--- /dev/null
+From 0c809025c311e8fb57dd71489821450f2f418252 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 17:04:33 +0800
+Subject: ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path
+
+From: Haotian Zhang <vulab@iscas.ac.cn>
+
+[ Upstream commit 5032347c04ba7ff9ba878f262e075d745c06a2a8 ]
+
+When pdacf_config() fails, snd_pdacf_probe() returns the error code
+directly without freeing the sound card resources allocated by
+snd_card_new(), which leads to a memory leak.
+
+Add proper error handling to free the sound card and clear the card
+list entry when pdacf_config() fails.
+
+Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions")
+Suggested-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
+Link: https://patch.msgid.link/20251215090433.211-1-vulab@iscas.ac.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pcmcia/pdaudiocf/pdaudiocf.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf.c b/sound/pcmcia/pdaudiocf/pdaudiocf.c
+index 27d9da6d61e8..3a354616af19 100644
+--- a/sound/pcmcia/pdaudiocf/pdaudiocf.c
++++ b/sound/pcmcia/pdaudiocf/pdaudiocf.c
+@@ -133,7 +133,13 @@ static int snd_pdacf_probe(struct pcmcia_device *link)
+ link->config_index = 1;
+ link->config_regs = PRESENT_OPTION;
+
+- return pdacf_config(link);
++ err = pdacf_config(link);
++ if (err < 0) {
++ card_list[i] = NULL;
++ snd_card_free(card);
++ return err;
++ }
++ return 0;
+ }
+
+
+--
+2.51.0
+
--- /dev/null
+From 7120f1d9b714187babb1623f97193d58b3e9bc0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 10:46:30 +0800
+Subject: ALSA: usb-mixer: us16x08: validate meter packet indices
+
+From: Shipei Qu <qu@darknavy.com>
+
+[ Upstream commit 5526c1c6ba1d0913c7dfcbbd6fe1744ea7c55f1e ]
+
+get_meter_levels_from_urb() parses the 64-byte meter packets sent by
+the device and fills the per-channel arrays meter_level[],
+comp_level[] and master_level[] in struct snd_us16x08_meter_store.
+
+Currently the function derives the channel index directly from the
+meter packet (MUB2(meter_urb, s) - 1) and uses it to index those
+arrays without validating the range. If the packet contains a
+negative or out-of-range channel number, the driver may write past
+the end of these arrays.
+
+Introduce a local channel variable and validate it before updating the
+arrays. We reject negative indices, limit meter_level[] and
+comp_level[] to SND_US16X08_MAX_CHANNELS, and guard master_level[]
+updates with ARRAY_SIZE(master_level).
+
+Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk")
+Reported-by: DARKNAVY (@DarkNavyOrg) <vr@darknavy.com>
+Closes: https://lore.kernel.org/tencent_21C112743C44C1A2517FF219@qq.com
+Signed-off-by: Shipei Qu <qu@darknavy.com>
+Link: https://patch.msgid.link/20251217024630.59576-1-qu@darknavy.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_us16x08.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/sound/usb/mixer_us16x08.c b/sound/usb/mixer_us16x08.c
+index 3959bbad0c4f..723b11cb0c1b 100644
+--- a/sound/usb/mixer_us16x08.c
++++ b/sound/usb/mixer_us16x08.c
+@@ -656,17 +656,25 @@ static void get_meter_levels_from_urb(int s,
+ u8 *meter_urb)
+ {
+ int val = MUC2(meter_urb, s) + (MUC3(meter_urb, s) << 8);
++ int ch = MUB2(meter_urb, s) - 1;
++
++ if (ch < 0)
++ return;
+
+ if (MUA0(meter_urb, s) == 0x61 && MUA1(meter_urb, s) == 0x02 &&
+ MUA2(meter_urb, s) == 0x04 && MUB0(meter_urb, s) == 0x62) {
+- if (MUC0(meter_urb, s) == 0x72)
+- store->meter_level[MUB2(meter_urb, s) - 1] = val;
+- if (MUC0(meter_urb, s) == 0xb2)
+- store->comp_level[MUB2(meter_urb, s) - 1] = val;
++ if (ch < SND_US16X08_MAX_CHANNELS) {
++ if (MUC0(meter_urb, s) == 0x72)
++ store->meter_level[ch] = val;
++ if (MUC0(meter_urb, s) == 0xb2)
++ store->comp_level[ch] = val;
++ }
+ }
+ if (MUA0(meter_urb, s) == 0x61 && MUA1(meter_urb, s) == 0x02 &&
+- MUA2(meter_urb, s) == 0x02 && MUB0(meter_urb, s) == 0x62)
+- store->master_level[MUB2(meter_urb, s) - 1] = val;
++ MUA2(meter_urb, s) == 0x02 && MUB0(meter_urb, s) == 0x62) {
++ if (ch < ARRAY_SIZE(store->master_level))
++ store->master_level[ch] = val;
++ }
+ }
+
+ /* Function to retrieve current meter values from the device.
+--
+2.51.0
+
--- /dev/null
+From a491baa26499b4c22d0f7b5ea5f8033aacc16c1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 12:26:52 +0800
+Subject: ALSA: vxpocket: Fix resource leak in vxpocket_probe error path
+
+From: Haotian Zhang <vulab@iscas.ac.cn>
+
+[ Upstream commit 2a03b40deacbd293ac9aed0f9b11197dad54fe5f ]
+
+When vxpocket_config() fails, vxpocket_probe() returns the error code
+directly without freeing the sound card resources allocated by
+snd_card_new(), which leads to a memory leak.
+
+Add proper error handling to free the sound card and clear the
+allocation bit when vxpocket_config() fails.
+
+Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions")
+Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
+Link: https://patch.msgid.link/20251215042652.695-1-vulab@iscas.ac.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pcmcia/vx/vxpocket.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pcmcia/vx/vxpocket.c b/sound/pcmcia/vx/vxpocket.c
+index afd30a90c807..16081c51b938 100644
+--- a/sound/pcmcia/vx/vxpocket.c
++++ b/sound/pcmcia/vx/vxpocket.c
+@@ -320,7 +320,13 @@ static int vxpocket_probe(struct pcmcia_device *p_dev)
+
+ vxp->p_dev = p_dev;
+
+- return vxpocket_config(p_dev);
++ err = vxpocket_config(p_dev);
++ if (err < 0) {
++ card_alloc &= ~(1 << i);
++ snd_card_free(card);
++ return err;
++ }
++ return 0;
+ }
+
+ static void vxpocket_detach(struct pcmcia_device *link)
+--
+2.51.0
+
--- /dev/null
+From f5462f39425b1f0c2011fe3c021a5e95b411f128 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 16:16:26 +0100
+Subject: clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &
+ pcie_x4
+
+From: Josua Mayer <josua@solid-run.com>
+
+[ Upstream commit f0e6bc0c3ef4b4afb299bd6912586cafd5d864e9 ]
+
+CP110 based platforms rely on the bootloader for pci port
+initialization.
+TF-A actively prevents non-uboot re-configuration of pci lanes, and many
+boards do not have software control over the pci card reset.
+
+If a pci port had link at boot-time and the clock is stopped at a later
+point, the link fails and can not be recovered.
+
+PCI controller driver probe - and by extension ownership of a driver for
+the pci clocks - may be delayed especially on large modular kernels,
+causing the clock core to start disabling unused clocks.
+
+Add the CLK_IGNORE_UNUSED flag to the three pci port's clocks to ensure
+they are not stopped before the pci controller driver has taken
+ownership and tested for an existing link.
+
+This fixes failed pci link detection when controller driver probes late,
+e.g. with arm64 defconfig and CONFIG_PHY_MVEBU_CP110_COMPHY=m.
+
+Closes: https://lore.kernel.org/r/b71596c7-461b-44b6-89ab-3cfbd492639f@solid-run.com
+Signed-off-by: Josua Mayer <josua@solid-run.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/cp110-system-controller.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/clk/mvebu/cp110-system-controller.c b/drivers/clk/mvebu/cp110-system-controller.c
+index 84c8900542e4..b477396917ad 100644
+--- a/drivers/clk/mvebu/cp110-system-controller.c
++++ b/drivers/clk/mvebu/cp110-system-controller.c
+@@ -110,6 +110,25 @@ static const char * const gate_base_names[] = {
+ [CP110_GATE_EIP197] = "eip197"
+ };
+
++static unsigned long gate_flags(const u8 bit_idx)
++{
++ switch (bit_idx) {
++ case CP110_GATE_PCIE_X1_0:
++ case CP110_GATE_PCIE_X1_1:
++ case CP110_GATE_PCIE_X4:
++ /*
++ * If a port had an active link at boot time, stopping
++ * the clock creates a failed state from which controller
++ * driver can not recover.
++ * Prevent stopping this clock till after a driver has taken
++ * ownership.
++ */
++ return CLK_IGNORE_UNUSED;
++ default:
++ return 0;
++ }
++};
++
+ struct cp110_gate_clk {
+ struct clk_hw hw;
+ struct regmap *regmap;
+@@ -171,6 +190,7 @@ static struct clk_hw *cp110_register_gate(const char *name,
+ init.ops = &cp110_gate_ops;
+ init.parent_names = &parent_name;
+ init.num_parents = 1;
++ init.flags = gate_flags(bit_idx);
+
+ gate->regmap = regmap;
+ gate->bit_idx = bit_idx;
+--
+2.51.0
+
--- /dev/null
+From 033e86aba7b87d4da5dbde804105e324b3f63493 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 17:51:10 +0800
+Subject: exfat: fix remount failure in different process environments
+
+From: Yuezhang Mo <Yuezhang.Mo@sony.com>
+
+[ Upstream commit 51fc7b4ce10ccab8ea5e4876bcdc42cf5202a0ef ]
+
+The kernel test robot reported that the exFAT remount operation
+failed. The reason for the failure was that the process's umask
+is different between mount and remount, causing fs_fmask and
+fs_dmask are changed.
+
+Potentially, both gid and uid may also be changed. Therefore, when
+initializing fs_context for remount, inherit these mount options
+from the options used during mount.
+
+Reported-by: kernel test robot <oliver.sang@intel.com>
+Closes: https://lore.kernel.org/oe-lkp/202511251637.81670f5c-lkp@intel.com
+Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exfat/super.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/fs/exfat/super.c b/fs/exfat/super.c
+index dfe298bc3782..b8ddb6fb50e9 100644
+--- a/fs/exfat/super.c
++++ b/fs/exfat/super.c
+@@ -757,10 +757,21 @@ static int exfat_init_fs_context(struct fs_context *fc)
+ ratelimit_state_init(&sbi->ratelimit, DEFAULT_RATELIMIT_INTERVAL,
+ DEFAULT_RATELIMIT_BURST);
+
+- sbi->options.fs_uid = current_uid();
+- sbi->options.fs_gid = current_gid();
+- sbi->options.fs_fmask = current->fs->umask;
+- sbi->options.fs_dmask = current->fs->umask;
++ if (fc->purpose == FS_CONTEXT_FOR_RECONFIGURE && fc->root) {
++ struct super_block *sb = fc->root->d_sb;
++ struct exfat_mount_options *cur_opts = &EXFAT_SB(sb)->options;
++
++ sbi->options.fs_uid = cur_opts->fs_uid;
++ sbi->options.fs_gid = cur_opts->fs_gid;
++ sbi->options.fs_fmask = cur_opts->fs_fmask;
++ sbi->options.fs_dmask = cur_opts->fs_dmask;
++ } else {
++ sbi->options.fs_uid = current_uid();
++ sbi->options.fs_gid = current_gid();
++ sbi->options.fs_fmask = current->fs->umask;
++ sbi->options.fs_dmask = current->fs->umask;
++ }
++
+ sbi->options.allow_utime = -1;
+ sbi->options.iocharset = exfat_default_iocharset;
+ sbi->options.errors = EXFAT_ERRORS_RO;
+--
+2.51.0
+
--- /dev/null
+From 88478308cce6de653256ea26dd15a0fc7ef506d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Oct 2025 09:56:26 +0800
+Subject: firmware: imx: scu-irq: Init workqueue before request mbox channel
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit 81fb53feb66a3aefbf6fcab73bb8d06f5b0c54ad ]
+
+With mailbox channel requested, there is possibility that interrupts may
+come in, so need to make sure the workqueue is initialized before
+the queue is scheduled by mailbox rx callback.
+
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/imx/imx-scu-irq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/imx/imx-scu-irq.c b/drivers/firmware/imx/imx-scu-irq.c
+index 32b1ca4e1050..06c49a61a079 100644
+--- a/drivers/firmware/imx/imx-scu-irq.c
++++ b/drivers/firmware/imx/imx-scu-irq.c
+@@ -148,6 +148,8 @@ int imx_scu_enable_general_irq_channel(struct device *dev)
+ cl->dev = dev;
+ cl->rx_callback = imx_scu_irq_callback;
+
++ INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler);
++
+ /* SCU general IRQ uses general interrupt channel 3 */
+ ch = mbox_request_channel_byname(cl, "gip3");
+ if (IS_ERR(ch)) {
+@@ -157,8 +159,6 @@ int imx_scu_enable_general_irq_channel(struct device *dev)
+ return ret;
+ }
+
+- INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler);
+-
+ if (!of_parse_phandle_with_args(dev->of_node, "mboxes",
+ "#mbox-cells", 0, &spec)) {
+ i = of_alias_get_id(spec.np, "mu");
+--
+2.51.0
+
--- /dev/null
+From a0c04cf2b222d45b6906c6eae4ce0d2ea95a841f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 15:42:38 +0800
+Subject: ipmi: Fix __scan_channels() failing to rescan channels
+
+From: Jinhui Guo <guojinhui.liam@bytedance.com>
+
+[ Upstream commit 6bd30d8fc523fb880b4be548e8501bc0fe8f42d4 ]
+
+channel_handler() sets intf->channels_ready to true but never
+clears it, so __scan_channels() skips any rescan. When the BMC
+firmware changes a rescan is required. Allow it by clearing
+the flag before starting a new scan.
+
+Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
+Message-ID: <20250930074239.2353-3-guojinhui.liam@bytedance.com>
+Signed-off-by: Corey Minyard <corey@minyard.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_msghandler.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index 117454a5603b..a72cd57dd8a5 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -605,7 +605,8 @@ static void __ipmi_bmc_unregister(struct ipmi_smi *intf);
+ static int __ipmi_bmc_register(struct ipmi_smi *intf,
+ struct ipmi_device_id *id,
+ bool guid_set, guid_t *guid, int intf_num);
+-static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id);
++static int __scan_channels(struct ipmi_smi *intf,
++ struct ipmi_device_id *id, bool rescan);
+
+
+ /**
+@@ -2556,7 +2557,7 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc,
+ if (__ipmi_bmc_register(intf, &id, guid_set, &guid, intf_num))
+ need_waiter(intf); /* Retry later on an error. */
+ else
+- __scan_channels(intf, &id);
++ __scan_channels(intf, &id, false);
+
+
+ if (!intf_set) {
+@@ -2576,7 +2577,7 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc,
+ goto out_noprocessing;
+ } else if (memcmp(&bmc->fetch_id, &bmc->id, sizeof(bmc->id)))
+ /* Version info changes, scan the channels again. */
+- __scan_channels(intf, &bmc->fetch_id);
++ __scan_channels(intf, &bmc->fetch_id, true);
+
+ bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY;
+
+@@ -3326,10 +3327,17 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)
+ /*
+ * Must be holding intf->bmc_reg_mutex to call this.
+ */
+-static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id)
++static int __scan_channels(struct ipmi_smi *intf,
++ struct ipmi_device_id *id,
++ bool rescan)
+ {
+ int rv;
+
++ if (rescan) {
++ /* Clear channels_ready to force channels rescan. */
++ intf->channels_ready = false;
++ }
++
+ if (ipmi_version_major(id) > 1
+ || (ipmi_version_major(id) == 1
+ && ipmi_version_minor(id) >= 5)) {
+@@ -3501,7 +3509,7 @@ int ipmi_add_smi(struct module *owner,
+ }
+
+ mutex_lock(&intf->bmc_reg_mutex);
+- rv = __scan_channels(intf, &id);
++ rv = __scan_channels(intf, &id, false);
+ mutex_unlock(&intf->bmc_reg_mutex);
+ if (rv)
+ goto out_err_bmc_reg;
+--
+2.51.0
+
--- /dev/null
+From 19706b832e48b7bfb8f38a62535e98b87ae41b3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 15:42:37 +0800
+Subject: ipmi: Fix the race between __scan_channels() and deliver_response()
+
+From: Jinhui Guo <guojinhui.liam@bytedance.com>
+
+[ Upstream commit 936750fdba4c45e13bbd17f261bb140dd55f5e93 ]
+
+The race window between __scan_channels() and deliver_response() causes
+the parameters of some channels to be set to 0.
+
+1.[CPUA] __scan_channels() issues an IPMI request and waits with
+ wait_event() until all channels have been scanned.
+ wait_event() internally calls might_sleep(), which might
+ yield the CPU. (Moreover, an interrupt can preempt
+ wait_event() and force the task to yield the CPU.)
+2.[CPUB] deliver_response() is invoked when the CPU receives the
+ IPMI response. After processing a IPMI response,
+ deliver_response() directly assigns intf->wchannels to
+ intf->channel_list and sets intf->channels_ready to true.
+ However, not all channels are actually ready for use.
+3.[CPUA] Since intf->channels_ready is already true, wait_event()
+ never enters __wait_event(). __scan_channels() immediately
+ clears intf->null_user_handler and exits.
+4.[CPUB] Once intf->null_user_handler is set to NULL, deliver_response()
+ ignores further IPMI responses, leaving the remaining
+ channels zero-initialized and unusable.
+
+CPUA CPUB
+------------------------------- -----------------------------
+__scan_channels()
+ intf->null_user_handler
+ = channel_handler;
+ send_channel_info_cmd(intf,
+ 0);
+ wait_event(intf->waitq,
+ intf->channels_ready);
+ do {
+ might_sleep();
+ deliver_response()
+ channel_handler()
+ intf->channel_list =
+ intf->wchannels + set;
+ intf->channels_ready = true;
+ send_channel_info_cmd(intf,
+ intf->curr_channel);
+ if (condition)
+ break;
+ __wait_event(wq_head,
+ condition);
+ } while(0)
+ intf->null_user_handler
+ = NULL;
+ deliver_response()
+ if (!msg->user)
+ if (intf->null_user_handler)
+ rv = -EINVAL;
+ return rv;
+------------------------------- -----------------------------
+
+Fix the race between __scan_channels() and deliver_response() by
+deferring both the assignment intf->channel_list = intf->wchannels
+and the flag intf->channels_ready = true until all channels have
+been successfully scanned or until the IPMI request has failed.
+
+Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
+Message-ID: <20250930074239.2353-2-guojinhui.liam@bytedance.com>
+Signed-off-by: Corey Minyard <corey@minyard.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_msghandler.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index 5b01985aed22..117454a5603b 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -3305,8 +3305,6 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)
+ intf->channels_ready = true;
+ wake_up(&intf->waitq);
+ } else {
+- intf->channel_list = intf->wchannels + set;
+- intf->channels_ready = true;
+ rv = send_channel_info_cmd(intf, intf->curr_channel);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 40eba4dd31015a3a3abc79271ef29158706b5f94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 11:05:45 +0100
+Subject: nvme-fc: don't hold rport lock when putting ctrl
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit b71cbcf7d170e51148d5467820ae8a72febcb651 ]
+
+nvme_fc_ctrl_put can acquire the rport lock when freeing the
+ctrl object:
+
+nvme_fc_ctrl_put
+ nvme_fc_ctrl_free
+ spin_lock_irqsave(rport->lock)
+
+Thus we can't hold the rport lock when calling nvme_fc_ctrl_put.
+
+Justin suggested use the safe list iterator variant because
+nvme_fc_ctrl_put will also modify the rport->list.
+
+Cc: Justin Tee <justin.tee@broadcom.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index e37e7207c60c..dbc9173ec0f8 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -1500,14 +1500,14 @@ nvme_fc_match_disconn_ls(struct nvme_fc_rport *rport,
+ {
+ struct fcnvme_ls_disconnect_assoc_rqst *rqst =
+ &lsop->rqstbuf->rq_dis_assoc;
+- struct nvme_fc_ctrl *ctrl, *ret = NULL;
++ struct nvme_fc_ctrl *ctrl, *tmp, *ret = NULL;
+ struct nvmefc_ls_rcv_op *oldls = NULL;
+ u64 association_id = be64_to_cpu(rqst->associd.association_id);
+ unsigned long flags;
+
+ spin_lock_irqsave(&rport->lock, flags);
+
+- list_for_each_entry(ctrl, &rport->ctrl_list, ctrl_list) {
++ list_for_each_entry_safe(ctrl, tmp, &rport->ctrl_list, ctrl_list) {
+ if (!nvme_fc_ctrl_get(ctrl))
+ continue;
+ spin_lock(&ctrl->lock);
+@@ -1520,7 +1520,9 @@ nvme_fc_match_disconn_ls(struct nvme_fc_rport *rport,
+ if (ret)
+ /* leave the ctrl get reference */
+ break;
++ spin_unlock_irqrestore(&rport->lock, flags);
+ nvme_fc_ctrl_put(ctrl);
++ spin_lock_irqsave(&rport->lock, flags);
+ }
+
+ spin_unlock_irqrestore(&rport->lock, flags);
+--
+2.51.0
+
--- /dev/null
+From 680b3383ad9d5c3b1eece4e0b2f59dfb1db0665a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Apr 2025 22:31:13 -0400
+Subject: powerpc/addnote: Fix overflow on 32-bit builds
+
+From: Ben Collins <bcollins@kernel.org>
+
+[ Upstream commit 825ce89a3ef17f84cf2c0eacfa6b8dc9fd11d13f ]
+
+The PUT_64[LB]E() macros need to cast the value to unsigned long long
+like the GET_64[LB]E() macros. Caused lots of warnings when compiled
+on 32-bit, and clobbered addresses (36-bit P4080).
+
+Signed-off-by: Ben Collins <bcollins@kernel.org>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/2025042122-mustard-wrasse-694572@boujee-and-buff
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/addnote.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/boot/addnote.c b/arch/powerpc/boot/addnote.c
+index 53b3b2621457..78704927453a 100644
+--- a/arch/powerpc/boot/addnote.c
++++ b/arch/powerpc/boot/addnote.c
+@@ -68,8 +68,8 @@ static int e_class = ELFCLASS32;
+ #define PUT_16BE(off, v)(buf[off] = ((v) >> 8) & 0xff, \
+ buf[(off) + 1] = (v) & 0xff)
+ #define PUT_32BE(off, v)(PUT_16BE((off), (v) >> 16L), PUT_16BE((off) + 2, (v)))
+-#define PUT_64BE(off, v)((PUT_32BE((off), (v) >> 32L), \
+- PUT_32BE((off) + 4, (v))))
++#define PUT_64BE(off, v)((PUT_32BE((off), (unsigned long long)(v) >> 32L), \
++ PUT_32BE((off) + 4, (unsigned long long)(v))))
+
+ #define GET_16LE(off) ((buf[off]) + (buf[(off)+1] << 8))
+ #define GET_32LE(off) (GET_16LE(off) + (GET_16LE((off)+2U) << 16U))
+@@ -78,7 +78,8 @@ static int e_class = ELFCLASS32;
+ #define PUT_16LE(off, v) (buf[off] = (v) & 0xff, \
+ buf[(off) + 1] = ((v) >> 8) & 0xff)
+ #define PUT_32LE(off, v) (PUT_16LE((off), (v)), PUT_16LE((off) + 2, (v) >> 16L))
+-#define PUT_64LE(off, v) (PUT_32LE((off), (v)), PUT_32LE((off) + 4, (v) >> 32L))
++#define PUT_64LE(off, v) (PUT_32LE((off), (unsigned long long)(v)), \
++ PUT_32LE((off) + 4, (unsigned long long)(v) >> 32L))
+
+ #define GET_16(off) (e_data == ELFDATA2MSB ? GET_16BE(off) : GET_16LE(off))
+ #define GET_32(off) (e_data == ELFDATA2MSB ? GET_32BE(off) : GET_32LE(off))
+--
+2.51.0
+
--- /dev/null
+From 3a6ea1951fb1117950678a61c103c8867281c31f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 14:10:37 +0800
+Subject: reset: fix BIT macro reference
+
+From: Encrow Thorne <jyc0019@gmail.com>
+
+[ Upstream commit f3d8b64ee46c9b4b0b82b1a4642027728bac95b8 ]
+
+RESET_CONTROL_FLAGS_BIT_* macros use BIT(), but reset.h does not
+include bits.h. This causes compilation errors when including
+reset.h standalone.
+
+Include bits.h to make reset.h self-contained.
+
+Suggested-by: Troy Mitchell <troy.mitchell@linux.dev>
+Reviewed-by: Troy Mitchell <troy.mitchell@linux.dev>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Encrow Thorne <jyc0019@gmail.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/reset.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/linux/reset.h b/include/linux/reset.h
+index 05aa9f440f48..f27026f52104 100644
+--- a/include/linux/reset.h
++++ b/include/linux/reset.h
+@@ -2,6 +2,7 @@
+ #ifndef _LINUX_RESET_H_
+ #define _LINUX_RESET_H_
+
++#include <linux/bits.h>
+ #include <linux/err.h>
+ #include <linux/errno.h>
+ #include <linux/types.h>
+--
+2.51.0
+
--- /dev/null
+From c6c25dd608e362022f14b682a6c4bbe5b8e9c726 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 10:48:45 -0500
+Subject: scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive
+
+From: Tony Battersby <tonyb@cybernetics.com>
+
+[ Upstream commit 8f58fc64d559b5fda1b0a5e2a71422be61e79ab9 ]
+
+When given the module parameter qlini_mode=exclusive, qla2xxx in
+initiator mode is initially unable to successfully send SCSI commands to
+devices it finds while scanning, resulting in an escalating series of
+resets until an adapter reset clears the issue. Fix by checking the
+active mode instead of the module parameter.
+
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Link: https://patch.msgid.link/1715ec14-ba9a-45dc-9cf2-d41aa6b81b5e@cybernetics.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_os.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index a6ecb4bb7456..f35a53cc00dd 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -3288,13 +3288,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ base_vha->mgmt_svr_loop_id, host->sg_tablesize);
+
+ if (ha->mqenable) {
+- bool startit = false;
+-
+- if (QLA_TGT_MODE_ENABLED())
+- startit = false;
+-
+- if (ql2x_ini_mode == QLA2XXX_INI_MODE_ENABLED)
+- startit = true;
++ bool startit = !!(host->active_mode & MODE_INITIATOR);
+
+ /* Create start of day qpairs for Block MQ */
+ for (i = 0; i < ha->max_qpairs; i++)
+--
+2.51.0
+
--- /dev/null
+From a95664ce94cfae3fd6f2d645bfe2926da98efbbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 10:51:28 -0500
+Subject: scsi: qla2xxx: Use reinit_completion on mbx_intr_comp
+
+From: Tony Battersby <tonyb@cybernetics.com>
+
+[ Upstream commit 957aa5974989fba4ae4f807ebcb27f12796edd4d ]
+
+If a mailbox command completes immediately after
+wait_for_completion_timeout() times out, ha->mbx_intr_comp could be left
+in an inconsistent state, causing the next mailbox command not to wait
+for the hardware. Fix by reinitializing the completion before use.
+
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Link: https://patch.msgid.link/11b6485e-0bfd-4784-8f99-c06a196dad94@cybernetics.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_mbx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
+index 8b7c71e779a7..aa6a68e235c9 100644
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -249,6 +249,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
+ /* Issue set host interrupt command to send cmd out. */
+ ha->flags.mbox_int = 0;
+ clear_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags);
++ reinit_completion(&ha->mbx_intr_comp);
+
+ /* Unlock mbx registers and wait for interrupt */
+ ql_dbg(ql_dbg_mbx, vha, 0x100f,
+@@ -275,6 +276,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
+ "cmd=%x Timeout.\n", command);
+ spin_lock_irqsave(&ha->hardware_lock, flags);
+ clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags);
++ reinit_completion(&ha->mbx_intr_comp);
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
+ if (chip_reset != ha->chip_reset) {
+--
+2.51.0
+
--- /dev/null
+From 415d4443af0ceb8dda536d07e55bf9db71f5d308 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Oct 2025 11:08:40 +0800
+Subject: serial: sprd: Return -EPROBE_DEFER when uart clock is not ready
+
+From: Wenhua Lin <Wenhua.Lin@unisoc.com>
+
+[ Upstream commit 29e8a0c587e328ed458380a45d6028adf64d7487 ]
+
+In sprd_clk_init(), when devm_clk_get() returns -EPROBE_DEFER
+for either uart or source clock, we should propagate the
+error instead of just warning and continuing with NULL clocks.
+
+Currently the driver only emits a warning when clock acquisition
+fails and proceeds with NULL clock pointers. This can lead to
+issues later when the clocks are actually needed. More importantly,
+when the clock provider is not ready yet and returns -EPROBE_DEFER,
+we should return this error to allow deferred probing.
+
+This change adds explicit checks for -EPROBE_DEFER after both:
+1. devm_clk_get(uport->dev, uart)
+2. devm_clk_get(uport->dev, source)
+
+When -EPROBE_DEFER is encountered, the function now returns
+-EPROBE_DEFER to let the driver framework retry probing
+later when the clock dependencies are resolved.
+
+Signed-off-by: Wenhua Lin <Wenhua.Lin@unisoc.com>
+Link: https://patch.msgid.link/20251022030840.956589-1-Wenhua.Lin@unisoc.com
+Reviewed-by: Cixi Geng <cixi.geng@linux.dev>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/sprd_serial.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c
+index a1952e4f1fcb..e850959ecf55 100644
+--- a/drivers/tty/serial/sprd_serial.c
++++ b/drivers/tty/serial/sprd_serial.c
+@@ -1137,6 +1137,9 @@ static int sprd_clk_init(struct uart_port *uport)
+
+ clk_uart = devm_clk_get(uport->dev, "uart");
+ if (IS_ERR(clk_uart)) {
++ if (PTR_ERR(clk_uart) == -EPROBE_DEFER)
++ return -EPROBE_DEFER;
++
+ dev_warn(uport->dev, "uart%d can't get uart clock\n",
+ uport->line);
+ clk_uart = NULL;
+@@ -1144,6 +1147,9 @@ static int sprd_clk_init(struct uart_port *uport)
+
+ clk_parent = devm_clk_get(uport->dev, "source");
+ if (IS_ERR(clk_parent)) {
++ if (PTR_ERR(clk_parent) == -EPROBE_DEFER)
++ return -EPROBE_DEFER;
++
+ dev_warn(uport->dev, "uart%d can't get source clock\n",
+ uport->line);
+ clk_parent = NULL;
+--
+2.51.0
+
acpi-cppc-fix-missing-pcc-check-for-guaranteed_perf.patch
spi-fsl-cpm-check-length-parity-before-switching-to-16-bit-mode.patch
net-hsr-fix-null-pointer-dereference-in-prp_get_untagged_frame.patch
+alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch
+alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch
+alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch
+ipmi-fix-the-race-between-__scan_channels-and-delive.patch
+ipmi-fix-__scan_channels-failing-to-rescan-channels.patch
+firmware-imx-scu-irq-init-workqueue-before-request-m.patch
+ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch
+clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch
+powerpc-addnote-fix-overflow-on-32-bit-builds.patch
+scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch
+scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch
+via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch
+reset-fix-bit-macro-reference.patch
+exfat-fix-remount-failure-in-different-process-envir.patch
+usbip-fix-locking-bug-in-rt-enabled-kernels.patch
+usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch
+usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch
+usb-usb-storage-no-additional-quirks-need-to-be-adde.patch
+serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch
+nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch
--- /dev/null
+From 4a994b36bd94a2dc12c010a95a552a6892c79d94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 15:11:13 +0200
+Subject: ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx
+
+From: Matthias Schiffer <matthias.schiffer@tq-group.com>
+
+[ Upstream commit 3f61783920504b2cf99330b372d82914bb004d8e ]
+
+am33xx.dtsi has the same clock setup as am35xx.dtsi, setting
+ti,no-reset-on-init and ti,no-idle on timer1_target and timer2_target,
+so AM33 needs the same workaround as AM35 to avoid ti-sysc probe
+failing on certain target modules.
+
+Signed-off-by: Matthias Schiffer <matthias.schiffer@tq-group.com>
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250825131114.2206804-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/ti-sysc.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index ed38c25fb0c5..fe5b0997aee6 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -37,6 +37,7 @@ enum sysc_soc {
+ SOC_UNKNOWN,
+ SOC_2420,
+ SOC_2430,
++ SOC_AM33,
+ SOC_3430,
+ SOC_AM35,
+ SOC_3630,
+@@ -2933,6 +2934,7 @@ static void ti_sysc_idle(struct work_struct *work)
+ static const struct soc_device_attribute sysc_soc_match[] = {
+ SOC_FLAG("OMAP242*", SOC_2420),
+ SOC_FLAG("OMAP243*", SOC_2430),
++ SOC_FLAG("AM33*", SOC_AM33),
+ SOC_FLAG("AM35*", SOC_AM35),
+ SOC_FLAG("OMAP3[45]*", SOC_3430),
+ SOC_FLAG("OMAP3[67]*", SOC_3630),
+@@ -3121,10 +3123,15 @@ static int sysc_check_active_timer(struct sysc *ddata)
+ * can be dropped if we stop supporting old beagleboard revisions
+ * A to B4 at some point.
+ */
+- if (sysc_soc->soc == SOC_3430 || sysc_soc->soc == SOC_AM35)
++ switch (sysc_soc->soc) {
++ case SOC_AM33:
++ case SOC_3430:
++ case SOC_AM35:
+ error = -ENXIO;
+- else
++ break;
++ default:
+ error = -EBUSY;
++ }
+
+ if ((ddata->cfg.quirks & SYSC_QUIRK_NO_RESET_ON_INIT) &&
+ (ddata->cfg.quirks & SYSC_QUIRK_NO_IDLE))
+--
+2.51.0
+
--- /dev/null
+From 82054a1f984ced0dd3740ea2704d2be755f5d517 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 14:53:07 -0400
+Subject: usb: typec: ucsi: Handle incorrect num_connectors capability
+
+From: Mark Pearson <mpearson-lenovo@squebb.ca>
+
+[ Upstream commit 30cd2cb1abf4c4acdb1ddb468c946f68939819fb ]
+
+The UCSI spec states that the num_connectors field is 7 bits, and the
+8th bit is reserved and should be set to zero.
+Some buggy FW has been known to set this bit, and it can lead to a
+system not booting.
+Flag that the FW is not behaving correctly, and auto-fix the value
+so that the system boots correctly.
+
+Found on Lenovo P1 G8 during Linux enablement program. The FW will
+be fixed, but seemed worth addressing in case it hit platforms that
+aren't officially Linux supported.
+
+Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20250821185319.2585023-1-mpearson-lenovo@squebb.ca
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/ucsi/ucsi.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
+index 0851d93d5909..60339c746694 100644
+--- a/drivers/usb/typec/ucsi/ucsi.c
++++ b/drivers/usb/typec/ucsi/ucsi.c
+@@ -1220,6 +1220,12 @@ static int ucsi_init(struct ucsi *ucsi)
+ ret = -ENODEV;
+ goto err_reset;
+ }
++ /* Check if reserved bit set. This is out of spec but happens in buggy FW */
++ if (ucsi->cap.num_connectors & 0x80) {
++ dev_warn(ucsi->dev, "UCSI: Invalid num_connectors %d. Likely buggy FW\n",
++ ucsi->cap.num_connectors);
++ ucsi->cap.num_connectors &= 0x7f; // clear bit and carry on
++ }
+
+ /* Allocate the connectors. Released in ucsi_unregister_ppm() */
+ ucsi->connector = kcalloc(ucsi->cap.num_connectors + 1,
+--
+2.51.0
+
--- /dev/null
+From f90df9ff69364766e12bc3b5f14a84c27f626929 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 14:40:20 +0800
+Subject: usb: usb-storage: No additional quirks need to be added to the EL-R12
+ optical drive.
+
+From: Chen Changcheng <chenchangcheng@kylinos.cn>
+
+[ Upstream commit 955a48a5353f4fe009704a9a4272a3adf627cd35 ]
+
+The optical drive of EL-R12 has the same vid and pid as INIC-3069,
+as follows:
+T: Bus=02 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#= 3 Spd=5000 MxCh= 0
+D: Ver= 3.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
+P: Vendor=13fd ProdID=3940 Rev= 3.10
+S: Manufacturer=HL-DT-ST
+S: Product= DVD+-RW GT80N
+S: SerialNumber=423349524E4E38303338323439202020
+C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=144mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=02 Prot=50 Driver=usb-storage
+E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=0a(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+
+This will result in the optical drive device also adding
+the quirks of US_FL_NO_ATA_1X. When performing an erase operation,
+it will fail, and the reason for the failure is as follows:
+[ 388.967742] sr 5:0:0:0: [sr0] tag#0 Send: scmd 0x00000000d20c33a7
+[ 388.967742] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00
+[ 388.967773] sr 5:0:0:0: [sr0] tag#0 Done: SUCCESS Result: hostbyte=DID_TARGET_FAILURE driverbyte=DRIVER_OK cmd_age=0s
+[ 388.967773] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00
+[ 388.967803] sr 5:0:0:0: [sr0] tag#0 Sense Key : Illegal Request [current]
+[ 388.967803] sr 5:0:0:0: [sr0] tag#0 Add. Sense: Invalid field in cdb
+[ 388.967803] sr 5:0:0:0: [sr0] tag#0 scsi host busy 1 failed 0
+[ 388.967803] sr 5:0:0:0: Notifying upper driver of completion (result 8100002)
+[ 388.967834] sr 5:0:0:0: [sr0] tag#0 0 sectors total, 0 bytes done.
+
+For the EL-R12 standard optical drive, all operational commands
+and usage scenarios were tested without adding the IGNORE_RESIDUE quirks,
+and no issues were encountered. It can be reasonably concluded
+that removing the IGNORE_RESIDUE quirks has no impact.
+
+Signed-off-by: Chen Changcheng <chenchangcheng@kylinos.cn>
+Link: https://patch.msgid.link/20251121064020.29332-1-chenchangcheng@kylinos.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/storage/unusual_uas.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index 1477e31d7763..b695f5ba9a40 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -98,7 +98,7 @@ UNUSUAL_DEV(0x125f, 0xa94a, 0x0160, 0x0160,
+ US_FL_NO_ATA_1X),
+
+ /* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
+-UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
++UNUSUAL_DEV(0x13fd, 0x3940, 0x0309, 0x0309,
+ "Initio Corporation",
+ "INIC-3069",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+--
+2.51.0
+
--- /dev/null
+From bcdfe2d480eba9c76f1943c93f9d0c8784bfd121 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 16:23:55 +0200
+Subject: usb: xhci: limit run_graceperiod for only usb 3.0 devices
+
+From: Hongyu Xie <xiehongyu1@kylinos.cn>
+
+[ Upstream commit 8d34983720155b8f05de765f0183d9b0e1345cc0 ]
+
+run_graceperiod blocks usb 2.0 devices from auto suspending after
+xhci_start for 500ms.
+
+Log shows:
+[ 13.387170] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100
+[ 13.387177] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.387182] hub_suspend:3903: hub 7-0:1.0: hub_suspend
+[ 13.387188] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1
+[ 13.387191] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event
+[ 13.387193] hcd_bus_resume:2303: usb usb7: usb auto-resume
+[ 13.387296] hub_event:5779: hub 3-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.393343] handle_port_status:2034: xhci-hcd PNP0D10:02: handle_port_status: starting usb5 port polling.
+[ 13.393353] xhci_hub_control:1271: xhci-hcd PNP0D10:02: Get port status 5-1 read: 0x206e1, return 0x10101
+[ 13.400047] hub_suspend:3903: hub 3-0:1.0: hub_suspend
+[ 13.403077] hub_resume:3948: hub 7-0:1.0: hub_resume
+[ 13.403080] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100
+[ 13.403085] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.403087] hub_suspend:3903: hub 7-0:1.0: hub_suspend
+[ 13.403090] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1
+[ 13.403093] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event
+[ 13.403095] hcd_bus_resume:2303: usb usb7: usb auto-resume
+[ 13.405002] handle_port_status:1913: xhci-hcd PNP0D10:04: Port change event, 9-1, id 1, portsc: 0x6e1
+[ 13.405016] hub_activate:1169: usb usb5-port1: status 0101 change 0001
+[ 13.405026] xhci_clear_port_change_bit:658: xhci-hcd PNP0D10:02: clear port1 connect change, portsc: 0x6e1
+[ 13.413275] hcd_bus_suspend:2250: usb usb3: bus auto-suspend, wakeup 1
+[ 13.419081] hub_resume:3948: hub 7-0:1.0: hub_resume
+[ 13.419086] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100
+[ 13.419095] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.419100] hub_suspend:3903: hub 7-0:1.0: hub_suspend
+[ 13.419106] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1
+[ 13.419110] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event
+[ 13.419112] hcd_bus_resume:2303: usb usb7: usb auto-resume
+[ 13.420455] handle_port_status:2034: xhci-hcd PNP0D10:04: handle_port_status: starting usb9 port polling.
+[ 13.420493] handle_port_status:1913: xhci-hcd PNP0D10:05: Port change event, 10-1, id 1, portsc: 0x6e1
+[ 13.425332] hcd_bus_suspend:2279: usb usb3: suspend raced with wakeup event
+[ 13.431931] handle_port_status:2034: xhci-hcd PNP0D10:05: handle_port_status: starting usb10 port polling.
+[ 13.435080] hub_resume:3948: hub 7-0:1.0: hub_resume
+[ 13.435084] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100
+[ 13.435092] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.435096] hub_suspend:3903: hub 7-0:1.0: hub_suspend
+[ 13.435102] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1
+[ 13.435106] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event
+
+usb7 and other usb 2.0 root hub were rapidly toggling between suspend
+and resume states. More, "suspend raced with wakeup event" confuses people.
+
+So, limit run_graceperiod for only usb 3.0 devices
+
+Signed-off-by: Hongyu Xie <xiehongyu1@kylinos.cn>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://patch.msgid.link/20251119142417.2820519-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-hub.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 05f119e7178c..a7a7f0a8488a 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -1564,7 +1564,7 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
+ * SS devices are only visible to roothub after link training completes.
+ * Keep polling roothubs for a grace period after xHC start
+ */
+- if (xhci->run_graceperiod) {
++ if (hcd->speed >= HCD_USB3 && xhci->run_graceperiod) {
+ if (time_before(jiffies, xhci->run_graceperiod))
+ status = 1;
+ else
+--
+2.51.0
+
--- /dev/null
+From ef092ccc1b1ad196c4a78a5cb0e2dd04be5284cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 09:41:43 +0800
+Subject: usbip: Fix locking bug in RT-enabled kernels
+
+From: Lizhi Xu <lizhi.xu@windriver.com>
+
+[ Upstream commit 09bf21bf5249880f62fe759b53b14b4b52900c6c ]
+
+Interrupts are disabled before entering usb_hcd_giveback_urb().
+A spinlock_t becomes a sleeping lock on PREEMPT_RT, so it cannot be
+acquired with disabled interrupts.
+
+Save the interrupt status and restore it after usb_hcd_giveback_urb().
+
+syz reported:
+BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
+Call Trace:
+ dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
+ rt_spin_lock+0xc7/0x2c0 kernel/locking/spinlock_rt.c:57
+ spin_lock include/linux/spinlock_rt.h:44 [inline]
+ mon_bus_complete drivers/usb/mon/mon_main.c:134 [inline]
+ mon_complete+0x5c/0x200 drivers/usb/mon/mon_main.c:147
+ usbmon_urb_complete include/linux/usb/hcd.h:738 [inline]
+ __usb_hcd_giveback_urb+0x254/0x5e0 drivers/usb/core/hcd.c:1647
+ vhci_urb_enqueue+0xb4f/0xe70 drivers/usb/usbip/vhci_hcd.c:818
+
+Reported-by: syzbot+205ef33a3b636b4181fb@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=205ef33a3b636b4181fb
+Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20250916014143.1439759-1-lizhi.xu@windriver.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/usbip/vhci_hcd.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
+index 2d2506c59881..e5660f0e97e8 100644
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -830,15 +830,15 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ no_need_xmit:
+ usb_hcd_unlink_urb_from_ep(hcd, urb);
+ no_need_unlink:
+- spin_unlock_irqrestore(&vhci->lock, flags);
+ if (!ret) {
+ /* usb_hcd_giveback_urb() should be called with
+ * irqs disabled
+ */
+- local_irq_disable();
++ spin_unlock(&vhci->lock);
+ usb_hcd_giveback_urb(hcd, urb, urb->status);
+- local_irq_enable();
++ spin_lock(&vhci->lock);
+ }
++ spin_unlock_irqrestore(&vhci->lock, flags);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From f6ad7a17de26f2d3118ecea739b2bf758c7799d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Sep 2025 16:33:32 +0800
+Subject: via_wdt: fix critical boot hang due to unnamed resource allocation
+
+From: Li Qiang <liqiang01@kylinos.cn>
+
+[ Upstream commit 7aa31ee9ec92915926e74731378c009c9cc04928 ]
+
+The VIA watchdog driver uses allocate_resource() to reserve a MMIO
+region for the watchdog control register. However, the allocated
+resource was not given a name, which causes the kernel resource tree
+to contain an entry marked as "<BAD>" under /proc/iomem on x86
+platforms.
+
+During boot, this unnamed resource can lead to a critical hang because
+subsequent resource lookups and conflict checks fail to handle the
+invalid entry properly.
+
+Signed-off-by: Li Qiang <liqiang01@kylinos.cn>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/via_wdt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/watchdog/via_wdt.c b/drivers/watchdog/via_wdt.c
+index eeb39f96e72e..c1ed3ce153cf 100644
+--- a/drivers/watchdog/via_wdt.c
++++ b/drivers/watchdog/via_wdt.c
+@@ -165,6 +165,7 @@ static int wdt_probe(struct pci_dev *pdev,
+ dev_err(&pdev->dev, "cannot enable PCI device\n");
+ return -ENODEV;
+ }
++ wdt_res.name = "via_wdt";
+
+ /*
+ * Allocate a MMIO region which contains watchdog control register
+--
+2.51.0
+
--- /dev/null
+From 4a8fb9ade8bb27554de443ade56954204aae04b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 17:04:33 +0800
+Subject: ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path
+
+From: Haotian Zhang <vulab@iscas.ac.cn>
+
+[ Upstream commit 5032347c04ba7ff9ba878f262e075d745c06a2a8 ]
+
+When pdacf_config() fails, snd_pdacf_probe() returns the error code
+directly without freeing the sound card resources allocated by
+snd_card_new(), which leads to a memory leak.
+
+Add proper error handling to free the sound card and clear the card
+list entry when pdacf_config() fails.
+
+Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions")
+Suggested-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
+Link: https://patch.msgid.link/20251215090433.211-1-vulab@iscas.ac.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pcmcia/pdaudiocf/pdaudiocf.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf.c b/sound/pcmcia/pdaudiocf/pdaudiocf.c
+index 8363ec08df5d..4468d81683ec 100644
+--- a/sound/pcmcia/pdaudiocf/pdaudiocf.c
++++ b/sound/pcmcia/pdaudiocf/pdaudiocf.c
+@@ -132,7 +132,13 @@ static int snd_pdacf_probe(struct pcmcia_device *link)
+ link->config_index = 1;
+ link->config_regs = PRESENT_OPTION;
+
+- return pdacf_config(link);
++ err = pdacf_config(link);
++ if (err < 0) {
++ card_list[i] = NULL;
++ snd_card_free(card);
++ return err;
++ }
++ return 0;
+ }
+
+
+--
+2.51.0
+
--- /dev/null
+From 9b715285ab55f12317e6cfac6897c752f2cc0a6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 10:46:30 +0800
+Subject: ALSA: usb-mixer: us16x08: validate meter packet indices
+
+From: Shipei Qu <qu@darknavy.com>
+
+[ Upstream commit 5526c1c6ba1d0913c7dfcbbd6fe1744ea7c55f1e ]
+
+get_meter_levels_from_urb() parses the 64-byte meter packets sent by
+the device and fills the per-channel arrays meter_level[],
+comp_level[] and master_level[] in struct snd_us16x08_meter_store.
+
+Currently the function derives the channel index directly from the
+meter packet (MUB2(meter_urb, s) - 1) and uses it to index those
+arrays without validating the range. If the packet contains a
+negative or out-of-range channel number, the driver may write past
+the end of these arrays.
+
+Introduce a local channel variable and validate it before updating the
+arrays. We reject negative indices, limit meter_level[] and
+comp_level[] to SND_US16X08_MAX_CHANNELS, and guard master_level[]
+updates with ARRAY_SIZE(master_level).
+
+Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk")
+Reported-by: DARKNAVY (@DarkNavyOrg) <vr@darknavy.com>
+Closes: https://lore.kernel.org/tencent_21C112743C44C1A2517FF219@qq.com
+Signed-off-by: Shipei Qu <qu@darknavy.com>
+Link: https://patch.msgid.link/20251217024630.59576-1-qu@darknavy.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_us16x08.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/sound/usb/mixer_us16x08.c b/sound/usb/mixer_us16x08.c
+index 2f6fa722442f..c13bc858e282 100644
+--- a/sound/usb/mixer_us16x08.c
++++ b/sound/usb/mixer_us16x08.c
+@@ -656,17 +656,25 @@ static void get_meter_levels_from_urb(int s,
+ u8 *meter_urb)
+ {
+ int val = MUC2(meter_urb, s) + (MUC3(meter_urb, s) << 8);
++ int ch = MUB2(meter_urb, s) - 1;
++
++ if (ch < 0)
++ return;
+
+ if (MUA0(meter_urb, s) == 0x61 && MUA1(meter_urb, s) == 0x02 &&
+ MUA2(meter_urb, s) == 0x04 && MUB0(meter_urb, s) == 0x62) {
+- if (MUC0(meter_urb, s) == 0x72)
+- store->meter_level[MUB2(meter_urb, s) - 1] = val;
+- if (MUC0(meter_urb, s) == 0xb2)
+- store->comp_level[MUB2(meter_urb, s) - 1] = val;
++ if (ch < SND_US16X08_MAX_CHANNELS) {
++ if (MUC0(meter_urb, s) == 0x72)
++ store->meter_level[ch] = val;
++ if (MUC0(meter_urb, s) == 0xb2)
++ store->comp_level[ch] = val;
++ }
+ }
+ if (MUA0(meter_urb, s) == 0x61 && MUA1(meter_urb, s) == 0x02 &&
+- MUA2(meter_urb, s) == 0x02 && MUB0(meter_urb, s) == 0x62)
+- store->master_level[MUB2(meter_urb, s) - 1] = val;
++ MUA2(meter_urb, s) == 0x02 && MUB0(meter_urb, s) == 0x62) {
++ if (ch < ARRAY_SIZE(store->master_level))
++ store->master_level[ch] = val;
++ }
+ }
+
+ /* Function to retrieve current meter values from the device.
+--
+2.51.0
+
--- /dev/null
+From 272fb07533788c9403e8ddf476dc61c29b02fc7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 12:26:52 +0800
+Subject: ALSA: vxpocket: Fix resource leak in vxpocket_probe error path
+
+From: Haotian Zhang <vulab@iscas.ac.cn>
+
+[ Upstream commit 2a03b40deacbd293ac9aed0f9b11197dad54fe5f ]
+
+When vxpocket_config() fails, vxpocket_probe() returns the error code
+directly without freeing the sound card resources allocated by
+snd_card_new(), which leads to a memory leak.
+
+Add proper error handling to free the sound card and clear the
+allocation bit when vxpocket_config() fails.
+
+Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions")
+Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
+Link: https://patch.msgid.link/20251215042652.695-1-vulab@iscas.ac.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pcmcia/vx/vxpocket.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pcmcia/vx/vxpocket.c b/sound/pcmcia/vx/vxpocket.c
+index 7a0f0e73ceb2..867a477d53ae 100644
+--- a/sound/pcmcia/vx/vxpocket.c
++++ b/sound/pcmcia/vx/vxpocket.c
+@@ -295,7 +295,13 @@ static int vxpocket_probe(struct pcmcia_device *p_dev)
+
+ vxp->p_dev = p_dev;
+
+- return vxpocket_config(p_dev);
++ err = vxpocket_config(p_dev);
++ if (err < 0) {
++ card_alloc &= ~(1 << i);
++ snd_card_free(card);
++ return err;
++ }
++ return 0;
+ }
+
+ static void vxpocket_detach(struct pcmcia_device *link)
+--
+2.51.0
+
--- /dev/null
+From 3f7eb90f0ab2d212cefc9d55c066322a83d1b401 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 16:16:26 +0100
+Subject: clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &
+ pcie_x4
+
+From: Josua Mayer <josua@solid-run.com>
+
+[ Upstream commit f0e6bc0c3ef4b4afb299bd6912586cafd5d864e9 ]
+
+CP110 based platforms rely on the bootloader for pci port
+initialization.
+TF-A actively prevents non-uboot re-configuration of pci lanes, and many
+boards do not have software control over the pci card reset.
+
+If a pci port had link at boot-time and the clock is stopped at a later
+point, the link fails and can not be recovered.
+
+PCI controller driver probe - and by extension ownership of a driver for
+the pci clocks - may be delayed especially on large modular kernels,
+causing the clock core to start disabling unused clocks.
+
+Add the CLK_IGNORE_UNUSED flag to the three pci port's clocks to ensure
+they are not stopped before the pci controller driver has taken
+ownership and tested for an existing link.
+
+This fixes failed pci link detection when controller driver probes late,
+e.g. with arm64 defconfig and CONFIG_PHY_MVEBU_CP110_COMPHY=m.
+
+Closes: https://lore.kernel.org/r/b71596c7-461b-44b6-89ab-3cfbd492639f@solid-run.com
+Signed-off-by: Josua Mayer <josua@solid-run.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/cp110-system-controller.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/clk/mvebu/cp110-system-controller.c b/drivers/clk/mvebu/cp110-system-controller.c
+index 84c8900542e4..b477396917ad 100644
+--- a/drivers/clk/mvebu/cp110-system-controller.c
++++ b/drivers/clk/mvebu/cp110-system-controller.c
+@@ -110,6 +110,25 @@ static const char * const gate_base_names[] = {
+ [CP110_GATE_EIP197] = "eip197"
+ };
+
++static unsigned long gate_flags(const u8 bit_idx)
++{
++ switch (bit_idx) {
++ case CP110_GATE_PCIE_X1_0:
++ case CP110_GATE_PCIE_X1_1:
++ case CP110_GATE_PCIE_X4:
++ /*
++ * If a port had an active link at boot time, stopping
++ * the clock creates a failed state from which controller
++ * driver can not recover.
++ * Prevent stopping this clock till after a driver has taken
++ * ownership.
++ */
++ return CLK_IGNORE_UNUSED;
++ default:
++ return 0;
++ }
++};
++
+ struct cp110_gate_clk {
+ struct clk_hw hw;
+ struct regmap *regmap;
+@@ -171,6 +190,7 @@ static struct clk_hw *cp110_register_gate(const char *name,
+ init.ops = &cp110_gate_ops;
+ init.parent_names = &parent_name;
+ init.num_parents = 1;
++ init.flags = gate_flags(bit_idx);
+
+ gate->regmap = regmap;
+ gate->bit_idx = bit_idx;
+--
+2.51.0
+
--- /dev/null
+From e3ed690259226de56ff2947b7d734747a16548dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 17:51:10 +0800
+Subject: exfat: fix remount failure in different process environments
+
+From: Yuezhang Mo <Yuezhang.Mo@sony.com>
+
+[ Upstream commit 51fc7b4ce10ccab8ea5e4876bcdc42cf5202a0ef ]
+
+The kernel test robot reported that the exFAT remount operation
+failed. The reason for the failure was that the process's umask
+is different between mount and remount, causing fs_fmask and
+fs_dmask are changed.
+
+Potentially, both gid and uid may also be changed. Therefore, when
+initializing fs_context for remount, inherit these mount options
+from the options used during mount.
+
+Reported-by: kernel test robot <oliver.sang@intel.com>
+Closes: https://lore.kernel.org/oe-lkp/202511251637.81670f5c-lkp@intel.com
+Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exfat/super.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/fs/exfat/super.c b/fs/exfat/super.c
+index 816ba7e1607f..39e999c0de75 100644
+--- a/fs/exfat/super.c
++++ b/fs/exfat/super.c
+@@ -758,10 +758,21 @@ static int exfat_init_fs_context(struct fs_context *fc)
+ ratelimit_state_init(&sbi->ratelimit, DEFAULT_RATELIMIT_INTERVAL,
+ DEFAULT_RATELIMIT_BURST);
+
+- sbi->options.fs_uid = current_uid();
+- sbi->options.fs_gid = current_gid();
+- sbi->options.fs_fmask = current->fs->umask;
+- sbi->options.fs_dmask = current->fs->umask;
++ if (fc->purpose == FS_CONTEXT_FOR_RECONFIGURE && fc->root) {
++ struct super_block *sb = fc->root->d_sb;
++ struct exfat_mount_options *cur_opts = &EXFAT_SB(sb)->options;
++
++ sbi->options.fs_uid = cur_opts->fs_uid;
++ sbi->options.fs_gid = cur_opts->fs_gid;
++ sbi->options.fs_fmask = cur_opts->fs_fmask;
++ sbi->options.fs_dmask = cur_opts->fs_dmask;
++ } else {
++ sbi->options.fs_uid = current_uid();
++ sbi->options.fs_gid = current_gid();
++ sbi->options.fs_fmask = current->fs->umask;
++ sbi->options.fs_dmask = current->fs->umask;
++ }
++
+ sbi->options.allow_utime = -1;
+ sbi->options.iocharset = exfat_default_iocharset;
+ sbi->options.errors = EXFAT_ERRORS_RO;
+--
+2.51.0
+
--- /dev/null
+From ef101f5b6c29e0551b2e15ab7bc00c7d38919457 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Oct 2025 09:56:26 +0800
+Subject: firmware: imx: scu-irq: Init workqueue before request mbox channel
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit 81fb53feb66a3aefbf6fcab73bb8d06f5b0c54ad ]
+
+With mailbox channel requested, there is possibility that interrupts may
+come in, so need to make sure the workqueue is initialized before
+the queue is scheduled by mailbox rx callback.
