
++
++ append_crate_with_generated("bindings", ["core"])
++ append_crate_with_generated("kernel", ["core", "macros", "build_error", "bindings"])
+
+ def is_root_crate(build_file, target):
+ try:
+--
+2.39.5
+
--- /dev/null
+From f6a1624cb2067f01c7c26df2cdb63922e9e2eaf7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Feb 2025 12:03:24 -0500
+Subject: scripts: generate_rust_analyzer: add missing macros deps
+
+From: Tamir Duberstein <tamird@gmail.com>
+
+[ Upstream commit 2e0f91aba507a3cb59f7a12fc3ea2b7d4d6675b7 ]
+
+The macros crate has depended on std and proc_macro since its
+introduction in commit 1fbde52bde73 ("rust: add `macros` crate"). These
+dependencies were omitted from commit 8c4555ccc55c ("scripts: add
+`generate_rust_analyzer.py`") resulting in missing go-to-definition and
+autocomplete, and false-positive warnings emitted from rust-analyzer
+such as:
+
+ [{
+ "resource": "/Users/tamird/src/linux/rust/macros/module.rs",
+ "owner": "_generated_diagnostic_collection_name_#1",
+ "code": {
+ "value": "non_snake_case",
+ "target": {
+ "$mid": 1,
+ "path": "/rustc/",
+ "scheme": "https",
+ "authority": "doc.rust-lang.org",
+ "query": "search=non_snake_case"
+ }
+ },
+ "severity": 4,
+ "message": "Variable `None` should have snake_case name, e.g. `none`",
+ "source": "rust-analyzer",
+ "startLineNumber": 123,
+ "startColumn": 17,
+ "endLineNumber": 123,
+ "endColumn": 21
+ }]
+
+Add the missing dependencies to improve the developer experience.
+
+ [ Fiona had a different approach (thanks!) at:
+
+ https://lore.kernel.org/rust-for-linux/20241205115438.234221-1-me@kloenk.dev/
+
+ But Tamir and Fiona agreed to this one. - Miguel ]
+
+Fixes: 8c4555ccc55c ("scripts: add `generate_rust_analyzer.py`")
+Reviewed-by: Fiona Behrens <me@kloenk.dev>
+Diagnosed-by: Chayim Refael Friedman <chayimfr@gmail.com>
+Link: https://github.com/rust-lang/rust-analyzer/issues/17759#issuecomment-2646328275
+Signed-off-by: Tamir Duberstein <tamird@gmail.com>
+Tested-by: Andreas Hindborg <a.hindborg@kernel.org>
+Link: https://lore.kernel.org/r/20250210-rust-analyzer-macros-core-dep-v3-1-45eb4836f218@gmail.com
+[ Removed `return`. Changed tag name. Added Link. Slightly
+ reworded. - Miguel ]
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/generate_rust_analyzer.py | 30 +++++++++++++++++++++---------
+ 1 file changed, 21 insertions(+), 9 deletions(-)
+
+diff --git a/scripts/generate_rust_analyzer.py b/scripts/generate_rust_analyzer.py
+index 09e1d166d8d23..8cf278aceba7b 100755
+--- a/scripts/generate_rust_analyzer.py
++++ b/scripts/generate_rust_analyzer.py
+@@ -49,14 +49,26 @@ def generate_crates(srctree, objtree, sysroot_src, external_src, cfgs):
+ }
+ })
+
+- # First, the ones in `rust/` since they are a bit special.
+- append_crate(
+- "core",
+- sysroot_src / "core" / "src" / "lib.rs",
+- [],
+- cfg=crates_cfgs.get("core", []),
+- is_workspace_member=False,
+- )
++ def append_sysroot_crate(
++ display_name,
++ deps,
++ cfg=[],
++ ):
++ append_crate(
++ display_name,
++ sysroot_src / display_name / "src" / "lib.rs",
++ deps,
++ cfg,
++ is_workspace_member=False,
++ )
++
++ # NB: sysroot crates reexport items from one another so setting up our transitive dependencies
++ # here is important for ensuring that rust-analyzer can resolve symbols. The sources of truth
++ # for this dependency graph are `(sysroot_src / crate / "Cargo.toml" for crate in crates)`.
++ append_sysroot_crate("core", [], cfg=crates_cfgs.get("core", []))
++ append_sysroot_crate("alloc", ["core"])
++ append_sysroot_crate("std", ["alloc", "core"])
++ append_sysroot_crate("proc_macro", ["core", "std"])
+
+ append_crate(
+ "compiler_builtins",
+@@ -67,7 +79,7 @@ def generate_crates(srctree, objtree, sysroot_src, external_src, cfgs):
+ append_crate(
+ "macros",
+ srctree / "rust" / "macros" / "lib.rs",
+- [],
++ ["std", "proc_macro"],
+ is_proc_macro=True,
+ )
+ crates[-1]["proc_macro_dylib_path"] = f"{objtree}/rust/libmacros.so"
+--
+2.39.5
+
--- /dev/null
+From 2eeef93a8bdcef1bf94bf7b723022c361615a5eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Feb 2025 13:04:17 -0500
+Subject: scripts: generate_rust_analyzer: add uapi crate
+
+From: Tamir Duberstein <tamird@gmail.com>
+
+[ Upstream commit a1eb95d6b5f4cf5cc7b081e85e374d1dd98a213b ]
+
+Commit 4e1746656839 ("rust: uapi: Add UAPI crate") did not update
+rust-analyzer to include the new crate.
+
+Add the missing definition to improve the developer experience.
