--- /dev/null
+From 255dbef42783c943c678f1052b5d6af05a634855 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 08:14:57 +0000
+Subject: alpha: don't reference obsolete termio struct for TC* constants
+
+From: Sam James <sam@gentoo.org>
+
+[ Upstream commit 9aeed9041929812a10a6d693af050846942a1d16 ]
+
+Similar in nature to ab107276607af90b13a5994997e19b7b9731e251. glibc-2.42
+drops the legacy termio struct, but the ioctls.h header still defines some
+TC* constants in terms of termio (via sizeof). Hardcode the values instead.
+
+This fixes building Python for example, which falls over like:
+ ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio'
+
+Link: https://bugs.gentoo.org/961769
+Link: https://bugs.gentoo.org/962600
+Signed-off-by: Sam James <sam@gentoo.org>
+Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
+Link: https://lore.kernel.org/r/6ebd3451908785cad53b50ca6bc46cfe9d6bc03c.1764922497.git.sam@gentoo.org
+Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/alpha/include/uapi/asm/ioctls.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/alpha/include/uapi/asm/ioctls.h b/arch/alpha/include/uapi/asm/ioctls.h
+index 971311605288f..a09d04b49cc65 100644
+--- a/arch/alpha/include/uapi/asm/ioctls.h
++++ b/arch/alpha/include/uapi/asm/ioctls.h
+@@ -23,10 +23,10 @@
+ #define TCSETSW _IOW('t', 21, struct termios)
+ #define TCSETSF _IOW('t', 22, struct termios)
+
+-#define TCGETA _IOR('t', 23, struct termio)
+-#define TCSETA _IOW('t', 24, struct termio)
+-#define TCSETAW _IOW('t', 25, struct termio)
+-#define TCSETAF _IOW('t', 28, struct termio)
++#define TCGETA 0x40127417
++#define TCSETA 0x80127418
++#define TCSETAW 0x80127419
++#define TCSETAF 0x8012741c
+
+ #define TCSBRK _IO('t', 29)
+ #define TCXONC _IO('t', 30)
+--
+2.51.0
+
--- /dev/null
+From c7e98b7c971a23cbbcdf61eb409e01116a4be49f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Nov 2025 16:54:37 +0100
+Subject: ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit fedadc4137234c3d00c4785eeed3e747fe9036ae ]
+
+gup_pgd_range() is invoked with disabled interrupts and invokes
+__kmap_local_page_prot() via pte_offset_map(), gup_p4d_range().
+With HIGHPTE enabled, __kmap_local_page_prot() invokes kmap_high_get()
+which uses a spinlock_t via lock_kmap_any(). This leads to an
+sleeping-while-atomic error on PREEMPT_RT because spinlock_t becomes a
+sleeping lock and must not be acquired in atomic context.
+
+The loop in map_new_virtual() uses wait_queue_head_t for wake up which
+also is using a spinlock_t.
+
+Since HIGHPTE is rarely needed at all, turn it off for PREEMPT_RT
+to allow the use of get_user_pages_fast().
+
+[arnd: rework patch to turn off HIGHPTE instead of HAVE_PAST_GUP]
+
+Co-developed-by: Arnd Bergmann <arnd@arndb.de>
+
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 335308aff6ce0..05fc9c6ee8c5b 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -1513,7 +1513,7 @@ config HIGHMEM
+
+ config HIGHPTE
+ bool "Allocate 2nd-level pagetables from highmem" if EXPERT
+- depends on HIGHMEM
++ depends on HIGHMEM && !PREEMPT_RT
+ default y
+ help
+ The VM uses one page of physical memory for each page table.
+--
+2.51.0
+
--- /dev/null
+From d7117b2cd5ad3f92fef9e94cf8bfdab2a1b1a847 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 18:56:46 -0500
+Subject: NFS: Fix up the automount fs_context to use the correct cred
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit a2a8fc27dd668e7562b5326b5ed2f1604cb1e2e9 ]
+
+When automounting, the fs_context should be fixed up to use the cred
+from the parent filesystem, since the operation is just extending the
+namespace. Authorisation to enter that namespace will already have been
+provided by the preceding lookup.
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/namespace.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
+index d205598cdc457..fc9f7b9cbf53b 100644
+--- a/fs/nfs/namespace.c
++++ b/fs/nfs/namespace.c
+@@ -170,6 +170,11 @@ struct vfsmount *nfs_d_automount(struct path *path)
+ if (!ctx->clone_data.fattr)
+ goto out_fc;
+
++ if (fc->cred != server->cred) {
++ put_cred(fc->cred);
++ fc->cred = get_cred(server->cred);
++ }
++
+ if (fc->net_ns != client->cl_net) {
+ put_net(fc->net_ns);
+ fc->net_ns = get_net(client->cl_net);
+--
+2.51.0
+
--- /dev/null
+From 182db9345c190e9a1686586c3de1d350b058784d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Nov 2025 10:44:15 -0500
+Subject: NFSv4: ensure the open stateid seqid doesn't go backwards
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+[ Upstream commit 2e47c3cc64b44b0b06cd68c2801db92ff143f2b2 ]
+
+We have observed an NFSv4 client receiving a LOCK reply with a status of
+NFS4ERR_OLD_STATEID and subsequently retrying the LOCK request with an
+earlier seqid value in the stateid. As this was for a new lockowner,
+that would imply that nfs_set_open_stateid_locked() had updated the open
+stateid seqid with an earlier value.
+
+Looking at nfs_set_open_stateid_locked(), if the incoming seqid is out
+of sequence, the task will sleep on the state->waitq for up to 5
+seconds. If the task waits for the full 5 seconds, then after finishing
+the wait it'll update the open stateid seqid with whatever value the
+incoming seqid has. If there are multiple waiters in this scenario,
+then the last one to perform said update may not be the one with the
+highest seqid.
+
+Add a check to ensure that the seqid can only be incremented, and add a
+tracepoint to indicate when old seqids are skipped.
+
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Reviewed-by: Benjamin Coddington <bcodding@hammerspace.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 13 +++++++++++--
+ fs/nfs/nfs4trace.h | 1 +
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index e3070982a909a..170e9eaf536af 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1688,8 +1688,17 @@ static void nfs_set_open_stateid_locked(struct nfs4_state *state,
+ if (nfs_stateid_is_sequential(state, stateid))
+ break;
+
+- if (status)
+- break;
++ if (status) {
++ if (nfs4_stateid_match_other(stateid, &state->open_stateid) &&
++ !nfs4_stateid_is_newer(stateid, &state->open_stateid)) {
++ trace_nfs4_open_stateid_update_skip(state->inode,
++ stateid, status);
++ return;
++ } else {
++ break;
++ }
++ }
++
+ /* Rely on seqids for serialisation with NFSv4.0 */
+ if (!nfs4_has_session(NFS_SERVER(state->inode)->nfs_client))
+ break;
+diff --git a/fs/nfs/nfs4trace.h b/fs/nfs/nfs4trace.h
+index d862df9761e77..3d538cb60593d 100644
+--- a/fs/nfs/nfs4trace.h
++++ b/fs/nfs/nfs4trace.h
+@@ -1513,6 +1513,7 @@ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_setattr);
+ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_delegreturn);
+ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update);
+ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update_wait);
++DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update_skip);
+ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_close_stateid_update_wait);
+
+ DECLARE_EVENT_CLASS(nfs4_getattr_event,
+--
+2.51.0
+
--- /dev/null
+From 8a8b5c51256a3dbfa80f32b8e084aa9e838956e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Oct 2025 09:24:26 -0500
+Subject: scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset
+
+From: Wen Xiong <wenxiong@linux.ibm.com>
+
+[ Upstream commit 6ac3484fb13b2fc7f31cfc7f56093e7d0ce646a5 ]
+
+A dynamic remove/add storage adapter test hits EEH on PowerPC:
+
+ EEH: [c00000000004f75c] __eeh_send_failure_event+0x7c/0x160
+ EEH: [c000000000048444] eeh_dev_check_failure.part.0+0x254/0x650
+ EEH: [c008000001650678] eeh_readl+0x60/0x90 [ipr]
+ EEH: [c00800000166746c] ipr_cancel_op+0x2b8/0x524 [ipr]
+ EEH: [c008000001656524] ipr_eh_abort+0x6c/0x130 [ipr]
+ EEH: [c000000000ab0d20] scmd_eh_abort_handler+0x140/0x440
+ EEH: [c00000000017e558] process_one_work+0x298/0x590
+ EEH: [c00000000017eef8] worker_thread+0xa8/0x620
+ EEH: [c00000000018be34] kthread+0x124/0x130
+ EEH: [c00000000000cd64] ret_from_kernel_thread+0x5c/0x64
+
+A PCIe bus trace reveals that a vector of MSI-X is cleared to 0 by
+irqbalance daemon. If we disable irqbalance daemon, we won't see the
+issue.
+
+With debug enabled in ipr driver:
+
+ [ 44.103071] ipr: Entering __ipr_remove
+ [ 44.103083] ipr: Entering ipr_initiate_ioa_bringdown
+ [ 44.103091] ipr: Entering ipr_reset_shutdown_ioa
+ [ 44.103099] ipr: Leaving ipr_reset_shutdown_ioa
+ [ 44.103105] ipr: Leaving ipr_initiate_ioa_bringdown
+ [ 44.149918] ipr: Entering ipr_reset_ucode_download
+ [ 44.149935] ipr: Entering ipr_reset_alert
+ [ 44.150032] ipr: Entering ipr_reset_start_timer
+ [ 44.150038] ipr: Leaving ipr_reset_alert
+ [ 44.244343] scsi 1:2:3:0: alua: Detached
+ [ 44.254300] ipr: Entering ipr_reset_start_bist
+ [ 44.254320] ipr: Entering ipr_reset_start_timer
+ [ 44.254325] ipr: Leaving ipr_reset_start_bist
+ [ 44.364329] scsi 1:2:4:0: alua: Detached
+ [ 45.134341] scsi 1:2:5:0: alua: Detached
+ [ 45.860949] ipr: Entering ipr_reset_shutdown_ioa
+ [ 45.860962] ipr: Leaving ipr_reset_shutdown_ioa
+ [ 45.860966] ipr: Entering ipr_reset_alert
+ [ 45.861028] ipr: Entering ipr_reset_start_timer
+ [ 45.861035] ipr: Leaving ipr_reset_alert
+ [ 45.964302] ipr: Entering ipr_reset_start_bist
+ [ 45.964309] ipr: Entering ipr_reset_start_timer
+ [ 45.964313] ipr: Leaving ipr_reset_start_bist
+ [ 46.264301] ipr: Entering ipr_reset_bist_done
+ [ 46.264309] ipr: Leaving ipr_reset_bist_done
+
+During adapter reset, ipr device driver blocks config space access but
+can't block MMIO access for MSI-X entries. There is very small window:
+irqbalance daemon kicks in during adapter reset before ipr driver calls
+pci_restore_state(pdev) to restore MSI-X table.
+
+irqbalance daemon reads back all 0 for that MSI-X vector in
+__pci_read_msi_msg().
+
+irqbalance daemon:
+
+ msi_domain_set_affinity()
+ ->irq_chip_set_affinity_patent()
+ ->xive_irq_set_affinity()
+ ->irq_chip_compose_msi_msg()
+ ->pseries_msi_compose_msg()
+ ->__pci_read_msi_msg(): read all 0 since didn't call pci_restore_state
+ ->irq_chip_write_msi_msg()
+ -> pci_write_msg_msi(): write 0 to the msix vector entry
+
+When ipr driver calls pci_restore_state(pdev) in
+ipr_reset_restore_cfg_space(), the MSI-X vector entry has been cleared
+by irqbalance daemon in pci_write_msg_msix().
+
+ pci_restore_state()
+ ->__pci_restore_msix_state()
+
+Below is the MSI-X table for ipr adapter after irqbalance daemon kicked
+in during adapter reset:
+
+ Dump MSIx table: index=0 address_lo=c800 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=1 address_lo=c810 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=2 address_lo=c820 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=3 address_lo=c830 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=4 address_lo=c840 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=5 address_lo=c850 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=6 address_lo=c860 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=7 address_lo=c870 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=8 address_lo=0 address_hi=0 msg_data=0
+ ---------> Hit EEH since msix vector of index=8 are 0
+ Dump MSIx table: index=9 address_lo=c890 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=10 address_lo=c8a0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=11 address_lo=c8b0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=12 address_lo=c8c0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=13 address_lo=c8d0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=14 address_lo=c8e0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=15 address_lo=c8f0 address_hi=10000000 msg_data=0
+
+ [ 46.264312] ipr: Entering ipr_reset_restore_cfg_space
+ [ 46.267439] ipr: Entering ipr_fail_all_ops
+ [ 46.267447] ipr: Leaving ipr_fail_all_ops
+ [ 46.267451] ipr: Leaving ipr_reset_restore_cfg_space
+ [ 46.267454] ipr: Entering ipr_ioa_bringdown_done
+ [ 46.267458] ipr: Leaving ipr_ioa_bringdown_done
+ [ 46.267467] ipr: Entering ipr_worker_thread
+ [ 46.267470] ipr: Leaving ipr_worker_thread
+
+IRQ balancing is not required during adapter reset.
+
+Enable "IRQ_NO_BALANCING" flag before starting adapter reset and disable
+it after calling pci_restore_state(). The irqbalance daemon is disabled
+for this short period of time (~2s).
+
+Co-developed-by: Kyle Mahlkuch <Kyle.Mahlkuch@ibm.com>
+Signed-off-by: Kyle Mahlkuch <Kyle.Mahlkuch@ibm.com>
+Signed-off-by: Wen Xiong <wenxiong@linux.ibm.com>
+Link: https://patch.msgid.link/20251028142427.3969819-2-wenxiong@linux.ibm.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ipr.c | 28 +++++++++++++++++++++++++++-
+ 1 file changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
+index 8c376736a8f51..4ae6b76c2c5e9 100644
+--- a/drivers/scsi/ipr.c
++++ b/drivers/scsi/ipr.c
+@@ -62,8 +62,8 @@
+ #include <linux/hdreg.h>
+ #include <linux/reboot.h>
+ #include <linux/stringify.h>
++#include <linux/irq.h>
+ #include <asm/io.h>
+-#include <asm/irq.h>
+ #include <asm/processor.h>
+ #include <scsi/scsi.h>
+ #include <scsi/scsi_host.h>
+@@ -8665,6 +8665,30 @@ static int ipr_dump_mailbox_wait(struct ipr_cmnd *ipr_cmd)
+ return IPR_RC_JOB_RETURN;
+ }
+
++/**
++ * ipr_set_affinity_nobalance
++ * @ioa_cfg: ipr_ioa_cfg struct for an ipr device
++ * @flag: bool
++ * true: ensable "IRQ_NO_BALANCING" bit for msix interrupt
++ * false: disable "IRQ_NO_BALANCING" bit for msix interrupt
++ * Description: This function will be called to disable/enable
++ * "IRQ_NO_BALANCING" to avoid irqbalance daemon
++ * kicking in during adapter reset.
++ **/
++static void ipr_set_affinity_nobalance(struct ipr_ioa_cfg *ioa_cfg, bool flag)
++{
++ int irq, i;
++
++ for (i = 0; i < ioa_cfg->nvectors; i++) {
++ irq = pci_irq_vector(ioa_cfg->pdev, i);
++
++ if (flag)
++ irq_set_status_flags(irq, IRQ_NO_BALANCING);
++ else
++ irq_clear_status_flags(irq, IRQ_NO_BALANCING);
++ }
++}
++
+ /**
+ * ipr_reset_restore_cfg_space - Restore PCI config space.
+ * @ipr_cmd: ipr command struct
+@@ -8689,6 +8713,7 @@ static int ipr_reset_restore_cfg_space(struct ipr_cmnd *ipr_cmd)
+ return IPR_RC_JOB_CONTINUE;
+ }
+
++ ipr_set_affinity_nobalance(ioa_cfg, false);
+ ipr_fail_all_ops(ioa_cfg);
+
+ if (ioa_cfg->sis64) {
+@@ -8768,6 +8793,7 @@ static int ipr_reset_start_bist(struct ipr_cmnd *ipr_cmd)
+ rc = pci_write_config_byte(ioa_cfg->pdev, PCI_BIST, PCI_BIST_START);
+
+ if (rc == PCIBIOS_SUCCESSFUL) {
++ ipr_set_affinity_nobalance(ioa_cfg, true);
+ ipr_cmd->job_step = ipr_reset_bist_done;
+ ipr_reset_start_timer(ipr_cmd, IPR_WAIT_FOR_BIST_TIMEOUT);
+ rc = IPR_RC_JOB_RETURN;
+--
+2.51.0
+
--- /dev/null
+From 1d9cd00024a1ff176bd913ed30fd02dbf145f046 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 14:56:27 +0800
+Subject: scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe
+ failure scanned in again after probe failed"
+
+From: Xingui Yang <yangxingui@huawei.com>
+
+[ Upstream commit 278712d20bc8ec29d1ad6ef9bdae9000ef2c220c ]
+
+This reverts commit ab2068a6fb84751836a84c26ca72b3beb349619d.
+
+When probing the exp-attached sata device, libsas/libata will issue a
+hard reset in sas_probe_sata() -> ata_sas_async_probe(), then a
+broadcast event will be received after the disk probe fails, and this
+commit causes the probe will be re-executed on the disk, and a faulty
+disk may get into an indefinite loop of probe.
+
+Therefore, revert this commit, although it can fix some temporary issues
+with disk probe failure.
+
+Signed-off-by: Xingui Yang <yangxingui@huawei.com>
+Reviewed-by: Jason Yan <yanaijie@huawei.com>
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Link: https://patch.msgid.link/20251202065627.140361-1-yangxingui@huawei.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_internal.h | 14 --------------
+ 1 file changed, 14 deletions(-)
+
+diff --git a/drivers/scsi/libsas/sas_internal.h b/drivers/scsi/libsas/sas_internal.h
+index 3ef2fde28b8ed..52e09c3e2b50d 100644
+--- a/drivers/scsi/libsas/sas_internal.h
++++ b/drivers/scsi/libsas/sas_internal.h
+@@ -114,20 +114,6 @@ static inline void sas_fail_probe(struct domain_device *dev, const char *func, i
+ func, dev->parent ? "exp-attached" :
+ "direct-attached",
+ SAS_ADDR(dev->sas_addr), err);
+-
+- /*
+- * If the device probe failed, the expander phy attached address
+- * needs to be reset so that the phy will not be treated as flutter
+- * in the next revalidation
+- */
+- if (dev->parent && !dev_is_expander(dev->dev_type)) {
+- struct sas_phy *phy = dev->phy;
+- struct domain_device *parent = dev->parent;
+- struct ex_phy *ex_phy = &parent->ex_dev.ex_phy[phy->number];
+-
+- memset(ex_phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
+- }
+-
+ sas_unregister_dev(dev->port, dev);
+ }
+
+--
+2.51.0
+
net-netdevice-add-operation-ndo_sk_get_lower_dev.patch
tls-use-__sk_dst_get-and-dst_dev_rcu-in-get_netdev_for_sock.patch
bpf-sockmap-don-t-let-sock_map_-close-destroy-unhash-call-itself.patch
+arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch
+alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch
+nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch
+nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch
+scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch
+scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch
--- /dev/null
+From df25696f353ee0d4dcb69cf26721d1fabd276dd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 08:14:57 +0000
+Subject: alpha: don't reference obsolete termio struct for TC* constants
+
+From: Sam James <sam@gentoo.org>
+
+[ Upstream commit 9aeed9041929812a10a6d693af050846942a1d16 ]
+
+Similar in nature to ab107276607af90b13a5994997e19b7b9731e251. glibc-2.42
+drops the legacy termio struct, but the ioctls.h header still defines some
+TC* constants in terms of termio (via sizeof). Hardcode the values instead.
+
+This fixes building Python for example, which falls over like:
+ ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio'
+
+Link: https://bugs.gentoo.org/961769
+Link: https://bugs.gentoo.org/962600
+Signed-off-by: Sam James <sam@gentoo.org>
+Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
+Link: https://lore.kernel.org/r/6ebd3451908785cad53b50ca6bc46cfe9d6bc03c.1764922497.git.sam@gentoo.org
+Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/alpha/include/uapi/asm/ioctls.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/alpha/include/uapi/asm/ioctls.h b/arch/alpha/include/uapi/asm/ioctls.h
+index 971311605288f..a09d04b49cc65 100644
+--- a/arch/alpha/include/uapi/asm/ioctls.h
++++ b/arch/alpha/include/uapi/asm/ioctls.h
+@@ -23,10 +23,10 @@
+ #define TCSETSW _IOW('t', 21, struct termios)
+ #define TCSETSF _IOW('t', 22, struct termios)
+
+-#define TCGETA _IOR('t', 23, struct termio)
+-#define TCSETA _IOW('t', 24, struct termio)
+-#define TCSETAW _IOW('t', 25, struct termio)
+-#define TCSETAF _IOW('t', 28, struct termio)
++#define TCGETA 0x40127417
++#define TCSETA 0x80127418
++#define TCSETAW 0x80127419
++#define TCSETAF 0x8012741c
+
+ #define TCSBRK _IO('t', 29)
+ #define TCXONC _IO('t', 30)
+--
+2.51.0
+
--- /dev/null
+From fe3ccf127dd225e72e26eaf0e3fa605aa91be5b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Nov 2025 16:54:37 +0100
+Subject: ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit fedadc4137234c3d00c4785eeed3e747fe9036ae ]
+
+gup_pgd_range() is invoked with disabled interrupts and invokes
+__kmap_local_page_prot() via pte_offset_map(), gup_p4d_range().
+With HIGHPTE enabled, __kmap_local_page_prot() invokes kmap_high_get()
+which uses a spinlock_t via lock_kmap_any(). This leads to an
+sleeping-while-atomic error on PREEMPT_RT because spinlock_t becomes a
+sleeping lock and must not be acquired in atomic context.
+
+The loop in map_new_virtual() uses wait_queue_head_t for wake up which
+also is using a spinlock_t.
+
+Since HIGHPTE is rarely needed at all, turn it off for PREEMPT_RT
+to allow the use of get_user_pages_fast().
+
+[arnd: rework patch to turn off HIGHPTE instead of HAVE_PAST_GUP]
+
+Co-developed-by: Arnd Bergmann <arnd@arndb.de>
+
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index f2fbb170d813c..74357ce8967b4 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -1473,7 +1473,7 @@ config HIGHMEM
+
+ config HIGHPTE
+ bool "Allocate 2nd-level pagetables from highmem" if EXPERT
+- depends on HIGHMEM
++ depends on HIGHMEM && !PREEMPT_RT
+ default y
+ help
+ The VM uses one page of physical memory for each page table.
+--
+2.51.0
+
--- /dev/null
+From 6df8fa6cc329fed1ac6c971d9c80eef653606511 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2024 17:56:26 +0800
+Subject: csky: fix csky_cmpxchg_fixup not working
+
+From: Yang Li <yang.li85200@gmail.com>
+
+[ Upstream commit 809ef03d6d21d5fea016bbf6babeec462e37e68c ]
+
+In the csky_cmpxchg_fixup function, it is incorrect to use the global
+variable csky_cmpxchg_stw to determine the address where the exception
+occurred.The global variable csky_cmpxchg_stw stores the opcode at the
+time of the exception, while &csky_cmpxchg_stw shows the address where
+the exception occurred.
+
+Signed-off-by: Yang Li <yang.li85200@gmail.com>
+Signed-off-by: Guo Ren <guoren@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/csky/mm/fault.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/csky/mm/fault.c b/arch/csky/mm/fault.c
+index 7215a46b6b8eb..98699fdeeeb54 100644
+--- a/arch/csky/mm/fault.c
++++ b/arch/csky/mm/fault.c
+@@ -45,8 +45,8 @@ static inline void csky_cmpxchg_fixup(struct pt_regs *regs)
+ if (trap_no(regs) != VEC_TLBMODIFIED)
+ return;
+
+- if (instruction_pointer(regs) == csky_cmpxchg_stw)
+- instruction_pointer_set(regs, csky_cmpxchg_ldw);
++ if (instruction_pointer(regs) == (unsigned long)&csky_cmpxchg_stw)
++ instruction_pointer_set(regs, (unsigned long)&csky_cmpxchg_ldw);
+ return;
+ }
+ #endif
+--
+2.51.0
+
--- /dev/null
+From 44f1290be6aeebfa5fb3d43b884f81ce8f2752ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:04:27 -0300
+Subject: ext4: filesystems without casefold feature cannot be mounted with
+ siphash
+
+From: Lizhi Xu <lizhi.xu@windriver.com>
+
+commit 985b67cd86392310d9e9326de941c22fc9340eec upstream.
+
+When mounting the ext4 filesystem, if the default hash version is set to
+DX_HASH_SIPHASH but the casefold feature is not set, exit the mounting.
+
+Reported-by: syzbot+340581ba9dceb7e06fb3@syzkaller.appspotmail.com
+Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
+Link: https://patch.msgid.link/20240605012335.44086-1-lizhi.xu@windriver.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+[cascardo: small conflict fixup]
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/super.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 05f1f9b7ad0c4..7780d8755ed8f 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -3191,6 +3191,14 @@ int ext4_feature_set_ok(struct super_block *sb, int readonly)
+ }
+ #endif
+
++ if (EXT4_SB(sb)->s_es->s_def_hash_version == DX_HASH_SIPHASH &&
++ !ext4_has_feature_casefold(sb)) {
++ ext4_msg(sb, KERN_ERR,
++ "Filesystem without casefold feature cannot be "
++ "mounted with siphash");
++ return 0;
++ }
++
+ if (readonly)
+ return 1;
+
+--
+2.51.0
+
--- /dev/null
+From 8907bf29100bd8831558d83b7020c4e49aee0b4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jan 2026 12:04:29 -0300
+Subject: ext4: fix error message when rejecting the default hash
+
+From: Gabriel Krisman Bertazi <krisman@suse.de>
+
+commit a2187431c395cdfbf144e3536f25468c64fc7cfa upstream.
+
+Commit 985b67cd8639 ("ext4: filesystems without casefold feature cannot
+be mounted with siphash") properly rejects volumes where
+s_def_hash_version is set to DX_HASH_SIPHASH, but the check and the
+error message should not look into casefold setup - a filesystem should
+never have DX_HASH_SIPHASH as the default hash. Fix it and, since we
+are there, move the check to ext4_hash_info_init.
+
+Fixes:985b67cd8639 ("ext4: filesystems without casefold feature cannot
+be mounted with siphash")
+
+Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de>
+Link: https://patch.msgid.link/87jzg1en6j.fsf_-_@mailhost.krisman.be
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+[cascardo: conflicts due to other parts of ext4_fill_super having been factored out]
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/super.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 7780d8755ed8f..05f1f9b7ad0c4 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -3191,14 +3191,6 @@ int ext4_feature_set_ok(struct super_block *sb, int readonly)
+ }
+ #endif
+
+- if (EXT4_SB(sb)->s_es->s_def_hash_version == DX_HASH_SIPHASH &&
+- !ext4_has_feature_casefold(sb)) {
+- ext4_msg(sb, KERN_ERR,
+- "Filesystem without casefold feature cannot be "
+- "mounted with siphash");
+- return 0;
+- }
+-
+ if (readonly)
+ return 1;
+
+--
+2.51.0
+
--- /dev/null
+From e8b637fda14ec76264148f274fb62b4529ee27aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 18:56:46 -0500
+Subject: NFS: Fix up the automount fs_context to use the correct cred
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit a2a8fc27dd668e7562b5326b5ed2f1604cb1e2e9 ]
+
+When automounting, the fs_context should be fixed up to use the cred
+from the parent filesystem, since the operation is just extending the
+namespace. Authorisation to enter that namespace will already have been
+provided by the preceding lookup.
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/namespace.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
+index 8fb570fd376a1..6367f067dd7be 100644
+--- a/fs/nfs/namespace.c
++++ b/fs/nfs/namespace.c
+@@ -170,6 +170,11 @@ struct vfsmount *nfs_d_automount(struct path *path)
+ if (!ctx->clone_data.fattr)
+ goto out_fc;
+
++ if (fc->cred != server->cred) {
++ put_cred(fc->cred);
++ fc->cred = get_cred(server->cred);
++ }
++
+ if (fc->net_ns != client->cl_net) {
+ put_net(fc->net_ns);
+ fc->net_ns = get_net(client->cl_net);
+--
+2.51.0
+
--- /dev/null
+From 53e9b7184a4125d84ea1e6db7d9ca4830002479f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Nov 2025 10:44:15 -0500
+Subject: NFSv4: ensure the open stateid seqid doesn't go backwards
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+[ Upstream commit 2e47c3cc64b44b0b06cd68c2801db92ff143f2b2 ]
+
+We have observed an NFSv4 client receiving a LOCK reply with a status of
+NFS4ERR_OLD_STATEID and subsequently retrying the LOCK request with an
+earlier seqid value in the stateid. As this was for a new lockowner,
+that would imply that nfs_set_open_stateid_locked() had updated the open
+stateid seqid with an earlier value.
+
+Looking at nfs_set_open_stateid_locked(), if the incoming seqid is out
+of sequence, the task will sleep on the state->waitq for up to 5
+seconds. If the task waits for the full 5 seconds, then after finishing
+the wait it'll update the open stateid seqid with whatever value the
+incoming seqid has. If there are multiple waiters in this scenario,
+then the last one to perform said update may not be the one with the
+highest seqid.
+
+Add a check to ensure that the seqid can only be incremented, and add a
+tracepoint to indicate when old seqids are skipped.