+
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/imx/imx-scu-irq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/imx/imx-scu-irq.c b/drivers/firmware/imx/imx-scu-irq.c
+index 32b1ca4e1050..06c49a61a079 100644
+--- a/drivers/firmware/imx/imx-scu-irq.c
++++ b/drivers/firmware/imx/imx-scu-irq.c
+@@ -148,6 +148,8 @@ int imx_scu_enable_general_irq_channel(struct device *dev)
+ cl->dev = dev;
+ cl->rx_callback = imx_scu_irq_callback;
+
++ INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler);
++
+ /* SCU general IRQ uses general interrupt channel 3 */
+ ch = mbox_request_channel_byname(cl, "gip3");
+ if (IS_ERR(ch)) {
+@@ -157,8 +159,6 @@ int imx_scu_enable_general_irq_channel(struct device *dev)
+ return ret;
+ }
+
+- INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler);
+-
+ if (!of_parse_phandle_with_args(dev->of_node, "mboxes",
+ "#mbox-cells", 0, &spec)) {
+ i = of_alias_get_id(spec.np, "mu");
+--
+2.51.0
+
--- /dev/null
+From 88f57de680a44aff6ecf518592d17e4c1bfe2815 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 15:42:38 +0800
+Subject: ipmi: Fix __scan_channels() failing to rescan channels
+
+From: Jinhui Guo <guojinhui.liam@bytedance.com>
+
+[ Upstream commit 6bd30d8fc523fb880b4be548e8501bc0fe8f42d4 ]
+
+channel_handler() sets intf->channels_ready to true but never
+clears it, so __scan_channels() skips any rescan. When the BMC
+firmware changes a rescan is required. Allow it by clearing
+the flag before starting a new scan.
+
+Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
+Message-ID: <20250930074239.2353-3-guojinhui.liam@bytedance.com>
+Signed-off-by: Corey Minyard <corey@minyard.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_msghandler.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index 98ccba19292a..d680e4d46992 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -593,7 +593,8 @@ static void __ipmi_bmc_unregister(struct ipmi_smi *intf);
+ static int __ipmi_bmc_register(struct ipmi_smi *intf,
+ struct ipmi_device_id *id,
+ bool guid_set, guid_t *guid, int intf_num);
+-static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id);
++static int __scan_channels(struct ipmi_smi *intf,
++ struct ipmi_device_id *id, bool rescan);
+
+
+ /**
+@@ -2543,7 +2544,7 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc,
+ if (__ipmi_bmc_register(intf, &id, guid_set, &guid, intf_num))
+ need_waiter(intf); /* Retry later on an error. */
+ else
+- __scan_channels(intf, &id);
++ __scan_channels(intf, &id, false);
+
+
+ if (!intf_set) {
+@@ -2563,7 +2564,7 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc,
+ goto out_noprocessing;
+ } else if (memcmp(&bmc->fetch_id, &bmc->id, sizeof(bmc->id)))
+ /* Version info changes, scan the channels again. */
+- __scan_channels(intf, &bmc->fetch_id);
++ __scan_channels(intf, &bmc->fetch_id, true);
+
+ bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY;
+
+@@ -3313,10 +3314,17 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)
+ /*
+ * Must be holding intf->bmc_reg_mutex to call this.
+ */
+-static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id)
++static int __scan_channels(struct ipmi_smi *intf,
++ struct ipmi_device_id *id,
++ bool rescan)
+ {
+ int rv;
+
++ if (rescan) {
++ /* Clear channels_ready to force channels rescan. */
++ intf->channels_ready = false;
++ }
++
+ if (ipmi_version_major(id) > 1
+ || (ipmi_version_major(id) == 1
+ && ipmi_version_minor(id) >= 5)) {
+@@ -3488,7 +3496,7 @@ int ipmi_add_smi(struct module *owner,
+ }
+
+ mutex_lock(&intf->bmc_reg_mutex);
+- rv = __scan_channels(intf, &id);
++ rv = __scan_channels(intf, &id, false);
+ mutex_unlock(&intf->bmc_reg_mutex);
+ if (rv)
+ goto out_err_bmc_reg;
+--
+2.51.0
+
--- /dev/null
+From 6c3f850656c17abf9794a752130145704edb6b96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 15:42:37 +0800
+Subject: ipmi: Fix the race between __scan_channels() and deliver_response()
+
+From: Jinhui Guo <guojinhui.liam@bytedance.com>
+
+[ Upstream commit 936750fdba4c45e13bbd17f261bb140dd55f5e93 ]
+
+The race window between __scan_channels() and deliver_response() causes
+the parameters of some channels to be set to 0.
+
+1.[CPUA] __scan_channels() issues an IPMI request and waits with
+ wait_event() until all channels have been scanned.
+ wait_event() internally calls might_sleep(), which might
+ yield the CPU. (Moreover, an interrupt can preempt
+ wait_event() and force the task to yield the CPU.)
+2.[CPUB] deliver_response() is invoked when the CPU receives the
+ IPMI response. After processing a IPMI response,
+ deliver_response() directly assigns intf->wchannels to
+ intf->channel_list and sets intf->channels_ready to true.
+ However, not all channels are actually ready for use.
+3.[CPUA] Since intf->channels_ready is already true, wait_event()
+ never enters __wait_event(). __scan_channels() immediately
+ clears intf->null_user_handler and exits.
+4.[CPUB] Once intf->null_user_handler is set to NULL, deliver_response()
+ ignores further IPMI responses, leaving the remaining
+ channels zero-initialized and unusable.
+
+CPUA CPUB
+------------------------------- -----------------------------
+__scan_channels()
+ intf->null_user_handler
+ = channel_handler;
+ send_channel_info_cmd(intf,
+ 0);
+ wait_event(intf->waitq,
+ intf->channels_ready);
+ do {
+ might_sleep();
+ deliver_response()
+ channel_handler()
+ intf->channel_list =
+ intf->wchannels + set;
+ intf->channels_ready = true;
+ send_channel_info_cmd(intf,
+ intf->curr_channel);
+ if (condition)
+ break;
+ __wait_event(wq_head,
+ condition);
+ } while(0)
+ intf->null_user_handler
+ = NULL;
+ deliver_response()
+ if (!msg->user)
+ if (intf->null_user_handler)
+ rv = -EINVAL;
+ return rv;
+------------------------------- -----------------------------
+
+Fix the race between __scan_channels() and deliver_response() by
+deferring both the assignment intf->channel_list = intf->wchannels
+and the flag intf->channels_ready = true until all channels have
+been successfully scanned or until the IPMI request has failed.
+
+Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
+Message-ID: <20250930074239.2353-2-guojinhui.liam@bytedance.com>
+Signed-off-by: Corey Minyard <corey@minyard.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_msghandler.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index af563ee827aa..98ccba19292a 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -3292,8 +3292,6 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)
+ intf->channels_ready = true;
+ wake_up(&intf->waitq);
+ } else {
+- intf->channel_list = intf->wchannels + set;
+- intf->channels_ready = true;
+ rv = send_channel_info_cmd(intf, intf->curr_channel);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 1c8e1406360e0e9dc9ca7fa1b2c77898a2fcd0c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 11:05:45 +0100
+Subject: nvme-fc: don't hold rport lock when putting ctrl
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit b71cbcf7d170e51148d5467820ae8a72febcb651 ]
+
+nvme_fc_ctrl_put can acquire the rport lock when freeing the
+ctrl object:
+
+nvme_fc_ctrl_put
+ nvme_fc_ctrl_free
+ spin_lock_irqsave(rport->lock)
+
+Thus we can't hold the rport lock when calling nvme_fc_ctrl_put.
+
+Justin suggested use the safe list iterator variant because
+nvme_fc_ctrl_put will also modify the rport->list.
+
+Cc: Justin Tee <justin.tee@broadcom.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 3fe4db3c9c34..0bbc226ea4f4 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -1500,14 +1500,14 @@ nvme_fc_match_disconn_ls(struct nvme_fc_rport *rport,
+ {
+ struct fcnvme_ls_disconnect_assoc_rqst *rqst =
+ &lsop->rqstbuf->rq_dis_assoc;
+- struct nvme_fc_ctrl *ctrl, *ret = NULL;
++ struct nvme_fc_ctrl *ctrl, *tmp, *ret = NULL;
+ struct nvmefc_ls_rcv_op *oldls = NULL;
+ u64 association_id = be64_to_cpu(rqst->associd.association_id);
+ unsigned long flags;
+
+ spin_lock_irqsave(&rport->lock, flags);
+
+- list_for_each_entry(ctrl, &rport->ctrl_list, ctrl_list) {
++ list_for_each_entry_safe(ctrl, tmp, &rport->ctrl_list, ctrl_list) {
+ if (!nvme_fc_ctrl_get(ctrl))
+ continue;
+ spin_lock(&ctrl->lock);
+@@ -1520,7 +1520,9 @@ nvme_fc_match_disconn_ls(struct nvme_fc_rport *rport,
+ if (ret)
+ /* leave the ctrl get reference */
+ break;
++ spin_unlock_irqrestore(&rport->lock, flags);
+ nvme_fc_ctrl_put(ctrl);
++ spin_lock_irqsave(&rport->lock, flags);
+ }
+
+ spin_unlock_irqrestore(&rport->lock, flags);
+--
+2.51.0
+
--- /dev/null
+From 965f49332de6788ad36162ab3e3dc6109b747e7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Nov 2025 15:04:07 +0800
+Subject: platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI
+ quirks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+
+[ Upstream commit b169e1733cadb614e87f69d7a5ae1b186c50d313 ]
+
+Dell Pro Rugged 10/12 tablets has a reliable VGBS method.
+If VGBS is not called on boot, the on-screen keyboard won't appear if the
+device is booted without a keyboard.
+
+Call VGBS on boot on thess devices to get the initial state of
+SW_TABLET_MODE in a reliable way.
+
+Signed-off-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Link: https://patch.msgid.link/20251127070407.656463-1-acelan.kao@canonical.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/hid.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c
+index f59a3cc9767b..4d488e985dc5 100644
+--- a/drivers/platform/x86/intel/hid.c
++++ b/drivers/platform/x86/intel/hid.c
+@@ -144,6 +144,18 @@ static const struct dmi_system_id dmi_vgbs_allow_list[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP Elite Dragonfly G2 Notebook PC"),
+ },
+ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro Rugged 10 Tablet RA00260"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro Rugged 12 Tablet RA02260"),
++ },
++ },
+ { }
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 3879210dbcbf3a5f6aa07f0f87fc21594ed77600 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Apr 2025 22:31:13 -0400
+Subject: powerpc/addnote: Fix overflow on 32-bit builds
+
+From: Ben Collins <bcollins@kernel.org>
+
+[ Upstream commit 825ce89a3ef17f84cf2c0eacfa6b8dc9fd11d13f ]
+
+The PUT_64[LB]E() macros need to cast the value to unsigned long long
+like the GET_64[LB]E() macros. Caused lots of warnings when compiled
+on 32-bit, and clobbered addresses (36-bit P4080).
+
+Signed-off-by: Ben Collins <bcollins@kernel.org>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/2025042122-mustard-wrasse-694572@boujee-and-buff
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/addnote.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/boot/addnote.c b/arch/powerpc/boot/addnote.c
+index 53b3b2621457..78704927453a 100644
+--- a/arch/powerpc/boot/addnote.c
++++ b/arch/powerpc/boot/addnote.c
+@@ -68,8 +68,8 @@ static int e_class = ELFCLASS32;
+ #define PUT_16BE(off, v)(buf[off] = ((v) >> 8) & 0xff, \
+ buf[(off) + 1] = (v) & 0xff)
+ #define PUT_32BE(off, v)(PUT_16BE((off), (v) >> 16L), PUT_16BE((off) + 2, (v)))
+-#define PUT_64BE(off, v)((PUT_32BE((off), (v) >> 32L), \
+- PUT_32BE((off) + 4, (v))))
++#define PUT_64BE(off, v)((PUT_32BE((off), (unsigned long long)(v) >> 32L), \
++ PUT_32BE((off) + 4, (unsigned long long)(v))))
+
+ #define GET_16LE(off) ((buf[off]) + (buf[(off)+1] << 8))
+ #define GET_32LE(off) (GET_16LE(off) + (GET_16LE((off)+2U) << 16U))
+@@ -78,7 +78,8 @@ static int e_class = ELFCLASS32;
+ #define PUT_16LE(off, v) (buf[off] = (v) & 0xff, \
+ buf[(off) + 1] = ((v) >> 8) & 0xff)
+ #define PUT_32LE(off, v) (PUT_16LE((off), (v)), PUT_16LE((off) + 2, (v) >> 16L))
+-#define PUT_64LE(off, v) (PUT_32LE((off), (v)), PUT_32LE((off) + 4, (v) >> 32L))
++#define PUT_64LE(off, v) (PUT_32LE((off), (unsigned long long)(v)), \
++ PUT_32LE((off) + 4, (unsigned long long)(v) >> 32L))
+
+ #define GET_16(off) (e_data == ELFDATA2MSB ? GET_16BE(off) : GET_16LE(off))
+ #define GET_32(off) (e_data == ELFDATA2MSB ? GET_32BE(off) : GET_32LE(off))
+--
+2.51.0
+
--- /dev/null
+From 01a30ff6a74d145704cf532d1450febb2febc167 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 14:10:37 +0800
+Subject: reset: fix BIT macro reference
+
+From: Encrow Thorne <jyc0019@gmail.com>
+
+[ Upstream commit f3d8b64ee46c9b4b0b82b1a4642027728bac95b8 ]
+
+RESET_CONTROL_FLAGS_BIT_* macros use BIT(), but reset.h does not
+include bits.h. This causes compilation errors when including
+reset.h standalone.
+
+Include bits.h to make reset.h self-contained.
+
+Suggested-by: Troy Mitchell <troy.mitchell@linux.dev>
+Reviewed-by: Troy Mitchell <troy.mitchell@linux.dev>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Encrow Thorne <jyc0019@gmail.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/reset.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/linux/reset.h b/include/linux/reset.h
+index 7bb583737528..23abb90398ad 100644
+--- a/include/linux/reset.h
++++ b/include/linux/reset.h
+@@ -2,6 +2,7 @@
+ #ifndef _LINUX_RESET_H_
+ #define _LINUX_RESET_H_
+
++#include <linux/bits.h>
+ #include <linux/err.h>
+ #include <linux/errno.h>
+ #include <linux/types.h>
+--
+2.51.0
+
--- /dev/null
+From ce63a60c547e7a7137372586568cc9dbe6f5877d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 10:48:45 -0500
+Subject: scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive
+
+From: Tony Battersby <tonyb@cybernetics.com>
+
+[ Upstream commit 8f58fc64d559b5fda1b0a5e2a71422be61e79ab9 ]
+
+When given the module parameter qlini_mode=exclusive, qla2xxx in
+initiator mode is initially unable to successfully send SCSI commands to
+devices it finds while scanning, resulting in an escalating series of
+resets until an adapter reset clears the issue. Fix by checking the
+active mode instead of the module parameter.
+
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Link: https://patch.msgid.link/1715ec14-ba9a-45dc-9cf2-d41aa6b81b5e@cybernetics.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_os.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 9267e7e73478..97a1aeb07947 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -3425,13 +3425,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ base_vha->mgmt_svr_loop_id, host->sg_tablesize);
+
+ if (ha->mqenable) {
+- bool startit = false;
+-
+- if (QLA_TGT_MODE_ENABLED())
+- startit = false;
+-
+- if (ql2x_ini_mode == QLA2XXX_INI_MODE_ENABLED)
+- startit = true;
++ bool startit = !!(host->active_mode & MODE_INITIATOR);
+
+ /* Create start of day qpairs for Block MQ */
+ for (i = 0; i < ha->max_qpairs; i++)
+--
+2.51.0
+
--- /dev/null
+From 3eb6f19c84c95eb16dc7ac8f8d3725af583f8b60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 10:50:05 -0500
+Subject: scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled
+
+From: Tony Battersby <tonyb@cybernetics.com>
+
+[ Upstream commit 4f6aaade2a22ac428fa99ed716cf2b87e79c9837 ]
+
+When qla2xxx is loaded with qlini_mode=disabled,
+ha->flags.disable_msix_handshake is used before it is set, resulting in
+the wrong interrupt handler being used on certain HBAs
+(qla2xxx_msix_rsp_q_hs() is used when qla2xxx_msix_rsp_q() should be
+used). The only difference between these two interrupt handlers is that
+the _hs() version writes to a register to clear the "RISC" interrupt,
+whereas the other version does not. So this bug results in the RISC
+interrupt being cleared when it should not be. This occasionally causes
+a different interrupt handler qla24xx_msix_default() for a different
+vector to see ((stat & HSRX_RISC_INT) == 0) and ignore its interrupt,
+which then causes problems like:
+
+qla2xxx [0000:02:00.0]-d04c:6: MBX Command timeout for cmd 20,
+ iocontrol=8 jiffies=1090c0300 mb[0-3]=[0x4000 0x0 0x40 0xda] mb7 0x500
+ host_status 0x40000010 hccr 0x3f00
+qla2xxx [0000:02:00.0]-101e:6: Mailbox cmd timeout occurred, cmd=0x20,
+ mb[0]=0x20. Scheduling ISP abort
+(the cmd varies; sometimes it is 0x20, 0x22, 0x54, 0x5a, 0x5d, or 0x6a)
+
+This problem can be reproduced with a 16 or 32 Gbps HBA by loading
+qla2xxx with qlini_mode=disabled and running a high IOPS test while
+triggering frequent RSCN database change events.
+
+While analyzing the problem I discovered that even with
+disable_msix_handshake forced to 0, it is not necessary to clear the
+RISC interrupt from qla2xxx_msix_rsp_q_hs() (more below). So just
+completely remove qla2xxx_msix_rsp_q_hs() and the logic for selecting
+it, which also fixes the bug with qlini_mode=disabled.
+
+The test below describes the justification for not needing
+qla2xxx_msix_rsp_q_hs():
+
+Force disable_msix_handshake to 0:
+qla24xx_config_rings():
+if (0 && (ha->fw_attributes & BIT_6) && (IS_MSIX_NACK_CAPABLE(ha)) &&
+ (ha->flags.msix_enabled)) {
+
+In qla24xx_msix_rsp_q() and qla2xxx_msix_rsp_q_hs(), check:
+ (rd_reg_dword(®->host_status) & HSRX_RISC_INT)
+
+Count the number of calls to each function with HSRX_RISC_INT set and
+the number with HSRX_RISC_INT not set while performing some I/O.
+
+If qla2xxx_msix_rsp_q_hs() clears the RISC interrupt (original code):
+qla24xx_msix_rsp_q: 50% of calls have HSRX_RISC_INT set
+qla2xxx_msix_rsp_q_hs: 5% of calls have HSRX_RISC_INT set
+(# of qla2xxx_msix_rsp_q_hs interrupts) =
+ (# of qla24xx_msix_rsp_q interrupts) * 3
+
+If qla2xxx_msix_rsp_q_hs() does not clear the RISC interrupt (patched
+code):
+qla24xx_msix_rsp_q: 100% of calls have HSRX_RISC_INT set
+qla2xxx_msix_rsp_q_hs: 9% of calls have HSRX_RISC_INT set
+(# of qla2xxx_msix_rsp_q_hs interrupts) =
+ (# of qla24xx_msix_rsp_q interrupts) * 3
+
+In the case of the original code, qla24xx_msix_rsp_q() was seeing
+HSRX_RISC_INT set only 50% of the time because qla2xxx_msix_rsp_q_hs()
+was clearing it when it shouldn't have been. In the patched code,
+qla24xx_msix_rsp_q() sees HSRX_RISC_INT set 100% of the time, which
+makes sense if that interrupt handler needs to clear the RISC interrupt
+(which it does). qla2xxx_msix_rsp_q_hs() sees HSRX_RISC_INT only 9% of
+the time, which is just overlap from the other interrupt during the
+high IOPS test.
+
+Tested with SCST on:
+QLE2742 FW:v9.08.02 (32 Gbps 2-port)
+QLE2694L FW:v9.10.11 (16 Gbps 4-port)
+QLE2694L FW:v9.08.02 (16 Gbps 4-port)
+QLE2672 FW:v8.07.12 (16 Gbps 2-port)
+both initiator and target mode
+
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Link: https://patch.msgid.link/56d378eb-14ad-49c7-bae9-c649b6c7691e@cybernetics.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_def.h | 1 -
+ drivers/scsi/qla2xxx/qla_gbl.h | 2 +-
+ drivers/scsi/qla2xxx/qla_isr.c | 32 +++-----------------------------
+ drivers/scsi/qla2xxx/qla_mid.c | 4 +---
+ 4 files changed, 5 insertions(+), 34 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
+index a6ea7c775092..02a2fd1b150a 100644
+--- a/drivers/scsi/qla2xxx/qla_def.h
++++ b/drivers/scsi/qla2xxx/qla_def.h
+@@ -3447,7 +3447,6 @@ struct isp_operations {
+ #define QLA_MSIX_RSP_Q 0x01
+ #define QLA_ATIO_VECTOR 0x02
+ #define QLA_MSIX_QPAIR_MULTIQ_RSP_Q 0x03
+-#define QLA_MSIX_QPAIR_MULTIQ_RSP_Q_HS 0x04
+
+ #define QLA_MIDX_DEFAULT 0
+ #define QLA_MIDX_RSP_Q 1
+diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
+index d1c290f3f56a..e8c66cc4b71b 100644
+--- a/drivers/scsi/qla2xxx/qla_gbl.h
++++ b/drivers/scsi/qla2xxx/qla_gbl.h
+@@ -769,7 +769,7 @@ extern int qla2x00_dfs_remove(scsi_qla_host_t *);
+
+ /* Globa function prototypes for multi-q */
+ extern int qla25xx_request_irq(struct qla_hw_data *, struct qla_qpair *,
+- struct qla_msix_entry *, int);
++ struct qla_msix_entry *);
+ extern int qla25xx_init_req_que(struct scsi_qla_host *, struct req_que *);
+ extern int qla25xx_init_rsp_que(struct scsi_qla_host *, struct rsp_que *);
+ extern int qla25xx_create_req_que(struct qla_hw_data *, uint16_t, uint8_t,
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index 51e906fa8694..1459ae380389 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -4284,32 +4284,6 @@ qla2xxx_msix_rsp_q(int irq, void *dev_id)
+ return IRQ_HANDLED;
+ }
+
+-irqreturn_t
+-qla2xxx_msix_rsp_q_hs(int irq, void *dev_id)
+-{
+- struct qla_hw_data *ha;
+- struct qla_qpair *qpair;
+- struct device_reg_24xx __iomem *reg;
+- unsigned long flags;
+-
+- qpair = dev_id;
+- if (!qpair) {
+- ql_log(ql_log_info, NULL, 0x505b,
+- "%s: NULL response queue pointer.\n", __func__);
+- return IRQ_NONE;
+- }
+- ha = qpair->hw;
+-
+- reg = &ha->iobase->isp24;
+- spin_lock_irqsave(&ha->hardware_lock, flags);
+- wrt_reg_dword(®->hccr, HCCRX_CLR_RISC_INT);
+- spin_unlock_irqrestore(&ha->hardware_lock, flags);
+-
+- queue_work(ha->wq, &qpair->q_work);
+-
+- return IRQ_HANDLED;
+-}
+-
+ /* Interrupt handling helpers. */
+
+ struct qla_init_msix_entry {
+@@ -4322,7 +4296,6 @@ static const struct qla_init_msix_entry msix_entries[] = {
+ { "rsp_q", qla24xx_msix_rsp_q },
+ { "atio_q", qla83xx_msix_atio_q },
+ { "qpair_multiq", qla2xxx_msix_rsp_q },
+- { "qpair_multiq_hs", qla2xxx_msix_rsp_q_hs },
+ };
+
+ static const struct qla_init_msix_entry qla82xx_msix_entries[] = {
+@@ -4609,9 +4582,10 @@ qla2x00_free_irqs(scsi_qla_host_t *vha)
+ }
+
+ int qla25xx_request_irq(struct qla_hw_data *ha, struct qla_qpair *qpair,
+- struct qla_msix_entry *msix, int vector_type)
++ struct qla_msix_entry *msix)
+ {
+- const struct qla_init_msix_entry *intr = &msix_entries[vector_type];
++ const struct qla_init_msix_entry *intr =
++ &msix_entries[QLA_MSIX_QPAIR_MULTIQ_RSP_Q];
+ scsi_qla_host_t *vha = pci_get_drvdata(ha->pdev);
+ int ret;
+
+diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
+index cb52841c5105..7e1956d0435d 100644
+--- a/drivers/scsi/qla2xxx/qla_mid.c
++++ b/drivers/scsi/qla2xxx/qla_mid.c
+@@ -910,9 +910,7 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options,
+ rsp->options, rsp->id, rsp->rsp_q_in,
+ rsp->rsp_q_out);
+
+- ret = qla25xx_request_irq(ha, qpair, qpair->msix,
+- ha->flags.disable_msix_handshake ?
+- QLA_MSIX_QPAIR_MULTIQ_RSP_Q : QLA_MSIX_QPAIR_MULTIQ_RSP_Q_HS);
++ ret = qla25xx_request_irq(ha, qpair, qpair->msix);
+ if (ret)
+ goto que_failed;
+
+--
+2.51.0
+
--- /dev/null
+From 6bc6ab97180e5b99dca7a3d39adfb4f040174e37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 10:51:28 -0500
+Subject: scsi: qla2xxx: Use reinit_completion on mbx_intr_comp
+
+From: Tony Battersby <tonyb@cybernetics.com>
+
+[ Upstream commit 957aa5974989fba4ae4f807ebcb27f12796edd4d ]
+
+If a mailbox command completes immediately after
+wait_for_completion_timeout() times out, ha->mbx_intr_comp could be left
+in an inconsistent state, causing the next mailbox command not to wait
+for the hardware. Fix by reinitializing the completion before use.
+
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Link: https://patch.msgid.link/11b6485e-0bfd-4784-8f99-c06a196dad94@cybernetics.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_mbx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
+index 7a28582b1f73..771b323a5194 100644
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -253,6 +253,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
+ /* Issue set host interrupt command to send cmd out. */
+ ha->flags.mbox_int = 0;
+ clear_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags);
++ reinit_completion(&ha->mbx_intr_comp);
+
+ /* Unlock mbx registers and wait for interrupt */
+ ql_dbg(ql_dbg_mbx, vha, 0x100f,
+@@ -279,6 +280,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
+ "cmd=%x Timeout.\n", command);
+ spin_lock_irqsave(&ha->hardware_lock, flags);
+ clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags);
++ reinit_completion(&ha->mbx_intr_comp);
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
+ if (chip_reset != ha->chip_reset) {
+--
+2.51.0
+
--- /dev/null
+From 1d28338b3bffc27c86b1ab631e3e26e1ff45d7ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Oct 2025 11:08:40 +0800
+Subject: serial: sprd: Return -EPROBE_DEFER when uart clock is not ready
+
+From: Wenhua Lin <Wenhua.Lin@unisoc.com>
+
+[ Upstream commit 29e8a0c587e328ed458380a45d6028adf64d7487 ]
+
+In sprd_clk_init(), when devm_clk_get() returns -EPROBE_DEFER
+for either uart or source clock, we should propagate the
+error instead of just warning and continuing with NULL clocks.
+
+Currently the driver only emits a warning when clock acquisition
+fails and proceeds with NULL clock pointers. This can lead to
+issues later when the clocks are actually needed. More importantly,
+when the clock provider is not ready yet and returns -EPROBE_DEFER,
+we should return this error to allow deferred probing.
+
+This change adds explicit checks for -EPROBE_DEFER after both:
+1. devm_clk_get(uport->dev, uart)
+2. devm_clk_get(uport->dev, source)
+
+When -EPROBE_DEFER is encountered, the function now returns
+-EPROBE_DEFER to let the driver framework retry probing
+later when the clock dependencies are resolved.
+
+Signed-off-by: Wenhua Lin <Wenhua.Lin@unisoc.com>
+Link: https://patch.msgid.link/20251022030840.956589-1-Wenhua.Lin@unisoc.com
+Reviewed-by: Cixi Geng <cixi.geng@linux.dev>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/sprd_serial.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c
+index a1952e4f1fcb..e850959ecf55 100644
+--- a/drivers/tty/serial/sprd_serial.c
++++ b/drivers/tty/serial/sprd_serial.c
+@@ -1137,6 +1137,9 @@ static int sprd_clk_init(struct uart_port *uport)
+
+ clk_uart = devm_clk_get(uport->dev, "uart");
+ if (IS_ERR(clk_uart)) {
++ if (PTR_ERR(clk_uart) == -EPROBE_DEFER)
++ return -EPROBE_DEFER;
++
+ dev_warn(uport->dev, "uart%d can't get uart clock\n",
+ uport->line);
+ clk_uart = NULL;
+@@ -1144,6 +1147,9 @@ static int sprd_clk_init(struct uart_port *uport)
+
+ clk_parent = devm_clk_get(uport->dev, "source");
+ if (IS_ERR(clk_parent)) {
++ if (PTR_ERR(clk_parent) == -EPROBE_DEFER)
++ return -EPROBE_DEFER;
++
+ dev_warn(uport->dev, "uart%d can't get source clock\n",
+ uport->line);
+ clk_parent = NULL;
+--
+2.51.0
+
spi-fsl-cpm-check-length-parity-before-switching-to-16-bit-mode.patch
mmc-sdhci-esdhc-imx-add-alternate-arch_s32-dependency-to-kconfig.patch
net-hsr-fix-null-pointer-dereference-in-prp_get_untagged_frame.patch
+alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch
+alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch
+alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch
+ipmi-fix-the-race-between-__scan_channels-and-delive.patch
+ipmi-fix-__scan_channels-failing-to-rescan-channels.patch
+firmware-imx-scu-irq-init-workqueue-before-request-m.patch
+ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch
+clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch
+powerpc-addnote-fix-overflow-on-32-bit-builds.patch
+scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch
+scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch
+scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch
+via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch
+reset-fix-bit-macro-reference.patch
+exfat-fix-remount-failure-in-different-process-envir.patch
+usbip-fix-locking-bug-in-rt-enabled-kernels.patch
+usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch
+usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch
+usb-usb-storage-no-additional-quirks-need-to-be-adde.patch
+serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch
+nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch
+platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch
--- /dev/null
+From 3cc58f948432d5a1d70587f57282139dd8b4dada Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 15:11:13 +0200
+Subject: ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx
+
+From: Matthias Schiffer <matthias.schiffer@tq-group.com>
+
+[ Upstream commit 3f61783920504b2cf99330b372d82914bb004d8e ]
+
+am33xx.dtsi has the same clock setup as am35xx.dtsi, setting
+ti,no-reset-on-init and ti,no-idle on timer1_target and timer2_target,
+so AM33 needs the same workaround as AM35 to avoid ti-sysc probe
+failing on certain target modules.
+
+Signed-off-by: Matthias Schiffer <matthias.schiffer@tq-group.com>
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250825131114.2206804-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/ti-sysc.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index 20e090723485..12ab9bf160c9 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -37,6 +37,7 @@ enum sysc_soc {
+ SOC_UNKNOWN,
+ SOC_2420,
+ SOC_2430,
++ SOC_AM33,
+ SOC_3430,
+ SOC_AM35,
+ SOC_3630,
+@@ -2946,6 +2947,7 @@ static void ti_sysc_idle(struct work_struct *work)
+ static const struct soc_device_attribute sysc_soc_match[] = {
+ SOC_FLAG("OMAP242*", SOC_2420),
+ SOC_FLAG("OMAP243*", SOC_2430),
++ SOC_FLAG("AM33*", SOC_AM33),
+ SOC_FLAG("AM35*", SOC_AM35),
+ SOC_FLAG("OMAP3[45]*", SOC_3430),
+ SOC_FLAG("OMAP3[67]*", SOC_3630),
+@@ -3153,10 +3155,15 @@ static int sysc_check_active_timer(struct sysc *ddata)
+ * can be dropped if we stop supporting old beagleboard revisions
+ * A to B4 at some point.
+ */
+- if (sysc_soc->soc == SOC_3430 || sysc_soc->soc == SOC_AM35)
++ switch (sysc_soc->soc) {
++ case SOC_AM33:
++ case SOC_3430:
++ case SOC_AM35:
+ error = -ENXIO;
+- else
++ break;
++ default:
+ error = -EBUSY;
++ }
+
+ if ((ddata->cfg.quirks & SYSC_QUIRK_NO_RESET_ON_INIT) &&
+ (ddata->cfg.quirks & SYSC_QUIRK_NO_IDLE))
+--
+2.51.0
+
--- /dev/null
+From 4f620a2a6006882b1fc5e185c1709eaa5f4928cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 14:53:07 -0400
+Subject: usb: typec: ucsi: Handle incorrect num_connectors capability
+
+From: Mark Pearson <mpearson-lenovo@squebb.ca>
+
+[ Upstream commit 30cd2cb1abf4c4acdb1ddb468c946f68939819fb ]
+
+The UCSI spec states that the num_connectors field is 7 bits, and the
+8th bit is reserved and should be set to zero.
+Some buggy FW has been known to set this bit, and it can lead to a
+system not booting.
+Flag that the FW is not behaving correctly, and auto-fix the value
+so that the system boots correctly.
+
+Found on Lenovo P1 G8 during Linux enablement program. The FW will
+be fixed, but seemed worth addressing in case it hit platforms that
+aren't officially Linux supported.
+
+Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20250821185319.2585023-1-mpearson-lenovo@squebb.ca
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/ucsi/ucsi.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
+index 62124882b21a..05a2909e84fd 100644
+--- a/drivers/usb/typec/ucsi/ucsi.c
++++ b/drivers/usb/typec/ucsi/ucsi.c
+@@ -1270,6 +1270,12 @@ static int ucsi_init(struct ucsi *ucsi)
+ ret = -ENODEV;
+ goto err_reset;
+ }
++ /* Check if reserved bit set. This is out of spec but happens in buggy FW */
++ if (ucsi->cap.num_connectors & 0x80) {
++ dev_warn(ucsi->dev, "UCSI: Invalid num_connectors %d. Likely buggy FW\n",
++ ucsi->cap.num_connectors);
++ ucsi->cap.num_connectors &= 0x7f; // clear bit and carry on
++ }
+
+ /* Allocate the connectors. Released in ucsi_unregister() */
+ ucsi->connector = kcalloc(ucsi->cap.num_connectors + 1,
+--
+2.51.0
+
--- /dev/null
+From 111c265db2dd32128376d8abd24c81f09edf5315 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 14:40:20 +0800
+Subject: usb: usb-storage: No additional quirks need to be added to the EL-R12
+ optical drive.
+
+From: Chen Changcheng <chenchangcheng@kylinos.cn>
+
+[ Upstream commit 955a48a5353f4fe009704a9a4272a3adf627cd35 ]
+
+The optical drive of EL-R12 has the same vid and pid as INIC-3069,
+as follows:
+T: Bus=02 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#= 3 Spd=5000 MxCh= 0
+D: Ver= 3.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
+P: Vendor=13fd ProdID=3940 Rev= 3.10
+S: Manufacturer=HL-DT-ST
+S: Product= DVD+-RW GT80N
+S: SerialNumber=423349524E4E38303338323439202020
+C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=144mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=02 Prot=50 Driver=usb-storage
+E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=0a(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+
+This will result in the optical drive device also adding
+the quirks of US_FL_NO_ATA_1X. When performing an erase operation,
+it will fail, and the reason for the failure is as follows:
+[ 388.967742] sr 5:0:0:0: [sr0] tag#0 Send: scmd 0x00000000d20c33a7
+[ 388.967742] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00
+[ 388.967773] sr 5:0:0:0: [sr0] tag#0 Done: SUCCESS Result: hostbyte=DID_TARGET_FAILURE driverbyte=DRIVER_OK cmd_age=0s
+[ 388.967773] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00
+[ 388.967803] sr 5:0:0:0: [sr0] tag#0 Sense Key : Illegal Request [current]
+[ 388.967803] sr 5:0:0:0: [sr0] tag#0 Add. Sense: Invalid field in cdb
+[ 388.967803] sr 5:0:0:0: [sr0] tag#0 scsi host busy 1 failed 0
+[ 388.967803] sr 5:0:0:0: Notifying upper driver of completion (result 8100002)
+[ 388.967834] sr 5:0:0:0: [sr0] tag#0 0 sectors total, 0 bytes done.
+
+For the EL-R12 standard optical drive, all operational commands
+and usage scenarios were tested without adding the IGNORE_RESIDUE quirks,
+and no issues were encountered. It can be reasonably concluded
+that removing the IGNORE_RESIDUE quirks has no impact.
+
+Signed-off-by: Chen Changcheng <chenchangcheng@kylinos.cn>
+Link: https://patch.msgid.link/20251121064020.29332-1-chenchangcheng@kylinos.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/storage/unusual_uas.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index 1477e31d7763..b695f5ba9a40 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -98,7 +98,7 @@ UNUSUAL_DEV(0x125f, 0xa94a, 0x0160, 0x0160,
+ US_FL_NO_ATA_1X),
+
+ /* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
+-UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
++UNUSUAL_DEV(0x13fd, 0x3940, 0x0309, 0x0309,
+ "Initio Corporation",
+ "INIC-3069",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+--
+2.51.0
+
--- /dev/null
+From 69e5f9d6e6e4fe62243fa09cc1f38ce71872464c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 16:23:55 +0200
+Subject: usb: xhci: limit run_graceperiod for only usb 3.0 devices
+
+From: Hongyu Xie <xiehongyu1@kylinos.cn>
+
+[ Upstream commit 8d34983720155b8f05de765f0183d9b0e1345cc0 ]
+
+run_graceperiod blocks usb 2.0 devices from auto suspending after
+xhci_start for 500ms.
+
+Log shows:
+[ 13.387170] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100
+[ 13.387177] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.387182] hub_suspend:3903: hub 7-0:1.0: hub_suspend
+[ 13.387188] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1
+[ 13.387191] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event
+[ 13.387193] hcd_bus_resume:2303: usb usb7: usb auto-resume
+[ 13.387296] hub_event:5779: hub 3-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.393343] handle_port_status:2034: xhci-hcd PNP0D10:02: handle_port_status: starting usb5 port polling.
+[ 13.393353] xhci_hub_control:1271: xhci-hcd PNP0D10:02: Get port status 5-1 read: 0x206e1, return 0x10101
+[ 13.400047] hub_suspend:3903: hub 3-0:1.0: hub_suspend
+[ 13.403077] hub_resume:3948: hub 7-0:1.0: hub_resume
+[ 13.403080] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100
+[ 13.403085] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.403087] hub_suspend:3903: hub 7-0:1.0: hub_suspend
+[ 13.403090] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1
+[ 13.403093] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event
+[ 13.403095] hcd_bus_resume:2303: usb usb7: usb auto-resume
+[ 13.405002] handle_port_status:1913: xhci-hcd PNP0D10:04: Port change event, 9-1, id 1, portsc: 0x6e1
+[ 13.405016] hub_activate:1169: usb usb5-port1: status 0101 change 0001
+[ 13.405026] xhci_clear_port_change_bit:658: xhci-hcd PNP0D10:02: clear port1 connect change, portsc: 0x6e1
+[ 13.413275] hcd_bus_suspend:2250: usb usb3: bus auto-suspend, wakeup 1
+[ 13.419081] hub_resume:3948: hub 7-0:1.0: hub_resume
+[ 13.419086] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100
+[ 13.419095] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.419100] hub_suspend:3903: hub 7-0:1.0: hub_suspend
+[ 13.419106] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1
+[ 13.419110] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event
+[ 13.419112] hcd_bus_resume:2303: usb usb7: usb auto-resume
+[ 13.420455] handle_port_status:2034: xhci-hcd PNP0D10:04: handle_port_status: starting usb9 port polling.
+[ 13.420493] handle_port_status:1913: xhci-hcd PNP0D10:05: Port change event, 10-1, id 1, portsc: 0x6e1
+[ 13.425332] hcd_bus_suspend:2279: usb usb3: suspend raced with wakeup event
+[ 13.431931] handle_port_status:2034: xhci-hcd PNP0D10:05: handle_port_status: starting usb10 port polling.
+[ 13.435080] hub_resume:3948: hub 7-0:1.0: hub_resume
+[ 13.435084] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100
+[ 13.435092] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.435096] hub_suspend:3903: hub 7-0:1.0: hub_suspend
+[ 13.435102] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1
+[ 13.435106] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event
+
+usb7 and other usb 2.0 root hub were rapidly toggling between suspend
+and resume states. More, "suspend raced with wakeup event" confuses people.
+
+So, limit run_graceperiod for only usb 3.0 devices
+
+Signed-off-by: Hongyu Xie <xiehongyu1@kylinos.cn>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://patch.msgid.link/20251119142417.2820519-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-hub.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index b226b5487694..f10ab11616ac 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -1650,7 +1650,7 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
+ * SS devices are only visible to roothub after link training completes.
+ * Keep polling roothubs for a grace period after xHC start
+ */
+- if (xhci->run_graceperiod) {
++ if (hcd->speed >= HCD_USB3 && xhci->run_graceperiod) {
+ if (time_before(jiffies, xhci->run_graceperiod))
+ status = 1;
+ else
+--
+2.51.0
+
--- /dev/null
+From bc8196ecc88503f4c67807778c97a60eddae66ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 09:41:43 +0800
+Subject: usbip: Fix locking bug in RT-enabled kernels
+
+From: Lizhi Xu <lizhi.xu@windriver.com>
+
+[ Upstream commit 09bf21bf5249880f62fe759b53b14b4b52900c6c ]
+
+Interrupts are disabled before entering usb_hcd_giveback_urb().
+A spinlock_t becomes a sleeping lock on PREEMPT_RT, so it cannot be
+acquired with disabled interrupts.
+
+Save the interrupt status and restore it after usb_hcd_giveback_urb().
+
+syz reported:
+BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
+Call Trace:
+ dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
+ rt_spin_lock+0xc7/0x2c0 kernel/locking/spinlock_rt.c:57
+ spin_lock include/linux/spinlock_rt.h:44 [inline]
+ mon_bus_complete drivers/usb/mon/mon_main.c:134 [inline]
+ mon_complete+0x5c/0x200 drivers/usb/mon/mon_main.c:147
+ usbmon_urb_complete include/linux/usb/hcd.h:738 [inline]
+ __usb_hcd_giveback_urb+0x254/0x5e0 drivers/usb/core/hcd.c:1647
+ vhci_urb_enqueue+0xb4f/0xe70 drivers/usb/usbip/vhci_hcd.c:818
+
+Reported-by: syzbot+205ef33a3b636b4181fb@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=205ef33a3b636b4181fb
+Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20250916014143.1439759-1-lizhi.xu@windriver.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/usbip/vhci_hcd.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
+index e3c8483d7ba4..cfe51672ca41 100644
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -830,15 +830,15 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ no_need_xmit:
+ usb_hcd_unlink_urb_from_ep(hcd, urb);
+ no_need_unlink:
+- spin_unlock_irqrestore(&vhci->lock, flags);
+ if (!ret) {
+ /* usb_hcd_giveback_urb() should be called with
+ * irqs disabled
+ */
+- local_irq_disable();
++ spin_unlock(&vhci->lock);
+ usb_hcd_giveback_urb(hcd, urb, urb->status);
+- local_irq_enable();
++ spin_lock(&vhci->lock);
+ }
++ spin_unlock_irqrestore(&vhci->lock, flags);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 03355f95e160a728e6cc0e791080e3aa38f72124 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Sep 2025 16:33:32 +0800
+Subject: via_wdt: fix critical boot hang due to unnamed resource allocation
+
+From: Li Qiang <liqiang01@kylinos.cn>
+
+[ Upstream commit 7aa31ee9ec92915926e74731378c009c9cc04928 ]
+
+The VIA watchdog driver uses allocate_resource() to reserve a MMIO
+region for the watchdog control register. However, the allocated
+resource was not given a name, which causes the kernel resource tree
+to contain an entry marked as "<BAD>" under /proc/iomem on x86
+platforms.
+
+During boot, this unnamed resource can lead to a critical hang because
+subsequent resource lookups and conflict checks fail to handle the
+invalid entry properly.
+
+Signed-off-by: Li Qiang <liqiang01@kylinos.cn>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/via_wdt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/watchdog/via_wdt.c b/drivers/watchdog/via_wdt.c
+index eeb39f96e72e..c1ed3ce153cf 100644
+--- a/drivers/watchdog/via_wdt.c
++++ b/drivers/watchdog/via_wdt.c
+@@ -165,6 +165,7 @@ static int wdt_probe(struct pci_dev *pdev,
+ dev_err(&pdev->dev, "cannot enable PCI device\n");
+ return -ENODEV;
+ }
++ wdt_res.name = "via_wdt";
+
+ /*
+ * Allocate a MMIO region which contains watchdog control register
+--
+2.51.0
+
--- /dev/null
+From 4a4d63c359f25af46135bf94df78675ca01d7145 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 17:04:33 +0800
+Subject: ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path
+
+From: Haotian Zhang <vulab@iscas.ac.cn>
+
+[ Upstream commit 5032347c04ba7ff9ba878f262e075d745c06a2a8 ]
+
+When pdacf_config() fails, snd_pdacf_probe() returns the error code
+directly without freeing the sound card resources allocated by
+snd_card_new(), which leads to a memory leak.
+
+Add proper error handling to free the sound card and clear the card
+list entry when pdacf_config() fails.
+
+Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions")
+Suggested-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
+Link: https://patch.msgid.link/20251215090433.211-1-vulab@iscas.ac.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pcmcia/pdaudiocf/pdaudiocf.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf.c b/sound/pcmcia/pdaudiocf/pdaudiocf.c
+index 8363ec08df5d..4468d81683ec 100644
+--- a/sound/pcmcia/pdaudiocf/pdaudiocf.c
++++ b/sound/pcmcia/pdaudiocf/pdaudiocf.c
+@@ -132,7 +132,13 @@ static int snd_pdacf_probe(struct pcmcia_device *link)
+ link->config_index = 1;
+ link->config_regs = PRESENT_OPTION;
+
+- return pdacf_config(link);
++ err = pdacf_config(link);
++ if (err < 0) {
++ card_list[i] = NULL;
++ snd_card_free(card);
++ return err;
++ }
++ return 0;
+ }
+
+
+--
+2.51.0
+
--- /dev/null
+From 5216cb6a1f8e1c9b13d574f14c091f49ad7cacce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 10:46:30 +0800
+Subject: ALSA: usb-mixer: us16x08: validate meter packet indices
+
+From: Shipei Qu <qu@darknavy.com>
+
+[ Upstream commit 5526c1c6ba1d0913c7dfcbbd6fe1744ea7c55f1e ]
+
+get_meter_levels_from_urb() parses the 64-byte meter packets sent by
+the device and fills the per-channel arrays meter_level[],
+comp_level[] and master_level[] in struct snd_us16x08_meter_store.
+
+Currently the function derives the channel index directly from the
+meter packet (MUB2(meter_urb, s) - 1) and uses it to index those
+arrays without validating the range. If the packet contains a
+negative or out-of-range channel number, the driver may write past
+the end of these arrays.
+
+Introduce a local channel variable and validate it before updating the
+arrays. We reject negative indices, limit meter_level[] and
+comp_level[] to SND_US16X08_MAX_CHANNELS, and guard master_level[]
+updates with ARRAY_SIZE(master_level).
+
+Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk")
+Reported-by: DARKNAVY (@DarkNavyOrg) <vr@darknavy.com>
+Closes: https://lore.kernel.org/tencent_21C112743C44C1A2517FF219@qq.com
+Signed-off-by: Shipei Qu <qu@darknavy.com>
+Link: https://patch.msgid.link/20251217024630.59576-1-qu@darknavy.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_us16x08.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/sound/usb/mixer_us16x08.c b/sound/usb/mixer_us16x08.c
+index 20ac32635f1f..d05cb54de788 100644
+--- a/sound/usb/mixer_us16x08.c
++++ b/sound/usb/mixer_us16x08.c
+@@ -656,17 +656,25 @@ static void get_meter_levels_from_urb(int s,
+ u8 *meter_urb)
+ {
+ int val = MUC2(meter_urb, s) + (MUC3(meter_urb, s) << 8);
++ int ch = MUB2(meter_urb, s) - 1;
++
++ if (ch < 0)
++ return;
+
+ if (MUA0(meter_urb, s) == 0x61 && MUA1(meter_urb, s) == 0x02 &&
+ MUA2(meter_urb, s) == 0x04 && MUB0(meter_urb, s) == 0x62) {
+- if (MUC0(meter_urb, s) == 0x72)
+- store->meter_level[MUB2(meter_urb, s) - 1] = val;
+- if (MUC0(meter_urb, s) == 0xb2)
+- store->comp_level[MUB2(meter_urb, s) - 1] = val;
++ if (ch < SND_US16X08_MAX_CHANNELS) {
++ if (MUC0(meter_urb, s) == 0x72)
++ store->meter_level[ch] = val;
++ if (MUC0(meter_urb, s) == 0xb2)
++ store->comp_level[ch] = val;
++ }
+ }
+ if (MUA0(meter_urb, s) == 0x61 && MUA1(meter_urb, s) == 0x02 &&
+- MUA2(meter_urb, s) == 0x02 && MUB0(meter_urb, s) == 0x62)
+- store->master_level[MUB2(meter_urb, s) - 1] = val;
++ MUA2(meter_urb, s) == 0x02 && MUB0(meter_urb, s) == 0x62) {
++ if (ch < ARRAY_SIZE(store->master_level))
++ store->master_level[ch] = val;
++ }
+ }
+
+ /* Function to retrieve current meter values from the device.
+--
+2.51.0
+
--- /dev/null
+From 2a8c901b8bb40572b31b565b9e559d88ba737d06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 12:26:52 +0800
+Subject: ALSA: vxpocket: Fix resource leak in vxpocket_probe error path
+
+From: Haotian Zhang <vulab@iscas.ac.cn>
+
+[ Upstream commit 2a03b40deacbd293ac9aed0f9b11197dad54fe5f ]
+
+When vxpocket_config() fails, vxpocket_probe() returns the error code
+directly without freeing the sound card resources allocated by
+snd_card_new(), which leads to a memory leak.
+
+Add proper error handling to free the sound card and clear the
+allocation bit when vxpocket_config() fails.
+
+Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions")
+Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
+Link: https://patch.msgid.link/20251215042652.695-1-vulab@iscas.ac.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pcmcia/vx/vxpocket.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pcmcia/vx/vxpocket.c b/sound/pcmcia/vx/vxpocket.c
+index 7a0f0e73ceb2..867a477d53ae 100644
+--- a/sound/pcmcia/vx/vxpocket.c
++++ b/sound/pcmcia/vx/vxpocket.c
+@@ -295,7 +295,13 @@ static int vxpocket_probe(struct pcmcia_device *p_dev)
+
+ vxp->p_dev = p_dev;
+
+- return vxpocket_config(p_dev);
++ err = vxpocket_config(p_dev);
++ if (err < 0) {
++ card_alloc &= ~(1 << i);
++ snd_card_free(card);
++ return err;
++ }
++ return 0;
+ }
+
+ static void vxpocket_detach(struct pcmcia_device *link)
+--
+2.51.0
+
--- /dev/null
+From c31f24ca5d5bd655d40ab15e9ab1298eb6c3dddf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 16:16:26 +0100
+Subject: clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &
+ pcie_x4
+
+From: Josua Mayer <josua@solid-run.com>
+
+[ Upstream commit f0e6bc0c3ef4b4afb299bd6912586cafd5d864e9 ]
+
+CP110 based platforms rely on the bootloader for pci port
+initialization.
+TF-A actively prevents non-uboot re-configuration of pci lanes, and many
+boards do not have software control over the pci card reset.
+
+If a pci port had link at boot-time and the clock is stopped at a later
+point, the link fails and can not be recovered.
+
+PCI controller driver probe - and by extension ownership of a driver for
+the pci clocks - may be delayed especially on large modular kernels,
+causing the clock core to start disabling unused clocks.
+
+Add the CLK_IGNORE_UNUSED flag to the three pci port's clocks to ensure
+they are not stopped before the pci controller driver has taken
+ownership and tested for an existing link.
+
+This fixes failed pci link detection when controller driver probes late,
+e.g. with arm64 defconfig and CONFIG_PHY_MVEBU_CP110_COMPHY=m.
+
+Closes: https://lore.kernel.org/r/b71596c7-461b-44b6-89ab-3cfbd492639f@solid-run.com
+Signed-off-by: Josua Mayer <josua@solid-run.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/cp110-system-controller.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/clk/mvebu/cp110-system-controller.c b/drivers/clk/mvebu/cp110-system-controller.c
+index 84c8900542e4..b477396917ad 100644
+--- a/drivers/clk/mvebu/cp110-system-controller.c
++++ b/drivers/clk/mvebu/cp110-system-controller.c
+@@ -110,6 +110,25 @@ static const char * const gate_base_names[] = {
+ [CP110_GATE_EIP197] = "eip197"
+ };
+
++static unsigned long gate_flags(const u8 bit_idx)
++{
++ switch (bit_idx) {
++ case CP110_GATE_PCIE_X1_0:
++ case CP110_GATE_PCIE_X1_1:
++ case CP110_GATE_PCIE_X4:
++ /*
++ * If a port had an active link at boot time, stopping
++ * the clock creates a failed state from which controller
++ * driver can not recover.
++ * Prevent stopping this clock till after a driver has taken
++ * ownership.
++ */
++ return CLK_IGNORE_UNUSED;
++ default:
++ return 0;
++ }
++};
++
+ struct cp110_gate_clk {
+ struct clk_hw hw;
+ struct regmap *regmap;
+@@ -171,6 +190,7 @@ static struct clk_hw *cp110_register_gate(const char *name,
+ init.ops = &cp110_gate_ops;
+ init.parent_names = &parent_name;
+ init.num_parents = 1;
++ init.flags = gate_flags(bit_idx);
+
+ gate->regmap = regmap;
+ gate->bit_idx = bit_idx;
+--
+2.51.0
+
--- /dev/null
+From 278cfee2cbe33a93de5bd1f1a1887b33d737fdb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 17:51:10 +0800
+Subject: exfat: fix remount failure in different process environments
+
+From: Yuezhang Mo <Yuezhang.Mo@sony.com>
+
+[ Upstream commit 51fc7b4ce10ccab8ea5e4876bcdc42cf5202a0ef ]
+
+The kernel test robot reported that the exFAT remount operation
+failed. The reason for the failure was that the process's umask
+is different between mount and remount, causing fs_fmask and
+fs_dmask are changed.
+
+Potentially, both gid and uid may also be changed. Therefore, when
+initializing fs_context for remount, inherit these mount options
+from the options used during mount.
+
+Reported-by: kernel test robot <oliver.sang@intel.com>
+Closes: https://lore.kernel.org/oe-lkp/202511251637.81670f5c-lkp@intel.com
+Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exfat/super.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/fs/exfat/super.c b/fs/exfat/super.c
+index 6cb7a11a3f62..52b852a4121b 100644
+--- a/fs/exfat/super.c
++++ b/fs/exfat/super.c
+@@ -763,10 +763,21 @@ static int exfat_init_fs_context(struct fs_context *fc)
+ ratelimit_state_init(&sbi->ratelimit, DEFAULT_RATELIMIT_INTERVAL,
+ DEFAULT_RATELIMIT_BURST);
+
+- sbi->options.fs_uid = current_uid();
+- sbi->options.fs_gid = current_gid();
+- sbi->options.fs_fmask = current->fs->umask;
+- sbi->options.fs_dmask = current->fs->umask;
++ if (fc->purpose == FS_CONTEXT_FOR_RECONFIGURE && fc->root) {
++ struct super_block *sb = fc->root->d_sb;
++ struct exfat_mount_options *cur_opts = &EXFAT_SB(sb)->options;
++
++ sbi->options.fs_uid = cur_opts->fs_uid;
++ sbi->options.fs_gid = cur_opts->fs_gid;
++ sbi->options.fs_fmask = cur_opts->fs_fmask;
++ sbi->options.fs_dmask = cur_opts->fs_dmask;
++ } else {
++ sbi->options.fs_uid = current_uid();
++ sbi->options.fs_gid = current_gid();
++ sbi->options.fs_fmask = current->fs->umask;
++ sbi->options.fs_dmask = current->fs->umask;
++ }
++
+ sbi->options.allow_utime = -1;
+ sbi->options.iocharset = exfat_default_iocharset;
+ sbi->options.errors = EXFAT_ERRORS_RO;
+--
+2.51.0
+
--- /dev/null
+From 794c5376098b61f1bd1eefdab7d5b5dbd3984900 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Oct 2025 09:56:26 +0800
+Subject: firmware: imx: scu-irq: Init workqueue before request mbox channel
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit 81fb53feb66a3aefbf6fcab73bb8d06f5b0c54ad ]
+
+With mailbox channel requested, there is possibility that interrupts may
+come in, so need to make sure the workqueue is initialized before
+the queue is scheduled by mailbox rx callback.