+
+Fixes: 4e1746656839 ("rust: uapi: Add UAPI crate")
+Signed-off-by: Tamir Duberstein <tamird@gmail.com>
+Tested-by: Andreas Hindborg <a.hindborg@kernel.org>
+Link: https://lore.kernel.org/r/20250210-rust-analyzer-bindings-include-v2-2-23dff845edc3@gmail.com
+[ Slightly reworded title. - Miguel ]
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/generate_rust_analyzer.py | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/generate_rust_analyzer.py b/scripts/generate_rust_analyzer.py
+index 2a64067b09b0c..d1f5adbf33f91 100755
+--- a/scripts/generate_rust_analyzer.py
++++ b/scripts/generate_rust_analyzer.py
+@@ -110,7 +110,8 @@ def generate_crates(srctree, objtree, sysroot_src, external_src, cfgs):
+ }
+
+ append_crate_with_generated("bindings", ["core"])
+- append_crate_with_generated("kernel", ["core", "macros", "build_error", "bindings"])
++ append_crate_with_generated("uapi", ["core"])
++ append_crate_with_generated("kernel", ["core", "macros", "build_error", "bindings", "uapi"])
+
+ def is_root_crate(build_file, target):
+ try:
+--
+2.39.5
+
net-phy-nxp-c45-tja11xx-add-tja112x-phy-configuration-errata.patch
net-phy-nxp-c45-tja11xx-add-tja112xb-sgmii-pcs-restart-errata.patch
sched_ext-validate-prev_cpu-in-scx_bpf_select_cpu_dfl.patch
+asoc-ops-consistently-treat-platform_max-as-control-.patch
+rust-error-add-missing-newline-to-pr_warn-calls.patch
+drm-gma500-add-null-check-for-pci_gfx_root-in-mid_ge.patch
+asoc-cs42l43-fix-maximum-adc-volume.patch
+rust-init-add-missing-newline-to-pr_info-calls.patch
+asoc-rt722-sdca-add-missing-readable-registers.patch
+drm-xe-cancel-pending-job-timer-before-freeing-sched.patch
+drm-xe-release-guc-ids-before-cancelling-work.patch
+drm-xe-userptr-fix-an-incorrect-assert.patch
+drm-xe-pm-temporarily-disable-d3cold-on-bmg.patch
+nvme-move-error-logging-from-nvme_end_req-to-__nvme_.patch
+asoc-codecs-wm0010-fix-error-handling-path-in-wm0010.patch
+drm-i915-increase-i915_param_mmap_gtt_version-versio.patch
+scripts-generate_rust_analyzer-add-missing-macros-de.patch
+scripts-generate_rust_analyzer-add-missing-include_d.patch
+scripts-generate_rust_analyzer-add-uapi-crate.patch
+block-change-blk_mq_add_to_batch-third-argument-type.patch
+gpio-cdev-use-raw-notifier-for-line-state-events.patch
+cifs-fix-integer-overflow-while-processing-acregmax-.patch
+cifs-fix-integer-overflow-while-processing-acdirmax-.patch
+cifs-fix-integer-overflow-while-processing-actimeo-m.patch
+cifs-fix-integer-overflow-while-processing-closetime.patch
+x86-vmware-parse-mp-tables-for-sev-snp-enabled-guest.patch
--- /dev/null
+From 177575b6a64150f8ae93a45b3396f15508ce5cdb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Mar 2025 17:31:11 +0000
+Subject: x86/vmware: Parse MP tables for SEV-SNP enabled guests under VMware
+ hypervisors
+
+From: Ajay Kaher <ajay.kaher@broadcom.com>
+
+[ Upstream commit a2ab25529bbcea51b5e01dded79f45aeb94f644a ]
+
+Under VMware hypervisors, SEV-SNP enabled VMs are fundamentally able to boot
+without UEFI, but this regressed a year ago due to:
+
+ 0f4a1e80989a ("x86/sev: Skip ROM range scans and validation for SEV-SNP guests")
+
+In this case, mpparse_find_mptable() has to be called to parse MP
+tables which contains the necessary boot information.
+
+[ mingo: Updated the changelog. ]
+
+Fixes: 0f4a1e80989a ("x86/sev: Skip ROM range scans and validation for SEV-SNP guests")
+Co-developed-by: Ye Li <ye.li@broadcom.com>
+Signed-off-by: Ye Li <ye.li@broadcom.com>
+Signed-off-by: Ajay Kaher <ajay.kaher@broadcom.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Tested-by: Ye Li <ye.li@broadcom.com>
+Reviewed-by: Kevin Loughlin <kevinloughlin@google.com>
+Acked-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/20250313173111.10918-1-ajay.kaher@broadcom.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/vmware.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/x86/kernel/cpu/vmware.c b/arch/x86/kernel/cpu/vmware.c
+index 00189cdeb775f..cb3f900c46fcc 100644
+--- a/arch/x86/kernel/cpu/vmware.c
++++ b/arch/x86/kernel/cpu/vmware.c
+@@ -26,6 +26,7 @@
+ #include <linux/export.h>
+ #include <linux/clocksource.h>
+ #include <linux/cpu.h>
++#include <linux/efi.h>
+ #include <linux/reboot.h>
+ #include <linux/static_call.h>
+ #include <asm/div64.h>
+@@ -429,6 +430,9 @@ static void __init vmware_platform_setup(void)
+ pr_warn("Failed to get TSC freq from the hypervisor\n");
+ }
+
++ if (cc_platform_has(CC_ATTR_GUEST_SEV_SNP) && !efi_enabled(EFI_BOOT))
++ x86_init.mpparse.find_mptable = mpparse_find_mptable;
++
+ vmware_paravirt_ops_setup();
+
+ #ifdef CONFIG_X86_IO_APIC
+--
+2.39.5
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