+
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Reviewed-by: Benjamin Coddington <bcodding@hammerspace.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 13 +++++++++++--
+ fs/nfs/nfs4trace.h | 1 +
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 883e4106fbcd9..cd97312860ce6 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1709,8 +1709,17 @@ static void nfs_set_open_stateid_locked(struct nfs4_state *state,
+ if (nfs_stateid_is_sequential(state, stateid))
+ break;
+
+- if (status)
+- break;
++ if (status) {
++ if (nfs4_stateid_match_other(stateid, &state->open_stateid) &&
++ !nfs4_stateid_is_newer(stateid, &state->open_stateid)) {
++ trace_nfs4_open_stateid_update_skip(state->inode,
++ stateid, status);
++ return;
++ } else {
++ break;
++ }
++ }
++
+ /* Rely on seqids for serialisation with NFSv4.0 */
+ if (!nfs4_has_session(NFS_SERVER(state->inode)->nfs_client))
+ break;
+diff --git a/fs/nfs/nfs4trace.h b/fs/nfs/nfs4trace.h
+index 8565fa654f59a..d3d5842781da2 100644
+--- a/fs/nfs/nfs4trace.h
++++ b/fs/nfs/nfs4trace.h
+@@ -1205,6 +1205,7 @@ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_setattr);
+ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_delegreturn);
+ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update);
+ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update_wait);
++DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update_skip);
+ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_close_stateid_update_wait);
+
+ DECLARE_EVENT_CLASS(nfs4_getattr_event,
+--
+2.51.0
+
--- /dev/null
+From e5937f0d74b1086b97dce6e5d2a50701b10a98c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Oct 2025 09:24:26 -0500
+Subject: scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset
+
+From: Wen Xiong <wenxiong@linux.ibm.com>
+
+[ Upstream commit 6ac3484fb13b2fc7f31cfc7f56093e7d0ce646a5 ]
+
+A dynamic remove/add storage adapter test hits EEH on PowerPC:
+
+ EEH: [c00000000004f75c] __eeh_send_failure_event+0x7c/0x160
+ EEH: [c000000000048444] eeh_dev_check_failure.part.0+0x254/0x650
+ EEH: [c008000001650678] eeh_readl+0x60/0x90 [ipr]
+ EEH: [c00800000166746c] ipr_cancel_op+0x2b8/0x524 [ipr]
+ EEH: [c008000001656524] ipr_eh_abort+0x6c/0x130 [ipr]
+ EEH: [c000000000ab0d20] scmd_eh_abort_handler+0x140/0x440
+ EEH: [c00000000017e558] process_one_work+0x298/0x590
+ EEH: [c00000000017eef8] worker_thread+0xa8/0x620
+ EEH: [c00000000018be34] kthread+0x124/0x130
+ EEH: [c00000000000cd64] ret_from_kernel_thread+0x5c/0x64
+
+A PCIe bus trace reveals that a vector of MSI-X is cleared to 0 by
+irqbalance daemon. If we disable irqbalance daemon, we won't see the
+issue.
+
+With debug enabled in ipr driver:
+
+ [ 44.103071] ipr: Entering __ipr_remove
+ [ 44.103083] ipr: Entering ipr_initiate_ioa_bringdown
+ [ 44.103091] ipr: Entering ipr_reset_shutdown_ioa
+ [ 44.103099] ipr: Leaving ipr_reset_shutdown_ioa
+ [ 44.103105] ipr: Leaving ipr_initiate_ioa_bringdown
+ [ 44.149918] ipr: Entering ipr_reset_ucode_download
+ [ 44.149935] ipr: Entering ipr_reset_alert
+ [ 44.150032] ipr: Entering ipr_reset_start_timer
+ [ 44.150038] ipr: Leaving ipr_reset_alert
+ [ 44.244343] scsi 1:2:3:0: alua: Detached
+ [ 44.254300] ipr: Entering ipr_reset_start_bist
+ [ 44.254320] ipr: Entering ipr_reset_start_timer
+ [ 44.254325] ipr: Leaving ipr_reset_start_bist
+ [ 44.364329] scsi 1:2:4:0: alua: Detached
+ [ 45.134341] scsi 1:2:5:0: alua: Detached
+ [ 45.860949] ipr: Entering ipr_reset_shutdown_ioa
+ [ 45.860962] ipr: Leaving ipr_reset_shutdown_ioa
+ [ 45.860966] ipr: Entering ipr_reset_alert
+ [ 45.861028] ipr: Entering ipr_reset_start_timer
+ [ 45.861035] ipr: Leaving ipr_reset_alert
+ [ 45.964302] ipr: Entering ipr_reset_start_bist
+ [ 45.964309] ipr: Entering ipr_reset_start_timer
+ [ 45.964313] ipr: Leaving ipr_reset_start_bist
+ [ 46.264301] ipr: Entering ipr_reset_bist_done
+ [ 46.264309] ipr: Leaving ipr_reset_bist_done
+
+During adapter reset, ipr device driver blocks config space access but
+can't block MMIO access for MSI-X entries. There is very small window:
+irqbalance daemon kicks in during adapter reset before ipr driver calls
+pci_restore_state(pdev) to restore MSI-X table.
+
+irqbalance daemon reads back all 0 for that MSI-X vector in
+__pci_read_msi_msg().
+
+irqbalance daemon:
+
+ msi_domain_set_affinity()
+ ->irq_chip_set_affinity_patent()
+ ->xive_irq_set_affinity()
+ ->irq_chip_compose_msi_msg()
+ ->pseries_msi_compose_msg()
+ ->__pci_read_msi_msg(): read all 0 since didn't call pci_restore_state
+ ->irq_chip_write_msi_msg()
+ -> pci_write_msg_msi(): write 0 to the msix vector entry
+
+When ipr driver calls pci_restore_state(pdev) in
+ipr_reset_restore_cfg_space(), the MSI-X vector entry has been cleared
+by irqbalance daemon in pci_write_msg_msix().
+
+ pci_restore_state()
+ ->__pci_restore_msix_state()
+
+Below is the MSI-X table for ipr adapter after irqbalance daemon kicked
+in during adapter reset:
+
+ Dump MSIx table: index=0 address_lo=c800 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=1 address_lo=c810 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=2 address_lo=c820 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=3 address_lo=c830 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=4 address_lo=c840 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=5 address_lo=c850 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=6 address_lo=c860 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=7 address_lo=c870 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=8 address_lo=0 address_hi=0 msg_data=0
+ ---------> Hit EEH since msix vector of index=8 are 0
+ Dump MSIx table: index=9 address_lo=c890 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=10 address_lo=c8a0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=11 address_lo=c8b0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=12 address_lo=c8c0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=13 address_lo=c8d0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=14 address_lo=c8e0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=15 address_lo=c8f0 address_hi=10000000 msg_data=0
+
+ [ 46.264312] ipr: Entering ipr_reset_restore_cfg_space
+ [ 46.267439] ipr: Entering ipr_fail_all_ops
+ [ 46.267447] ipr: Leaving ipr_fail_all_ops
+ [ 46.267451] ipr: Leaving ipr_reset_restore_cfg_space
+ [ 46.267454] ipr: Entering ipr_ioa_bringdown_done
+ [ 46.267458] ipr: Leaving ipr_ioa_bringdown_done
+ [ 46.267467] ipr: Entering ipr_worker_thread
+ [ 46.267470] ipr: Leaving ipr_worker_thread
+
+IRQ balancing is not required during adapter reset.
+
+Enable "IRQ_NO_BALANCING" flag before starting adapter reset and disable
+it after calling pci_restore_state(). The irqbalance daemon is disabled
+for this short period of time (~2s).
+
+Co-developed-by: Kyle Mahlkuch <Kyle.Mahlkuch@ibm.com>
+Signed-off-by: Kyle Mahlkuch <Kyle.Mahlkuch@ibm.com>
+Signed-off-by: Wen Xiong <wenxiong@linux.ibm.com>
+Link: https://patch.msgid.link/20251028142427.3969819-2-wenxiong@linux.ibm.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ipr.c | 28 +++++++++++++++++++++++++++-
+ 1 file changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
+index e5e38431c5c73..acb5025b196de 100644
+--- a/drivers/scsi/ipr.c
++++ b/drivers/scsi/ipr.c
+@@ -62,8 +62,8 @@
+ #include <linux/hdreg.h>
+ #include <linux/reboot.h>
+ #include <linux/stringify.h>
++#include <linux/irq.h>
+ #include <asm/io.h>
+-#include <asm/irq.h>
+ #include <asm/processor.h>
+ #include <scsi/scsi.h>
+ #include <scsi/scsi_host.h>
+@@ -8665,6 +8665,30 @@ static int ipr_dump_mailbox_wait(struct ipr_cmnd *ipr_cmd)
+ return IPR_RC_JOB_RETURN;
+ }
+
++/**
++ * ipr_set_affinity_nobalance
++ * @ioa_cfg: ipr_ioa_cfg struct for an ipr device
++ * @flag: bool
++ * true: ensable "IRQ_NO_BALANCING" bit for msix interrupt
++ * false: disable "IRQ_NO_BALANCING" bit for msix interrupt
++ * Description: This function will be called to disable/enable
++ * "IRQ_NO_BALANCING" to avoid irqbalance daemon
++ * kicking in during adapter reset.
++ **/
++static void ipr_set_affinity_nobalance(struct ipr_ioa_cfg *ioa_cfg, bool flag)
++{
++ int irq, i;
++
++ for (i = 0; i < ioa_cfg->nvectors; i++) {
++ irq = pci_irq_vector(ioa_cfg->pdev, i);
++
++ if (flag)
++ irq_set_status_flags(irq, IRQ_NO_BALANCING);
++ else
++ irq_clear_status_flags(irq, IRQ_NO_BALANCING);
++ }
++}
++
+ /**
+ * ipr_reset_restore_cfg_space - Restore PCI config space.
+ * @ipr_cmd: ipr command struct
+@@ -8689,6 +8713,7 @@ static int ipr_reset_restore_cfg_space(struct ipr_cmnd *ipr_cmd)
+ return IPR_RC_JOB_CONTINUE;
+ }
+
++ ipr_set_affinity_nobalance(ioa_cfg, false);
+ ipr_fail_all_ops(ioa_cfg);
+
+ if (ioa_cfg->sis64) {
+@@ -8768,6 +8793,7 @@ static int ipr_reset_start_bist(struct ipr_cmnd *ipr_cmd)
+ rc = pci_write_config_byte(ioa_cfg->pdev, PCI_BIST, PCI_BIST_START);
+
+ if (rc == PCIBIOS_SUCCESSFUL) {
++ ipr_set_affinity_nobalance(ioa_cfg, true);
+ ipr_cmd->job_step = ipr_reset_bist_done;
+ ipr_reset_start_timer(ipr_cmd, IPR_WAIT_FOR_BIST_TIMEOUT);
+ rc = IPR_RC_JOB_RETURN;
+--
+2.51.0
+
--- /dev/null
+From 9a6d0a8f246a03059ef31af3cbbbc48330d2ac86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 14:56:27 +0800
+Subject: scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe
+ failure scanned in again after probe failed"
+
+From: Xingui Yang <yangxingui@huawei.com>
+
+[ Upstream commit 278712d20bc8ec29d1ad6ef9bdae9000ef2c220c ]
+
+This reverts commit ab2068a6fb84751836a84c26ca72b3beb349619d.
+
+When probing the exp-attached sata device, libsas/libata will issue a
+hard reset in sas_probe_sata() -> ata_sas_async_probe(), then a
+broadcast event will be received after the disk probe fails, and this
+commit causes the probe will be re-executed on the disk, and a faulty
+disk may get into an indefinite loop of probe.
+
+Therefore, revert this commit, although it can fix some temporary issues
+with disk probe failure.
+
+Signed-off-by: Xingui Yang <yangxingui@huawei.com>
+Reviewed-by: Jason Yan <yanaijie@huawei.com>
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Link: https://patch.msgid.link/20251202065627.140361-1-yangxingui@huawei.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_internal.h | 14 --------------
+ 1 file changed, 14 deletions(-)
+
+diff --git a/drivers/scsi/libsas/sas_internal.h b/drivers/scsi/libsas/sas_internal.h
+index 5028bc394c4f9..d7a1fb5c10c6e 100644
+--- a/drivers/scsi/libsas/sas_internal.h
++++ b/drivers/scsi/libsas/sas_internal.h
+@@ -111,20 +111,6 @@ static inline void sas_fail_probe(struct domain_device *dev, const char *func, i
+ func, dev->parent ? "exp-attached" :
+ "direct-attached",
+ SAS_ADDR(dev->sas_addr), err);
+-
+- /*
+- * If the device probe failed, the expander phy attached address
+- * needs to be reset so that the phy will not be treated as flutter
+- * in the next revalidation
+- */
+- if (dev->parent && !dev_is_expander(dev->dev_type)) {
+- struct sas_phy *phy = dev->phy;
+- struct domain_device *parent = dev->parent;
+- struct ex_phy *ex_phy = &parent->ex_dev.ex_phy[phy->number];
+-
+- memset(ex_phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
+- }
+-
+ sas_unregister_dev(dev->port, dev);
+ }
+
+--
+2.51.0
+
ext4-fix-out-of-bound-read-in-ext4_xattr_inode_dec_ref_all.patch
net-add-locking-to-protect-skb-dev-access-in-ip_output.patch
tls-use-__sk_dst_get-and-dst_dev_rcu-in-get_netdev_for_sock.patch
+ext4-filesystems-without-casefold-feature-cannot-be-.patch
+ext4-fix-error-message-when-rejecting-the-default-ha.patch
+csky-fix-csky_cmpxchg_fixup-not-working.patch
+arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch
+alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch
+nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch
+nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch
+scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch
+scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch
--- /dev/null
+From 7bba8da611ddaa6b10f26d8d26882e3a62ed61f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 08:14:57 +0000
+Subject: alpha: don't reference obsolete termio struct for TC* constants
+
+From: Sam James <sam@gentoo.org>
+
+[ Upstream commit 9aeed9041929812a10a6d693af050846942a1d16 ]
+
+Similar in nature to ab107276607af90b13a5994997e19b7b9731e251. glibc-2.42
+drops the legacy termio struct, but the ioctls.h header still defines some
+TC* constants in terms of termio (via sizeof). Hardcode the values instead.
+
+This fixes building Python for example, which falls over like:
+ ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio'
+
+Link: https://bugs.gentoo.org/961769
+Link: https://bugs.gentoo.org/962600
+Signed-off-by: Sam James <sam@gentoo.org>
+Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
+Link: https://lore.kernel.org/r/6ebd3451908785cad53b50ca6bc46cfe9d6bc03c.1764922497.git.sam@gentoo.org
+Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/alpha/include/uapi/asm/ioctls.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/alpha/include/uapi/asm/ioctls.h b/arch/alpha/include/uapi/asm/ioctls.h
+index 971311605288f..a09d04b49cc65 100644
+--- a/arch/alpha/include/uapi/asm/ioctls.h
++++ b/arch/alpha/include/uapi/asm/ioctls.h
+@@ -23,10 +23,10 @@
+ #define TCSETSW _IOW('t', 21, struct termios)
+ #define TCSETSF _IOW('t', 22, struct termios)
+
+-#define TCGETA _IOR('t', 23, struct termio)
+-#define TCSETA _IOW('t', 24, struct termio)
+-#define TCSETAW _IOW('t', 25, struct termio)
+-#define TCSETAF _IOW('t', 28, struct termio)
++#define TCGETA 0x40127417
++#define TCSETA 0x80127418
++#define TCSETAW 0x80127419
++#define TCSETAF 0x8012741c
+
+ #define TCSBRK _IO('t', 29)
+ #define TCXONC _IO('t', 30)
+--
+2.51.0
+
--- /dev/null
+From 0b92b8784fcf5433034cd3e954402a72c50309f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Nov 2025 16:54:37 +0100
+Subject: ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit fedadc4137234c3d00c4785eeed3e747fe9036ae ]
+
+gup_pgd_range() is invoked with disabled interrupts and invokes
+__kmap_local_page_prot() via pte_offset_map(), gup_p4d_range().
+With HIGHPTE enabled, __kmap_local_page_prot() invokes kmap_high_get()
+which uses a spinlock_t via lock_kmap_any(). This leads to an
+sleeping-while-atomic error on PREEMPT_RT because spinlock_t becomes a
+sleeping lock and must not be acquired in atomic context.
+
+The loop in map_new_virtual() uses wait_queue_head_t for wake up which
+also is using a spinlock_t.
+
+Since HIGHPTE is rarely needed at all, turn it off for PREEMPT_RT
+to allow the use of get_user_pages_fast().
+
+[arnd: rework patch to turn off HIGHPTE instead of HAVE_PAST_GUP]
+
+Co-developed-by: Arnd Bergmann <arnd@arndb.de>
+
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 6d5afe2e6ba33..f0352e5675dd0 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -1318,7 +1318,7 @@ config HIGHMEM
+
+ config HIGHPTE
+ bool "Allocate 2nd-level pagetables from highmem" if EXPERT
+- depends on HIGHMEM
++ depends on HIGHMEM && !PREEMPT_RT
+ default y
+ help
+ The VM uses one page of physical memory for each page table.
+--
+2.51.0
+
--- /dev/null
+From ea0e23f93c78d8ca22abe5739808fe20d6a41f74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Dec 2025 17:01:56 +0800
+Subject: bcache: fix improper use of bi_end_io
+
+From: Shida Zhang <zhangshida@kylinos.cn>
+
+[ Upstream commit 53280e398471f0bddbb17b798a63d41264651325 ]
+
+Don't call bio->bi_end_io() directly. Use the bio_endio() helper
+function instead, which handles completion more safely and uniformly.
+
+Suggested-by: Christoph Hellwig <hch@infradead.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Shida Zhang <zhangshida@kylinos.cn>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/request.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
+index 3427555b0ccae..6a1bd0c49d2b9 100644
+--- a/drivers/md/bcache/request.c
++++ b/drivers/md/bcache/request.c
+@@ -1090,7 +1090,7 @@ static void detached_dev_end_io(struct bio *bio)
+ }
+
+ kfree(ddip);
+- bio->bi_end_io(bio);
++ bio_endio(bio);
+ }
+
+ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio,
+@@ -1107,7 +1107,7 @@ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio,
+ ddip = kzalloc(sizeof(struct detached_dev_io_private), GFP_NOIO);
+ if (!ddip) {
+ bio->bi_status = BLK_STS_RESOURCE;
+- bio->bi_end_io(bio);
++ bio_endio(bio);
+ return;
+ }
+
+@@ -1122,7 +1122,7 @@ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio,
+
+ if ((bio_op(bio) == REQ_OP_DISCARD) &&
+ !bdev_max_discard_sectors(dc->bdev))
+- bio->bi_end_io(bio);
++ detached_dev_end_io(bio);
+ else
+ submit_bio_noacct(bio);
+ }
+--
+2.51.0
+
--- /dev/null
+From 7ded6f882c3ea27581fc9c4a10a66604e66a9e9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2024 17:56:26 +0800
+Subject: csky: fix csky_cmpxchg_fixup not working
+
+From: Yang Li <yang.li85200@gmail.com>
+
+[ Upstream commit 809ef03d6d21d5fea016bbf6babeec462e37e68c ]
+
+In the csky_cmpxchg_fixup function, it is incorrect to use the global
+variable csky_cmpxchg_stw to determine the address where the exception
+occurred.The global variable csky_cmpxchg_stw stores the opcode at the
+time of the exception, while &csky_cmpxchg_stw shows the address where
+the exception occurred.
+
+Signed-off-by: Yang Li <yang.li85200@gmail.com>
+Signed-off-by: Guo Ren <guoren@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/csky/mm/fault.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/csky/mm/fault.c b/arch/csky/mm/fault.c
+index a885518ce1dd2..5226bc08c3360 100644
+--- a/arch/csky/mm/fault.c
++++ b/arch/csky/mm/fault.c
+@@ -45,8 +45,8 @@ static inline void csky_cmpxchg_fixup(struct pt_regs *regs)
+ if (trap_no(regs) != VEC_TLBMODIFIED)
+ return;
+
+- if (instruction_pointer(regs) == csky_cmpxchg_stw)
+- instruction_pointer_set(regs, csky_cmpxchg_ldw);
++ if (instruction_pointer(regs) == (unsigned long)&csky_cmpxchg_stw)
++ instruction_pointer_set(regs, (unsigned long)&csky_cmpxchg_ldw);
+ return;
+ }
+ #endif
+--
+2.51.0
+
--- /dev/null
+From ead66d1000b52d39b727fba1a8cb8a85b3ed072a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 18:56:46 -0500
+Subject: NFS: Fix up the automount fs_context to use the correct cred
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit a2a8fc27dd668e7562b5326b5ed2f1604cb1e2e9 ]
+
+When automounting, the fs_context should be fixed up to use the cred
+from the parent filesystem, since the operation is just extending the
+namespace. Authorisation to enter that namespace will already have been
+provided by the preceding lookup.
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/namespace.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
+index 663f1a3f7cc3e..5cbbe59e56234 100644
+--- a/fs/nfs/namespace.c
++++ b/fs/nfs/namespace.c
+@@ -170,6 +170,11 @@ struct vfsmount *nfs_d_automount(struct path *path)
+ if (!ctx->clone_data.fattr)
+ goto out_fc;
+
++ if (fc->cred != server->cred) {
++ put_cred(fc->cred);
++ fc->cred = get_cred(server->cred);
++ }
++
+ if (fc->net_ns != client->cl_net) {
+ put_net(fc->net_ns);
+ fc->net_ns = get_net(client->cl_net);
+--
+2.51.0
+
--- /dev/null
+From 763a0ab1db5fc4a00bab8a2cd63326cdd993dbc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Nov 2025 10:44:15 -0500
+Subject: NFSv4: ensure the open stateid seqid doesn't go backwards
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+[ Upstream commit 2e47c3cc64b44b0b06cd68c2801db92ff143f2b2 ]
+
+We have observed an NFSv4 client receiving a LOCK reply with a status of
+NFS4ERR_OLD_STATEID and subsequently retrying the LOCK request with an
+earlier seqid value in the stateid. As this was for a new lockowner,
+that would imply that nfs_set_open_stateid_locked() had updated the open
+stateid seqid with an earlier value.
+
+Looking at nfs_set_open_stateid_locked(), if the incoming seqid is out
+of sequence, the task will sleep on the state->waitq for up to 5
+seconds. If the task waits for the full 5 seconds, then after finishing
+the wait it'll update the open stateid seqid with whatever value the
+incoming seqid has. If there are multiple waiters in this scenario,
+then the last one to perform said update may not be the one with the
+highest seqid.
+
+Add a check to ensure that the seqid can only be incremented, and add a
+tracepoint to indicate when old seqids are skipped.
+
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Reviewed-by: Benjamin Coddington <bcodding@hammerspace.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 13 +++++++++++--
+ fs/nfs/nfs4trace.h | 1 +
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index d4ae2ce56af4a..8258bce82e5bc 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1700,8 +1700,17 @@ static void nfs_set_open_stateid_locked(struct nfs4_state *state,
+ if (nfs_stateid_is_sequential(state, stateid))
+ break;
+
+- if (status)
+- break;
++ if (status) {
++ if (nfs4_stateid_match_other(stateid, &state->open_stateid) &&
++ !nfs4_stateid_is_newer(stateid, &state->open_stateid)) {
++ trace_nfs4_open_stateid_update_skip(state->inode,
++ stateid, status);
++ return;
++ } else {
++ break;
++ }
++ }
++
+ /* Rely on seqids for serialisation with NFSv4.0 */
+ if (!nfs4_has_session(NFS_SERVER(state->inode)->nfs_client))
+ break;
+diff --git a/fs/nfs/nfs4trace.h b/fs/nfs/nfs4trace.h
+index c8a57cfde64b4..0fc1b4a6eab90 100644
+--- a/fs/nfs/nfs4trace.h
++++ b/fs/nfs/nfs4trace.h
+@@ -1248,6 +1248,7 @@ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_setattr);
+ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_delegreturn);
+ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update);
+ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update_wait);
++DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update_skip);
+ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_close_stateid_update_wait);
+
+ DECLARE_EVENT_CLASS(nfs4_getattr_event,
+--
+2.51.0
+
--- /dev/null
+From bac864df8a18dc8906ac647d440aee509cab46a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Oct 2025 09:24:26 -0500
+Subject: scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset
+
+From: Wen Xiong <wenxiong@linux.ibm.com>
+
+[ Upstream commit 6ac3484fb13b2fc7f31cfc7f56093e7d0ce646a5 ]
+
+A dynamic remove/add storage adapter test hits EEH on PowerPC:
+
+ EEH: [c00000000004f75c] __eeh_send_failure_event+0x7c/0x160
+ EEH: [c000000000048444] eeh_dev_check_failure.part.0+0x254/0x650
+ EEH: [c008000001650678] eeh_readl+0x60/0x90 [ipr]
+ EEH: [c00800000166746c] ipr_cancel_op+0x2b8/0x524 [ipr]
+ EEH: [c008000001656524] ipr_eh_abort+0x6c/0x130 [ipr]
+ EEH: [c000000000ab0d20] scmd_eh_abort_handler+0x140/0x440
+ EEH: [c00000000017e558] process_one_work+0x298/0x590
+ EEH: [c00000000017eef8] worker_thread+0xa8/0x620
+ EEH: [c00000000018be34] kthread+0x124/0x130
+ EEH: [c00000000000cd64] ret_from_kernel_thread+0x5c/0x64
+
+A PCIe bus trace reveals that a vector of MSI-X is cleared to 0 by
+irqbalance daemon. If we disable irqbalance daemon, we won't see the
+issue.
+
+With debug enabled in ipr driver:
+
+ [ 44.103071] ipr: Entering __ipr_remove
+ [ 44.103083] ipr: Entering ipr_initiate_ioa_bringdown
+ [ 44.103091] ipr: Entering ipr_reset_shutdown_ioa
+ [ 44.103099] ipr: Leaving ipr_reset_shutdown_ioa
+ [ 44.103105] ipr: Leaving ipr_initiate_ioa_bringdown
+ [ 44.149918] ipr: Entering ipr_reset_ucode_download
+ [ 44.149935] ipr: Entering ipr_reset_alert
+ [ 44.150032] ipr: Entering ipr_reset_start_timer
+ [ 44.150038] ipr: Leaving ipr_reset_alert
+ [ 44.244343] scsi 1:2:3:0: alua: Detached
+ [ 44.254300] ipr: Entering ipr_reset_start_bist
+ [ 44.254320] ipr: Entering ipr_reset_start_timer
+ [ 44.254325] ipr: Leaving ipr_reset_start_bist
+ [ 44.364329] scsi 1:2:4:0: alua: Detached
+ [ 45.134341] scsi 1:2:5:0: alua: Detached
+ [ 45.860949] ipr: Entering ipr_reset_shutdown_ioa
+ [ 45.860962] ipr: Leaving ipr_reset_shutdown_ioa
+ [ 45.860966] ipr: Entering ipr_reset_alert
+ [ 45.861028] ipr: Entering ipr_reset_start_timer
+ [ 45.861035] ipr: Leaving ipr_reset_alert
+ [ 45.964302] ipr: Entering ipr_reset_start_bist
+ [ 45.964309] ipr: Entering ipr_reset_start_timer
+ [ 45.964313] ipr: Leaving ipr_reset_start_bist
+ [ 46.264301] ipr: Entering ipr_reset_bist_done
+ [ 46.264309] ipr: Leaving ipr_reset_bist_done
+
+During adapter reset, ipr device driver blocks config space access but
+can't block MMIO access for MSI-X entries. There is very small window:
+irqbalance daemon kicks in during adapter reset before ipr driver calls
+pci_restore_state(pdev) to restore MSI-X table.
+
+irqbalance daemon reads back all 0 for that MSI-X vector in
+__pci_read_msi_msg().
+
+irqbalance daemon:
+
+ msi_domain_set_affinity()
+ ->irq_chip_set_affinity_patent()
+ ->xive_irq_set_affinity()
+ ->irq_chip_compose_msi_msg()
+ ->pseries_msi_compose_msg()
+ ->__pci_read_msi_msg(): read all 0 since didn't call pci_restore_state
+ ->irq_chip_write_msi_msg()
+ -> pci_write_msg_msi(): write 0 to the msix vector entry
+
+When ipr driver calls pci_restore_state(pdev) in
+ipr_reset_restore_cfg_space(), the MSI-X vector entry has been cleared
+by irqbalance daemon in pci_write_msg_msix().
+
+ pci_restore_state()
+ ->__pci_restore_msix_state()
+
+Below is the MSI-X table for ipr adapter after irqbalance daemon kicked
+in during adapter reset:
+
+ Dump MSIx table: index=0 address_lo=c800 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=1 address_lo=c810 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=2 address_lo=c820 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=3 address_lo=c830 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=4 address_lo=c840 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=5 address_lo=c850 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=6 address_lo=c860 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=7 address_lo=c870 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=8 address_lo=0 address_hi=0 msg_data=0
+ ---------> Hit EEH since msix vector of index=8 are 0
+ Dump MSIx table: index=9 address_lo=c890 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=10 address_lo=c8a0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=11 address_lo=c8b0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=12 address_lo=c8c0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=13 address_lo=c8d0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=14 address_lo=c8e0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=15 address_lo=c8f0 address_hi=10000000 msg_data=0
+
+ [ 46.264312] ipr: Entering ipr_reset_restore_cfg_space
+ [ 46.267439] ipr: Entering ipr_fail_all_ops
+ [ 46.267447] ipr: Leaving ipr_fail_all_ops
+ [ 46.267451] ipr: Leaving ipr_reset_restore_cfg_space
+ [ 46.267454] ipr: Entering ipr_ioa_bringdown_done
+ [ 46.267458] ipr: Leaving ipr_ioa_bringdown_done
+ [ 46.267467] ipr: Entering ipr_worker_thread
+ [ 46.267470] ipr: Leaving ipr_worker_thread
+
+IRQ balancing is not required during adapter reset.
+
+Enable "IRQ_NO_BALANCING" flag before starting adapter reset and disable
+it after calling pci_restore_state(). The irqbalance daemon is disabled
+for this short period of time (~2s).
+
+Co-developed-by: Kyle Mahlkuch <Kyle.Mahlkuch@ibm.com>
+Signed-off-by: Kyle Mahlkuch <Kyle.Mahlkuch@ibm.com>
+Signed-off-by: Wen Xiong <wenxiong@linux.ibm.com>
+Link: https://patch.msgid.link/20251028142427.3969819-2-wenxiong@linux.ibm.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ipr.c | 28 +++++++++++++++++++++++++++-
+ 1 file changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
+index 8c062afb2918d..89b8990208506 100644
+--- a/drivers/scsi/ipr.c
++++ b/drivers/scsi/ipr.c
+@@ -62,8 +62,8 @@
+ #include <linux/hdreg.h>
+ #include <linux/reboot.h>
+ #include <linux/stringify.h>
++#include <linux/irq.h>
+ #include <asm/io.h>
+-#include <asm/irq.h>
+ #include <asm/processor.h>
+ #include <scsi/scsi.h>
+ #include <scsi/scsi_host.h>
+@@ -8669,6 +8669,30 @@ static int ipr_dump_mailbox_wait(struct ipr_cmnd *ipr_cmd)
+ return IPR_RC_JOB_RETURN;
+ }
+
++/**
++ * ipr_set_affinity_nobalance
++ * @ioa_cfg: ipr_ioa_cfg struct for an ipr device
++ * @flag: bool
++ * true: ensable "IRQ_NO_BALANCING" bit for msix interrupt
++ * false: disable "IRQ_NO_BALANCING" bit for msix interrupt
++ * Description: This function will be called to disable/enable
++ * "IRQ_NO_BALANCING" to avoid irqbalance daemon
++ * kicking in during adapter reset.