+
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/imx/imx-scu-irq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/imx/imx-scu-irq.c b/drivers/firmware/imx/imx-scu-irq.c
+index 32b1ca4e1050..06c49a61a079 100644
+--- a/drivers/firmware/imx/imx-scu-irq.c
++++ b/drivers/firmware/imx/imx-scu-irq.c
+@@ -148,6 +148,8 @@ int imx_scu_enable_general_irq_channel(struct device *dev)
+ cl->dev = dev;
+ cl->rx_callback = imx_scu_irq_callback;
+
++ INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler);
++
+ /* SCU general IRQ uses general interrupt channel 3 */
+ ch = mbox_request_channel_byname(cl, "gip3");
+ if (IS_ERR(ch)) {
+@@ -157,8 +159,6 @@ int imx_scu_enable_general_irq_channel(struct device *dev)
+ return ret;
+ }
+
+- INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler);
+-
+ if (!of_parse_phandle_with_args(dev->of_node, "mboxes",
+ "#mbox-cells", 0, &spec)) {
+ i = of_alias_get_id(spec.np, "mu");
+--
+2.51.0
+
--- /dev/null
+From bf2670b3cbc266b80ba1a604180f7b3b0338b3a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 17:12:50 +0800
+Subject: iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc
+ complains
+
+From: Pei Xiao <xiaopei01@kylinos.cn>
+
+[ Upstream commit c9fb952360d0c78bbe98239bd6b702f05c2dbb31 ]
+
+FIELD_PREP() checks that a value fits into the available bitfield, add a
+check for step_avg to fix gcc complains.
+
+which gcc complains about:
+ drivers/iio/adc/ti_am335x_adc.c: In function 'tiadc_step_config':
+ include/linux/compiler_types.h:572:38: error: call to
+'__compiletime_assert_491' declared with attribute error: FIELD_PREP: value
+too large for the field include/linux/mfd/ti_am335x_tscadc.h:58:29: note:
+in expansion of macro 'FIELD_PREP'
+ #define STEPCONFIG_AVG(val) FIELD_PREP(GENMASK(4, 2), (val))
+ ^~~~~~~~~~
+drivers/iio/adc/ti_am335x_adc.c:127:17: note: in expansion of macro 'STEPCONFIG_AVG'
+ stepconfig = STEPCONFIG_AVG(ffs(adc_dev->step_avg[i]) - 1)
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202510102117.Jqxrw1vF-lkp@intel.com/
+Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/ti_am335x_adc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
+index 3ac253a27dd9..109adff1370e 100644
+--- a/drivers/iio/adc/ti_am335x_adc.c
++++ b/drivers/iio/adc/ti_am335x_adc.c
+@@ -124,7 +124,7 @@ static void tiadc_step_config(struct iio_dev *indio_dev)
+
+ chan = adc_dev->channel_line[i];
+
+- if (adc_dev->step_avg[i])
++ if (adc_dev->step_avg[i] && adc_dev->step_avg[i] <= STEPCONFIG_AVG_16)
+ stepconfig = STEPCONFIG_AVG(ffs(adc_dev->step_avg[i]) - 1) |
+ STEPCONFIG_FIFO1;
+ else
+--
+2.51.0
+
--- /dev/null
+From 61116a7db9c7065ed4f517ee16cec08d7ac67fb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 15:42:38 +0800
+Subject: ipmi: Fix __scan_channels() failing to rescan channels
+
+From: Jinhui Guo <guojinhui.liam@bytedance.com>
+
+[ Upstream commit 6bd30d8fc523fb880b4be548e8501bc0fe8f42d4 ]
+
+channel_handler() sets intf->channels_ready to true but never
+clears it, so __scan_channels() skips any rescan. When the BMC
+firmware changes a rescan is required. Allow it by clearing
+the flag before starting a new scan.
+
+Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
+Message-ID: <20250930074239.2353-3-guojinhui.liam@bytedance.com>
+Signed-off-by: Corey Minyard <corey@minyard.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_msghandler.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index b7f6cec0383f..8bc8da7f70bb 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -613,7 +613,8 @@ static void __ipmi_bmc_unregister(struct ipmi_smi *intf);
+ static int __ipmi_bmc_register(struct ipmi_smi *intf,
+ struct ipmi_device_id *id,
+ bool guid_set, guid_t *guid, int intf_num);
+-static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id);
++static int __scan_channels(struct ipmi_smi *intf,
++ struct ipmi_device_id *id, bool rescan);
+
+
+ /**
+@@ -2665,7 +2666,7 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc,
+ if (__ipmi_bmc_register(intf, &id, guid_set, &guid, intf_num))
+ need_waiter(intf); /* Retry later on an error. */
+ else
+- __scan_channels(intf, &id);
++ __scan_channels(intf, &id, false);
+
+
+ if (!intf_set) {
+@@ -2685,7 +2686,7 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc,
+ goto out_noprocessing;
+ } else if (memcmp(&bmc->fetch_id, &bmc->id, sizeof(bmc->id)))
+ /* Version info changes, scan the channels again. */
+- __scan_channels(intf, &bmc->fetch_id);
++ __scan_channels(intf, &bmc->fetch_id, true);
+
+ bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY;
+
+@@ -3435,10 +3436,17 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)
+ /*
+ * Must be holding intf->bmc_reg_mutex to call this.
+ */
+-static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id)
++static int __scan_channels(struct ipmi_smi *intf,
++ struct ipmi_device_id *id,
++ bool rescan)
+ {
+ int rv;
+
++ if (rescan) {
++ /* Clear channels_ready to force channels rescan. */
++ intf->channels_ready = false;
++ }
++
+ if (ipmi_version_major(id) > 1
+ || (ipmi_version_major(id) == 1
+ && ipmi_version_minor(id) >= 5)) {
+@@ -3641,7 +3649,7 @@ int ipmi_add_smi(struct module *owner,
+ }
+
+ mutex_lock(&intf->bmc_reg_mutex);
+- rv = __scan_channels(intf, &id);
++ rv = __scan_channels(intf, &id, false);
+ mutex_unlock(&intf->bmc_reg_mutex);
+ if (rv)
+ goto out_err_bmc_reg;
+--
+2.51.0
+
--- /dev/null
+From 2d9fd35e8c946945103163d571a835870ee3fefb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 15:42:37 +0800
+Subject: ipmi: Fix the race between __scan_channels() and deliver_response()
+
+From: Jinhui Guo <guojinhui.liam@bytedance.com>
+
+[ Upstream commit 936750fdba4c45e13bbd17f261bb140dd55f5e93 ]
+
+The race window between __scan_channels() and deliver_response() causes
+the parameters of some channels to be set to 0.
+
+1.[CPUA] __scan_channels() issues an IPMI request and waits with
+ wait_event() until all channels have been scanned.
+ wait_event() internally calls might_sleep(), which might
+ yield the CPU. (Moreover, an interrupt can preempt
+ wait_event() and force the task to yield the CPU.)
+2.[CPUB] deliver_response() is invoked when the CPU receives the
+ IPMI response. After processing a IPMI response,
+ deliver_response() directly assigns intf->wchannels to
+ intf->channel_list and sets intf->channels_ready to true.
+ However, not all channels are actually ready for use.
+3.[CPUA] Since intf->channels_ready is already true, wait_event()
+ never enters __wait_event(). __scan_channels() immediately
+ clears intf->null_user_handler and exits.
+4.[CPUB] Once intf->null_user_handler is set to NULL, deliver_response()
+ ignores further IPMI responses, leaving the remaining
+ channels zero-initialized and unusable.
+
+CPUA CPUB
+------------------------------- -----------------------------
+__scan_channels()
+ intf->null_user_handler
+ = channel_handler;
+ send_channel_info_cmd(intf,
+ 0);
+ wait_event(intf->waitq,
+ intf->channels_ready);
+ do {
+ might_sleep();
+ deliver_response()
+ channel_handler()
+ intf->channel_list =
+ intf->wchannels + set;
+ intf->channels_ready = true;
+ send_channel_info_cmd(intf,
+ intf->curr_channel);
+ if (condition)
+ break;
+ __wait_event(wq_head,
+ condition);
+ } while(0)
+ intf->null_user_handler
+ = NULL;
+ deliver_response()
+ if (!msg->user)
+ if (intf->null_user_handler)
+ rv = -EINVAL;
+ return rv;
+------------------------------- -----------------------------
+
+Fix the race between __scan_channels() and deliver_response() by
+deferring both the assignment intf->channel_list = intf->wchannels
+and the flag intf->channels_ready = true until all channels have
+been successfully scanned or until the IPMI request has failed.
+
+Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
+Message-ID: <20250930074239.2353-2-guojinhui.liam@bytedance.com>
+Signed-off-by: Corey Minyard <corey@minyard.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_msghandler.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index a475d0bd2685..b7f6cec0383f 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -3414,8 +3414,6 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)
+ intf->channels_ready = true;
+ wake_up(&intf->waitq);
+ } else {
+- intf->channel_list = intf->wchannels + set;
+- intf->channels_ready = true;
+ rv = send_channel_info_cmd(intf, intf->curr_channel);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 5fb14aff931ef32f9ee8f27a6ed284cac678d2ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 11:05:45 +0100
+Subject: nvme-fc: don't hold rport lock when putting ctrl
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit b71cbcf7d170e51148d5467820ae8a72febcb651 ]
+
+nvme_fc_ctrl_put can acquire the rport lock when freeing the
+ctrl object:
+
+nvme_fc_ctrl_put
+ nvme_fc_ctrl_free
+ spin_lock_irqsave(rport->lock)
+
+Thus we can't hold the rport lock when calling nvme_fc_ctrl_put.
+
+Justin suggested use the safe list iterator variant because
+nvme_fc_ctrl_put will also modify the rport->list.
+
+Cc: Justin Tee <justin.tee@broadcom.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index f5b1378839a7..87a9801ac9f2 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -1501,14 +1501,14 @@ nvme_fc_match_disconn_ls(struct nvme_fc_rport *rport,
+ {
+ struct fcnvme_ls_disconnect_assoc_rqst *rqst =
+ &lsop->rqstbuf->rq_dis_assoc;
+- struct nvme_fc_ctrl *ctrl, *ret = NULL;
++ struct nvme_fc_ctrl *ctrl, *tmp, *ret = NULL;
+ struct nvmefc_ls_rcv_op *oldls = NULL;
+ u64 association_id = be64_to_cpu(rqst->associd.association_id);
+ unsigned long flags;
+
+ spin_lock_irqsave(&rport->lock, flags);
+
+- list_for_each_entry(ctrl, &rport->ctrl_list, ctrl_list) {
++ list_for_each_entry_safe(ctrl, tmp, &rport->ctrl_list, ctrl_list) {
+ if (!nvme_fc_ctrl_get(ctrl))
+ continue;
+ spin_lock(&ctrl->lock);
+@@ -1521,7 +1521,9 @@ nvme_fc_match_disconn_ls(struct nvme_fc_rport *rport,
+ if (ret)
+ /* leave the ctrl get reference */
+ break;
++ spin_unlock_irqrestore(&rport->lock, flags);
+ nvme_fc_ctrl_put(ctrl);
++ spin_lock_irqsave(&rport->lock, flags);
+ }
+
+ spin_unlock_irqrestore(&rport->lock, flags);
+--
+2.51.0
+
--- /dev/null
+From 70b46e94a4700d957b9280973601b9dee2f2d381 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Nov 2025 15:04:07 +0800
+Subject: platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI
+ quirks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+
+[ Upstream commit b169e1733cadb614e87f69d7a5ae1b186c50d313 ]
+
+Dell Pro Rugged 10/12 tablets has a reliable VGBS method.
+If VGBS is not called on boot, the on-screen keyboard won't appear if the
+device is booted without a keyboard.
+
+Call VGBS on boot on thess devices to get the initial state of
+SW_TABLET_MODE in a reliable way.
+
+Signed-off-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Link: https://patch.msgid.link/20251127070407.656463-1-acelan.kao@canonical.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/hid.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c
+index c13837401c26..051f2bb786e9 100644
+--- a/drivers/platform/x86/intel/hid.c
++++ b/drivers/platform/x86/intel/hid.c
+@@ -144,6 +144,18 @@ static const struct dmi_system_id dmi_vgbs_allow_list[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP Elite Dragonfly G2 Notebook PC"),
+ },
+ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro Rugged 10 Tablet RA00260"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro Rugged 12 Tablet RA02260"),
++ },
++ },
+ { }
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 7c4a9f5b36aa6e926f12a659d17eb61a04e901a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Apr 2025 22:31:13 -0400
+Subject: powerpc/addnote: Fix overflow on 32-bit builds
+
+From: Ben Collins <bcollins@kernel.org>
+
+[ Upstream commit 825ce89a3ef17f84cf2c0eacfa6b8dc9fd11d13f ]
+
+The PUT_64[LB]E() macros need to cast the value to unsigned long long
+like the GET_64[LB]E() macros. Caused lots of warnings when compiled
+on 32-bit, and clobbered addresses (36-bit P4080).
+
+Signed-off-by: Ben Collins <bcollins@kernel.org>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/2025042122-mustard-wrasse-694572@boujee-and-buff
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/addnote.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/boot/addnote.c b/arch/powerpc/boot/addnote.c
+index 53b3b2621457..78704927453a 100644
+--- a/arch/powerpc/boot/addnote.c
++++ b/arch/powerpc/boot/addnote.c
+@@ -68,8 +68,8 @@ static int e_class = ELFCLASS32;
+ #define PUT_16BE(off, v)(buf[off] = ((v) >> 8) & 0xff, \
+ buf[(off) + 1] = (v) & 0xff)
+ #define PUT_32BE(off, v)(PUT_16BE((off), (v) >> 16L), PUT_16BE((off) + 2, (v)))
+-#define PUT_64BE(off, v)((PUT_32BE((off), (v) >> 32L), \
+- PUT_32BE((off) + 4, (v))))
++#define PUT_64BE(off, v)((PUT_32BE((off), (unsigned long long)(v) >> 32L), \
++ PUT_32BE((off) + 4, (unsigned long long)(v))))
+
+ #define GET_16LE(off) ((buf[off]) + (buf[(off)+1] << 8))
+ #define GET_32LE(off) (GET_16LE(off) + (GET_16LE((off)+2U) << 16U))
+@@ -78,7 +78,8 @@ static int e_class = ELFCLASS32;
+ #define PUT_16LE(off, v) (buf[off] = (v) & 0xff, \
+ buf[(off) + 1] = ((v) >> 8) & 0xff)
+ #define PUT_32LE(off, v) (PUT_16LE((off), (v)), PUT_16LE((off) + 2, (v) >> 16L))
+-#define PUT_64LE(off, v) (PUT_32LE((off), (v)), PUT_32LE((off) + 4, (v) >> 32L))
++#define PUT_64LE(off, v) (PUT_32LE((off), (unsigned long long)(v)), \
++ PUT_32LE((off) + 4, (unsigned long long)(v) >> 32L))
+
+ #define GET_16(off) (e_data == ELFDATA2MSB ? GET_16BE(off) : GET_16LE(off))
+ #define GET_32(off) (e_data == ELFDATA2MSB ? GET_32BE(off) : GET_32LE(off))
+--
+2.51.0
+
--- /dev/null
+From 9a14328156df86903d97ab0ef983633f1d112830 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 14:10:37 +0800
+Subject: reset: fix BIT macro reference
+
+From: Encrow Thorne <jyc0019@gmail.com>
+
+[ Upstream commit f3d8b64ee46c9b4b0b82b1a4642027728bac95b8 ]
+
+RESET_CONTROL_FLAGS_BIT_* macros use BIT(), but reset.h does not
+include bits.h. This causes compilation errors when including
+reset.h standalone.
+
+Include bits.h to make reset.h self-contained.
+
+Suggested-by: Troy Mitchell <troy.mitchell@linux.dev>
+Reviewed-by: Troy Mitchell <troy.mitchell@linux.dev>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Encrow Thorne <jyc0019@gmail.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/reset.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/linux/reset.h b/include/linux/reset.h
+index 514ddf003efc..4b31d683776e 100644
+--- a/include/linux/reset.h
++++ b/include/linux/reset.h
+@@ -2,6 +2,7 @@
+ #ifndef _LINUX_RESET_H_
+ #define _LINUX_RESET_H_
+
++#include <linux/bits.h>
+ #include <linux/err.h>
+ #include <linux/errno.h>
+ #include <linux/types.h>
+--
+2.51.0
+
--- /dev/null
+From 0b19cf5215a02428e73bc2272b69d69f2c2c0f6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 10:48:45 -0500
+Subject: scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive
+
+From: Tony Battersby <tonyb@cybernetics.com>
+
+[ Upstream commit 8f58fc64d559b5fda1b0a5e2a71422be61e79ab9 ]
+
+When given the module parameter qlini_mode=exclusive, qla2xxx in
+initiator mode is initially unable to successfully send SCSI commands to
+devices it finds while scanning, resulting in an escalating series of
+resets until an adapter reset clears the issue. Fix by checking the
+active mode instead of the module parameter.
+
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Link: https://patch.msgid.link/1715ec14-ba9a-45dc-9cf2-d41aa6b81b5e@cybernetics.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_os.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 513a9749ea3d..372562d35c9b 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -3458,13 +3458,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ ha->mqenable = 0;
+
+ if (ha->mqenable) {
+- bool startit = false;
+-
+- if (QLA_TGT_MODE_ENABLED())
+- startit = false;
+-
+- if (ql2x_ini_mode == QLA2XXX_INI_MODE_ENABLED)
+- startit = true;
++ bool startit = !!(host->active_mode & MODE_INITIATOR);
+
+ /* Create start of day qpairs for Block MQ */
+ for (i = 0; i < ha->max_qpairs; i++)
+--
+2.51.0
+
--- /dev/null
+From 90cb3482705a6fb11e2365b300496843f51c9e49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 10:50:05 -0500
+Subject: scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled
+
+From: Tony Battersby <tonyb@cybernetics.com>
+
+[ Upstream commit 4f6aaade2a22ac428fa99ed716cf2b87e79c9837 ]
+
+When qla2xxx is loaded with qlini_mode=disabled,
+ha->flags.disable_msix_handshake is used before it is set, resulting in
+the wrong interrupt handler being used on certain HBAs
+(qla2xxx_msix_rsp_q_hs() is used when qla2xxx_msix_rsp_q() should be
+used). The only difference between these two interrupt handlers is that
+the _hs() version writes to a register to clear the "RISC" interrupt,
+whereas the other version does not. So this bug results in the RISC
+interrupt being cleared when it should not be. This occasionally causes
+a different interrupt handler qla24xx_msix_default() for a different
+vector to see ((stat & HSRX_RISC_INT) == 0) and ignore its interrupt,
+which then causes problems like:
+
+qla2xxx [0000:02:00.0]-d04c:6: MBX Command timeout for cmd 20,
+ iocontrol=8 jiffies=1090c0300 mb[0-3]=[0x4000 0x0 0x40 0xda] mb7 0x500
+ host_status 0x40000010 hccr 0x3f00
+qla2xxx [0000:02:00.0]-101e:6: Mailbox cmd timeout occurred, cmd=0x20,
+ mb[0]=0x20. Scheduling ISP abort
+(the cmd varies; sometimes it is 0x20, 0x22, 0x54, 0x5a, 0x5d, or 0x6a)
+
+This problem can be reproduced with a 16 or 32 Gbps HBA by loading
+qla2xxx with qlini_mode=disabled and running a high IOPS test while
+triggering frequent RSCN database change events.
+
+While analyzing the problem I discovered that even with
+disable_msix_handshake forced to 0, it is not necessary to clear the
+RISC interrupt from qla2xxx_msix_rsp_q_hs() (more below). So just
+completely remove qla2xxx_msix_rsp_q_hs() and the logic for selecting
+it, which also fixes the bug with qlini_mode=disabled.
+
+The test below describes the justification for not needing
+qla2xxx_msix_rsp_q_hs():
+
+Force disable_msix_handshake to 0:
+qla24xx_config_rings():
+if (0 && (ha->fw_attributes & BIT_6) && (IS_MSIX_NACK_CAPABLE(ha)) &&
+ (ha->flags.msix_enabled)) {
+
+In qla24xx_msix_rsp_q() and qla2xxx_msix_rsp_q_hs(), check:
+ (rd_reg_dword(®->host_status) & HSRX_RISC_INT)
+
+Count the number of calls to each function with HSRX_RISC_INT set and
+the number with HSRX_RISC_INT not set while performing some I/O.
+
+If qla2xxx_msix_rsp_q_hs() clears the RISC interrupt (original code):
+qla24xx_msix_rsp_q: 50% of calls have HSRX_RISC_INT set
+qla2xxx_msix_rsp_q_hs: 5% of calls have HSRX_RISC_INT set
+(# of qla2xxx_msix_rsp_q_hs interrupts) =
+ (# of qla24xx_msix_rsp_q interrupts) * 3
+
+If qla2xxx_msix_rsp_q_hs() does not clear the RISC interrupt (patched
+code):
+qla24xx_msix_rsp_q: 100% of calls have HSRX_RISC_INT set
+qla2xxx_msix_rsp_q_hs: 9% of calls have HSRX_RISC_INT set
+(# of qla2xxx_msix_rsp_q_hs interrupts) =
+ (# of qla24xx_msix_rsp_q interrupts) * 3
+
+In the case of the original code, qla24xx_msix_rsp_q() was seeing
+HSRX_RISC_INT set only 50% of the time because qla2xxx_msix_rsp_q_hs()
+was clearing it when it shouldn't have been. In the patched code,
+qla24xx_msix_rsp_q() sees HSRX_RISC_INT set 100% of the time, which
+makes sense if that interrupt handler needs to clear the RISC interrupt
+(which it does). qla2xxx_msix_rsp_q_hs() sees HSRX_RISC_INT only 9% of
+the time, which is just overlap from the other interrupt during the
+high IOPS test.
+
+Tested with SCST on:
+QLE2742 FW:v9.08.02 (32 Gbps 2-port)
+QLE2694L FW:v9.10.11 (16 Gbps 4-port)
+QLE2694L FW:v9.08.02 (16 Gbps 4-port)
+QLE2672 FW:v8.07.12 (16 Gbps 2-port)
+both initiator and target mode
+
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Link: https://patch.msgid.link/56d378eb-14ad-49c7-bae9-c649b6c7691e@cybernetics.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_def.h | 1 -
+ drivers/scsi/qla2xxx/qla_gbl.h | 2 +-
+ drivers/scsi/qla2xxx/qla_isr.c | 32 +++-----------------------------
+ drivers/scsi/qla2xxx/qla_mid.c | 4 +---
+ 4 files changed, 5 insertions(+), 34 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
+index f8b949eaffcf..c0d8714d6f76 100644
+--- a/drivers/scsi/qla2xxx/qla_def.h
++++ b/drivers/scsi/qla2xxx/qla_def.h
+@@ -3461,7 +3461,6 @@ struct isp_operations {
+ #define QLA_MSIX_RSP_Q 0x01
+ #define QLA_ATIO_VECTOR 0x02
+ #define QLA_MSIX_QPAIR_MULTIQ_RSP_Q 0x03
+-#define QLA_MSIX_QPAIR_MULTIQ_RSP_Q_HS 0x04
+
+ #define QLA_MIDX_DEFAULT 0
+ #define QLA_MIDX_RSP_Q 1
+diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
+index f991fb81c72b..f654877ed083 100644
+--- a/drivers/scsi/qla2xxx/qla_gbl.h
++++ b/drivers/scsi/qla2xxx/qla_gbl.h
+@@ -776,7 +776,7 @@ extern int qla2x00_dfs_remove(scsi_qla_host_t *);
+
+ /* Globa function prototypes for multi-q */
+ extern int qla25xx_request_irq(struct qla_hw_data *, struct qla_qpair *,
+- struct qla_msix_entry *, int);
++ struct qla_msix_entry *);
+ extern int qla25xx_init_req_que(struct scsi_qla_host *, struct req_que *);
+ extern int qla25xx_init_rsp_que(struct scsi_qla_host *, struct rsp_que *);
+ extern int qla25xx_create_req_que(struct qla_hw_data *, uint16_t, uint8_t,
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index db65dbab3a9f..b5421614c857 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -4313,32 +4313,6 @@ qla2xxx_msix_rsp_q(int irq, void *dev_id)
+ return IRQ_HANDLED;
+ }
+
+-irqreturn_t
+-qla2xxx_msix_rsp_q_hs(int irq, void *dev_id)
+-{
+- struct qla_hw_data *ha;
+- struct qla_qpair *qpair;
+- struct device_reg_24xx __iomem *reg;
+- unsigned long flags;
+-
+- qpair = dev_id;
+- if (!qpair) {
+- ql_log(ql_log_info, NULL, 0x505b,
+- "%s: NULL response queue pointer.\n", __func__);
+- return IRQ_NONE;
+- }
+- ha = qpair->hw;
+-
+- reg = &ha->iobase->isp24;
+- spin_lock_irqsave(&ha->hardware_lock, flags);
+- wrt_reg_dword(®->hccr, HCCRX_CLR_RISC_INT);
+- spin_unlock_irqrestore(&ha->hardware_lock, flags);
+-
+- queue_work(ha->wq, &qpair->q_work);
+-
+- return IRQ_HANDLED;
+-}
+-
+ /* Interrupt handling helpers. */
+
+ struct qla_init_msix_entry {
+@@ -4351,7 +4325,6 @@ static const struct qla_init_msix_entry msix_entries[] = {
+ { "rsp_q", qla24xx_msix_rsp_q },
+ { "atio_q", qla83xx_msix_atio_q },
+ { "qpair_multiq", qla2xxx_msix_rsp_q },
+- { "qpair_multiq_hs", qla2xxx_msix_rsp_q_hs },
+ };
+
+ static const struct qla_init_msix_entry qla82xx_msix_entries[] = {
+@@ -4638,9 +4611,10 @@ qla2x00_free_irqs(scsi_qla_host_t *vha)
+ }
+
+ int qla25xx_request_irq(struct qla_hw_data *ha, struct qla_qpair *qpair,
+- struct qla_msix_entry *msix, int vector_type)
++ struct qla_msix_entry *msix)
+ {
+- const struct qla_init_msix_entry *intr = &msix_entries[vector_type];
++ const struct qla_init_msix_entry *intr =
++ &msix_entries[QLA_MSIX_QPAIR_MULTIQ_RSP_Q];
+ scsi_qla_host_t *vha = pci_get_drvdata(ha->pdev);
+ int ret;
+
+diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
+index 8e582fbb3403..79e4319bbbd2 100644
+--- a/drivers/scsi/qla2xxx/qla_mid.c
++++ b/drivers/scsi/qla2xxx/qla_mid.c
+@@ -908,9 +908,7 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options,
+ rsp->options, rsp->id, rsp->rsp_q_in,
+ rsp->rsp_q_out);
+
+- ret = qla25xx_request_irq(ha, qpair, qpair->msix,
+- ha->flags.disable_msix_handshake ?
+- QLA_MSIX_QPAIR_MULTIQ_RSP_Q : QLA_MSIX_QPAIR_MULTIQ_RSP_Q_HS);
++ ret = qla25xx_request_irq(ha, qpair, qpair->msix);
+ if (ret)
+ goto que_failed;
+
+--
+2.51.0
+
--- /dev/null
+From afc28371f2446accfc86aad09f99552e4164d6ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 10:51:28 -0500
+Subject: scsi: qla2xxx: Use reinit_completion on mbx_intr_comp
+
+From: Tony Battersby <tonyb@cybernetics.com>
+
+[ Upstream commit 957aa5974989fba4ae4f807ebcb27f12796edd4d ]
+
+If a mailbox command completes immediately after
+wait_for_completion_timeout() times out, ha->mbx_intr_comp could be left
+in an inconsistent state, causing the next mailbox command not to wait
+for the hardware. Fix by reinitializing the completion before use.
+
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Link: https://patch.msgid.link/11b6485e-0bfd-4784-8f99-c06a196dad94@cybernetics.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_mbx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
+index 77b23d9dcb3c..33a499dea7ad 100644
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -253,6 +253,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
+ /* Issue set host interrupt command to send cmd out. */
+ ha->flags.mbox_int = 0;
+ clear_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags);
++ reinit_completion(&ha->mbx_intr_comp);
+
+ /* Unlock mbx registers and wait for interrupt */
+ ql_dbg(ql_dbg_mbx, vha, 0x100f,
+@@ -279,6 +280,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
+ "cmd=%x Timeout.\n", command);
+ spin_lock_irqsave(&ha->hardware_lock, flags);
+ clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags);
++ reinit_completion(&ha->mbx_intr_comp);
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
+ if (chip_reset != ha->chip_reset) {
+--
+2.51.0
+
--- /dev/null
+From 351ac9685d601d62612495a35a86cb68d8dbcfce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Oct 2025 11:08:40 +0800
+Subject: serial: sprd: Return -EPROBE_DEFER when uart clock is not ready
+
+From: Wenhua Lin <Wenhua.Lin@unisoc.com>
+
+[ Upstream commit 29e8a0c587e328ed458380a45d6028adf64d7487 ]
+
+In sprd_clk_init(), when devm_clk_get() returns -EPROBE_DEFER
+for either uart or source clock, we should propagate the
+error instead of just warning and continuing with NULL clocks.
+
+Currently the driver only emits a warning when clock acquisition
+fails and proceeds with NULL clock pointers. This can lead to
+issues later when the clocks are actually needed. More importantly,
+when the clock provider is not ready yet and returns -EPROBE_DEFER,
+we should return this error to allow deferred probing.
+
+This change adds explicit checks for -EPROBE_DEFER after both:
+1. devm_clk_get(uport->dev, uart)
+2. devm_clk_get(uport->dev, source)
+
+When -EPROBE_DEFER is encountered, the function now returns
+-EPROBE_DEFER to let the driver framework retry probing
+later when the clock dependencies are resolved.
+
+Signed-off-by: Wenhua Lin <Wenhua.Lin@unisoc.com>
+Link: https://patch.msgid.link/20251022030840.956589-1-Wenhua.Lin@unisoc.com
+Reviewed-by: Cixi Geng <cixi.geng@linux.dev>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/sprd_serial.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c
+index 9c7f71993e94..33cc3773cf56 100644
+--- a/drivers/tty/serial/sprd_serial.c
++++ b/drivers/tty/serial/sprd_serial.c
+@@ -1136,6 +1136,9 @@ static int sprd_clk_init(struct uart_port *uport)
+
+ clk_uart = devm_clk_get(uport->dev, "uart");
+ if (IS_ERR(clk_uart)) {
++ if (PTR_ERR(clk_uart) == -EPROBE_DEFER)
++ return -EPROBE_DEFER;
++
+ dev_warn(uport->dev, "uart%d can't get uart clock\n",
+ uport->line);
+ clk_uart = NULL;
+@@ -1143,6 +1146,9 @@ static int sprd_clk_init(struct uart_port *uport)
+
+ clk_parent = devm_clk_get(uport->dev, "source");
+ if (IS_ERR(clk_parent)) {
++ if (PTR_ERR(clk_parent) == -EPROBE_DEFER)
++ return -EPROBE_DEFER;
++
+ dev_warn(uport->dev, "uart%d can't get source clock\n",
+ uport->line);
+ clk_parent = NULL;
+--
+2.51.0
+
spi-fsl-cpm-check-length-parity-before-switching-to-16-bit-mode.patch
mmc-sdhci-esdhc-imx-add-alternate-arch_s32-dependency-to-kconfig.patch
net-hsr-fix-null-pointer-dereference-in-prp_get_untagged_frame.patch
+alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch
+alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch
+alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch
+ipmi-fix-the-race-between-__scan_channels-and-delive.patch
+ipmi-fix-__scan_channels-failing-to-rescan-channels.patch
+firmware-imx-scu-irq-init-workqueue-before-request-m.patch
+ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch
+clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch
+powerpc-addnote-fix-overflow-on-32-bit-builds.patch
+scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch
+scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch
+scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch
+via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch
+reset-fix-bit-macro-reference.patch
+exfat-fix-remount-failure-in-different-process-envir.patch
+usbip-fix-locking-bug-in-rt-enabled-kernels.patch
+usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch
+iio-adc-ti_am335x_adc-limit-step_avg-to-valid-range-.patch
+usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch
+usb-usb-storage-no-additional-quirks-need-to-be-adde.patch
+serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch
+nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch
+platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch
--- /dev/null
+From 45e2a4922e88411f6aaf1e8584ccd8a656e3677c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 15:11:13 +0200
+Subject: ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx
+
+From: Matthias Schiffer <matthias.schiffer@tq-group.com>
+
+[ Upstream commit 3f61783920504b2cf99330b372d82914bb004d8e ]
+
+am33xx.dtsi has the same clock setup as am35xx.dtsi, setting
+ti,no-reset-on-init and ti,no-idle on timer1_target and timer2_target,
+so AM33 needs the same workaround as AM35 to avoid ti-sysc probe
+failing on certain target modules.
+
+Signed-off-by: Matthias Schiffer <matthias.schiffer@tq-group.com>
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250825131114.2206804-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/ti-sysc.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index 172b17fe87c4..42037b15594a 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -37,6 +37,7 @@ enum sysc_soc {
+ SOC_UNKNOWN,
+ SOC_2420,
+ SOC_2430,
++ SOC_AM33,
+ SOC_3430,
+ SOC_AM35,
+ SOC_3630,
+@@ -3016,6 +3017,7 @@ static void ti_sysc_idle(struct work_struct *work)
+ static const struct soc_device_attribute sysc_soc_match[] = {
+ SOC_FLAG("OMAP242*", SOC_2420),
+ SOC_FLAG("OMAP243*", SOC_2430),
++ SOC_FLAG("AM33*", SOC_AM33),
+ SOC_FLAG("AM35*", SOC_AM35),
+ SOC_FLAG("OMAP3[45]*", SOC_3430),
+ SOC_FLAG("OMAP3[67]*", SOC_3630),
+@@ -3223,10 +3225,15 @@ static int sysc_check_active_timer(struct sysc *ddata)
+ * can be dropped if we stop supporting old beagleboard revisions
+ * A to B4 at some point.
+ */
+- if (sysc_soc->soc == SOC_3430 || sysc_soc->soc == SOC_AM35)
++ switch (sysc_soc->soc) {
++ case SOC_AM33:
++ case SOC_3430:
++ case SOC_AM35:
+ error = -ENXIO;
+- else
++ break;
++ default:
+ error = -EBUSY;
++ }
+
+ if ((ddata->cfg.quirks & SYSC_QUIRK_NO_RESET_ON_INIT) &&
+ (ddata->cfg.quirks & SYSC_QUIRK_NO_IDLE))
+--
+2.51.0
+
--- /dev/null
+From 33dbd0437df324151972ce09a06a26a627e9a45e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 14:53:07 -0400
+Subject: usb: typec: ucsi: Handle incorrect num_connectors capability
+
+From: Mark Pearson <mpearson-lenovo@squebb.ca>
+
+[ Upstream commit 30cd2cb1abf4c4acdb1ddb468c946f68939819fb ]
+
+The UCSI spec states that the num_connectors field is 7 bits, and the
+8th bit is reserved and should be set to zero.
+Some buggy FW has been known to set this bit, and it can lead to a
+system not booting.
+Flag that the FW is not behaving correctly, and auto-fix the value
+so that the system boots correctly.
+
+Found on Lenovo P1 G8 during Linux enablement program. The FW will
+be fixed, but seemed worth addressing in case it hit platforms that
+aren't officially Linux supported.
+
+Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20250821185319.2585023-1-mpearson-lenovo@squebb.ca
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/ucsi/ucsi.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
+index c26b5aae11fb..5baa48213f1e 100644
+--- a/drivers/usb/typec/ucsi/ucsi.c
++++ b/drivers/usb/typec/ucsi/ucsi.c
+@@ -1276,6 +1276,12 @@ static int ucsi_init(struct ucsi *ucsi)
+ ret = -ENODEV;
+ goto err_reset;
+ }
++ /* Check if reserved bit set. This is out of spec but happens in buggy FW */
++ if (ucsi->cap.num_connectors & 0x80) {
++ dev_warn(ucsi->dev, "UCSI: Invalid num_connectors %d. Likely buggy FW\n",
++ ucsi->cap.num_connectors);
++ ucsi->cap.num_connectors &= 0x7f; // clear bit and carry on
++ }
+
+ /* Allocate the connectors. Released in ucsi_unregister() */
+ connector = kcalloc(ucsi->cap.num_connectors + 1, sizeof(*connector), GFP_KERNEL);
+--
+2.51.0
+
--- /dev/null
+From 87b05223cc81fb3321cf5e65c24cb7dfb2236b10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 14:40:20 +0800
+Subject: usb: usb-storage: No additional quirks need to be added to the EL-R12
+ optical drive.
+
+From: Chen Changcheng <chenchangcheng@kylinos.cn>
+
+[ Upstream commit 955a48a5353f4fe009704a9a4272a3adf627cd35 ]
+
+The optical drive of EL-R12 has the same vid and pid as INIC-3069,
+as follows:
+T: Bus=02 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#= 3 Spd=5000 MxCh= 0
+D: Ver= 3.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
+P: Vendor=13fd ProdID=3940 Rev= 3.10
+S: Manufacturer=HL-DT-ST
+S: Product= DVD+-RW GT80N
+S: SerialNumber=423349524E4E38303338323439202020
+C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=144mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=02 Prot=50 Driver=usb-storage
+E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=0a(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+
+This will result in the optical drive device also adding
+the quirks of US_FL_NO_ATA_1X. When performing an erase operation,
+it will fail, and the reason for the failure is as follows:
+[ 388.967742] sr 5:0:0:0: [sr0] tag#0 Send: scmd 0x00000000d20c33a7
+[ 388.967742] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00
+[ 388.967773] sr 5:0:0:0: [sr0] tag#0 Done: SUCCESS Result: hostbyte=DID_TARGET_FAILURE driverbyte=DRIVER_OK cmd_age=0s
+[ 388.967773] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00
+[ 388.967803] sr 5:0:0:0: [sr0] tag#0 Sense Key : Illegal Request [current]
+[ 388.967803] sr 5:0:0:0: [sr0] tag#0 Add. Sense: Invalid field in cdb
+[ 388.967803] sr 5:0:0:0: [sr0] tag#0 scsi host busy 1 failed 0
+[ 388.967803] sr 5:0:0:0: Notifying upper driver of completion (result 8100002)
+[ 388.967834] sr 5:0:0:0: [sr0] tag#0 0 sectors total, 0 bytes done.
+
+For the EL-R12 standard optical drive, all operational commands
+and usage scenarios were tested without adding the IGNORE_RESIDUE quirks,
+and no issues were encountered. It can be reasonably concluded
+that removing the IGNORE_RESIDUE quirks has no impact.
+
+Signed-off-by: Chen Changcheng <chenchangcheng@kylinos.cn>
+Link: https://patch.msgid.link/20251121064020.29332-1-chenchangcheng@kylinos.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/storage/unusual_uas.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index 1477e31d7763..b695f5ba9a40 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -98,7 +98,7 @@ UNUSUAL_DEV(0x125f, 0xa94a, 0x0160, 0x0160,
+ US_FL_NO_ATA_1X),
+
+ /* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
+-UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
++UNUSUAL_DEV(0x13fd, 0x3940, 0x0309, 0x0309,
+ "Initio Corporation",
+ "INIC-3069",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+--
+2.51.0
+
--- /dev/null
+From b61d66a47615257eefa1b3878dae5f3cf191b5b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 16:23:55 +0200
+Subject: usb: xhci: limit run_graceperiod for only usb 3.0 devices
+
+From: Hongyu Xie <xiehongyu1@kylinos.cn>
+
+[ Upstream commit 8d34983720155b8f05de765f0183d9b0e1345cc0 ]
+
+run_graceperiod blocks usb 2.0 devices from auto suspending after
+xhci_start for 500ms.
+
+Log shows:
+[ 13.387170] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100
+[ 13.387177] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.387182] hub_suspend:3903: hub 7-0:1.0: hub_suspend
+[ 13.387188] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1
+[ 13.387191] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event
+[ 13.387193] hcd_bus_resume:2303: usb usb7: usb auto-resume
+[ 13.387296] hub_event:5779: hub 3-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.393343] handle_port_status:2034: xhci-hcd PNP0D10:02: handle_port_status: starting usb5 port polling.
+[ 13.393353] xhci_hub_control:1271: xhci-hcd PNP0D10:02: Get port status 5-1 read: 0x206e1, return 0x10101
+[ 13.400047] hub_suspend:3903: hub 3-0:1.0: hub_suspend
+[ 13.403077] hub_resume:3948: hub 7-0:1.0: hub_resume
+[ 13.403080] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100
+[ 13.403085] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.403087] hub_suspend:3903: hub 7-0:1.0: hub_suspend
+[ 13.403090] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1
+[ 13.403093] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event
+[ 13.403095] hcd_bus_resume:2303: usb usb7: usb auto-resume
+[ 13.405002] handle_port_status:1913: xhci-hcd PNP0D10:04: Port change event, 9-1, id 1, portsc: 0x6e1
+[ 13.405016] hub_activate:1169: usb usb5-port1: status 0101 change 0001
+[ 13.405026] xhci_clear_port_change_bit:658: xhci-hcd PNP0D10:02: clear port1 connect change, portsc: 0x6e1
+[ 13.413275] hcd_bus_suspend:2250: usb usb3: bus auto-suspend, wakeup 1
+[ 13.419081] hub_resume:3948: hub 7-0:1.0: hub_resume
+[ 13.419086] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100
+[ 13.419095] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.419100] hub_suspend:3903: hub 7-0:1.0: hub_suspend
+[ 13.419106] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1
+[ 13.419110] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event
+[ 13.419112] hcd_bus_resume:2303: usb usb7: usb auto-resume
+[ 13.420455] handle_port_status:2034: xhci-hcd PNP0D10:04: handle_port_status: starting usb9 port polling.
+[ 13.420493] handle_port_status:1913: xhci-hcd PNP0D10:05: Port change event, 10-1, id 1, portsc: 0x6e1
+[ 13.425332] hcd_bus_suspend:2279: usb usb3: suspend raced with wakeup event
+[ 13.431931] handle_port_status:2034: xhci-hcd PNP0D10:05: handle_port_status: starting usb10 port polling.
+[ 13.435080] hub_resume:3948: hub 7-0:1.0: hub_resume
+[ 13.435084] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100
+[ 13.435092] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.435096] hub_suspend:3903: hub 7-0:1.0: hub_suspend
+[ 13.435102] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1
+[ 13.435106] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event
+
+usb7 and other usb 2.0 root hub were rapidly toggling between suspend
+and resume states. More, "suspend raced with wakeup event" confuses people.
+
+So, limit run_graceperiod for only usb 3.0 devices
+
+Signed-off-by: Hongyu Xie <xiehongyu1@kylinos.cn>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://patch.msgid.link/20251119142417.2820519-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-hub.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 4619d5e89d5b..6a7f3047ead3 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -1652,7 +1652,7 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
+ * SS devices are only visible to roothub after link training completes.
+ * Keep polling roothubs for a grace period after xHC start
+ */
+- if (xhci->run_graceperiod) {
++ if (hcd->speed >= HCD_USB3 && xhci->run_graceperiod) {
+ if (time_before(jiffies, xhci->run_graceperiod))
+ status = 1;
+ else
+--
+2.51.0
+
--- /dev/null
+From 2a2d1d454b4669d48455d8e25f9b4642b657292a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 09:41:43 +0800
+Subject: usbip: Fix locking bug in RT-enabled kernels
+
+From: Lizhi Xu <lizhi.xu@windriver.com>
+
+[ Upstream commit 09bf21bf5249880f62fe759b53b14b4b52900c6c ]
+
+Interrupts are disabled before entering usb_hcd_giveback_urb().
+A spinlock_t becomes a sleeping lock on PREEMPT_RT, so it cannot be
+acquired with disabled interrupts.
+
+Save the interrupt status and restore it after usb_hcd_giveback_urb().
+
+syz reported:
+BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
+Call Trace:
+ dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
+ rt_spin_lock+0xc7/0x2c0 kernel/locking/spinlock_rt.c:57
+ spin_lock include/linux/spinlock_rt.h:44 [inline]
+ mon_bus_complete drivers/usb/mon/mon_main.c:134 [inline]
+ mon_complete+0x5c/0x200 drivers/usb/mon/mon_main.c:147
+ usbmon_urb_complete include/linux/usb/hcd.h:738 [inline]
+ __usb_hcd_giveback_urb+0x254/0x5e0 drivers/usb/core/hcd.c:1647
+ vhci_urb_enqueue+0xb4f/0xe70 drivers/usb/usbip/vhci_hcd.c:818
+
+Reported-by: syzbot+205ef33a3b636b4181fb@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=205ef33a3b636b4181fb
+Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20250916014143.1439759-1-lizhi.xu@windriver.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/usbip/vhci_hcd.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
+index e3c8483d7ba4..cfe51672ca41 100644
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -830,15 +830,15 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ no_need_xmit:
+ usb_hcd_unlink_urb_from_ep(hcd, urb);
+ no_need_unlink:
+- spin_unlock_irqrestore(&vhci->lock, flags);
+ if (!ret) {
+ /* usb_hcd_giveback_urb() should be called with
+ * irqs disabled
+ */
+- local_irq_disable();
++ spin_unlock(&vhci->lock);
+ usb_hcd_giveback_urb(hcd, urb, urb->status);
+- local_irq_enable();
++ spin_lock(&vhci->lock);
+ }
++ spin_unlock_irqrestore(&vhci->lock, flags);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 0fa6ae62668990c50fe04f59b8c37e4f5571bf5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Sep 2025 16:33:32 +0800
+Subject: via_wdt: fix critical boot hang due to unnamed resource allocation
+
+From: Li Qiang <liqiang01@kylinos.cn>
+
+[ Upstream commit 7aa31ee9ec92915926e74731378c009c9cc04928 ]
+
+The VIA watchdog driver uses allocate_resource() to reserve a MMIO
+region for the watchdog control register. However, the allocated
+resource was not given a name, which causes the kernel resource tree
+to contain an entry marked as "<BAD>" under /proc/iomem on x86
+platforms.
+
+During boot, this unnamed resource can lead to a critical hang because
+subsequent resource lookups and conflict checks fail to handle the
+invalid entry properly.
+
+Signed-off-by: Li Qiang <liqiang01@kylinos.cn>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/via_wdt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/watchdog/via_wdt.c b/drivers/watchdog/via_wdt.c
+index eeb39f96e72e..c1ed3ce153cf 100644
+--- a/drivers/watchdog/via_wdt.c
++++ b/drivers/watchdog/via_wdt.c
+@@ -165,6 +165,7 @@ static int wdt_probe(struct pci_dev *pdev,
+ dev_err(&pdev->dev, "cannot enable PCI device\n");
+ return -ENODEV;
+ }
++ wdt_res.name = "via_wdt";
+
+ /*
+ * Allocate a MMIO region which contains watchdog control register
+--
+2.51.0
+
--- /dev/null
+From 9d8c4f018e476188fb67ad7862dec719fd9b9489 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 17:04:33 +0800
+Subject: ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path
+
+From: Haotian Zhang <vulab@iscas.ac.cn>
+
+[ Upstream commit 5032347c04ba7ff9ba878f262e075d745c06a2a8 ]
+
+When pdacf_config() fails, snd_pdacf_probe() returns the error code
+directly without freeing the sound card resources allocated by
+snd_card_new(), which leads to a memory leak.
+
+Add proper error handling to free the sound card and clear the card
+list entry when pdacf_config() fails.
+
+Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions")
+Suggested-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
+Link: https://patch.msgid.link/20251215090433.211-1-vulab@iscas.ac.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pcmcia/pdaudiocf/pdaudiocf.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf.c b/sound/pcmcia/pdaudiocf/pdaudiocf.c
+index 494460746614..7531e89e35da 100644
+--- a/sound/pcmcia/pdaudiocf/pdaudiocf.c
++++ b/sound/pcmcia/pdaudiocf/pdaudiocf.c
+@@ -131,7 +131,13 @@ static int snd_pdacf_probe(struct pcmcia_device *link)
+ link->config_index = 1;
+ link->config_regs = PRESENT_OPTION;
+
+- return pdacf_config(link);
++ err = pdacf_config(link);
++ if (err < 0) {
++ card_list[i] = NULL;
++ snd_card_free(card);
++ return err;
++ }
++ return 0;
+ }
+
+
+--
+2.51.0
+
--- /dev/null
+From d1de75c367a84e141441ee8b2cfc923b0baff4c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 10:46:30 +0800
+Subject: ALSA: usb-mixer: us16x08: validate meter packet indices
+
+From: Shipei Qu <qu@darknavy.com>
+
+[ Upstream commit 5526c1c6ba1d0913c7dfcbbd6fe1744ea7c55f1e ]
+
+get_meter_levels_from_urb() parses the 64-byte meter packets sent by
+the device and fills the per-channel arrays meter_level[],
+comp_level[] and master_level[] in struct snd_us16x08_meter_store.
+
+Currently the function derives the channel index directly from the
+meter packet (MUB2(meter_urb, s) - 1) and uses it to index those
+arrays without validating the range. If the packet contains a
+negative or out-of-range channel number, the driver may write past
+the end of these arrays.
+
+Introduce a local channel variable and validate it before updating the
+arrays. We reject negative indices, limit meter_level[] and
+comp_level[] to SND_US16X08_MAX_CHANNELS, and guard master_level[]
+updates with ARRAY_SIZE(master_level).
+
+Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk")
+Reported-by: DARKNAVY (@DarkNavyOrg) <vr@darknavy.com>
+Closes: https://lore.kernel.org/tencent_21C112743C44C1A2517FF219@qq.com
+Signed-off-by: Shipei Qu <qu@darknavy.com>
+Link: https://patch.msgid.link/20251217024630.59576-1-qu@darknavy.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_us16x08.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/sound/usb/mixer_us16x08.c b/sound/usb/mixer_us16x08.c
+index 20ac32635f1f..d05cb54de788 100644
+--- a/sound/usb/mixer_us16x08.c
++++ b/sound/usb/mixer_us16x08.c
+@@ -656,17 +656,25 @@ static void get_meter_levels_from_urb(int s,
+ u8 *meter_urb)
+ {
+ int val = MUC2(meter_urb, s) + (MUC3(meter_urb, s) << 8);
++ int ch = MUB2(meter_urb, s) - 1;
++
++ if (ch < 0)
++ return;
+
+ if (MUA0(meter_urb, s) == 0x61 && MUA1(meter_urb, s) == 0x02 &&
+ MUA2(meter_urb, s) == 0x04 && MUB0(meter_urb, s) == 0x62) {
+- if (MUC0(meter_urb, s) == 0x72)
+- store->meter_level[MUB2(meter_urb, s) - 1] = val;
+- if (MUC0(meter_urb, s) == 0xb2)
+- store->comp_level[MUB2(meter_urb, s) - 1] = val;
++ if (ch < SND_US16X08_MAX_CHANNELS) {
++ if (MUC0(meter_urb, s) == 0x72)
++ store->meter_level[ch] = val;
++ if (MUC0(meter_urb, s) == 0xb2)
++ store->comp_level[ch] = val;
++ }
+ }
+ if (MUA0(meter_urb, s) == 0x61 && MUA1(meter_urb, s) == 0x02 &&
+- MUA2(meter_urb, s) == 0x02 && MUB0(meter_urb, s) == 0x62)
+- store->master_level[MUB2(meter_urb, s) - 1] = val;
++ MUA2(meter_urb, s) == 0x02 && MUB0(meter_urb, s) == 0x62) {
++ if (ch < ARRAY_SIZE(store->master_level))
++ store->master_level[ch] = val;
++ }
+ }
+
+ /* Function to retrieve current meter values from the device.
+--
+2.51.0
+
--- /dev/null
+From 26a3189b37ae837c64ad1d2cd08ae53918d93367 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 12:26:52 +0800
+Subject: ALSA: vxpocket: Fix resource leak in vxpocket_probe error path
+
+From: Haotian Zhang <vulab@iscas.ac.cn>
+
+[ Upstream commit 2a03b40deacbd293ac9aed0f9b11197dad54fe5f ]
+
+When vxpocket_config() fails, vxpocket_probe() returns the error code
+directly without freeing the sound card resources allocated by
+snd_card_new(), which leads to a memory leak.
+
+Add proper error handling to free the sound card and clear the
+allocation bit when vxpocket_config() fails.
+
+Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions")
+Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
+Link: https://patch.msgid.link/20251215042652.695-1-vulab@iscas.ac.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pcmcia/vx/vxpocket.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pcmcia/vx/vxpocket.c b/sound/pcmcia/vx/vxpocket.c
+index d2d5f64d63b4..e1f5b8cfeef0 100644
+--- a/sound/pcmcia/vx/vxpocket.c
++++ b/sound/pcmcia/vx/vxpocket.c
+@@ -284,7 +284,13 @@ static int vxpocket_probe(struct pcmcia_device *p_dev)
+
+ vxp->p_dev = p_dev;
+
+- return vxpocket_config(p_dev);
++ err = vxpocket_config(p_dev);
++ if (err < 0) {
++ card_alloc &= ~(1 << i);
++ snd_card_free(card);
++ return err;
++ }
++ return 0;
+ }
+
+ static void vxpocket_detach(struct pcmcia_device *link)
+--
+2.51.0
+
--- /dev/null
+From d21ea27bca81e1ff0a04f4c133971c352d500f74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 15:02:01 +0800
+Subject: ASoC: ak4458: remove the reset operation in probe and remove
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 00b960a83c764208b0623089eb70af3685e3906f ]
+
+The reset_control handler has the reference count for usage, as there is
+reset operation in runtime suspend and resume, then reset operation in
+probe() would cause the reference count of reset not balanced.
+
+Previously add reset operation in probe and remove is to fix the compile
+issue with !CONFIG_PM, as the driver has been update to use
+RUNTIME_PM_OPS(), so that change can be reverted.
+
+Fixes: 1e0dff741b0a ("ASoC: ak4458: remove "reset-gpios" property handler")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://patch.msgid.link/20251216070201.358477-1-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/ak4458.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/sound/soc/codecs/ak4458.c b/sound/soc/codecs/ak4458.c
+index fb1ab335a4c1..e2e12dbc8cf2 100644
+--- a/sound/soc/codecs/ak4458.c
++++ b/sound/soc/codecs/ak4458.c
+@@ -790,16 +790,12 @@ static int ak4458_i2c_probe(struct i2c_client *i2c)
+
+ pm_runtime_enable(&i2c->dev);
+ regcache_cache_only(ak4458->regmap, true);
+- ak4458_reset(ak4458, false);
+
+ return 0;
+ }
+
+ static void ak4458_i2c_remove(struct i2c_client *i2c)
+ {
+- struct ak4458_priv *ak4458 = i2c_get_clientdata(i2c);
+-
+- ak4458_reset(ak4458, true);
+ pm_runtime_disable(&i2c->dev);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From bc1fceaf8c912827ce31126887a33d9769001177 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 16:16:26 +0100
+Subject: clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &
+ pcie_x4
+
+From: Josua Mayer <josua@solid-run.com>
+
+[ Upstream commit f0e6bc0c3ef4b4afb299bd6912586cafd5d864e9 ]
+
+CP110 based platforms rely on the bootloader for pci port
+initialization.
+TF-A actively prevents non-uboot re-configuration of pci lanes, and many
+boards do not have software control over the pci card reset.
+
+If a pci port had link at boot-time and the clock is stopped at a later
+point, the link fails and can not be recovered.
+
+PCI controller driver probe - and by extension ownership of a driver for
+the pci clocks - may be delayed especially on large modular kernels,
+causing the clock core to start disabling unused clocks.
+
+Add the CLK_IGNORE_UNUSED flag to the three pci port's clocks to ensure
+they are not stopped before the pci controller driver has taken
+ownership and tested for an existing link.
+
+This fixes failed pci link detection when controller driver probes late,
+e.g. with arm64 defconfig and CONFIG_PHY_MVEBU_CP110_COMPHY=m.
+
+Closes: https://lore.kernel.org/r/b71596c7-461b-44b6-89ab-3cfbd492639f@solid-run.com
+Signed-off-by: Josua Mayer <josua@solid-run.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/cp110-system-controller.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/clk/mvebu/cp110-system-controller.c b/drivers/clk/mvebu/cp110-system-controller.c
+index 03c59bf22106..b47c86906046 100644
+--- a/drivers/clk/mvebu/cp110-system-controller.c
++++ b/drivers/clk/mvebu/cp110-system-controller.c
+@@ -110,6 +110,25 @@ static const char * const gate_base_names[] = {
+ [CP110_GATE_EIP197] = "eip197"
+ };
+
++static unsigned long gate_flags(const u8 bit_idx)
++{
++ switch (bit_idx) {
++ case CP110_GATE_PCIE_X1_0:
++ case CP110_GATE_PCIE_X1_1:
++ case CP110_GATE_PCIE_X4:
++ /*
++ * If a port had an active link at boot time, stopping
++ * the clock creates a failed state from which controller
++ * driver can not recover.
++ * Prevent stopping this clock till after a driver has taken
++ * ownership.