++ **/
++static void ipr_set_affinity_nobalance(struct ipr_ioa_cfg *ioa_cfg, bool flag)
++{
++ int irq, i;
++
++ for (i = 0; i < ioa_cfg->nvectors; i++) {
++ irq = pci_irq_vector(ioa_cfg->pdev, i);
++
++ if (flag)
++ irq_set_status_flags(irq, IRQ_NO_BALANCING);
++ else
++ irq_clear_status_flags(irq, IRQ_NO_BALANCING);
++ }
++}
++
+ /**
+ * ipr_reset_restore_cfg_space - Restore PCI config space.
+ * @ipr_cmd: ipr command struct
+@@ -8693,6 +8717,7 @@ static int ipr_reset_restore_cfg_space(struct ipr_cmnd *ipr_cmd)
+ return IPR_RC_JOB_CONTINUE;
+ }
+
++ ipr_set_affinity_nobalance(ioa_cfg, false);
+ ipr_fail_all_ops(ioa_cfg);
+
+ if (ioa_cfg->sis64) {
+@@ -8772,6 +8797,7 @@ static int ipr_reset_start_bist(struct ipr_cmnd *ipr_cmd)
+ rc = pci_write_config_byte(ioa_cfg->pdev, PCI_BIST, PCI_BIST_START);
+
+ if (rc == PCIBIOS_SUCCESSFUL) {
++ ipr_set_affinity_nobalance(ioa_cfg, true);
+ ipr_cmd->job_step = ipr_reset_bist_done;
+ ipr_reset_start_timer(ipr_cmd, IPR_WAIT_FOR_BIST_TIMEOUT);
+ rc = IPR_RC_JOB_RETURN;
+--
+2.51.0
+
--- /dev/null
+From 676b811dd00a4e99177e501dfd074c8f8afb5786 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 14:56:27 +0800
+Subject: scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe
+ failure scanned in again after probe failed"
+
+From: Xingui Yang <yangxingui@huawei.com>
+
+[ Upstream commit 278712d20bc8ec29d1ad6ef9bdae9000ef2c220c ]
+
+This reverts commit ab2068a6fb84751836a84c26ca72b3beb349619d.
+
+When probing the exp-attached sata device, libsas/libata will issue a
+hard reset in sas_probe_sata() -> ata_sas_async_probe(), then a
+broadcast event will be received after the disk probe fails, and this
+commit causes the probe will be re-executed on the disk, and a faulty
+disk may get into an indefinite loop of probe.
+
+Therefore, revert this commit, although it can fix some temporary issues
+with disk probe failure.
+
+Signed-off-by: Xingui Yang <yangxingui@huawei.com>
+Reviewed-by: Jason Yan <yanaijie@huawei.com>
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Link: https://patch.msgid.link/20251202065627.140361-1-yangxingui@huawei.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_internal.h | 14 --------------
+ 1 file changed, 14 deletions(-)
+
+diff --git a/drivers/scsi/libsas/sas_internal.h b/drivers/scsi/libsas/sas_internal.h
+index 6ddccc67e808f..a94bd0790b055 100644
+--- a/drivers/scsi/libsas/sas_internal.h
++++ b/drivers/scsi/libsas/sas_internal.h
+@@ -119,20 +119,6 @@ static inline void sas_fail_probe(struct domain_device *dev, const char *func, i
+ func, dev->parent ? "exp-attached" :
+ "direct-attached",
+ SAS_ADDR(dev->sas_addr), err);
+-
+- /*
+- * If the device probe failed, the expander phy attached address
+- * needs to be reset so that the phy will not be treated as flutter
+- * in the next revalidation
+- */
+- if (dev->parent && !dev_is_expander(dev->dev_type)) {
+- struct sas_phy *phy = dev->phy;
+- struct domain_device *parent = dev->parent;
+- struct ex_phy *ex_phy = &parent->ex_dev.ex_phy[phy->number];
+-
+- memset(ex_phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
+- }
+-
+ sas_unregister_dev(dev->port, dev);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From d18202c2e95ebac59984203faa1679e32614904f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Nov 2025 06:32:02 +0000
+Subject: scsi: ufs: core: Fix EH failure after W-LUN resume error
+
+From: Brian Kao <powenkao@google.com>
+
+[ Upstream commit b4bb6daf4ac4d4560044ecdd81e93aa2f6acbb06 ]
+
+When a W-LUN resume fails, its parent devices in the SCSI hierarchy,
+including the scsi_target, may be runtime suspended. Subsequently, the
+error handler in ufshcd_recover_pm_error() fails to set the W-LUN device
+back to active because the parent target is not active. This results in
+the following errors:
+
+ google-ufshcd 3c2d0000.ufs: ufshcd_err_handler started; HBA state eh_fatal; ...
+ ufs_device_wlun 0:0:0:49488: START_STOP failed for power mode: 1, result 40000
+ ufs_device_wlun 0:0:0:49488: ufshcd_wl_runtime_resume failed: -5
+ ...
+ ufs_device_wlun 0:0:0:49488: runtime PM trying to activate child device 0:0:0:49488 but parent (target0:0:0) is not active
+
+Address this by:
+
+ 1. Ensuring the W-LUN's parent scsi_target is runtime resumed before
+ attempting to set the W-LUN to active within
+ ufshcd_recover_pm_error().
+
+ 2. Explicitly checking for power.runtime_error on the HBA and W-LUN
+ devices before calling pm_runtime_set_active() to clear the error
+ state.
+
+ 3. Adding pm_runtime_get_sync(hba->dev) in
+ ufshcd_err_handling_prepare() to ensure the HBA itself is active
+ during error recovery, even if a child device resume failed.
+
+These changes ensure the device power states are managed correctly
+during error recovery.
+
+Signed-off-by: Brian Kao <powenkao@google.com>
+Tested-by: Brian Kao <powenkao@google.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://patch.msgid.link/20251112063214.1195761-1-powenkao@google.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufshcd.c | 36 ++++++++++++++++++++++++++++--------
+ 1 file changed, 28 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index 2435ea7ec089b..d553169b4d9ad 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -6154,6 +6154,11 @@ static void ufshcd_clk_scaling_suspend(struct ufs_hba *hba, bool suspend)
+
+ static void ufshcd_err_handling_prepare(struct ufs_hba *hba)
+ {
++ /*
++ * A WLUN resume failure could potentially lead to the HBA being
++ * runtime suspended, so take an extra reference on hba->dev.
++ */
++ pm_runtime_get_sync(hba->dev);
+ ufshcd_rpm_get_sync(hba);
+ if (pm_runtime_status_suspended(&hba->ufs_device_wlun->sdev_gendev) ||
+ hba->is_sys_suspended) {
+@@ -6194,6 +6199,7 @@ static void ufshcd_err_handling_unprepare(struct ufs_hba *hba)
+ if (ufshcd_is_clkscaling_supported(hba))
+ ufshcd_clk_scaling_suspend(hba, false);
+ ufshcd_rpm_put(hba);
++ pm_runtime_put(hba->dev);
+ }
+
+ static inline bool ufshcd_err_handling_should_stop(struct ufs_hba *hba)
+@@ -6208,28 +6214,42 @@ static inline bool ufshcd_err_handling_should_stop(struct ufs_hba *hba)
+ #ifdef CONFIG_PM
+ static void ufshcd_recover_pm_error(struct ufs_hba *hba)
+ {
++ struct scsi_target *starget = hba->ufs_device_wlun->sdev_target;
+ struct Scsi_Host *shost = hba->host;
+ struct scsi_device *sdev;
+ struct request_queue *q;
+- int ret;
++ bool resume_sdev_queues = false;
+
+ hba->is_sys_suspended = false;
++
+ /*
+- * Set RPM status of wlun device to RPM_ACTIVE,
+- * this also clears its runtime error.
++ * Ensure the parent's error status is cleared before proceeding
++ * to the child, as the parent must be active to activate the child.
+ */
+- ret = pm_runtime_set_active(&hba->ufs_device_wlun->sdev_gendev);
++ if (hba->dev->power.runtime_error) {
++ /* hba->dev has no functional parent thus simplily set RPM_ACTIVE */
++ pm_runtime_set_active(hba->dev);
++ resume_sdev_queues = true;
++ }
++
++ if (hba->ufs_device_wlun->sdev_gendev.power.runtime_error) {
++ /*
++ * starget, parent of wlun, might be suspended if wlun resume failed.
++ * Make sure parent is resumed before set child (wlun) active.
++ */
++ pm_runtime_get_sync(&starget->dev);
++ pm_runtime_set_active(&hba->ufs_device_wlun->sdev_gendev);
++ pm_runtime_put_sync(&starget->dev);
++ resume_sdev_queues = true;
++ }
+
+- /* hba device might have a runtime error otherwise */
+- if (ret)
+- ret = pm_runtime_set_active(hba->dev);
+ /*
+ * If wlun device had runtime error, we also need to resume those
+ * consumer scsi devices in case any of them has failed to be
+ * resumed due to supplier runtime resume failure. This is to unblock
+ * blk_queue_enter in case there are bios waiting inside it.
+ */
+- if (!ret) {
++ if (resume_sdev_queues) {
+ shost_for_each_device(sdev, shost) {
+ q = sdev->request_queue;
+ if (q->dev && (q->rpm_status == RPM_SUSPENDED ||
+--
+2.51.0
+
ext4-fix-out-of-bound-read-in-ext4_xattr_inode_dec_ref_all.patch
net-add-locking-to-protect-skb-dev-access-in-ip_output.patch
tls-use-__sk_dst_get-and-dst_dev_rcu-in-get_netdev_for_sock.patch
+csky-fix-csky_cmpxchg_fixup-not-working.patch
+arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch
+alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch
+nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch
+nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch
+bcache-fix-improper-use-of-bi_end_io.patch
+smb-client-fix-nt_status_unable_to_free_vm-value.patch
+smb-client-fix-nt_status_device_door_open-value.patch
+smb-client-fix-nt_status_no_data_detected-value.patch
+scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch
+scsi-ufs-core-fix-eh-failure-after-w-lun-resume-erro.patch
+scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch
--- /dev/null
+From 838f8a4b49d288c813fc8bbfb7a93e6ee094d583 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Dec 2025 09:17:57 +0800
+Subject: smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value
+
+From: ChenXiaoSong <chenxiaosong@kylinos.cn>
+
+[ Upstream commit b2b50fca34da5ec231008edba798ddf92986bd7f ]
+
+This was reported by the KUnit tests in the later patches.
+
+See MS-ERREF 2.3.1 STATUS_DEVICE_DOOR_OPEN. Keep it consistent with the
+value in the documentation.
+
+Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/nterr.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/nterr.h b/fs/smb/client/nterr.h
+index 7ce063a1dc3f6..d46d42559eea2 100644
+--- a/fs/smb/client/nterr.h
++++ b/fs/smb/client/nterr.h
+@@ -44,7 +44,7 @@ extern const struct nt_err_code_struct nt_errs[];
+ #define NT_STATUS_NO_DATA_DETECTED 0x8000001c
+ #define NT_STATUS_STOPPED_ON_SYMLINK 0x8000002d
+ #define NT_STATUS_DEVICE_REQUIRES_CLEANING 0x80000288
+-#define NT_STATUS_DEVICE_DOOR_OPEN 0x80000288
++#define NT_STATUS_DEVICE_DOOR_OPEN 0x80000289
+ #define NT_STATUS_UNSUCCESSFUL 0xC0000000 | 0x0001
+ #define NT_STATUS_NOT_IMPLEMENTED 0xC0000000 | 0x0002
+ #define NT_STATUS_INVALID_INFO_CLASS 0xC0000000 | 0x0003
+--
+2.51.0
+
--- /dev/null
+From 27cbea2186c608003dce4dd49d1c86b4f63a3e32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Dec 2025 09:13:06 +0800
+Subject: smb/client: fix NT_STATUS_NO_DATA_DETECTED value
+
+From: ChenXiaoSong <chenxiaosong@kylinos.cn>
+
+[ Upstream commit a1237c203f1757480dc2f3b930608ee00072d3cc ]
+
+This was reported by the KUnit tests in the later patches.
+
+See MS-ERREF 2.3.1 STATUS_NO_DATA_DETECTED. Keep it consistent with the
+value in the documentation.
+
+Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/nterr.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/nterr.h b/fs/smb/client/nterr.h
+index d46d42559eea2..e3a341316a711 100644
+--- a/fs/smb/client/nterr.h
++++ b/fs/smb/client/nterr.h
+@@ -41,7 +41,7 @@ extern const struct nt_err_code_struct nt_errs[];
+ #define NT_STATUS_MEDIA_CHANGED 0x8000001c
+ #define NT_STATUS_END_OF_MEDIA 0x8000001e
+ #define NT_STATUS_MEDIA_CHECK 0x80000020
+-#define NT_STATUS_NO_DATA_DETECTED 0x8000001c
++#define NT_STATUS_NO_DATA_DETECTED 0x80000022
+ #define NT_STATUS_STOPPED_ON_SYMLINK 0x8000002d
+ #define NT_STATUS_DEVICE_REQUIRES_CLEANING 0x80000288
+ #define NT_STATUS_DEVICE_DOOR_OPEN 0x80000289
+--
+2.51.0
+
--- /dev/null
+From f220ec313084f210c394dc7f665e197881aa3b86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Dec 2025 09:22:53 +0800
+Subject: smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value
+
+From: ChenXiaoSong <chenxiaosong@kylinos.cn>
+
+[ Upstream commit 9f99caa8950a76f560a90074e3a4b93cfa8b3d84 ]
+
+This was reported by the KUnit tests in the later patches.
+
+See MS-ERREF 2.3.1 STATUS_UNABLE_TO_FREE_VM. Keep it consistent with the
+value in the documentation.
+
+Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/nterr.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/nterr.h b/fs/smb/client/nterr.h
+index edd4741cab0a1..7ce063a1dc3f6 100644
+--- a/fs/smb/client/nterr.h
++++ b/fs/smb/client/nterr.h
+@@ -70,7 +70,7 @@ extern const struct nt_err_code_struct nt_errs[];
+ #define NT_STATUS_NO_MEMORY 0xC0000000 | 0x0017
+ #define NT_STATUS_CONFLICTING_ADDRESSES 0xC0000000 | 0x0018
+ #define NT_STATUS_NOT_MAPPED_VIEW 0xC0000000 | 0x0019
+-#define NT_STATUS_UNABLE_TO_FREE_VM 0x80000000 | 0x001a
++#define NT_STATUS_UNABLE_TO_FREE_VM 0xC0000000 | 0x001a
+ #define NT_STATUS_UNABLE_TO_DELETE_SECTION 0xC0000000 | 0x001b
+ #define NT_STATUS_INVALID_SYSTEM_SERVICE 0xC0000000 | 0x001c
+ #define NT_STATUS_ILLEGAL_INSTRUCTION 0xC0000000 | 0x001d
+--
+2.51.0
+
--- /dev/null
+From 5a8cb69a2744cb9fa2cdf4172cb4efcfb4cf70e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 08:14:57 +0000
+Subject: alpha: don't reference obsolete termio struct for TC* constants
+
+From: Sam James <sam@gentoo.org>
+
+[ Upstream commit 9aeed9041929812a10a6d693af050846942a1d16 ]
+
+Similar in nature to ab107276607af90b13a5994997e19b7b9731e251. glibc-2.42
+drops the legacy termio struct, but the ioctls.h header still defines some
+TC* constants in terms of termio (via sizeof). Hardcode the values instead.
+
+This fixes building Python for example, which falls over like:
+ ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio'
+
+Link: https://bugs.gentoo.org/961769
+Link: https://bugs.gentoo.org/962600
+Signed-off-by: Sam James <sam@gentoo.org>
+Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
+Link: https://lore.kernel.org/r/6ebd3451908785cad53b50ca6bc46cfe9d6bc03c.1764922497.git.sam@gentoo.org
+Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/alpha/include/uapi/asm/ioctls.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/alpha/include/uapi/asm/ioctls.h b/arch/alpha/include/uapi/asm/ioctls.h
+index 971311605288f..a09d04b49cc65 100644
+--- a/arch/alpha/include/uapi/asm/ioctls.h
++++ b/arch/alpha/include/uapi/asm/ioctls.h
+@@ -23,10 +23,10 @@
+ #define TCSETSW _IOW('t', 21, struct termios)
+ #define TCSETSF _IOW('t', 22, struct termios)
+
+-#define TCGETA _IOR('t', 23, struct termio)
+-#define TCSETA _IOW('t', 24, struct termio)
+-#define TCSETAW _IOW('t', 25, struct termio)
+-#define TCSETAF _IOW('t', 28, struct termio)
++#define TCGETA 0x40127417
++#define TCSETA 0x80127418
++#define TCSETAW 0x80127419
++#define TCSETAF 0x8012741c
+
+ #define TCSBRK _IO('t', 29)
+ #define TCXONC _IO('t', 30)
+--
+2.51.0
+
--- /dev/null
+From 10383fd99ee873a5afd2064b9af7173252f7ba00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Nov 2025 16:54:37 +0100
+Subject: ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit fedadc4137234c3d00c4785eeed3e747fe9036ae ]
+
+gup_pgd_range() is invoked with disabled interrupts and invokes
+__kmap_local_page_prot() via pte_offset_map(), gup_p4d_range().
+With HIGHPTE enabled, __kmap_local_page_prot() invokes kmap_high_get()
+which uses a spinlock_t via lock_kmap_any(). This leads to an
+sleeping-while-atomic error on PREEMPT_RT because spinlock_t becomes a
+sleeping lock and must not be acquired in atomic context.
+
+The loop in map_new_virtual() uses wait_queue_head_t for wake up which
+also is using a spinlock_t.
+
+Since HIGHPTE is rarely needed at all, turn it off for PREEMPT_RT
+to allow the use of get_user_pages_fast().
+
+[arnd: rework patch to turn off HIGHPTE instead of HAVE_PAST_GUP]
+
+Co-developed-by: Arnd Bergmann <arnd@arndb.de>
+
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index d5bf16462bdba..cc8beccc4e86d 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -1229,7 +1229,7 @@ config HIGHMEM
+
+ config HIGHPTE
+ bool "Allocate 2nd-level pagetables from highmem" if EXPERT
+- depends on HIGHMEM
++ depends on HIGHMEM && !PREEMPT_RT
+ default y
+ help
+ The VM uses one page of physical memory for each page table.
+--
+2.51.0
+
--- /dev/null
+From 04001c04b8ad988519cc401191323d9fdec60f54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Dec 2025 15:16:45 +0100
+Subject: ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again)
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
+
+[ Upstream commit 57d508b5f718730f74b11e0dc9609ac7976802d1 ]
+
+'version' is an enum, thus cast of pointer on 64-bit compile test with
+clang W=1 causes:
+
+ rockchip_pdm.c:583:17: error: cast to smaller integer type 'enum rk_pdm_version' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast]
+
+This was already fixed in commit 49a4a8d12612 ("ASoC: rockchip: Fix
+Wvoid-pointer-to-enum-cast warning") but then got bad in
+commit 9958d85968ed ("ASoC: Use device_get_match_data()").
+
+Discussion on LKML also pointed out that 'uintptr_t' is not the correct
+type and either 'kernel_ulong_t' or 'unsigned long' should be used,
+with several arguments towards the latter [1].
+
+Link: https://lore.kernel.org/r/CAMuHMdX7t=mabqFE5O-Cii3REMuyaePHmqX+j_mqyrn6XXzsoA@mail.gmail.com/ [1]
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
+Link: https://patch.msgid.link/20251203141644.106459-2-krzysztof.kozlowski@oss.qualcomm.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/rockchip/rockchip_pdm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/rockchip/rockchip_pdm.c b/sound/soc/rockchip/rockchip_pdm.c
+index cae91108f7a8e..30d51e03d49e9 100644
+--- a/sound/soc/rockchip/rockchip_pdm.c
++++ b/sound/soc/rockchip/rockchip_pdm.c
+@@ -580,7 +580,7 @@ static int rockchip_pdm_probe(struct platform_device *pdev)
+ if (!pdm)
+ return -ENOMEM;
+
+- pdm->version = (enum rk_pdm_version)device_get_match_data(&pdev->dev);
++ pdm->version = (unsigned long)device_get_match_data(&pdev->dev);
+ if (pdm->version == RK_PDM_RK3308) {
+ pdm->reset = devm_reset_control_get(&pdev->dev, "pdm-m");
+ if (IS_ERR(pdm->reset))
+--
+2.51.0
+
--- /dev/null
+From 6c4579ac46128404dcfb1bea2774ebddcd0b0074 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Dec 2025 17:01:56 +0800
+Subject: bcache: fix improper use of bi_end_io
+
+From: Shida Zhang <zhangshida@kylinos.cn>
+
+[ Upstream commit 53280e398471f0bddbb17b798a63d41264651325 ]
+
+Don't call bio->bi_end_io() directly. Use the bio_endio() helper
+function instead, which handles completion more safely and uniformly.
+
+Suggested-by: Christoph Hellwig <hch@infradead.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Shida Zhang <zhangshida@kylinos.cn>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/request.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
+index af345dc6fde14..82fdea7dea7aa 100644
+--- a/drivers/md/bcache/request.c
++++ b/drivers/md/bcache/request.c
+@@ -1104,7 +1104,7 @@ static void detached_dev_end_io(struct bio *bio)
+ }
+
+ kfree(ddip);
+- bio->bi_end_io(bio);
++ bio_endio(bio);
+ }
+
+ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio,
+@@ -1121,7 +1121,7 @@ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio,
+ ddip = kzalloc(sizeof(struct detached_dev_io_private), GFP_NOIO);
+ if (!ddip) {
+ bio->bi_status = BLK_STS_RESOURCE;
+- bio->bi_end_io(bio);
++ bio_endio(bio);
+ return;
+ }
+
+@@ -1136,7 +1136,7 @@ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio,
+
+ if ((bio_op(bio) == REQ_OP_DISCARD) &&
+ !bdev_max_discard_sectors(dc->bdev))
+- bio->bi_end_io(bio);
++ detached_dev_end_io(bio);
+ else
+ submit_bio_noacct(bio);
+ }
+--
+2.51.0
+
--- /dev/null
+From e15d81a0aea27235d4053f95c355b7a617b3226c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Oct 2025 11:11:25 +0200
+Subject: btrfs: fix NULL dereference on root when tracing inode eviction
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Miquel Sabaté Solà <mssola@mssola.com>
+
+[ Upstream commit f157dd661339fc6f5f2b574fe2429c43bd309534 ]
+
+When evicting an inode the first thing we do is to setup tracing for it,
+which implies fetching the root's id. But in btrfs_evict_inode() the
+root might be NULL, as implied in the next check that we do in
+btrfs_evict_inode().
+
+Hence, we either should set the ->root_objectid to 0 in case the root is
+NULL, or we move tracing setup after checking that the root is not
+NULL. Setting the rootid to 0 at least gives us the possibility to trace
+this call even in the case when the root is NULL, so that's the solution
+taken here.
+
+Fixes: 1abe9b8a138c ("Btrfs: add initial tracepoint support for btrfs")
+Reported-by: syzbot+d991fea1b4b23b1f6bf8@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=d991fea1b4b23b1f6bf8
+Signed-off-by: Miquel Sabaté Solà <mssola@mssola.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/btrfs.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h
+index cc88074914283..0ca86909ce5bd 100644
+--- a/include/trace/events/btrfs.h
++++ b/include/trace/events/btrfs.h
+@@ -223,7 +223,8 @@ DECLARE_EVENT_CLASS(btrfs__inode,
+ __entry->generation = BTRFS_I(inode)->generation;
+ __entry->last_trans = BTRFS_I(inode)->last_trans;
+ __entry->logged_trans = BTRFS_I(inode)->logged_trans;
+- __entry->root_objectid = btrfs_root_id(BTRFS_I(inode)->root);
++ __entry->root_objectid = BTRFS_I(inode)->root ?
++ btrfs_root_id(BTRFS_I(inode)->root) : 0;
+ ),
+
+ TP_printk_btrfs("root=%llu(%s) gen=%llu ino=%llu blocks=%llu "
+--
+2.51.0
+
--- /dev/null
+From ddfd965c923daeb43797c972e4badb8be5da4512 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 12:47:14 -0800
+Subject: btrfs: fix qgroup_snapshot_quick_inherit() squota bug
+
+From: Boris Burkov <boris@bur.io>
+
+[ Upstream commit 7ee19a59a75e3d5b9ec00499b86af8e2a46fbe86 ]
+
+qgroup_snapshot_quick_inherit() detects conditions where the snapshot
+destination would land in the same parent qgroup as the snapshot source
+subvolume. In this case we can avoid costly qgroup calculations and just
+add the nodesize of the new snapshot to the parent.
+
+However, in the case of squotas this is actually a double count, and
+also an undercount for deeper qgroup nestings.
+
+The following annotated script shows the issue:
+
+ btrfs quota enable --simple "$mnt"
+
+ # Create 2-level qgroup hierarchy
+ btrfs qgroup create 2/100 "$mnt" # Q2 (level 2)
+ btrfs qgroup create 1/100 "$mnt" # Q1 (level 1)
+ btrfs qgroup assign 1/100 2/100 "$mnt"
+
+ # Create base subvolume
+ btrfs subvolume create "$mnt/base" >/dev/null
+ base_id=$(btrfs subvolume show "$mnt/base" | grep 'Subvolume ID:' | awk '{print $3}')
+
+ # Create intermediate snapshot and add to Q1
+ btrfs subvolume snapshot "$mnt/base" "$mnt/intermediate" >/dev/null
+ inter_id=$(btrfs subvolume show "$mnt/intermediate" | grep 'Subvolume ID:' | awk '{print $3}')
+ btrfs qgroup assign "0/$inter_id" 1/100 "$mnt"
+
+ # Create working snapshot with --inherit (auto-adds to Q1)
+ # src=intermediate (in only Q1)
+ # dst=snap (inheriting only into Q1)
+ # This double counts the 16k nodesize of the snapshot in Q1, and
+ # undercounts it in Q2.
+ btrfs subvolume snapshot -i 1/100 "$mnt/intermediate" "$mnt/snap" >/dev/null
+ snap_id=$(btrfs subvolume show "$mnt/snap" | grep 'Subvolume ID:' | awk '{print $3}')
+
+ # Fully complete snapshot creation
+ sync
+
+ # Delete working snapshot
+ # Q1 and Q2 will lose the full snap usage
+ btrfs subvolume delete "$mnt/snap" >/dev/null
+
+ # Delete intermediate and remove from Q1
+ # Q1 and Q2 will lose the full intermediate usage
+ btrfs qgroup remove "0/$inter_id" 1/100 "$mnt"
+ btrfs subvolume delete "$mnt/intermediate" >/dev/null
+
+ # Q1 should be at 0, but still has 16k. Q2 is "correct" at 0 (for now...)
+
+ # Trigger cleaner, wait for deletions
+ mount -o remount,sync=1 "$mnt"
+ btrfs subvolume sync "$mnt" "$snap_id"
+ btrfs subvolume sync "$mnt" "$inter_id"
+
+ # Remove Q1 from Q2
+ # Frees 16k more from Q2, underflowing it to 16EiB
+ btrfs qgroup remove 1/100 2/100 "$mnt"
+
+ # And show the bad state:
+ btrfs qgroup show -pc "$mnt"
+
+ Qgroupid Referenced Exclusive Parent Child Path
+ -------- ---------- --------- ------ ----- ----
+ 0/5 16.00KiB 16.00KiB - - <toplevel>
+ 0/256 16.00KiB 16.00KiB - - base
+ 1/100 16.00KiB 16.00KiB - - <0 member qgroups>
+ 2/100 16.00EiB 16.00EiB - - <0 member qgroups>
+
+Fix this by simply not doing this quick inheritance with squotas.
+
+I suspect that it is also wrong in normal qgroups to not recurse up the
+qgroup tree in the quick inherit case, though other consistency checks
+will likely fix it anyway.
+
+Fixes: b20fe56cd285 ("btrfs: qgroup: allow quick inherit if snapshot is created and added to the same parent")
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Boris Burkov <boris@bur.io>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/qgroup.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index 3c77f3506faf3..f23b482dfad9e 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -3298,6 +3298,9 @@ static int qgroup_snapshot_quick_inherit(struct btrfs_fs_info *fs_info,
+ struct btrfs_qgroup_list *list;
+ int nr_parents = 0;
+
++ if (btrfs_qgroup_mode(fs_info) != BTRFS_QGROUP_MODE_FULL)
++ return 0;
++
+ src = find_qgroup_rb(fs_info, srcid);
+ if (!src)
+ return -ENOENT;
+--
+2.51.0
+
--- /dev/null
+From d7694b3094b8bcea7f00a8cd6fbcfd27e4430f8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Dec 2025 14:38:23 +1030
+Subject: btrfs: qgroup: update all parent qgroups when doing quick inherit
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit 68d4b3fa18d72b7f649e83012e7e08f1881f6b75 ]
+
+[BUG]
+There is a bug that if a subvolume has multi-level parent qgroups, and
+is able to do a quick inherit, only the direct parent qgroup got
+updated:
+
+ mkfs.btrfs -f -O quota $dev
+ mount $dev $mnt
+ btrfs subv create $mnt/subv1
+ btrfs qgroup create 1/100 $mnt
+ btrfs qgroup create 2/100 $mnt
+ btrfs qgroup assign 1/100 2/100 $mnt
+ btrfs qgroup assign 0/256 1/100 $mnt
+ btrfs qgroup show -p --sync $mnt
+
+ Qgroupid Referenced Exclusive Parent Path
+ -------- ---------- --------- ------ ----
+ 0/5 16.00KiB 16.00KiB - <toplevel>
+ 0/256 16.00KiB 16.00KiB 1/100 subv1
+ 1/100 16.00KiB 16.00KiB 2/100 2/100<1 member qgroup>
+ 2/100 16.00KiB 16.00KiB - <0 member qgroups>
+
+ btrfs subv snap -i 1/100 $mnt/subv1 $mnt/snap1
+ btrfs qgroup show -p --sync $mnt
+
+ Qgroupid Referenced Exclusive Parent Path
+ -------- ---------- --------- ------ ----
+ 0/5 16.00KiB 16.00KiB - <toplevel>
+ 0/256 16.00KiB 16.00KiB 1/100 subv1
+ 0/257 16.00KiB 16.00KiB 1/100 snap1
+ 1/100 32.00KiB 32.00KiB 2/100 2/100<1 member qgroup>
+ 2/100 16.00KiB 16.00KiB - <0 member qgroups>
+ # Note that 2/100 is not updated, and qgroup numbers are inconsistent
+
+ umount $mnt
+
+[CAUSE]
+If the snapshot source subvolume belongs to a parent qgroup, and the new
+snapshot target is also added to the new same parent qgroup, we allow a
+quick update without marking qgroup inconsistent.