++ */
++ return CLK_IGNORE_UNUSED;
++ default:
++ return 0;
++ }
++};
++
+ struct cp110_gate_clk {
+ struct clk_hw hw;
+ struct regmap *regmap;
+@@ -171,6 +190,7 @@ static struct clk_hw *cp110_register_gate(const char *name,
+ init.ops = &cp110_gate_ops;
+ init.parent_names = &parent_name;
+ init.num_parents = 1;
++ init.flags = gate_flags(bit_idx);
+
+ gate->regmap = regmap;
+ gate->bit_idx = bit_idx;
+--
+2.51.0
+
--- /dev/null
+From 5b81477732f777ef503a2a8436e5f35700bd75fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 14:34:32 +0200
+Subject: clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk0_clk_src
+
+From: Jens Reidel <adrian@mainlining.org>
+
+[ Upstream commit e3c13e0caa8ceb7dec1a7c4fcfd9dbef56a69fbe ]
+
+Set CLK_OPS_PARENT_ENABLE to ensure the parent gets prepared and enabled
+when switching to it, fixing an "rcg didn't update its configuration"
+warning.
+
+Signed-off-by: Jens Reidel <adrian@mainlining.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250919-sm7150-dispcc-fixes-v1-3-308ad47c5fce@mainlining.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/dispcc-sm7150.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/dispcc-sm7150.c b/drivers/clk/qcom/dispcc-sm7150.c
+index d32bd7df1433..1e2a98a63511 100644
+--- a/drivers/clk/qcom/dispcc-sm7150.c
++++ b/drivers/clk/qcom/dispcc-sm7150.c
+@@ -357,7 +357,7 @@ static struct clk_rcg2 dispcc_mdss_pclk0_clk_src = {
+ .name = "dispcc_mdss_pclk0_clk_src",
+ .parent_data = dispcc_parent_data_4,
+ .num_parents = ARRAY_SIZE(dispcc_parent_data_4),
+- .flags = CLK_SET_RATE_PARENT,
++ .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE,
+ .ops = &clk_pixel_ops,
+ },
+ };
+--
+2.51.0
+
--- /dev/null
+From 2595a36943c2a23b74577332b3856c9d4fb7d05b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 17:51:10 +0800
+Subject: exfat: fix remount failure in different process environments
+
+From: Yuezhang Mo <Yuezhang.Mo@sony.com>
+
+[ Upstream commit 51fc7b4ce10ccab8ea5e4876bcdc42cf5202a0ef ]
+
+The kernel test robot reported that the exFAT remount operation
+failed. The reason for the failure was that the process's umask
+is different between mount and remount, causing fs_fmask and
+fs_dmask are changed.
+
+Potentially, both gid and uid may also be changed. Therefore, when
+initializing fs_context for remount, inherit these mount options
+from the options used during mount.
+
+Reported-by: kernel test robot <oliver.sang@intel.com>
+Closes: https://lore.kernel.org/oe-lkp/202511251637.81670f5c-lkp@intel.com
+Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exfat/super.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/fs/exfat/super.c b/fs/exfat/super.c
+index 82acff400f4c..75c6d5046e31 100644
+--- a/fs/exfat/super.c
++++ b/fs/exfat/super.c
+@@ -801,10 +801,21 @@ static int exfat_init_fs_context(struct fs_context *fc)
+ ratelimit_state_init(&sbi->ratelimit, DEFAULT_RATELIMIT_INTERVAL,
+ DEFAULT_RATELIMIT_BURST);
+
+- sbi->options.fs_uid = current_uid();
+- sbi->options.fs_gid = current_gid();
+- sbi->options.fs_fmask = current->fs->umask;
+- sbi->options.fs_dmask = current->fs->umask;
++ if (fc->purpose == FS_CONTEXT_FOR_RECONFIGURE && fc->root) {
++ struct super_block *sb = fc->root->d_sb;
++ struct exfat_mount_options *cur_opts = &EXFAT_SB(sb)->options;
++
++ sbi->options.fs_uid = cur_opts->fs_uid;
++ sbi->options.fs_gid = cur_opts->fs_gid;
++ sbi->options.fs_fmask = cur_opts->fs_fmask;
++ sbi->options.fs_dmask = cur_opts->fs_dmask;
++ } else {
++ sbi->options.fs_uid = current_uid();
++ sbi->options.fs_gid = current_gid();
++ sbi->options.fs_fmask = current->fs->umask;
++ sbi->options.fs_dmask = current->fs->umask;
++ }
++
+ sbi->options.allow_utime = -1;
+ sbi->options.iocharset = exfat_default_iocharset;
+ sbi->options.errors = EXFAT_ERRORS_RO;
+--
+2.51.0
+
--- /dev/null
+From 604de3d0f79d148c2f216059f2d4022e09024aca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Oct 2025 17:03:41 +0800
+Subject: exfat: zero out post-EOF page cache on file extension
+
+From: Yuezhang Mo <Yuezhang.Mo@sony.com>
+
+[ Upstream commit 4e163c39dd4e70fcdce948b8774d96e0482b4a11 ]
+
+xfstests generic/363 was failing due to unzeroed post-EOF page
+cache that allowed mmap writes beyond EOF to become visible
+after file extension.
+
+For example, in following xfs_io sequence, 0x22 should not be
+written to the file but would become visible after the extension:
+
+ xfs_io -f -t -c "pwrite -S 0x11 0 8" \
+ -c "mmap 0 4096" \
+ -c "mwrite -S 0x22 32 32" \
+ -c "munmap" \
+ -c "pwrite -S 0x33 512 32" \
+ $testfile
+
+This violates the expected behavior where writes beyond EOF via
+mmap should not persist after the file is extended. Instead, the
+extended region should contain zeros.
+
+Fix this by using truncate_pagecache() to truncate the page cache
+after the current EOF when extending the file.
+
+Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exfat/file.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/exfat/file.c b/fs/exfat/file.c
+index 7ac5126aa4f1..033852efe5dc 100644
+--- a/fs/exfat/file.c
++++ b/fs/exfat/file.c
+@@ -25,6 +25,8 @@ static int exfat_cont_expand(struct inode *inode, loff_t size)
+ struct exfat_sb_info *sbi = EXFAT_SB(sb);
+ struct exfat_chain clu;
+
++ truncate_pagecache(inode, i_size_read(inode));
++
+ ret = inode_newsize_ok(inode, size);
+ if (ret)
+ return ret;
+@@ -587,6 +589,9 @@ static ssize_t exfat_file_write_iter(struct kiocb *iocb, struct iov_iter *iter)
+
+ inode_lock(inode);
+
++ if (pos > i_size_read(inode))
++ truncate_pagecache(inode, i_size_read(inode));
++
+ valid_size = ei->valid_size;
+
+ ret = generic_write_checks(iocb, iter);
+--
+2.51.0
+
--- /dev/null
+From f644f2a81bd920876c36075f18cafb659bd82b07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Oct 2025 09:56:26 +0800
+Subject: firmware: imx: scu-irq: Init workqueue before request mbox channel
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit 81fb53feb66a3aefbf6fcab73bb8d06f5b0c54ad ]
+
+With mailbox channel requested, there is possibility that interrupts may
+come in, so need to make sure the workqueue is initialized before
+the queue is scheduled by mailbox rx callback.
+
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/imx/imx-scu-irq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/imx/imx-scu-irq.c b/drivers/firmware/imx/imx-scu-irq.c
+index f2b902e95b73..b9f6128d56f7 100644
+--- a/drivers/firmware/imx/imx-scu-irq.c
++++ b/drivers/firmware/imx/imx-scu-irq.c
+@@ -214,6 +214,8 @@ int imx_scu_enable_general_irq_channel(struct device *dev)
+ cl->dev = dev;
+ cl->rx_callback = imx_scu_irq_callback;
+
++ INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler);
++
+ /* SCU general IRQ uses general interrupt channel 3 */
+ ch = mbox_request_channel_byname(cl, "gip3");
+ if (IS_ERR(ch)) {
+@@ -223,8 +225,6 @@ int imx_scu_enable_general_irq_channel(struct device *dev)
+ return ret;
+ }
+
+- INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler);
+-
+ if (!of_parse_phandle_with_args(dev->of_node, "mboxes",
+ "#mbox-cells", 0, &spec)) {
+ i = of_alias_get_id(spec.np, "mu");
+--
+2.51.0
+
--- /dev/null
+From b6a23d526c91e657619171486556355431047014 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Oct 2025 00:21:18 +0200
+Subject: fuse: Always flush the page cache before FOPEN_DIRECT_IO write
+
+From: Bernd Schubert <bschubert@ddn.com>
+
+[ Upstream commit 1ce120dcefc056ce8af2486cebbb77a458aad4c3 ]
+
+This was done as condition on direct_io_allow_mmap, but I believe
+this is not right, as a file might be open two times - once with
+write-back enabled another time with FOPEN_DIRECT_IO.
+
+Signed-off-by: Bernd Schubert <bschubert@ddn.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fuse/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index a8218a3bc0b4..ec1b235df91d 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -1582,7 +1582,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter,
+ if (!ia)
+ return -ENOMEM;
+
+- if (fopen_direct_io && fc->direct_io_allow_mmap) {
++ if (fopen_direct_io) {
+ res = filemap_write_and_wait_range(mapping, pos, pos + count - 1);
+ if (res) {
+ fuse_io_free(ia);
+--
+2.51.0
+
--- /dev/null
+From 8b3241a6614108e8f08be5311bb11e8ca6f8c943 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Oct 2025 00:21:17 +0200
+Subject: fuse: Invalidate the page cache after FOPEN_DIRECT_IO write
+
+From: Bernd Schubert <bschubert@ddn.com>
+
+[ Upstream commit b359af8275a982a458e8df6c6beab1415be1f795 ]
+
+generic_file_direct_write() also does this and has a large
+comment about.
+
+Reproducer here is xfstest's generic/209, which is exactly to
+have competing DIO write and cached IO read.
+
+Signed-off-by: Bernd Schubert <bschubert@ddn.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fuse/file.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index ec1b235df91d..4c5cf2d116d2 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -1656,6 +1656,15 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter,
+ if (res > 0)
+ *ppos = pos;
+
++ if (res > 0 && write && fopen_direct_io) {
++ /*
++ * As in generic_file_direct_write(), invalidate after the
++ * write, to invalidate read-ahead cache that may have competed
++ * with the write.
++ */
++ invalidate_inode_pages2_range(mapping, idx_from, idx_to);
++ }
++
+ return res > 0 ? res : err;
+ }
+ EXPORT_SYMBOL_GPL(fuse_direct_io);
+--
+2.51.0
+
--- /dev/null
+From 851837c3e96759183e872e224080a6d1eca833b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Oct 2025 15:57:14 +0800
+Subject: i2c: designware: Disable SMBus interrupts to prevent storms from
+ mis-configured firmware
+
+From: Jinhui Guo <guojinhui.liam@bytedance.com>
+
+[ Upstream commit d3429178ee51dd7155445d15a5ab87a45fae3c73 ]
+
+When probing the I2C master, disable SMBus interrupts to prevent
+storms caused by broken firmware mis-configuring IC_SMBUS=1; the
+handler never services them and a mis-configured SMBUS Master
+extend-clock timeout or SMBUS Slave extend-clock timeout can
+flood the CPU.
+
+Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Link: https://lore.kernel.org/r/20251021075714.3712-2-guojinhui.liam@bytedance.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-designware-core.h | 1 +
+ drivers/i2c/busses/i2c-designware-master.c | 7 +++++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h
+index 2d32896d0673..e3d76e423842 100644
+--- a/drivers/i2c/busses/i2c-designware-core.h
++++ b/drivers/i2c/busses/i2c-designware-core.h
+@@ -78,6 +78,7 @@
+ #define DW_IC_TX_ABRT_SOURCE 0x80
+ #define DW_IC_ENABLE_STATUS 0x9c
+ #define DW_IC_CLR_RESTART_DET 0xa8
++#define DW_IC_SMBUS_INTR_MASK 0xcc
+ #define DW_IC_COMP_PARAM_1 0xf4
+ #define DW_IC_COMP_VERSION 0xf8
+ #define DW_IC_SDA_HOLD_MIN_VERS 0x3131312A /* "111*" == v1.11* */
+diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c
+index 52dc666c3ef4..196bb073c6bc 100644
+--- a/drivers/i2c/busses/i2c-designware-master.c
++++ b/drivers/i2c/busses/i2c-designware-master.c
+@@ -203,6 +203,13 @@ static int i2c_dw_init_master(struct dw_i2c_dev *dev)
+ /* Disable the adapter */
+ __i2c_dw_disable(dev);
+
++ /*
++ * Mask SMBus interrupts to block storms from broken
++ * firmware that leaves IC_SMBUS=1; the handler never
++ * services them.
++ */
++ regmap_write(dev->map, DW_IC_SMBUS_INTR_MASK, 0);
++
+ /* Write standard speed timing parameters */
+ regmap_write(dev->map, DW_IC_SS_SCL_HCNT, dev->ss_hcnt);
+ regmap_write(dev->map, DW_IC_SS_SCL_LCNT, dev->ss_lcnt);
+--
+2.51.0
+
--- /dev/null
+From 4d85d2ad3751729814a68ab9b39d14f4c84ccf6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 17:12:50 +0800
+Subject: iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc
+ complains
+
+From: Pei Xiao <xiaopei01@kylinos.cn>
+
+[ Upstream commit c9fb952360d0c78bbe98239bd6b702f05c2dbb31 ]
+
+FIELD_PREP() checks that a value fits into the available bitfield, add a
+check for step_avg to fix gcc complains.
+
+which gcc complains about:
+ drivers/iio/adc/ti_am335x_adc.c: In function 'tiadc_step_config':
+ include/linux/compiler_types.h:572:38: error: call to
+'__compiletime_assert_491' declared with attribute error: FIELD_PREP: value
+too large for the field include/linux/mfd/ti_am335x_tscadc.h:58:29: note:
+in expansion of macro 'FIELD_PREP'
+ #define STEPCONFIG_AVG(val) FIELD_PREP(GENMASK(4, 2), (val))
+ ^~~~~~~~~~
+drivers/iio/adc/ti_am335x_adc.c:127:17: note: in expansion of macro 'STEPCONFIG_AVG'
+ stepconfig = STEPCONFIG_AVG(ffs(adc_dev->step_avg[i]) - 1)
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202510102117.Jqxrw1vF-lkp@intel.com/
+Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/ti_am335x_adc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
+index 426e3c9f88a1..205d1f103b3c 100644
+--- a/drivers/iio/adc/ti_am335x_adc.c
++++ b/drivers/iio/adc/ti_am335x_adc.c
+@@ -123,7 +123,7 @@ static void tiadc_step_config(struct iio_dev *indio_dev)
+
+ chan = adc_dev->channel_line[i];
+
+- if (adc_dev->step_avg[i])
++ if (adc_dev->step_avg[i] && adc_dev->step_avg[i] <= STEPCONFIG_AVG_16)
+ stepconfig = STEPCONFIG_AVG(ffs(adc_dev->step_avg[i]) - 1) |
+ STEPCONFIG_FIFO1;
+ else
+--
+2.51.0
+
--- /dev/null
+From 2e59e8a2f574287cf126a1c5519204847f07adbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 15:42:38 +0800
+Subject: ipmi: Fix __scan_channels() failing to rescan channels
+
+From: Jinhui Guo <guojinhui.liam@bytedance.com>
+
+[ Upstream commit 6bd30d8fc523fb880b4be548e8501bc0fe8f42d4 ]
+
+channel_handler() sets intf->channels_ready to true but never
+clears it, so __scan_channels() skips any rescan. When the BMC
+firmware changes a rescan is required. Allow it by clearing
+the flag before starting a new scan.
+
+Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
+Message-ID: <20250930074239.2353-3-guojinhui.liam@bytedance.com>
+Signed-off-by: Corey Minyard <corey@minyard.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_msghandler.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index 29106325aba7..188722ec0337 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -613,7 +613,8 @@ static void __ipmi_bmc_unregister(struct ipmi_smi *intf);
+ static int __ipmi_bmc_register(struct ipmi_smi *intf,
+ struct ipmi_device_id *id,
+ bool guid_set, guid_t *guid, int intf_num);
+-static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id);
++static int __scan_channels(struct ipmi_smi *intf,
++ struct ipmi_device_id *id, bool rescan);
+
+
+ /*
+@@ -2665,7 +2666,7 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc,
+ if (__ipmi_bmc_register(intf, &id, guid_set, &guid, intf_num))
+ need_waiter(intf); /* Retry later on an error. */
+ else
+- __scan_channels(intf, &id);
++ __scan_channels(intf, &id, false);
+
+
+ if (!intf_set) {
+@@ -2685,7 +2686,7 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc,
+ goto out_noprocessing;
+ } else if (memcmp(&bmc->fetch_id, &bmc->id, sizeof(bmc->id)))
+ /* Version info changes, scan the channels again. */
+- __scan_channels(intf, &bmc->fetch_id);
++ __scan_channels(intf, &bmc->fetch_id, true);
+
+ bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY;
+
+@@ -3435,10 +3436,17 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)
+ /*
+ * Must be holding intf->bmc_reg_mutex to call this.
+ */
+-static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id)
++static int __scan_channels(struct ipmi_smi *intf,
++ struct ipmi_device_id *id,
++ bool rescan)
+ {
+ int rv;
+
++ if (rescan) {
++ /* Clear channels_ready to force channels rescan. */
++ intf->channels_ready = false;
++ }
++
+ if (ipmi_version_major(id) > 1
+ || (ipmi_version_major(id) == 1
+ && ipmi_version_minor(id) >= 5)) {
+@@ -3640,7 +3648,7 @@ int ipmi_add_smi(struct module *owner,
+ }
+
+ mutex_lock(&intf->bmc_reg_mutex);
+- rv = __scan_channels(intf, &id);
++ rv = __scan_channels(intf, &id, false);
+ mutex_unlock(&intf->bmc_reg_mutex);
+ if (rv)
+ goto out_err_bmc_reg;
+--
+2.51.0
+
--- /dev/null
+From 5dc16937175c98bb2d793717a5429a82b379d606 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 15:42:37 +0800
+Subject: ipmi: Fix the race between __scan_channels() and deliver_response()
+
+From: Jinhui Guo <guojinhui.liam@bytedance.com>
+
+[ Upstream commit 936750fdba4c45e13bbd17f261bb140dd55f5e93 ]
+
+The race window between __scan_channels() and deliver_response() causes
+the parameters of some channels to be set to 0.
+
+1.[CPUA] __scan_channels() issues an IPMI request and waits with
+ wait_event() until all channels have been scanned.
+ wait_event() internally calls might_sleep(), which might
+ yield the CPU. (Moreover, an interrupt can preempt
+ wait_event() and force the task to yield the CPU.)
+2.[CPUB] deliver_response() is invoked when the CPU receives the
+ IPMI response. After processing a IPMI response,
+ deliver_response() directly assigns intf->wchannels to
+ intf->channel_list and sets intf->channels_ready to true.
+ However, not all channels are actually ready for use.
+3.[CPUA] Since intf->channels_ready is already true, wait_event()
+ never enters __wait_event(). __scan_channels() immediately
+ clears intf->null_user_handler and exits.
+4.[CPUB] Once intf->null_user_handler is set to NULL, deliver_response()
+ ignores further IPMI responses, leaving the remaining
+ channels zero-initialized and unusable.
+
+CPUA CPUB
+------------------------------- -----------------------------
+__scan_channels()
+ intf->null_user_handler
+ = channel_handler;
+ send_channel_info_cmd(intf,
+ 0);
+ wait_event(intf->waitq,
+ intf->channels_ready);
+ do {
+ might_sleep();
+ deliver_response()
+ channel_handler()
+ intf->channel_list =
+ intf->wchannels + set;
+ intf->channels_ready = true;
+ send_channel_info_cmd(intf,
+ intf->curr_channel);
+ if (condition)
+ break;
+ __wait_event(wq_head,
+ condition);
+ } while(0)
+ intf->null_user_handler
+ = NULL;
+ deliver_response()
+ if (!msg->user)
+ if (intf->null_user_handler)
+ rv = -EINVAL;
+ return rv;
+------------------------------- -----------------------------
+
+Fix the race between __scan_channels() and deliver_response() by
+deferring both the assignment intf->channel_list = intf->wchannels
+and the flag intf->channels_ready = true until all channels have
+been successfully scanned or until the IPMI request has failed.
+
+Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
+Message-ID: <20250930074239.2353-2-guojinhui.liam@bytedance.com>
+Signed-off-by: Corey Minyard <corey@minyard.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_msghandler.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index 99fe01321971..29106325aba7 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -3414,8 +3414,6 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)
+ intf->channels_ready = true;
+ wake_up(&intf->waitq);
+ } else {
+- intf->channel_list = intf->wchannels + set;
+- intf->channels_ready = true;
+ rv = send_channel_info_cmd(intf, intf->curr_channel);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 93f7dae4e2d27f6bc82580d96ea52693a881d28a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Dec 2025 13:47:01 -0800
+Subject: libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit a0a4173631bfcfd3520192c0a61cf911d6a52c3a ]
+
+Passing an empty map to perf_cpu_map__max triggered a SEGV. Explicitly
+test for the empty map.
+
+Reported-by: Ingo Molnar <mingo@kernel.org>
+Closes: https://lore.kernel.org/linux-perf-users/aSwt7yzFjVJCEmVp@gmail.com/
+Tested-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Tested-by: Thomas Richter <tmricht@linux.ibm.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/perf/cpumap.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/tools/lib/perf/cpumap.c b/tools/lib/perf/cpumap.c
+index cae799ad44e1..e5938b91199f 100644
+--- a/tools/lib/perf/cpumap.c
++++ b/tools/lib/perf/cpumap.c
+@@ -409,10 +409,12 @@ struct perf_cpu perf_cpu_map__max(const struct perf_cpu_map *map)
+ .cpu = -1
+ };
+
+- // cpu_map__trim_new() qsort()s it, cpu_map__default_new() sorts it as well.
+- return __perf_cpu_map__nr(map) > 0
+- ? __perf_cpu_map__cpu(map, __perf_cpu_map__nr(map) - 1)
+- : result;
++ if (!map)
++ return result;
++
++ // The CPUs are always sorted and nr is always > 0 as 0 length map is
++ // encoded as NULL.
++ return __perf_cpu_map__cpu(map, __perf_cpu_map__nr(map) - 1);
+ }
+
+ /** Is 'b' a subset of 'a'. */
+--
+2.51.0
+
--- /dev/null
+From e24ad0f0c0054440b4c54dc95896343955c2fcff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 09:30:06 +0100
+Subject: MIPS: ftrace: Fix memory corruption when kernel is located beyond 32
+ bits
+
+From: Gregory CLEMENT <gregory.clement@bootlin.com>
+
+[ Upstream commit 36dac9a3dda1f2bae343191bc16b910c603cac25 ]
+
+Since commit e424054000878 ("MIPS: Tracing: Reduce the overhead of
+dynamic Function Tracer"), the macro UASM_i_LA_mostly has been used,
+and this macro can generate more than 2 instructions. At the same
+time, the code in ftrace assumes that no more than 2 instructions can
+be generated, which is why it stores them in an int[2] array. However,
+as previously noted, the macro UASM_i_LA_mostly (and now UASM_i_LA)
+causes a buffer overflow when _mcount is beyond 32 bits. This leads to
+corruption of the variables located in the __read_mostly section.
+
+This corruption was observed because the variable
+__cpu_primary_thread_mask was corrupted, causing a hang very early
+during boot.
+
+This fix prevents the corruption by avoiding the generation of
+instructions if they could exceed 2 instructions in
+length. Fortunately, insn_la_mcount is only used if the instrumented
+code is located outside the kernel code section, so dynamic ftrace can
+still be used, albeit in a more limited scope. This is still
+preferable to corrupting memory and/or crashing the kernel.
+
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/kernel/ftrace.c | 25 +++++++++++++++++++++----
+ 1 file changed, 21 insertions(+), 4 deletions(-)
+
+diff --git a/arch/mips/kernel/ftrace.c b/arch/mips/kernel/ftrace.c
+index f39e85fd58fa..b15615b28569 100644
+--- a/arch/mips/kernel/ftrace.c
++++ b/arch/mips/kernel/ftrace.c
+@@ -54,10 +54,20 @@ static inline void ftrace_dyn_arch_init_insns(void)
+ u32 *buf;
+ unsigned int v1;
+
+- /* la v1, _mcount */
+- v1 = 3;
+- buf = (u32 *)&insn_la_mcount[0];
+- UASM_i_LA(&buf, v1, MCOUNT_ADDR);
++ /* If we are not in compat space, the number of generated
++ * instructions will exceed the maximum expected limit of 2.
++ * To prevent buffer overflow, we avoid generating them.
++ * insn_la_mcount will not be used later in ftrace_make_call.
++ */
++ if (uasm_in_compat_space_p(MCOUNT_ADDR)) {
++ /* la v1, _mcount */
++ v1 = 3;
++ buf = (u32 *)&insn_la_mcount[0];
++ UASM_i_LA(&buf, v1, MCOUNT_ADDR);
++ } else {
++ pr_warn("ftrace: mcount address beyond 32 bits is not supported (%lX)\n",
++ MCOUNT_ADDR);
++ }
+
+ /* jal (ftrace_caller + 8), jump over the first two instruction */
+ buf = (u32 *)&insn_jal_ftrace_caller;
+@@ -189,6 +199,13 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
+ unsigned int new;
+ unsigned long ip = rec->ip;
+
++ /* When the code to patch does not belong to the kernel code
++ * space, we must use insn_la_mcount. However, if MCOUNT_ADDR
++ * is not in compat space, insn_la_mcount is not usable.
++ */
++ if (!core_kernel_text(ip) && !uasm_in_compat_space_p(MCOUNT_ADDR))
++ return -EFAULT;
++
+ new = core_kernel_text(ip) ? insn_jal_ftrace_caller : insn_la_mcount[0];
+
+ #ifdef CONFIG_64BIT
+--
+2.51.0
+
--- /dev/null
+From 1209a3dd1c94e6f55df34fdcda276f5d1622803d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 17:41:21 +0530
+Subject: nfsd: fix memory leak in nfsd_create_serv error paths
+
+From: Shardul Bankar <shardul.b@mpiricsoftware.com>
+
+[ Upstream commit df8d829bba3adcf3cc744c01d933b6fd7cf06e91 ]
+
+When nfsd_create_serv() calls percpu_ref_init() to initialize
+nn->nfsd_net_ref, it allocates both a percpu reference counter
+and a percpu_ref_data structure (64 bytes). However, if the
+function fails later due to svc_create_pooled() returning NULL
+or svc_bind() returning an error, these allocations are not
+cleaned up, resulting in a memory leak.
+
+The leak manifests as:
+- Unreferenced percpu allocation (8 bytes per CPU)
+- Unreferenced percpu_ref_data structure (64 bytes)
+
+Fix this by adding percpu_ref_exit() calls in both error paths
+to properly clean up the percpu_ref_init() allocations.
+
+This patch fixes the percpu_ref leak in nfsd_create_serv() seen
+as an auxiliary leak in syzbot report 099461f8558eb0a1f4f3; the
+prepare_creds() and vsock-related leaks in the same report
+remain to be addressed separately.
+
+Reported-by: syzbot+099461f8558eb0a1f4f3@syzkaller.appspotmail.com
+Link: https://syzkaller.appspot.com/bug?extid=099461f8558eb0a1f4f3
+Fixes: 47e988147f40 ("nfsd: add nfsd_serv_try_get and nfsd_serv_put")
+Signed-off-by: Shardul Bankar <shardul.b@mpiricsoftware.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfssvc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
+index 571a6ae90833..cc185c00e309 100644
+--- a/fs/nfsd/nfssvc.c
++++ b/fs/nfsd/nfssvc.c
+@@ -667,13 +667,16 @@ int nfsd_create_serv(struct net *net)
+ serv = svc_create_pooled(nfsd_programs, ARRAY_SIZE(nfsd_programs),
+ &nn->nfsd_svcstats,
+ nfsd_max_blksize, nfsd);
+- if (serv == NULL)
++ if (serv == NULL) {
++ percpu_ref_exit(&nn->nfsd_net_ref);
+ return -ENOMEM;
++ }
+
+ serv->sv_maxconn = nn->max_connections;
+ error = svc_bind(serv, net);
+ if (error < 0) {
+ svc_destroy(&serv);
++ percpu_ref_exit(&nn->nfsd_net_ref);
+ return error;
+ }
+ spin_lock(&nfsd_notifier_lock);
+--
+2.51.0
+
--- /dev/null
+From dcdf956b530de8f7ee73d9e06218996ac58b0cf6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2024 20:40:59 -0500
+Subject: nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_
+
+From: Mike Snitzer <snitzer@kernel.org>
+
+[ Upstream commit b33f7dec3a67216123312c7bb752b8f6faa1c465 ]
+
+Also update Documentation/filesystems/nfs/localio.rst accordingly
+and reduce the technical documentation debt that was previously
+captured in that document.
+
+Signed-off-by: Mike Snitzer <snitzer@kernel.org>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Acked-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Stable-dep-of: df8d829bba3a ("nfsd: fix memory leak in nfsd_create_serv error paths")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/filesystems/nfs/localio.rst | 85 +++++++----------------
+ fs/nfs_common/nfslocalio.c | 10 ++-
+ fs/nfsd/filecache.c | 2 +-
+ fs/nfsd/localio.c | 4 +-
+ fs/nfsd/netns.h | 11 +--
+ fs/nfsd/nfssvc.c | 34 ++++-----
+ include/linux/nfslocalio.h | 12 ++--
+ 7 files changed, 66 insertions(+), 92 deletions(-)
+
+diff --git a/Documentation/filesystems/nfs/localio.rst b/Documentation/filesystems/nfs/localio.rst
+index 20fc901a08f4..7d2dbf75e96d 100644
+--- a/Documentation/filesystems/nfs/localio.rst
++++ b/Documentation/filesystems/nfs/localio.rst
+@@ -218,64 +218,30 @@ NFS Client and Server Interlock
+ ===============================
+
+ LOCALIO provides the nfs_uuid_t object and associated interfaces to
+-allow proper network namespace (net-ns) and NFSD object refcounting:
+-
+- We don't want to keep a long-term counted reference on each NFSD's
+- net-ns in the client because that prevents a server container from
+- completely shutting down.
+-
+- So we avoid taking a reference at all and rely on the per-cpu
+- reference to the server (detailed below) being sufficient to keep
+- the net-ns active. This involves allowing the NFSD's net-ns exit
+- code to iterate all active clients and clear their ->net pointers
+- (which are needed to find the per-cpu-refcount for the nfsd_serv).
+-
+- Details:
+-
+- - Embed nfs_uuid_t in nfs_client. nfs_uuid_t provides a list_head
+- that can be used to find the client. It does add the 16-byte
+- uuid_t to nfs_client so it is bigger than needed (given that
+- uuid_t is only used during the initial NFS client and server
+- LOCALIO handshake to determine if they are local to each other).
+- If that is really a problem we can find a fix.
+-
+- - When the nfs server confirms that the uuid_t is local, it moves
+- the nfs_uuid_t onto a per-net-ns list in NFSD's nfsd_net.
+-
+- - When each server's net-ns is shutting down - in a "pre_exit"
+- handler, all these nfs_uuid_t have their ->net cleared. There is
+- an rcu_synchronize() call between pre_exit() handlers and exit()
+- handlers so any caller that sees nfs_uuid_t ->net as not NULL can
+- safely manage the per-cpu-refcount for nfsd_serv.
+-
+- - The client's nfs_uuid_t is passed to nfsd_open_local_fh() so it
+- can safely dereference ->net in a private rcu_read_lock() section
+- to allow safe access to the associated nfsd_net and nfsd_serv.
+-
+-So LOCALIO required the introduction and use of NFSD's percpu_ref to
+-interlock nfsd_destroy_serv() and nfsd_open_local_fh(), to ensure each
+-nn->nfsd_serv is not destroyed while in use by nfsd_open_local_fh(), and
++allow proper network namespace (net-ns) and NFSD object refcounting.
++
++LOCALIO required the introduction and use of NFSD's percpu nfsd_net_ref
++to interlock nfsd_shutdown_net() and nfsd_open_local_fh(), to ensure
++each net-ns is not destroyed while in use by nfsd_open_local_fh(), and
+ warrants a more detailed explanation:
+
+- nfsd_open_local_fh() uses nfsd_serv_try_get() before opening its
++ nfsd_open_local_fh() uses nfsd_net_try_get() before opening its
+ nfsd_file handle and then the caller (NFS client) must drop the
+- reference for the nfsd_file and associated nn->nfsd_serv using
+- nfs_file_put_local() once it has completed its IO.
++ reference for the nfsd_file and associated net-ns using
++ nfsd_file_put_local() once it has completed its IO.
+
+ This interlock working relies heavily on nfsd_open_local_fh() being
+ afforded the ability to safely deal with the possibility that the
+ NFSD's net-ns (and nfsd_net by association) may have been destroyed
+- by nfsd_destroy_serv() via nfsd_shutdown_net() -- which is only
+- possible given the nfs_uuid_t ->net pointer managemenet detailed
+- above.
+-
+-All told, this elaborate interlock of the NFS client and server has been
+-verified to fix an easy to hit crash that would occur if an NFSD
+-instance running in a container, with a LOCALIO client mounted, is
+-shutdown. Upon restart of the container and associated NFSD the client
+-would go on to crash due to NULL pointer dereference that occurred due
+-to the LOCALIO client's attempting to nfsd_open_local_fh(), using
+-nn->nfsd_serv, without having a proper reference on nn->nfsd_serv.
++ by nfsd_destroy_serv() via nfsd_shutdown_net().
++
++This interlock of the NFS client and server has been verified to fix an
++easy to hit crash that would occur if an NFSD instance running in a
++container, with a LOCALIO client mounted, is shutdown. Upon restart of
++the container and associated NFSD, the client would go on to crash due
++to NULL pointer dereference that occurred due to the LOCALIO client's
++attempting to nfsd_open_local_fh() without having a proper reference on
++NFSD's net-ns.
+
+ NFS Client issues IO instead of Server
+ ======================================
+@@ -308,16 +274,19 @@ fs/nfs/localio.c:nfs_local_commit().
+
+ With normal NFS that makes use of RPC to issue IO to the server, if an
+ application uses O_DIRECT the NFS client will bypass the pagecache but
+-the NFS server will not. Because the NFS server's use of buffered IO
+-affords applications to be less precise with their alignment when
+-issuing IO to the NFS client. LOCALIO can be configured to use O_DIRECT
+-semantics by setting the 'localio_O_DIRECT_semantics' nfs module
++the NFS server will not. The NFS server's use of buffered IO affords
++applications to be less precise with their alignment when issuing IO to
++the NFS client. But if all applications properly align their IO, LOCALIO
++can be configured to use end-to-end O_DIRECT semantics from the NFS
++client to the underlying local filesystem, that it is sharing with
++the NFS server, by setting the 'localio_O_DIRECT_semantics' nfs module
+ parameter to Y, e.g.:
+
+- echo Y > /sys/module/nfs/parameters/localio_O_DIRECT_semantics
++ echo Y > /sys/module/nfs/parameters/localio_O_DIRECT_semantics
+
+-Once enabled, it will cause LOCALIO to use O_DIRECT semantics (this may
+-cause IO to fail if applications do not properly align their IO).
++Once enabled, it will cause LOCALIO to use end-to-end O_DIRECT semantics
++(but again, this may cause IO to fail if applications do not properly
++align their IO).
+
+ Security
+ ========
+diff --git a/fs/nfs_common/nfslocalio.c b/fs/nfs_common/nfslocalio.c
+index a74ec08f6c96..e6fbc45ec4f1 100644
+--- a/fs/nfs_common/nfslocalio.c
++++ b/fs/nfs_common/nfslocalio.c
+@@ -128,6 +128,10 @@ void nfs_uuid_invalidate_one_client(nfs_uuid_t *nfs_uuid)
+ }
+ EXPORT_SYMBOL_GPL(nfs_uuid_invalidate_one_client);
+
++/*
++ * Caller is responsible for calling nfsd_net_put and
++ * nfsd_file_put (via nfs_to_nfsd_file_put_local).
++ */
+ struct nfsd_file *nfs_open_local_fh(nfs_uuid_t *uuid,
+ struct rpc_clnt *rpc_clnt, const struct cred *cred,
+ const struct nfs_fh *nfs_fh, const fmode_t fmode)
+@@ -139,7 +143,7 @@ struct nfsd_file *nfs_open_local_fh(nfs_uuid_t *uuid,
+ * Not running in nfsd context, so must safely get reference on nfsd_serv.
+ * But the server may already be shutting down, if so disallow new localio.
+ * uuid->net is NOT a counted reference, but rcu_read_lock() ensures that
+- * if uuid->net is not NULL, then calling nfsd_serv_try_get() is safe
++ * if uuid->net is not NULL, then calling nfsd_net_try_get() is safe
+ * and if it succeeds we will have an implied reference to the net.
+ *
+ * Otherwise NFS may not have ref on NFSD and therefore cannot safely
+@@ -147,12 +151,12 @@ struct nfsd_file *nfs_open_local_fh(nfs_uuid_t *uuid,
+ */
+ rcu_read_lock();
+ net = rcu_dereference(uuid->net);
+- if (!net || !nfs_to->nfsd_serv_try_get(net)) {
++ if (!net || !nfs_to->nfsd_net_try_get(net)) {
+ rcu_read_unlock();
+ return ERR_PTR(-ENXIO);
+ }
+ rcu_read_unlock();
+- /* We have an implied reference to net thanks to nfsd_serv_try_get */
++ /* We have an implied reference to net thanks to nfsd_net_try_get */
+ localio = nfs_to->nfsd_open_local_fh(net, uuid->dom, rpc_clnt,
+ cred, nfs_fh, fmode);
+ if (IS_ERR(localio))
+diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c
+index d19968881855..05f0a4867673 100644
+--- a/fs/nfsd/filecache.c
++++ b/fs/nfsd/filecache.c
+@@ -391,7 +391,7 @@ nfsd_file_put(struct nfsd_file *nf)
+ }
+
+ /**
+- * nfsd_file_put_local - put nfsd_file reference and arm nfsd_serv_put in caller
++ * nfsd_file_put_local - put nfsd_file reference and arm nfsd_net_put in caller
+ * @nf: nfsd_file of which to put the reference
+ *
+ * First save the associated net to return to caller, then put
+diff --git a/fs/nfsd/localio.c b/fs/nfsd/localio.c
+index f441cb9f74d5..ce6d408598c7 100644
+--- a/fs/nfsd/localio.c
++++ b/fs/nfsd/localio.c
+@@ -25,8 +25,8 @@
+ #include "cache.h"
+
+ static const struct nfsd_localio_operations nfsd_localio_ops = {
+- .nfsd_serv_try_get = nfsd_serv_try_get,
+- .nfsd_serv_put = nfsd_serv_put,
++ .nfsd_net_try_get = nfsd_net_try_get,
++ .nfsd_net_put = nfsd_net_put,
+ .nfsd_open_local_fh = nfsd_open_local_fh,
+ .nfsd_file_put_local = nfsd_file_put_local,
+ .nfsd_file_file = nfsd_file_file,
+diff --git a/fs/nfsd/netns.h b/fs/nfsd/netns.h
+index a05a45bb1978..ceab4a3e503f 100644
+--- a/fs/nfsd/netns.h
++++ b/fs/nfsd/netns.h
+@@ -140,9 +140,10 @@ struct nfsd_net {
+
+ struct svc_info nfsd_info;
+ #define nfsd_serv nfsd_info.serv
+- struct percpu_ref nfsd_serv_ref;
+- struct completion nfsd_serv_confirm_done;
+- struct completion nfsd_serv_free_done;
++
++ struct percpu_ref nfsd_net_ref;
++ struct completion nfsd_net_confirm_done;
++ struct completion nfsd_net_free_done;
+
+ /*
+ * clientid and stateid data for construction of net unique COPY
+@@ -229,8 +230,8 @@ struct nfsd_net {
+ extern bool nfsd_support_version(int vers);
+ extern unsigned int nfsd_net_id;
+
+-bool nfsd_serv_try_get(struct net *net);
+-void nfsd_serv_put(struct net *net);
++bool nfsd_net_try_get(struct net *net);
++void nfsd_net_put(struct net *net);
+
+ void nfsd_copy_write_verifier(__be32 verf[2], struct nfsd_net *nn);
+ void nfsd_reset_write_verifier(struct nfsd_net *nn);
+diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
+index f9bb408478dc..571a6ae90833 100644
+--- a/fs/nfsd/nfssvc.c
++++ b/fs/nfsd/nfssvc.c
+@@ -214,32 +214,32 @@ int nfsd_minorversion(struct nfsd_net *nn, u32 minorversion, enum vers_op change
+ return 0;
+ }
+
+-bool nfsd_serv_try_get(struct net *net) __must_hold(rcu)
++bool nfsd_net_try_get(struct net *net) __must_hold(rcu)
+ {
+ struct nfsd_net *nn = net_generic(net, nfsd_net_id);
+
+- return (nn && percpu_ref_tryget_live(&nn->nfsd_serv_ref));
++ return (nn && percpu_ref_tryget_live(&nn->nfsd_net_ref));
+ }
+
+-void nfsd_serv_put(struct net *net) __must_hold(rcu)
++void nfsd_net_put(struct net *net) __must_hold(rcu)
+ {
+ struct nfsd_net *nn = net_generic(net, nfsd_net_id);
+
+- percpu_ref_put(&nn->nfsd_serv_ref);
++ percpu_ref_put(&nn->nfsd_net_ref);
+ }
+
+-static void nfsd_serv_done(struct percpu_ref *ref)
++static void nfsd_net_done(struct percpu_ref *ref)
+ {
+- struct nfsd_net *nn = container_of(ref, struct nfsd_net, nfsd_serv_ref);
++ struct nfsd_net *nn = container_of(ref, struct nfsd_net, nfsd_net_ref);
+
+- complete(&nn->nfsd_serv_confirm_done);
++ complete(&nn->nfsd_net_confirm_done);
+ }
+
+-static void nfsd_serv_free(struct percpu_ref *ref)
++static void nfsd_net_free(struct percpu_ref *ref)
+ {
+- struct nfsd_net *nn = container_of(ref, struct nfsd_net, nfsd_serv_ref);
++ struct nfsd_net *nn = container_of(ref, struct nfsd_net, nfsd_net_ref);
+
+- complete(&nn->nfsd_serv_free_done);
++ complete(&nn->nfsd_net_free_done);
+ }
+
+ /*
+@@ -437,8 +437,8 @@ static void nfsd_shutdown_net(struct net *net)
+ if (!nn->nfsd_net_up)
+ return;
+
+- percpu_ref_kill_and_confirm(&nn->nfsd_serv_ref, nfsd_serv_done);
+- wait_for_completion(&nn->nfsd_serv_confirm_done);
++ percpu_ref_kill_and_confirm(&nn->nfsd_net_ref, nfsd_net_done);
++ wait_for_completion(&nn->nfsd_net_confirm_done);
+
+ nfsd_export_flush(net);
+ nfs4_state_shutdown_net(net);
+@@ -449,8 +449,8 @@ static void nfsd_shutdown_net(struct net *net)
+ nn->lockd_up = false;
+ }
+
+- wait_for_completion(&nn->nfsd_serv_free_done);
+- percpu_ref_exit(&nn->nfsd_serv_ref);
++ wait_for_completion(&nn->nfsd_net_free_done);
++ percpu_ref_exit(&nn->nfsd_net_ref);
+
+ nn->nfsd_net_up = false;
+ nfsd_shutdown_generic();
+@@ -654,12 +654,12 @@ int nfsd_create_serv(struct net *net)
+ if (nn->nfsd_serv)
+ return 0;
+
+- error = percpu_ref_init(&nn->nfsd_serv_ref, nfsd_serv_free,
++ error = percpu_ref_init(&nn->nfsd_net_ref, nfsd_net_free,
+ 0, GFP_KERNEL);
+ if (error)
+ return error;
+- init_completion(&nn->nfsd_serv_free_done);
+- init_completion(&nn->nfsd_serv_confirm_done);
++ init_completion(&nn->nfsd_net_free_done);
++ init_completion(&nn->nfsd_net_confirm_done);
+
+ if (nfsd_max_blksize == 0)
+ nfsd_max_blksize = nfsd_get_default_max_blksize();
+diff --git a/include/linux/nfslocalio.h b/include/linux/nfslocalio.h
+index 9202f4b24343..e1b8018ba639 100644
+--- a/include/linux/nfslocalio.h
++++ b/include/linux/nfslocalio.h
+@@ -47,8 +47,8 @@ nfsd_open_local_fh(struct net *, struct auth_domain *, struct rpc_clnt *,
+ const fmode_t) __must_hold(rcu);
+
+ struct nfsd_localio_operations {
+- bool (*nfsd_serv_try_get)(struct net *);
+- void (*nfsd_serv_put)(struct net *);
++ bool (*nfsd_net_try_get)(struct net *);
++ void (*nfsd_net_put)(struct net *);
+ struct nfsd_file *(*nfsd_open_local_fh)(struct net *,
+ struct auth_domain *,
+ struct rpc_clnt *,
+@@ -69,12 +69,12 @@ struct nfsd_file *nfs_open_local_fh(nfs_uuid_t *,
+ static inline void nfs_to_nfsd_net_put(struct net *net)
+ {
+ /*
+- * Once reference to nfsd_serv is dropped, NFSD could be
+- * unloaded, so ensure safe return from nfsd_file_put_local()
+- * by always taking RCU.
++ * Once reference to net (and associated nfsd_serv) is dropped, NFSD
++ * could be unloaded, so ensure safe return from nfsd_net_put() by
++ * always taking RCU.
+ */
+ rcu_read_lock();
+- nfs_to->nfsd_serv_put(net);
++ nfs_to->nfsd_net_put(net);
+ rcu_read_unlock();
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 5074ab86f3edcc55cb6b7a574f9042a1516d2969 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2024 20:40:58 -0500
+Subject: nfsd: update percpu_ref to manage references on nfsd_net
+
+From: Mike Snitzer <snitzer@kernel.org>
+
+[ Upstream commit 39972494e318a21b3059287909fc090186dbe60a ]
+
+Holding a reference on nfsd_net is what is required, it was never
+actually about ensuring nn->nfsd_serv available.
+
+Move waiting for outstanding percpu references from
+nfsd_destroy_serv() to nfsd_shutdown_net().
+
+By moving it later it will be possible to invalidate localio clients
+during nfsd_file_cache_shutdown_net() via __nfsd_file_cache_purge().
+
+Signed-off-by: Mike Snitzer <snitzer@kernel.org>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Acked-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Stable-dep-of: df8d829bba3a ("nfsd: fix memory leak in nfsd_create_serv error paths")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfssvc.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
+index 45f1bb2c6f13..f9bb408478dc 100644
+--- a/fs/nfsd/nfssvc.c
++++ b/fs/nfsd/nfssvc.c
+@@ -436,6 +436,10 @@ static void nfsd_shutdown_net(struct net *net)
+
+ if (!nn->nfsd_net_up)
+ return;
++
++ percpu_ref_kill_and_confirm(&nn->nfsd_serv_ref, nfsd_serv_done);
++ wait_for_completion(&nn->nfsd_serv_confirm_done);
++
+ nfsd_export_flush(net);
+ nfs4_state_shutdown_net(net);
+ nfsd_reply_cache_shutdown(nn);
+@@ -444,7 +448,10 @@ static void nfsd_shutdown_net(struct net *net)
+ lockd_down(net);
+ nn->lockd_up = false;
+ }
++
++ wait_for_completion(&nn->nfsd_serv_free_done);
+ percpu_ref_exit(&nn->nfsd_serv_ref);
++
+ nn->nfsd_net_up = false;
+ nfsd_shutdown_generic();
+ }
+@@ -526,11 +533,6 @@ void nfsd_destroy_serv(struct net *net)
+
+ lockdep_assert_held(&nfsd_mutex);
+
+- percpu_ref_kill_and_confirm(&nn->nfsd_serv_ref, nfsd_serv_done);
+- wait_for_completion(&nn->nfsd_serv_confirm_done);
+- wait_for_completion(&nn->nfsd_serv_free_done);
+- /* percpu_ref_exit is called in nfsd_shutdown_net */
+-
+ spin_lock(&nfsd_notifier_lock);
+ nn->nfsd_serv = NULL;
+ spin_unlock(&nfsd_notifier_lock);
+--
+2.51.0
+
--- /dev/null
+From e03d7ce9bfac2a872a4c791331a862e65fe5d751 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 10:43:43 -0800
+Subject: nvme-fabrics: add ENOKEY to no retry criteria for authentication
+ failures
+
+From: Justin Tee <justintee8345@gmail.com>
+
+[ Upstream commit 13989207ee29c40501e719512e8dc90768325895 ]
+
+With authentication, in addition to EKEYREJECTED there is also no point in
+retrying reconnects when status is ENOKEY. Thus, add -ENOKEY as another
+criteria to determine when to stop retries.
+
+Cc: Daniel Wagner <wagi@kernel.org>
+Cc: Hannes Reinecke <hare@suse.de>
+Closes: https://lore.kernel.org/linux-nvme/20250829-nvme-fc-sync-v3-0-d69c87e63aee@kernel.org/
+Signed-off-by: Justin Tee <justintee8345@gmail.com>
+Tested-by: Daniel Wagner <wagi@kernel.org>
+Reviewed-by: Daniel Wagner <wagi@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fabrics.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
+index 432efcbf9e2f..2e47c56b2d4b 100644
+--- a/drivers/nvme/host/fabrics.c
++++ b/drivers/nvme/host/fabrics.c
+@@ -591,7 +591,7 @@ bool nvmf_should_reconnect(struct nvme_ctrl *ctrl, int status)
+ if (status > 0 && (status & NVME_STATUS_DNR))
+ return false;
+
+- if (status == -EKEYREJECTED)
++ if (status == -EKEYREJECTED || status == -ENOKEY)
+ return false;
+
+ if (ctrl->opts->max_reconnects == -1 ||
+--
+2.51.0
+
--- /dev/null
+From 4bcf19f1ebd641c4729453d734cd0812264213c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 11:05:45 +0100
+Subject: nvme-fc: don't hold rport lock when putting ctrl
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit b71cbcf7d170e51148d5467820ae8a72febcb651 ]
+
+nvme_fc_ctrl_put can acquire the rport lock when freeing the
+ctrl object:
+
+nvme_fc_ctrl_put
+ nvme_fc_ctrl_free
+ spin_lock_irqsave(rport->lock)
+
+Thus we can't hold the rport lock when calling nvme_fc_ctrl_put.
+
+Justin suggested use the safe list iterator variant because
+nvme_fc_ctrl_put will also modify the rport->list.
+
+Cc: Justin Tee <justin.tee@broadcom.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index d01bd3c300fa..3d90ace0b537 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -1462,14 +1462,14 @@ nvme_fc_match_disconn_ls(struct nvme_fc_rport *rport,
+ {
+ struct fcnvme_ls_disconnect_assoc_rqst *rqst =
+ &lsop->rqstbuf->rq_dis_assoc;
+- struct nvme_fc_ctrl *ctrl, *ret = NULL;
++ struct nvme_fc_ctrl *ctrl, *tmp, *ret = NULL;
+ struct nvmefc_ls_rcv_op *oldls = NULL;
+ u64 association_id = be64_to_cpu(rqst->associd.association_id);
+ unsigned long flags;
+
+ spin_lock_irqsave(&rport->lock, flags);
+
+- list_for_each_entry(ctrl, &rport->ctrl_list, ctrl_list) {
++ list_for_each_entry_safe(ctrl, tmp, &rport->ctrl_list, ctrl_list) {
+ if (!nvme_fc_ctrl_get(ctrl))
+ continue;
+ spin_lock(&ctrl->lock);
+@@ -1482,7 +1482,9 @@ nvme_fc_match_disconn_ls(struct nvme_fc_rport *rport,
+ if (ret)
+ /* leave the ctrl get reference */
+ break;
++ spin_unlock_irqrestore(&rport->lock, flags);
+ nvme_fc_ctrl_put(ctrl);
++ spin_lock_irqsave(&rport->lock, flags);
+ }
+
+ spin_unlock_irqrestore(&rport->lock, flags);
+--
+2.51.0
+
--- /dev/null
+From 6dd01971aa603b8686df38d9fb701bb1d20da573 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Nov 2025 15:04:07 +0800
+Subject: platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI
+ quirks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+
+[ Upstream commit b169e1733cadb614e87f69d7a5ae1b186c50d313 ]
+
+Dell Pro Rugged 10/12 tablets has a reliable VGBS method.
+If VGBS is not called on boot, the on-screen keyboard won't appear if the
+device is booted without a keyboard.
+
+Call VGBS on boot on thess devices to get the initial state of
+SW_TABLET_MODE in a reliable way.
+
+Signed-off-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Link: https://patch.msgid.link/20251127070407.656463-1-acelan.kao@canonical.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/hid.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c
+index 59392f1a0d8a..04056fbd9219 100644
+--- a/drivers/platform/x86/intel/hid.c
++++ b/drivers/platform/x86/intel/hid.c
+@@ -168,6 +168,18 @@ static const struct dmi_system_id dmi_vgbs_allow_list[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP Elite Dragonfly G2 Notebook PC"),
+ },
+ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro Rugged 10 Tablet RA00260"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro Rugged 12 Tablet RA02260"),
++ },
++ },
+ { }
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 34aed5e4db5932f9b78832549e794d3e06d702c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Apr 2025 22:31:13 -0400
+Subject: powerpc/addnote: Fix overflow on 32-bit builds
+
+From: Ben Collins <bcollins@kernel.org>
+
+[ Upstream commit 825ce89a3ef17f84cf2c0eacfa6b8dc9fd11d13f ]
+
+The PUT_64[LB]E() macros need to cast the value to unsigned long long
+like the GET_64[LB]E() macros. Caused lots of warnings when compiled
+on 32-bit, and clobbered addresses (36-bit P4080).
+
+Signed-off-by: Ben Collins <bcollins@kernel.org>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/2025042122-mustard-wrasse-694572@boujee-and-buff
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/addnote.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/boot/addnote.c b/arch/powerpc/boot/addnote.c
+index 53b3b2621457..78704927453a 100644
+--- a/arch/powerpc/boot/addnote.c
++++ b/arch/powerpc/boot/addnote.c
+@@ -68,8 +68,8 @@ static int e_class = ELFCLASS32;
+ #define PUT_16BE(off, v)(buf[off] = ((v) >> 8) & 0xff, \
+ buf[(off) + 1] = (v) & 0xff)
+ #define PUT_32BE(off, v)(PUT_16BE((off), (v) >> 16L), PUT_16BE((off) + 2, (v)))
+-#define PUT_64BE(off, v)((PUT_32BE((off), (v) >> 32L), \
+- PUT_32BE((off) + 4, (v))))
++#define PUT_64BE(off, v)((PUT_32BE((off), (unsigned long long)(v) >> 32L), \
++ PUT_32BE((off) + 4, (unsigned long long)(v))))
+
+ #define GET_16LE(off) ((buf[off]) + (buf[(off)+1] << 8))
+ #define GET_32LE(off) (GET_16LE(off) + (GET_16LE((off)+2U) << 16U))
+@@ -78,7 +78,8 @@ static int e_class = ELFCLASS32;
+ #define PUT_16LE(off, v) (buf[off] = (v) & 0xff, \
+ buf[(off) + 1] = ((v) >> 8) & 0xff)
+ #define PUT_32LE(off, v) (PUT_16LE((off), (v)), PUT_16LE((off) + 2, (v) >> 16L))
+-#define PUT_64LE(off, v) (PUT_32LE((off), (v)), PUT_32LE((off) + 4, (v) >> 32L))
++#define PUT_64LE(off, v) (PUT_32LE((off), (unsigned long long)(v)), \
++ PUT_32LE((off) + 4, (unsigned long long)(v) >> 32L))
+
+ #define GET_16(off) (e_data == ELFDATA2MSB ? GET_16BE(off) : GET_16LE(off))
+ #define GET_32(off) (e_data == ELFDATA2MSB ? GET_32BE(off) : GET_32LE(off))
+--
+2.51.0
+
--- /dev/null
+From 54d365941f0576bedd4d910233463746a2d89ebc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 14:10:37 +0800
+Subject: reset: fix BIT macro reference
+
+From: Encrow Thorne <jyc0019@gmail.com>
+
+[ Upstream commit f3d8b64ee46c9b4b0b82b1a4642027728bac95b8 ]
+
+RESET_CONTROL_FLAGS_BIT_* macros use BIT(), but reset.h does not
+include bits.h. This causes compilation errors when including
+reset.h standalone.
+
+Include bits.h to make reset.h self-contained.
+
+Suggested-by: Troy Mitchell <troy.mitchell@linux.dev>
+Reviewed-by: Troy Mitchell <troy.mitchell@linux.dev>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Encrow Thorne <jyc0019@gmail.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/reset.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/linux/reset.h b/include/linux/reset.h
+index 514ddf003efc..4b31d683776e 100644
+--- a/include/linux/reset.h
++++ b/include/linux/reset.h
+@@ -2,6 +2,7 @@
+ #ifndef _LINUX_RESET_H_
+ #define _LINUX_RESET_H_
+
++#include <linux/bits.h>
+ #include <linux/err.h>
+ #include <linux/errno.h>
+ #include <linux/types.h>
+--
+2.51.0
+
--- /dev/null
+From 69cff80a2a9da6b8fce01299d0cd581141052433 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 10:48:45 -0500
+Subject: scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive
+
+From: Tony Battersby <tonyb@cybernetics.com>
+
+[ Upstream commit 8f58fc64d559b5fda1b0a5e2a71422be61e79ab9 ]
+
+When given the module parameter qlini_mode=exclusive, qla2xxx in
+initiator mode is initially unable to successfully send SCSI commands to
+devices it finds while scanning, resulting in an escalating series of
+resets until an adapter reset clears the issue. Fix by checking the
+active mode instead of the module parameter.
+
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Link: https://patch.msgid.link/1715ec14-ba9a-45dc-9cf2-d41aa6b81b5e@cybernetics.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_os.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 81c76678f25a..9f35c42102be 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -3456,13 +3456,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ ha->mqenable = 0;
+
+ if (ha->mqenable) {
+- bool startit = false;
+-
+- if (QLA_TGT_MODE_ENABLED())
+- startit = false;
+-
+- if (ql2x_ini_mode == QLA2XXX_INI_MODE_ENABLED)
+- startit = true;
++ bool startit = !!(host->active_mode & MODE_INITIATOR);
+
+ /* Create start of day qpairs for Block MQ */
+ for (i = 0; i < ha->max_qpairs; i++)
+--
+2.51.0
+
--- /dev/null
+From aec241eecfe4f669a6c7c53b965ec5d8fec93cb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 10:50:05 -0500
+Subject: scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled
+
+From: Tony Battersby <tonyb@cybernetics.com>
+
+[ Upstream commit 4f6aaade2a22ac428fa99ed716cf2b87e79c9837 ]
+
+When qla2xxx is loaded with qlini_mode=disabled,
+ha->flags.disable_msix_handshake is used before it is set, resulting in
+the wrong interrupt handler being used on certain HBAs
+(qla2xxx_msix_rsp_q_hs() is used when qla2xxx_msix_rsp_q() should be
+used). The only difference between these two interrupt handlers is that
+the _hs() version writes to a register to clear the "RISC" interrupt,
+whereas the other version does not. So this bug results in the RISC
+interrupt being cleared when it should not be. This occasionally causes
+a different interrupt handler qla24xx_msix_default() for a different
+vector to see ((stat & HSRX_RISC_INT) == 0) and ignore its interrupt,
+which then causes problems like:
+
+qla2xxx [0000:02:00.0]-d04c:6: MBX Command timeout for cmd 20,
+ iocontrol=8 jiffies=1090c0300 mb[0-3]=[0x4000 0x0 0x40 0xda] mb7 0x500
+ host_status 0x40000010 hccr 0x3f00
+qla2xxx [0000:02:00.0]-101e:6: Mailbox cmd timeout occurred, cmd=0x20,
+ mb[0]=0x20. Scheduling ISP abort
+(the cmd varies; sometimes it is 0x20, 0x22, 0x54, 0x5a, 0x5d, or 0x6a)
+
+This problem can be reproduced with a 16 or 32 Gbps HBA by loading
+qla2xxx with qlini_mode=disabled and running a high IOPS test while
+triggering frequent RSCN database change events.
+
+While analyzing the problem I discovered that even with
+disable_msix_handshake forced to 0, it is not necessary to clear the
+RISC interrupt from qla2xxx_msix_rsp_q_hs() (more below). So just
+completely remove qla2xxx_msix_rsp_q_hs() and the logic for selecting
+it, which also fixes the bug with qlini_mode=disabled.
+
+The test below describes the justification for not needing
+qla2xxx_msix_rsp_q_hs():
+
+Force disable_msix_handshake to 0:
+qla24xx_config_rings():
+if (0 && (ha->fw_attributes & BIT_6) && (IS_MSIX_NACK_CAPABLE(ha)) &&
+ (ha->flags.msix_enabled)) {
+
+In qla24xx_msix_rsp_q() and qla2xxx_msix_rsp_q_hs(), check:
+ (rd_reg_dword(®->host_status) & HSRX_RISC_INT)
+
+Count the number of calls to each function with HSRX_RISC_INT set and
+the number with HSRX_RISC_INT not set while performing some I/O.
+
+If qla2xxx_msix_rsp_q_hs() clears the RISC interrupt (original code):
+qla24xx_msix_rsp_q: 50% of calls have HSRX_RISC_INT set
+qla2xxx_msix_rsp_q_hs: 5% of calls have HSRX_RISC_INT set
+(# of qla2xxx_msix_rsp_q_hs interrupts) =
+ (# of qla24xx_msix_rsp_q interrupts) * 3
+
+If qla2xxx_msix_rsp_q_hs() does not clear the RISC interrupt (patched
+code):
+qla24xx_msix_rsp_q: 100% of calls have HSRX_RISC_INT set
+qla2xxx_msix_rsp_q_hs: 9% of calls have HSRX_RISC_INT set
+(# of qla2xxx_msix_rsp_q_hs interrupts) =
+ (# of qla24xx_msix_rsp_q interrupts) * 3
+
+In the case of the original code, qla24xx_msix_rsp_q() was seeing
+HSRX_RISC_INT set only 50% of the time because qla2xxx_msix_rsp_q_hs()
+was clearing it when it shouldn't have been. In the patched code,
+qla24xx_msix_rsp_q() sees HSRX_RISC_INT set 100% of the time, which
+makes sense if that interrupt handler needs to clear the RISC interrupt
+(which it does). qla2xxx_msix_rsp_q_hs() sees HSRX_RISC_INT only 9% of
+the time, which is just overlap from the other interrupt during the
+high IOPS test.
+
+Tested with SCST on:
+QLE2742 FW:v9.08.02 (32 Gbps 2-port)
+QLE2694L FW:v9.10.11 (16 Gbps 4-port)
+QLE2694L FW:v9.08.02 (16 Gbps 4-port)
+QLE2672 FW:v8.07.12 (16 Gbps 2-port)
+both initiator and target mode
+
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Link: https://patch.msgid.link/56d378eb-14ad-49c7-bae9-c649b6c7691e@cybernetics.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_def.h | 1 -
+ drivers/scsi/qla2xxx/qla_gbl.h | 2 +-
+ drivers/scsi/qla2xxx/qla_isr.c | 32 +++-----------------------------
+ drivers/scsi/qla2xxx/qla_mid.c | 4 +---
+ 4 files changed, 5 insertions(+), 34 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
+index cb95b7b12051..b3265952c4be 100644
+--- a/drivers/scsi/qla2xxx/qla_def.h
++++ b/drivers/scsi/qla2xxx/qla_def.h
+@@ -3503,7 +3503,6 @@ struct isp_operations {
+ #define QLA_MSIX_RSP_Q 0x01
+ #define QLA_ATIO_VECTOR 0x02
+ #define QLA_MSIX_QPAIR_MULTIQ_RSP_Q 0x03
+-#define QLA_MSIX_QPAIR_MULTIQ_RSP_Q_HS 0x04
+
+ #define QLA_MIDX_DEFAULT 0
+ #define QLA_MIDX_RSP_Q 1
+diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
+index e556f57c91af..59f448e2e319 100644
+--- a/drivers/scsi/qla2xxx/qla_gbl.h
++++ b/drivers/scsi/qla2xxx/qla_gbl.h
+@@ -768,7 +768,7 @@ extern int qla2x00_dfs_remove(scsi_qla_host_t *);
+
+ /* Globa function prototypes for multi-q */
+ extern int qla25xx_request_irq(struct qla_hw_data *, struct qla_qpair *,
+- struct qla_msix_entry *, int);
++ struct qla_msix_entry *);
+ extern int qla25xx_init_req_que(struct scsi_qla_host *, struct req_que *);
+ extern int qla25xx_init_rsp_que(struct scsi_qla_host *, struct rsp_que *);
+ extern int qla25xx_create_req_que(struct qla_hw_data *, uint16_t, uint8_t,
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index fe98c76e9be3..77c779cca97f 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -4467,32 +4467,6 @@ qla2xxx_msix_rsp_q(int irq, void *dev_id)
+ return IRQ_HANDLED;
+ }
+
+-irqreturn_t
+-qla2xxx_msix_rsp_q_hs(int irq, void *dev_id)
+-{
+- struct qla_hw_data *ha;
+- struct qla_qpair *qpair;
+- struct device_reg_24xx __iomem *reg;
+- unsigned long flags;
+-
+- qpair = dev_id;
+- if (!qpair) {
+- ql_log(ql_log_info, NULL, 0x505b,
+- "%s: NULL response queue pointer.\n", __func__);
+- return IRQ_NONE;
+- }
+- ha = qpair->hw;
+-
+- reg = &ha->iobase->isp24;
+- spin_lock_irqsave(&ha->hardware_lock, flags);
+- wrt_reg_dword(®->hccr, HCCRX_CLR_RISC_INT);
+- spin_unlock_irqrestore(&ha->hardware_lock, flags);
+-
+- queue_work(ha->wq, &qpair->q_work);
+-
+- return IRQ_HANDLED;
+-}
+-
+ /* Interrupt handling helpers. */
+
+ struct qla_init_msix_entry {
+@@ -4505,7 +4479,6 @@ static const struct qla_init_msix_entry msix_entries[] = {
+ { "rsp_q", qla24xx_msix_rsp_q },
+ { "atio_q", qla83xx_msix_atio_q },
+ { "qpair_multiq", qla2xxx_msix_rsp_q },
+- { "qpair_multiq_hs", qla2xxx_msix_rsp_q_hs },
+ };
+
+ static const struct qla_init_msix_entry qla82xx_msix_entries[] = {
+@@ -4792,9 +4765,10 @@ qla2x00_free_irqs(scsi_qla_host_t *vha)
+ }
+
+ int qla25xx_request_irq(struct qla_hw_data *ha, struct qla_qpair *qpair,
+- struct qla_msix_entry *msix, int vector_type)
++ struct qla_msix_entry *msix)
+ {
+- const struct qla_init_msix_entry *intr = &msix_entries[vector_type];
++ const struct qla_init_msix_entry *intr =
++ &msix_entries[QLA_MSIX_QPAIR_MULTIQ_RSP_Q];
+ scsi_qla_host_t *vha = pci_get_drvdata(ha->pdev);
+ int ret;
+
+diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
+index 79879c4743e6..9946899dd83b 100644
+--- a/drivers/scsi/qla2xxx/qla_mid.c
++++ b/drivers/scsi/qla2xxx/qla_mid.c
+@@ -899,9 +899,7 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options,
+ rsp->options, rsp->id, rsp->rsp_q_in,
+ rsp->rsp_q_out);
+
+- ret = qla25xx_request_irq(ha, qpair, qpair->msix,
+- ha->flags.disable_msix_handshake ?
+- QLA_MSIX_QPAIR_MULTIQ_RSP_Q : QLA_MSIX_QPAIR_MULTIQ_RSP_Q_HS);
++ ret = qla25xx_request_irq(ha, qpair, qpair->msix);
+ if (ret)
+ goto que_failed;
+
+--
+2.51.0
+
--- /dev/null
+From 6f6c1ee3030abbb7ff5d0d087da7dd8495542cf0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 10:51:28 -0500
+Subject: scsi: qla2xxx: Use reinit_completion on mbx_intr_comp
+
+From: Tony Battersby <tonyb@cybernetics.com>
+
+[ Upstream commit 957aa5974989fba4ae4f807ebcb27f12796edd4d ]
+
+If a mailbox command completes immediately after
+wait_for_completion_timeout() times out, ha->mbx_intr_comp could be left
+in an inconsistent state, causing the next mailbox command not to wait
+for the hardware. Fix by reinitializing the completion before use.
+
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Link: https://patch.msgid.link/11b6485e-0bfd-4784-8f99-c06a196dad94@cybernetics.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_mbx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
+index 13b6cb1b93ac..41435e98092a 100644
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -253,6 +253,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
+ /* Issue set host interrupt command to send cmd out. */
+ ha->flags.mbox_int = 0;
+ clear_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags);
++ reinit_completion(&ha->mbx_intr_comp);
+
+ /* Unlock mbx registers and wait for interrupt */
+ ql_dbg(ql_dbg_mbx, vha, 0x100f,
+@@ -279,6 +280,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
+ "cmd=%x Timeout.\n", command);
+ spin_lock_irqsave(&ha->hardware_lock, flags);
+ clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags);
++ reinit_completion(&ha->mbx_intr_comp);
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
+ if (chip_reset != ha->chip_reset) {
+--
+2.51.0
+
--- /dev/null
+From 5f79852ca80fa2a55e0fcaf33c30b52f7c9df97f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Nov 2025 10:38:21 -0600
+Subject: scsi: smartpqi: Add support for Hurray Data new controller PCI device
+
+From: David Strahan <David.Strahan@microchip.com>
+
+[ Upstream commit 48e6b7e708029cea451e53a8c16fc8c16039ecdc ]
+
+Add support for new Hurray Data controller.
+
+All entries are in HEX.
+
+Add PCI IDs for Hurray Data controllers:
+ VID / DID / SVID / SDID
+ ---- ---- ---- ----
+ 9005 028f 207d 4840
+
+Reviewed-by: Scott Benesh <scott.benesh@microchip.com>
+Reviewed-by: Scott Teel <scott.teel@microchip.com>
+Reviewed-by: Mike McGowen <mike.mcgowen@microchip.com>
+Signed-off-by: David Strahan <David.Strahan@microchip.com>
+Signed-off-by: Don Brace <don.brace@microchip.com>
+Link: https://patch.msgid.link/20251106163823.786828-4-don.brace@microchip.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/smartpqi/smartpqi_init.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
+index 018f5428a07d..f0fb22e4117e 100644
+--- a/drivers/scsi/smartpqi/smartpqi_init.c
++++ b/drivers/scsi/smartpqi/smartpqi_init.c
+@@ -10091,6 +10091,10 @@ static const struct pci_device_id pqi_pci_id_table[] = {
+ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+ 0x207d, 0x4240)
+ },
++ {
++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
++ 0x207d, 0x4840)
++ },
+ {
+ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+ PCI_VENDOR_ID_ADVANTECH, 0x8312)
+--
+2.51.0
+
--- /dev/null
+From 6f05c0c8eebe81b81f2f275bf3b54a9a4c4b70fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 17:43:27 +0800
+Subject: scsi: ufs: host: mediatek: Fix shutdown/suspend race condition
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit 014de20bb36ba03e0e0b0a7e0a1406ab900c9fda ]
+
+Address a race condition between shutdown and suspend operations in the
+UFS Mediatek driver. Before entering suspend, check if a shutdown is in
+progress to prevent conflicts and ensure system stability.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Acked-by: Chun-Hung Wu <chun-hung.wu@mediatek.com>
+Link: https://patch.msgid.link/20250924094527.2992256-6-peter.wang@mediatek.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 00ecfe14c1fd..1fb98af4ac56 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1994,6 +1994,11 @@ static int ufs_mtk_system_suspend(struct device *dev)
+ struct arm_smccc_res res;
+ int ret;
+
++ if (hba->shutting_down) {
++ ret = -EBUSY;
++ goto out;
++ }
++
+ ret = ufshcd_system_suspend(dev);
+ if (ret)
+ goto out;
+--
+2.51.0
+
--- /dev/null
+From 09181ceced300c988eba7942e770166c4bea9559 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Oct 2025 11:08:40 +0800
+Subject: serial: sprd: Return -EPROBE_DEFER when uart clock is not ready
+
+From: Wenhua Lin <Wenhua.Lin@unisoc.com>
+
+[ Upstream commit 29e8a0c587e328ed458380a45d6028adf64d7487 ]
+
+In sprd_clk_init(), when devm_clk_get() returns -EPROBE_DEFER
+for either uart or source clock, we should propagate the
+error instead of just warning and continuing with NULL clocks.
+
+Currently the driver only emits a warning when clock acquisition
+fails and proceeds with NULL clock pointers. This can lead to
+issues later when the clocks are actually needed. More importantly,
+when the clock provider is not ready yet and returns -EPROBE_DEFER,
+we should return this error to allow deferred probing.
+
+This change adds explicit checks for -EPROBE_DEFER after both:
+1. devm_clk_get(uport->dev, uart)
+2. devm_clk_get(uport->dev, source)
+
+When -EPROBE_DEFER is encountered, the function now returns
+-EPROBE_DEFER to let the driver framework retry probing
+later when the clock dependencies are resolved.
+
+Signed-off-by: Wenhua Lin <Wenhua.Lin@unisoc.com>
+Link: https://patch.msgid.link/20251022030840.956589-1-Wenhua.Lin@unisoc.com
+Reviewed-by: Cixi Geng <cixi.geng@linux.dev>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/sprd_serial.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c
+index 3fc54cc02a1f..c575c38b513d 100644
+--- a/drivers/tty/serial/sprd_serial.c
++++ b/drivers/tty/serial/sprd_serial.c
+@@ -1109,6 +1109,9 @@ static int sprd_clk_init(struct uart_port *uport)
+
+ clk_uart = devm_clk_get(uport->dev, "uart");
+ if (IS_ERR(clk_uart)) {
++ if (PTR_ERR(clk_uart) == -EPROBE_DEFER)
++ return -EPROBE_DEFER;
++
+ dev_warn(uport->dev, "uart%d can't get uart clock\n",
+ uport->line);
+ clk_uart = NULL;
+@@ -1116,6 +1119,9 @@ static int sprd_clk_init(struct uart_port *uport)
+
+ clk_parent = devm_clk_get(uport->dev, "source");
+ if (IS_ERR(clk_parent)) {
++ if (PTR_ERR(clk_parent) == -EPROBE_DEFER)
++ return -EPROBE_DEFER;
++
+ dev_warn(uport->dev, "uart%d can't get source clock\n",
+ uport->line);
+ clk_parent = NULL;
+--
+2.51.0
+
mmc-sdhci-of-arasan-increase-cd-stable-timeout-to-2-seconds.patch
dt-bindings-mmc-sdhci-of-aspeed-switch-ref-to-sdhci-common.yaml.patch
net-hsr-fix-null-pointer-dereference-in-prp_get_untagged_frame.patch
+x86-fpu-fix-fpu-state-core-dump-truncation-on-cpus-w.patch
+alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch
+alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch
+alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch
+asoc-ak4458-remove-the-reset-operation-in-probe-and-.patch
+nfsd-update-percpu_ref-to-manage-references-on-nfsd_.patch
+nfsd-rename-nfsd_serv_-prefixed-methods-and-variable.patch
+nfsd-fix-memory-leak-in-nfsd_create_serv-error-paths.patch
+ipmi-fix-the-race-between-__scan_channels-and-delive.patch
+ipmi-fix-__scan_channels-failing-to-rescan-channels.patch
+scsi-ufs-host-mediatek-fix-shutdown-suspend-race-con.patch
+firmware-imx-scu-irq-init-workqueue-before-request-m.patch
+ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch
+scsi-smartpqi-add-support-for-hurray-data-new-contro.patch
+clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch
+powerpc-addnote-fix-overflow-on-32-bit-builds.patch
+scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch
+scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch
+scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch
+fuse-always-flush-the-page-cache-before-fopen_direct.patch
+fuse-invalidate-the-page-cache-after-fopen_direct_io.patch
+via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch
+reset-fix-bit-macro-reference.patch
+exfat-fix-remount-failure-in-different-process-envir.patch
+exfat-zero-out-post-eof-page-cache-on-file-extension.patch
+usbip-fix-locking-bug-in-rt-enabled-kernels.patch
+usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch
+iio-adc-ti_am335x_adc-limit-step_avg-to-valid-range-.patch
+usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch
+usb-usb-storage-no-additional-quirks-need-to-be-adde.patch
+serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch
+libperf-cpumap-fix-perf_cpu_map__max-for-an-empty-nu.patch
+clk-qcom-dispcc-sm7150-fix-dispcc_mdss_pclk0_clk_src.patch
+i2c-designware-disable-smbus-interrupts-to-prevent-s.patch
+nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch
+nvme-fabrics-add-enokey-to-no-retry-criteria-for-aut.patch
+platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch
+mips-ftrace-fix-memory-corruption-when-kernel-is-loc.patch
--- /dev/null
+From 856c2c0de0c7bb5026229eadfa097a7694e016ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 15:11:13 +0200
+Subject: ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx
+
+From: Matthias Schiffer <matthias.schiffer@tq-group.com>
+
+[ Upstream commit 3f61783920504b2cf99330b372d82914bb004d8e ]
+
+am33xx.dtsi has the same clock setup as am35xx.dtsi, setting
+ti,no-reset-on-init and ti,no-idle on timer1_target and timer2_target,
+so AM33 needs the same workaround as AM35 to avoid ti-sysc probe
+failing on certain target modules.
+
+Signed-off-by: Matthias Schiffer <matthias.schiffer@tq-group.com>
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250825131114.2206804-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/ti-sysc.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index f715c8d28129..27149eb29afb 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -48,6 +48,7 @@ enum sysc_soc {
+ SOC_UNKNOWN,
+ SOC_2420,
+ SOC_2430,
++ SOC_AM33,
+ SOC_3430,
+ SOC_AM35,
+ SOC_3630,
+@@ -2896,6 +2897,7 @@ static void ti_sysc_idle(struct work_struct *work)
+ static const struct soc_device_attribute sysc_soc_match[] = {
+ SOC_FLAG("OMAP242*", SOC_2420),
+ SOC_FLAG("OMAP243*", SOC_2430),
++ SOC_FLAG("AM33*", SOC_AM33),
+ SOC_FLAG("AM35*", SOC_AM35),
+ SOC_FLAG("OMAP3[45]*", SOC_3430),
+ SOC_FLAG("OMAP3[67]*", SOC_3630),
+@@ -3101,10 +3103,15 @@ static int sysc_check_active_timer(struct sysc *ddata)
+ * can be dropped if we stop supporting old beagleboard revisions
+ * A to B4 at some point.
+ */
+- if (sysc_soc->soc == SOC_3430 || sysc_soc->soc == SOC_AM35)
++ switch (sysc_soc->soc) {
++ case SOC_AM33:
++ case SOC_3430:
++ case SOC_AM35:
+ error = -ENXIO;
+- else
++ break;
++ default:
+ error = -EBUSY;
++ }
+
+ if ((ddata->cfg.quirks & SYSC_QUIRK_NO_RESET_ON_INIT) &&
+ (ddata->cfg.quirks & SYSC_QUIRK_NO_IDLE))
+--
+2.51.0
+
--- /dev/null
+From ab8c19545f24332b4a071cad9d247618fbca9b13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 14:53:07 -0400
+Subject: usb: typec: ucsi: Handle incorrect num_connectors capability
+
+From: Mark Pearson <mpearson-lenovo@squebb.ca>
+
+[ Upstream commit 30cd2cb1abf4c4acdb1ddb468c946f68939819fb ]
+
+The UCSI spec states that the num_connectors field is 7 bits, and the
+8th bit is reserved and should be set to zero.
+Some buggy FW has been known to set this bit, and it can lead to a
+system not booting.
+Flag that the FW is not behaving correctly, and auto-fix the value
+so that the system boots correctly.
+
+Found on Lenovo P1 G8 during Linux enablement program. The FW will
+be fixed, but seemed worth addressing in case it hit platforms that
+aren't officially Linux supported.
+
+Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20250821185319.2585023-1-mpearson-lenovo@squebb.ca
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/ucsi/ucsi.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
+index 896e6bc1b5e2..9a0fb6a79b21 100644
+--- a/drivers/usb/typec/ucsi/ucsi.c
++++ b/drivers/usb/typec/ucsi/ucsi.c
+@@ -1772,6 +1772,12 @@ static int ucsi_init(struct ucsi *ucsi)
+ ret = -ENODEV;
+ goto err_reset;
+ }
++ /* Check if reserved bit set. This is out of spec but happens in buggy FW */
++ if (ucsi->cap.num_connectors & 0x80) {
++ dev_warn(ucsi->dev, "UCSI: Invalid num_connectors %d. Likely buggy FW\n",
++ ucsi->cap.num_connectors);
++ ucsi->cap.num_connectors &= 0x7f; // clear bit and carry on
++ }
+
+ /* Allocate the connectors. Released in ucsi_unregister() */
+ connector = kcalloc(ucsi->cap.num_connectors + 1, sizeof(*connector), GFP_KERNEL);
+--
+2.51.0
+
--- /dev/null
+From ee8f8f89c95ed161edcd84d81db71d01286fa238 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 14:40:20 +0800
+Subject: usb: usb-storage: No additional quirks need to be added to the EL-R12
+ optical drive.
+
+From: Chen Changcheng <chenchangcheng@kylinos.cn>
+
+[ Upstream commit 955a48a5353f4fe009704a9a4272a3adf627cd35 ]
+
+The optical drive of EL-R12 has the same vid and pid as INIC-3069,
+as follows:
+T: Bus=02 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#= 3 Spd=5000 MxCh= 0
+D: Ver= 3.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
+P: Vendor=13fd ProdID=3940 Rev= 3.10
+S: Manufacturer=HL-DT-ST
+S: Product= DVD+-RW GT80N
+S: SerialNumber=423349524E4E38303338323439202020
+C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=144mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=02 Prot=50 Driver=usb-storage
+E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=0a(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+
+This will result in the optical drive device also adding
+the quirks of US_FL_NO_ATA_1X. When performing an erase operation,
+it will fail, and the reason for the failure is as follows:
+[ 388.967742] sr 5:0:0:0: [sr0] tag#0 Send: scmd 0x00000000d20c33a7
+[ 388.967742] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00
+[ 388.967773] sr 5:0:0:0: [sr0] tag#0 Done: SUCCESS Result: hostbyte=DID_TARGET_FAILURE driverbyte=DRIVER_OK cmd_age=0s
+[ 388.967773] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00
+[ 388.967803] sr 5:0:0:0: [sr0] tag#0 Sense Key : Illegal Request [current]
+[ 388.967803] sr 5:0:0:0: [sr0] tag#0 Add. Sense: Invalid field in cdb
+[ 388.967803] sr 5:0:0:0: [sr0] tag#0 scsi host busy 1 failed 0
+[ 388.967803] sr 5:0:0:0: Notifying upper driver of completion (result 8100002)
+[ 388.967834] sr 5:0:0:0: [sr0] tag#0 0 sectors total, 0 bytes done.
+
+For the EL-R12 standard optical drive, all operational commands
+and usage scenarios were tested without adding the IGNORE_RESIDUE quirks,
+and no issues were encountered. It can be reasonably concluded
+that removing the IGNORE_RESIDUE quirks has no impact.
+
+Signed-off-by: Chen Changcheng <chenchangcheng@kylinos.cn>
+Link: https://patch.msgid.link/20251121064020.29332-1-chenchangcheng@kylinos.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/storage/unusual_uas.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index 1477e31d7763..b695f5ba9a40 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -98,7 +98,7 @@ UNUSUAL_DEV(0x125f, 0xa94a, 0x0160, 0x0160,
+ US_FL_NO_ATA_1X),
+
+ /* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
+-UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
++UNUSUAL_DEV(0x13fd, 0x3940, 0x0309, 0x0309,
+ "Initio Corporation",
+ "INIC-3069",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+--
+2.51.0
+
--- /dev/null
+From 87ce67ca4fb2a0d6d6abca90a8936ea6d879b608 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 16:23:55 +0200
+Subject: usb: xhci: limit run_graceperiod for only usb 3.0 devices
+
+From: Hongyu Xie <xiehongyu1@kylinos.cn>
+
+[ Upstream commit 8d34983720155b8f05de765f0183d9b0e1345cc0 ]
+
+run_graceperiod blocks usb 2.0 devices from auto suspending after
+xhci_start for 500ms.
+
+Log shows:
+[ 13.387170] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100
+[ 13.387177] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.387182] hub_suspend:3903: hub 7-0:1.0: hub_suspend
+[ 13.387188] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1
+[ 13.387191] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event
+[ 13.387193] hcd_bus_resume:2303: usb usb7: usb auto-resume
+[ 13.387296] hub_event:5779: hub 3-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.393343] handle_port_status:2034: xhci-hcd PNP0D10:02: handle_port_status: starting usb5 port polling.
+[ 13.393353] xhci_hub_control:1271: xhci-hcd PNP0D10:02: Get port status 5-1 read: 0x206e1, return 0x10101
+[ 13.400047] hub_suspend:3903: hub 3-0:1.0: hub_suspend
+[ 13.403077] hub_resume:3948: hub 7-0:1.0: hub_resume
+[ 13.403080] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100
+[ 13.403085] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.403087] hub_suspend:3903: hub 7-0:1.0: hub_suspend
+[ 13.403090] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1
+[ 13.403093] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event
+[ 13.403095] hcd_bus_resume:2303: usb usb7: usb auto-resume
+[ 13.405002] handle_port_status:1913: xhci-hcd PNP0D10:04: Port change event, 9-1, id 1, portsc: 0x6e1
+[ 13.405016] hub_activate:1169: usb usb5-port1: status 0101 change 0001
+[ 13.405026] xhci_clear_port_change_bit:658: xhci-hcd PNP0D10:02: clear port1 connect change, portsc: 0x6e1
+[ 13.413275] hcd_bus_suspend:2250: usb usb3: bus auto-suspend, wakeup 1
+[ 13.419081] hub_resume:3948: hub 7-0:1.0: hub_resume
+[ 13.419086] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100
+[ 13.419095] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.419100] hub_suspend:3903: hub 7-0:1.0: hub_suspend
+[ 13.419106] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1
+[ 13.419110] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event
+[ 13.419112] hcd_bus_resume:2303: usb usb7: usb auto-resume
+[ 13.420455] handle_port_status:2034: xhci-hcd PNP0D10:04: handle_port_status: starting usb9 port polling.
+[ 13.420493] handle_port_status:1913: xhci-hcd PNP0D10:05: Port change event, 10-1, id 1, portsc: 0x6e1
+[ 13.425332] hcd_bus_suspend:2279: usb usb3: suspend raced with wakeup event
+[ 13.431931] handle_port_status:2034: xhci-hcd PNP0D10:05: handle_port_status: starting usb10 port polling.
+[ 13.435080] hub_resume:3948: hub 7-0:1.0: hub_resume
+[ 13.435084] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100
+[ 13.435092] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.435096] hub_suspend:3903: hub 7-0:1.0: hub_suspend
+[ 13.435102] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1
+[ 13.435106] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event
+
+usb7 and other usb 2.0 root hub were rapidly toggling between suspend
+and resume states. More, "suspend raced with wakeup event" confuses people.
+
+So, limit run_graceperiod for only usb 3.0 devices
+
+Signed-off-by: Hongyu Xie <xiehongyu1@kylinos.cn>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://patch.msgid.link/20251119142417.2820519-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-hub.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 69aedce9d67b..49cba1cdd91b 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -1671,7 +1671,7 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
+ * SS devices are only visible to roothub after link training completes.
+ * Keep polling roothubs for a grace period after xHC start
+ */
+- if (xhci->run_graceperiod) {
++ if (hcd->speed >= HCD_USB3 && xhci->run_graceperiod) {
+ if (time_before(jiffies, xhci->run_graceperiod))
+ status = 1;
+ else
+--
+2.51.0
+
--- /dev/null
+From 6c7f345971e7097ba694751dc853c5c1f4e46de2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 09:41:43 +0800
+Subject: usbip: Fix locking bug in RT-enabled kernels
+
+From: Lizhi Xu <lizhi.xu@windriver.com>
+
+[ Upstream commit 09bf21bf5249880f62fe759b53b14b4b52900c6c ]
+
+Interrupts are disabled before entering usb_hcd_giveback_urb().
+A spinlock_t becomes a sleeping lock on PREEMPT_RT, so it cannot be
+acquired with disabled interrupts.
+
+Save the interrupt status and restore it after usb_hcd_giveback_urb().
+
+syz reported:
+BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
+Call Trace:
+ dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
+ rt_spin_lock+0xc7/0x2c0 kernel/locking/spinlock_rt.c:57
+ spin_lock include/linux/spinlock_rt.h:44 [inline]
+ mon_bus_complete drivers/usb/mon/mon_main.c:134 [inline]
+ mon_complete+0x5c/0x200 drivers/usb/mon/mon_main.c:147
+ usbmon_urb_complete include/linux/usb/hcd.h:738 [inline]
+ __usb_hcd_giveback_urb+0x254/0x5e0 drivers/usb/core/hcd.c:1647
+ vhci_urb_enqueue+0xb4f/0xe70 drivers/usb/usbip/vhci_hcd.c:818
+
+Reported-by: syzbot+205ef33a3b636b4181fb@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=205ef33a3b636b4181fb
+Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20250916014143.1439759-1-lizhi.xu@windriver.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/usbip/vhci_hcd.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
+index a793e30d46b7..f67b4d33a0ab 100644
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -830,15 +830,15 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ no_need_xmit:
+ usb_hcd_unlink_urb_from_ep(hcd, urb);
+ no_need_unlink:
+- spin_unlock_irqrestore(&vhci->lock, flags);
+ if (!ret) {
+ /* usb_hcd_giveback_urb() should be called with
+ * irqs disabled
+ */
+- local_irq_disable();
++ spin_unlock(&vhci->lock);
+ usb_hcd_giveback_urb(hcd, urb, urb->status);
+- local_irq_enable();
++ spin_lock(&vhci->lock);
+ }
++ spin_unlock_irqrestore(&vhci->lock, flags);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 8f2cabc6242ca1414347f7585fef0e640c1ae665 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Sep 2025 16:33:32 +0800
+Subject: via_wdt: fix critical boot hang due to unnamed resource allocation
+
+From: Li Qiang <liqiang01@kylinos.cn>
+
+[ Upstream commit 7aa31ee9ec92915926e74731378c009c9cc04928 ]
+
+The VIA watchdog driver uses allocate_resource() to reserve a MMIO
+region for the watchdog control register. However, the allocated
+resource was not given a name, which causes the kernel resource tree
+to contain an entry marked as "<BAD>" under /proc/iomem on x86
+platforms.
+
+During boot, this unnamed resource can lead to a critical hang because
+subsequent resource lookups and conflict checks fail to handle the
+invalid entry properly.
+
+Signed-off-by: Li Qiang <liqiang01@kylinos.cn>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/via_wdt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/watchdog/via_wdt.c b/drivers/watchdog/via_wdt.c
+index eeb39f96e72e..c1ed3ce153cf 100644
+--- a/drivers/watchdog/via_wdt.c
++++ b/drivers/watchdog/via_wdt.c
+@@ -165,6 +165,7 @@ static int wdt_probe(struct pci_dev *pdev,
+ dev_err(&pdev->dev, "cannot enable PCI device\n");
+ return -ENODEV;
+ }
++ wdt_res.name = "via_wdt";
+
+ /*
+ * Allocate a MMIO region which contains watchdog control register
+--
+2.51.0
+
--- /dev/null
+From c8b030f6fdc3e50c93209199e5f23c0a960cbd79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Dec 2025 08:02:20 +0800
+Subject: x86/fpu: Fix FPU state core dump truncation on CPUs with no extended
+ xfeatures
+
+From: Yongxin Liu <yongxin.liu@windriver.com>
+
+[ Upstream commit c8161e5304abb26e6c0bec6efc947992500fa6c5 ]
+
+Zero can be a valid value of num_records. For example, on Intel Atom x6425RE,
+only x87 and SSE are supported (features 0, 1), and fpu_user_cfg.max_features
+is 3. The for_each_extended_xfeature() loop only iterates feature 2, which is
+not enabled, so num_records = 0. This is valid and should not cause core dump
+failure.
+
+The issue is that dump_xsave_layout_desc() returns 0 for both genuine errors
+(dump_emit() failure) and valid cases (no extended features). Use negative
+return values for errors and only abort on genuine failures.
+
+Fixes: ba386777a30b ("x86/elf: Add a new FPU buffer layout info to x86 core files")
+Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://patch.msgid.link/20251210000219.4094353-2-yongxin.liu@windriver.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/fpu/xstate.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
+index 22abb5ee0cf2..aacb59c4a35c 100644
+--- a/arch/x86/kernel/fpu/xstate.c
++++ b/arch/x86/kernel/fpu/xstate.c
+@@ -1879,7 +1879,7 @@ static int dump_xsave_layout_desc(struct coredump_params *cprm)
+ };
+
+ if (!dump_emit(cprm, &xc, sizeof(xc)))
+- return 0;
++ return -1;
+
+ num_records++;
+ }
+@@ -1917,7 +1917,7 @@ int elf_coredump_extra_notes_write(struct coredump_params *cprm)
+ return 1;
+
+ num_records = dump_xsave_layout_desc(cprm);
+- if (!num_records)
++ if (num_records < 0)
+ return 1;
+
+ /* Total size should be equal to the number of records */
+--
+2.51.0
+
--- /dev/null
+From c3fdb025dbec65c7516f52bc61d8fb4ec6a6691b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 17:04:33 +0800
+Subject: ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path
+
+From: Haotian Zhang <vulab@iscas.ac.cn>
+
+[ Upstream commit 5032347c04ba7ff9ba878f262e075d745c06a2a8 ]
+
+When pdacf_config() fails, snd_pdacf_probe() returns the error code
+directly without freeing the sound card resources allocated by
+snd_card_new(), which leads to a memory leak.
+
+Add proper error handling to free the sound card and clear the card
+list entry when pdacf_config() fails.
+
+Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions")
+Suggested-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
+Link: https://patch.msgid.link/20251215090433.211-1-vulab@iscas.ac.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pcmcia/pdaudiocf/pdaudiocf.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf.c b/sound/pcmcia/pdaudiocf/pdaudiocf.c
+index 13419837dfb7..a3291e626440 100644
+--- a/sound/pcmcia/pdaudiocf/pdaudiocf.c
++++ b/sound/pcmcia/pdaudiocf/pdaudiocf.c
+@@ -131,7 +131,13 @@ static int snd_pdacf_probe(struct pcmcia_device *link)
+ link->config_index = 1;
+ link->config_regs = PRESENT_OPTION;
+
+- return pdacf_config(link);
++ err = pdacf_config(link);
++ if (err < 0) {
++ card_list[i] = NULL;
++ snd_card_free(card);
++ return err;
++ }
++ return 0;
+ }
+
+
+--
+2.51.0
+
--- /dev/null
+From 42edac347ca65be744a4b9b489b640cebaf446ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 10:46:30 +0800
+Subject: ALSA: usb-mixer: us16x08: validate meter packet indices
+
+From: Shipei Qu <qu@darknavy.com>
+
+[ Upstream commit 5526c1c6ba1d0913c7dfcbbd6fe1744ea7c55f1e ]
+
+get_meter_levels_from_urb() parses the 64-byte meter packets sent by
+the device and fills the per-channel arrays meter_level[],
+comp_level[] and master_level[] in struct snd_us16x08_meter_store.
+
+Currently the function derives the channel index directly from the
+meter packet (MUB2(meter_urb, s) - 1) and uses it to index those
+arrays without validating the range. If the packet contains a
+negative or out-of-range channel number, the driver may write past
+the end of these arrays.
+
+Introduce a local channel variable and validate it before updating the
+arrays. We reject negative indices, limit meter_level[] and
+comp_level[] to SND_US16X08_MAX_CHANNELS, and guard master_level[]
+updates with ARRAY_SIZE(master_level).
+
+Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk")
+Reported-by: DARKNAVY (@DarkNavyOrg) <vr@darknavy.com>
+Closes: https://lore.kernel.org/tencent_21C112743C44C1A2517FF219@qq.com
+Signed-off-by: Shipei Qu <qu@darknavy.com>
+Link: https://patch.msgid.link/20251217024630.59576-1-qu@darknavy.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_us16x08.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/sound/usb/mixer_us16x08.c b/sound/usb/mixer_us16x08.c
+index 1c5712c31f5e..f9df40730eff 100644
+--- a/sound/usb/mixer_us16x08.c
++++ b/sound/usb/mixer_us16x08.c
+@@ -655,17 +655,25 @@ static void get_meter_levels_from_urb(int s,
+ u8 *meter_urb)
+ {
+ int val = MUC2(meter_urb, s) + (MUC3(meter_urb, s) << 8);
++ int ch = MUB2(meter_urb, s) - 1;
++
++ if (ch < 0)
++ return;
+
+ if (MUA0(meter_urb, s) == 0x61 && MUA1(meter_urb, s) == 0x02 &&
+ MUA2(meter_urb, s) == 0x04 && MUB0(meter_urb, s) == 0x62) {
+- if (MUC0(meter_urb, s) == 0x72)
+- store->meter_level[MUB2(meter_urb, s) - 1] = val;
+- if (MUC0(meter_urb, s) == 0xb2)
+- store->comp_level[MUB2(meter_urb, s) - 1] = val;
++ if (ch < SND_US16X08_MAX_CHANNELS) {
++ if (MUC0(meter_urb, s) == 0x72)
++ store->meter_level[ch] = val;
++ if (MUC0(meter_urb, s) == 0xb2)
++ store->comp_level[ch] = val;
++ }
+ }
+ if (MUA0(meter_urb, s) == 0x61 && MUA1(meter_urb, s) == 0x02 &&
+- MUA2(meter_urb, s) == 0x02 && MUB0(meter_urb, s) == 0x62)
+- store->master_level[MUB2(meter_urb, s) - 1] = val;
++ MUA2(meter_urb, s) == 0x02 && MUB0(meter_urb, s) == 0x62) {
++ if (ch < ARRAY_SIZE(store->master_level))
++ store->master_level[ch] = val;
++ }
+ }
+
+ /* Function to retrieve current meter values from the device.
+--
+2.51.0
+
--- /dev/null
+From e8c7452384ab27cd70a9b18089cbc98ff91517d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 12:26:52 +0800
+Subject: ALSA: vxpocket: Fix resource leak in vxpocket_probe error path
+
+From: Haotian Zhang <vulab@iscas.ac.cn>
+
+[ Upstream commit 2a03b40deacbd293ac9aed0f9b11197dad54fe5f ]
+
+When vxpocket_config() fails, vxpocket_probe() returns the error code
+directly without freeing the sound card resources allocated by
+snd_card_new(), which leads to a memory leak.
+
+Add proper error handling to free the sound card and clear the
+allocation bit when vxpocket_config() fails.
+
+Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions")
+Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
+Link: https://patch.msgid.link/20251215042652.695-1-vulab@iscas.ac.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pcmcia/vx/vxpocket.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pcmcia/vx/vxpocket.c b/sound/pcmcia/vx/vxpocket.c
+index 2e09f2a513a6..9a5c9aa8eec4 100644
+--- a/sound/pcmcia/vx/vxpocket.c
++++ b/sound/pcmcia/vx/vxpocket.c
+@@ -284,7 +284,13 @@ static int vxpocket_probe(struct pcmcia_device *p_dev)
+
+ vxp->p_dev = p_dev;
+
+- return vxpocket_config(p_dev);
++ err = vxpocket_config(p_dev);
++ if (err < 0) {
++ card_alloc &= ~(1 << i);
++ snd_card_free(card);
++ return err;
++ }
++ return 0;
+ }
+
+ static void vxpocket_detach(struct pcmcia_device *link)
+--
+2.51.0
+
--- /dev/null
+From 3e07d91f74426033504afacdd76db9cd6ffbc5b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 15:02:01 +0800
+Subject: ASoC: ak4458: remove the reset operation in probe and remove
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 00b960a83c764208b0623089eb70af3685e3906f ]
+
+The reset_control handler has the reference count for usage, as there is
+reset operation in runtime suspend and resume, then reset operation in
+probe() would cause the reference count of reset not balanced.
+
+Previously add reset operation in probe and remove is to fix the compile
+issue with !CONFIG_PM, as the driver has been update to use
+RUNTIME_PM_OPS(), so that change can be reverted.
+
+Fixes: 1e0dff741b0a ("ASoC: ak4458: remove "reset-gpios" property handler")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://patch.msgid.link/20251216070201.358477-1-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/ak4458.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/sound/soc/codecs/ak4458.c b/sound/soc/codecs/ak4458.c
+index a6c04dd3de3e..abe742edb10f 100644
+--- a/sound/soc/codecs/ak4458.c
++++ b/sound/soc/codecs/ak4458.c
+@@ -783,16 +783,12 @@ static int ak4458_i2c_probe(struct i2c_client *i2c)
+
+ pm_runtime_enable(&i2c->dev);
+ regcache_cache_only(ak4458->regmap, true);
+- ak4458_reset(ak4458, false);
+
+ return 0;
+ }
+
+ static void ak4458_i2c_remove(struct i2c_client *i2c)
+ {
+- struct ak4458_priv *ak4458 = i2c_get_clientdata(i2c);
+-
+- ak4458_reset(ak4458, true);
+ pm_runtime_disable(&i2c->dev);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From fad6db078815dbe7aea942ff6a0af5e5306fba88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Dec 2025 15:21:09 +0900
+Subject: ASoC: fsl_sai: Constrain sample rates from audio PLLs only in master
+ mode
+
+From: Chancel Liu <chancel.liu@nxp.com>
+
+[ Upstream commit 9f4d0899efd9892fc7514c9488270e1bb7dedd2b ]
+
+If SAI works in master mode it will generate clocks for external codec
+from audio PLLs. Thus sample rates should be constrained according to
+audio PLL clocks. While SAI works in slave mode which means clocks are
+generated externally then constraints are independent of audio PLLs.
+
+Fixes: 4edc98598be4 ("ASoC: fsl_sai: Add sample rate constraint")
+Signed-off-by: Chancel Liu <chancel.liu@nxp.com>
+Link: https://patch.msgid.link/20251210062109.2577735-1-chancel.liu@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_sai.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c
+index 72bfc91e21b9..86730c214914 100644
+--- a/sound/soc/fsl/fsl_sai.c
++++ b/sound/soc/fsl/fsl_sai.c
+@@ -917,8 +917,14 @@ static int fsl_sai_startup(struct snd_pcm_substream *substream,
+ tx ? sai->dma_params_tx.maxburst :
+ sai->dma_params_rx.maxburst);
+
+- ret = snd_pcm_hw_constraint_list(substream->runtime, 0,
+- SNDRV_PCM_HW_PARAM_RATE, &sai->constraint_rates);
++ if (sai->is_consumer_mode[tx])
++ ret = snd_pcm_hw_constraint_list(substream->runtime, 0,
++ SNDRV_PCM_HW_PARAM_RATE,
++ &fsl_sai_rate_constraints);
++ else
++ ret = snd_pcm_hw_constraint_list(substream->runtime, 0,
++ SNDRV_PCM_HW_PARAM_RATE,
++ &sai->constraint_rates);
+
+ return ret;
+ }
+--
+2.51.0
+
--- /dev/null
+From e4ab11bff0d6f855a6fbc0908a31a5db75e86100 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Dec 2025 13:49:20 +0000
+Subject: ASoC: ops: fix snd_soc_get_volsw for sx controls
+
+From: Stefan Binding <sbinding@opensource.cirrus.com>
+
+[ Upstream commit 095d621141826a2841dae85b52c784c147ea99d3 ]
+
+SX controls are currently broken, since the clamp introduced in
+commit a0ce874cfaaa ("ASoC: ops: improve snd_soc_get_volsw") does not
+handle SX controls, for example where the min value in the clamp is
+greater than the max value in the clamp.
+
+Add clamp parameter to prevent clamping in SX controls.
+The nature of SX controls mean that it wraps around 0, with a variable
+number of bits, therefore clamping the value becomes complicated and
+prone to error.
+
+Fixes 35 kunit tests for soc_ops_test_access.
+
+Fixes: a0ce874cfaaa ("ASoC: ops: improve snd_soc_get_volsw")
+
+Co-developed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com>
+Tested-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://patch.msgid.link/20251216134938.788625-1-sbinding@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-ops.c | 32 ++++++++++++++++++++------------
+ 1 file changed, 20 insertions(+), 12 deletions(-)
+
+diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
+index ce86978c158d..624e9269fc25 100644
+--- a/sound/soc/soc-ops.c
++++ b/sound/soc/soc-ops.c
+@@ -111,7 +111,8 @@ int snd_soc_put_enum_double(struct snd_kcontrol *kcontrol,
+ EXPORT_SYMBOL_GPL(snd_soc_put_enum_double);
+
+ static int sdca_soc_q78_reg_to_ctl(struct soc_mixer_control *mc, unsigned int reg_val,
+- unsigned int mask, unsigned int shift, int max)
++ unsigned int mask, unsigned int shift, int max,
++ bool sx)
+ {
+ int val = reg_val;
+
+@@ -141,20 +142,26 @@ static unsigned int sdca_soc_q78_ctl_to_reg(struct soc_mixer_control *mc, int va
+ }
+
+ static int soc_mixer_reg_to_ctl(struct soc_mixer_control *mc, unsigned int reg_val,
+- unsigned int mask, unsigned int shift, int max)
++ unsigned int mask, unsigned int shift, int max,
++ bool sx)
+ {
+ int val = (reg_val >> shift) & mask;
+
+ if (mc->sign_bit)
+ val = sign_extend32(val, mc->sign_bit);
+
+- val = clamp(val, mc->min, mc->max);
+- val -= mc->min;
++ if (sx) {
++ val -= mc->min; // SX controls intentionally can overflow here
++ val = min_t(unsigned int, val & mask, max);
++ } else {
++ val = clamp(val, mc->min, mc->max);
++ val -= mc->min;
++ }
+
+ if (mc->invert)
+ val = max - val;
+
+- return val & mask;
++ return val;
+ }
+
+ static unsigned int soc_mixer_ctl_to_reg(struct soc_mixer_control *mc, int val,
+@@ -280,9 +287,10 @@ static int soc_put_volsw(struct snd_kcontrol *kcontrol,
+
+ static int soc_get_volsw(struct snd_kcontrol *kcontrol,
+ struct snd_ctl_elem_value *ucontrol,
+- struct soc_mixer_control *mc, int mask, int max)
++ struct soc_mixer_control *mc, int mask, int max, bool sx)
+ {
+- int (*reg_to_ctl)(struct soc_mixer_control *, unsigned int, unsigned int, unsigned int, int);
++ int (*reg_to_ctl)(struct soc_mixer_control *, unsigned int, unsigned int,
++ unsigned int, int, bool);
+ struct snd_soc_component *component = snd_kcontrol_chip(kcontrol);
+ unsigned int reg_val;
+ int val;
+@@ -293,16 +301,16 @@ static int soc_get_volsw(struct snd_kcontrol *kcontrol,
+ reg_to_ctl = soc_mixer_reg_to_ctl;
+
+ reg_val = snd_soc_component_read(component, mc->reg);
+- val = reg_to_ctl(mc, reg_val, mask, mc->shift, max);
++ val = reg_to_ctl(mc, reg_val, mask, mc->shift, max, sx);
+
+ ucontrol->value.integer.value[0] = val;
+
+ if (snd_soc_volsw_is_stereo(mc)) {
+ if (mc->reg == mc->rreg) {
+- val = reg_to_ctl(mc, reg_val, mask, mc->rshift, max);
++ val = reg_to_ctl(mc, reg_val, mask, mc->rshift, max, sx);
+ } else {
+ reg_val = snd_soc_component_read(component, mc->rreg);
+- val = reg_to_ctl(mc, reg_val, mask, mc->shift, max);
++ val = reg_to_ctl(mc, reg_val, mask, mc->shift, max, sx);
+ }
+
+ ucontrol->value.integer.value[1] = val;
+@@ -371,7 +379,7 @@ int snd_soc_get_volsw(struct snd_kcontrol *kcontrol,
+ (struct soc_mixer_control *)kcontrol->private_value;
+ unsigned int mask = soc_mixer_mask(mc);
+
+- return soc_get_volsw(kcontrol, ucontrol, mc, mask, mc->max - mc->min);
++ return soc_get_volsw(kcontrol, ucontrol, mc, mask, mc->max - mc->min, false);
+ }
+ EXPORT_SYMBOL_GPL(snd_soc_get_volsw);
+
+@@ -413,7 +421,7 @@ int snd_soc_get_volsw_sx(struct snd_kcontrol *kcontrol,
+ (struct soc_mixer_control *)kcontrol->private_value;
+ unsigned int mask = soc_mixer_sx_mask(mc);
+
+- return soc_get_volsw(kcontrol, ucontrol, mc, mask, mc->max);
++ return soc_get_volsw(kcontrol, ucontrol, mc, mask, mc->max, true);
+ }
+ EXPORT_SYMBOL_GPL(snd_soc_get_volsw_sx);
+
+--
+2.51.0
+
--- /dev/null
+From 192149320c2ef63d0ecffd51618d4c558ef25ee7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Nov 2025 17:33:35 +0800
+Subject: ASoC: SDCA: support Q7.8 volume format
+
+From: Shuming Fan <shumingf@realtek.com>
+
+[ Upstream commit 1b0f3f9ee41ee2bdd206667f85ea2aa36dfe6e69 ]
+
+The SDCA specification uses Q7.8 volume format.
+This patch adds a field to indicate whether it is SDCA volume control
+and supports the volume settings.
+
+Signed-off-by: Shuming Fan <shumingf@realtek.com>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20251106093335.1363237-1-shumingf@realtek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 095d62114182 ("ASoC: ops: fix snd_soc_get_volsw for sx controls")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/sound/soc.h | 1 +
+ sound/soc/sdca/sdca_asoc.c | 34 ++++++---------------
+ sound/soc/soc-ops.c | 62 +++++++++++++++++++++++++++++++-------
+ 3 files changed, 61 insertions(+), 36 deletions(-)
+
+diff --git a/include/sound/soc.h b/include/sound/soc.h
+index ddc508ff7b9b..a9c058b06ab4 100644
+--- a/include/sound/soc.h
++++ b/include/sound/soc.h
+@@ -1225,6 +1225,7 @@ struct soc_mixer_control {
+ unsigned int sign_bit;
+ unsigned int invert:1;
+ unsigned int autodisable:1;
++ unsigned int sdca_q78:1;
+ #ifdef CONFIG_SND_SOC_TOPOLOGY
+ struct snd_soc_dobj dobj;
+ #endif
+diff --git a/sound/soc/sdca/sdca_asoc.c b/sound/soc/sdca/sdca_asoc.c
+index c493ec530cc5..892b7c028fae 100644
+--- a/sound/soc/sdca/sdca_asoc.c
++++ b/sound/soc/sdca/sdca_asoc.c
+@@ -795,7 +795,6 @@ static int control_limit_kctl(struct device *dev,
+ struct sdca_control_range *range;
+ int min, max, step;
+ unsigned int *tlv;
+- int shift;
+
+ if (control->type != SDCA_CTL_DATATYPE_Q7P8DB)
+ return 0;
+@@ -814,37 +813,22 @@ static int control_limit_kctl(struct device *dev,
+ min = sign_extend32(min, control->nbits - 1);
+ max = sign_extend32(max, control->nbits - 1);
+
+- /*
+- * FIXME: Only support power of 2 step sizes as this can be supported
+- * by a simple shift.
+- */
+- if (hweight32(step) != 1) {
+- dev_err(dev, "%s: %s: currently unsupported step size\n",
+- entity->label, control->label);
+- return -EINVAL;
+- }
+-
+- /*
+- * The SDCA volumes are in steps of 1/256th of a dB, a step down of
+- * 64 (shift of 6) gives 1/4dB. 1/4dB is the smallest unit that is also
+- * representable in the ALSA TLVs which are in 1/100ths of a dB.