+
+But that quick update only update the parent qgroup, without checking if
+there is any more parent qgroups.
+
+[FIX]
+Iterate through all parent qgroups during the quick inherit.
+
+Reported-by: Boris Burkov <boris@bur.io>
+Fixes: b20fe56cd285 ("btrfs: qgroup: allow quick inherit if snapshot is created and added to the same parent")
+Reviewed-by: Boris Burkov <boris@bur.io>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/qgroup.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index f23b482dfad9e..029017afaf344 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -3295,7 +3295,10 @@ static int qgroup_snapshot_quick_inherit(struct btrfs_fs_info *fs_info,
+ {
+ struct btrfs_qgroup *src;
+ struct btrfs_qgroup *parent;
++ struct btrfs_qgroup *qgroup;
+ struct btrfs_qgroup_list *list;
++ LIST_HEAD(qgroup_list);
++ const u32 nodesize = fs_info->nodesize;
+ int nr_parents = 0;
+
+ if (btrfs_qgroup_mode(fs_info) != BTRFS_QGROUP_MODE_FULL)
+@@ -3335,8 +3338,19 @@ static int qgroup_snapshot_quick_inherit(struct btrfs_fs_info *fs_info,
+ if (parent->excl != parent->rfer)
+ return 1;
+
+- parent->excl += fs_info->nodesize;
+- parent->rfer += fs_info->nodesize;
++ qgroup_iterator_add(&qgroup_list, parent);
++ list_for_each_entry(qgroup, &qgroup_list, iterator) {
++ qgroup->rfer += nodesize;
++ qgroup->rfer_cmpr += nodesize;
++ qgroup->excl += nodesize;
++ qgroup->excl_cmpr += nodesize;
++ qgroup_dirty(fs_info, qgroup);
++
++ /* Append parent qgroups to @qgroup_list. */
++ list_for_each_entry(list, &qgroup->groups, next_group)
++ qgroup_iterator_add(&qgroup_list, list->group);
++ }
++ qgroup_iterator_clean(&qgroup_list);
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From ccb812fee0df8eac13e8fe36e6dfae3fa9c03e93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Apr 2025 16:23:41 +0100
+Subject: btrfs: tracepoints: use btrfs_root_id() to get the id of a root
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit 0f987c099d22c3b8c7d94fd13f957792e46f79c9 ]
+
+Instead of open coding btrfs_root_id() to get the ID of a root, use the
+helper in the trace points, which also makes the code less verbose.
+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Stable-dep-of: f157dd661339 ("btrfs: fix NULL dereference on root when tracing inode eviction")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/btrfs.h | 50 +++++++++++++++++-------------------
+ 1 file changed, 23 insertions(+), 27 deletions(-)
+
+diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h
+index 3b16b0cc1b7a6..cc88074914283 100644
+--- a/include/trace/events/btrfs.h
++++ b/include/trace/events/btrfs.h
+@@ -223,8 +223,7 @@ DECLARE_EVENT_CLASS(btrfs__inode,
+ __entry->generation = BTRFS_I(inode)->generation;
+ __entry->last_trans = BTRFS_I(inode)->last_trans;
+ __entry->logged_trans = BTRFS_I(inode)->logged_trans;
+- __entry->root_objectid =
+- BTRFS_I(inode)->root->root_key.objectid;
++ __entry->root_objectid = btrfs_root_id(BTRFS_I(inode)->root);
+ ),
+
+ TP_printk_btrfs("root=%llu(%s) gen=%llu ino=%llu blocks=%llu "
+@@ -296,7 +295,7 @@ TRACE_EVENT_CONDITION(btrfs_get_extent,
+ ),
+
+ TP_fast_assign_btrfs(root->fs_info,
+- __entry->root_objectid = root->root_key.objectid;
++ __entry->root_objectid = btrfs_root_id(root);
+ __entry->ino = btrfs_ino(inode);
+ __entry->start = map->start;
+ __entry->len = map->len;
+@@ -375,7 +374,7 @@ DECLARE_EVENT_CLASS(btrfs__file_extent_item_regular,
+ ),
+
+ TP_fast_assign_btrfs(bi->root->fs_info,
+- __entry->root_obj = bi->root->root_key.objectid;
++ __entry->root_obj = btrfs_root_id(bi->root);
+ __entry->ino = btrfs_ino(bi);
+ __entry->isize = bi->vfs_inode.i_size;
+ __entry->disk_isize = bi->disk_i_size;
+@@ -426,7 +425,7 @@ DECLARE_EVENT_CLASS(
+
+ TP_fast_assign_btrfs(
+ bi->root->fs_info,
+- __entry->root_obj = bi->root->root_key.objectid;
++ __entry->root_obj = btrfs_root_id(bi->root);
+ __entry->ino = btrfs_ino(bi);
+ __entry->isize = bi->vfs_inode.i_size;
+ __entry->disk_isize = bi->disk_i_size;
+@@ -526,7 +525,7 @@ DECLARE_EVENT_CLASS(btrfs__ordered_extent,
+ __entry->flags = ordered->flags;
+ __entry->compress_type = ordered->compress_type;
+ __entry->refs = refcount_read(&ordered->refs);
+- __entry->root_objectid = inode->root->root_key.objectid;
++ __entry->root_objectid = btrfs_root_id(inode->root);
+ __entry->truncated_len = ordered->truncated_len;
+ ),
+
+@@ -663,7 +662,7 @@ TRACE_EVENT(btrfs_finish_ordered_extent,
+ __entry->start = start;
+ __entry->len = len;
+ __entry->uptodate = uptodate;
+- __entry->root_objectid = inode->root->root_key.objectid;
++ __entry->root_objectid = btrfs_root_id(inode->root);
+ ),
+
+ TP_printk_btrfs("root=%llu(%s) ino=%llu start=%llu len=%llu uptodate=%d",
+@@ -704,8 +703,7 @@ DECLARE_EVENT_CLASS(btrfs__writepage,
+ __entry->for_reclaim = wbc->for_reclaim;
+ __entry->range_cyclic = wbc->range_cyclic;
+ __entry->writeback_index = inode->i_mapping->writeback_index;
+- __entry->root_objectid =
+- BTRFS_I(inode)->root->root_key.objectid;
++ __entry->root_objectid = btrfs_root_id(BTRFS_I(inode)->root);
+ ),
+
+ TP_printk_btrfs("root=%llu(%s) ino=%llu page_index=%lu "
+@@ -749,7 +747,7 @@ TRACE_EVENT(btrfs_writepage_end_io_hook,
+ __entry->start = start;
+ __entry->end = end;
+ __entry->uptodate = uptodate;
+- __entry->root_objectid = inode->root->root_key.objectid;
++ __entry->root_objectid = btrfs_root_id(inode->root);
+ ),
+
+ TP_printk_btrfs("root=%llu(%s) ino=%llu start=%llu end=%llu uptodate=%d",
+@@ -779,8 +777,7 @@ TRACE_EVENT(btrfs_sync_file,
+ __entry->ino = btrfs_ino(BTRFS_I(inode));
+ __entry->parent = btrfs_ino(BTRFS_I(d_inode(dentry->d_parent)));
+ __entry->datasync = datasync;
+- __entry->root_objectid =
+- BTRFS_I(inode)->root->root_key.objectid;
++ __entry->root_objectid = btrfs_root_id(BTRFS_I(inode)->root);
+ ),
+
+ TP_printk_btrfs("root=%llu(%s) ino=%llu parent=%llu datasync=%d",
+@@ -1051,7 +1048,7 @@ DECLARE_EVENT_CLASS(btrfs__chunk,
+ __entry->sub_stripes = map->sub_stripes;
+ __entry->offset = offset;
+ __entry->size = size;
+- __entry->root_objectid = fs_info->chunk_root->root_key.objectid;
++ __entry->root_objectid = btrfs_root_id(fs_info->chunk_root);
+ ),
+
+ TP_printk_btrfs("root=%llu(%s) offset=%llu size=%llu "
+@@ -1096,7 +1093,7 @@ TRACE_EVENT(btrfs_cow_block,
+ ),
+
+ TP_fast_assign_btrfs(root->fs_info,
+- __entry->root_objectid = root->root_key.objectid;
++ __entry->root_objectid = btrfs_root_id(root);
+ __entry->buf_start = buf->start;
+ __entry->refs = atomic_read(&buf->refs);
+ __entry->cow_start = cow->start;
+@@ -1254,7 +1251,7 @@ TRACE_EVENT(find_free_extent,
+ ),
+
+ TP_fast_assign_btrfs(root->fs_info,
+- __entry->root_objectid = root->root_key.objectid;
++ __entry->root_objectid = btrfs_root_id(root);
+ __entry->num_bytes = ffe_ctl->num_bytes;
+ __entry->empty_size = ffe_ctl->empty_size;
+ __entry->flags = ffe_ctl->flags;
+@@ -1283,7 +1280,7 @@ TRACE_EVENT(find_free_extent_search_loop,
+ ),
+
+ TP_fast_assign_btrfs(root->fs_info,
+- __entry->root_objectid = root->root_key.objectid;
++ __entry->root_objectid = btrfs_root_id(root);
+ __entry->num_bytes = ffe_ctl->num_bytes;
+ __entry->empty_size = ffe_ctl->empty_size;
+ __entry->flags = ffe_ctl->flags;
+@@ -1317,7 +1314,7 @@ TRACE_EVENT(find_free_extent_have_block_group,
+ ),
+
+ TP_fast_assign_btrfs(root->fs_info,
+- __entry->root_objectid = root->root_key.objectid;
++ __entry->root_objectid = btrfs_root_id(root);
+ __entry->num_bytes = ffe_ctl->num_bytes;
+ __entry->empty_size = ffe_ctl->empty_size;
+ __entry->flags = ffe_ctl->flags;
+@@ -1671,8 +1668,7 @@ DECLARE_EVENT_CLASS(btrfs__qgroup_rsv_data,
+ ),
+
+ TP_fast_assign_btrfs(btrfs_sb(inode->i_sb),
+- __entry->rootid =
+- BTRFS_I(inode)->root->root_key.objectid;
++ __entry->rootid = btrfs_root_id(BTRFS_I(inode)->root);
+ __entry->ino = btrfs_ino(BTRFS_I(inode));
+ __entry->start = start;
+ __entry->len = len;
+@@ -1862,7 +1858,7 @@ TRACE_EVENT(qgroup_meta_reserve,
+ ),
+
+ TP_fast_assign_btrfs(root->fs_info,
+- __entry->refroot = root->root_key.objectid;
++ __entry->refroot = btrfs_root_id(root);
+ __entry->diff = diff;
+ __entry->type = type;
+ ),
+@@ -1884,7 +1880,7 @@ TRACE_EVENT(qgroup_meta_convert,
+ ),
+
+ TP_fast_assign_btrfs(root->fs_info,
+- __entry->refroot = root->root_key.objectid;
++ __entry->refroot = btrfs_root_id(root);
+ __entry->diff = diff;
+ ),
+
+@@ -1908,7 +1904,7 @@ TRACE_EVENT(qgroup_meta_free_all_pertrans,
+ ),
+
+ TP_fast_assign_btrfs(root->fs_info,
+- __entry->refroot = root->root_key.objectid;
++ __entry->refroot = btrfs_root_id(root);
+ spin_lock(&root->qgroup_meta_rsv_lock);
+ __entry->diff = -(s64)root->qgroup_meta_rsv_pertrans;
+ spin_unlock(&root->qgroup_meta_rsv_lock);
+@@ -1990,7 +1986,7 @@ TRACE_EVENT(btrfs_inode_mod_outstanding_extents,
+ ),
+
+ TP_fast_assign_btrfs(root->fs_info,
+- __entry->root_objectid = root->root_key.objectid;
++ __entry->root_objectid = btrfs_root_id(root);
+ __entry->ino = ino;
+ __entry->mod = mod;
+ __entry->outstanding = outstanding;
+@@ -2075,7 +2071,7 @@ TRACE_EVENT(btrfs_set_extent_bit,
+
+ __entry->owner = tree->owner;
+ __entry->ino = inode ? btrfs_ino(inode) : 0;
+- __entry->rootid = inode ? inode->root->root_key.objectid : 0;
++ __entry->rootid = inode ? btrfs_root_id(inode->root) : 0;
+ __entry->start = start;
+ __entry->len = len;
+ __entry->set_bits = set_bits;
+@@ -2108,7 +2104,7 @@ TRACE_EVENT(btrfs_clear_extent_bit,
+
+ __entry->owner = tree->owner;
+ __entry->ino = inode ? btrfs_ino(inode) : 0;
+- __entry->rootid = inode ? inode->root->root_key.objectid : 0;
++ __entry->rootid = inode ? btrfs_root_id(inode->root) : 0;
+ __entry->start = start;
+ __entry->len = len;
+ __entry->clear_bits = clear_bits;
+@@ -2142,7 +2138,7 @@ TRACE_EVENT(btrfs_convert_extent_bit,
+
+ __entry->owner = tree->owner;
+ __entry->ino = inode ? btrfs_ino(inode) : 0;
+- __entry->rootid = inode ? inode->root->root_key.objectid : 0;
++ __entry->rootid = inode ? btrfs_root_id(inode->root) : 0;
+ __entry->start = start;
+ __entry->len = len;
+ __entry->set_bits = set_bits;
+@@ -2619,7 +2615,7 @@ TRACE_EVENT(btrfs_extent_map_shrinker_remove_em,
+
+ TP_fast_assign_btrfs(inode->root->fs_info,
+ __entry->ino = btrfs_ino(inode);
+- __entry->root_id = inode->root->root_key.objectid;
++ __entry->root_id = btrfs_root_id(inode->root);
+ __entry->start = em->start;
+ __entry->len = em->len;
+ __entry->flags = em->flags;
+--
+2.51.0
+
--- /dev/null
+From d163c0769b5f92e9e87c96b8958982c36a22b6c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2024 17:56:26 +0800
+Subject: csky: fix csky_cmpxchg_fixup not working
+
+From: Yang Li <yang.li85200@gmail.com>
+
+[ Upstream commit 809ef03d6d21d5fea016bbf6babeec462e37e68c ]
+
+In the csky_cmpxchg_fixup function, it is incorrect to use the global
+variable csky_cmpxchg_stw to determine the address where the exception
+occurred.The global variable csky_cmpxchg_stw stores the opcode at the
+time of the exception, while &csky_cmpxchg_stw shows the address where
+the exception occurred.
+
+Signed-off-by: Yang Li <yang.li85200@gmail.com>
+Signed-off-by: Guo Ren <guoren@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/csky/mm/fault.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/csky/mm/fault.c b/arch/csky/mm/fault.c
+index a885518ce1dd2..5226bc08c3360 100644
+--- a/arch/csky/mm/fault.c
++++ b/arch/csky/mm/fault.c
+@@ -45,8 +45,8 @@ static inline void csky_cmpxchg_fixup(struct pt_regs *regs)
+ if (trap_no(regs) != VEC_TLBMODIFIED)
+ return;
+
+- if (instruction_pointer(regs) == csky_cmpxchg_stw)
+- instruction_pointer_set(regs, csky_cmpxchg_ldw);
++ if (instruction_pointer(regs) == (unsigned long)&csky_cmpxchg_stw)
++ instruction_pointer_set(regs, (unsigned long)&csky_cmpxchg_ldw);
+ return;
+ }
+ #endif
+--
+2.51.0
+
--- /dev/null
+From d933d77f619523dbd68f415c6f981368db831572 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 22:13:10 +0100
+Subject: dm-snapshot: fix 'scheduling while atomic' on real-time kernels
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+[ Upstream commit 8581b19eb2c5ccf06c195d3b5468c3c9d17a5020 ]
+
+There is reported 'scheduling while atomic' bug when using dm-snapshot on
+real-time kernels. The reason for the bug is that the hlist_bl code does
+preempt_disable() when taking the lock and the kernel attempts to take
+other spinlocks while holding the hlist_bl lock.
+
+Fix this by converting a hlist_bl spinlock into a regular spinlock.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Reported-by: Jiping Ma <jiping.ma2@windriver.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-exception-store.h | 2 +-
+ drivers/md/dm-snap.c | 73 +++++++++++++++------------------
+ 2 files changed, 35 insertions(+), 40 deletions(-)
+
+diff --git a/drivers/md/dm-exception-store.h b/drivers/md/dm-exception-store.h
+index b679766375381..061b4d3108132 100644
+--- a/drivers/md/dm-exception-store.h
++++ b/drivers/md/dm-exception-store.h
+@@ -29,7 +29,7 @@ typedef sector_t chunk_t;
+ * chunk within the device.
+ */
+ struct dm_exception {
+- struct hlist_bl_node hash_list;
++ struct hlist_node hash_list;
+
+ chunk_t old_chunk;
+ chunk_t new_chunk;
+diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
+index f40c18da40000..dbd148967de42 100644
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -40,10 +40,15 @@ static const char dm_snapshot_merge_target_name[] = "snapshot-merge";
+ #define DM_TRACKED_CHUNK_HASH(x) ((unsigned long)(x) & \
+ (DM_TRACKED_CHUNK_HASH_SIZE - 1))
+
++struct dm_hlist_head {
++ struct hlist_head head;
++ spinlock_t lock;
++};
++
+ struct dm_exception_table {
+ uint32_t hash_mask;
+ unsigned int hash_shift;
+- struct hlist_bl_head *table;
++ struct dm_hlist_head *table;
+ };
+
+ struct dm_snapshot {
+@@ -628,8 +633,8 @@ static uint32_t exception_hash(struct dm_exception_table *et, chunk_t chunk);
+
+ /* Lock to protect access to the completed and pending exception hash tables. */
+ struct dm_exception_table_lock {
+- struct hlist_bl_head *complete_slot;
+- struct hlist_bl_head *pending_slot;
++ spinlock_t *complete_slot;
++ spinlock_t *pending_slot;
+ };
+
+ static void dm_exception_table_lock_init(struct dm_snapshot *s, chunk_t chunk,
+@@ -638,20 +643,20 @@ static void dm_exception_table_lock_init(struct dm_snapshot *s, chunk_t chunk,
+ struct dm_exception_table *complete = &s->complete;
+ struct dm_exception_table *pending = &s->pending;
+
+- lock->complete_slot = &complete->table[exception_hash(complete, chunk)];
+- lock->pending_slot = &pending->table[exception_hash(pending, chunk)];
++ lock->complete_slot = &complete->table[exception_hash(complete, chunk)].lock;
++ lock->pending_slot = &pending->table[exception_hash(pending, chunk)].lock;
+ }
+
+ static void dm_exception_table_lock(struct dm_exception_table_lock *lock)
+ {
+- hlist_bl_lock(lock->complete_slot);
+- hlist_bl_lock(lock->pending_slot);
++ spin_lock_nested(lock->complete_slot, 1);
++ spin_lock_nested(lock->pending_slot, 2);
+ }
+
+ static void dm_exception_table_unlock(struct dm_exception_table_lock *lock)
+ {
+- hlist_bl_unlock(lock->pending_slot);
+- hlist_bl_unlock(lock->complete_slot);
++ spin_unlock(lock->pending_slot);
++ spin_unlock(lock->complete_slot);
+ }
+
+ static int dm_exception_table_init(struct dm_exception_table *et,
+@@ -661,13 +666,15 @@ static int dm_exception_table_init(struct dm_exception_table *et,
+
+ et->hash_shift = hash_shift;
+ et->hash_mask = size - 1;
+- et->table = kvmalloc_array(size, sizeof(struct hlist_bl_head),
++ et->table = kvmalloc_array(size, sizeof(struct dm_hlist_head),
+ GFP_KERNEL);
+ if (!et->table)
+ return -ENOMEM;
+
+- for (i = 0; i < size; i++)
+- INIT_HLIST_BL_HEAD(et->table + i);
++ for (i = 0; i < size; i++) {
++ INIT_HLIST_HEAD(&et->table[i].head);
++ spin_lock_init(&et->table[i].lock);
++ }
+
+ return 0;
+ }
+@@ -675,16 +682,17 @@ static int dm_exception_table_init(struct dm_exception_table *et,
+ static void dm_exception_table_exit(struct dm_exception_table *et,
+ struct kmem_cache *mem)
+ {
+- struct hlist_bl_head *slot;
++ struct dm_hlist_head *slot;
+ struct dm_exception *ex;
+- struct hlist_bl_node *pos, *n;
++ struct hlist_node *pos;
+ int i, size;
+
+ size = et->hash_mask + 1;
+ for (i = 0; i < size; i++) {
+ slot = et->table + i;
+
+- hlist_bl_for_each_entry_safe(ex, pos, n, slot, hash_list) {
++ hlist_for_each_entry_safe(ex, pos, &slot->head, hash_list) {
++ hlist_del(&ex->hash_list);
+ kmem_cache_free(mem, ex);
+ cond_resched();
+ }
+@@ -700,7 +708,7 @@ static uint32_t exception_hash(struct dm_exception_table *et, chunk_t chunk)
+
+ static void dm_remove_exception(struct dm_exception *e)
+ {
+- hlist_bl_del(&e->hash_list);
++ hlist_del(&e->hash_list);
+ }
+
+ /*
+@@ -710,12 +718,11 @@ static void dm_remove_exception(struct dm_exception *e)
+ static struct dm_exception *dm_lookup_exception(struct dm_exception_table *et,
+ chunk_t chunk)
+ {
+- struct hlist_bl_head *slot;
+- struct hlist_bl_node *pos;
++ struct hlist_head *slot;
+ struct dm_exception *e;
+
+- slot = &et->table[exception_hash(et, chunk)];
+- hlist_bl_for_each_entry(e, pos, slot, hash_list)
++ slot = &et->table[exception_hash(et, chunk)].head;
++ hlist_for_each_entry(e, slot, hash_list)
+ if (chunk >= e->old_chunk &&
+ chunk <= e->old_chunk + dm_consecutive_chunk_count(e))
+ return e;
+@@ -762,18 +769,17 @@ static void free_pending_exception(struct dm_snap_pending_exception *pe)
+ static void dm_insert_exception(struct dm_exception_table *eh,
+ struct dm_exception *new_e)
+ {
+- struct hlist_bl_head *l;
+- struct hlist_bl_node *pos;
++ struct hlist_head *l;
+ struct dm_exception *e = NULL;
+
+- l = &eh->table[exception_hash(eh, new_e->old_chunk)];
++ l = &eh->table[exception_hash(eh, new_e->old_chunk)].head;
+
+ /* Add immediately if this table doesn't support consecutive chunks */
+ if (!eh->hash_shift)
+ goto out;
+
+ /* List is ordered by old_chunk */
+- hlist_bl_for_each_entry(e, pos, l, hash_list) {
++ hlist_for_each_entry(e, l, hash_list) {
+ /* Insert after an existing chunk? */
+ if (new_e->old_chunk == (e->old_chunk +
+ dm_consecutive_chunk_count(e) + 1) &&
+@@ -804,13 +810,13 @@ static void dm_insert_exception(struct dm_exception_table *eh,
+ * Either the table doesn't support consecutive chunks or slot
+ * l is empty.
+ */
+- hlist_bl_add_head(&new_e->hash_list, l);
++ hlist_add_head(&new_e->hash_list, l);
+ } else if (new_e->old_chunk < e->old_chunk) {
+ /* Add before an existing exception */
+- hlist_bl_add_before(&new_e->hash_list, &e->hash_list);
++ hlist_add_before(&new_e->hash_list, &e->hash_list);
+ } else {
+ /* Add to l's tail: e is the last exception in this slot */
+- hlist_bl_add_behind(&new_e->hash_list, &e->hash_list);
++ hlist_add_behind(&new_e->hash_list, &e->hash_list);
+ }
+ }
+
+@@ -820,7 +826,6 @@ static void dm_insert_exception(struct dm_exception_table *eh,
+ */
+ static int dm_add_exception(void *context, chunk_t old, chunk_t new)
+ {
+- struct dm_exception_table_lock lock;
+ struct dm_snapshot *s = context;
+ struct dm_exception *e;
+
+@@ -833,17 +838,7 @@ static int dm_add_exception(void *context, chunk_t old, chunk_t new)
+ /* Consecutive_count is implicitly initialised to zero */
+ e->new_chunk = new;
+
+- /*
+- * Although there is no need to lock access to the exception tables
+- * here, if we don't then hlist_bl_add_head(), called by
+- * dm_insert_exception(), will complain about accessing the
+- * corresponding list without locking it first.
+- */
+- dm_exception_table_lock_init(s, old, &lock);
+-
+- dm_exception_table_lock(&lock);
+ dm_insert_exception(&s->complete, e);
+- dm_exception_table_unlock(&lock);
+
+ return 0;
+ }
+@@ -873,7 +868,7 @@ static int calc_max_buckets(void)
+ /* use a fixed size of 2MB */
+ unsigned long mem = 2 * 1024 * 1024;
+
+- mem /= sizeof(struct hlist_bl_head);
++ mem /= sizeof(struct dm_hlist_head);
+
+ return mem;
+ }
+--
+2.51.0
+
--- /dev/null
+From c2f738cf2f45486e0dec696cf9656d4b28390a4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Nov 2025 09:40:47 -0800
+Subject: drm/amd/display: shrink struct members
+
+From: Rosen Penev <rosenp@gmail.com>
+
+[ Upstream commit 7329417fc9ac128729c3a092b006c8f1fd0d04a6 ]
+
+On a 32-bit ARM system, the audio_decoder struct ends up being too large
+for dp_retrain_link_dp_test.
+
+link_dp_cts.c:157:1: error: the frame size of 1328 bytes is larger than
+1280 bytes [-Werror=frame-larger-than=]
+
+This is mitigated by shrinking the members of the struct and avoids
+having to deal with dynamic allocation.
+
+feed_back_divider is assigned but otherwise unused. Remove both.
+
+pixel_repetition looks like it should be a bool since it's only ever
+assigned to 1. But there are checks for 2 and 4. Reduce to uint8_t.
+
+Remove ss_percentage_divider. Unused.
+
+Shrink refresh_rate as it gets assigned to at most a 3 digit integer
+value.
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 3849efdc7888d537f09c3dcfaea4b3cd377a102e)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 3 ---
+ drivers/gpu/drm/amd/display/include/audio_types.h | 12 +++++-------
+ 2 files changed, 5 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+index 03b22e9115ea8..13e7c253ad697 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+@@ -1448,9 +1448,6 @@ static void build_audio_output(
+ state->clk_mgr);
+ }
+
+- audio_output->pll_info.feed_back_divider =
+- pipe_ctx->pll_settings.feedback_divider;
+-
+ audio_output->pll_info.dto_source =
+ translate_to_dto_source(
+ pipe_ctx->stream_res.tg->inst + 1);
+diff --git a/drivers/gpu/drm/amd/display/include/audio_types.h b/drivers/gpu/drm/amd/display/include/audio_types.h
+index e4a26143f14c9..6699ad4fa825e 100644
+--- a/drivers/gpu/drm/amd/display/include/audio_types.h
++++ b/drivers/gpu/drm/amd/display/include/audio_types.h
+@@ -47,15 +47,15 @@ struct audio_crtc_info {
+ uint32_t h_total;
+ uint32_t h_active;
+ uint32_t v_active;
+- uint32_t pixel_repetition;
+ uint32_t requested_pixel_clock_100Hz; /* in 100Hz */
+ uint32_t calculated_pixel_clock_100Hz; /* in 100Hz */
+- uint32_t refresh_rate;
++ uint32_t dsc_bits_per_pixel;
++ uint32_t dsc_num_slices;
+ enum dc_color_depth color_depth;
+ enum dc_pixel_encoding pixel_encoding;
++ uint16_t refresh_rate;
++ uint8_t pixel_repetition;
+ bool interlaced;
+- uint32_t dsc_bits_per_pixel;
+- uint32_t dsc_num_slices;
+ };
+ struct azalia_clock_info {
+ uint32_t pixel_clock_in_10khz;
+@@ -78,11 +78,9 @@ enum audio_dto_source {
+
+ struct audio_pll_info {
+ uint32_t audio_dto_source_clock_in_khz;
+- uint32_t feed_back_divider;
++ uint32_t ss_percentage;
+ enum audio_dto_source dto_source;
+ bool ss_enabled;
+- uint32_t ss_percentage;
+- uint32_t ss_percentage_divider;
+ };
+
+ struct audio_channel_associate_info {
+--
+2.51.0
+
--- /dev/null
+From edb32860967e998296ba1dc38dc52ade9553fe6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 18:56:46 -0500
+Subject: NFS: Fix up the automount fs_context to use the correct cred
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit a2a8fc27dd668e7562b5326b5ed2f1604cb1e2e9 ]
+
+When automounting, the fs_context should be fixed up to use the cred
+from the parent filesystem, since the operation is just extending the
+namespace. Authorisation to enter that namespace will already have been
+provided by the preceding lookup.
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/namespace.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
+index 923b5c1eb47e9..99ef1146096fe 100644
+--- a/fs/nfs/namespace.c
++++ b/fs/nfs/namespace.c
+@@ -170,6 +170,11 @@ struct vfsmount *nfs_d_automount(struct path *path)
+ if (!ctx->clone_data.fattr)
+ goto out_fc;
+
++ if (fc->cred != server->cred) {
++ put_cred(fc->cred);
++ fc->cred = get_cred(server->cred);
++ }
++
+ if (fc->net_ns != client->cl_net) {
+ put_net(fc->net_ns);
+ fc->net_ns = get_net(client->cl_net);
+--
+2.51.0
+
--- /dev/null
+From b62f15d3e7ec96978edbfc311e43490e5df5db6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Nov 2025 10:44:15 -0500
+Subject: NFSv4: ensure the open stateid seqid doesn't go backwards
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+[ Upstream commit 2e47c3cc64b44b0b06cd68c2801db92ff143f2b2 ]
+
+We have observed an NFSv4 client receiving a LOCK reply with a status of
+NFS4ERR_OLD_STATEID and subsequently retrying the LOCK request with an
+earlier seqid value in the stateid. As this was for a new lockowner,
+that would imply that nfs_set_open_stateid_locked() had updated the open
+stateid seqid with an earlier value.