+- */
+- shift = max(ffs(step) - 1, 6);
+-
+ tlv = devm_kcalloc(dev, 4, sizeof(*tlv), GFP_KERNEL);
+ if (!tlv)
+ return -ENOMEM;
+
+- tlv[0] = SNDRV_CTL_TLVT_DB_SCALE;
++ tlv[0] = SNDRV_CTL_TLVT_DB_MINMAX;
+ tlv[1] = 2 * sizeof(*tlv);
+ tlv[2] = (min * 100) >> 8;
+- tlv[3] = ((1 << shift) * 100) >> 8;
++ tlv[3] = (max * 100) >> 8;
++
++ step = (step * 100) >> 8;
+
+- mc->min = min >> shift;
+- mc->max = max >> shift;
+- mc->shift = shift;
+- mc->rshift = shift;
+- mc->sign_bit = 15 - shift;
++ mc->min = ((int)tlv[2] / step);
++ mc->max = ((int)tlv[3] / step);
++ mc->shift = step;
++ mc->sign_bit = 15;
++ mc->sdca_q78 = 1;
+
+ kctl->tlv.p = tlv;
+ kctl->access |= SNDRV_CTL_ELEM_ACCESS_TLV_READ;
+diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
+index d2b6fb8e0b6c..ce86978c158d 100644
+--- a/sound/soc/soc-ops.c
++++ b/sound/soc/soc-ops.c
+@@ -110,6 +110,36 @@ int snd_soc_put_enum_double(struct snd_kcontrol *kcontrol,
+ }
+ EXPORT_SYMBOL_GPL(snd_soc_put_enum_double);
+
++static int sdca_soc_q78_reg_to_ctl(struct soc_mixer_control *mc, unsigned int reg_val,
++ unsigned int mask, unsigned int shift, int max)
++{
++ int val = reg_val;
++
++ if (WARN_ON(!mc->shift))
++ return -EINVAL;
++
++ val = sign_extend32(val, mc->sign_bit);
++ val = (((val * 100) >> 8) / (int)mc->shift);
++ val -= mc->min;
++
++ return val & mask;
++}
++
++static unsigned int sdca_soc_q78_ctl_to_reg(struct soc_mixer_control *mc, int val,
++ unsigned int mask, unsigned int shift, int max)
++{
++ unsigned int ret_val;
++ int reg_val;
++
++ if (WARN_ON(!mc->shift))
++ return -EINVAL;
++
++ reg_val = val + mc->min;
++ ret_val = (int)((reg_val * mc->shift) << 8) / 100;
++
++ return ret_val & mask;
++}
++
+ static int soc_mixer_reg_to_ctl(struct soc_mixer_control *mc, unsigned int reg_val,
+ unsigned int mask, unsigned int shift, int max)
+ {
+@@ -197,19 +227,27 @@ static int soc_put_volsw(struct snd_kcontrol *kcontrol,
+ struct snd_ctl_elem_value *ucontrol,
+ struct soc_mixer_control *mc, int mask, int max)
+ {
++ unsigned int (*ctl_to_reg)(struct soc_mixer_control *, int, unsigned int, unsigned int, int);
+ struct snd_soc_component *component = snd_kcontrol_chip(kcontrol);
+ unsigned int val1, val_mask;
+ unsigned int val2 = 0;
+ bool double_r = false;
+ int ret;
+
++ if (mc->sdca_q78) {
++ ctl_to_reg = sdca_soc_q78_ctl_to_reg;
++ val_mask = mask;
++ } else {
++ ctl_to_reg = soc_mixer_ctl_to_reg;
++ val_mask = mask << mc->shift;
++ }
++
+ ret = soc_mixer_valid_ctl(mc, ucontrol->value.integer.value[0], max);
+ if (ret)
+ return ret;
+
+- val1 = soc_mixer_ctl_to_reg(mc, ucontrol->value.integer.value[0],
++ val1 = ctl_to_reg(mc, ucontrol->value.integer.value[0],
+ mask, mc->shift, max);
+- val_mask = mask << mc->shift;
+
+ if (snd_soc_volsw_is_stereo(mc)) {
+ ret = soc_mixer_valid_ctl(mc, ucontrol->value.integer.value[1], max);
+@@ -217,14 +255,10 @@ static int soc_put_volsw(struct snd_kcontrol *kcontrol,
+ return ret;
+
+ if (mc->reg == mc->rreg) {
+- val1 |= soc_mixer_ctl_to_reg(mc,
+- ucontrol->value.integer.value[1],
+- mask, mc->rshift, max);
++ val1 |= ctl_to_reg(mc, ucontrol->value.integer.value[1], mask, mc->rshift, max);
+ val_mask |= mask << mc->rshift;
+ } else {
+- val2 = soc_mixer_ctl_to_reg(mc,
+- ucontrol->value.integer.value[1],
+- mask, mc->shift, max);
++ val2 = ctl_to_reg(mc, ucontrol->value.integer.value[1], mask, mc->shift, max);
+ double_r = true;
+ }
+ }
+@@ -248,21 +282,27 @@ static int soc_get_volsw(struct snd_kcontrol *kcontrol,
+ struct snd_ctl_elem_value *ucontrol,
+ struct soc_mixer_control *mc, int mask, int max)
+ {
++ int (*reg_to_ctl)(struct soc_mixer_control *, unsigned int, unsigned int, unsigned int, int);
+ struct snd_soc_component *component = snd_kcontrol_chip(kcontrol);
+ unsigned int reg_val;
+ int val;
+
++ if (mc->sdca_q78)
++ reg_to_ctl = sdca_soc_q78_reg_to_ctl;
++ else
++ reg_to_ctl = soc_mixer_reg_to_ctl;
++
+ reg_val = snd_soc_component_read(component, mc->reg);
+- val = soc_mixer_reg_to_ctl(mc, reg_val, mask, mc->shift, max);
++ val = reg_to_ctl(mc, reg_val, mask, mc->shift, max);
+
+ ucontrol->value.integer.value[0] = val;
+
+ if (snd_soc_volsw_is_stereo(mc)) {
+ if (mc->reg == mc->rreg) {
+- val = soc_mixer_reg_to_ctl(mc, reg_val, mask, mc->rshift, max);
++ val = reg_to_ctl(mc, reg_val, mask, mc->rshift, max);
+ } else {
+ reg_val = snd_soc_component_read(component, mc->rreg);
+- val = soc_mixer_reg_to_ctl(mc, reg_val, mask, mc->shift, max);
++ val = reg_to_ctl(mc, reg_val, mask, mc->shift, max);
+ }
+
+ ucontrol->value.integer.value[1] = val;
+--
+2.51.0
+
--- /dev/null
+From 77101cf3d34dc7cfa2317cf88c48cd65e48b2b2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 16:16:26 +0100
+Subject: clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &
+ pcie_x4
+
+From: Josua Mayer <josua@solid-run.com>
+
+[ Upstream commit f0e6bc0c3ef4b4afb299bd6912586cafd5d864e9 ]
+
+CP110 based platforms rely on the bootloader for pci port
+initialization.
+TF-A actively prevents non-uboot re-configuration of pci lanes, and many
+boards do not have software control over the pci card reset.
+
+If a pci port had link at boot-time and the clock is stopped at a later
+point, the link fails and can not be recovered.
+
+PCI controller driver probe - and by extension ownership of a driver for
+the pci clocks - may be delayed especially on large modular kernels,
+causing the clock core to start disabling unused clocks.
+
+Add the CLK_IGNORE_UNUSED flag to the three pci port's clocks to ensure
+they are not stopped before the pci controller driver has taken
+ownership and tested for an existing link.
+
+This fixes failed pci link detection when controller driver probes late,
+e.g. with arm64 defconfig and CONFIG_PHY_MVEBU_CP110_COMPHY=m.
+
+Closes: https://lore.kernel.org/r/b71596c7-461b-44b6-89ab-3cfbd492639f@solid-run.com
+Signed-off-by: Josua Mayer <josua@solid-run.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/cp110-system-controller.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/clk/mvebu/cp110-system-controller.c b/drivers/clk/mvebu/cp110-system-controller.c
+index 03c59bf22106..b47c86906046 100644
+--- a/drivers/clk/mvebu/cp110-system-controller.c
++++ b/drivers/clk/mvebu/cp110-system-controller.c
+@@ -110,6 +110,25 @@ static const char * const gate_base_names[] = {
+ [CP110_GATE_EIP197] = "eip197"
+ };
+
++static unsigned long gate_flags(const u8 bit_idx)
++{
++ switch (bit_idx) {
++ case CP110_GATE_PCIE_X1_0:
++ case CP110_GATE_PCIE_X1_1:
++ case CP110_GATE_PCIE_X4:
++ /*
++ * If a port had an active link at boot time, stopping
++ * the clock creates a failed state from which controller
++ * driver can not recover.
++ * Prevent stopping this clock till after a driver has taken
++ * ownership.
++ */
++ return CLK_IGNORE_UNUSED;
++ default:
++ return 0;
++ }
++};
++
+ struct cp110_gate_clk {
+ struct clk_hw hw;
+ struct regmap *regmap;
+@@ -171,6 +190,7 @@ static struct clk_hw *cp110_register_gate(const char *name,
+ init.ops = &cp110_gate_ops;
+ init.parent_names = &parent_name;
+ init.num_parents = 1;
++ init.flags = gate_flags(bit_idx);
+
+ gate->regmap = regmap;
+ gate->bit_idx = bit_idx;
+--
+2.51.0
+
--- /dev/null
+From a7105597e0bdb68e2af07f36627502b964fec45e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 14:34:32 +0200
+Subject: clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk0_clk_src
+
+From: Jens Reidel <adrian@mainlining.org>
+
+[ Upstream commit e3c13e0caa8ceb7dec1a7c4fcfd9dbef56a69fbe ]
+
+Set CLK_OPS_PARENT_ENABLE to ensure the parent gets prepared and enabled
+when switching to it, fixing an "rcg didn't update its configuration"
+warning.
+
+Signed-off-by: Jens Reidel <adrian@mainlining.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250919-sm7150-dispcc-fixes-v1-3-308ad47c5fce@mainlining.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/dispcc-sm7150.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/dispcc-sm7150.c b/drivers/clk/qcom/dispcc-sm7150.c
+index bdfff246ed3f..ddc7230b8aea 100644
+--- a/drivers/clk/qcom/dispcc-sm7150.c
++++ b/drivers/clk/qcom/dispcc-sm7150.c
+@@ -356,7 +356,7 @@ static struct clk_rcg2 dispcc_mdss_pclk0_clk_src = {
+ .name = "dispcc_mdss_pclk0_clk_src",
+ .parent_data = dispcc_parent_data_4,
+ .num_parents = ARRAY_SIZE(dispcc_parent_data_4),
+- .flags = CLK_SET_RATE_PARENT,
++ .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE,
+ .ops = &clk_pixel_ops,
+ },
+ };
+--
+2.51.0
+
--- /dev/null
+From 1aa377ec85460a454f58b44984d1487e25fbb0c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 17:51:10 +0800
+Subject: exfat: fix remount failure in different process environments
+
+From: Yuezhang Mo <Yuezhang.Mo@sony.com>
+
+[ Upstream commit 51fc7b4ce10ccab8ea5e4876bcdc42cf5202a0ef ]
+
+The kernel test robot reported that the exFAT remount operation
+failed. The reason for the failure was that the process's umask
+is different between mount and remount, causing fs_fmask and
+fs_dmask are changed.
+
+Potentially, both gid and uid may also be changed. Therefore, when
+initializing fs_context for remount, inherit these mount options
+from the options used during mount.
+
+Reported-by: kernel test robot <oliver.sang@intel.com>
+Closes: https://lore.kernel.org/oe-lkp/202511251637.81670f5c-lkp@intel.com
+Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exfat/super.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/fs/exfat/super.c b/fs/exfat/super.c
+index 74d451f732c7..581754001128 100644
+--- a/fs/exfat/super.c
++++ b/fs/exfat/super.c
+@@ -813,10 +813,21 @@ static int exfat_init_fs_context(struct fs_context *fc)
+ ratelimit_state_init(&sbi->ratelimit, DEFAULT_RATELIMIT_INTERVAL,
+ DEFAULT_RATELIMIT_BURST);
+
+- sbi->options.fs_uid = current_uid();
+- sbi->options.fs_gid = current_gid();
+- sbi->options.fs_fmask = current->fs->umask;
+- sbi->options.fs_dmask = current->fs->umask;
++ if (fc->purpose == FS_CONTEXT_FOR_RECONFIGURE && fc->root) {
++ struct super_block *sb = fc->root->d_sb;
++ struct exfat_mount_options *cur_opts = &EXFAT_SB(sb)->options;
++
++ sbi->options.fs_uid = cur_opts->fs_uid;
++ sbi->options.fs_gid = cur_opts->fs_gid;
++ sbi->options.fs_fmask = cur_opts->fs_fmask;
++ sbi->options.fs_dmask = cur_opts->fs_dmask;
++ } else {
++ sbi->options.fs_uid = current_uid();
++ sbi->options.fs_gid = current_gid();
++ sbi->options.fs_fmask = current->fs->umask;
++ sbi->options.fs_dmask = current->fs->umask;
++ }
++
+ sbi->options.allow_utime = -1;
+ sbi->options.errors = EXFAT_ERRORS_RO;
+ exfat_set_iocharset(&sbi->options, exfat_default_iocharset);
+--
+2.51.0
+
--- /dev/null
+From f15f34ce4687cd02668b26102b15a44a763011ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Oct 2025 17:03:41 +0800
+Subject: exfat: zero out post-EOF page cache on file extension
+
+From: Yuezhang Mo <Yuezhang.Mo@sony.com>
+
+[ Upstream commit 4e163c39dd4e70fcdce948b8774d96e0482b4a11 ]
+
+xfstests generic/363 was failing due to unzeroed post-EOF page
+cache that allowed mmap writes beyond EOF to become visible
+after file extension.
+
+For example, in following xfs_io sequence, 0x22 should not be
+written to the file but would become visible after the extension:
+
+ xfs_io -f -t -c "pwrite -S 0x11 0 8" \
+ -c "mmap 0 4096" \
+ -c "mwrite -S 0x22 32 32" \
+ -c "munmap" \
+ -c "pwrite -S 0x33 512 32" \
+ $testfile
+
+This violates the expected behavior where writes beyond EOF via
+mmap should not persist after the file is extended. Instead, the
+extended region should contain zeros.
+
+Fix this by using truncate_pagecache() to truncate the page cache
+after the current EOF when extending the file.
+
+Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exfat/file.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/exfat/file.c b/fs/exfat/file.c
+index adc37b4d7fc2..536c8078f0c1 100644
+--- a/fs/exfat/file.c
++++ b/fs/exfat/file.c
+@@ -25,6 +25,8 @@ static int exfat_cont_expand(struct inode *inode, loff_t size)
+ struct exfat_sb_info *sbi = EXFAT_SB(sb);
+ struct exfat_chain clu;
+
++ truncate_pagecache(inode, i_size_read(inode));
++
+ ret = inode_newsize_ok(inode, size);
+ if (ret)
+ return ret;
+@@ -639,6 +641,9 @@ static ssize_t exfat_file_write_iter(struct kiocb *iocb, struct iov_iter *iter)
+
+ inode_lock(inode);
+
++ if (pos > i_size_read(inode))
++ truncate_pagecache(inode, i_size_read(inode));
++
+ valid_size = ei->valid_size;
+
+ ret = generic_write_checks(iocb, iter);
+--
+2.51.0
+
--- /dev/null
+From fb3f685982a800468d43edabb4486bef35d6e6cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Oct 2025 09:56:26 +0800
+Subject: firmware: imx: scu-irq: Init workqueue before request mbox channel
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit 81fb53feb66a3aefbf6fcab73bb8d06f5b0c54ad ]
+
+With mailbox channel requested, there is possibility that interrupts may
+come in, so need to make sure the workqueue is initialized before
+the queue is scheduled by mailbox rx callback.
+
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/imx/imx-scu-irq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/imx/imx-scu-irq.c b/drivers/firmware/imx/imx-scu-irq.c
+index f2b902e95b73..b9f6128d56f7 100644
+--- a/drivers/firmware/imx/imx-scu-irq.c
++++ b/drivers/firmware/imx/imx-scu-irq.c
+@@ -214,6 +214,8 @@ int imx_scu_enable_general_irq_channel(struct device *dev)
+ cl->dev = dev;
+ cl->rx_callback = imx_scu_irq_callback;
+
++ INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler);
++
+ /* SCU general IRQ uses general interrupt channel 3 */
+ ch = mbox_request_channel_byname(cl, "gip3");
+ if (IS_ERR(ch)) {
+@@ -223,8 +225,6 @@ int imx_scu_enable_general_irq_channel(struct device *dev)
+ return ret;
+ }
+
+- INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler);
+-
+ if (!of_parse_phandle_with_args(dev->of_node, "mboxes",
+ "#mbox-cells", 0, &spec)) {
+ i = of_alias_get_id(spec.np, "mu");
+--
+2.51.0
+
--- /dev/null
+From b6daec599af2fccb451702345162ebb2033eb5b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Nov 2025 02:18:22 -0500
+Subject: functionfs: fix the open/removal races
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit e5bf5ee266633cb18fff6f98f0b7d59a62819eee ]
+
+ffs_epfile_open() can race with removal, ending up with file->private_data
+pointing to freed object.
+
+There is a total count of opened files on functionfs (both ep0 and
+dynamic ones) and when it hits zero, dynamic files get removed.
+Unfortunately, that removal can happen while another thread is
+in ffs_epfile_open(), but has not incremented the count yet.
+In that case open will succeed, leaving us with UAF on any subsequent
+read() or write().
+
+The root cause is that ffs->opened is misused; atomic_dec_and_test() vs.
+atomic_add_return() is not a good idea, when object remains visible all
+along.
+
+To untangle that
+ * serialize openers on ffs->mutex (both for ep0 and for dynamic files)
+ * have dynamic ones use atomic_inc_not_zero() and fail if we had
+zero ->opened; in that case the file we are opening is doomed.
+ * have the inodes of dynamic files marked on removal (from the
+callback of simple_recursive_removal()) - clear ->i_private there.
+ * have open of dynamic ones verify they hadn't been already removed,
+along with checking that state is FFS_ACTIVE.
+
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_fs.c | 53 ++++++++++++++++++++++++------
+ 1 file changed, 43 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 47cfbe41fdff..69f6e3c0f7e0 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -640,13 +640,22 @@ static ssize_t ffs_ep0_read(struct file *file, char __user *buf,
+
+ static int ffs_ep0_open(struct inode *inode, struct file *file)
+ {
+- struct ffs_data *ffs = inode->i_private;
++ struct ffs_data *ffs = inode->i_sb->s_fs_info;
++ int ret;
+
+- if (ffs->state == FFS_CLOSING)
+- return -EBUSY;
++ /* Acquire mutex */
++ ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
++ if (ret < 0)
++ return ret;
+
+- file->private_data = ffs;
+ ffs_data_opened(ffs);
++ if (ffs->state == FFS_CLOSING) {
++ ffs_data_closed(ffs);
++ mutex_unlock(&ffs->mutex);
++ return -EBUSY;
++ }
++ mutex_unlock(&ffs->mutex);
++ file->private_data = ffs;
+
+ return stream_open(inode, file);
+ }
+@@ -1193,14 +1202,33 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
+ static int
+ ffs_epfile_open(struct inode *inode, struct file *file)
+ {
+- struct ffs_epfile *epfile = inode->i_private;
++ struct ffs_data *ffs = inode->i_sb->s_fs_info;
++ struct ffs_epfile *epfile;
++ int ret;
+
+- if (WARN_ON(epfile->ffs->state != FFS_ACTIVE))
++ /* Acquire mutex */
++ ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
++ if (ret < 0)
++ return ret;
++
++ if (!atomic_inc_not_zero(&ffs->opened)) {
++ mutex_unlock(&ffs->mutex);
++ return -ENODEV;
++ }
++ /*
++ * we want the state to be FFS_ACTIVE; FFS_ACTIVE alone is
++ * not enough, though - we might have been through FFS_CLOSING
++ * and back to FFS_ACTIVE, with our file already removed.
++ */
++ epfile = smp_load_acquire(&inode->i_private);
++ if (unlikely(ffs->state != FFS_ACTIVE || !epfile)) {
++ mutex_unlock(&ffs->mutex);
++ ffs_data_closed(ffs);
+ return -ENODEV;
++ }
++ mutex_unlock(&ffs->mutex);
+
+ file->private_data = epfile;
+- ffs_data_opened(epfile->ffs);
+-
+ return stream_open(inode, file);
+ }
+
+@@ -1332,7 +1360,7 @@ static void ffs_dmabuf_put(struct dma_buf_attachment *attach)
+ static int
+ ffs_epfile_release(struct inode *inode, struct file *file)
+ {
+- struct ffs_epfile *epfile = inode->i_private;
++ struct ffs_epfile *epfile = file->private_data;
+ struct ffs_dmabuf_priv *priv, *tmp;
+ struct ffs_data *ffs = epfile->ffs;
+
+@@ -2352,6 +2380,11 @@ static int ffs_epfiles_create(struct ffs_data *ffs)
+ return 0;
+ }
+
++static void clear_one(struct dentry *dentry)
++{
++ smp_store_release(&dentry->d_inode->i_private, NULL);
++}
++
+ static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count)
+ {
+ struct ffs_epfile *epfile = epfiles;
+@@ -2359,7 +2392,7 @@ static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count)
+ for (; count; --count, ++epfile) {
+ BUG_ON(mutex_is_locked(&epfile->mutex));
+ if (epfile->dentry) {
+- simple_recursive_removal(epfile->dentry, NULL);
++ simple_recursive_removal(epfile->dentry, clear_one);
+ epfile->dentry = NULL;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From f5e92a2cb7b894d86921049eaa3d8fe4c375fb9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Oct 2025 00:21:18 +0200
+Subject: fuse: Always flush the page cache before FOPEN_DIRECT_IO write
+
+From: Bernd Schubert <bschubert@ddn.com>
+
+[ Upstream commit 1ce120dcefc056ce8af2486cebbb77a458aad4c3 ]
+
+This was done as condition on direct_io_allow_mmap, but I believe
+this is not right, as a file might be open two times - once with
+write-back enabled another time with FOPEN_DIRECT_IO.
+
+Signed-off-by: Bernd Schubert <bschubert@ddn.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fuse/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index f1ef77a0be05..c5c82b380791 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -1607,7 +1607,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter,
+ if (!ia)
+ return -ENOMEM;
+
+- if (fopen_direct_io && fc->direct_io_allow_mmap) {
++ if (fopen_direct_io) {
+ res = filemap_write_and_wait_range(mapping, pos, pos + count - 1);
+ if (res) {
+ fuse_io_free(ia);
+--
+2.51.0
+
--- /dev/null
+From 40270b9231a715f9d5a0fd2a9931ec43ee5c6534 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Oct 2025 00:21:17 +0200
+Subject: fuse: Invalidate the page cache after FOPEN_DIRECT_IO write
+
+From: Bernd Schubert <bschubert@ddn.com>
+
+[ Upstream commit b359af8275a982a458e8df6c6beab1415be1f795 ]
+
+generic_file_direct_write() also does this and has a large
+comment about.
+
+Reproducer here is xfstest's generic/209, which is exactly to
+have competing DIO write and cached IO read.
+
+Signed-off-by: Bernd Schubert <bschubert@ddn.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fuse/file.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index c5c82b380791..bb4ecfd469a5 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -1681,6 +1681,15 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter,
+ if (res > 0)
+ *ppos = pos;
+
++ if (res > 0 && write && fopen_direct_io) {
++ /*
++ * As in generic_file_direct_write(), invalidate after the
++ * write, to invalidate read-ahead cache that may have competed
++ * with the write.
++ */
++ invalidate_inode_pages2_range(mapping, idx_from, idx_to);
++ }
++
+ return res > 0 ? res : err;
+ }
+ EXPORT_SYMBOL_GPL(fuse_direct_io);
+--
+2.51.0
+
--- /dev/null
+From 5e180a8f19c94e5750e1b8145b6d0a4712cfdf11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 11:15:13 +0800
+Subject: hwmon: (emc2305) fix device node refcount leak in error path
+
+From: Pei Xiao <xiaopei01@kylinos.cn>
+
+[ Upstream commit 4910da6b36b122db50a27fabf6ab7f8611b60bf8 ]
+
+The for_each_child_of_node() macro automatically manages device node
+reference counts during normal iteration. However, when breaking out
+of the loop early with return, the current iteration's node is not
+automatically released, leading to a reference count leak.
+
+Fix this by adding of_node_put(child) before returning from the loop
+when emc2305_set_single_tz() fails.
+
+This issue could lead to memory leaks over multiple probe cycles.
+
+Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
+Link: https://lore.kernel.org/r/tencent_5CDC08544C901D5ECA270573D5AEE3117108@qq.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/emc2305.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/emc2305.c b/drivers/hwmon/emc2305.c
+index 60809289f816..84cb9b72cb6c 100644
+--- a/drivers/hwmon/emc2305.c
++++ b/drivers/hwmon/emc2305.c
+@@ -685,8 +685,10 @@ static int emc2305_probe(struct i2c_client *client)
+ i = 0;
+ for_each_child_of_node(dev->of_node, child) {
+ ret = emc2305_set_single_tz(dev, child, i);
+- if (ret != 0)
++ if (ret != 0) {
++ of_node_put(child);
+ return ret;
++ }
+ i++;
+ }
+ } else {
+--
+2.51.0
+
--- /dev/null
+From dbeb9d4698fe445f4039354040915ae7ef127c63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 10:02:41 +0800
+Subject: hwmon: (emc2305) fix double put in emc2305_probe_childs_from_dt
+
+From: Pei Xiao <xiaopei01@kylinos.cn>
+
+[ Upstream commit 541dfb49dcb80c2509e030842de77adfb77820f5 ]
+
+./drivers/hwmon/emc2305.c:597:4-15: ERROR: probable double put
+
+Device node iterators put the previous value of the index variable, so an
+explicit put causes a double put.
+
+Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
+Link: https://lore.kernel.org/r/tencent_CD373F952BE48697C949E39CB5EB77841D06@qq.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/emc2305.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/emc2305.c b/drivers/hwmon/emc2305.c
+index 84cb9b72cb6c..ceae96c07ac4 100644
+--- a/drivers/hwmon/emc2305.c
++++ b/drivers/hwmon/emc2305.c
+@@ -593,10 +593,8 @@ static int emc2305_probe_childs_from_dt(struct device *dev)
+ for_each_child_of_node(dev->of_node, child) {
+ if (of_property_present(child, "reg")) {
+ ret = emc2305_of_parse_pwm_child(dev, child, data);
+- if (ret) {
+- of_node_put(child);
++ if (ret)
+ continue;
+- }
+ count++;
+ }
+ }
+--
+2.51.0
+
--- /dev/null
+From 4c51fe21250e0b50ff4ee0c2f4ce92629c462175 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Oct 2025 15:57:14 +0800
+Subject: i2c: designware: Disable SMBus interrupts to prevent storms from
+ mis-configured firmware
+
+From: Jinhui Guo <guojinhui.liam@bytedance.com>
+
+[ Upstream commit d3429178ee51dd7155445d15a5ab87a45fae3c73 ]
+
+When probing the I2C master, disable SMBus interrupts to prevent
+storms caused by broken firmware mis-configuring IC_SMBUS=1; the
+handler never services them and a mis-configured SMBUS Master
+extend-clock timeout or SMBUS Slave extend-clock timeout can
+flood the CPU.
+
+Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Link: https://lore.kernel.org/r/20251021075714.3712-2-guojinhui.liam@bytedance.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-designware-core.h | 1 +
+ drivers/i2c/busses/i2c-designware-master.c | 7 +++++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h
+index 347843b4f5dd..436555543c79 100644
+--- a/drivers/i2c/busses/i2c-designware-core.h
++++ b/drivers/i2c/busses/i2c-designware-core.h
+@@ -78,6 +78,7 @@
+ #define DW_IC_TX_ABRT_SOURCE 0x80
+ #define DW_IC_ENABLE_STATUS 0x9c
+ #define DW_IC_CLR_RESTART_DET 0xa8
++#define DW_IC_SMBUS_INTR_MASK 0xcc
+ #define DW_IC_COMP_PARAM_1 0xf4
+ #define DW_IC_COMP_VERSION 0xf8
+ #define DW_IC_SDA_HOLD_MIN_VERS 0x3131312A /* "111*" == v1.11* */
+diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c
+index 41e9b5ecad20..45bfca05bb30 100644
+--- a/drivers/i2c/busses/i2c-designware-master.c
++++ b/drivers/i2c/busses/i2c-designware-master.c
+@@ -220,6 +220,13 @@ static int i2c_dw_init_master(struct dw_i2c_dev *dev)
+ /* Disable the adapter */
+ __i2c_dw_disable(dev);
+
++ /*
++ * Mask SMBus interrupts to block storms from broken
++ * firmware that leaves IC_SMBUS=1; the handler never
++ * services them.
++ */
++ regmap_write(dev->map, DW_IC_SMBUS_INTR_MASK, 0);
++
+ /* Write standard speed timing parameters */
+ regmap_write(dev->map, DW_IC_SS_SCL_HCNT, dev->ss_hcnt);
+ regmap_write(dev->map, DW_IC_SS_SCL_LCNT, dev->ss_lcnt);
+--
+2.51.0
+
--- /dev/null
+From 22cbbf8d8ef3e1c08e93cc985b62b277e00b2618 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 17:12:50 +0800
+Subject: iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc
+ complains
+
+From: Pei Xiao <xiaopei01@kylinos.cn>
+
+[ Upstream commit c9fb952360d0c78bbe98239bd6b702f05c2dbb31 ]
+
+FIELD_PREP() checks that a value fits into the available bitfield, add a
+check for step_avg to fix gcc complains.
+
+which gcc complains about:
+ drivers/iio/adc/ti_am335x_adc.c: In function 'tiadc_step_config':
+ include/linux/compiler_types.h:572:38: error: call to
+'__compiletime_assert_491' declared with attribute error: FIELD_PREP: value
+too large for the field include/linux/mfd/ti_am335x_tscadc.h:58:29: note:
+in expansion of macro 'FIELD_PREP'
+ #define STEPCONFIG_AVG(val) FIELD_PREP(GENMASK(4, 2), (val))
+ ^~~~~~~~~~
+drivers/iio/adc/ti_am335x_adc.c:127:17: note: in expansion of macro 'STEPCONFIG_AVG'
+ stepconfig = STEPCONFIG_AVG(ffs(adc_dev->step_avg[i]) - 1)
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202510102117.Jqxrw1vF-lkp@intel.com/
+Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/ti_am335x_adc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
+index 99f274adc870..a1a28584de93 100644
+--- a/drivers/iio/adc/ti_am335x_adc.c
++++ b/drivers/iio/adc/ti_am335x_adc.c
+@@ -123,7 +123,7 @@ static void tiadc_step_config(struct iio_dev *indio_dev)
+
+ chan = adc_dev->channel_line[i];
+
+- if (adc_dev->step_avg[i])
++ if (adc_dev->step_avg[i] && adc_dev->step_avg[i] <= STEPCONFIG_AVG_16)
+ stepconfig = STEPCONFIG_AVG(ffs(adc_dev->step_avg[i]) - 1) |
+ STEPCONFIG_FIFO1;
+ else
+--
+2.51.0
+
--- /dev/null
+From 3074718f41bce2743710b41f7c0068d175c7c1d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 15:42:38 +0800
+Subject: ipmi: Fix __scan_channels() failing to rescan channels
+
+From: Jinhui Guo <guojinhui.liam@bytedance.com>
+
+[ Upstream commit 6bd30d8fc523fb880b4be548e8501bc0fe8f42d4 ]
+
+channel_handler() sets intf->channels_ready to true but never
+clears it, so __scan_channels() skips any rescan. When the BMC
+firmware changes a rescan is required. Allow it by clearing
+the flag before starting a new scan.
+
+Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
+Message-ID: <20250930074239.2353-3-guojinhui.liam@bytedance.com>
+Signed-off-by: Corey Minyard <corey@minyard.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_msghandler.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index d3f84deee451..0a886399f9da 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -599,7 +599,8 @@ static void __ipmi_bmc_unregister(struct ipmi_smi *intf);
+ static int __ipmi_bmc_register(struct ipmi_smi *intf,
+ struct ipmi_device_id *id,
+ bool guid_set, guid_t *guid, int intf_num);
+-static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id);
++static int __scan_channels(struct ipmi_smi *intf,
++ struct ipmi_device_id *id, bool rescan);
+
+ static void free_ipmi_user(struct kref *ref)
+ {
+@@ -2668,7 +2669,7 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc,
+ if (__ipmi_bmc_register(intf, &id, guid_set, &guid, intf_num))
+ need_waiter(intf); /* Retry later on an error. */
+ else
+- __scan_channels(intf, &id);
++ __scan_channels(intf, &id, false);
+
+
+ if (!intf_set) {
+@@ -2688,7 +2689,7 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc,
+ goto out_noprocessing;
+ } else if (memcmp(&bmc->fetch_id, &bmc->id, sizeof(bmc->id)))
+ /* Version info changes, scan the channels again. */
+- __scan_channels(intf, &bmc->fetch_id);
++ __scan_channels(intf, &bmc->fetch_id, true);
+
+ bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY;
+
+@@ -3438,10 +3439,17 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)
+ /*
+ * Must be holding intf->bmc_reg_mutex to call this.
+ */
+-static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id)
++static int __scan_channels(struct ipmi_smi *intf,
++ struct ipmi_device_id *id,
++ bool rescan)
+ {
+ int rv;
+
++ if (rescan) {
++ /* Clear channels_ready to force channels rescan. */
++ intf->channels_ready = false;
++ }
++
+ if (ipmi_version_major(id) > 1
+ || (ipmi_version_major(id) == 1
+ && ipmi_version_minor(id) >= 5)) {
+@@ -3656,7 +3664,7 @@ int ipmi_add_smi(struct module *owner,
+ }
+
+ mutex_lock(&intf->bmc_reg_mutex);
+- rv = __scan_channels(intf, &id);
++ rv = __scan_channels(intf, &id, false);
+ mutex_unlock(&intf->bmc_reg_mutex);
+ if (rv)
+ goto out_err_bmc_reg;
+--
+2.51.0
+
--- /dev/null
+From 9b8413d41077b4b752c6633d628eb8955846cc39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 15:42:37 +0800
+Subject: ipmi: Fix the race between __scan_channels() and deliver_response()
+
+From: Jinhui Guo <guojinhui.liam@bytedance.com>
+
+[ Upstream commit 936750fdba4c45e13bbd17f261bb140dd55f5e93 ]
+
+The race window between __scan_channels() and deliver_response() causes
+the parameters of some channels to be set to 0.
+
+1.[CPUA] __scan_channels() issues an IPMI request and waits with
+ wait_event() until all channels have been scanned.
+ wait_event() internally calls might_sleep(), which might
+ yield the CPU. (Moreover, an interrupt can preempt
+ wait_event() and force the task to yield the CPU.)
+2.[CPUB] deliver_response() is invoked when the CPU receives the
+ IPMI response. After processing a IPMI response,
+ deliver_response() directly assigns intf->wchannels to
+ intf->channel_list and sets intf->channels_ready to true.
+ However, not all channels are actually ready for use.
+3.[CPUA] Since intf->channels_ready is already true, wait_event()
+ never enters __wait_event(). __scan_channels() immediately
+ clears intf->null_user_handler and exits.
+4.[CPUB] Once intf->null_user_handler is set to NULL, deliver_response()
+ ignores further IPMI responses, leaving the remaining
+ channels zero-initialized and unusable.
+
+CPUA CPUB
+------------------------------- -----------------------------
+__scan_channels()
+ intf->null_user_handler
+ = channel_handler;
+ send_channel_info_cmd(intf,
+ 0);
+ wait_event(intf->waitq,
+ intf->channels_ready);
+ do {
+ might_sleep();
+ deliver_response()
+ channel_handler()
+ intf->channel_list =
+ intf->wchannels + set;
+ intf->channels_ready = true;
+ send_channel_info_cmd(intf,
+ intf->curr_channel);
+ if (condition)
+ break;
+ __wait_event(wq_head,
+ condition);
+ } while(0)
+ intf->null_user_handler
+ = NULL;
+ deliver_response()
+ if (!msg->user)
+ if (intf->null_user_handler)
+ rv = -EINVAL;
+ return rv;
+------------------------------- -----------------------------
+
+Fix the race between __scan_channels() and deliver_response() by
+deferring both the assignment intf->channel_list = intf->wchannels
+and the flag intf->channels_ready = true until all channels have
+been successfully scanned or until the IPMI request has failed.
+
+Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
+Message-ID: <20250930074239.2353-2-guojinhui.liam@bytedance.com>
+Signed-off-by: Corey Minyard <corey@minyard.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_msghandler.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index 3700ab4eba3e..d3f84deee451 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -3417,8 +3417,6 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)
+ intf->channels_ready = true;
+ wake_up(&intf->waitq);
+ } else {
+- intf->channel_list = intf->wchannels + set;
+- intf->channels_ready = true;
+ rv = send_channel_info_cmd(intf, intf->curr_channel);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From c6d02c36ff2db753b30fba7d31fa4ef1257e71e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Dec 2025 13:47:01 -0800
+Subject: libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit a0a4173631bfcfd3520192c0a61cf911d6a52c3a ]
+
+Passing an empty map to perf_cpu_map__max triggered a SEGV. Explicitly
+test for the empty map.
+
+Reported-by: Ingo Molnar <mingo@kernel.org>
+Closes: https://lore.kernel.org/linux-perf-users/aSwt7yzFjVJCEmVp@gmail.com/
+Tested-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Tested-by: Thomas Richter <tmricht@linux.ibm.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/perf/cpumap.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/tools/lib/perf/cpumap.c b/tools/lib/perf/cpumap.c
+index b20a5280f2b3..2bbbe1c782b8 100644
+--- a/tools/lib/perf/cpumap.c
++++ b/tools/lib/perf/cpumap.c
+@@ -368,10 +368,12 @@ struct perf_cpu perf_cpu_map__max(const struct perf_cpu_map *map)
+ .cpu = -1
+ };
+
+- // cpu_map__trim_new() qsort()s it, cpu_map__default_new() sorts it as well.
+- return __perf_cpu_map__nr(map) > 0
+- ? __perf_cpu_map__cpu(map, __perf_cpu_map__nr(map) - 1)
+- : result;
++ if (!map)
++ return result;
++
++ // The CPUs are always sorted and nr is always > 0 as 0 length map is
++ // encoded as NULL.
++ return __perf_cpu_map__cpu(map, __perf_cpu_map__nr(map) - 1);
+ }
+
+ /** Is 'b' a subset of 'a'. */
+--
+2.51.0
+
--- /dev/null
+From e479f09f217e3219a0662b05d6324b2d15addcee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 09:30:06 +0100
+Subject: MIPS: ftrace: Fix memory corruption when kernel is located beyond 32
+ bits
+
+From: Gregory CLEMENT <gregory.clement@bootlin.com>
+
+[ Upstream commit 36dac9a3dda1f2bae343191bc16b910c603cac25 ]
+
+Since commit e424054000878 ("MIPS: Tracing: Reduce the overhead of
+dynamic Function Tracer"), the macro UASM_i_LA_mostly has been used,
+and this macro can generate more than 2 instructions. At the same
+time, the code in ftrace assumes that no more than 2 instructions can
+be generated, which is why it stores them in an int[2] array. However,
+as previously noted, the macro UASM_i_LA_mostly (and now UASM_i_LA)
+causes a buffer overflow when _mcount is beyond 32 bits. This leads to
+corruption of the variables located in the __read_mostly section.
+
+This corruption was observed because the variable
+__cpu_primary_thread_mask was corrupted, causing a hang very early
+during boot.
+
+This fix prevents the corruption by avoiding the generation of
+instructions if they could exceed 2 instructions in
+length. Fortunately, insn_la_mcount is only used if the instrumented
+code is located outside the kernel code section, so dynamic ftrace can
+still be used, albeit in a more limited scope. This is still
+preferable to corrupting memory and/or crashing the kernel.
+
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/kernel/ftrace.c | 25 +++++++++++++++++++++----
+ 1 file changed, 21 insertions(+), 4 deletions(-)
+
+diff --git a/arch/mips/kernel/ftrace.c b/arch/mips/kernel/ftrace.c
+index f39e85fd58fa..b15615b28569 100644
+--- a/arch/mips/kernel/ftrace.c
++++ b/arch/mips/kernel/ftrace.c
+@@ -54,10 +54,20 @@ static inline void ftrace_dyn_arch_init_insns(void)
+ u32 *buf;
+ unsigned int v1;
+
+- /* la v1, _mcount */
+- v1 = 3;
+- buf = (u32 *)&insn_la_mcount[0];
+- UASM_i_LA(&buf, v1, MCOUNT_ADDR);
++ /* If we are not in compat space, the number of generated
++ * instructions will exceed the maximum expected limit of 2.
++ * To prevent buffer overflow, we avoid generating them.
++ * insn_la_mcount will not be used later in ftrace_make_call.
++ */
++ if (uasm_in_compat_space_p(MCOUNT_ADDR)) {
++ /* la v1, _mcount */
++ v1 = 3;
++ buf = (u32 *)&insn_la_mcount[0];
++ UASM_i_LA(&buf, v1, MCOUNT_ADDR);
++ } else {
++ pr_warn("ftrace: mcount address beyond 32 bits is not supported (%lX)\n",
++ MCOUNT_ADDR);
++ }
+
+ /* jal (ftrace_caller + 8), jump over the first two instruction */
+ buf = (u32 *)&insn_jal_ftrace_caller;
+@@ -189,6 +199,13 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
+ unsigned int new;
+ unsigned long ip = rec->ip;
+
++ /* When the code to patch does not belong to the kernel code
++ * space, we must use insn_la_mcount. However, if MCOUNT_ADDR
++ * is not in compat space, insn_la_mcount is not usable.
++ */
++ if (!core_kernel_text(ip) && !uasm_in_compat_space_p(MCOUNT_ADDR))
++ return -EFAULT;
++
+ new = core_kernel_text(ip) ? insn_jal_ftrace_caller : insn_la_mcount[0];
+
+ #ifdef CONFIG_64BIT
+--
+2.51.0
+
--- /dev/null
+From 75b879c3aeafd55bbcc1ca6c1f9024ea80e01bb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 17:41:21 +0530
+Subject: nfsd: fix memory leak in nfsd_create_serv error paths
+
+From: Shardul Bankar <shardul.b@mpiricsoftware.com>
+
+[ Upstream commit df8d829bba3adcf3cc744c01d933b6fd7cf06e91 ]
+
+When nfsd_create_serv() calls percpu_ref_init() to initialize
+nn->nfsd_net_ref, it allocates both a percpu reference counter
+and a percpu_ref_data structure (64 bytes). However, if the
+function fails later due to svc_create_pooled() returning NULL
+or svc_bind() returning an error, these allocations are not
+cleaned up, resulting in a memory leak.
+
+The leak manifests as:
+- Unreferenced percpu allocation (8 bytes per CPU)
+- Unreferenced percpu_ref_data structure (64 bytes)
+
+Fix this by adding percpu_ref_exit() calls in both error paths
+to properly clean up the percpu_ref_init() allocations.
+
+This patch fixes the percpu_ref leak in nfsd_create_serv() seen
+as an auxiliary leak in syzbot report 099461f8558eb0a1f4f3; the
+prepare_creds() and vsock-related leaks in the same report
+remain to be addressed separately.
+
+Reported-by: syzbot+099461f8558eb0a1f4f3@syzkaller.appspotmail.com
+Link: https://syzkaller.appspot.com/bug?extid=099461f8558eb0a1f4f3
+Fixes: 47e988147f40 ("nfsd: add nfsd_serv_try_get and nfsd_serv_put")
+Signed-off-by: Shardul Bankar <shardul.b@mpiricsoftware.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfssvc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
+index 7057ddd7a0a8..32cc03a7e7be 100644
+--- a/fs/nfsd/nfssvc.c
++++ b/fs/nfsd/nfssvc.c
+@@ -633,12 +633,15 @@ int nfsd_create_serv(struct net *net)
+ serv = svc_create_pooled(nfsd_programs, ARRAY_SIZE(nfsd_programs),
+ &nn->nfsd_svcstats,
+ nfsd_max_blksize, nfsd);
+- if (serv == NULL)
++ if (serv == NULL) {
++ percpu_ref_exit(&nn->nfsd_net_ref);
+ return -ENOMEM;
++ }
+
+ error = svc_bind(serv, net);
+ if (error < 0) {
+ svc_destroy(&serv);
++ percpu_ref_exit(&nn->nfsd_net_ref);
+ return error;
+ }
+ spin_lock(&nfsd_notifier_lock);
+--
+2.51.0
+
--- /dev/null
+From 8dc813082f682be81d46190282ccd58f430b1129 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 10:43:43 -0800
+Subject: nvme-fabrics: add ENOKEY to no retry criteria for authentication
+ failures
+
+From: Justin Tee <justintee8345@gmail.com>
+
+[ Upstream commit 13989207ee29c40501e719512e8dc90768325895 ]
+
+With authentication, in addition to EKEYREJECTED there is also no point in
+retrying reconnects when status is ENOKEY. Thus, add -ENOKEY as another
+criteria to determine when to stop retries.
+
+Cc: Daniel Wagner <wagi@kernel.org>
+Cc: Hannes Reinecke <hare@suse.de>
+Closes: https://lore.kernel.org/linux-nvme/20250829-nvme-fc-sync-v3-0-d69c87e63aee@kernel.org/
+Signed-off-by: Justin Tee <justintee8345@gmail.com>
+Tested-by: Daniel Wagner <wagi@kernel.org>
+Reviewed-by: Daniel Wagner <wagi@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fabrics.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
+index 2e58a7ce1090..55a8afd2efd5 100644
+--- a/drivers/nvme/host/fabrics.c
++++ b/drivers/nvme/host/fabrics.c
+@@ -592,7 +592,7 @@ bool nvmf_should_reconnect(struct nvme_ctrl *ctrl, int status)
+ if (status > 0 && (status & NVME_STATUS_DNR))
+ return false;
+
+- if (status == -EKEYREJECTED)
++ if (status == -EKEYREJECTED || status == -ENOKEY)
+ return false;
+
+ if (ctrl->opts->max_reconnects == -1 ||
+--
+2.51.0
+
--- /dev/null
+From 0f72775e3f54420e392e50a97e2ea250a60feb56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 11:05:45 +0100
+Subject: nvme-fc: don't hold rport lock when putting ctrl
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit b71cbcf7d170e51148d5467820ae8a72febcb651 ]
+
+nvme_fc_ctrl_put can acquire the rport lock when freeing the
+ctrl object:
+
+nvme_fc_ctrl_put
+ nvme_fc_ctrl_free
+ spin_lock_irqsave(rport->lock)
+
+Thus we can't hold the rport lock when calling nvme_fc_ctrl_put.
+
+Justin suggested use the safe list iterator variant because
+nvme_fc_ctrl_put will also modify the rport->list.
+
+Cc: Justin Tee <justin.tee@broadcom.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 2c903729b0b9..8324230c5371 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -1468,14 +1468,14 @@ nvme_fc_match_disconn_ls(struct nvme_fc_rport *rport,
+ {
+ struct fcnvme_ls_disconnect_assoc_rqst *rqst =
+ &lsop->rqstbuf->rq_dis_assoc;
+- struct nvme_fc_ctrl *ctrl, *ret = NULL;
++ struct nvme_fc_ctrl *ctrl, *tmp, *ret = NULL;
+ struct nvmefc_ls_rcv_op *oldls = NULL;
+ u64 association_id = be64_to_cpu(rqst->associd.association_id);
+ unsigned long flags;
+
+ spin_lock_irqsave(&rport->lock, flags);
+
+- list_for_each_entry(ctrl, &rport->ctrl_list, ctrl_list) {
++ list_for_each_entry_safe(ctrl, tmp, &rport->ctrl_list, ctrl_list) {
+ if (!nvme_fc_ctrl_get(ctrl))
+ continue;
+ spin_lock(&ctrl->lock);
+@@ -1488,7 +1488,9 @@ nvme_fc_match_disconn_ls(struct nvme_fc_rport *rport,
+ if (ret)
+ /* leave the ctrl get reference */
+ break;
++ spin_unlock_irqrestore(&rport->lock, flags);
+ nvme_fc_ctrl_put(ctrl);
++ spin_lock_irqsave(&rport->lock, flags);
+ }
+
+ spin_unlock_irqrestore(&rport->lock, flags);
+--
+2.51.0
+
--- /dev/null
+From c1ba8feee3265d4fbc38dae347c6d954fb1d030a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Nov 2025 15:04:07 +0800
+Subject: platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI
+ quirks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+
+[ Upstream commit b169e1733cadb614e87f69d7a5ae1b186c50d313 ]
+
+Dell Pro Rugged 10/12 tablets has a reliable VGBS method.
+If VGBS is not called on boot, the on-screen keyboard won't appear if the
+device is booted without a keyboard.
+
+Call VGBS on boot on thess devices to get the initial state of
+SW_TABLET_MODE in a reliable way.
+
+Signed-off-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Link: https://patch.msgid.link/20251127070407.656463-1-acelan.kao@canonical.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/hid.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c
+index 9c07a7faf18f..560cc063198e 100644
+--- a/drivers/platform/x86/intel/hid.c
++++ b/drivers/platform/x86/intel/hid.c
+@@ -177,6 +177,18 @@ static const struct dmi_system_id dmi_vgbs_allow_list[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP Elite Dragonfly G2 Notebook PC"),
+ },
+ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro Rugged 10 Tablet RA00260"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro Rugged 12 Tablet RA02260"),
++ },
++ },
+ { }
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 4361d09df411f487a06ffa48308ddba3c49eba57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Nov 2025 07:16:05 -0800
+Subject: platform/x86: wmi-gamezone: Add Legion Go 2 Quirks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Derek J. Clark <derekjohn.clark@gmail.com>
+
+[ Upstream commit 55715d7ad5e772d621c3201da3895f250591bce8 ]
+
+Add Legion Go 2 SKU's to the Extreme Mode quirks table.
+
+Signed-off-by: Derek J. Clark <derekjohn.clark@gmail.com>
+Reviewed-by: Armin Wolf <W_Armin@gmx.de>
+Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Link: https://patch.msgid.link/20251127151605.1018026-4-derekjohn.clark@gmail.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/lenovo/wmi-gamezone.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/lenovo/wmi-gamezone.c b/drivers/platform/x86/lenovo/wmi-gamezone.c
+index 0eb7fe8222f4..b26806b37d96 100644
+--- a/drivers/platform/x86/lenovo/wmi-gamezone.c
++++ b/drivers/platform/x86/lenovo/wmi-gamezone.c
+@@ -274,8 +274,23 @@ static const struct dmi_system_id fwbug_list[] = {
+ },
+ .driver_data = &quirk_no_extreme_bug,
+ },
++ {
++ .ident = "Legion Go 8ASP2",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "Legion Go 8ASP2"),
++ },
++ .driver_data = &quirk_no_extreme_bug,
++ },
++ {
++ .ident = "Legion Go 8AHP2",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "Legion Go 8AHP2"),
++ },
++ .driver_data = &quirk_no_extreme_bug,
++ },
+ {},
+-
+ };
+
+ /**
+--
+2.51.0
+
--- /dev/null
+From 9ce7f4ec91455dc1284f9ad7c1de9f9a7a28335d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Apr 2025 22:31:13 -0400
+Subject: powerpc/addnote: Fix overflow on 32-bit builds
+
+From: Ben Collins <bcollins@kernel.org>
+
+[ Upstream commit 825ce89a3ef17f84cf2c0eacfa6b8dc9fd11d13f ]
+
+The PUT_64[LB]E() macros need to cast the value to unsigned long long
+like the GET_64[LB]E() macros. Caused lots of warnings when compiled
+on 32-bit, and clobbered addresses (36-bit P4080).
+
+Signed-off-by: Ben Collins <bcollins@kernel.org>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/2025042122-mustard-wrasse-694572@boujee-and-buff
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/addnote.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/boot/addnote.c b/arch/powerpc/boot/addnote.c
+index 53b3b2621457..78704927453a 100644
+--- a/arch/powerpc/boot/addnote.c
++++ b/arch/powerpc/boot/addnote.c
+@@ -68,8 +68,8 @@ static int e_class = ELFCLASS32;
+ #define PUT_16BE(off, v)(buf[off] = ((v) >> 8) & 0xff, \
+ buf[(off) + 1] = (v) & 0xff)
+ #define PUT_32BE(off, v)(PUT_16BE((off), (v) >> 16L), PUT_16BE((off) + 2, (v)))
+-#define PUT_64BE(off, v)((PUT_32BE((off), (v) >> 32L), \
+- PUT_32BE((off) + 4, (v))))
++#define PUT_64BE(off, v)((PUT_32BE((off), (unsigned long long)(v) >> 32L), \
++ PUT_32BE((off) + 4, (unsigned long long)(v))))
+
+ #define GET_16LE(off) ((buf[off]) + (buf[(off)+1] << 8))
+ #define GET_32LE(off) (GET_16LE(off) + (GET_16LE((off)+2U) << 16U))
+@@ -78,7 +78,8 @@ static int e_class = ELFCLASS32;
+ #define PUT_16LE(off, v) (buf[off] = (v) & 0xff, \
+ buf[(off) + 1] = ((v) >> 8) & 0xff)
+ #define PUT_32LE(off, v) (PUT_16LE((off), (v)), PUT_16LE((off) + 2, (v) >> 16L))
+-#define PUT_64LE(off, v) (PUT_32LE((off), (v)), PUT_32LE((off) + 4, (v) >> 32L))
++#define PUT_64LE(off, v) (PUT_32LE((off), (unsigned long long)(v)), \
++ PUT_32LE((off) + 4, (unsigned long long)(v) >> 32L))
+
+ #define GET_16(off) (e_data == ELFDATA2MSB ? GET_16BE(off) : GET_16LE(off))
+ #define GET_32(off) (e_data == ELFDATA2MSB ? GET_32BE(off) : GET_32LE(off))
+--
+2.51.0
+
--- /dev/null
+From c89eceec495afc78a08f794bc9fcc0b85a062580 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 14:10:37 +0800
+Subject: reset: fix BIT macro reference
+
+From: Encrow Thorne <jyc0019@gmail.com>
+
+[ Upstream commit f3d8b64ee46c9b4b0b82b1a4642027728bac95b8 ]
+
+RESET_CONTROL_FLAGS_BIT_* macros use BIT(), but reset.h does not
+include bits.h. This causes compilation errors when including
+reset.h standalone.
+
+Include bits.h to make reset.h self-contained.
+
+Suggested-by: Troy Mitchell <troy.mitchell@linux.dev>
+Reviewed-by: Troy Mitchell <troy.mitchell@linux.dev>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Encrow Thorne <jyc0019@gmail.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/reset.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/linux/reset.h b/include/linux/reset.h
+index 840d75d172f6..44f9e3415f92 100644
+--- a/include/linux/reset.h
++++ b/include/linux/reset.h
+@@ -2,6 +2,7 @@
+ #ifndef _LINUX_RESET_H_
+ #define _LINUX_RESET_H_
+
++#include <linux/bits.h>
+ #include <linux/err.h>
+ #include <linux/errno.h>
+ #include <linux/types.h>
+--
+2.51.0
+
--- /dev/null
+From 225db0c387df79255948f442b77f2329cdab2e2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Nov 2025 14:46:36 -0800
+Subject: scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during
+ FLOGI
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit 07caedc6a3887938813727beafea40f07c497705 ]
+
+It's possible for an unstable link to repeatedly bounce allowing a FLOGI
+retry, but then bounce again forcing an abort of the FLOGI. Ensure that
+the initial reference count on the FLOGI ndlp is restored in this faulty
+link scenario.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Link: https://patch.msgid.link/20251106224639.139176-8-justintee8345@gmail.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_els.c | 36 +++++++++++++++++++++++++-------
+ drivers/scsi/lpfc/lpfc_hbadisc.c | 4 +++-
+ 2 files changed, 32 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index b71db7d7d747..c08237f04bce 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -934,10 +934,15 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+ /* Check to see if link went down during discovery */
+ if (lpfc_els_chk_latt(vport)) {
+ /* One additional decrement on node reference count to
+- * trigger the release of the node
++ * trigger the release of the node. Make sure the ndlp
++ * is marked NLP_DROPPED.
+ */
+- if (!(ndlp->fc4_xpt_flags & SCSI_XPT_REGD))
++ if (!test_bit(NLP_IN_DEV_LOSS, &ndlp->nlp_flag) &&
++ !test_bit(NLP_DROPPED, &ndlp->nlp_flag) &&
++ !(ndlp->fc4_xpt_flags & SCSI_XPT_REGD)) {
++ set_bit(NLP_DROPPED, &ndlp->nlp_flag);
+ lpfc_nlp_put(ndlp);
++ }
+ goto out;
+ }
+
+@@ -995,9 +1000,10 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+ IOERR_LOOP_OPEN_FAILURE)))
+ lpfc_vlog_msg(vport, KERN_WARNING, LOG_ELS,
+ "2858 FLOGI Status:x%x/x%x TMO"
+- ":x%x Data x%lx x%x\n",
++ ":x%x Data x%lx x%x x%lx x%x\n",
+ ulp_status, ulp_word4, tmo,
+- phba->hba_flag, phba->fcf.fcf_flag);
++ phba->hba_flag, phba->fcf.fcf_flag,
++ ndlp->nlp_flag, ndlp->fc4_xpt_flags);
+
+ /* Check for retry */
+ if (lpfc_els_retry(phba, cmdiocb, rspiocb)) {
+@@ -1015,14 +1021,17 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+ * reference to trigger node release.
+ */
+ if (!test_bit(NLP_IN_DEV_LOSS, &ndlp->nlp_flag) &&
+- !(ndlp->fc4_xpt_flags & SCSI_XPT_REGD))
++ !test_bit(NLP_DROPPED, &ndlp->nlp_flag) &&
++ !(ndlp->fc4_xpt_flags & SCSI_XPT_REGD)) {
++ set_bit(NLP_DROPPED, &ndlp->nlp_flag);
+ lpfc_nlp_put(ndlp);
++ }
+
+ lpfc_printf_vlog(vport, KERN_WARNING, LOG_ELS,
+ "0150 FLOGI Status:x%x/x%x "
+- "xri x%x TMO:x%x refcnt %d\n",
++ "xri x%x iotag x%x TMO:x%x refcnt %d\n",
+ ulp_status, ulp_word4, cmdiocb->sli4_xritag,
+- tmo, kref_read(&ndlp->kref));
++ cmdiocb->iotag, tmo, kref_read(&ndlp->kref));
+
+ /* If this is not a loop open failure, bail out */
+ if (!(ulp_status == IOSTAT_LOCAL_REJECT &&
+@@ -1279,6 +1288,19 @@ lpfc_issue_els_flogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
+ uint32_t tmo, did;
+ int rc;
+
++ /* It's possible for lpfc to reissue a FLOGI on an ndlp that is marked
++ * NLP_DROPPED. This happens when the FLOGI completed with the XB bit
++ * set causing lpfc to reference the ndlp until the XRI_ABORTED CQE is
++ * issued. The time window for the XRI_ABORTED CQE can be as much as
++ * 2*2*RA_TOV allowing for ndlp reuse of this type when the link is
++ * cycling quickly. When true, restore the initial reference and remove
++ * the NLP_DROPPED flag as lpfc is retrying.
++ */
++ if (test_and_clear_bit(NLP_DROPPED, &ndlp->nlp_flag)) {
++ if (!lpfc_nlp_get(ndlp))
++ return 1;
++ }
++
+ cmdsize = (sizeof(uint32_t) + sizeof(struct serv_parm));
+ elsiocb = lpfc_prep_els_iocb(vport, 1, cmdsize, retry, ndlp,
+ ndlp->nlp_DID, ELS_CMD_FLOGI);
+diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
+index 43d246c5c049..717ae56c8e4b 100644
+--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
+@@ -424,6 +424,7 @@ lpfc_check_nlp_post_devloss(struct lpfc_vport *vport,
+ struct lpfc_nodelist *ndlp)
+ {
+ if (test_and_clear_bit(NLP_IN_RECOV_POST_DEV_LOSS, &ndlp->save_flags)) {
++ clear_bit(NLP_DROPPED, &ndlp->nlp_flag);
+ lpfc_nlp_get(ndlp);
+ lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY | LOG_NODE,
+ "8438 Devloss timeout reversed on DID x%x "
+@@ -566,7 +567,8 @@ lpfc_dev_loss_tmo_handler(struct lpfc_nodelist *ndlp)
+ return fcf_inuse;
+ }
+
+- lpfc_nlp_put(ndlp);
++ if (!test_and_set_bit(NLP_DROPPED, &ndlp->nlp_flag))
++ lpfc_nlp_put(ndlp);
+ return fcf_inuse;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From ede7fa5b45120364d6a71ea886778bc3eb2f6035 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 10:48:45 -0500
+Subject: scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive
+
+From: Tony Battersby <tonyb@cybernetics.com>
+
+[ Upstream commit 8f58fc64d559b5fda1b0a5e2a71422be61e79ab9 ]
+
+When given the module parameter qlini_mode=exclusive, qla2xxx in
+initiator mode is initially unable to successfully send SCSI commands to
+devices it finds while scanning, resulting in an escalating series of
+resets until an adapter reset clears the issue. Fix by checking the
+active mode instead of the module parameter.