+
+Looking at nfs_set_open_stateid_locked(), if the incoming seqid is out
+of sequence, the task will sleep on the state->waitq for up to 5
+seconds. If the task waits for the full 5 seconds, then after finishing
+the wait it'll update the open stateid seqid with whatever value the
+incoming seqid has. If there are multiple waiters in this scenario,
+then the last one to perform said update may not be the one with the
+highest seqid.
+
+Add a check to ensure that the seqid can only be incremented, and add a
+tracepoint to indicate when old seqids are skipped.
+
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Reviewed-by: Benjamin Coddington <bcodding@hammerspace.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 13 +++++++++++--
+ fs/nfs/nfs4trace.h | 1 +
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 172ff213b50b6..89f779f16f0dc 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1753,8 +1753,17 @@ static void nfs_set_open_stateid_locked(struct nfs4_state *state,
+ if (nfs_stateid_is_sequential(state, stateid))
+ break;
+
+- if (status)
+- break;
++ if (status) {
++ if (nfs4_stateid_match_other(stateid, &state->open_stateid) &&
++ !nfs4_stateid_is_newer(stateid, &state->open_stateid)) {
++ trace_nfs4_open_stateid_update_skip(state->inode,
++ stateid, status);
++ return;
++ } else {
++ break;
++ }
++ }
++
+ /* Rely on seqids for serialisation with NFSv4.0 */
+ if (!nfs4_has_session(NFS_SERVER(state->inode)->nfs_client))
+ break;
+diff --git a/fs/nfs/nfs4trace.h b/fs/nfs/nfs4trace.h
+index 22c973316f0bd..9a38a5d3bf512 100644
+--- a/fs/nfs/nfs4trace.h
++++ b/fs/nfs/nfs4trace.h
+@@ -1278,6 +1278,7 @@ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_setattr);
+ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_delegreturn);
+ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update);
+ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update_wait);
++DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update_skip);
+ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_close_stateid_update_wait);
+
+ DECLARE_EVENT_CLASS(nfs4_getattr_event,
+--
+2.51.0
+
--- /dev/null
+From 2c744bf45c7e2f39fc350439a6fb5f25573ed3ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Oct 2025 09:24:26 -0500
+Subject: scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset
+
+From: Wen Xiong <wenxiong@linux.ibm.com>
+
+[ Upstream commit 6ac3484fb13b2fc7f31cfc7f56093e7d0ce646a5 ]
+
+A dynamic remove/add storage adapter test hits EEH on PowerPC:
+
+ EEH: [c00000000004f75c] __eeh_send_failure_event+0x7c/0x160
+ EEH: [c000000000048444] eeh_dev_check_failure.part.0+0x254/0x650
+ EEH: [c008000001650678] eeh_readl+0x60/0x90 [ipr]
+ EEH: [c00800000166746c] ipr_cancel_op+0x2b8/0x524 [ipr]
+ EEH: [c008000001656524] ipr_eh_abort+0x6c/0x130 [ipr]
+ EEH: [c000000000ab0d20] scmd_eh_abort_handler+0x140/0x440
+ EEH: [c00000000017e558] process_one_work+0x298/0x590
+ EEH: [c00000000017eef8] worker_thread+0xa8/0x620
+ EEH: [c00000000018be34] kthread+0x124/0x130
+ EEH: [c00000000000cd64] ret_from_kernel_thread+0x5c/0x64
+
+A PCIe bus trace reveals that a vector of MSI-X is cleared to 0 by
+irqbalance daemon. If we disable irqbalance daemon, we won't see the
+issue.
+
+With debug enabled in ipr driver:
+
+ [ 44.103071] ipr: Entering __ipr_remove
+ [ 44.103083] ipr: Entering ipr_initiate_ioa_bringdown
+ [ 44.103091] ipr: Entering ipr_reset_shutdown_ioa
+ [ 44.103099] ipr: Leaving ipr_reset_shutdown_ioa
+ [ 44.103105] ipr: Leaving ipr_initiate_ioa_bringdown
+ [ 44.149918] ipr: Entering ipr_reset_ucode_download
+ [ 44.149935] ipr: Entering ipr_reset_alert
+ [ 44.150032] ipr: Entering ipr_reset_start_timer
+ [ 44.150038] ipr: Leaving ipr_reset_alert
+ [ 44.244343] scsi 1:2:3:0: alua: Detached
+ [ 44.254300] ipr: Entering ipr_reset_start_bist
+ [ 44.254320] ipr: Entering ipr_reset_start_timer
+ [ 44.254325] ipr: Leaving ipr_reset_start_bist
+ [ 44.364329] scsi 1:2:4:0: alua: Detached
+ [ 45.134341] scsi 1:2:5:0: alua: Detached
+ [ 45.860949] ipr: Entering ipr_reset_shutdown_ioa
+ [ 45.860962] ipr: Leaving ipr_reset_shutdown_ioa
+ [ 45.860966] ipr: Entering ipr_reset_alert
+ [ 45.861028] ipr: Entering ipr_reset_start_timer
+ [ 45.861035] ipr: Leaving ipr_reset_alert
+ [ 45.964302] ipr: Entering ipr_reset_start_bist
+ [ 45.964309] ipr: Entering ipr_reset_start_timer
+ [ 45.964313] ipr: Leaving ipr_reset_start_bist
+ [ 46.264301] ipr: Entering ipr_reset_bist_done
+ [ 46.264309] ipr: Leaving ipr_reset_bist_done
+
+During adapter reset, ipr device driver blocks config space access but
+can't block MMIO access for MSI-X entries. There is very small window:
+irqbalance daemon kicks in during adapter reset before ipr driver calls
+pci_restore_state(pdev) to restore MSI-X table.
+
+irqbalance daemon reads back all 0 for that MSI-X vector in
+__pci_read_msi_msg().
+
+irqbalance daemon:
+
+ msi_domain_set_affinity()
+ ->irq_chip_set_affinity_patent()
+ ->xive_irq_set_affinity()
+ ->irq_chip_compose_msi_msg()
+ ->pseries_msi_compose_msg()
+ ->__pci_read_msi_msg(): read all 0 since didn't call pci_restore_state
+ ->irq_chip_write_msi_msg()
+ -> pci_write_msg_msi(): write 0 to the msix vector entry
+
+When ipr driver calls pci_restore_state(pdev) in
+ipr_reset_restore_cfg_space(), the MSI-X vector entry has been cleared
+by irqbalance daemon in pci_write_msg_msix().
+
+ pci_restore_state()
+ ->__pci_restore_msix_state()
+
+Below is the MSI-X table for ipr adapter after irqbalance daemon kicked
+in during adapter reset:
+
+ Dump MSIx table: index=0 address_lo=c800 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=1 address_lo=c810 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=2 address_lo=c820 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=3 address_lo=c830 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=4 address_lo=c840 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=5 address_lo=c850 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=6 address_lo=c860 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=7 address_lo=c870 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=8 address_lo=0 address_hi=0 msg_data=0
+ ---------> Hit EEH since msix vector of index=8 are 0
+ Dump MSIx table: index=9 address_lo=c890 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=10 address_lo=c8a0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=11 address_lo=c8b0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=12 address_lo=c8c0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=13 address_lo=c8d0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=14 address_lo=c8e0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=15 address_lo=c8f0 address_hi=10000000 msg_data=0
+
+ [ 46.264312] ipr: Entering ipr_reset_restore_cfg_space
+ [ 46.267439] ipr: Entering ipr_fail_all_ops
+ [ 46.267447] ipr: Leaving ipr_fail_all_ops
+ [ 46.267451] ipr: Leaving ipr_reset_restore_cfg_space
+ [ 46.267454] ipr: Entering ipr_ioa_bringdown_done
+ [ 46.267458] ipr: Leaving ipr_ioa_bringdown_done
+ [ 46.267467] ipr: Entering ipr_worker_thread
+ [ 46.267470] ipr: Leaving ipr_worker_thread
+
+IRQ balancing is not required during adapter reset.
+
+Enable "IRQ_NO_BALANCING" flag before starting adapter reset and disable
+it after calling pci_restore_state(). The irqbalance daemon is disabled
+for this short period of time (~2s).
+
+Co-developed-by: Kyle Mahlkuch <Kyle.Mahlkuch@ibm.com>
+Signed-off-by: Kyle Mahlkuch <Kyle.Mahlkuch@ibm.com>
+Signed-off-by: Wen Xiong <wenxiong@linux.ibm.com>
+Link: https://patch.msgid.link/20251028142427.3969819-2-wenxiong@linux.ibm.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ipr.c | 28 +++++++++++++++++++++++++++-
+ 1 file changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
+index 31cf2d31cceba..ea3d8239c6b3d 100644
+--- a/drivers/scsi/ipr.c
++++ b/drivers/scsi/ipr.c
+@@ -61,8 +61,8 @@
+ #include <linux/hdreg.h>
+ #include <linux/reboot.h>
+ #include <linux/stringify.h>
++#include <linux/irq.h>
+ #include <asm/io.h>
+-#include <asm/irq.h>
+ #include <asm/processor.h>
+ #include <scsi/scsi.h>
+ #include <scsi/scsi_host.h>
+@@ -7843,6 +7843,30 @@ static int ipr_dump_mailbox_wait(struct ipr_cmnd *ipr_cmd)
+ return IPR_RC_JOB_RETURN;
+ }
+
++/**
++ * ipr_set_affinity_nobalance
++ * @ioa_cfg: ipr_ioa_cfg struct for an ipr device
++ * @flag: bool
++ * true: ensable "IRQ_NO_BALANCING" bit for msix interrupt
++ * false: disable "IRQ_NO_BALANCING" bit for msix interrupt
++ * Description: This function will be called to disable/enable
++ * "IRQ_NO_BALANCING" to avoid irqbalance daemon
++ * kicking in during adapter reset.
++ **/
++static void ipr_set_affinity_nobalance(struct ipr_ioa_cfg *ioa_cfg, bool flag)
++{
++ int irq, i;
++
++ for (i = 0; i < ioa_cfg->nvectors; i++) {
++ irq = pci_irq_vector(ioa_cfg->pdev, i);
++
++ if (flag)
++ irq_set_status_flags(irq, IRQ_NO_BALANCING);
++ else
++ irq_clear_status_flags(irq, IRQ_NO_BALANCING);
++ }
++}
++
+ /**
+ * ipr_reset_restore_cfg_space - Restore PCI config space.
+ * @ipr_cmd: ipr command struct
+@@ -7867,6 +7891,7 @@ static int ipr_reset_restore_cfg_space(struct ipr_cmnd *ipr_cmd)
+ return IPR_RC_JOB_CONTINUE;
+ }
+
++ ipr_set_affinity_nobalance(ioa_cfg, false);
+ ipr_fail_all_ops(ioa_cfg);
+
+ if (ioa_cfg->sis64) {
+@@ -7946,6 +7971,7 @@ static int ipr_reset_start_bist(struct ipr_cmnd *ipr_cmd)
+ rc = pci_write_config_byte(ioa_cfg->pdev, PCI_BIST, PCI_BIST_START);
+
+ if (rc == PCIBIOS_SUCCESSFUL) {
++ ipr_set_affinity_nobalance(ioa_cfg, true);
+ ipr_cmd->job_step = ipr_reset_bist_done;
+ ipr_reset_start_timer(ipr_cmd, IPR_WAIT_FOR_BIST_TIMEOUT);
+ rc = IPR_RC_JOB_RETURN;
+--
+2.51.0
+
--- /dev/null
+From 2709439d4c537da483c258160e01e5c3693ff72b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 14:56:27 +0800
+Subject: scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe
+ failure scanned in again after probe failed"
+
+From: Xingui Yang <yangxingui@huawei.com>
+
+[ Upstream commit 278712d20bc8ec29d1ad6ef9bdae9000ef2c220c ]
+
+This reverts commit ab2068a6fb84751836a84c26ca72b3beb349619d.
+
+When probing the exp-attached sata device, libsas/libata will issue a
+hard reset in sas_probe_sata() -> ata_sas_async_probe(), then a
+broadcast event will be received after the disk probe fails, and this
+commit causes the probe will be re-executed on the disk, and a faulty
+disk may get into an indefinite loop of probe.
+
+Therefore, revert this commit, although it can fix some temporary issues
+with disk probe failure.
+
+Signed-off-by: Xingui Yang <yangxingui@huawei.com>
+Reviewed-by: Jason Yan <yanaijie@huawei.com>
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Link: https://patch.msgid.link/20251202065627.140361-1-yangxingui@huawei.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_internal.h | 14 --------------
+ 1 file changed, 14 deletions(-)
+
+diff --git a/drivers/scsi/libsas/sas_internal.h b/drivers/scsi/libsas/sas_internal.h
+index 03d6ec1eb970b..85948963fb97a 100644
+--- a/drivers/scsi/libsas/sas_internal.h
++++ b/drivers/scsi/libsas/sas_internal.h
+@@ -145,20 +145,6 @@ static inline void sas_fail_probe(struct domain_device *dev, const char *func, i
+ func, dev->parent ? "exp-attached" :
+ "direct-attached",
+ SAS_ADDR(dev->sas_addr), err);
+-
+- /*
+- * If the device probe failed, the expander phy attached address
+- * needs to be reset so that the phy will not be treated as flutter
+- * in the next revalidation
+- */
+- if (dev->parent && !dev_is_expander(dev->dev_type)) {
+- struct sas_phy *phy = dev->phy;
+- struct domain_device *parent = dev->parent;
+- struct ex_phy *ex_phy = &parent->ex_dev.ex_phy[phy->number];
+-
+- memset(ex_phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
+- }
+-
+ sas_unregister_dev(dev->port, dev);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 476a23386de4be583497487eda0ebee81ed8a53e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Nov 2025 06:32:02 +0000
+Subject: scsi: ufs: core: Fix EH failure after W-LUN resume error
+
+From: Brian Kao <powenkao@google.com>
+
+[ Upstream commit b4bb6daf4ac4d4560044ecdd81e93aa2f6acbb06 ]
+
+When a W-LUN resume fails, its parent devices in the SCSI hierarchy,
+including the scsi_target, may be runtime suspended. Subsequently, the
+error handler in ufshcd_recover_pm_error() fails to set the W-LUN device
+back to active because the parent target is not active. This results in
+the following errors:
+
+ google-ufshcd 3c2d0000.ufs: ufshcd_err_handler started; HBA state eh_fatal; ...
+ ufs_device_wlun 0:0:0:49488: START_STOP failed for power mode: 1, result 40000
+ ufs_device_wlun 0:0:0:49488: ufshcd_wl_runtime_resume failed: -5
+ ...
+ ufs_device_wlun 0:0:0:49488: runtime PM trying to activate child device 0:0:0:49488 but parent (target0:0:0) is not active
+
+Address this by:
+
+ 1. Ensuring the W-LUN's parent scsi_target is runtime resumed before
+ attempting to set the W-LUN to active within
+ ufshcd_recover_pm_error().
+
+ 2. Explicitly checking for power.runtime_error on the HBA and W-LUN
+ devices before calling pm_runtime_set_active() to clear the error
+ state.
+
+ 3. Adding pm_runtime_get_sync(hba->dev) in
+ ufshcd_err_handling_prepare() to ensure the HBA itself is active
+ during error recovery, even if a child device resume failed.
+
+These changes ensure the device power states are managed correctly
+during error recovery.
+
+Signed-off-by: Brian Kao <powenkao@google.com>
+Tested-by: Brian Kao <powenkao@google.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://patch.msgid.link/20251112063214.1195761-1-powenkao@google.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufshcd.c | 36 ++++++++++++++++++++++++++++--------
+ 1 file changed, 28 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index 24eb4795328ef..fb406e926d0cc 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -6411,6 +6411,11 @@ static void ufshcd_clk_scaling_suspend(struct ufs_hba *hba, bool suspend)
+
+ static void ufshcd_err_handling_prepare(struct ufs_hba *hba)
+ {
++ /*
++ * A WLUN resume failure could potentially lead to the HBA being
++ * runtime suspended, so take an extra reference on hba->dev.
++ */
++ pm_runtime_get_sync(hba->dev);
+ ufshcd_rpm_get_sync(hba);
+ if (pm_runtime_status_suspended(&hba->ufs_device_wlun->sdev_gendev) ||
+ hba->is_sys_suspended) {
+@@ -6451,6 +6456,7 @@ static void ufshcd_err_handling_unprepare(struct ufs_hba *hba)
+ if (ufshcd_is_clkscaling_supported(hba))
+ ufshcd_clk_scaling_suspend(hba, false);
+ ufshcd_rpm_put(hba);
++ pm_runtime_put(hba->dev);
+ }
+
+ static inline bool ufshcd_err_handling_should_stop(struct ufs_hba *hba)
+@@ -6465,28 +6471,42 @@ static inline bool ufshcd_err_handling_should_stop(struct ufs_hba *hba)
+ #ifdef CONFIG_PM
+ static void ufshcd_recover_pm_error(struct ufs_hba *hba)
+ {
++ struct scsi_target *starget = hba->ufs_device_wlun->sdev_target;
+ struct Scsi_Host *shost = hba->host;
+ struct scsi_device *sdev;
+ struct request_queue *q;
+- int ret;
++ bool resume_sdev_queues = false;
+
+ hba->is_sys_suspended = false;
++
+ /*
+- * Set RPM status of wlun device to RPM_ACTIVE,
+- * this also clears its runtime error.
++ * Ensure the parent's error status is cleared before proceeding
++ * to the child, as the parent must be active to activate the child.
+ */
+- ret = pm_runtime_set_active(&hba->ufs_device_wlun->sdev_gendev);
++ if (hba->dev->power.runtime_error) {
++ /* hba->dev has no functional parent thus simplily set RPM_ACTIVE */
++ pm_runtime_set_active(hba->dev);
++ resume_sdev_queues = true;
++ }
++
++ if (hba->ufs_device_wlun->sdev_gendev.power.runtime_error) {
++ /*
++ * starget, parent of wlun, might be suspended if wlun resume failed.
++ * Make sure parent is resumed before set child (wlun) active.
++ */
++ pm_runtime_get_sync(&starget->dev);
++ pm_runtime_set_active(&hba->ufs_device_wlun->sdev_gendev);
++ pm_runtime_put_sync(&starget->dev);
++ resume_sdev_queues = true;
++ }
+
+- /* hba device might have a runtime error otherwise */
+- if (ret)
+- ret = pm_runtime_set_active(hba->dev);
+ /*
+ * If wlun device had runtime error, we also need to resume those
+ * consumer scsi devices in case any of them has failed to be
+ * resumed due to supplier runtime resume failure. This is to unblock
+ * blk_queue_enter in case there are bios waiting inside it.
+ */
+- if (!ret) {
++ if (resume_sdev_queues) {
+ shost_for_each_device(sdev, shost) {
+ q = sdev->request_queue;
+ if (q->dev && (q->rpm_status == RPM_SUSPENDED ||
+--
+2.51.0
+
tls-use-__sk_dst_get-and-dst_dev_rcu-in-get_netdev_for_sock.patch
drm-xe-make-xe_gt_idle_disable_c6-handle-the-forcewake-internally.patch
drm-xe-ensure-gt-is-in-c0-during-resumes.patch
+csky-fix-csky_cmpxchg_fixup-not-working.patch
+arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch
+alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch
+dm-snapshot-fix-scheduling-while-atomic-on-real-time.patch
+nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch
+asoc-rockchip-fix-wvoid-pointer-to-enum-cast-warning.patch
+nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch
+drm-amd-display-shrink-struct-members.patch
+bcache-fix-improper-use-of-bi_end_io.patch
+smb-client-fix-nt_status_unable_to_free_vm-value.patch
+smb-client-fix-nt_status_device_door_open-value.patch
+smb-client-fix-nt_status_no_data_detected-value.patch
+scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch
+scsi-ufs-core-fix-eh-failure-after-w-lun-resume-erro.patch
+scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch
+btrfs-fix-qgroup_snapshot_quick_inherit-squota-bug.patch
+btrfs-qgroup-update-all-parent-qgroups-when-doing-qu.patch
+btrfs-tracepoints-use-btrfs_root_id-to-get-the-id-of.patch
+btrfs-fix-null-dereference-on-root-when-tracing-inod.patch
--- /dev/null
+From 3284512d7ea03a0ec6486979137afca1ce70e1ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Dec 2025 09:17:57 +0800
+Subject: smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value
+
+From: ChenXiaoSong <chenxiaosong@kylinos.cn>
+
+[ Upstream commit b2b50fca34da5ec231008edba798ddf92986bd7f ]
+
+This was reported by the KUnit tests in the later patches.
+
+See MS-ERREF 2.3.1 STATUS_DEVICE_DOOR_OPEN. Keep it consistent with the
+value in the documentation.
+
+Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/nterr.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/nterr.h b/fs/smb/client/nterr.h
+index 7ce063a1dc3f6..d46d42559eea2 100644
+--- a/fs/smb/client/nterr.h
++++ b/fs/smb/client/nterr.h
+@@ -44,7 +44,7 @@ extern const struct nt_err_code_struct nt_errs[];
+ #define NT_STATUS_NO_DATA_DETECTED 0x8000001c
+ #define NT_STATUS_STOPPED_ON_SYMLINK 0x8000002d
+ #define NT_STATUS_DEVICE_REQUIRES_CLEANING 0x80000288
+-#define NT_STATUS_DEVICE_DOOR_OPEN 0x80000288
++#define NT_STATUS_DEVICE_DOOR_OPEN 0x80000289
+ #define NT_STATUS_UNSUCCESSFUL 0xC0000000 | 0x0001
+ #define NT_STATUS_NOT_IMPLEMENTED 0xC0000000 | 0x0002
+ #define NT_STATUS_INVALID_INFO_CLASS 0xC0000000 | 0x0003
+--
+2.51.0
+
--- /dev/null
+From 8349d538907634ced3299250568768c45cc98aa4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Dec 2025 09:13:06 +0800
+Subject: smb/client: fix NT_STATUS_NO_DATA_DETECTED value
+
+From: ChenXiaoSong <chenxiaosong@kylinos.cn>
+
+[ Upstream commit a1237c203f1757480dc2f3b930608ee00072d3cc ]
+
+This was reported by the KUnit tests in the later patches.
+
+See MS-ERREF 2.3.1 STATUS_NO_DATA_DETECTED. Keep it consistent with the
+value in the documentation.
+
+Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/nterr.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/nterr.h b/fs/smb/client/nterr.h
+index d46d42559eea2..e3a341316a711 100644
+--- a/fs/smb/client/nterr.h
++++ b/fs/smb/client/nterr.h
+@@ -41,7 +41,7 @@ extern const struct nt_err_code_struct nt_errs[];
+ #define NT_STATUS_MEDIA_CHANGED 0x8000001c
+ #define NT_STATUS_END_OF_MEDIA 0x8000001e
+ #define NT_STATUS_MEDIA_CHECK 0x80000020
+-#define NT_STATUS_NO_DATA_DETECTED 0x8000001c
++#define NT_STATUS_NO_DATA_DETECTED 0x80000022
+ #define NT_STATUS_STOPPED_ON_SYMLINK 0x8000002d
+ #define NT_STATUS_DEVICE_REQUIRES_CLEANING 0x80000288
+ #define NT_STATUS_DEVICE_DOOR_OPEN 0x80000289
+--
+2.51.0
+
--- /dev/null
+From 428bf75f636e8ad499662f3298a3f5b20bdea15d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Dec 2025 09:22:53 +0800
+Subject: smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value
+
+From: ChenXiaoSong <chenxiaosong@kylinos.cn>
+
+[ Upstream commit 9f99caa8950a76f560a90074e3a4b93cfa8b3d84 ]
+
+This was reported by the KUnit tests in the later patches.
+
+See MS-ERREF 2.3.1 STATUS_UNABLE_TO_FREE_VM. Keep it consistent with the
+value in the documentation.
+
+Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/nterr.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/nterr.h b/fs/smb/client/nterr.h
+index edd4741cab0a1..7ce063a1dc3f6 100644
+--- a/fs/smb/client/nterr.h
++++ b/fs/smb/client/nterr.h
+@@ -70,7 +70,7 @@ extern const struct nt_err_code_struct nt_errs[];
+ #define NT_STATUS_NO_MEMORY 0xC0000000 | 0x0017
+ #define NT_STATUS_CONFLICTING_ADDRESSES 0xC0000000 | 0x0018
+ #define NT_STATUS_NOT_MAPPED_VIEW 0xC0000000 | 0x0019
+-#define NT_STATUS_UNABLE_TO_FREE_VM 0x80000000 | 0x001a
++#define NT_STATUS_UNABLE_TO_FREE_VM 0xC0000000 | 0x001a
+ #define NT_STATUS_UNABLE_TO_DELETE_SECTION 0xC0000000 | 0x001b
+ #define NT_STATUS_INVALID_SYSTEM_SERVICE 0xC0000000 | 0x001c
+ #define NT_STATUS_ILLEGAL_INSTRUCTION 0xC0000000 | 0x001d
+--
+2.51.0
+
--- /dev/null
+From 302281cfe16f3433729f6b7db06e9d84b596fecf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 08:14:57 +0000
+Subject: alpha: don't reference obsolete termio struct for TC* constants
+
+From: Sam James <sam@gentoo.org>
+
+[ Upstream commit 9aeed9041929812a10a6d693af050846942a1d16 ]
+
+Similar in nature to ab107276607af90b13a5994997e19b7b9731e251. glibc-2.42
+drops the legacy termio struct, but the ioctls.h header still defines some
+TC* constants in terms of termio (via sizeof). Hardcode the values instead.
+
+This fixes building Python for example, which falls over like:
+ ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio'
+
+Link: https://bugs.gentoo.org/961769
+Link: https://bugs.gentoo.org/962600
+Signed-off-by: Sam James <sam@gentoo.org>
+Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
+Link: https://lore.kernel.org/r/6ebd3451908785cad53b50ca6bc46cfe9d6bc03c.1764922497.git.sam@gentoo.org
+Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/alpha/include/uapi/asm/ioctls.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/alpha/include/uapi/asm/ioctls.h b/arch/alpha/include/uapi/asm/ioctls.h
+index 971311605288f..a09d04b49cc65 100644
+--- a/arch/alpha/include/uapi/asm/ioctls.h
++++ b/arch/alpha/include/uapi/asm/ioctls.h
+@@ -23,10 +23,10 @@
+ #define TCSETSW _IOW('t', 21, struct termios)
+ #define TCSETSF _IOW('t', 22, struct termios)
+
+-#define TCGETA _IOR('t', 23, struct termio)
+-#define TCSETA _IOW('t', 24, struct termio)
+-#define TCSETAW _IOW('t', 25, struct termio)
+-#define TCSETAF _IOW('t', 28, struct termio)
++#define TCGETA 0x40127417
++#define TCSETA 0x80127418
++#define TCSETAW 0x80127419
++#define TCSETAF 0x8012741c
+
+ #define TCSBRK _IO('t', 29)
+ #define TCXONC _IO('t', 30)
+--
+2.51.0
+
--- /dev/null
+From 431c15061623536b3cbab56d1f0f8ccae5d31345 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 15:05:55 +0000
+Subject: ALSA: hda/realtek: Add support for ASUS UM3406GA
+
+From: Stefan Binding <sbinding@opensource.cirrus.com>
+
+[ Upstream commit 826c0b1ed09e5335abcae07292440ce72346e578 ]
+
+Laptops use 2 CS35L41 Amps with HDA, using External boost, with I2C
+
+Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com>
+Link: https://patch.msgid.link/20251205150614.49590-3-sbinding@opensource.cirrus.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/codecs/realtek/alc269.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
+index b3582e390dfa3..eea8399e32588 100644
+--- a/sound/hda/codecs/realtek/alc269.c
++++ b/sound/hda/codecs/realtek/alc269.c
+@@ -6761,6 +6761,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
+ SND_PCI_QUIRK(0x1043, 0x1533, "ASUS GV302XA/XJ/XQ/XU/XV/XI", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x1043, 0x1573, "ASUS GZ301VV/VQ/VU/VJ/VA/VC/VE/VVC/VQC/VUC/VJC/VEC/VCC", ALC285_FIXUP_ASUS_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1043, 0x1584, "ASUS UM3406GA ", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x1043, 0x1652, "ASUS ROG Zephyrus Do 15 SE", ALC289_FIXUP_ASUS_ZEPHYRUS_DUAL_SPK),
+ SND_PCI_QUIRK(0x1043, 0x1662, "ASUS GV301QH", ALC294_FIXUP_ASUS_DUAL_SPK),
+ SND_PCI_QUIRK(0x1043, 0x1663, "ASUS GU603ZI/ZJ/ZQ/ZU/ZV", ALC285_FIXUP_ASUS_HEADSET_MIC),
+--
+2.51.0
+
--- /dev/null
+From ffe854e3c298b891480f31d094ee12728511879a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Nov 2025 16:54:37 +0100
+Subject: ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit fedadc4137234c3d00c4785eeed3e747fe9036ae ]
+
+gup_pgd_range() is invoked with disabled interrupts and invokes
+__kmap_local_page_prot() via pte_offset_map(), gup_p4d_range().
+With HIGHPTE enabled, __kmap_local_page_prot() invokes kmap_high_get()
+which uses a spinlock_t via lock_kmap_any(). This leads to an
+sleeping-while-atomic error on PREEMPT_RT because spinlock_t becomes a
+sleeping lock and must not be acquired in atomic context.
+
+The loop in map_new_virtual() uses wait_queue_head_t for wake up which
+also is using a spinlock_t.
+
+Since HIGHPTE is rarely needed at all, turn it off for PREEMPT_RT
+to allow the use of get_user_pages_fast().
+
+[arnd: rework patch to turn off HIGHPTE instead of HAVE_PAST_GUP]
+
+Co-developed-by: Arnd Bergmann <arnd@arndb.de>
+
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 4fb985b76e97f..70cd3b5b5a059 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -1215,7 +1215,7 @@ config HIGHMEM
+
+ config HIGHPTE
+ bool "Allocate 2nd-level pagetables from highmem" if EXPERT
+- depends on HIGHMEM
++ depends on HIGHMEM && !PREEMPT_RT
+ default y
+ help
+ The VM uses one page of physical memory for each page table.
+--
+2.51.0
+
--- /dev/null
+From 759b662d7b9d5d0a1d7b368ecb9ed92b06495a34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Dec 2025 15:16:45 +0100
+Subject: ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again)
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
+
+[ Upstream commit 57d508b5f718730f74b11e0dc9609ac7976802d1 ]
+
+'version' is an enum, thus cast of pointer on 64-bit compile test with
+clang W=1 causes:
+
+ rockchip_pdm.c:583:17: error: cast to smaller integer type 'enum rk_pdm_version' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast]
+
+This was already fixed in commit 49a4a8d12612 ("ASoC: rockchip: Fix
+Wvoid-pointer-to-enum-cast warning") but then got bad in
+commit 9958d85968ed ("ASoC: Use device_get_match_data()").
+
+Discussion on LKML also pointed out that 'uintptr_t' is not the correct
+type and either 'kernel_ulong_t' or 'unsigned long' should be used,
+with several arguments towards the latter [1].
+
+Link: https://lore.kernel.org/r/CAMuHMdX7t=mabqFE5O-Cii3REMuyaePHmqX+j_mqyrn6XXzsoA@mail.gmail.com/ [1]
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
+Link: https://patch.msgid.link/20251203141644.106459-2-krzysztof.kozlowski@oss.qualcomm.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/rockchip/rockchip_pdm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/rockchip/rockchip_pdm.c b/sound/soc/rockchip/rockchip_pdm.c
+index c1ee470ec6079..c69cdd6f24994 100644
+--- a/sound/soc/rockchip/rockchip_pdm.c
++++ b/sound/soc/rockchip/rockchip_pdm.c
+@@ -580,7 +580,7 @@ static int rockchip_pdm_probe(struct platform_device *pdev)
+ if (!pdm)
+ return -ENOMEM;
+
+- pdm->version = (enum rk_pdm_version)device_get_match_data(&pdev->dev);
++ pdm->version = (unsigned long)device_get_match_data(&pdev->dev);
+ if (pdm->version == RK_PDM_RK3308) {
+ pdm->reset = devm_reset_control_get(&pdev->dev, "pdm-m");
+ if (IS_ERR(pdm->reset))
+--
+2.51.0
+
--- /dev/null
+From a16d4f532d0ae2d7d4c3c0063cc62f97ffc8dd5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Dec 2025 17:01:56 +0800
+Subject: bcache: fix improper use of bi_end_io
+
+From: Shida Zhang <zhangshida@kylinos.cn>
+
+[ Upstream commit 53280e398471f0bddbb17b798a63d41264651325 ]
+
+Don't call bio->bi_end_io() directly. Use the bio_endio() helper
+function instead, which handles completion more safely and uniformly.
+
+Suggested-by: Christoph Hellwig <hch@infradead.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Shida Zhang <zhangshida@kylinos.cn>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/request.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
+index af345dc6fde14..82fdea7dea7aa 100644
+--- a/drivers/md/bcache/request.c
++++ b/drivers/md/bcache/request.c
+@@ -1104,7 +1104,7 @@ static void detached_dev_end_io(struct bio *bio)
+ }
+
+ kfree(ddip);
+- bio->bi_end_io(bio);
++ bio_endio(bio);
+ }
+
+ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio,
+@@ -1121,7 +1121,7 @@ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio,
+ ddip = kzalloc(sizeof(struct detached_dev_io_private), GFP_NOIO);
+ if (!ddip) {
+ bio->bi_status = BLK_STS_RESOURCE;
+- bio->bi_end_io(bio);
++ bio_endio(bio);
+ return;
+ }
+
+@@ -1136,7 +1136,7 @@ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio,
+
+ if ((bio_op(bio) == REQ_OP_DISCARD) &&
+ !bdev_max_discard_sectors(dc->bdev))
+- bio->bi_end_io(bio);
++ detached_dev_end_io(bio);
+ else
+ submit_bio_noacct(bio);
+ }
+--
+2.51.0
+
--- /dev/null
+From 308b7920f6cd1fa25f53a36314ff7328742952b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Oct 2025 11:11:25 +0200
+Subject: btrfs: fix NULL dereference on root when tracing inode eviction
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Miquel Sabaté Solà <mssola@mssola.com>
+
+[ Upstream commit f157dd661339fc6f5f2b574fe2429c43bd309534 ]
+
+When evicting an inode the first thing we do is to setup tracing for it,
+which implies fetching the root's id. But in btrfs_evict_inode() the
+root might be NULL, as implied in the next check that we do in
+btrfs_evict_inode().
+
+Hence, we either should set the ->root_objectid to 0 in case the root is
+NULL, or we move tracing setup after checking that the root is not
+NULL. Setting the rootid to 0 at least gives us the possibility to trace
+this call even in the case when the root is NULL, so that's the solution
+taken here.
+
+Fixes: 1abe9b8a138c ("Btrfs: add initial tracepoint support for btrfs")
+Reported-by: syzbot+d991fea1b4b23b1f6bf8@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=d991fea1b4b23b1f6bf8
+Signed-off-by: Miquel Sabaté Solà <mssola@mssola.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/btrfs.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h
+index 7e418f065b945..125bdc166bfed 100644
+--- a/include/trace/events/btrfs.h
++++ b/include/trace/events/btrfs.h
+@@ -224,7 +224,8 @@ DECLARE_EVENT_CLASS(btrfs__inode,
+ __entry->generation = BTRFS_I(inode)->generation;
+ __entry->last_trans = BTRFS_I(inode)->last_trans;
+ __entry->logged_trans = BTRFS_I(inode)->logged_trans;
+- __entry->root_objectid = btrfs_root_id(BTRFS_I(inode)->root);
++ __entry->root_objectid = BTRFS_I(inode)->root ?
++ btrfs_root_id(BTRFS_I(inode)->root) : 0;
+ ),
+
+ TP_printk_btrfs("root=%llu(%s) gen=%llu ino=%llu blocks=%llu "
+--
+2.51.0
+
--- /dev/null
+From da0e6d5b69d9e5deb7764cbf001e2e242c6f9ce8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 12:47:14 -0800
+Subject: btrfs: fix qgroup_snapshot_quick_inherit() squota bug
+
+From: Boris Burkov <boris@bur.io>
+
+[ Upstream commit 7ee19a59a75e3d5b9ec00499b86af8e2a46fbe86 ]
+
+qgroup_snapshot_quick_inherit() detects conditions where the snapshot
+destination would land in the same parent qgroup as the snapshot source
+subvolume. In this case we can avoid costly qgroup calculations and just
+add the nodesize of the new snapshot to the parent.
+
+However, in the case of squotas this is actually a double count, and
+also an undercount for deeper qgroup nestings.
+
+The following annotated script shows the issue:
+
+ btrfs quota enable --simple "$mnt"
+
+ # Create 2-level qgroup hierarchy
+ btrfs qgroup create 2/100 "$mnt" # Q2 (level 2)
+ btrfs qgroup create 1/100 "$mnt" # Q1 (level 1)
+ btrfs qgroup assign 1/100 2/100 "$mnt"
+
+ # Create base subvolume
+ btrfs subvolume create "$mnt/base" >/dev/null
+ base_id=$(btrfs subvolume show "$mnt/base" | grep 'Subvolume ID:' | awk '{print $3}')
+
+ # Create intermediate snapshot and add to Q1
+ btrfs subvolume snapshot "$mnt/base" "$mnt/intermediate" >/dev/null
+ inter_id=$(btrfs subvolume show "$mnt/intermediate" | grep 'Subvolume ID:' | awk '{print $3}')
+ btrfs qgroup assign "0/$inter_id" 1/100 "$mnt"
+
+ # Create working snapshot with --inherit (auto-adds to Q1)
+ # src=intermediate (in only Q1)
+ # dst=snap (inheriting only into Q1)
+ # This double counts the 16k nodesize of the snapshot in Q1, and
+ # undercounts it in Q2.
+ btrfs subvolume snapshot -i 1/100 "$mnt/intermediate" "$mnt/snap" >/dev/null
+ snap_id=$(btrfs subvolume show "$mnt/snap" | grep 'Subvolume ID:' | awk '{print $3}')
+
+ # Fully complete snapshot creation
+ sync
+
+ # Delete working snapshot
+ # Q1 and Q2 will lose the full snap usage
+ btrfs subvolume delete "$mnt/snap" >/dev/null
+
+ # Delete intermediate and remove from Q1
+ # Q1 and Q2 will lose the full intermediate usage
+ btrfs qgroup remove "0/$inter_id" 1/100 "$mnt"
+ btrfs subvolume delete "$mnt/intermediate" >/dev/null
+
+ # Q1 should be at 0, but still has 16k. Q2 is "correct" at 0 (for now...)
+
+ # Trigger cleaner, wait for deletions
+ mount -o remount,sync=1 "$mnt"
+ btrfs subvolume sync "$mnt" "$snap_id"
+ btrfs subvolume sync "$mnt" "$inter_id"
+
+ # Remove Q1 from Q2
+ # Frees 16k more from Q2, underflowing it to 16EiB
+ btrfs qgroup remove 1/100 2/100 "$mnt"
+
+ # And show the bad state:
+ btrfs qgroup show -pc "$mnt"
+
+ Qgroupid Referenced Exclusive Parent Child Path
+ -------- ---------- --------- ------ ----- ----
+ 0/5 16.00KiB 16.00KiB - - <toplevel>
+ 0/256 16.00KiB 16.00KiB - - base
+ 1/100 16.00KiB 16.00KiB - - <0 member qgroups>
+ 2/100 16.00EiB 16.00EiB - - <0 member qgroups>
+
+Fix this by simply not doing this quick inheritance with squotas.
+
+I suspect that it is also wrong in normal qgroups to not recurse up the
+qgroup tree in the quick inherit case, though other consistency checks
+will likely fix it anyway.
+
+Fixes: b20fe56cd285 ("btrfs: qgroup: allow quick inherit if snapshot is created and added to the same parent")
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Boris Burkov <boris@bur.io>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/qgroup.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index 31ad8580322a6..7faaa777010d7 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -3247,6 +3247,9 @@ static int qgroup_snapshot_quick_inherit(struct btrfs_fs_info *fs_info,
+ struct btrfs_qgroup_list *list;
+ int nr_parents = 0;
+
++ if (btrfs_qgroup_mode(fs_info) != BTRFS_QGROUP_MODE_FULL)
++ return 0;
++
+ src = find_qgroup_rb(fs_info, srcid);
+ if (!src)
+ return -ENOENT;
+--
+2.51.0
+
--- /dev/null
+From 7bc1e477dc45342f125bc9e57eb9874c99046c7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Dec 2025 17:26:26 -0800
+Subject: btrfs: fix use-after-free warning in
+ btrfs_get_or_create_delayed_node()
+
+From: Leo Martins <loemra.dev@gmail.com>
+
+[ Upstream commit 83f59076a1ae6f5c6845d6f7ed3a1a373d883684 ]
+
+Previously, btrfs_get_or_create_delayed_node() set the delayed_node's
+refcount before acquiring the root->delayed_nodes lock.
+Commit e8513c012de7 ("btrfs: implement ref_tracker for delayed_nodes")
+moved refcount_set inside the critical section, which means there is
+no longer a memory barrier between setting the refcount and setting
+btrfs_inode->delayed_node.
+
+Without that barrier, the stores to node->refs and
+btrfs_inode->delayed_node may become visible out of order. Another
+thread can then read btrfs_inode->delayed_node and attempt to
+increment a refcount that hasn't been set yet, leading to a
+refcounting bug and a use-after-free warning.
+
+The fix is to move refcount_set back to where it was to take
+advantage of the implicit memory barrier provided by lock
+acquisition.
+
+Because the allocations now happen outside of the lock's critical
+section, they can use GFP_NOFS instead of GFP_ATOMIC.
+
+Reported-by: kernel test robot <oliver.sang@intel.com>
+Closes: https://lore.kernel.org/oe-lkp/202511262228.6dda231e-lkp@intel.com
+Fixes: e8513c012de7 ("btrfs: implement ref_tracker for delayed_nodes")
+Tested-by: kernel test robot <oliver.sang@intel.com>
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Leo Martins <loemra.dev@gmail.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/delayed-inode.c | 32 +++++++++++++++++---------------
+ 1 file changed, 17 insertions(+), 15 deletions(-)
+
+diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
+index 3df7b9d7fbe8d..59b489d7e4b58 100644
+--- a/fs/btrfs/delayed-inode.c
++++ b/fs/btrfs/delayed-inode.c
+@@ -152,37 +152,39 @@ static struct btrfs_delayed_node *btrfs_get_or_create_delayed_node(
+ return ERR_PTR(-ENOMEM);
+ btrfs_init_delayed_node(node, root, ino);
+
++ /* Cached in the inode and can be accessed. */
++ refcount_set(&node->refs, 2);
++ btrfs_delayed_node_ref_tracker_alloc(node, tracker, GFP_NOFS);
++ btrfs_delayed_node_ref_tracker_alloc(node, &node->inode_cache_tracker, GFP_NOFS);
++
+ /* Allocate and reserve the slot, from now it can return a NULL from xa_load(). */
+ ret = xa_reserve(&root->delayed_nodes, ino, GFP_NOFS);
+- if (ret == -ENOMEM) {
+- btrfs_delayed_node_ref_tracker_dir_exit(node);
+- kmem_cache_free(delayed_node_cache, node);
+- return ERR_PTR(-ENOMEM);
+- }
++ if (ret == -ENOMEM)
++ goto cleanup;
++
+ xa_lock(&root->delayed_nodes);
+ ptr = xa_load(&root->delayed_nodes, ino);
+ if (ptr) {
+ /* Somebody inserted it, go back and read it. */
+ xa_unlock(&root->delayed_nodes);
+- btrfs_delayed_node_ref_tracker_dir_exit(node);
+- kmem_cache_free(delayed_node_cache, node);
+- node = NULL;
+- goto again;
++ goto cleanup;
+ }
+ ptr = __xa_store(&root->delayed_nodes, ino, node, GFP_ATOMIC);
+ ASSERT(xa_err(ptr) != -EINVAL);
+ ASSERT(xa_err(ptr) != -ENOMEM);
+ ASSERT(ptr == NULL);
+-
+- /* Cached in the inode and can be accessed. */
+- refcount_set(&node->refs, 2);
+- btrfs_delayed_node_ref_tracker_alloc(node, tracker, GFP_ATOMIC);
+- btrfs_delayed_node_ref_tracker_alloc(node, &node->inode_cache_tracker, GFP_ATOMIC);
+-
+ btrfs_inode->delayed_node = node;
+ xa_unlock(&root->delayed_nodes);
+
+ return node;
++cleanup:
++ btrfs_delayed_node_ref_tracker_free(node, tracker);
++ btrfs_delayed_node_ref_tracker_free(node, &node->inode_cache_tracker);
++ btrfs_delayed_node_ref_tracker_dir_exit(node);
++ kmem_cache_free(delayed_node_cache, node);
++ if (ret)
++ return ERR_PTR(ret);
++ goto again;
+ }
+
+ /*
+--
+2.51.0
+
--- /dev/null
+From 77d21b4236beec637f79af4a48b81d53ae107e41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Dec 2025 14:38:23 +1030
+Subject: btrfs: qgroup: update all parent qgroups when doing quick inherit
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit 68d4b3fa18d72b7f649e83012e7e08f1881f6b75 ]
+
+[BUG]
+There is a bug that if a subvolume has multi-level parent qgroups, and
+is able to do a quick inherit, only the direct parent qgroup got
+updated:
+
+ mkfs.btrfs -f -O quota $dev
+ mount $dev $mnt
+ btrfs subv create $mnt/subv1
+ btrfs qgroup create 1/100 $mnt
+ btrfs qgroup create 2/100 $mnt
+ btrfs qgroup assign 1/100 2/100 $mnt
+ btrfs qgroup assign 0/256 1/100 $mnt
+ btrfs qgroup show -p --sync $mnt
+
+ Qgroupid Referenced Exclusive Parent Path
+ -------- ---------- --------- ------ ----
+ 0/5 16.00KiB 16.00KiB - <toplevel>
+ 0/256 16.00KiB 16.00KiB 1/100 subv1
+ 1/100 16.00KiB 16.00KiB 2/100 2/100<1 member qgroup>
+ 2/100 16.00KiB 16.00KiB - <0 member qgroups>
+
+ btrfs subv snap -i 1/100 $mnt/subv1 $mnt/snap1
+ btrfs qgroup show -p --sync $mnt
+
+ Qgroupid Referenced Exclusive Parent Path
+ -------- ---------- --------- ------ ----
+ 0/5 16.00KiB 16.00KiB - <toplevel>
+ 0/256 16.00KiB 16.00KiB 1/100 subv1
+ 0/257 16.00KiB 16.00KiB 1/100 snap1
+ 1/100 32.00KiB 32.00KiB 2/100 2/100<1 member qgroup>
+ 2/100 16.00KiB 16.00KiB - <0 member qgroups>
+ # Note that 2/100 is not updated, and qgroup numbers are inconsistent
+
+ umount $mnt
+
+[CAUSE]
+If the snapshot source subvolume belongs to a parent qgroup, and the new
+snapshot target is also added to the new same parent qgroup, we allow a
+quick update without marking qgroup inconsistent.
+
+But that quick update only update the parent qgroup, without checking if
+there is any more parent qgroups.
+
+[FIX]
+Iterate through all parent qgroups during the quick inherit.
+
+Reported-by: Boris Burkov <boris@bur.io>
+Fixes: b20fe56cd285 ("btrfs: qgroup: allow quick inherit if snapshot is created and added to the same parent")
+Reviewed-by: Boris Burkov <boris@bur.io>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/qgroup.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index 7faaa777010d7..febc22d1b6487 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -3244,7 +3244,10 @@ static int qgroup_snapshot_quick_inherit(struct btrfs_fs_info *fs_info,
+ {
+ struct btrfs_qgroup *src;
+ struct btrfs_qgroup *parent;
++ struct btrfs_qgroup *qgroup;
+ struct btrfs_qgroup_list *list;
++ LIST_HEAD(qgroup_list);
++ const u32 nodesize = fs_info->nodesize;
+ int nr_parents = 0;
+
+ if (btrfs_qgroup_mode(fs_info) != BTRFS_QGROUP_MODE_FULL)
+@@ -3284,8 +3287,19 @@ static int qgroup_snapshot_quick_inherit(struct btrfs_fs_info *fs_info,
+ if (parent->excl != parent->rfer)
+ return 1;
+
+- parent->excl += fs_info->nodesize;
+- parent->rfer += fs_info->nodesize;
++ qgroup_iterator_add(&qgroup_list, parent);
++ list_for_each_entry(qgroup, &qgroup_list, iterator) {
++ qgroup->rfer += nodesize;
++ qgroup->rfer_cmpr += nodesize;
++ qgroup->excl += nodesize;
++ qgroup->excl_cmpr += nodesize;
++ qgroup_dirty(fs_info, qgroup);
++
++ /* Append parent qgroups to @qgroup_list. */
++ list_for_each_entry(list, &qgroup->groups, next_group)
++ qgroup_iterator_add(&qgroup_list, list->group);
++ }
++ qgroup_iterator_clean(&qgroup_list);
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 34eb91b8f427727c5945864dd10b386d97d70d63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2024 17:56:26 +0800
+Subject: csky: fix csky_cmpxchg_fixup not working
+
+From: Yang Li <yang.li85200@gmail.com>
+
+[ Upstream commit 809ef03d6d21d5fea016bbf6babeec462e37e68c ]
+
+In the csky_cmpxchg_fixup function, it is incorrect to use the global
+variable csky_cmpxchg_stw to determine the address where the exception
+occurred.The global variable csky_cmpxchg_stw stores the opcode at the
+time of the exception, while &csky_cmpxchg_stw shows the address where
+the exception occurred.
+
+Signed-off-by: Yang Li <yang.li85200@gmail.com>
+Signed-off-by: Guo Ren <guoren@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/csky/mm/fault.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/csky/mm/fault.c b/arch/csky/mm/fault.c
+index a6ca7dff42153..7ff4011089850 100644
+--- a/arch/csky/mm/fault.c
++++ b/arch/csky/mm/fault.c
+@@ -45,8 +45,8 @@ static inline void csky_cmpxchg_fixup(struct pt_regs *regs)
+ if (trap_no(regs) != VEC_TLBMODIFIED)
+ return;
+
+- if (instruction_pointer(regs) == csky_cmpxchg_stw)
+- instruction_pointer_set(regs, csky_cmpxchg_ldw);
++ if (instruction_pointer(regs) == (unsigned long)&csky_cmpxchg_stw)
++ instruction_pointer_set(regs, (unsigned long)&csky_cmpxchg_ldw);
+ return;
+ }
+ #endif
+--
+2.51.0
+
--- /dev/null
+From f696545255ae22ef5fdf6b2da59ebc6214e97bd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 22:13:10 +0100
+Subject: dm-snapshot: fix 'scheduling while atomic' on real-time kernels
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+[ Upstream commit 8581b19eb2c5ccf06c195d3b5468c3c9d17a5020 ]
+
+There is reported 'scheduling while atomic' bug when using dm-snapshot on
+real-time kernels. The reason for the bug is that the hlist_bl code does
+preempt_disable() when taking the lock and the kernel attempts to take
+other spinlocks while holding the hlist_bl lock.
+
+Fix this by converting a hlist_bl spinlock into a regular spinlock.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Reported-by: Jiping Ma <jiping.ma2@windriver.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-exception-store.h | 2 +-
+ drivers/md/dm-snap.c | 73 +++++++++++++++------------------
+ 2 files changed, 35 insertions(+), 40 deletions(-)
+
+diff --git a/drivers/md/dm-exception-store.h b/drivers/md/dm-exception-store.h
+index b679766375381..061b4d3108132 100644
+--- a/drivers/md/dm-exception-store.h
++++ b/drivers/md/dm-exception-store.h
+@@ -29,7 +29,7 @@ typedef sector_t chunk_t;
+ * chunk within the device.
+ */
+ struct dm_exception {
+- struct hlist_bl_node hash_list;
++ struct hlist_node hash_list;
+
+ chunk_t old_chunk;
+ chunk_t new_chunk;
+diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
+index f40c18da40000..dbd148967de42 100644
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -40,10 +40,15 @@ static const char dm_snapshot_merge_target_name[] = "snapshot-merge";
+ #define DM_TRACKED_CHUNK_HASH(x) ((unsigned long)(x) & \
+ (DM_TRACKED_CHUNK_HASH_SIZE - 1))
+
++struct dm_hlist_head {
++ struct hlist_head head;
++ spinlock_t lock;
++};
++
+ struct dm_exception_table {
+ uint32_t hash_mask;
+ unsigned int hash_shift;
+- struct hlist_bl_head *table;
++ struct dm_hlist_head *table;
+ };
+
+ struct dm_snapshot {
+@@ -628,8 +633,8 @@ static uint32_t exception_hash(struct dm_exception_table *et, chunk_t chunk);
+
+ /* Lock to protect access to the completed and pending exception hash tables. */
+ struct dm_exception_table_lock {
+- struct hlist_bl_head *complete_slot;
+- struct hlist_bl_head *pending_slot;
++ spinlock_t *complete_slot;
++ spinlock_t *pending_slot;
+ };
+
+ static void dm_exception_table_lock_init(struct dm_snapshot *s, chunk_t chunk,
+@@ -638,20 +643,20 @@ static void dm_exception_table_lock_init(struct dm_snapshot *s, chunk_t chunk,
+ struct dm_exception_table *complete = &s->complete;
+ struct dm_exception_table *pending = &s->pending;
+
+- lock->complete_slot = &complete->table[exception_hash(complete, chunk)];
+- lock->pending_slot = &pending->table[exception_hash(pending, chunk)];
++ lock->complete_slot = &complete->table[exception_hash(complete, chunk)].lock;
++ lock->pending_slot = &pending->table[exception_hash(pending, chunk)].lock;
+ }
+
+ static void dm_exception_table_lock(struct dm_exception_table_lock *lock)
+ {
+- hlist_bl_lock(lock->complete_slot);
+- hlist_bl_lock(lock->pending_slot);
++ spin_lock_nested(lock->complete_slot, 1);
++ spin_lock_nested(lock->pending_slot, 2);
+ }
+
+ static void dm_exception_table_unlock(struct dm_exception_table_lock *lock)
+ {
+- hlist_bl_unlock(lock->pending_slot);
+- hlist_bl_unlock(lock->complete_slot);
++ spin_unlock(lock->pending_slot);
++ spin_unlock(lock->complete_slot);
+ }
+
+ static int dm_exception_table_init(struct dm_exception_table *et,
+@@ -661,13 +666,15 @@ static int dm_exception_table_init(struct dm_exception_table *et,
+
+ et->hash_shift = hash_shift;
+ et->hash_mask = size - 1;
+- et->table = kvmalloc_array(size, sizeof(struct hlist_bl_head),
++ et->table = kvmalloc_array(size, sizeof(struct dm_hlist_head),
+ GFP_KERNEL);
+ if (!et->table)
+ return -ENOMEM;
+
+- for (i = 0; i < size; i++)
+- INIT_HLIST_BL_HEAD(et->table + i);
++ for (i = 0; i < size; i++) {
++ INIT_HLIST_HEAD(&et->table[i].head);
++ spin_lock_init(&et->table[i].lock);
++ }
+
+ return 0;
+ }
+@@ -675,16 +682,17 @@ static int dm_exception_table_init(struct dm_exception_table *et,
+ static void dm_exception_table_exit(struct dm_exception_table *et,
+ struct kmem_cache *mem)
+ {
+- struct hlist_bl_head *slot;
++ struct dm_hlist_head *slot;
+ struct dm_exception *ex;
+- struct hlist_bl_node *pos, *n;
++ struct hlist_node *pos;
+ int i, size;
+
+ size = et->hash_mask + 1;
+ for (i = 0; i < size; i++) {
+ slot = et->table + i;
+
+- hlist_bl_for_each_entry_safe(ex, pos, n, slot, hash_list) {
++ hlist_for_each_entry_safe(ex, pos, &slot->head, hash_list) {
++ hlist_del(&ex->hash_list);
+ kmem_cache_free(mem, ex);
+ cond_resched();
+ }
+@@ -700,7 +708,7 @@ static uint32_t exception_hash(struct dm_exception_table *et, chunk_t chunk)
+
+ static void dm_remove_exception(struct dm_exception *e)
+ {
+- hlist_bl_del(&e->hash_list);
++ hlist_del(&e->hash_list);
+ }
+
+ /*
+@@ -710,12 +718,11 @@ static void dm_remove_exception(struct dm_exception *e)
+ static struct dm_exception *dm_lookup_exception(struct dm_exception_table *et,
+ chunk_t chunk)
+ {
+- struct hlist_bl_head *slot;
+- struct hlist_bl_node *pos;
++ struct hlist_head *slot;
+ struct dm_exception *e;
+
+- slot = &et->table[exception_hash(et, chunk)];
+- hlist_bl_for_each_entry(e, pos, slot, hash_list)
++ slot = &et->table[exception_hash(et, chunk)].head;
++ hlist_for_each_entry(e, slot, hash_list)
+ if (chunk >= e->old_chunk &&
+ chunk <= e->old_chunk + dm_consecutive_chunk_count(e))
+ return e;
+@@ -762,18 +769,17 @@ static void free_pending_exception(struct dm_snap_pending_exception *pe)
+ static void dm_insert_exception(struct dm_exception_table *eh,
+ struct dm_exception *new_e)
+ {
+- struct hlist_bl_head *l;
+- struct hlist_bl_node *pos;
++ struct hlist_head *l;
+ struct dm_exception *e = NULL;
+
+- l = &eh->table[exception_hash(eh, new_e->old_chunk)];
++ l = &eh->table[exception_hash(eh, new_e->old_chunk)].head;
+
+ /* Add immediately if this table doesn't support consecutive chunks */
+ if (!eh->hash_shift)
+ goto out;
+
+ /* List is ordered by old_chunk */
+- hlist_bl_for_each_entry(e, pos, l, hash_list) {
++ hlist_for_each_entry(e, l, hash_list) {
+ /* Insert after an existing chunk? */
+ if (new_e->old_chunk == (e->old_chunk +
+ dm_consecutive_chunk_count(e) + 1) &&
+@@ -804,13 +810,13 @@ static void dm_insert_exception(struct dm_exception_table *eh,
+ * Either the table doesn't support consecutive chunks or slot
+ * l is empty.
+ */
+- hlist_bl_add_head(&new_e->hash_list, l);
++ hlist_add_head(&new_e->hash_list, l);
+ } else if (new_e->old_chunk < e->old_chunk) {
+ /* Add before an existing exception */
+- hlist_bl_add_before(&new_e->hash_list, &e->hash_list);
++ hlist_add_before(&new_e->hash_list, &e->hash_list);
+ } else {
+ /* Add to l's tail: e is the last exception in this slot */
+- hlist_bl_add_behind(&new_e->hash_list, &e->hash_list);
++ hlist_add_behind(&new_e->hash_list, &e->hash_list);
+ }
+ }
+
+@@ -820,7 +826,6 @@ static void dm_insert_exception(struct dm_exception_table *eh,
+ */
+ static int dm_add_exception(void *context, chunk_t old, chunk_t new)
+ {
+- struct dm_exception_table_lock lock;
+ struct dm_snapshot *s = context;
+ struct dm_exception *e;
+
+@@ -833,17 +838,7 @@ static int dm_add_exception(void *context, chunk_t old, chunk_t new)
+ /* Consecutive_count is implicitly initialised to zero */
+ e->new_chunk = new;
+
+- /*
+- * Although there is no need to lock access to the exception tables
+- * here, if we don't then hlist_bl_add_head(), called by
+- * dm_insert_exception(), will complain about accessing the
+- * corresponding list without locking it first.
+- */
+- dm_exception_table_lock_init(s, old, &lock);
+-
+- dm_exception_table_lock(&lock);
+ dm_insert_exception(&s->complete, e);
+- dm_exception_table_unlock(&lock);
+
+ return 0;
+ }
+@@ -873,7 +868,7 @@ static int calc_max_buckets(void)
+ /* use a fixed size of 2MB */
+ unsigned long mem = 2 * 1024 * 1024;
+
+- mem /= sizeof(struct hlist_bl_head);
++ mem /= sizeof(struct dm_hlist_head);
+
+ return mem;
+ }
+--
+2.51.0
+
--- /dev/null
+From 9f95c7e4edca22832bade26d3d6c0cb244e137f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Nov 2025 16:54:01 +0100
+Subject: dm-verity: disable recursive forward error correction
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+[ Upstream commit d9f3e47d3fae0c101d9094bc956ed24e7a0ee801 ]
+
+There are two problems with the recursive correction:
+
+1. It may cause denial-of-service. In fec_read_bufs, there is a loop that
+has 253 iterations. For each iteration, we may call verity_hash_for_block
+recursively. There is a limit of 4 nested recursions - that means that
+there may be at most 253^4 (4 billion) iterations. Red Hat QE team
+actually created an image that pushes dm-verity to this limit - and this
+image just makes the udev-worker process get stuck in the 'D' state.