+
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Link: https://patch.msgid.link/1715ec14-ba9a-45dc-9cf2-d41aa6b81b5e@cybernetics.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_os.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 70a579cf9c3f..6b0f616b1ca0 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -3460,13 +3460,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ ha->mqenable = 0;
+
+ if (ha->mqenable) {
+- bool startit = false;
+-
+- if (QLA_TGT_MODE_ENABLED())
+- startit = false;
+-
+- if (ql2x_ini_mode == QLA2XXX_INI_MODE_ENABLED)
+- startit = true;
++ bool startit = !!(host->active_mode & MODE_INITIATOR);
+
+ /* Create start of day qpairs for Block MQ */
+ for (i = 0; i < ha->max_qpairs; i++)
+--
+2.51.0
+
--- /dev/null
+From dc5cf5fb755ca552126de94eeb05d0b8d4868e62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 10:50:05 -0500
+Subject: scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled
+
+From: Tony Battersby <tonyb@cybernetics.com>
+
+[ Upstream commit 4f6aaade2a22ac428fa99ed716cf2b87e79c9837 ]
+
+When qla2xxx is loaded with qlini_mode=disabled,
+ha->flags.disable_msix_handshake is used before it is set, resulting in
+the wrong interrupt handler being used on certain HBAs
+(qla2xxx_msix_rsp_q_hs() is used when qla2xxx_msix_rsp_q() should be
+used). The only difference between these two interrupt handlers is that
+the _hs() version writes to a register to clear the "RISC" interrupt,
+whereas the other version does not. So this bug results in the RISC
+interrupt being cleared when it should not be. This occasionally causes
+a different interrupt handler qla24xx_msix_default() for a different
+vector to see ((stat & HSRX_RISC_INT) == 0) and ignore its interrupt,
+which then causes problems like:
+
+qla2xxx [0000:02:00.0]-d04c:6: MBX Command timeout for cmd 20,
+ iocontrol=8 jiffies=1090c0300 mb[0-3]=[0x4000 0x0 0x40 0xda] mb7 0x500
+ host_status 0x40000010 hccr 0x3f00
+qla2xxx [0000:02:00.0]-101e:6: Mailbox cmd timeout occurred, cmd=0x20,
+ mb[0]=0x20. Scheduling ISP abort
+(the cmd varies; sometimes it is 0x20, 0x22, 0x54, 0x5a, 0x5d, or 0x6a)
+
+This problem can be reproduced with a 16 or 32 Gbps HBA by loading
+qla2xxx with qlini_mode=disabled and running a high IOPS test while
+triggering frequent RSCN database change events.
+
+While analyzing the problem I discovered that even with
+disable_msix_handshake forced to 0, it is not necessary to clear the
+RISC interrupt from qla2xxx_msix_rsp_q_hs() (more below). So just
+completely remove qla2xxx_msix_rsp_q_hs() and the logic for selecting
+it, which also fixes the bug with qlini_mode=disabled.
+
+The test below describes the justification for not needing
+qla2xxx_msix_rsp_q_hs():
+
+Force disable_msix_handshake to 0:
+qla24xx_config_rings():
+if (0 && (ha->fw_attributes & BIT_6) && (IS_MSIX_NACK_CAPABLE(ha)) &&
+ (ha->flags.msix_enabled)) {
+
+In qla24xx_msix_rsp_q() and qla2xxx_msix_rsp_q_hs(), check:
+ (rd_reg_dword(®->host_status) & HSRX_RISC_INT)
+
+Count the number of calls to each function with HSRX_RISC_INT set and
+the number with HSRX_RISC_INT not set while performing some I/O.
+
+If qla2xxx_msix_rsp_q_hs() clears the RISC interrupt (original code):
+qla24xx_msix_rsp_q: 50% of calls have HSRX_RISC_INT set
+qla2xxx_msix_rsp_q_hs: 5% of calls have HSRX_RISC_INT set
+(# of qla2xxx_msix_rsp_q_hs interrupts) =
+ (# of qla24xx_msix_rsp_q interrupts) * 3
+
+If qla2xxx_msix_rsp_q_hs() does not clear the RISC interrupt (patched
+code):
+qla24xx_msix_rsp_q: 100% of calls have HSRX_RISC_INT set
+qla2xxx_msix_rsp_q_hs: 9% of calls have HSRX_RISC_INT set
+(# of qla2xxx_msix_rsp_q_hs interrupts) =
+ (# of qla24xx_msix_rsp_q interrupts) * 3
+
+In the case of the original code, qla24xx_msix_rsp_q() was seeing
+HSRX_RISC_INT set only 50% of the time because qla2xxx_msix_rsp_q_hs()
+was clearing it when it shouldn't have been. In the patched code,
+qla24xx_msix_rsp_q() sees HSRX_RISC_INT set 100% of the time, which
+makes sense if that interrupt handler needs to clear the RISC interrupt
+(which it does). qla2xxx_msix_rsp_q_hs() sees HSRX_RISC_INT only 9% of
+the time, which is just overlap from the other interrupt during the
+high IOPS test.
+
+Tested with SCST on:
+QLE2742 FW:v9.08.02 (32 Gbps 2-port)
+QLE2694L FW:v9.10.11 (16 Gbps 4-port)
+QLE2694L FW:v9.08.02 (16 Gbps 4-port)
+QLE2672 FW:v8.07.12 (16 Gbps 2-port)
+both initiator and target mode
+
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Link: https://patch.msgid.link/56d378eb-14ad-49c7-bae9-c649b6c7691e@cybernetics.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_def.h | 1 -
+ drivers/scsi/qla2xxx/qla_gbl.h | 2 +-
+ drivers/scsi/qla2xxx/qla_isr.c | 32 +++-----------------------------
+ drivers/scsi/qla2xxx/qla_mid.c | 4 +---
+ 4 files changed, 5 insertions(+), 34 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
+index cb95b7b12051..b3265952c4be 100644
+--- a/drivers/scsi/qla2xxx/qla_def.h
++++ b/drivers/scsi/qla2xxx/qla_def.h
+@@ -3503,7 +3503,6 @@ struct isp_operations {
+ #define QLA_MSIX_RSP_Q 0x01
+ #define QLA_ATIO_VECTOR 0x02
+ #define QLA_MSIX_QPAIR_MULTIQ_RSP_Q 0x03
+-#define QLA_MSIX_QPAIR_MULTIQ_RSP_Q_HS 0x04
+
+ #define QLA_MIDX_DEFAULT 0
+ #define QLA_MIDX_RSP_Q 1
+diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
+index 145defc420f2..55d531c19e6b 100644
+--- a/drivers/scsi/qla2xxx/qla_gbl.h
++++ b/drivers/scsi/qla2xxx/qla_gbl.h
+@@ -766,7 +766,7 @@ extern int qla2x00_dfs_remove(scsi_qla_host_t *);
+
+ /* Globa function prototypes for multi-q */
+ extern int qla25xx_request_irq(struct qla_hw_data *, struct qla_qpair *,
+- struct qla_msix_entry *, int);
++ struct qla_msix_entry *);
+ extern int qla25xx_init_req_que(struct scsi_qla_host *, struct req_que *);
+ extern int qla25xx_init_rsp_que(struct scsi_qla_host *, struct rsp_que *);
+ extern int qla25xx_create_req_que(struct qla_hw_data *, uint16_t, uint8_t,
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index c4c6b5c6658c..a3971afc2dd1 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -4467,32 +4467,6 @@ qla2xxx_msix_rsp_q(int irq, void *dev_id)
+ return IRQ_HANDLED;
+ }
+
+-irqreturn_t
+-qla2xxx_msix_rsp_q_hs(int irq, void *dev_id)
+-{
+- struct qla_hw_data *ha;
+- struct qla_qpair *qpair;
+- struct device_reg_24xx __iomem *reg;
+- unsigned long flags;
+-
+- qpair = dev_id;
+- if (!qpair) {
+- ql_log(ql_log_info, NULL, 0x505b,
+- "%s: NULL response queue pointer.\n", __func__);
+- return IRQ_NONE;
+- }
+- ha = qpair->hw;
+-
+- reg = &ha->iobase->isp24;
+- spin_lock_irqsave(&ha->hardware_lock, flags);
+- wrt_reg_dword(®->hccr, HCCRX_CLR_RISC_INT);
+- spin_unlock_irqrestore(&ha->hardware_lock, flags);
+-
+- queue_work(ha->wq, &qpair->q_work);
+-
+- return IRQ_HANDLED;
+-}
+-
+ /* Interrupt handling helpers. */
+
+ struct qla_init_msix_entry {
+@@ -4505,7 +4479,6 @@ static const struct qla_init_msix_entry msix_entries[] = {
+ { "rsp_q", qla24xx_msix_rsp_q },
+ { "atio_q", qla83xx_msix_atio_q },
+ { "qpair_multiq", qla2xxx_msix_rsp_q },
+- { "qpair_multiq_hs", qla2xxx_msix_rsp_q_hs },
+ };
+
+ static const struct qla_init_msix_entry qla82xx_msix_entries[] = {
+@@ -4792,9 +4765,10 @@ qla2x00_free_irqs(scsi_qla_host_t *vha)
+ }
+
+ int qla25xx_request_irq(struct qla_hw_data *ha, struct qla_qpair *qpair,
+- struct qla_msix_entry *msix, int vector_type)
++ struct qla_msix_entry *msix)
+ {
+- const struct qla_init_msix_entry *intr = &msix_entries[vector_type];
++ const struct qla_init_msix_entry *intr =
++ &msix_entries[QLA_MSIX_QPAIR_MULTIQ_RSP_Q];
+ scsi_qla_host_t *vha = pci_get_drvdata(ha->pdev);
+ int ret;
+
+diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
+index 8b71ac0b1d99..0abc47e72e0b 100644
+--- a/drivers/scsi/qla2xxx/qla_mid.c
++++ b/drivers/scsi/qla2xxx/qla_mid.c
+@@ -899,9 +899,7 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options,
+ rsp->options, rsp->id, rsp->rsp_q_in,
+ rsp->rsp_q_out);
+
+- ret = qla25xx_request_irq(ha, qpair, qpair->msix,
+- ha->flags.disable_msix_handshake ?
+- QLA_MSIX_QPAIR_MULTIQ_RSP_Q : QLA_MSIX_QPAIR_MULTIQ_RSP_Q_HS);
++ ret = qla25xx_request_irq(ha, qpair, qpair->msix);
+ if (ret)
+ goto que_failed;
+
+--
+2.51.0
+
--- /dev/null
+From 75835cf3e9ab3c67c3674c8643f46c3d8203e75e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 10:51:28 -0500
+Subject: scsi: qla2xxx: Use reinit_completion on mbx_intr_comp
+
+From: Tony Battersby <tonyb@cybernetics.com>
+
+[ Upstream commit 957aa5974989fba4ae4f807ebcb27f12796edd4d ]
+
+If a mailbox command completes immediately after
+wait_for_completion_timeout() times out, ha->mbx_intr_comp could be left
+in an inconsistent state, causing the next mailbox command not to wait
+for the hardware. Fix by reinitializing the completion before use.
+
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Link: https://patch.msgid.link/11b6485e-0bfd-4784-8f99-c06a196dad94@cybernetics.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_mbx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
+index 32eb0ce8b170..1f01576f044b 100644
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -253,6 +253,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
+ /* Issue set host interrupt command to send cmd out. */
+ ha->flags.mbox_int = 0;
+ clear_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags);
++ reinit_completion(&ha->mbx_intr_comp);
+
+ /* Unlock mbx registers and wait for interrupt */
+ ql_dbg(ql_dbg_mbx, vha, 0x100f,
+@@ -279,6 +280,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
+ "cmd=%x Timeout.\n", command);
+ spin_lock_irqsave(&ha->hardware_lock, flags);
+ clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags);
++ reinit_completion(&ha->mbx_intr_comp);
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
+ if (chip_reset != ha->chip_reset) {
+--
+2.51.0
+
--- /dev/null
+From 8170d9f6259383f531d91ab8f029a5cfc2b21215 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Nov 2025 10:38:21 -0600
+Subject: scsi: smartpqi: Add support for Hurray Data new controller PCI device
+
+From: David Strahan <David.Strahan@microchip.com>
+
+[ Upstream commit 48e6b7e708029cea451e53a8c16fc8c16039ecdc ]
+
+Add support for new Hurray Data controller.
+
+All entries are in HEX.
+
+Add PCI IDs for Hurray Data controllers:
+ VID / DID / SVID / SDID
+ ---- ---- ---- ----
+ 9005 028f 207d 4840
+
+Reviewed-by: Scott Benesh <scott.benesh@microchip.com>
+Reviewed-by: Scott Teel <scott.teel@microchip.com>
+Reviewed-by: Mike McGowen <mike.mcgowen@microchip.com>
+Signed-off-by: David Strahan <David.Strahan@microchip.com>
+Signed-off-by: Don Brace <don.brace@microchip.com>
+Link: https://patch.msgid.link/20251106163823.786828-4-don.brace@microchip.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/smartpqi/smartpqi_init.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
+index fdc856845a05..98e93900254c 100644
+--- a/drivers/scsi/smartpqi/smartpqi_init.c
++++ b/drivers/scsi/smartpqi/smartpqi_init.c
+@@ -10127,6 +10127,10 @@ static const struct pci_device_id pqi_pci_id_table[] = {
+ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+ 0x207d, 0x4240)
+ },
++ {
++ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
++ 0x207d, 0x4840)
++ },
+ {
+ PCI_DEVICE_SUB(PCI_VENDOR_ID_ADAPTEC2, 0x028f,
+ PCI_VENDOR_ID_ADVANTECH, 0x8312)
+--
+2.51.0
+
--- /dev/null
+From 6c827dee72e180e671f65e58f2feec086fa5e102 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 17:43:27 +0800
+Subject: scsi: ufs: host: mediatek: Fix shutdown/suspend race condition
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit 014de20bb36ba03e0e0b0a7e0a1406ab900c9fda ]
+
+Address a race condition between shutdown and suspend operations in the
+UFS Mediatek driver. Before entering suspend, check if a shutdown is in
+progress to prevent conflicts and ensure system stability.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Acked-by: Chun-Hung Wu <chun-hung.wu@mediatek.com>
+Link: https://patch.msgid.link/20250924094527.2992256-6-peter.wang@mediatek.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 758a393a9de1..d0cbd96ad29d 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -2373,6 +2373,11 @@ static int ufs_mtk_system_suspend(struct device *dev)
+ struct arm_smccc_res res;
+ int ret;
+
++ if (hba->shutting_down) {
++ ret = -EBUSY;
++ goto out;
++ }
++
+ ret = ufshcd_system_suspend(dev);
+ if (ret)
+ goto out;
+--
+2.51.0
+
--- /dev/null
+From bb6f000f360cba14062355382489097acb3f4f7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Oct 2025 11:08:40 +0800
+Subject: serial: sprd: Return -EPROBE_DEFER when uart clock is not ready
+
+From: Wenhua Lin <Wenhua.Lin@unisoc.com>
+
+[ Upstream commit 29e8a0c587e328ed458380a45d6028adf64d7487 ]
+
+In sprd_clk_init(), when devm_clk_get() returns -EPROBE_DEFER
+for either uart or source clock, we should propagate the
+error instead of just warning and continuing with NULL clocks.
+
+Currently the driver only emits a warning when clock acquisition
+fails and proceeds with NULL clock pointers. This can lead to
+issues later when the clocks are actually needed. More importantly,
+when the clock provider is not ready yet and returns -EPROBE_DEFER,
+we should return this error to allow deferred probing.
+
+This change adds explicit checks for -EPROBE_DEFER after both:
+1. devm_clk_get(uport->dev, uart)
+2. devm_clk_get(uport->dev, source)
+
+When -EPROBE_DEFER is encountered, the function now returns
+-EPROBE_DEFER to let the driver framework retry probing
+later when the clock dependencies are resolved.
+
+Signed-off-by: Wenhua Lin <Wenhua.Lin@unisoc.com>
+Link: https://patch.msgid.link/20251022030840.956589-1-Wenhua.Lin@unisoc.com
+Reviewed-by: Cixi Geng <cixi.geng@linux.dev>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/sprd_serial.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c
+index 8c9366321f8e..092755f35683 100644
+--- a/drivers/tty/serial/sprd_serial.c
++++ b/drivers/tty/serial/sprd_serial.c
+@@ -1133,6 +1133,9 @@ static int sprd_clk_init(struct uart_port *uport)
+
+ clk_uart = devm_clk_get(uport->dev, "uart");
+ if (IS_ERR(clk_uart)) {
++ if (PTR_ERR(clk_uart) == -EPROBE_DEFER)
++ return -EPROBE_DEFER;
++
+ dev_warn(uport->dev, "uart%d can't get uart clock\n",
+ uport->line);
+ clk_uart = NULL;
+@@ -1140,6 +1143,9 @@ static int sprd_clk_init(struct uart_port *uport)
+
+ clk_parent = devm_clk_get(uport->dev, "source");
+ if (IS_ERR(clk_parent)) {
++ if (PTR_ERR(clk_parent) == -EPROBE_DEFER)
++ return -EPROBE_DEFER;
++
+ dev_warn(uport->dev, "uart%d can't get source clock\n",
+ uport->line);
+ clk_parent = NULL;
+--
+2.51.0
+
net-hsr-fix-null-pointer-dereference-in-prp_get_untagged_frame.patch
x86-bug-fix-old-gcc-compile-fails.patch
x86-msi-make-irq_retrigger-functional-for-posted-msi.patch
+x86-fpu-fix-fpu-state-core-dump-truncation-on-cpus-w.patch
+x86-mm-tlb-trace-export-the-tlb_remote_wrong_cpu-enu.patch
+asoc-fsl_sai-constrain-sample-rates-from-audio-plls-.patch
+alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch
+alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch
+alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch
+asoc-ak4458-remove-the-reset-operation-in-probe-and-.patch
+nfsd-fix-memory-leak-in-nfsd_create_serv-error-paths.patch
+asoc-sdca-support-q7.8-volume-format.patch
+asoc-ops-fix-snd_soc_get_volsw-for-sx-controls.patch
+ipmi-fix-the-race-between-__scan_channels-and-delive.patch
+ipmi-fix-__scan_channels-failing-to-rescan-channels.patch
+scsi-ufs-host-mediatek-fix-shutdown-suspend-race-con.patch
+firmware-imx-scu-irq-init-workqueue-before-request-m.patch
+um-init-cpu_tasks-earlier.patch
+ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch
+scsi-smartpqi-add-support-for-hurray-data-new-contro.patch
+scsi-lpfc-fix-reusing-an-ndlp-that-is-marked-nlp_dro.patch
+clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch
+powerpc-addnote-fix-overflow-on-32-bit-builds.patch
+scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch
+scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch
+scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch
+fuse-always-flush-the-page-cache-before-fopen_direct.patch
+fuse-invalidate-the-page-cache-after-fopen_direct_io.patch
+via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch
+functionfs-fix-the-open-removal-races.patch
+reset-fix-bit-macro-reference.patch
+exfat-fix-remount-failure-in-different-process-envir.patch
+exfat-zero-out-post-eof-page-cache-on-file-extension.patch
+usbip-fix-locking-bug-in-rt-enabled-kernels.patch
+usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch
+iio-adc-ti_am335x_adc-limit-step_avg-to-valid-range-.patch
+usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch
+usb-usb-storage-no-additional-quirks-need-to-be-adde.patch
+usb-xhci-don-t-unchain-link-trbs-on-quirky-hcs.patch
+serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch
+libperf-cpumap-fix-perf_cpu_map__max-for-an-empty-nu.patch
+clk-qcom-dispcc-sm7150-fix-dispcc_mdss_pclk0_clk_src.patch
+i2c-designware-disable-smbus-interrupts-to-prevent-s.patch
+platform-x86-wmi-gamezone-add-legion-go-2-quirks.patch
+nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch
+hwmon-emc2305-fix-device-node-refcount-leak-in-error.patch
+nvme-fabrics-add-enokey-to-no-retry-criteria-for-aut.patch
+hwmon-emc2305-fix-double-put-in-emc2305_probe_childs.patch
+platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch
+mips-ftrace-fix-memory-corruption-when-kernel-is-loc.patch
--- /dev/null
+From ae503c7c4bce7777289aedfdd01d0d5162a94871 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 15:11:13 +0200
+Subject: ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx
+
+From: Matthias Schiffer <matthias.schiffer@tq-group.com>
+
+[ Upstream commit 3f61783920504b2cf99330b372d82914bb004d8e ]
+
+am33xx.dtsi has the same clock setup as am35xx.dtsi, setting
+ti,no-reset-on-init and ti,no-idle on timer1_target and timer2_target,
+so AM33 needs the same workaround as AM35 to avoid ti-sysc probe
+failing on certain target modules.
+
+Signed-off-by: Matthias Schiffer <matthias.schiffer@tq-group.com>
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250825131114.2206804-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/ti-sysc.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index 5566ad11399e..610354ce7f8f 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -48,6 +48,7 @@ enum sysc_soc {
+ SOC_UNKNOWN,
+ SOC_2420,
+ SOC_2430,
++ SOC_AM33,
+ SOC_3430,
+ SOC_AM35,
+ SOC_3630,
+@@ -2912,6 +2913,7 @@ static void ti_sysc_idle(struct work_struct *work)
+ static const struct soc_device_attribute sysc_soc_match[] = {
+ SOC_FLAG("OMAP242*", SOC_2420),
+ SOC_FLAG("OMAP243*", SOC_2430),
++ SOC_FLAG("AM33*", SOC_AM33),
+ SOC_FLAG("AM35*", SOC_AM35),
+ SOC_FLAG("OMAP3[45]*", SOC_3430),
+ SOC_FLAG("OMAP3[67]*", SOC_3630),
+@@ -3117,10 +3119,15 @@ static int sysc_check_active_timer(struct sysc *ddata)
+ * can be dropped if we stop supporting old beagleboard revisions
+ * A to B4 at some point.
+ */
+- if (sysc_soc->soc == SOC_3430 || sysc_soc->soc == SOC_AM35)
++ switch (sysc_soc->soc) {
++ case SOC_AM33:
++ case SOC_3430:
++ case SOC_AM35:
+ error = -ENXIO;
+- else
++ break;
++ default:
+ error = -EBUSY;
++ }
+
+ if ((ddata->cfg.quirks & SYSC_QUIRK_NO_RESET_ON_INIT) &&
+ (ddata->cfg.quirks & SYSC_QUIRK_NO_IDLE))
+--
+2.51.0
+
--- /dev/null
+From fa8f531c8fc02fad26f2b05a799805a28a2378f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 11:32:13 +0200
+Subject: um: init cpu_tasks[] earlier
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 7b5d4416964c07c902163822a30a622111172b01 ]
+
+This is currently done in uml_finishsetup(), but e.g. with
+KCOV enabled we'll crash because some init code can call
+into e.g. memparse(), which has coverage annotations, and
+then the checks in check_kcov_mode() crash because current
+is NULL.
+
+Simply initialize the cpu_tasks[] array statically, which
+fixes the crash. For the later SMP work, it seems to have
+not really caused any problems yet, but initialize all of
+the entries anyway.
+
+Link: https://patch.msgid.link/20250924113214.c76cd74d0583.I974f691ebb1a2b47915bd2b04cc38e5263b9447f@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/kernel/process.c | 4 +++-
+ arch/um/kernel/um_arch.c | 2 --
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
+index 9c9c66dc45f0..13d461712c99 100644
+--- a/arch/um/kernel/process.c
++++ b/arch/um/kernel/process.c
+@@ -43,7 +43,9 @@
+ * cares about its entry, so it's OK if another processor is modifying its
+ * entry.
+ */
+-struct task_struct *cpu_tasks[NR_CPUS];
++struct task_struct *cpu_tasks[NR_CPUS] = {
++ [0 ... NR_CPUS - 1] = &init_task,
++};
+ EXPORT_SYMBOL(cpu_tasks);
+
+ void free_stack(unsigned long stack, int order)
+diff --git a/arch/um/kernel/um_arch.c b/arch/um/kernel/um_arch.c
+index cfbbbf8500c3..ed2f67848a50 100644
+--- a/arch/um/kernel/um_arch.c
++++ b/arch/um/kernel/um_arch.c
+@@ -239,8 +239,6 @@ static struct notifier_block panic_exit_notifier = {
+
+ void uml_finishsetup(void)
+ {
+- cpu_tasks[0] = &init_task;
+-
+ atomic_notifier_chain_register(&panic_notifier_list,
+ &panic_exit_notifier);
+
+--
+2.51.0
+
--- /dev/null
+From 8ccee6d20f99f8c3cb86227a3fc60e8cc09cb310 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 14:53:07 -0400
+Subject: usb: typec: ucsi: Handle incorrect num_connectors capability
+
+From: Mark Pearson <mpearson-lenovo@squebb.ca>
+
+[ Upstream commit 30cd2cb1abf4c4acdb1ddb468c946f68939819fb ]
+
+The UCSI spec states that the num_connectors field is 7 bits, and the
+8th bit is reserved and should be set to zero.
+Some buggy FW has been known to set this bit, and it can lead to a
+system not booting.
+Flag that the FW is not behaving correctly, and auto-fix the value
+so that the system boots correctly.
+
+Found on Lenovo P1 G8 during Linux enablement program. The FW will
+be fixed, but seemed worth addressing in case it hit platforms that
+aren't officially Linux supported.
+
+Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20250821185319.2585023-1-mpearson-lenovo@squebb.ca
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/ucsi/ucsi.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
+index 3f568f790f39..3995483a0aa0 100644
+--- a/drivers/usb/typec/ucsi/ucsi.c
++++ b/drivers/usb/typec/ucsi/ucsi.c
+@@ -1807,6 +1807,12 @@ static int ucsi_init(struct ucsi *ucsi)
+ ret = -ENODEV;
+ goto err_reset;
+ }
++ /* Check if reserved bit set. This is out of spec but happens in buggy FW */
++ if (ucsi->cap.num_connectors & 0x80) {
++ dev_warn(ucsi->dev, "UCSI: Invalid num_connectors %d. Likely buggy FW\n",
++ ucsi->cap.num_connectors);
++ ucsi->cap.num_connectors &= 0x7f; // clear bit and carry on
++ }
+
+ /* Allocate the connectors. Released in ucsi_unregister() */
+ connector = kcalloc(ucsi->cap.num_connectors + 1, sizeof(*connector), GFP_KERNEL);
+--
+2.51.0
+
--- /dev/null
+From 4846de73fe267ccffe66a5bff7c7def201c34df1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 14:40:20 +0800
+Subject: usb: usb-storage: No additional quirks need to be added to the EL-R12
+ optical drive.
+
+From: Chen Changcheng <chenchangcheng@kylinos.cn>
+
+[ Upstream commit 955a48a5353f4fe009704a9a4272a3adf627cd35 ]
+
+The optical drive of EL-R12 has the same vid and pid as INIC-3069,
+as follows:
+T: Bus=02 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#= 3 Spd=5000 MxCh= 0
+D: Ver= 3.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
+P: Vendor=13fd ProdID=3940 Rev= 3.10
+S: Manufacturer=HL-DT-ST
+S: Product= DVD+-RW GT80N
+S: SerialNumber=423349524E4E38303338323439202020
+C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=144mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=02 Prot=50 Driver=usb-storage
+E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=0a(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+
+This will result in the optical drive device also adding
+the quirks of US_FL_NO_ATA_1X. When performing an erase operation,
+it will fail, and the reason for the failure is as follows:
+[ 388.967742] sr 5:0:0:0: [sr0] tag#0 Send: scmd 0x00000000d20c33a7
+[ 388.967742] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00
+[ 388.967773] sr 5:0:0:0: [sr0] tag#0 Done: SUCCESS Result: hostbyte=DID_TARGET_FAILURE driverbyte=DRIVER_OK cmd_age=0s
+[ 388.967773] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00
+[ 388.967803] sr 5:0:0:0: [sr0] tag#0 Sense Key : Illegal Request [current]
+[ 388.967803] sr 5:0:0:0: [sr0] tag#0 Add. Sense: Invalid field in cdb
+[ 388.967803] sr 5:0:0:0: [sr0] tag#0 scsi host busy 1 failed 0
+[ 388.967803] sr 5:0:0:0: Notifying upper driver of completion (result 8100002)
+[ 388.967834] sr 5:0:0:0: [sr0] tag#0 0 sectors total, 0 bytes done.
+
+For the EL-R12 standard optical drive, all operational commands
+and usage scenarios were tested without adding the IGNORE_RESIDUE quirks,
+and no issues were encountered. It can be reasonably concluded
+that removing the IGNORE_RESIDUE quirks has no impact.
+
+Signed-off-by: Chen Changcheng <chenchangcheng@kylinos.cn>
+Link: https://patch.msgid.link/20251121064020.29332-1-chenchangcheng@kylinos.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/storage/unusual_uas.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index 1477e31d7763..b695f5ba9a40 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -98,7 +98,7 @@ UNUSUAL_DEV(0x125f, 0xa94a, 0x0160, 0x0160,
+ US_FL_NO_ATA_1X),
+
+ /* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
+-UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
++UNUSUAL_DEV(0x13fd, 0x3940, 0x0309, 0x0309,
+ "Initio Corporation",
+ "INIC-3069",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+--
+2.51.0
+
--- /dev/null
+From 31bcf826b0f750c3c84a349851337e9378f7f9c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 16:24:04 +0200
+Subject: usb: xhci: Don't unchain link TRBs on quirky HCs
+
+From: Michal Pecio <michal.pecio@gmail.com>
+
+[ Upstream commit e6aec6d9f5794e85d2312497a5d81296d885090e ]
+
+Some old HCs ignore transfer ring link TRBs whose chain bit is unset.
+This breaks endpoint operation and sometimes makes it execute other
+ring's TDs, which may corrupt their buffers or cause unwanted device
+action. We avoid this by chaining all link TRBs on affected rings.
+
+Fix an omission which allows them to be unchained by cancelling TDs.
+
+The patch was tested by reproducing this condition on an isochronous
+endpoint (non-power-of-two TDs are sometimes split not to cross 64K)
+and printing link TRBs in trb_to_noop() on good and buggy HCs.
+
+Actual hardware malfunction is rare since it requires Missed Service
+Error shortly before the unchained link TRB, at least on NEC and AMD.
+I have never seen it after commit bb0ba4cb1065 ("usb: xhci: Apply the
+link chain quirk on NEC isoc endpoints"), but it's Russian roulette
+and I can't test all affected hosts and workloads. Fairly often MSEs
+happen after cancellation because the endpoint was stopped.
+
+Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://patch.msgid.link/20251119142417.2820519-11-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-ring.c | 27 ++++++++++++++++-----------
+ 1 file changed, 16 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 5bdcf9ab2b99..25185552287c 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -128,11 +128,11 @@ static void inc_td_cnt(struct urb *urb)
+ urb_priv->num_tds_done++;
+ }
+
+-static void trb_to_noop(union xhci_trb *trb, u32 noop_type)
++static void trb_to_noop(union xhci_trb *trb, u32 noop_type, bool unchain_links)
+ {
+ if (trb_is_link(trb)) {
+- /* unchain chained link TRBs */
+- trb->link.control &= cpu_to_le32(~TRB_CHAIN);
++ if (unchain_links)
++ trb->link.control &= cpu_to_le32(~TRB_CHAIN);
+ } else {
+ trb->generic.field[0] = 0;
+ trb->generic.field[1] = 0;
+@@ -465,7 +465,7 @@ static void xhci_handle_stopped_cmd_ring(struct xhci_hcd *xhci,
+ xhci_dbg(xhci, "Turn aborted command %p to no-op\n",
+ i_cmd->command_trb);
+
+- trb_to_noop(i_cmd->command_trb, TRB_CMD_NOOP);
++ trb_to_noop(i_cmd->command_trb, TRB_CMD_NOOP, false);
+
+ /*
+ * caller waiting for completion is called when command
+@@ -797,13 +797,18 @@ static int xhci_move_dequeue_past_td(struct xhci_hcd *xhci,
+ * (The last TRB actually points to the ring enqueue pointer, which is not part
+ * of this TD.) This is used to remove partially enqueued isoc TDs from a ring.
+ */
+-static void td_to_noop(struct xhci_td *td, bool flip_cycle)
++static void td_to_noop(struct xhci_hcd *xhci, struct xhci_virt_ep *ep,
++ struct xhci_td *td, bool flip_cycle)
+ {
++ bool unchain_links;
+ struct xhci_segment *seg = td->start_seg;
+ union xhci_trb *trb = td->start_trb;
+
++ /* link TRBs should now be unchained, but some old HCs expect otherwise */
++ unchain_links = !xhci_link_chain_quirk(xhci, ep->ring ? ep->ring->type : TYPE_STREAM);
++
+ while (1) {
+- trb_to_noop(trb, TRB_TR_NOOP);
++ trb_to_noop(trb, TRB_TR_NOOP, unchain_links);
+
+ /* flip cycle if asked to */
+ if (flip_cycle && trb != td->start_trb && trb != td->end_trb)
+@@ -1091,16 +1096,16 @@ static int xhci_invalidate_cancelled_tds(struct xhci_virt_ep *ep)
+ "Found multiple active URBs %p and %p in stream %u?\n",
+ td->urb, cached_td->urb,
+ td->urb->stream_id);
+- td_to_noop(cached_td, false);
++ td_to_noop(xhci, ep, cached_td, false);
+ cached_td->cancel_status = TD_CLEARED;
+ }
+- td_to_noop(td, false);
++ td_to_noop(xhci, ep, td, false);
+ td->cancel_status = TD_CLEARING_CACHE;
+ cached_td = td;
+ break;
+ }
+ } else {
+- td_to_noop(td, false);
++ td_to_noop(xhci, ep, td, false);
+ td->cancel_status = TD_CLEARED;
+ }
+ }
+@@ -1125,7 +1130,7 @@ static int xhci_invalidate_cancelled_tds(struct xhci_virt_ep *ep)
+ continue;
+ xhci_warn(xhci, "Failed to clear cancelled cached URB %p, mark clear anyway\n",
+ td->urb);
+- td_to_noop(td, false);
++ td_to_noop(xhci, ep, td, false);
+ td->cancel_status = TD_CLEARED;
+ }
+ }
+@@ -4273,7 +4278,7 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ */
+ urb_priv->td[0].end_trb = ep_ring->enqueue;
+ /* Every TRB except the first & last will have its cycle bit flipped. */
+- td_to_noop(&urb_priv->td[0], true);
++ td_to_noop(xhci, xep, &urb_priv->td[0], true);
+
+ /* Reset the ring enqueue back to the first TRB and its cycle bit. */
+ ep_ring->enqueue = urb_priv->td[0].start_trb;
+--
+2.51.0
+
--- /dev/null
+From 51be315e80aa45f63d0b5155701538420673b311 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 16:23:55 +0200
+Subject: usb: xhci: limit run_graceperiod for only usb 3.0 devices
+
+From: Hongyu Xie <xiehongyu1@kylinos.cn>
+
+[ Upstream commit 8d34983720155b8f05de765f0183d9b0e1345cc0 ]
+
+run_graceperiod blocks usb 2.0 devices from auto suspending after
+xhci_start for 500ms.
+
+Log shows:
+[ 13.387170] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100
+[ 13.387177] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.387182] hub_suspend:3903: hub 7-0:1.0: hub_suspend
+[ 13.387188] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1
+[ 13.387191] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event
+[ 13.387193] hcd_bus_resume:2303: usb usb7: usb auto-resume
+[ 13.387296] hub_event:5779: hub 3-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.393343] handle_port_status:2034: xhci-hcd PNP0D10:02: handle_port_status: starting usb5 port polling.
+[ 13.393353] xhci_hub_control:1271: xhci-hcd PNP0D10:02: Get port status 5-1 read: 0x206e1, return 0x10101
+[ 13.400047] hub_suspend:3903: hub 3-0:1.0: hub_suspend
+[ 13.403077] hub_resume:3948: hub 7-0:1.0: hub_resume
+[ 13.403080] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100
+[ 13.403085] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.403087] hub_suspend:3903: hub 7-0:1.0: hub_suspend
+[ 13.403090] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1
+[ 13.403093] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event
+[ 13.403095] hcd_bus_resume:2303: usb usb7: usb auto-resume
+[ 13.405002] handle_port_status:1913: xhci-hcd PNP0D10:04: Port change event, 9-1, id 1, portsc: 0x6e1
+[ 13.405016] hub_activate:1169: usb usb5-port1: status 0101 change 0001
+[ 13.405026] xhci_clear_port_change_bit:658: xhci-hcd PNP0D10:02: clear port1 connect change, portsc: 0x6e1
+[ 13.413275] hcd_bus_suspend:2250: usb usb3: bus auto-suspend, wakeup 1
+[ 13.419081] hub_resume:3948: hub 7-0:1.0: hub_resume
+[ 13.419086] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100
+[ 13.419095] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.419100] hub_suspend:3903: hub 7-0:1.0: hub_suspend
+[ 13.419106] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1
+[ 13.419110] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event
+[ 13.419112] hcd_bus_resume:2303: usb usb7: usb auto-resume
+[ 13.420455] handle_port_status:2034: xhci-hcd PNP0D10:04: handle_port_status: starting usb9 port polling.
+[ 13.420493] handle_port_status:1913: xhci-hcd PNP0D10:05: Port change event, 10-1, id 1, portsc: 0x6e1
+[ 13.425332] hcd_bus_suspend:2279: usb usb3: suspend raced with wakeup event
+[ 13.431931] handle_port_status:2034: xhci-hcd PNP0D10:05: handle_port_status: starting usb10 port polling.
+[ 13.435080] hub_resume:3948: hub 7-0:1.0: hub_resume
+[ 13.435084] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100
+[ 13.435092] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.435096] hub_suspend:3903: hub 7-0:1.0: hub_suspend
+[ 13.435102] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1
+[ 13.435106] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event
+
+usb7 and other usb 2.0 root hub were rapidly toggling between suspend
+and resume states. More, "suspend raced with wakeup event" confuses people.
+
+So, limit run_graceperiod for only usb 3.0 devices
+
+Signed-off-by: Hongyu Xie <xiehongyu1@kylinos.cn>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://patch.msgid.link/20251119142417.2820519-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-hub.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index b3a59ce1b3f4..5e1442e91743 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -1671,7 +1671,7 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
+ * SS devices are only visible to roothub after link training completes.
+ * Keep polling roothubs for a grace period after xHC start
+ */
+- if (xhci->run_graceperiod) {
++ if (hcd->speed >= HCD_USB3 && xhci->run_graceperiod) {
+ if (time_before(jiffies, xhci->run_graceperiod))
+ status = 1;
+ else
+--
+2.51.0
+
--- /dev/null
+From edfc197c373f8102cf5a14afa7c1c13e8471a74f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 09:41:43 +0800
+Subject: usbip: Fix locking bug in RT-enabled kernels
+
+From: Lizhi Xu <lizhi.xu@windriver.com>
+
+[ Upstream commit 09bf21bf5249880f62fe759b53b14b4b52900c6c ]
+
+Interrupts are disabled before entering usb_hcd_giveback_urb().
+A spinlock_t becomes a sleeping lock on PREEMPT_RT, so it cannot be
+acquired with disabled interrupts.
+
+Save the interrupt status and restore it after usb_hcd_giveback_urb().
+
+syz reported:
+BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
+Call Trace:
+ dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
+ rt_spin_lock+0xc7/0x2c0 kernel/locking/spinlock_rt.c:57
+ spin_lock include/linux/spinlock_rt.h:44 [inline]
+ mon_bus_complete drivers/usb/mon/mon_main.c:134 [inline]
+ mon_complete+0x5c/0x200 drivers/usb/mon/mon_main.c:147
+ usbmon_urb_complete include/linux/usb/hcd.h:738 [inline]
+ __usb_hcd_giveback_urb+0x254/0x5e0 drivers/usb/core/hcd.c:1647
+ vhci_urb_enqueue+0xb4f/0xe70 drivers/usb/usbip/vhci_hcd.c:818
+
+Reported-by: syzbot+205ef33a3b636b4181fb@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=205ef33a3b636b4181fb
+Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20250916014143.1439759-1-lizhi.xu@windriver.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/usbip/vhci_hcd.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
+index 0d6c10a8490c..f7e405abe608 100644
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -831,15 +831,15 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ no_need_xmit:
+ usb_hcd_unlink_urb_from_ep(hcd, urb);
+ no_need_unlink:
+- spin_unlock_irqrestore(&vhci->lock, flags);
+ if (!ret) {
+ /* usb_hcd_giveback_urb() should be called with
+ * irqs disabled
+ */
+- local_irq_disable();
++ spin_unlock(&vhci->lock);
+ usb_hcd_giveback_urb(hcd, urb, urb->status);
+- local_irq_enable();
++ spin_lock(&vhci->lock);
+ }
++ spin_unlock_irqrestore(&vhci->lock, flags);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From c2310c4927a15b923f7f5875f0b0cfecd83e7656 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Sep 2025 16:33:32 +0800
+Subject: via_wdt: fix critical boot hang due to unnamed resource allocation
+
+From: Li Qiang <liqiang01@kylinos.cn>
+
+[ Upstream commit 7aa31ee9ec92915926e74731378c009c9cc04928 ]
+
+The VIA watchdog driver uses allocate_resource() to reserve a MMIO
+region for the watchdog control register. However, the allocated
+resource was not given a name, which causes the kernel resource tree
+to contain an entry marked as "<BAD>" under /proc/iomem on x86
+platforms.
+
+During boot, this unnamed resource can lead to a critical hang because
+subsequent resource lookups and conflict checks fail to handle the
+invalid entry properly.
+
+Signed-off-by: Li Qiang <liqiang01@kylinos.cn>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/via_wdt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/watchdog/via_wdt.c b/drivers/watchdog/via_wdt.c
+index d647923d68fe..f55576392651 100644
+--- a/drivers/watchdog/via_wdt.c
++++ b/drivers/watchdog/via_wdt.c
+@@ -165,6 +165,7 @@ static int wdt_probe(struct pci_dev *pdev,
+ dev_err(&pdev->dev, "cannot enable PCI device\n");
+ return -ENODEV;
+ }
++ wdt_res.name = "via_wdt";
+
+ /*
+ * Allocate a MMIO region which contains watchdog control register
+--
+2.51.0
+
--- /dev/null
+From 38e07ce4630e45c200e466753d1b0f3f9316e3ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Dec 2025 08:02:20 +0800
+Subject: x86/fpu: Fix FPU state core dump truncation on CPUs with no extended
+ xfeatures
+
+From: Yongxin Liu <yongxin.liu@windriver.com>
+
+[ Upstream commit c8161e5304abb26e6c0bec6efc947992500fa6c5 ]
+
+Zero can be a valid value of num_records. For example, on Intel Atom x6425RE,
+only x87 and SSE are supported (features 0, 1), and fpu_user_cfg.max_features
+is 3. The for_each_extended_xfeature() loop only iterates feature 2, which is
+not enabled, so num_records = 0. This is valid and should not cause core dump
+failure.
+
+The issue is that dump_xsave_layout_desc() returns 0 for both genuine errors
+(dump_emit() failure) and valid cases (no extended features). Use negative
+return values for errors and only abort on genuine failures.
+
+Fixes: ba386777a30b ("x86/elf: Add a new FPU buffer layout info to x86 core files")
+Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://patch.msgid.link/20251210000219.4094353-2-yongxin.liu@windriver.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/fpu/xstate.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
+index 28e4fd65c9da..5f54a207ace4 100644
+--- a/arch/x86/kernel/fpu/xstate.c
++++ b/arch/x86/kernel/fpu/xstate.c
+@@ -1945,7 +1945,7 @@ static int dump_xsave_layout_desc(struct coredump_params *cprm)
+ };
+
+ if (!dump_emit(cprm, &xc, sizeof(xc)))
+- return 0;
++ return -1;
+
+ num_records++;
+ }
+@@ -1983,7 +1983,7 @@ int elf_coredump_extra_notes_write(struct coredump_params *cprm)
+ return 1;
+
+ num_records = dump_xsave_layout_desc(cprm);
+- if (!num_records)
++ if (num_records < 0)
+ return 1;
+
+ /* Total size should be equal to the number of records */
+--
+2.51.0
+
--- /dev/null
+From 6b5e2ce29e5151b4b1d4e550557b7d043780111a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Dec 2025 04:08:07 -0500
+Subject: x86/mm/tlb/trace: Export the TLB_REMOTE_WRONG_CPU enum in
+ <trace/events/tlb.h>
+
+From: Tal Zussman <tz2294@columbia.edu>
+
+[ Upstream commit 8b62e64e6d30fa047b3aefb1a36e1f80c8acb3d2 ]
+
+When the TLB_REMOTE_WRONG_CPU enum was introduced for the tlb_flush
+tracepoint, the enum was not exported to user-space. Add it to the
+appropriate macro definition to enable parsing by userspace tools, as
+per:
+
+ Link: https://lore.kernel.org/all/20150403013802.220157513@goodmis.org
+
+[ mingo: Capitalize IPI, etc. ]
+
+Fixes: 2815a56e4b72 ("x86/mm/tlb: Add tracepoint for TLB flush IPI to stale CPU")
+Signed-off-by: Tal Zussman <tz2294@columbia.edu>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Rik van Riel <riel@surriel.com>
+Link: https://patch.msgid.link/20251212-tlb-trace-fix-v2-1-d322e0ad9b69@columbia.edu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/tlb.h | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/include/trace/events/tlb.h b/include/trace/events/tlb.h
+index b4d8e7dc38f8..fb8369511685 100644
+--- a/include/trace/events/tlb.h
++++ b/include/trace/events/tlb.h
+@@ -12,8 +12,9 @@
+ EM( TLB_FLUSH_ON_TASK_SWITCH, "flush on task switch" ) \
+ EM( TLB_REMOTE_SHOOTDOWN, "remote shootdown" ) \
+ EM( TLB_LOCAL_SHOOTDOWN, "local shootdown" ) \
+- EM( TLB_LOCAL_MM_SHOOTDOWN, "local mm shootdown" ) \
+- EMe( TLB_REMOTE_SEND_IPI, "remote ipi send" )
++ EM( TLB_LOCAL_MM_SHOOTDOWN, "local MM shootdown" ) \
++ EM( TLB_REMOTE_SEND_IPI, "remote IPI send" ) \
++ EMe( TLB_REMOTE_WRONG_CPU, "remote wrong CPU" )
+
+ /*
+ * First define the enums in TLB_FLUSH_REASON to be exported to userspace
+--
+2.51.0
+
--- /dev/null
+From a996d526643eb7459a27714c905dcd405d1e179e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 17:04:33 +0800
+Subject: ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path
+
+From: Haotian Zhang <vulab@iscas.ac.cn>
+
+[ Upstream commit 5032347c04ba7ff9ba878f262e075d745c06a2a8 ]
+
+When pdacf_config() fails, snd_pdacf_probe() returns the error code
+directly without freeing the sound card resources allocated by
+snd_card_new(), which leads to a memory leak.
+
+Add proper error handling to free the sound card and clear the card
+list entry when pdacf_config() fails.
+
+Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions")
+Suggested-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
+Link: https://patch.msgid.link/20251215090433.211-1-vulab@iscas.ac.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pcmcia/pdaudiocf/pdaudiocf.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf.c b/sound/pcmcia/pdaudiocf/pdaudiocf.c
+index 8363ec08df5d..4468d81683ec 100644
+--- a/sound/pcmcia/pdaudiocf/pdaudiocf.c
++++ b/sound/pcmcia/pdaudiocf/pdaudiocf.c
+@@ -132,7 +132,13 @@ static int snd_pdacf_probe(struct pcmcia_device *link)
+ link->config_index = 1;
+ link->config_regs = PRESENT_OPTION;
+
+- return pdacf_config(link);
++ err = pdacf_config(link);
++ if (err < 0) {
++ card_list[i] = NULL;
++ snd_card_free(card);
++ return err;
++ }
++ return 0;
+ }
+
+
+--
+2.51.0
+
--- /dev/null
+From d223ca66fa11564fa439440d243117a60d1e655d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Dec 2025 10:46:30 +0800
+Subject: ALSA: usb-mixer: us16x08: validate meter packet indices
+
+From: Shipei Qu <qu@darknavy.com>
+
+[ Upstream commit 5526c1c6ba1d0913c7dfcbbd6fe1744ea7c55f1e ]
+
+get_meter_levels_from_urb() parses the 64-byte meter packets sent by
+the device and fills the per-channel arrays meter_level[],
+comp_level[] and master_level[] in struct snd_us16x08_meter_store.
+
+Currently the function derives the channel index directly from the
+meter packet (MUB2(meter_urb, s) - 1) and uses it to index those
+arrays without validating the range. If the packet contains a
+negative or out-of-range channel number, the driver may write past
+the end of these arrays.
+
+Introduce a local channel variable and validate it before updating the
+arrays. We reject negative indices, limit meter_level[] and
+comp_level[] to SND_US16X08_MAX_CHANNELS, and guard master_level[]
+updates with ARRAY_SIZE(master_level).
+
+Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk")
+Reported-by: DARKNAVY (@DarkNavyOrg) <vr@darknavy.com>
+Closes: https://lore.kernel.org/tencent_21C112743C44C1A2517FF219@qq.com
+Signed-off-by: Shipei Qu <qu@darknavy.com>
+Link: https://patch.msgid.link/20251217024630.59576-1-qu@darknavy.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_us16x08.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/sound/usb/mixer_us16x08.c b/sound/usb/mixer_us16x08.c
+index 20ac32635f1f..d05cb54de788 100644
+--- a/sound/usb/mixer_us16x08.c
++++ b/sound/usb/mixer_us16x08.c
+@@ -656,17 +656,25 @@ static void get_meter_levels_from_urb(int s,
+ u8 *meter_urb)
+ {
+ int val = MUC2(meter_urb, s) + (MUC3(meter_urb, s) << 8);
++ int ch = MUB2(meter_urb, s) - 1;
++
++ if (ch < 0)
++ return;
+
+ if (MUA0(meter_urb, s) == 0x61 && MUA1(meter_urb, s) == 0x02 &&
+ MUA2(meter_urb, s) == 0x04 && MUB0(meter_urb, s) == 0x62) {
+- if (MUC0(meter_urb, s) == 0x72)
+- store->meter_level[MUB2(meter_urb, s) - 1] = val;
+- if (MUC0(meter_urb, s) == 0xb2)
+- store->comp_level[MUB2(meter_urb, s) - 1] = val;
++ if (ch < SND_US16X08_MAX_CHANNELS) {
++ if (MUC0(meter_urb, s) == 0x72)
++ store->meter_level[ch] = val;
++ if (MUC0(meter_urb, s) == 0xb2)
++ store->comp_level[ch] = val;
++ }
+ }
+ if (MUA0(meter_urb, s) == 0x61 && MUA1(meter_urb, s) == 0x02 &&
+- MUA2(meter_urb, s) == 0x02 && MUB0(meter_urb, s) == 0x62)
+- store->master_level[MUB2(meter_urb, s) - 1] = val;
++ MUA2(meter_urb, s) == 0x02 && MUB0(meter_urb, s) == 0x62) {
++ if (ch < ARRAY_SIZE(store->master_level))
++ store->master_level[ch] = val;
++ }
+ }
+
+ /* Function to retrieve current meter values from the device.
+--
+2.51.0
+
--- /dev/null
+From 013b5cf44713aba5b2d3d4bae4419f3455e5ba1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Dec 2025 12:26:52 +0800
+Subject: ALSA: vxpocket: Fix resource leak in vxpocket_probe error path
+
+From: Haotian Zhang <vulab@iscas.ac.cn>
+
+[ Upstream commit 2a03b40deacbd293ac9aed0f9b11197dad54fe5f ]
+
+When vxpocket_config() fails, vxpocket_probe() returns the error code
+directly without freeing the sound card resources allocated by
+snd_card_new(), which leads to a memory leak.
+
+Add proper error handling to free the sound card and clear the
+allocation bit when vxpocket_config() fails.
+
+Fixes: 15b99ac17295 ("[PATCH] pcmcia: add return value to _config() functions")
+Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
+Link: https://patch.msgid.link/20251215042652.695-1-vulab@iscas.ac.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pcmcia/vx/vxpocket.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pcmcia/vx/vxpocket.c b/sound/pcmcia/vx/vxpocket.c
+index 7a0f0e73ceb2..867a477d53ae 100644
+--- a/sound/pcmcia/vx/vxpocket.c
++++ b/sound/pcmcia/vx/vxpocket.c
+@@ -295,7 +295,13 @@ static int vxpocket_probe(struct pcmcia_device *p_dev)
+
+ vxp->p_dev = p_dev;
+
+- return vxpocket_config(p_dev);
++ err = vxpocket_config(p_dev);
++ if (err < 0) {
++ card_alloc &= ~(1 << i);
++ snd_card_free(card);
++ return err;
++ }
++ return 0;
+ }
+
+ static void vxpocket_detach(struct pcmcia_device *link)
+--
+2.51.0
+
--- /dev/null
+From 9923b9c4220cadd8f6cd429f860745ffa0a100ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 16:16:26 +0100
+Subject: clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 &
+ pcie_x4
+
+From: Josua Mayer <josua@solid-run.com>
+
+[ Upstream commit f0e6bc0c3ef4b4afb299bd6912586cafd5d864e9 ]
+
+CP110 based platforms rely on the bootloader for pci port
+initialization.
+TF-A actively prevents non-uboot re-configuration of pci lanes, and many
+boards do not have software control over the pci card reset.
+
+If a pci port had link at boot-time and the clock is stopped at a later
+point, the link fails and can not be recovered.
+
+PCI controller driver probe - and by extension ownership of a driver for
+the pci clocks - may be delayed especially on large modular kernels,
+causing the clock core to start disabling unused clocks.
+
+Add the CLK_IGNORE_UNUSED flag to the three pci port's clocks to ensure
+they are not stopped before the pci controller driver has taken
+ownership and tested for an existing link.
+
+This fixes failed pci link detection when controller driver probes late,
+e.g. with arm64 defconfig and CONFIG_PHY_MVEBU_CP110_COMPHY=m.
+
+Closes: https://lore.kernel.org/r/b71596c7-461b-44b6-89ab-3cfbd492639f@solid-run.com
+Signed-off-by: Josua Mayer <josua@solid-run.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/cp110-system-controller.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/clk/mvebu/cp110-system-controller.c b/drivers/clk/mvebu/cp110-system-controller.c
+index 03c59bf22106..b47c86906046 100644
+--- a/drivers/clk/mvebu/cp110-system-controller.c
++++ b/drivers/clk/mvebu/cp110-system-controller.c
+@@ -110,6 +110,25 @@ static const char * const gate_base_names[] = {
+ [CP110_GATE_EIP197] = "eip197"
+ };
+
++static unsigned long gate_flags(const u8 bit_idx)
++{
++ switch (bit_idx) {
++ case CP110_GATE_PCIE_X1_0:
++ case CP110_GATE_PCIE_X1_1:
++ case CP110_GATE_PCIE_X4:
++ /*
++ * If a port had an active link at boot time, stopping
++ * the clock creates a failed state from which controller
++ * driver can not recover.
++ * Prevent stopping this clock till after a driver has taken
++ * ownership.
++ */
++ return CLK_IGNORE_UNUSED;
++ default:
++ return 0;
++ }
++};
++
+ struct cp110_gate_clk {
+ struct clk_hw hw;
+ struct regmap *regmap;
+@@ -171,6 +190,7 @@ static struct clk_hw *cp110_register_gate(const char *name,
+ init.ops = &cp110_gate_ops;
+ init.parent_names = &parent_name;
+ init.num_parents = 1;
++ init.flags = gate_flags(bit_idx);
+
+ gate->regmap = regmap;
+ gate->bit_idx = bit_idx;
+--
+2.51.0
+
--- /dev/null
+From a6ade131edcb3809866850e9f8a068e60e07b040 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 17:51:10 +0800
+Subject: exfat: fix remount failure in different process environments
+
+From: Yuezhang Mo <Yuezhang.Mo@sony.com>
+
+[ Upstream commit 51fc7b4ce10ccab8ea5e4876bcdc42cf5202a0ef ]
+
+The kernel test robot reported that the exFAT remount operation
+failed. The reason for the failure was that the process's umask
+is different between mount and remount, causing fs_fmask and
+fs_dmask are changed.
+
+Potentially, both gid and uid may also be changed. Therefore, when
+initializing fs_context for remount, inherit these mount options
+from the options used during mount.