+
+2. It doesn't work. In fec_read_bufs we store data into the variable
+"fio->bufs", but fio bufs is shared between recursive invocations, if
+"verity_hash_for_block" invoked correction recursively, it would
+overwrite partially filled fio->bufs.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Reported-by: Guangwu Zhang <guazhang@redhat.com>
+Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
+Reviewed-by: Eric Biggers <ebiggers@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-verity-fec.c | 4 +---
+ drivers/md/dm-verity-fec.h | 3 ---
+ drivers/md/dm-verity-target.c | 2 +-
+ 3 files changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/md/dm-verity-fec.c b/drivers/md/dm-verity-fec.c
+index 72047b47a7a0a..e41bde1d3b15b 100644
+--- a/drivers/md/dm-verity-fec.c
++++ b/drivers/md/dm-verity-fec.c
+@@ -413,10 +413,8 @@ int verity_fec_decode(struct dm_verity *v, struct dm_verity_io *io,
+ if (!verity_fec_is_enabled(v))
+ return -EOPNOTSUPP;
+
+- if (fio->level >= DM_VERITY_FEC_MAX_RECURSION) {
+- DMWARN_LIMIT("%s: FEC: recursion too deep", v->data_dev->name);
++ if (fio->level)
+ return -EIO;
+- }
+
+ fio->level++;
+
+diff --git a/drivers/md/dm-verity-fec.h b/drivers/md/dm-verity-fec.h
+index 09123a6129538..ec37e607cb3f0 100644
+--- a/drivers/md/dm-verity-fec.h
++++ b/drivers/md/dm-verity-fec.h
+@@ -23,9 +23,6 @@
+ #define DM_VERITY_FEC_BUF_MAX \
+ (1 << (PAGE_SHIFT - DM_VERITY_FEC_BUF_RS_BITS))
+
+-/* maximum recursion level for verity_fec_decode */
+-#define DM_VERITY_FEC_MAX_RECURSION 4
+-
+ #define DM_VERITY_OPT_FEC_DEV "use_fec_from_device"
+ #define DM_VERITY_OPT_FEC_BLOCKS "fec_blocks"
+ #define DM_VERITY_OPT_FEC_START "fec_start"
+diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
+index 66a00a8ccb398..c8695c079cfe0 100644
+--- a/drivers/md/dm-verity-target.c
++++ b/drivers/md/dm-verity-target.c
+@@ -1690,7 +1690,7 @@ static struct target_type verity_target = {
+ .name = "verity",
+ /* Note: the LSMs depend on the singleton and immutable features */
+ .features = DM_TARGET_SINGLETON | DM_TARGET_IMMUTABLE,
+- .version = {1, 12, 0},
++ .version = {1, 13, 0},
+ .module = THIS_MODULE,
+ .ctr = verity_ctr,
+ .dtr = verity_dtr,
+--
+2.51.0
+
--- /dev/null
+From 51a5d60ceca6c650913273721c0c112062e166c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Nov 2025 09:40:47 -0800
+Subject: drm/amd/display: shrink struct members
+
+From: Rosen Penev <rosenp@gmail.com>
+
+[ Upstream commit 7329417fc9ac128729c3a092b006c8f1fd0d04a6 ]
+
+On a 32-bit ARM system, the audio_decoder struct ends up being too large
+for dp_retrain_link_dp_test.
+
+link_dp_cts.c:157:1: error: the frame size of 1328 bytes is larger than
+1280 bytes [-Werror=frame-larger-than=]
+
+This is mitigated by shrinking the members of the struct and avoids
+having to deal with dynamic allocation.
+
+feed_back_divider is assigned but otherwise unused. Remove both.
+
+pixel_repetition looks like it should be a bool since it's only ever
+assigned to 1. But there are checks for 2 and 4. Reduce to uint8_t.
+
+Remove ss_percentage_divider. Unused.
+
+Shrink refresh_rate as it gets assigned to at most a 3 digit integer
+value.
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 3849efdc7888d537f09c3dcfaea4b3cd377a102e)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 3 ---
+ drivers/gpu/drm/amd/display/include/audio_types.h | 12 +++++-------
+ 2 files changed, 5 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+index ebc220b29d142..b94fec8347400 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+@@ -1458,9 +1458,6 @@ void build_audio_output(
+ state->clk_mgr);
+ }
+
+- audio_output->pll_info.feed_back_divider =
+- pipe_ctx->pll_settings.feedback_divider;
+-
+ audio_output->pll_info.dto_source =
+ translate_to_dto_source(
+ pipe_ctx->stream_res.tg->inst + 1);
+diff --git a/drivers/gpu/drm/amd/display/include/audio_types.h b/drivers/gpu/drm/amd/display/include/audio_types.h
+index e4a26143f14c9..6699ad4fa825e 100644
+--- a/drivers/gpu/drm/amd/display/include/audio_types.h
++++ b/drivers/gpu/drm/amd/display/include/audio_types.h
+@@ -47,15 +47,15 @@ struct audio_crtc_info {
+ uint32_t h_total;
+ uint32_t h_active;
+ uint32_t v_active;
+- uint32_t pixel_repetition;
+ uint32_t requested_pixel_clock_100Hz; /* in 100Hz */
+ uint32_t calculated_pixel_clock_100Hz; /* in 100Hz */
+- uint32_t refresh_rate;
++ uint32_t dsc_bits_per_pixel;
++ uint32_t dsc_num_slices;
+ enum dc_color_depth color_depth;
+ enum dc_pixel_encoding pixel_encoding;
++ uint16_t refresh_rate;
++ uint8_t pixel_repetition;
+ bool interlaced;
+- uint32_t dsc_bits_per_pixel;
+- uint32_t dsc_num_slices;
+ };
+ struct azalia_clock_info {
+ uint32_t pixel_clock_in_10khz;
+@@ -78,11 +78,9 @@ enum audio_dto_source {
+
+ struct audio_pll_info {
+ uint32_t audio_dto_source_clock_in_khz;
+- uint32_t feed_back_divider;
++ uint32_t ss_percentage;
+ enum audio_dto_source dto_source;
+ bool ss_enabled;
+- uint32_t ss_percentage;
+- uint32_t ss_percentage_divider;
+ };
+
+ struct audio_channel_associate_info {
+--
+2.51.0
+
--- /dev/null
+From 7e651130e6a4487377d7da1be9b4ccd046f81e42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 18:56:46 -0500
+Subject: NFS: Fix up the automount fs_context to use the correct cred
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit a2a8fc27dd668e7562b5326b5ed2f1604cb1e2e9 ]
+
+When automounting, the fs_context should be fixed up to use the cred
+from the parent filesystem, since the operation is just extending the
+namespace. Authorisation to enter that namespace will already have been
+provided by the preceding lookup.
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/namespace.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
+index 9e4d94f41fc67..af9be0c5f5163 100644
+--- a/fs/nfs/namespace.c
++++ b/fs/nfs/namespace.c
+@@ -170,6 +170,11 @@ struct vfsmount *nfs_d_automount(struct path *path)
+ if (!ctx->clone_data.fattr)
+ goto out_fc;
+
++ if (fc->cred != server->cred) {
++ put_cred(fc->cred);
++ fc->cred = get_cred(server->cred);
++ }
++
+ if (fc->net_ns != client->cl_net) {
+ put_net(fc->net_ns);
+ fc->net_ns = get_net(client->cl_net);
+--
+2.51.0
+
--- /dev/null
+From 8350e20cfb445bb7518e68d9a10d8d808f12713a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Nov 2025 10:44:15 -0500
+Subject: NFSv4: ensure the open stateid seqid doesn't go backwards
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+[ Upstream commit 2e47c3cc64b44b0b06cd68c2801db92ff143f2b2 ]
+
+We have observed an NFSv4 client receiving a LOCK reply with a status of
+NFS4ERR_OLD_STATEID and subsequently retrying the LOCK request with an
+earlier seqid value in the stateid. As this was for a new lockowner,
+that would imply that nfs_set_open_stateid_locked() had updated the open
+stateid seqid with an earlier value.
+
+Looking at nfs_set_open_stateid_locked(), if the incoming seqid is out
+of sequence, the task will sleep on the state->waitq for up to 5
+seconds. If the task waits for the full 5 seconds, then after finishing
+the wait it'll update the open stateid seqid with whatever value the
+incoming seqid has. If there are multiple waiters in this scenario,
+then the last one to perform said update may not be the one with the
+highest seqid.
+
+Add a check to ensure that the seqid can only be incremented, and add a
+tracepoint to indicate when old seqids are skipped.
+
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Reviewed-by: Benjamin Coddington <bcodding@hammerspace.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 13 +++++++++++--
+ fs/nfs/nfs4trace.h | 1 +
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 6f4e14fb7b9b8..3b436ba2ed3bf 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1780,8 +1780,17 @@ static void nfs_set_open_stateid_locked(struct nfs4_state *state,
+ if (nfs_stateid_is_sequential(state, stateid))
+ break;
+
+- if (status)
+- break;
++ if (status) {
++ if (nfs4_stateid_match_other(stateid, &state->open_stateid) &&
++ !nfs4_stateid_is_newer(stateid, &state->open_stateid)) {
++ trace_nfs4_open_stateid_update_skip(state->inode,
++ stateid, status);
++ return;
++ } else {
++ break;
++ }
++ }
++
+ /* Rely on seqids for serialisation with NFSv4.0 */
+ if (!nfs4_has_session(NFS_SERVER(state->inode)->nfs_client))
+ break;
+diff --git a/fs/nfs/nfs4trace.h b/fs/nfs/nfs4trace.h
+index 9776d220cec33..6285128e631a5 100644
+--- a/fs/nfs/nfs4trace.h
++++ b/fs/nfs/nfs4trace.h
+@@ -1353,6 +1353,7 @@ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_setattr);
+ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_delegreturn);
+ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update);
+ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update_wait);
++DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update_skip);
+ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_close_stateid_update_wait);
+
+ DECLARE_EVENT_CLASS(nfs4_getattr_event,
+--
+2.51.0
+
--- /dev/null
+From 6b14f7e0eb65adff7742f55a19d62c9042ae39d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Dec 2025 11:49:15 +0000
+Subject: of: unittest: Fix memory leak in unittest_data_add()
+
+From: Zilin Guan <zilin@seu.edu.cn>
+
+[ Upstream commit 235a1eb8d2dcc49a6cf0a5ee1aa85544a5d0054b ]
+
+In unittest_data_add(), if of_resolve_phandles() fails, the allocated
+unittest_data is not freed, leading to a memory leak.
+
+Fix this by using scope-based cleanup helper __free(kfree) for automatic
+resource cleanup. This ensures unittest_data is automatically freed when
+it goes out of scope in error paths.
+
+For the success path, use retain_and_null_ptr() to transfer ownership
+of the memory to the device tree and prevent double freeing.
+
+Fixes: 2eb46da2a760 ("of/selftest: Use the resolver to fixup phandles")
+Suggested-by: Rob Herring <robh@kernel.org>
+Co-developed-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
+Signed-off-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
+Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
+Link: https://patch.msgid.link/20251231114915.234638-1-zilin@seu.edu.cn
+Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/unittest.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
+index 388e9ec2cccf8..3b773aaf9d050 100644
+--- a/drivers/of/unittest.c
++++ b/drivers/of/unittest.c
+@@ -1985,7 +1985,6 @@ static void attach_node_and_children(struct device_node *np)
+ */
+ static int __init unittest_data_add(void)
+ {
+- void *unittest_data;
+ void *unittest_data_align;
+ struct device_node *unittest_data_node = NULL, *np;
+ /*
+@@ -2004,7 +2003,7 @@ static int __init unittest_data_add(void)
+ }
+
+ /* creating copy */
+- unittest_data = kmalloc(size + FDT_ALIGN_SIZE, GFP_KERNEL);
++ void *unittest_data __free(kfree) = kmalloc(size + FDT_ALIGN_SIZE, GFP_KERNEL);
+ if (!unittest_data)
+ return -ENOMEM;
+
+@@ -2014,12 +2013,10 @@ static int __init unittest_data_add(void)
+ ret = of_fdt_unflatten_tree(unittest_data_align, NULL, &unittest_data_node);
+ if (!ret) {
+ pr_warn("%s: unflatten testcases tree failed\n", __func__);
+- kfree(unittest_data);
+ return -ENODATA;
+ }
+ if (!unittest_data_node) {
+ pr_warn("%s: testcases tree is empty\n", __func__);
+- kfree(unittest_data);
+ return -ENODATA;
+ }
+
+@@ -2038,7 +2035,6 @@ static int __init unittest_data_add(void)
+ /* attach the sub-tree to live tree */
+ if (!of_root) {
+ pr_warn("%s: no live tree to attach sub-tree\n", __func__);
+- kfree(unittest_data);
+ rc = -ENODEV;
+ goto unlock;
+ }
+@@ -2059,6 +2055,8 @@ static int __init unittest_data_add(void)
+ EXPECT_END(KERN_INFO,
+ "Duplicate name in testcase-data, renamed to \"duplicate-name#1\"");
+
++ retain_and_null_ptr(unittest_data);
++
+ unlock:
+ of_overlay_mutex_unlock();
+
+--
+2.51.0
+
--- /dev/null
+From 0a132c3644f68ada4bcee88ccb65d894a3edcc68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Oct 2025 09:24:26 -0500
+Subject: scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset
+
+From: Wen Xiong <wenxiong@linux.ibm.com>
+
+[ Upstream commit 6ac3484fb13b2fc7f31cfc7f56093e7d0ce646a5 ]
+
+A dynamic remove/add storage adapter test hits EEH on PowerPC:
+
+ EEH: [c00000000004f75c] __eeh_send_failure_event+0x7c/0x160
+ EEH: [c000000000048444] eeh_dev_check_failure.part.0+0x254/0x650
+ EEH: [c008000001650678] eeh_readl+0x60/0x90 [ipr]
+ EEH: [c00800000166746c] ipr_cancel_op+0x2b8/0x524 [ipr]
+ EEH: [c008000001656524] ipr_eh_abort+0x6c/0x130 [ipr]
+ EEH: [c000000000ab0d20] scmd_eh_abort_handler+0x140/0x440
+ EEH: [c00000000017e558] process_one_work+0x298/0x590
+ EEH: [c00000000017eef8] worker_thread+0xa8/0x620
+ EEH: [c00000000018be34] kthread+0x124/0x130
+ EEH: [c00000000000cd64] ret_from_kernel_thread+0x5c/0x64
+
+A PCIe bus trace reveals that a vector of MSI-X is cleared to 0 by
+irqbalance daemon. If we disable irqbalance daemon, we won't see the
+issue.
+
+With debug enabled in ipr driver:
+
+ [ 44.103071] ipr: Entering __ipr_remove
+ [ 44.103083] ipr: Entering ipr_initiate_ioa_bringdown
+ [ 44.103091] ipr: Entering ipr_reset_shutdown_ioa
+ [ 44.103099] ipr: Leaving ipr_reset_shutdown_ioa
+ [ 44.103105] ipr: Leaving ipr_initiate_ioa_bringdown
+ [ 44.149918] ipr: Entering ipr_reset_ucode_download
+ [ 44.149935] ipr: Entering ipr_reset_alert
+ [ 44.150032] ipr: Entering ipr_reset_start_timer
+ [ 44.150038] ipr: Leaving ipr_reset_alert
+ [ 44.244343] scsi 1:2:3:0: alua: Detached
+ [ 44.254300] ipr: Entering ipr_reset_start_bist
+ [ 44.254320] ipr: Entering ipr_reset_start_timer
+ [ 44.254325] ipr: Leaving ipr_reset_start_bist
+ [ 44.364329] scsi 1:2:4:0: alua: Detached
+ [ 45.134341] scsi 1:2:5:0: alua: Detached
+ [ 45.860949] ipr: Entering ipr_reset_shutdown_ioa
+ [ 45.860962] ipr: Leaving ipr_reset_shutdown_ioa
+ [ 45.860966] ipr: Entering ipr_reset_alert
+ [ 45.861028] ipr: Entering ipr_reset_start_timer
+ [ 45.861035] ipr: Leaving ipr_reset_alert
+ [ 45.964302] ipr: Entering ipr_reset_start_bist
+ [ 45.964309] ipr: Entering ipr_reset_start_timer
+ [ 45.964313] ipr: Leaving ipr_reset_start_bist
+ [ 46.264301] ipr: Entering ipr_reset_bist_done
+ [ 46.264309] ipr: Leaving ipr_reset_bist_done
+
+During adapter reset, ipr device driver blocks config space access but
+can't block MMIO access for MSI-X entries. There is very small window:
+irqbalance daemon kicks in during adapter reset before ipr driver calls
+pci_restore_state(pdev) to restore MSI-X table.
+
+irqbalance daemon reads back all 0 for that MSI-X vector in
+__pci_read_msi_msg().
+
+irqbalance daemon:
+
+ msi_domain_set_affinity()
+ ->irq_chip_set_affinity_patent()
+ ->xive_irq_set_affinity()
+ ->irq_chip_compose_msi_msg()
+ ->pseries_msi_compose_msg()
+ ->__pci_read_msi_msg(): read all 0 since didn't call pci_restore_state
+ ->irq_chip_write_msi_msg()
+ -> pci_write_msg_msi(): write 0 to the msix vector entry
+
+When ipr driver calls pci_restore_state(pdev) in
+ipr_reset_restore_cfg_space(), the MSI-X vector entry has been cleared
+by irqbalance daemon in pci_write_msg_msix().
+
+ pci_restore_state()
+ ->__pci_restore_msix_state()
+
+Below is the MSI-X table for ipr adapter after irqbalance daemon kicked
+in during adapter reset:
+
+ Dump MSIx table: index=0 address_lo=c800 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=1 address_lo=c810 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=2 address_lo=c820 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=3 address_lo=c830 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=4 address_lo=c840 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=5 address_lo=c850 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=6 address_lo=c860 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=7 address_lo=c870 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=8 address_lo=0 address_hi=0 msg_data=0
+ ---------> Hit EEH since msix vector of index=8 are 0
+ Dump MSIx table: index=9 address_lo=c890 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=10 address_lo=c8a0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=11 address_lo=c8b0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=12 address_lo=c8c0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=13 address_lo=c8d0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=14 address_lo=c8e0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=15 address_lo=c8f0 address_hi=10000000 msg_data=0
+
+ [ 46.264312] ipr: Entering ipr_reset_restore_cfg_space
+ [ 46.267439] ipr: Entering ipr_fail_all_ops
+ [ 46.267447] ipr: Leaving ipr_fail_all_ops
+ [ 46.267451] ipr: Leaving ipr_reset_restore_cfg_space
+ [ 46.267454] ipr: Entering ipr_ioa_bringdown_done
+ [ 46.267458] ipr: Leaving ipr_ioa_bringdown_done
+ [ 46.267467] ipr: Entering ipr_worker_thread
+ [ 46.267470] ipr: Leaving ipr_worker_thread
+
+IRQ balancing is not required during adapter reset.
+
+Enable "IRQ_NO_BALANCING" flag before starting adapter reset and disable
+it after calling pci_restore_state(). The irqbalance daemon is disabled
+for this short period of time (~2s).
+
+Co-developed-by: Kyle Mahlkuch <Kyle.Mahlkuch@ibm.com>
+Signed-off-by: Kyle Mahlkuch <Kyle.Mahlkuch@ibm.com>
+Signed-off-by: Wen Xiong <wenxiong@linux.ibm.com>
+Link: https://patch.msgid.link/20251028142427.3969819-2-wenxiong@linux.ibm.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ipr.c | 28 +++++++++++++++++++++++++++-
+ 1 file changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
+index 44214884deaf5..d62bb7d0e4164 100644
+--- a/drivers/scsi/ipr.c
++++ b/drivers/scsi/ipr.c
+@@ -61,8 +61,8 @@
+ #include <linux/hdreg.h>
+ #include <linux/reboot.h>
+ #include <linux/stringify.h>
++#include <linux/irq.h>
+ #include <asm/io.h>
+-#include <asm/irq.h>
+ #include <asm/processor.h>
+ #include <scsi/scsi.h>
+ #include <scsi/scsi_host.h>
+@@ -7843,6 +7843,30 @@ static int ipr_dump_mailbox_wait(struct ipr_cmnd *ipr_cmd)
+ return IPR_RC_JOB_RETURN;
+ }
+
++/**
++ * ipr_set_affinity_nobalance
++ * @ioa_cfg: ipr_ioa_cfg struct for an ipr device
++ * @flag: bool
++ * true: ensable "IRQ_NO_BALANCING" bit for msix interrupt
++ * false: disable "IRQ_NO_BALANCING" bit for msix interrupt
++ * Description: This function will be called to disable/enable
++ * "IRQ_NO_BALANCING" to avoid irqbalance daemon
++ * kicking in during adapter reset.
++ **/
++static void ipr_set_affinity_nobalance(struct ipr_ioa_cfg *ioa_cfg, bool flag)
++{
++ int irq, i;
++
++ for (i = 0; i < ioa_cfg->nvectors; i++) {
++ irq = pci_irq_vector(ioa_cfg->pdev, i);
++
++ if (flag)
++ irq_set_status_flags(irq, IRQ_NO_BALANCING);
++ else
++ irq_clear_status_flags(irq, IRQ_NO_BALANCING);
++ }
++}
++
+ /**
+ * ipr_reset_restore_cfg_space - Restore PCI config space.
+ * @ipr_cmd: ipr command struct
+@@ -7867,6 +7891,7 @@ static int ipr_reset_restore_cfg_space(struct ipr_cmnd *ipr_cmd)
+ return IPR_RC_JOB_CONTINUE;
+ }
+
++ ipr_set_affinity_nobalance(ioa_cfg, false);
+ ipr_fail_all_ops(ioa_cfg);
+
+ if (ioa_cfg->sis64) {
+@@ -7946,6 +7971,7 @@ static int ipr_reset_start_bist(struct ipr_cmnd *ipr_cmd)
+ rc = pci_write_config_byte(ioa_cfg->pdev, PCI_BIST, PCI_BIST_START);
+
+ if (rc == PCIBIOS_SUCCESSFUL) {
++ ipr_set_affinity_nobalance(ioa_cfg, true);
+ ipr_cmd->job_step = ipr_reset_bist_done;
+ ipr_reset_start_timer(ipr_cmd, IPR_WAIT_FOR_BIST_TIMEOUT);
+ rc = IPR_RC_JOB_RETURN;
+--
+2.51.0
+
--- /dev/null
+From 40ece0093ecc6eb7a2492ab582259aa22531e2a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 12:49:55 +0530
+Subject: scsi: mpi3mr: Prevent duplicate SAS/SATA device entries in channel 1
+
+From: Suganath Prabu S <suganath-prabu.subramani@broadcom.com>
+
+[ Upstream commit 4588e65cfd66fc8bbd9969ea730db39b60a36a30 ]
+
+Avoid scanning SAS/SATA devices in channel 1 when SAS transport is
+enabled, as the SAS/SATA devices are exposed through channel 0.
+
+Signed-off-by: Suganath Prabu S <suganath-prabu.subramani@broadcom.com>
+Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
+Link: https://lore.kernel.org/stable/20251120071955.463475-1-suganath-prabu.subramani%40broadcom.com
+Link: https://patch.msgid.link/20251120071955.463475-1-suganath-prabu.subramani@broadcom.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpi3mr/mpi3mr.h | 4 ++--
+ drivers/scsi/mpi3mr/mpi3mr_os.c | 4 +++-
+ 2 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/mpi3mr/mpi3mr.h b/drivers/scsi/mpi3mr/mpi3mr.h
+index 6742684e2990a..31d68c151b207 100644
+--- a/drivers/scsi/mpi3mr/mpi3mr.h
++++ b/drivers/scsi/mpi3mr/mpi3mr.h
+@@ -56,8 +56,8 @@ extern struct list_head mrioc_list;
+ extern int prot_mask;
+ extern atomic64_t event_counter;
+
+-#define MPI3MR_DRIVER_VERSION "8.15.0.5.50"
+-#define MPI3MR_DRIVER_RELDATE "12-August-2025"
++#define MPI3MR_DRIVER_VERSION "8.15.0.5.51"
++#define MPI3MR_DRIVER_RELDATE "18-November-2025"
+
+ #define MPI3MR_DRIVER_NAME "mpi3mr"
+ #define MPI3MR_DRIVER_LICENSE "GPL"
+diff --git a/drivers/scsi/mpi3mr/mpi3mr_os.c b/drivers/scsi/mpi3mr/mpi3mr_os.c
+index b88633e1efe27..d4ca878d08869 100644
+--- a/drivers/scsi/mpi3mr/mpi3mr_os.c
++++ b/drivers/scsi/mpi3mr/mpi3mr_os.c
+@@ -1184,6 +1184,8 @@ static void mpi3mr_update_tgtdev(struct mpi3mr_ioc *mrioc,
+ if (is_added == true)
+ tgtdev->io_throttle_enabled =
+ (flags & MPI3_DEVICE0_FLAGS_IO_THROTTLING_REQUIRED) ? 1 : 0;
++ if (!mrioc->sas_transport_enabled)
++ tgtdev->non_stl = 1;
+
+ switch (flags & MPI3_DEVICE0_FLAGS_MAX_WRITE_SAME_MASK) {
+ case MPI3_DEVICE0_FLAGS_MAX_WRITE_SAME_256_LB:
+@@ -4844,7 +4846,7 @@ static int mpi3mr_target_alloc(struct scsi_target *starget)
+ spin_lock_irqsave(&mrioc->tgtdev_lock, flags);
+ if (starget->channel == mrioc->scsi_device_channel) {
+ tgt_dev = __mpi3mr_get_tgtdev_by_perst_id(mrioc, starget->id);
+- if (tgt_dev && !tgt_dev->is_hidden) {
++ if (tgt_dev && !tgt_dev->is_hidden && tgt_dev->non_stl) {
+ scsi_tgt_priv_data->starget = starget;
+ scsi_tgt_priv_data->dev_handle = tgt_dev->dev_handle;
+ scsi_tgt_priv_data->perst_id = tgt_dev->perst_id;
+--
+2.51.0
+
--- /dev/null
+From 38f8727940c82f0281075510afb5cbec60e3f27b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 14:56:27 +0800
+Subject: scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe
+ failure scanned in again after probe failed"
+
+From: Xingui Yang <yangxingui@huawei.com>
+
+[ Upstream commit 278712d20bc8ec29d1ad6ef9bdae9000ef2c220c ]
+
+This reverts commit ab2068a6fb84751836a84c26ca72b3beb349619d.
+
+When probing the exp-attached sata device, libsas/libata will issue a
+hard reset in sas_probe_sata() -> ata_sas_async_probe(), then a
+broadcast event will be received after the disk probe fails, and this
+commit causes the probe will be re-executed on the disk, and a faulty
+disk may get into an indefinite loop of probe.
+
+Therefore, revert this commit, although it can fix some temporary issues
+with disk probe failure.
+
+Signed-off-by: Xingui Yang <yangxingui@huawei.com>
+Reviewed-by: Jason Yan <yanaijie@huawei.com>
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Link: https://patch.msgid.link/20251202065627.140361-1-yangxingui@huawei.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_internal.h | 14 --------------
+ 1 file changed, 14 deletions(-)
+
+diff --git a/drivers/scsi/libsas/sas_internal.h b/drivers/scsi/libsas/sas_internal.h
+index 6706f2be8d274..da5408c701cdd 100644
+--- a/drivers/scsi/libsas/sas_internal.h
++++ b/drivers/scsi/libsas/sas_internal.h
+@@ -145,20 +145,6 @@ static inline void sas_fail_probe(struct domain_device *dev, const char *func, i
+ func, dev->parent ? "exp-attached" :
+ "direct-attached",
+ SAS_ADDR(dev->sas_addr), err);
+-
+- /*
+- * If the device probe failed, the expander phy attached address
+- * needs to be reset so that the phy will not be treated as flutter
+- * in the next revalidation
+- */
+- if (dev->parent && !dev_is_expander(dev->dev_type)) {
+- struct sas_phy *phy = dev->phy;
+- struct domain_device *parent = dev->parent;
+- struct ex_phy *ex_phy = &parent->ex_dev.ex_phy[phy->number];
+-
+- memset(ex_phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
+- }
+-
+ sas_unregister_dev(dev->port, dev);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 251e53ab0a379e0b5e03c4e571bd43300f36a289 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Nov 2025 06:32:02 +0000
+Subject: scsi: ufs: core: Fix EH failure after W-LUN resume error
+
+From: Brian Kao <powenkao@google.com>
+
+[ Upstream commit b4bb6daf4ac4d4560044ecdd81e93aa2f6acbb06 ]
+
+When a W-LUN resume fails, its parent devices in the SCSI hierarchy,
+including the scsi_target, may be runtime suspended. Subsequently, the
+error handler in ufshcd_recover_pm_error() fails to set the W-LUN device
+back to active because the parent target is not active. This results in
+the following errors:
+
+ google-ufshcd 3c2d0000.ufs: ufshcd_err_handler started; HBA state eh_fatal; ...
+ ufs_device_wlun 0:0:0:49488: START_STOP failed for power mode: 1, result 40000
+ ufs_device_wlun 0:0:0:49488: ufshcd_wl_runtime_resume failed: -5
+ ...
+ ufs_device_wlun 0:0:0:49488: runtime PM trying to activate child device 0:0:0:49488 but parent (target0:0:0) is not active
+
+Address this by:
+
+ 1. Ensuring the W-LUN's parent scsi_target is runtime resumed before
+ attempting to set the W-LUN to active within
+ ufshcd_recover_pm_error().
+
+ 2. Explicitly checking for power.runtime_error on the HBA and W-LUN
+ devices before calling pm_runtime_set_active() to clear the error
+ state.
+
+ 3. Adding pm_runtime_get_sync(hba->dev) in
+ ufshcd_err_handling_prepare() to ensure the HBA itself is active
+ during error recovery, even if a child device resume failed.