+
+Reported-by: kernel test robot <oliver.sang@intel.com>
+Closes: https://lore.kernel.org/oe-lkp/202511251637.81670f5c-lkp@intel.com
+Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exfat/super.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/fs/exfat/super.c b/fs/exfat/super.c
+index 957135f20cb6..da3e03b059cf 100644
+--- a/fs/exfat/super.c
++++ b/fs/exfat/super.c
+@@ -764,10 +764,21 @@ static int exfat_init_fs_context(struct fs_context *fc)
+ ratelimit_state_init(&sbi->ratelimit, DEFAULT_RATELIMIT_INTERVAL,
+ DEFAULT_RATELIMIT_BURST);
+
+- sbi->options.fs_uid = current_uid();
+- sbi->options.fs_gid = current_gid();
+- sbi->options.fs_fmask = current->fs->umask;
+- sbi->options.fs_dmask = current->fs->umask;
++ if (fc->purpose == FS_CONTEXT_FOR_RECONFIGURE && fc->root) {
++ struct super_block *sb = fc->root->d_sb;
++ struct exfat_mount_options *cur_opts = &EXFAT_SB(sb)->options;
++
++ sbi->options.fs_uid = cur_opts->fs_uid;
++ sbi->options.fs_gid = cur_opts->fs_gid;
++ sbi->options.fs_fmask = cur_opts->fs_fmask;
++ sbi->options.fs_dmask = cur_opts->fs_dmask;
++ } else {
++ sbi->options.fs_uid = current_uid();
++ sbi->options.fs_gid = current_gid();
++ sbi->options.fs_fmask = current->fs->umask;
++ sbi->options.fs_dmask = current->fs->umask;
++ }
++
+ sbi->options.allow_utime = -1;
+ sbi->options.iocharset = exfat_default_iocharset;
+ sbi->options.errors = EXFAT_ERRORS_RO;
+--
+2.51.0
+
--- /dev/null
+From feac99df61f77b2bd225d0a69c3085c99f745ac8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Oct 2025 09:56:26 +0800
+Subject: firmware: imx: scu-irq: Init workqueue before request mbox channel
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit 81fb53feb66a3aefbf6fcab73bb8d06f5b0c54ad ]
+
+With mailbox channel requested, there is possibility that interrupts may
+come in, so need to make sure the workqueue is initialized before
+the queue is scheduled by mailbox rx callback.
+
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/imx/imx-scu-irq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/imx/imx-scu-irq.c b/drivers/firmware/imx/imx-scu-irq.c
+index f2b902e95b73..b9f6128d56f7 100644
+--- a/drivers/firmware/imx/imx-scu-irq.c
++++ b/drivers/firmware/imx/imx-scu-irq.c
+@@ -214,6 +214,8 @@ int imx_scu_enable_general_irq_channel(struct device *dev)
+ cl->dev = dev;
+ cl->rx_callback = imx_scu_irq_callback;
+
++ INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler);
++
+ /* SCU general IRQ uses general interrupt channel 3 */
+ ch = mbox_request_channel_byname(cl, "gip3");
+ if (IS_ERR(ch)) {
+@@ -223,8 +225,6 @@ int imx_scu_enable_general_irq_channel(struct device *dev)
+ return ret;
+ }
+
+- INIT_WORK(&imx_sc_irq_work, imx_scu_irq_work_handler);
+-
+ if (!of_parse_phandle_with_args(dev->of_node, "mboxes",
+ "#mbox-cells", 0, &spec)) {
+ i = of_alias_get_id(spec.np, "mu");
+--
+2.51.0
+
--- /dev/null
+From 5aa8f338c94d6c73f5c4f39665175d6f15523871 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Oct 2025 00:21:18 +0200
+Subject: fuse: Always flush the page cache before FOPEN_DIRECT_IO write
+
+From: Bernd Schubert <bschubert@ddn.com>
+
+[ Upstream commit 1ce120dcefc056ce8af2486cebbb77a458aad4c3 ]
+
+This was done as condition on direct_io_allow_mmap, but I believe
+this is not right, as a file might be open two times - once with
+write-back enabled another time with FOPEN_DIRECT_IO.
+
+Signed-off-by: Bernd Schubert <bschubert@ddn.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fuse/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 2055af1ffaf3..1dd9ef5398d7 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -1463,7 +1463,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter,
+ if (!ia)
+ return -ENOMEM;
+
+- if (fopen_direct_io && fc->direct_io_allow_mmap) {
++ if (fopen_direct_io) {
+ res = filemap_write_and_wait_range(mapping, pos, pos + count - 1);
+ if (res) {
+ fuse_io_free(ia);
+--
+2.51.0
+
--- /dev/null
+From 2dcc501014f84bc50e9f6c61b35dff082e6e5569 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Oct 2025 00:21:17 +0200
+Subject: fuse: Invalidate the page cache after FOPEN_DIRECT_IO write
+
+From: Bernd Schubert <bschubert@ddn.com>
+
+[ Upstream commit b359af8275a982a458e8df6c6beab1415be1f795 ]
+
+generic_file_direct_write() also does this and has a large
+comment about.
+
+Reproducer here is xfstest's generic/209, which is exactly to
+have competing DIO write and cached IO read.
+
+Signed-off-by: Bernd Schubert <bschubert@ddn.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fuse/file.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 1dd9ef5398d7..ae62f47ef004 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -1537,6 +1537,15 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter,
+ if (res > 0)
+ *ppos = pos;
+
++ if (res > 0 && write && fopen_direct_io) {
++ /*
++ * As in generic_file_direct_write(), invalidate after the
++ * write, to invalidate read-ahead cache that may have competed
++ * with the write.
++ */
++ invalidate_inode_pages2_range(mapping, idx_from, idx_to);
++ }
++
+ return res > 0 ? res : err;
+ }
+ EXPORT_SYMBOL_GPL(fuse_direct_io);
+--
+2.51.0
+
--- /dev/null
+From 1e8eed7b529e23511ff61e8e8ec7c6e15f8159e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Oct 2025 15:57:14 +0800
+Subject: i2c: designware: Disable SMBus interrupts to prevent storms from
+ mis-configured firmware
+
+From: Jinhui Guo <guojinhui.liam@bytedance.com>
+
+[ Upstream commit d3429178ee51dd7155445d15a5ab87a45fae3c73 ]
+
+When probing the I2C master, disable SMBus interrupts to prevent
+storms caused by broken firmware mis-configuring IC_SMBUS=1; the
+handler never services them and a mis-configured SMBUS Master
+extend-clock timeout or SMBUS Slave extend-clock timeout can
+flood the CPU.
+
+Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Link: https://lore.kernel.org/r/20251021075714.3712-2-guojinhui.liam@bytedance.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-designware-core.h | 1 +
+ drivers/i2c/busses/i2c-designware-master.c | 7 +++++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h
+index e93870a0f9a4..f8feae20a7b2 100644
+--- a/drivers/i2c/busses/i2c-designware-core.h
++++ b/drivers/i2c/busses/i2c-designware-core.h
+@@ -79,6 +79,7 @@
+ #define DW_IC_TX_ABRT_SOURCE 0x80
+ #define DW_IC_ENABLE_STATUS 0x9c
+ #define DW_IC_CLR_RESTART_DET 0xa8
++#define DW_IC_SMBUS_INTR_MASK 0xcc
+ #define DW_IC_COMP_PARAM_1 0xf4
+ #define DW_IC_COMP_VERSION 0xf8
+ #define DW_IC_SDA_HOLD_MIN_VERS 0x3131312A /* "111*" == v1.11* */
+diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c
+index e865869ccc50..56f124f32cac 100644
+--- a/drivers/i2c/busses/i2c-designware-master.c
++++ b/drivers/i2c/busses/i2c-designware-master.c
+@@ -184,6 +184,13 @@ static int i2c_dw_init_master(struct dw_i2c_dev *dev)
+ /* Disable the adapter */
+ __i2c_dw_disable(dev);
+
++ /*
++ * Mask SMBus interrupts to block storms from broken
++ * firmware that leaves IC_SMBUS=1; the handler never
++ * services them.
++ */
++ regmap_write(dev->map, DW_IC_SMBUS_INTR_MASK, 0);
++
+ /* Write standard speed timing parameters */
+ regmap_write(dev->map, DW_IC_SS_SCL_HCNT, dev->ss_hcnt);
+ regmap_write(dev->map, DW_IC_SS_SCL_LCNT, dev->ss_lcnt);
+--
+2.51.0
+
--- /dev/null
+From 5e5dc8ea242627a3c7c16d5a0324ba9aeda7c01c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 17:12:50 +0800
+Subject: iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc
+ complains
+
+From: Pei Xiao <xiaopei01@kylinos.cn>
+
+[ Upstream commit c9fb952360d0c78bbe98239bd6b702f05c2dbb31 ]
+
+FIELD_PREP() checks that a value fits into the available bitfield, add a
+check for step_avg to fix gcc complains.
+
+which gcc complains about:
+ drivers/iio/adc/ti_am335x_adc.c: In function 'tiadc_step_config':
+ include/linux/compiler_types.h:572:38: error: call to
+'__compiletime_assert_491' declared with attribute error: FIELD_PREP: value
+too large for the field include/linux/mfd/ti_am335x_tscadc.h:58:29: note:
+in expansion of macro 'FIELD_PREP'
+ #define STEPCONFIG_AVG(val) FIELD_PREP(GENMASK(4, 2), (val))
+ ^~~~~~~~~~
+drivers/iio/adc/ti_am335x_adc.c:127:17: note: in expansion of macro 'STEPCONFIG_AVG'
+ stepconfig = STEPCONFIG_AVG(ffs(adc_dev->step_avg[i]) - 1)
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202510102117.Jqxrw1vF-lkp@intel.com/
+Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/ti_am335x_adc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
+index 32f1f91e2720..9e009b035eb5 100644
+--- a/drivers/iio/adc/ti_am335x_adc.c
++++ b/drivers/iio/adc/ti_am335x_adc.c
+@@ -123,7 +123,7 @@ static void tiadc_step_config(struct iio_dev *indio_dev)
+
+ chan = adc_dev->channel_line[i];
+
+- if (adc_dev->step_avg[i])
++ if (adc_dev->step_avg[i] && adc_dev->step_avg[i] <= STEPCONFIG_AVG_16)
+ stepconfig = STEPCONFIG_AVG(ffs(adc_dev->step_avg[i]) - 1) |
+ STEPCONFIG_FIFO1;
+ else
+--
+2.51.0
+
--- /dev/null
+From 1708e4178c9777fb2655e50fd02d857c8abaa284 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 15:42:38 +0800
+Subject: ipmi: Fix __scan_channels() failing to rescan channels
+
+From: Jinhui Guo <guojinhui.liam@bytedance.com>
+
+[ Upstream commit 6bd30d8fc523fb880b4be548e8501bc0fe8f42d4 ]
+
+channel_handler() sets intf->channels_ready to true but never
+clears it, so __scan_channels() skips any rescan. When the BMC
+firmware changes a rescan is required. Allow it by clearing
+the flag before starting a new scan.
+
+Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
+Message-ID: <20250930074239.2353-3-guojinhui.liam@bytedance.com>
+Signed-off-by: Corey Minyard <corey@minyard.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_msghandler.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index 4619ee5c744c..fc5f9d757b94 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -613,7 +613,8 @@ static void __ipmi_bmc_unregister(struct ipmi_smi *intf);
+ static int __ipmi_bmc_register(struct ipmi_smi *intf,
+ struct ipmi_device_id *id,
+ bool guid_set, guid_t *guid, int intf_num);
+-static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id);
++static int __scan_channels(struct ipmi_smi *intf,
++ struct ipmi_device_id *id, bool rescan);
+
+
+ /*
+@@ -2665,7 +2666,7 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc,
+ if (__ipmi_bmc_register(intf, &id, guid_set, &guid, intf_num))
+ need_waiter(intf); /* Retry later on an error. */
+ else
+- __scan_channels(intf, &id);
++ __scan_channels(intf, &id, false);
+
+
+ if (!intf_set) {
+@@ -2685,7 +2686,7 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, struct bmc_device *bmc,
+ goto out_noprocessing;
+ } else if (memcmp(&bmc->fetch_id, &bmc->id, sizeof(bmc->id)))
+ /* Version info changes, scan the channels again. */
+- __scan_channels(intf, &bmc->fetch_id);
++ __scan_channels(intf, &bmc->fetch_id, true);
+
+ bmc->dyn_id_expiry = jiffies + IPMI_DYN_DEV_ID_EXPIRY;
+
+@@ -3435,10 +3436,17 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)
+ /*
+ * Must be holding intf->bmc_reg_mutex to call this.
+ */
+-static int __scan_channels(struct ipmi_smi *intf, struct ipmi_device_id *id)
++static int __scan_channels(struct ipmi_smi *intf,
++ struct ipmi_device_id *id,
++ bool rescan)
+ {
+ int rv;
+
++ if (rescan) {
++ /* Clear channels_ready to force channels rescan. */
++ intf->channels_ready = false;
++ }
++
+ if (ipmi_version_major(id) > 1
+ || (ipmi_version_major(id) == 1
+ && ipmi_version_minor(id) >= 5)) {
+@@ -3641,7 +3649,7 @@ int ipmi_add_smi(struct module *owner,
+ }
+
+ mutex_lock(&intf->bmc_reg_mutex);
+- rv = __scan_channels(intf, &id);
++ rv = __scan_channels(intf, &id, false);
+ mutex_unlock(&intf->bmc_reg_mutex);
+ if (rv)
+ goto out_err_bmc_reg;
+--
+2.51.0
+
--- /dev/null
+From 22b389391b969db583aa7703a478e0f703c382b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Sep 2025 15:42:37 +0800
+Subject: ipmi: Fix the race between __scan_channels() and deliver_response()
+
+From: Jinhui Guo <guojinhui.liam@bytedance.com>
+
+[ Upstream commit 936750fdba4c45e13bbd17f261bb140dd55f5e93 ]
+
+The race window between __scan_channels() and deliver_response() causes
+the parameters of some channels to be set to 0.
+
+1.[CPUA] __scan_channels() issues an IPMI request and waits with
+ wait_event() until all channels have been scanned.
+ wait_event() internally calls might_sleep(), which might
+ yield the CPU. (Moreover, an interrupt can preempt
+ wait_event() and force the task to yield the CPU.)
+2.[CPUB] deliver_response() is invoked when the CPU receives the
+ IPMI response. After processing a IPMI response,
+ deliver_response() directly assigns intf->wchannels to
+ intf->channel_list and sets intf->channels_ready to true.
+ However, not all channels are actually ready for use.
+3.[CPUA] Since intf->channels_ready is already true, wait_event()
+ never enters __wait_event(). __scan_channels() immediately
+ clears intf->null_user_handler and exits.
+4.[CPUB] Once intf->null_user_handler is set to NULL, deliver_response()
+ ignores further IPMI responses, leaving the remaining
+ channels zero-initialized and unusable.
+
+CPUA CPUB
+------------------------------- -----------------------------
+__scan_channels()
+ intf->null_user_handler
+ = channel_handler;
+ send_channel_info_cmd(intf,
+ 0);
+ wait_event(intf->waitq,
+ intf->channels_ready);
+ do {
+ might_sleep();
+ deliver_response()
+ channel_handler()
+ intf->channel_list =
+ intf->wchannels + set;
+ intf->channels_ready = true;
+ send_channel_info_cmd(intf,
+ intf->curr_channel);
+ if (condition)
+ break;
+ __wait_event(wq_head,
+ condition);
+ } while(0)
+ intf->null_user_handler
+ = NULL;
+ deliver_response()
+ if (!msg->user)
+ if (intf->null_user_handler)
+ rv = -EINVAL;
+ return rv;
+------------------------------- -----------------------------
+
+Fix the race between __scan_channels() and deliver_response() by
+deferring both the assignment intf->channel_list = intf->wchannels
+and the flag intf->channels_ready = true until all channels have
+been successfully scanned or until the IPMI request has failed.
+
+Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
+Message-ID: <20250930074239.2353-2-guojinhui.liam@bytedance.com>
+Signed-off-by: Corey Minyard <corey@minyard.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_msghandler.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index b7d8bf202ed2..4619ee5c744c 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -3414,8 +3414,6 @@ channel_handler(struct ipmi_smi *intf, struct ipmi_recv_msg *msg)
+ intf->channels_ready = true;
+ wake_up(&intf->waitq);
+ } else {
+- intf->channel_list = intf->wchannels + set;
+- intf->channels_ready = true;
+ rv = send_channel_info_cmd(intf, intf->curr_channel);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From b7833dbbb8351b03383698e99bfcffd4bf14aa4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Dec 2025 13:47:01 -0800
+Subject: libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit a0a4173631bfcfd3520192c0a61cf911d6a52c3a ]
+
+Passing an empty map to perf_cpu_map__max triggered a SEGV. Explicitly
+test for the empty map.
+
+Reported-by: Ingo Molnar <mingo@kernel.org>
+Closes: https://lore.kernel.org/linux-perf-users/aSwt7yzFjVJCEmVp@gmail.com/
+Tested-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Tested-by: Thomas Richter <tmricht@linux.ibm.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/perf/cpumap.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/tools/lib/perf/cpumap.c b/tools/lib/perf/cpumap.c
+index 2a5a29217374..97f76d5457b9 100644
+--- a/tools/lib/perf/cpumap.c
++++ b/tools/lib/perf/cpumap.c
+@@ -367,10 +367,12 @@ struct perf_cpu perf_cpu_map__max(const struct perf_cpu_map *map)
+ .cpu = -1
+ };
+
+- // cpu_map__trim_new() qsort()s it, cpu_map__default_new() sorts it as well.
+- return __perf_cpu_map__nr(map) > 0
+- ? __perf_cpu_map__cpu(map, __perf_cpu_map__nr(map) - 1)
+- : result;
++ if (!map)
++ return result;
++
++ // The CPUs are always sorted and nr is always > 0 as 0 length map is
++ // encoded as NULL.
++ return __perf_cpu_map__cpu(map, __perf_cpu_map__nr(map) - 1);
+ }
+
+ /** Is 'b' a subset of 'a'. */
+--
+2.51.0
+
--- /dev/null
+From dbc55d9efb97fe5346430f7bb065cce5ff9f77fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 11:05:45 +0100
+Subject: nvme-fc: don't hold rport lock when putting ctrl
+
+From: Daniel Wagner <wagi@kernel.org>
+
+[ Upstream commit b71cbcf7d170e51148d5467820ae8a72febcb651 ]
+
+nvme_fc_ctrl_put can acquire the rport lock when freeing the
+ctrl object:
+
+nvme_fc_ctrl_put
+ nvme_fc_ctrl_free
+ spin_lock_irqsave(rport->lock)
+
+Thus we can't hold the rport lock when calling nvme_fc_ctrl_put.
+
+Justin suggested use the safe list iterator variant because
+nvme_fc_ctrl_put will also modify the rport->list.
+
+Cc: Justin Tee <justin.tee@broadcom.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Daniel Wagner <wagi@kernel.org>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 37fede155b92..2954f0a27474 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -1462,14 +1462,14 @@ nvme_fc_match_disconn_ls(struct nvme_fc_rport *rport,
+ {
+ struct fcnvme_ls_disconnect_assoc_rqst *rqst =
+ &lsop->rqstbuf->rq_dis_assoc;
+- struct nvme_fc_ctrl *ctrl, *ret = NULL;
++ struct nvme_fc_ctrl *ctrl, *tmp, *ret = NULL;
+ struct nvmefc_ls_rcv_op *oldls = NULL;
+ u64 association_id = be64_to_cpu(rqst->associd.association_id);
+ unsigned long flags;
+
+ spin_lock_irqsave(&rport->lock, flags);
+
+- list_for_each_entry(ctrl, &rport->ctrl_list, ctrl_list) {
++ list_for_each_entry_safe(ctrl, tmp, &rport->ctrl_list, ctrl_list) {
+ if (!nvme_fc_ctrl_get(ctrl))
+ continue;
+ spin_lock(&ctrl->lock);
+@@ -1482,7 +1482,9 @@ nvme_fc_match_disconn_ls(struct nvme_fc_rport *rport,
+ if (ret)
+ /* leave the ctrl get reference */
+ break;
++ spin_unlock_irqrestore(&rport->lock, flags);
+ nvme_fc_ctrl_put(ctrl);
++ spin_lock_irqsave(&rport->lock, flags);
+ }
+
+ spin_unlock_irqrestore(&rport->lock, flags);
+--
+2.51.0
+
--- /dev/null
+From 68e292e2eab20f03c39bd3bcfab4a85abbb9a776 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Nov 2025 15:04:07 +0800
+Subject: platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI
+ quirks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+
+[ Upstream commit b169e1733cadb614e87f69d7a5ae1b186c50d313 ]
+
+Dell Pro Rugged 10/12 tablets has a reliable VGBS method.
+If VGBS is not called on boot, the on-screen keyboard won't appear if the
+device is booted without a keyboard.
+
+Call VGBS on boot on thess devices to get the initial state of
+SW_TABLET_MODE in a reliable way.
+
+Signed-off-by: Chia-Lin Kao (AceLan) <acelan.kao@canonical.com>
+Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Link: https://patch.msgid.link/20251127070407.656463-1-acelan.kao@canonical.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/hid.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c
+index 36209997ba98..ac88119a73b8 100644
+--- a/drivers/platform/x86/intel/hid.c
++++ b/drivers/platform/x86/intel/hid.c
+@@ -163,6 +163,18 @@ static const struct dmi_system_id dmi_vgbs_allow_list[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP Elite Dragonfly G2 Notebook PC"),
+ },
+ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro Rugged 10 Tablet RA00260"),
++ },
++ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Dell Pro Rugged 12 Tablet RA02260"),
++ },
++ },
+ { }
+ };
+
+--
+2.51.0
+
--- /dev/null
+From a41cf5e4f90cab5f1f523d260e90695327b3e96d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Apr 2025 22:31:13 -0400
+Subject: powerpc/addnote: Fix overflow on 32-bit builds
+
+From: Ben Collins <bcollins@kernel.org>
+
+[ Upstream commit 825ce89a3ef17f84cf2c0eacfa6b8dc9fd11d13f ]
+
+The PUT_64[LB]E() macros need to cast the value to unsigned long long
+like the GET_64[LB]E() macros. Caused lots of warnings when compiled
+on 32-bit, and clobbered addresses (36-bit P4080).
+
+Signed-off-by: Ben Collins <bcollins@kernel.org>
+Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
+Link: https://patch.msgid.link/2025042122-mustard-wrasse-694572@boujee-and-buff
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/addnote.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/boot/addnote.c b/arch/powerpc/boot/addnote.c
+index 53b3b2621457..78704927453a 100644
+--- a/arch/powerpc/boot/addnote.c
++++ b/arch/powerpc/boot/addnote.c
+@@ -68,8 +68,8 @@ static int e_class = ELFCLASS32;
+ #define PUT_16BE(off, v)(buf[off] = ((v) >> 8) & 0xff, \
+ buf[(off) + 1] = (v) & 0xff)
+ #define PUT_32BE(off, v)(PUT_16BE((off), (v) >> 16L), PUT_16BE((off) + 2, (v)))
+-#define PUT_64BE(off, v)((PUT_32BE((off), (v) >> 32L), \
+- PUT_32BE((off) + 4, (v))))
++#define PUT_64BE(off, v)((PUT_32BE((off), (unsigned long long)(v) >> 32L), \
++ PUT_32BE((off) + 4, (unsigned long long)(v))))
+
+ #define GET_16LE(off) ((buf[off]) + (buf[(off)+1] << 8))
+ #define GET_32LE(off) (GET_16LE(off) + (GET_16LE((off)+2U) << 16U))
+@@ -78,7 +78,8 @@ static int e_class = ELFCLASS32;
+ #define PUT_16LE(off, v) (buf[off] = (v) & 0xff, \
+ buf[(off) + 1] = ((v) >> 8) & 0xff)
+ #define PUT_32LE(off, v) (PUT_16LE((off), (v)), PUT_16LE((off) + 2, (v) >> 16L))
+-#define PUT_64LE(off, v) (PUT_32LE((off), (v)), PUT_32LE((off) + 4, (v) >> 32L))
++#define PUT_64LE(off, v) (PUT_32LE((off), (unsigned long long)(v)), \
++ PUT_32LE((off) + 4, (unsigned long long)(v) >> 32L))
+
+ #define GET_16(off) (e_data == ELFDATA2MSB ? GET_16BE(off) : GET_16LE(off))
+ #define GET_32(off) (e_data == ELFDATA2MSB ? GET_32BE(off) : GET_32LE(off))
+--
+2.51.0
+
--- /dev/null
+From 25f485e8747d4ed0ec51de91f3b8a1f43d24f59f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 14:10:37 +0800
+Subject: reset: fix BIT macro reference
+
+From: Encrow Thorne <jyc0019@gmail.com>
+
+[ Upstream commit f3d8b64ee46c9b4b0b82b1a4642027728bac95b8 ]
+
+RESET_CONTROL_FLAGS_BIT_* macros use BIT(), but reset.h does not
+include bits.h. This causes compilation errors when including
+reset.h standalone.
+
+Include bits.h to make reset.h self-contained.
+
+Suggested-by: Troy Mitchell <troy.mitchell@linux.dev>
+Reviewed-by: Troy Mitchell <troy.mitchell@linux.dev>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Encrow Thorne <jyc0019@gmail.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/reset.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/linux/reset.h b/include/linux/reset.h
+index 514ddf003efc..4b31d683776e 100644
+--- a/include/linux/reset.h
++++ b/include/linux/reset.h
+@@ -2,6 +2,7 @@
+ #ifndef _LINUX_RESET_H_
+ #define _LINUX_RESET_H_
+
++#include <linux/bits.h>
+ #include <linux/err.h>
+ #include <linux/errno.h>
+ #include <linux/types.h>
+--
+2.51.0
+
--- /dev/null
+From c7368cf4f01d64a71152e63b13fe715ea74feb3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 10:48:45 -0500
+Subject: scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive
+
+From: Tony Battersby <tonyb@cybernetics.com>
+
+[ Upstream commit 8f58fc64d559b5fda1b0a5e2a71422be61e79ab9 ]
+
+When given the module parameter qlini_mode=exclusive, qla2xxx in
+initiator mode is initially unable to successfully send SCSI commands to
+devices it finds while scanning, resulting in an escalating series of
+resets until an adapter reset clears the issue. Fix by checking the
+active mode instead of the module parameter.
+
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Link: https://patch.msgid.link/1715ec14-ba9a-45dc-9cf2-d41aa6b81b5e@cybernetics.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_os.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 0a3a5af67f0a..4c7cf581bc86 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -3459,13 +3459,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ ha->mqenable = 0;
+
+ if (ha->mqenable) {
+- bool startit = false;
+-
+- if (QLA_TGT_MODE_ENABLED())
+- startit = false;
+-
+- if (ql2x_ini_mode == QLA2XXX_INI_MODE_ENABLED)
+- startit = true;
++ bool startit = !!(host->active_mode & MODE_INITIATOR);
+
+ /* Create start of day qpairs for Block MQ */
+ for (i = 0; i < ha->max_qpairs; i++)
+--
+2.51.0
+
--- /dev/null
+From 8b535bc7d9c6f90d364195cb40d37ac3613da71a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 10:50:05 -0500
+Subject: scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled
+
+From: Tony Battersby <tonyb@cybernetics.com>
+
+[ Upstream commit 4f6aaade2a22ac428fa99ed716cf2b87e79c9837 ]
+
+When qla2xxx is loaded with qlini_mode=disabled,
+ha->flags.disable_msix_handshake is used before it is set, resulting in
+the wrong interrupt handler being used on certain HBAs
+(qla2xxx_msix_rsp_q_hs() is used when qla2xxx_msix_rsp_q() should be
+used). The only difference between these two interrupt handlers is that
+the _hs() version writes to a register to clear the "RISC" interrupt,
+whereas the other version does not. So this bug results in the RISC
+interrupt being cleared when it should not be. This occasionally causes
+a different interrupt handler qla24xx_msix_default() for a different
+vector to see ((stat & HSRX_RISC_INT) == 0) and ignore its interrupt,
+which then causes problems like:
+
+qla2xxx [0000:02:00.0]-d04c:6: MBX Command timeout for cmd 20,
+ iocontrol=8 jiffies=1090c0300 mb[0-3]=[0x4000 0x0 0x40 0xda] mb7 0x500
+ host_status 0x40000010 hccr 0x3f00
+qla2xxx [0000:02:00.0]-101e:6: Mailbox cmd timeout occurred, cmd=0x20,
+ mb[0]=0x20. Scheduling ISP abort
+(the cmd varies; sometimes it is 0x20, 0x22, 0x54, 0x5a, 0x5d, or 0x6a)
+
+This problem can be reproduced with a 16 or 32 Gbps HBA by loading
+qla2xxx with qlini_mode=disabled and running a high IOPS test while
+triggering frequent RSCN database change events.
+
+While analyzing the problem I discovered that even with
+disable_msix_handshake forced to 0, it is not necessary to clear the
+RISC interrupt from qla2xxx_msix_rsp_q_hs() (more below). So just
+completely remove qla2xxx_msix_rsp_q_hs() and the logic for selecting
+it, which also fixes the bug with qlini_mode=disabled.
+
+The test below describes the justification for not needing
+qla2xxx_msix_rsp_q_hs():
+
+Force disable_msix_handshake to 0:
+qla24xx_config_rings():
+if (0 && (ha->fw_attributes & BIT_6) && (IS_MSIX_NACK_CAPABLE(ha)) &&
+ (ha->flags.msix_enabled)) {
+
+In qla24xx_msix_rsp_q() and qla2xxx_msix_rsp_q_hs(), check:
+ (rd_reg_dword(®->host_status) & HSRX_RISC_INT)
+
+Count the number of calls to each function with HSRX_RISC_INT set and
+the number with HSRX_RISC_INT not set while performing some I/O.
+
+If qla2xxx_msix_rsp_q_hs() clears the RISC interrupt (original code):
+qla24xx_msix_rsp_q: 50% of calls have HSRX_RISC_INT set
+qla2xxx_msix_rsp_q_hs: 5% of calls have HSRX_RISC_INT set
+(# of qla2xxx_msix_rsp_q_hs interrupts) =
+ (# of qla24xx_msix_rsp_q interrupts) * 3
+
+If qla2xxx_msix_rsp_q_hs() does not clear the RISC interrupt (patched
+code):
+qla24xx_msix_rsp_q: 100% of calls have HSRX_RISC_INT set
+qla2xxx_msix_rsp_q_hs: 9% of calls have HSRX_RISC_INT set
+(# of qla2xxx_msix_rsp_q_hs interrupts) =
+ (# of qla24xx_msix_rsp_q interrupts) * 3
+
+In the case of the original code, qla24xx_msix_rsp_q() was seeing
+HSRX_RISC_INT set only 50% of the time because qla2xxx_msix_rsp_q_hs()
+was clearing it when it shouldn't have been. In the patched code,
+qla24xx_msix_rsp_q() sees HSRX_RISC_INT set 100% of the time, which
+makes sense if that interrupt handler needs to clear the RISC interrupt
+(which it does). qla2xxx_msix_rsp_q_hs() sees HSRX_RISC_INT only 9% of
+the time, which is just overlap from the other interrupt during the
+high IOPS test.
+
+Tested with SCST on:
+QLE2742 FW:v9.08.02 (32 Gbps 2-port)
+QLE2694L FW:v9.10.11 (16 Gbps 4-port)
+QLE2694L FW:v9.08.02 (16 Gbps 4-port)
+QLE2672 FW:v8.07.12 (16 Gbps 2-port)
+both initiator and target mode
+
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Link: https://patch.msgid.link/56d378eb-14ad-49c7-bae9-c649b6c7691e@cybernetics.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_def.h | 1 -
+ drivers/scsi/qla2xxx/qla_gbl.h | 2 +-
+ drivers/scsi/qla2xxx/qla_isr.c | 32 +++-----------------------------
+ drivers/scsi/qla2xxx/qla_mid.c | 4 +---
+ 4 files changed, 5 insertions(+), 34 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
+index 78a10d4979e9..4f7248643335 100644
+--- a/drivers/scsi/qla2xxx/qla_def.h
++++ b/drivers/scsi/qla2xxx/qla_def.h
+@@ -3504,7 +3504,6 @@ struct isp_operations {
+ #define QLA_MSIX_RSP_Q 0x01
+ #define QLA_ATIO_VECTOR 0x02
+ #define QLA_MSIX_QPAIR_MULTIQ_RSP_Q 0x03
+-#define QLA_MSIX_QPAIR_MULTIQ_RSP_Q_HS 0x04
+
+ #define QLA_MIDX_DEFAULT 0
+ #define QLA_MIDX_RSP_Q 1
+diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
+index e556f57c91af..59f448e2e319 100644
+--- a/drivers/scsi/qla2xxx/qla_gbl.h
++++ b/drivers/scsi/qla2xxx/qla_gbl.h
+@@ -768,7 +768,7 @@ extern int qla2x00_dfs_remove(scsi_qla_host_t *);
+
+ /* Globa function prototypes for multi-q */
+ extern int qla25xx_request_irq(struct qla_hw_data *, struct qla_qpair *,
+- struct qla_msix_entry *, int);
++ struct qla_msix_entry *);
+ extern int qla25xx_init_req_que(struct scsi_qla_host *, struct req_que *);
+ extern int qla25xx_init_rsp_que(struct scsi_qla_host *, struct rsp_que *);
+ extern int qla25xx_create_req_que(struct qla_hw_data *, uint16_t, uint8_t,
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index d48007e18288..a85d3a40ee49 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -4473,32 +4473,6 @@ qla2xxx_msix_rsp_q(int irq, void *dev_id)
+ return IRQ_HANDLED;
+ }
+
+-irqreturn_t
+-qla2xxx_msix_rsp_q_hs(int irq, void *dev_id)
+-{
+- struct qla_hw_data *ha;
+- struct qla_qpair *qpair;
+- struct device_reg_24xx __iomem *reg;
+- unsigned long flags;
+-
+- qpair = dev_id;
+- if (!qpair) {
+- ql_log(ql_log_info, NULL, 0x505b,
+- "%s: NULL response queue pointer.\n", __func__);
+- return IRQ_NONE;
+- }
+- ha = qpair->hw;
+-
+- reg = &ha->iobase->isp24;
+- spin_lock_irqsave(&ha->hardware_lock, flags);
+- wrt_reg_dword(®->hccr, HCCRX_CLR_RISC_INT);
+- spin_unlock_irqrestore(&ha->hardware_lock, flags);
+-
+- queue_work(ha->wq, &qpair->q_work);
+-
+- return IRQ_HANDLED;
+-}
+-
+ /* Interrupt handling helpers. */
+
+ struct qla_init_msix_entry {
+@@ -4511,7 +4485,6 @@ static const struct qla_init_msix_entry msix_entries[] = {
+ { "rsp_q", qla24xx_msix_rsp_q },
+ { "atio_q", qla83xx_msix_atio_q },
+ { "qpair_multiq", qla2xxx_msix_rsp_q },
+- { "qpair_multiq_hs", qla2xxx_msix_rsp_q_hs },
+ };
+
+ static const struct qla_init_msix_entry qla82xx_msix_entries[] = {
+@@ -4798,9 +4771,10 @@ qla2x00_free_irqs(scsi_qla_host_t *vha)
+ }
+
+ int qla25xx_request_irq(struct qla_hw_data *ha, struct qla_qpair *qpair,
+- struct qla_msix_entry *msix, int vector_type)
++ struct qla_msix_entry *msix)
+ {
+- const struct qla_init_msix_entry *intr = &msix_entries[vector_type];
++ const struct qla_init_msix_entry *intr =
++ &msix_entries[QLA_MSIX_QPAIR_MULTIQ_RSP_Q];
+ scsi_qla_host_t *vha = pci_get_drvdata(ha->pdev);
+ int ret;
+
+diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
+index 79879c4743e6..9946899dd83b 100644
+--- a/drivers/scsi/qla2xxx/qla_mid.c
++++ b/drivers/scsi/qla2xxx/qla_mid.c
+@@ -899,9 +899,7 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options,
+ rsp->options, rsp->id, rsp->rsp_q_in,
+ rsp->rsp_q_out);
+
+- ret = qla25xx_request_irq(ha, qpair, qpair->msix,
+- ha->flags.disable_msix_handshake ?
+- QLA_MSIX_QPAIR_MULTIQ_RSP_Q : QLA_MSIX_QPAIR_MULTIQ_RSP_Q_HS);
++ ret = qla25xx_request_irq(ha, qpair, qpair->msix);
+ if (ret)
+ goto que_failed;
+
+--
+2.51.0
+
--- /dev/null
+From a0d2e982f0ac92771513eeed6272dd422fc2b6f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 10:51:28 -0500
+Subject: scsi: qla2xxx: Use reinit_completion on mbx_intr_comp
+
+From: Tony Battersby <tonyb@cybernetics.com>
+
+[ Upstream commit 957aa5974989fba4ae4f807ebcb27f12796edd4d ]
+
+If a mailbox command completes immediately after
+wait_for_completion_timeout() times out, ha->mbx_intr_comp could be left
+in an inconsistent state, causing the next mailbox command not to wait
+for the hardware. Fix by reinitializing the completion before use.
+
+Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
+Link: https://patch.msgid.link/11b6485e-0bfd-4784-8f99-c06a196dad94@cybernetics.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_mbx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
+index 13b6cb1b93ac..41435e98092a 100644
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -253,6 +253,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
+ /* Issue set host interrupt command to send cmd out. */
+ ha->flags.mbox_int = 0;
+ clear_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags);
++ reinit_completion(&ha->mbx_intr_comp);
+
+ /* Unlock mbx registers and wait for interrupt */
+ ql_dbg(ql_dbg_mbx, vha, 0x100f,
+@@ -279,6 +280,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
+ "cmd=%x Timeout.\n", command);
+ spin_lock_irqsave(&ha->hardware_lock, flags);
+ clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags);
++ reinit_completion(&ha->mbx_intr_comp);
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
+ if (chip_reset != ha->chip_reset) {
+--
+2.51.0
+
--- /dev/null
+From 1f41874874cf23ccd22157098f14d93a5ebcdb42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Oct 2025 11:08:40 +0800
+Subject: serial: sprd: Return -EPROBE_DEFER when uart clock is not ready
+
+From: Wenhua Lin <Wenhua.Lin@unisoc.com>
+
+[ Upstream commit 29e8a0c587e328ed458380a45d6028adf64d7487 ]
+
+In sprd_clk_init(), when devm_clk_get() returns -EPROBE_DEFER
+for either uart or source clock, we should propagate the
+error instead of just warning and continuing with NULL clocks.
+
+Currently the driver only emits a warning when clock acquisition
+fails and proceeds with NULL clock pointers. This can lead to
+issues later when the clocks are actually needed. More importantly,
+when the clock provider is not ready yet and returns -EPROBE_DEFER,
+we should return this error to allow deferred probing.
+
+This change adds explicit checks for -EPROBE_DEFER after both:
+1. devm_clk_get(uport->dev, uart)
+2. devm_clk_get(uport->dev, source)
+
+When -EPROBE_DEFER is encountered, the function now returns
+-EPROBE_DEFER to let the driver framework retry probing
+later when the clock dependencies are resolved.
+
+Signed-off-by: Wenhua Lin <Wenhua.Lin@unisoc.com>
+Link: https://patch.msgid.link/20251022030840.956589-1-Wenhua.Lin@unisoc.com
+Reviewed-by: Cixi Geng <cixi.geng@linux.dev>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/sprd_serial.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c
+index f328fa57231f..c6d2258d719b 100644
+--- a/drivers/tty/serial/sprd_serial.c
++++ b/drivers/tty/serial/sprd_serial.c
+@@ -1111,6 +1111,9 @@ static int sprd_clk_init(struct uart_port *uport)
+
+ clk_uart = devm_clk_get(uport->dev, "uart");
+ if (IS_ERR(clk_uart)) {
++ if (PTR_ERR(clk_uart) == -EPROBE_DEFER)
++ return -EPROBE_DEFER;
++
+ dev_warn(uport->dev, "uart%d can't get uart clock\n",
+ uport->line);
+ clk_uart = NULL;
+@@ -1118,6 +1121,9 @@ static int sprd_clk_init(struct uart_port *uport)
+
+ clk_parent = devm_clk_get(uport->dev, "source");
+ if (IS_ERR(clk_parent)) {
++ if (PTR_ERR(clk_parent) == -EPROBE_DEFER)
++ return -EPROBE_DEFER;
++
+ dev_warn(uport->dev, "uart%d can't get source clock\n",
+ uport->line);
+ clk_parent = NULL;
+--
+2.51.0
+
mmc-sdhci-esdhc-imx-add-alternate-arch_s32-dependency-to-kconfig.patch
dt-bindings-mmc-sdhci-of-aspeed-switch-ref-to-sdhci-common.yaml.patch
net-hsr-fix-null-pointer-dereference-in-prp_get_untagged_frame.patch
+alsa-vxpocket-fix-resource-leak-in-vxpocket_probe-er.patch
+alsa-pcmcia-fix-resource-leak-in-snd_pdacf_probe-err.patch
+alsa-usb-mixer-us16x08-validate-meter-packet-indices.patch
+ipmi-fix-the-race-between-__scan_channels-and-delive.patch
+ipmi-fix-__scan_channels-failing-to-rescan-channels.patch
+firmware-imx-scu-irq-init-workqueue-before-request-m.patch
+ti-sysc-allow-omap2-and-omap4-timers-to-be-reserved-.patch
+clk-mvebu-cp110-add-clk_ignore_unused-to-pcie_x10-pc.patch
+powerpc-addnote-fix-overflow-on-32-bit-builds.patch
+scsi-qla2xxx-fix-lost-interrupts-with-qlini_mode-dis.patch
+scsi-qla2xxx-fix-initiator-mode-with-qlini_mode-excl.patch
+scsi-qla2xxx-use-reinit_completion-on-mbx_intr_comp.patch
+fuse-always-flush-the-page-cache-before-fopen_direct.patch
+fuse-invalidate-the-page-cache-after-fopen_direct_io.patch
+via_wdt-fix-critical-boot-hang-due-to-unnamed-resour.patch
+reset-fix-bit-macro-reference.patch
+exfat-fix-remount-failure-in-different-process-envir.patch
+usbip-fix-locking-bug-in-rt-enabled-kernels.patch
+usb-typec-ucsi-handle-incorrect-num_connectors-capab.patch
+iio-adc-ti_am335x_adc-limit-step_avg-to-valid-range-.patch
+usb-xhci-limit-run_graceperiod-for-only-usb-3.0-devi.patch
+usb-usb-storage-no-additional-quirks-need-to-be-adde.patch
+serial-sprd-return-eprobe_defer-when-uart-clock-is-n.patch
+libperf-cpumap-fix-perf_cpu_map__max-for-an-empty-nu.patch
+i2c-designware-disable-smbus-interrupts-to-prevent-s.patch
+nvme-fc-don-t-hold-rport-lock-when-putting-ctrl.patch
+platform-x86-intel-hid-add-dell-pro-rugged-10-12-tab.patch
--- /dev/null
+From 5b7c02d1d6923c79ac36b5adcfc8f3e5daba4cfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 15:11:13 +0200
+Subject: ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx
+
+From: Matthias Schiffer <matthias.schiffer@tq-group.com>
+
+[ Upstream commit 3f61783920504b2cf99330b372d82914bb004d8e ]
+
+am33xx.dtsi has the same clock setup as am35xx.dtsi, setting
+ti,no-reset-on-init and ti,no-idle on timer1_target and timer2_target,
+so AM33 needs the same workaround as AM35 to avoid ti-sysc probe
+failing on certain target modules.
+
+Signed-off-by: Matthias Schiffer <matthias.schiffer@tq-group.com>
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20250825131114.2206804-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/ti-sysc.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index 46d7410f6f0f..b6a7d0d3f153 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -37,6 +37,7 @@ enum sysc_soc {
+ SOC_UNKNOWN,
+ SOC_2420,
+ SOC_2430,
++ SOC_AM33,
+ SOC_3430,
+ SOC_AM35,
+ SOC_3630,
+@@ -2996,6 +2997,7 @@ static void ti_sysc_idle(struct work_struct *work)
+ static const struct soc_device_attribute sysc_soc_match[] = {
+ SOC_FLAG("OMAP242*", SOC_2420),
+ SOC_FLAG("OMAP243*", SOC_2430),
++ SOC_FLAG("AM33*", SOC_AM33),
+ SOC_FLAG("AM35*", SOC_AM35),
+ SOC_FLAG("OMAP3[45]*", SOC_3430),
+ SOC_FLAG("OMAP3[67]*", SOC_3630),
+@@ -3201,10 +3203,15 @@ static int sysc_check_active_timer(struct sysc *ddata)
+ * can be dropped if we stop supporting old beagleboard revisions
+ * A to B4 at some point.
+ */
+- if (sysc_soc->soc == SOC_3430 || sysc_soc->soc == SOC_AM35)
++ switch (sysc_soc->soc) {
++ case SOC_AM33:
++ case SOC_3430:
++ case SOC_AM35:
+ error = -ENXIO;
+- else
++ break;
++ default:
+ error = -EBUSY;
++ }
+
+ if ((ddata->cfg.quirks & SYSC_QUIRK_NO_RESET_ON_INIT) &&
+ (ddata->cfg.quirks & SYSC_QUIRK_NO_IDLE))
+--
+2.51.0
+
--- /dev/null
+From 0bc3e000e9086753562b53e3ac44b9794b049ff3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 14:53:07 -0400
+Subject: usb: typec: ucsi: Handle incorrect num_connectors capability
+
+From: Mark Pearson <mpearson-lenovo@squebb.ca>
+
+[ Upstream commit 30cd2cb1abf4c4acdb1ddb468c946f68939819fb ]
+
+The UCSI spec states that the num_connectors field is 7 bits, and the
+8th bit is reserved and should be set to zero.
+Some buggy FW has been known to set this bit, and it can lead to a
+system not booting.
+Flag that the FW is not behaving correctly, and auto-fix the value
+so that the system boots correctly.
+
+Found on Lenovo P1 G8 during Linux enablement program. The FW will
+be fixed, but seemed worth addressing in case it hit platforms that
+aren't officially Linux supported.
+
+Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20250821185319.2585023-1-mpearson-lenovo@squebb.ca
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/ucsi/ucsi.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
+index e5c001ee0cd7..b88f4e179a7a 100644
+--- a/drivers/usb/typec/ucsi/ucsi.c
++++ b/drivers/usb/typec/ucsi/ucsi.c
+@@ -1428,6 +1428,12 @@ static int ucsi_init(struct ucsi *ucsi)
+ ret = -ENODEV;
+ goto err_reset;
+ }
++ /* Check if reserved bit set. This is out of spec but happens in buggy FW */
++ if (ucsi->cap.num_connectors & 0x80) {
++ dev_warn(ucsi->dev, "UCSI: Invalid num_connectors %d. Likely buggy FW\n",
++ ucsi->cap.num_connectors);
++ ucsi->cap.num_connectors &= 0x7f; // clear bit and carry on
++ }
+
+ /* Allocate the connectors. Released in ucsi_unregister() */
+ connector = kcalloc(ucsi->cap.num_connectors + 1, sizeof(*connector), GFP_KERNEL);
+--
+2.51.0
+
--- /dev/null
+From 68ea06da4ab0386ab681e6ee9acfd5dbffde32a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 14:40:20 +0800
+Subject: usb: usb-storage: No additional quirks need to be added to the EL-R12
+ optical drive.
+
+From: Chen Changcheng <chenchangcheng@kylinos.cn>
+
+[ Upstream commit 955a48a5353f4fe009704a9a4272a3adf627cd35 ]
+
+The optical drive of EL-R12 has the same vid and pid as INIC-3069,
+as follows:
+T: Bus=02 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#= 3 Spd=5000 MxCh= 0
+D: Ver= 3.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
+P: Vendor=13fd ProdID=3940 Rev= 3.10
+S: Manufacturer=HL-DT-ST
+S: Product= DVD+-RW GT80N
+S: SerialNumber=423349524E4E38303338323439202020
+C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=144mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=02 Prot=50 Driver=usb-storage
+E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=0a(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+
+This will result in the optical drive device also adding
+the quirks of US_FL_NO_ATA_1X. When performing an erase operation,
+it will fail, and the reason for the failure is as follows:
+[ 388.967742] sr 5:0:0:0: [sr0] tag#0 Send: scmd 0x00000000d20c33a7
+[ 388.967742] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00
+[ 388.967773] sr 5:0:0:0: [sr0] tag#0 Done: SUCCESS Result: hostbyte=DID_TARGET_FAILURE driverbyte=DRIVER_OK cmd_age=0s
+[ 388.967773] sr 5:0:0:0: [sr0] tag#0 CDB: ATA command pass through(12)/Blank a1 11 00 00 00 00 00 00 00 00 00 00
+[ 388.967803] sr 5:0:0:0: [sr0] tag#0 Sense Key : Illegal Request [current]
+[ 388.967803] sr 5:0:0:0: [sr0] tag#0 Add. Sense: Invalid field in cdb
+[ 388.967803] sr 5:0:0:0: [sr0] tag#0 scsi host busy 1 failed 0
+[ 388.967803] sr 5:0:0:0: Notifying upper driver of completion (result 8100002)
+[ 388.967834] sr 5:0:0:0: [sr0] tag#0 0 sectors total, 0 bytes done.
+
+For the EL-R12 standard optical drive, all operational commands
+and usage scenarios were tested without adding the IGNORE_RESIDUE quirks,
+and no issues were encountered. It can be reasonably concluded
+that removing the IGNORE_RESIDUE quirks has no impact.
+
+Signed-off-by: Chen Changcheng <chenchangcheng@kylinos.cn>
+Link: https://patch.msgid.link/20251121064020.29332-1-chenchangcheng@kylinos.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/storage/unusual_uas.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index 1477e31d7763..b695f5ba9a40 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -98,7 +98,7 @@ UNUSUAL_DEV(0x125f, 0xa94a, 0x0160, 0x0160,
+ US_FL_NO_ATA_1X),
+
+ /* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
+-UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
++UNUSUAL_DEV(0x13fd, 0x3940, 0x0309, 0x0309,
+ "Initio Corporation",
+ "INIC-3069",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+--
+2.51.0
+
--- /dev/null
+From fe368d1c05fe1b610105d55e6db027f425f71e52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Nov 2025 16:23:55 +0200
+Subject: usb: xhci: limit run_graceperiod for only usb 3.0 devices
+
+From: Hongyu Xie <xiehongyu1@kylinos.cn>
+
+[ Upstream commit 8d34983720155b8f05de765f0183d9b0e1345cc0 ]
+
+run_graceperiod blocks usb 2.0 devices from auto suspending after
+xhci_start for 500ms.
+
+Log shows:
+[ 13.387170] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100
+[ 13.387177] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.387182] hub_suspend:3903: hub 7-0:1.0: hub_suspend
+[ 13.387188] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1
+[ 13.387191] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event
+[ 13.387193] hcd_bus_resume:2303: usb usb7: usb auto-resume
+[ 13.387296] hub_event:5779: hub 3-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.393343] handle_port_status:2034: xhci-hcd PNP0D10:02: handle_port_status: starting usb5 port polling.
+[ 13.393353] xhci_hub_control:1271: xhci-hcd PNP0D10:02: Get port status 5-1 read: 0x206e1, return 0x10101
+[ 13.400047] hub_suspend:3903: hub 3-0:1.0: hub_suspend
+[ 13.403077] hub_resume:3948: hub 7-0:1.0: hub_resume
+[ 13.403080] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100
+[ 13.403085] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.403087] hub_suspend:3903: hub 7-0:1.0: hub_suspend
+[ 13.403090] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1
+[ 13.403093] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event
+[ 13.403095] hcd_bus_resume:2303: usb usb7: usb auto-resume
+[ 13.405002] handle_port_status:1913: xhci-hcd PNP0D10:04: Port change event, 9-1, id 1, portsc: 0x6e1
+[ 13.405016] hub_activate:1169: usb usb5-port1: status 0101 change 0001
+[ 13.405026] xhci_clear_port_change_bit:658: xhci-hcd PNP0D10:02: clear port1 connect change, portsc: 0x6e1
+[ 13.413275] hcd_bus_suspend:2250: usb usb3: bus auto-suspend, wakeup 1
+[ 13.419081] hub_resume:3948: hub 7-0:1.0: hub_resume
+[ 13.419086] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100
+[ 13.419095] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.419100] hub_suspend:3903: hub 7-0:1.0: hub_suspend
+[ 13.419106] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1
+[ 13.419110] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event
+[ 13.419112] hcd_bus_resume:2303: usb usb7: usb auto-resume
+[ 13.420455] handle_port_status:2034: xhci-hcd PNP0D10:04: handle_port_status: starting usb9 port polling.
+[ 13.420493] handle_port_status:1913: xhci-hcd PNP0D10:05: Port change event, 10-1, id 1, portsc: 0x6e1
+[ 13.425332] hcd_bus_suspend:2279: usb usb3: suspend raced with wakeup event
+[ 13.431931] handle_port_status:2034: xhci-hcd PNP0D10:05: handle_port_status: starting usb10 port polling.
+[ 13.435080] hub_resume:3948: hub 7-0:1.0: hub_resume
+[ 13.435084] xhci_hub_control:1271: xhci-hcd PNP0D10:03: Get port status 7-1 read: 0x2a0, return 0x100
+[ 13.435092] hub_event:5779: hub 7-0:1.0: state 7 ports 1 chg 0000 evt 0000
+[ 13.435096] hub_suspend:3903: hub 7-0:1.0: hub_suspend
+[ 13.435102] hcd_bus_suspend:2250: usb usb7: bus auto-suspend, wakeup 1
+[ 13.435106] hcd_bus_suspend:2279: usb usb7: suspend raced with wakeup event
+
+usb7 and other usb 2.0 root hub were rapidly toggling between suspend
+and resume states. More, "suspend raced with wakeup event" confuses people.
+
+So, limit run_graceperiod for only usb 3.0 devices
+
+Signed-off-by: Hongyu Xie <xiehongyu1@kylinos.cn>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://patch.msgid.link/20251119142417.2820519-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-hub.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index d3d535ed00b5..61642c8d529f 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -1669,7 +1669,7 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
+ * SS devices are only visible to roothub after link training completes.
+ * Keep polling roothubs for a grace period after xHC start
+ */
+- if (xhci->run_graceperiod) {
++ if (hcd->speed >= HCD_USB3 && xhci->run_graceperiod) {
+ if (time_before(jiffies, xhci->run_graceperiod))
+ status = 1;
+ else
+--
+2.51.0
+
--- /dev/null
+From eb9c1d5d70093ac4467fd85e507101a8fb01e234 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 09:41:43 +0800
+Subject: usbip: Fix locking bug in RT-enabled kernels
+
+From: Lizhi Xu <lizhi.xu@windriver.com>
+
+[ Upstream commit 09bf21bf5249880f62fe759b53b14b4b52900c6c ]
+
+Interrupts are disabled before entering usb_hcd_giveback_urb().
+A spinlock_t becomes a sleeping lock on PREEMPT_RT, so it cannot be
+acquired with disabled interrupts.
+
+Save the interrupt status and restore it after usb_hcd_giveback_urb().
+
+syz reported:
+BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
+Call Trace:
+ dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
+ rt_spin_lock+0xc7/0x2c0 kernel/locking/spinlock_rt.c:57
+ spin_lock include/linux/spinlock_rt.h:44 [inline]
+ mon_bus_complete drivers/usb/mon/mon_main.c:134 [inline]
+ mon_complete+0x5c/0x200 drivers/usb/mon/mon_main.c:147
+ usbmon_urb_complete include/linux/usb/hcd.h:738 [inline]
+ __usb_hcd_giveback_urb+0x254/0x5e0 drivers/usb/core/hcd.c:1647
+ vhci_urb_enqueue+0xb4f/0xe70 drivers/usb/usbip/vhci_hcd.c:818
+
+Reported-by: syzbot+205ef33a3b636b4181fb@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=205ef33a3b636b4181fb
+Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20250916014143.1439759-1-lizhi.xu@windriver.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/usbip/vhci_hcd.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
+index b22e0881bfaf..0bc4805cfa3e 100644
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -830,15 +830,15 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
+ no_need_xmit:
+ usb_hcd_unlink_urb_from_ep(hcd, urb);
+ no_need_unlink:
+- spin_unlock_irqrestore(&vhci->lock, flags);
+ if (!ret) {
+ /* usb_hcd_giveback_urb() should be called with
+ * irqs disabled
+ */
+- local_irq_disable();
++ spin_unlock(&vhci->lock);
+ usb_hcd_giveback_urb(hcd, urb, urb->status);
+- local_irq_enable();
++ spin_lock(&vhci->lock);
+ }
++ spin_unlock_irqrestore(&vhci->lock, flags);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 878a2ac28d544f6aca2aca19f16b34ccd6d0ef9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Sep 2025 16:33:32 +0800
+Subject: via_wdt: fix critical boot hang due to unnamed resource allocation
+
+From: Li Qiang <liqiang01@kylinos.cn>
+
+[ Upstream commit 7aa31ee9ec92915926e74731378c009c9cc04928 ]
+
+The VIA watchdog driver uses allocate_resource() to reserve a MMIO
+region for the watchdog control register. However, the allocated
+resource was not given a name, which causes the kernel resource tree
+to contain an entry marked as "<BAD>" under /proc/iomem on x86
+platforms.
+
+During boot, this unnamed resource can lead to a critical hang because
+subsequent resource lookups and conflict checks fail to handle the
+invalid entry properly.
+
+Signed-off-by: Li Qiang <liqiang01@kylinos.cn>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/via_wdt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/watchdog/via_wdt.c b/drivers/watchdog/via_wdt.c
+index eeb39f96e72e..c1ed3ce153cf 100644
+--- a/drivers/watchdog/via_wdt.c
++++ b/drivers/watchdog/via_wdt.c
+@@ -165,6 +165,7 @@ static int wdt_probe(struct pci_dev *pdev,
+ dev_err(&pdev->dev, "cannot enable PCI device\n");
+ return -ENODEV;
+ }
++ wdt_res.name = "via_wdt";
+
+ /*
+ * Allocate a MMIO region which contains watchdog control register
+--
+2.51.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