+
+These changes ensure the device power states are managed correctly
+during error recovery.
+
+Signed-off-by: Brian Kao <powenkao@google.com>
+Tested-by: Brian Kao <powenkao@google.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://patch.msgid.link/20251112063214.1195761-1-powenkao@google.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufshcd.c | 36 ++++++++++++++++++++++++++++--------
+ 1 file changed, 28 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index ba1bb3953cf69..022810b524e96 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -6498,6 +6498,11 @@ static void ufshcd_clk_scaling_suspend(struct ufs_hba *hba, bool suspend)
+
+ static void ufshcd_err_handling_prepare(struct ufs_hba *hba)
+ {
++ /*
++ * A WLUN resume failure could potentially lead to the HBA being
++ * runtime suspended, so take an extra reference on hba->dev.
++ */
++ pm_runtime_get_sync(hba->dev);
+ ufshcd_rpm_get_sync(hba);
+ if (pm_runtime_status_suspended(&hba->ufs_device_wlun->sdev_gendev) ||
+ hba->is_sys_suspended) {
+@@ -6537,6 +6542,7 @@ static void ufshcd_err_handling_unprepare(struct ufs_hba *hba)
+ if (ufshcd_is_clkscaling_supported(hba))
+ ufshcd_clk_scaling_suspend(hba, false);
+ ufshcd_rpm_put(hba);
++ pm_runtime_put(hba->dev);
+ }
+
+ static inline bool ufshcd_err_handling_should_stop(struct ufs_hba *hba)
+@@ -6551,28 +6557,42 @@ static inline bool ufshcd_err_handling_should_stop(struct ufs_hba *hba)
+ #ifdef CONFIG_PM
+ static void ufshcd_recover_pm_error(struct ufs_hba *hba)
+ {
++ struct scsi_target *starget = hba->ufs_device_wlun->sdev_target;
+ struct Scsi_Host *shost = hba->host;
+ struct scsi_device *sdev;
+ struct request_queue *q;
+- int ret;
++ bool resume_sdev_queues = false;
+
+ hba->is_sys_suspended = false;
++
+ /*
+- * Set RPM status of wlun device to RPM_ACTIVE,
+- * this also clears its runtime error.
++ * Ensure the parent's error status is cleared before proceeding
++ * to the child, as the parent must be active to activate the child.
+ */
+- ret = pm_runtime_set_active(&hba->ufs_device_wlun->sdev_gendev);
++ if (hba->dev->power.runtime_error) {
++ /* hba->dev has no functional parent thus simplily set RPM_ACTIVE */
++ pm_runtime_set_active(hba->dev);
++ resume_sdev_queues = true;
++ }
++
++ if (hba->ufs_device_wlun->sdev_gendev.power.runtime_error) {
++ /*
++ * starget, parent of wlun, might be suspended if wlun resume failed.
++ * Make sure parent is resumed before set child (wlun) active.
++ */
++ pm_runtime_get_sync(&starget->dev);
++ pm_runtime_set_active(&hba->ufs_device_wlun->sdev_gendev);
++ pm_runtime_put_sync(&starget->dev);
++ resume_sdev_queues = true;
++ }
+
+- /* hba device might have a runtime error otherwise */
+- if (ret)
+- ret = pm_runtime_set_active(hba->dev);
+ /*
+ * If wlun device had runtime error, we also need to resume those
+ * consumer scsi devices in case any of them has failed to be
+ * resumed due to supplier runtime resume failure. This is to unblock
+ * blk_queue_enter in case there are bios waiting inside it.
+ */
+- if (!ret) {
++ if (resume_sdev_queues) {
+ shost_for_each_device(sdev, shost) {
+ q = sdev->request_queue;
+ if (q->dev && (q->rpm_status == RPM_SUSPENDED ||
+--
+2.51.0
+
libceph-make-calc_target-set-t-paused-not-just-clear-it.patch
ublk-reorder-tag_set-initialization-before-queue-allocation.patch
alsa-hda-intel-dsp-config-prefer-legacy-driver-as-fallback.patch
+csky-fix-csky_cmpxchg_fixup-not-working.patch
+arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch
+alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch
+dm-verity-disable-recursive-forward-error-correction.patch
+dm-snapshot-fix-scheduling-while-atomic-on-real-time.patch
+nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch
+asoc-rockchip-fix-wvoid-pointer-to-enum-cast-warning.patch
+nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch
+alsa-hda-realtek-add-support-for-asus-um3406ga.patch
+drm-amd-display-shrink-struct-members.patch
+bcache-fix-improper-use-of-bi_end_io.patch
+smb-client-fix-nt_status_unable_to_free_vm-value.patch
+smb-client-fix-nt_status_device_door_open-value.patch
+smb-client-fix-nt_status_no_data_detected-value.patch
+scsi-mpi3mr-prevent-duplicate-sas-sata-device-entrie.patch
+scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch
+scsi-ufs-core-fix-eh-failure-after-w-lun-resume-erro.patch
+scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch
+btrfs-fix-qgroup_snapshot_quick_inherit-squota-bug.patch
+btrfs-qgroup-update-all-parent-qgroups-when-doing-qu.patch
+btrfs-fix-null-dereference-on-root-when-tracing-inod.patch
+btrfs-fix-use-after-free-warning-in-btrfs_get_or_cre.patch
+of-unittest-fix-memory-leak-in-unittest_data_add.patch
--- /dev/null
+From 3730060c69a225196e8f11cfbf1bbf5199995f56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Dec 2025 09:17:57 +0800
+Subject: smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value
+
+From: ChenXiaoSong <chenxiaosong@kylinos.cn>
+
+[ Upstream commit b2b50fca34da5ec231008edba798ddf92986bd7f ]
+
+This was reported by the KUnit tests in the later patches.
+
+See MS-ERREF 2.3.1 STATUS_DEVICE_DOOR_OPEN. Keep it consistent with the
+value in the documentation.
+
+Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/nterr.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/nterr.h b/fs/smb/client/nterr.h
+index e3a607b45e719..b3516c71cff77 100644
+--- a/fs/smb/client/nterr.h
++++ b/fs/smb/client/nterr.h
+@@ -44,7 +44,7 @@ extern const struct nt_err_code_struct nt_errs[];
+ #define NT_STATUS_NO_DATA_DETECTED 0x8000001c
+ #define NT_STATUS_STOPPED_ON_SYMLINK 0x8000002d
+ #define NT_STATUS_DEVICE_REQUIRES_CLEANING 0x80000288
+-#define NT_STATUS_DEVICE_DOOR_OPEN 0x80000288
++#define NT_STATUS_DEVICE_DOOR_OPEN 0x80000289
+ #define NT_STATUS_UNSUCCESSFUL 0xC0000000 | 0x0001
+ #define NT_STATUS_NOT_IMPLEMENTED 0xC0000000 | 0x0002
+ #define NT_STATUS_INVALID_INFO_CLASS 0xC0000000 | 0x0003
+--
+2.51.0
+
--- /dev/null
+From 4a0b834e85042be254020d41164e55f0a091326a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Dec 2025 09:13:06 +0800
+Subject: smb/client: fix NT_STATUS_NO_DATA_DETECTED value
+
+From: ChenXiaoSong <chenxiaosong@kylinos.cn>
+
+[ Upstream commit a1237c203f1757480dc2f3b930608ee00072d3cc ]
+
+This was reported by the KUnit tests in the later patches.
+
+See MS-ERREF 2.3.1 STATUS_NO_DATA_DETECTED. Keep it consistent with the
+value in the documentation.
+
+Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/nterr.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/nterr.h b/fs/smb/client/nterr.h
+index b3516c71cff77..09263c91d07a4 100644
+--- a/fs/smb/client/nterr.h
++++ b/fs/smb/client/nterr.h
+@@ -41,7 +41,7 @@ extern const struct nt_err_code_struct nt_errs[];
+ #define NT_STATUS_MEDIA_CHANGED 0x8000001c
+ #define NT_STATUS_END_OF_MEDIA 0x8000001e
+ #define NT_STATUS_MEDIA_CHECK 0x80000020
+-#define NT_STATUS_NO_DATA_DETECTED 0x8000001c
++#define NT_STATUS_NO_DATA_DETECTED 0x80000022
+ #define NT_STATUS_STOPPED_ON_SYMLINK 0x8000002d
+ #define NT_STATUS_DEVICE_REQUIRES_CLEANING 0x80000288
+ #define NT_STATUS_DEVICE_DOOR_OPEN 0x80000289
+--
+2.51.0
+
--- /dev/null
+From 0903818e37affc577d88348ef68d063353660b3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Dec 2025 09:22:53 +0800
+Subject: smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value
+
+From: ChenXiaoSong <chenxiaosong@kylinos.cn>
+
+[ Upstream commit 9f99caa8950a76f560a90074e3a4b93cfa8b3d84 ]
+
+This was reported by the KUnit tests in the later patches.
+
+See MS-ERREF 2.3.1 STATUS_UNABLE_TO_FREE_VM. Keep it consistent with the
+value in the documentation.
+
+Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/nterr.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/nterr.h b/fs/smb/client/nterr.h
+index 180602c22355e..e3a607b45e719 100644
+--- a/fs/smb/client/nterr.h
++++ b/fs/smb/client/nterr.h
+@@ -70,7 +70,7 @@ extern const struct nt_err_code_struct nt_errs[];
+ #define NT_STATUS_NO_MEMORY 0xC0000000 | 0x0017
+ #define NT_STATUS_CONFLICTING_ADDRESSES 0xC0000000 | 0x0018
+ #define NT_STATUS_NOT_MAPPED_VIEW 0xC0000000 | 0x0019
+-#define NT_STATUS_UNABLE_TO_FREE_VM 0x80000000 | 0x001a
++#define NT_STATUS_UNABLE_TO_FREE_VM 0xC0000000 | 0x001a
+ #define NT_STATUS_UNABLE_TO_DELETE_SECTION 0xC0000000 | 0x001b
+ #define NT_STATUS_INVALID_SYSTEM_SERVICE 0xC0000000 | 0x001c
+ #define NT_STATUS_ILLEGAL_INSTRUCTION 0xC0000000 | 0x001d
+--
+2.51.0
+
--- /dev/null
+From 2b262c8389f9aed247e66bfb99046b20aa12c9aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Dec 2025 08:14:57 +0000
+Subject: alpha: don't reference obsolete termio struct for TC* constants
+
+From: Sam James <sam@gentoo.org>
+
+[ Upstream commit 9aeed9041929812a10a6d693af050846942a1d16 ]
+
+Similar in nature to ab107276607af90b13a5994997e19b7b9731e251. glibc-2.42
+drops the legacy termio struct, but the ioctls.h header still defines some
+TC* constants in terms of termio (via sizeof). Hardcode the values instead.
+
+This fixes building Python for example, which falls over like:
+ ./Modules/termios.c:1119:16: error: invalid application of 'sizeof' to incomplete type 'struct termio'
+
+Link: https://bugs.gentoo.org/961769
+Link: https://bugs.gentoo.org/962600
+Signed-off-by: Sam James <sam@gentoo.org>
+Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
+Link: https://lore.kernel.org/r/6ebd3451908785cad53b50ca6bc46cfe9d6bc03c.1764922497.git.sam@gentoo.org
+Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/alpha/include/uapi/asm/ioctls.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/alpha/include/uapi/asm/ioctls.h b/arch/alpha/include/uapi/asm/ioctls.h
+index 971311605288f..a09d04b49cc65 100644
+--- a/arch/alpha/include/uapi/asm/ioctls.h
++++ b/arch/alpha/include/uapi/asm/ioctls.h
+@@ -23,10 +23,10 @@
+ #define TCSETSW _IOW('t', 21, struct termios)
+ #define TCSETSF _IOW('t', 22, struct termios)
+
+-#define TCGETA _IOR('t', 23, struct termio)
+-#define TCSETA _IOW('t', 24, struct termio)
+-#define TCSETAW _IOW('t', 25, struct termio)
+-#define TCSETAF _IOW('t', 28, struct termio)
++#define TCGETA 0x40127417
++#define TCSETA 0x80127418
++#define TCSETAW 0x80127419
++#define TCSETAF 0x8012741c
+
+ #define TCSBRK _IO('t', 29)
+ #define TCXONC _IO('t', 30)
+--
+2.51.0
+
--- /dev/null
+From 49ff4c6fea8cedb53237d128ea385b0bba7f5f29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Nov 2025 16:54:37 +0100
+Subject: ARM: 9461/1: Disable HIGHPTE on PREEMPT_RT kernels
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit fedadc4137234c3d00c4785eeed3e747fe9036ae ]
+
+gup_pgd_range() is invoked with disabled interrupts and invokes
+__kmap_local_page_prot() via pte_offset_map(), gup_p4d_range().
+With HIGHPTE enabled, __kmap_local_page_prot() invokes kmap_high_get()
+which uses a spinlock_t via lock_kmap_any(). This leads to an
+sleeping-while-atomic error on PREEMPT_RT because spinlock_t becomes a
+sleeping lock and must not be acquired in atomic context.
+
+The loop in map_new_virtual() uses wait_queue_head_t for wake up which
+also is using a spinlock_t.
+
+Since HIGHPTE is rarely needed at all, turn it off for PREEMPT_RT
+to allow the use of get_user_pages_fast().
+
+[arnd: rework patch to turn off HIGHPTE instead of HAVE_PAST_GUP]
+
+Co-developed-by: Arnd Bergmann <arnd@arndb.de>
+
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 57c0448d017a1..be3b0f83eee57 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -1308,7 +1308,7 @@ config HIGHMEM
+
+ config HIGHPTE
+ bool "Allocate 2nd-level pagetables from highmem" if EXPERT
+- depends on HIGHMEM
++ depends on HIGHMEM && !PREEMPT_RT
+ default y
+ help
+ The VM uses one page of physical memory for each page table.
+--
+2.51.0
+
--- /dev/null
+From 81e7e43a810e8f40e163928d441de02d2816b073 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Dec 2025 17:01:56 +0800
+Subject: bcache: fix improper use of bi_end_io
+
+From: Shida Zhang <zhangshida@kylinos.cn>
+
+[ Upstream commit 53280e398471f0bddbb17b798a63d41264651325 ]
+
+Don't call bio->bi_end_io() directly. Use the bio_endio() helper
+function instead, which handles completion more safely and uniformly.
+
+Suggested-by: Christoph Hellwig <hch@infradead.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Shida Zhang <zhangshida@kylinos.cn>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/request.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
+index a9b1f3896249b..b4059d2daa326 100644
+--- a/drivers/md/bcache/request.c
++++ b/drivers/md/bcache/request.c
+@@ -1090,7 +1090,7 @@ static void detached_dev_end_io(struct bio *bio)
+ }
+
+ kfree(ddip);
+- bio->bi_end_io(bio);
++ bio_endio(bio);
+ }
+
+ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio,
+@@ -1107,7 +1107,7 @@ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio,
+ ddip = kzalloc(sizeof(struct detached_dev_io_private), GFP_NOIO);
+ if (!ddip) {
+ bio->bi_status = BLK_STS_RESOURCE;
+- bio->bi_end_io(bio);
++ bio_endio(bio);
+ return;
+ }
+
+@@ -1122,7 +1122,7 @@ static void detached_dev_do_request(struct bcache_device *d, struct bio *bio,
+
+ if ((bio_op(bio) == REQ_OP_DISCARD) &&
+ !bdev_max_discard_sectors(dc->bdev))
+- bio->bi_end_io(bio);
++ detached_dev_end_io(bio);
+ else
+ submit_bio_noacct(bio);
+ }
+--
+2.51.0
+
--- /dev/null
+From a5f3e0431d1ca633e25034454d314150f238c83c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2024 17:56:26 +0800
+Subject: csky: fix csky_cmpxchg_fixup not working
+
+From: Yang Li <yang.li85200@gmail.com>
+
+[ Upstream commit 809ef03d6d21d5fea016bbf6babeec462e37e68c ]
+
+In the csky_cmpxchg_fixup function, it is incorrect to use the global
+variable csky_cmpxchg_stw to determine the address where the exception
+occurred.The global variable csky_cmpxchg_stw stores the opcode at the
+time of the exception, while &csky_cmpxchg_stw shows the address where
+the exception occurred.
+
+Signed-off-by: Yang Li <yang.li85200@gmail.com>
+Signed-off-by: Guo Ren <guoren@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/csky/mm/fault.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/csky/mm/fault.c b/arch/csky/mm/fault.c
+index a885518ce1dd2..5226bc08c3360 100644
+--- a/arch/csky/mm/fault.c
++++ b/arch/csky/mm/fault.c
+@@ -45,8 +45,8 @@ static inline void csky_cmpxchg_fixup(struct pt_regs *regs)
+ if (trap_no(regs) != VEC_TLBMODIFIED)
+ return;
+
+- if (instruction_pointer(regs) == csky_cmpxchg_stw)
+- instruction_pointer_set(regs, csky_cmpxchg_ldw);
++ if (instruction_pointer(regs) == (unsigned long)&csky_cmpxchg_stw)
++ instruction_pointer_set(regs, (unsigned long)&csky_cmpxchg_ldw);
+ return;
+ }
+ #endif
+--
+2.51.0
+
--- /dev/null
+From 87e45f417bee62bfcad64e4b7cba8b0b7361762d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Dec 2025 22:13:10 +0100
+Subject: dm-snapshot: fix 'scheduling while atomic' on real-time kernels
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+[ Upstream commit 8581b19eb2c5ccf06c195d3b5468c3c9d17a5020 ]
+
+There is reported 'scheduling while atomic' bug when using dm-snapshot on
+real-time kernels. The reason for the bug is that the hlist_bl code does
+preempt_disable() when taking the lock and the kernel attempts to take
+other spinlocks while holding the hlist_bl lock.
+
+Fix this by converting a hlist_bl spinlock into a regular spinlock.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Reported-by: Jiping Ma <jiping.ma2@windriver.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-exception-store.h | 2 +-
+ drivers/md/dm-snap.c | 73 +++++++++++++++------------------
+ 2 files changed, 35 insertions(+), 40 deletions(-)
+
+diff --git a/drivers/md/dm-exception-store.h b/drivers/md/dm-exception-store.h
+index b679766375381..061b4d3108132 100644
+--- a/drivers/md/dm-exception-store.h
++++ b/drivers/md/dm-exception-store.h
+@@ -29,7 +29,7 @@ typedef sector_t chunk_t;
+ * chunk within the device.
+ */
+ struct dm_exception {
+- struct hlist_bl_node hash_list;
++ struct hlist_node hash_list;
+
+ chunk_t old_chunk;
+ chunk_t new_chunk;
+diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
+index 0ace06d1bee38..dcffa3441a662 100644
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -40,10 +40,15 @@ static const char dm_snapshot_merge_target_name[] = "snapshot-merge";
+ #define DM_TRACKED_CHUNK_HASH(x) ((unsigned long)(x) & \
+ (DM_TRACKED_CHUNK_HASH_SIZE - 1))
+
++struct dm_hlist_head {
++ struct hlist_head head;
++ spinlock_t lock;
++};
++
+ struct dm_exception_table {
+ uint32_t hash_mask;
+ unsigned int hash_shift;
+- struct hlist_bl_head *table;
++ struct dm_hlist_head *table;
+ };
+
+ struct dm_snapshot {
+@@ -628,8 +633,8 @@ static uint32_t exception_hash(struct dm_exception_table *et, chunk_t chunk);
+
+ /* Lock to protect access to the completed and pending exception hash tables. */
+ struct dm_exception_table_lock {
+- struct hlist_bl_head *complete_slot;
+- struct hlist_bl_head *pending_slot;
++ spinlock_t *complete_slot;
++ spinlock_t *pending_slot;
+ };
+
+ static void dm_exception_table_lock_init(struct dm_snapshot *s, chunk_t chunk,
+@@ -638,20 +643,20 @@ static void dm_exception_table_lock_init(struct dm_snapshot *s, chunk_t chunk,
+ struct dm_exception_table *complete = &s->complete;
+ struct dm_exception_table *pending = &s->pending;
+
+- lock->complete_slot = &complete->table[exception_hash(complete, chunk)];
+- lock->pending_slot = &pending->table[exception_hash(pending, chunk)];
++ lock->complete_slot = &complete->table[exception_hash(complete, chunk)].lock;
++ lock->pending_slot = &pending->table[exception_hash(pending, chunk)].lock;
+ }
+
+ static void dm_exception_table_lock(struct dm_exception_table_lock *lock)
+ {
+- hlist_bl_lock(lock->complete_slot);
+- hlist_bl_lock(lock->pending_slot);
++ spin_lock_nested(lock->complete_slot, 1);
++ spin_lock_nested(lock->pending_slot, 2);
+ }
+
+ static void dm_exception_table_unlock(struct dm_exception_table_lock *lock)
+ {
+- hlist_bl_unlock(lock->pending_slot);
+- hlist_bl_unlock(lock->complete_slot);
++ spin_unlock(lock->pending_slot);
++ spin_unlock(lock->complete_slot);
+ }
+
+ static int dm_exception_table_init(struct dm_exception_table *et,
+@@ -661,13 +666,15 @@ static int dm_exception_table_init(struct dm_exception_table *et,
+
+ et->hash_shift = hash_shift;
+ et->hash_mask = size - 1;
+- et->table = kvmalloc_array(size, sizeof(struct hlist_bl_head),
++ et->table = kvmalloc_array(size, sizeof(struct dm_hlist_head),
+ GFP_KERNEL);
+ if (!et->table)
+ return -ENOMEM;
+
+- for (i = 0; i < size; i++)
+- INIT_HLIST_BL_HEAD(et->table + i);
++ for (i = 0; i < size; i++) {
++ INIT_HLIST_HEAD(&et->table[i].head);
++ spin_lock_init(&et->table[i].lock);
++ }
+
+ return 0;
+ }
+@@ -675,16 +682,17 @@ static int dm_exception_table_init(struct dm_exception_table *et,
+ static void dm_exception_table_exit(struct dm_exception_table *et,
+ struct kmem_cache *mem)
+ {
+- struct hlist_bl_head *slot;
++ struct dm_hlist_head *slot;
+ struct dm_exception *ex;
+- struct hlist_bl_node *pos, *n;
++ struct hlist_node *pos;
+ int i, size;
+
+ size = et->hash_mask + 1;
+ for (i = 0; i < size; i++) {
+ slot = et->table + i;
+
+- hlist_bl_for_each_entry_safe(ex, pos, n, slot, hash_list) {
++ hlist_for_each_entry_safe(ex, pos, &slot->head, hash_list) {
++ hlist_del(&ex->hash_list);
+ kmem_cache_free(mem, ex);
+ cond_resched();
+ }
+@@ -700,7 +708,7 @@ static uint32_t exception_hash(struct dm_exception_table *et, chunk_t chunk)
+
+ static void dm_remove_exception(struct dm_exception *e)
+ {
+- hlist_bl_del(&e->hash_list);
++ hlist_del(&e->hash_list);
+ }
+
+ /*
+@@ -710,12 +718,11 @@ static void dm_remove_exception(struct dm_exception *e)
+ static struct dm_exception *dm_lookup_exception(struct dm_exception_table *et,
+ chunk_t chunk)
+ {
+- struct hlist_bl_head *slot;
+- struct hlist_bl_node *pos;
++ struct hlist_head *slot;
+ struct dm_exception *e;
+
+- slot = &et->table[exception_hash(et, chunk)];
+- hlist_bl_for_each_entry(e, pos, slot, hash_list)
++ slot = &et->table[exception_hash(et, chunk)].head;
++ hlist_for_each_entry(e, slot, hash_list)
+ if (chunk >= e->old_chunk &&
+ chunk <= e->old_chunk + dm_consecutive_chunk_count(e))
+ return e;
+@@ -762,18 +769,17 @@ static void free_pending_exception(struct dm_snap_pending_exception *pe)
+ static void dm_insert_exception(struct dm_exception_table *eh,
+ struct dm_exception *new_e)
+ {
+- struct hlist_bl_head *l;
+- struct hlist_bl_node *pos;
++ struct hlist_head *l;
+ struct dm_exception *e = NULL;
+
+- l = &eh->table[exception_hash(eh, new_e->old_chunk)];
++ l = &eh->table[exception_hash(eh, new_e->old_chunk)].head;
+
+ /* Add immediately if this table doesn't support consecutive chunks */
+ if (!eh->hash_shift)
+ goto out;
+
+ /* List is ordered by old_chunk */
+- hlist_bl_for_each_entry(e, pos, l, hash_list) {
++ hlist_for_each_entry(e, l, hash_list) {
+ /* Insert after an existing chunk? */
+ if (new_e->old_chunk == (e->old_chunk +
+ dm_consecutive_chunk_count(e) + 1) &&
+@@ -804,13 +810,13 @@ static void dm_insert_exception(struct dm_exception_table *eh,
+ * Either the table doesn't support consecutive chunks or slot
+ * l is empty.
+ */
+- hlist_bl_add_head(&new_e->hash_list, l);
++ hlist_add_head(&new_e->hash_list, l);
+ } else if (new_e->old_chunk < e->old_chunk) {
+ /* Add before an existing exception */
+- hlist_bl_add_before(&new_e->hash_list, &e->hash_list);
++ hlist_add_before(&new_e->hash_list, &e->hash_list);
+ } else {
+ /* Add to l's tail: e is the last exception in this slot */
+- hlist_bl_add_behind(&new_e->hash_list, &e->hash_list);
++ hlist_add_behind(&new_e->hash_list, &e->hash_list);
+ }
+ }
+
+@@ -820,7 +826,6 @@ static void dm_insert_exception(struct dm_exception_table *eh,
+ */
+ static int dm_add_exception(void *context, chunk_t old, chunk_t new)
+ {
+- struct dm_exception_table_lock lock;
+ struct dm_snapshot *s = context;
+ struct dm_exception *e;
+
+@@ -833,17 +838,7 @@ static int dm_add_exception(void *context, chunk_t old, chunk_t new)
+ /* Consecutive_count is implicitly initialised to zero */
+ e->new_chunk = new;
+
+- /*
+- * Although there is no need to lock access to the exception tables
+- * here, if we don't then hlist_bl_add_head(), called by
+- * dm_insert_exception(), will complain about accessing the
+- * corresponding list without locking it first.
+- */
+- dm_exception_table_lock_init(s, old, &lock);
+-
+- dm_exception_table_lock(&lock);
+ dm_insert_exception(&s->complete, e);
+- dm_exception_table_unlock(&lock);
+
+ return 0;
+ }
+@@ -873,7 +868,7 @@ static int calc_max_buckets(void)
+ /* use a fixed size of 2MB */
+ unsigned long mem = 2 * 1024 * 1024;
+
+- mem /= sizeof(struct hlist_bl_head);
++ mem /= sizeof(struct dm_hlist_head);
+
+ return mem;
+ }
+--
+2.51.0
+
--- /dev/null
+From 2dee4178d9a0743458f5a69aae661cdb1ae4c6be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Nov 2025 18:56:46 -0500
+Subject: NFS: Fix up the automount fs_context to use the correct cred
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit a2a8fc27dd668e7562b5326b5ed2f1604cb1e2e9 ]
+
+When automounting, the fs_context should be fixed up to use the cred
+from the parent filesystem, since the operation is just extending the
+namespace. Authorisation to enter that namespace will already have been
+provided by the preceding lookup.
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/namespace.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
+index 923b5c1eb47e9..99ef1146096fe 100644
+--- a/fs/nfs/namespace.c
++++ b/fs/nfs/namespace.c
+@@ -170,6 +170,11 @@ struct vfsmount *nfs_d_automount(struct path *path)
+ if (!ctx->clone_data.fattr)
+ goto out_fc;
+
++ if (fc->cred != server->cred) {
++ put_cred(fc->cred);
++ fc->cred = get_cred(server->cred);
++ }
++
+ if (fc->net_ns != client->cl_net) {
+ put_net(fc->net_ns);
+ fc->net_ns = get_net(client->cl_net);
+--
+2.51.0
+
--- /dev/null
+From 14c9e290a1d92f00c6018327229fbfb3eb448b00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Nov 2025 10:44:15 -0500
+Subject: NFSv4: ensure the open stateid seqid doesn't go backwards
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+[ Upstream commit 2e47c3cc64b44b0b06cd68c2801db92ff143f2b2 ]
+
+We have observed an NFSv4 client receiving a LOCK reply with a status of
+NFS4ERR_OLD_STATEID and subsequently retrying the LOCK request with an
+earlier seqid value in the stateid. As this was for a new lockowner,
+that would imply that nfs_set_open_stateid_locked() had updated the open
+stateid seqid with an earlier value.
+
+Looking at nfs_set_open_stateid_locked(), if the incoming seqid is out
+of sequence, the task will sleep on the state->waitq for up to 5
+seconds. If the task waits for the full 5 seconds, then after finishing
+the wait it'll update the open stateid seqid with whatever value the
+incoming seqid has. If there are multiple waiters in this scenario,
+then the last one to perform said update may not be the one with the
+highest seqid.
+
+Add a check to ensure that the seqid can only be incremented, and add a
+tracepoint to indicate when old seqids are skipped.
+
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Reviewed-by: Benjamin Coddington <bcodding@hammerspace.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 13 +++++++++++--
+ fs/nfs/nfs4trace.h | 1 +
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index a0a71a163ffed..fe6986939bc90 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1700,8 +1700,17 @@ static void nfs_set_open_stateid_locked(struct nfs4_state *state,
+ if (nfs_stateid_is_sequential(state, stateid))
+ break;
+
+- if (status)
+- break;
++ if (status) {
++ if (nfs4_stateid_match_other(stateid, &state->open_stateid) &&
++ !nfs4_stateid_is_newer(stateid, &state->open_stateid)) {
++ trace_nfs4_open_stateid_update_skip(state->inode,
++ stateid, status);
++ return;
++ } else {
++ break;
++ }
++ }
++
+ /* Rely on seqids for serialisation with NFSv4.0 */
+ if (!nfs4_has_session(NFS_SERVER(state->inode)->nfs_client))
+ break;
+diff --git a/fs/nfs/nfs4trace.h b/fs/nfs/nfs4trace.h
+index d27919d7241d3..52a985ebe2b1d 100644
+--- a/fs/nfs/nfs4trace.h
++++ b/fs/nfs/nfs4trace.h
+@@ -1248,6 +1248,7 @@ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_setattr);
+ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_delegreturn);
+ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update);
+ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update_wait);
++DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_open_stateid_update_skip);
+ DEFINE_NFS4_INODE_STATEID_EVENT(nfs4_close_stateid_update_wait);
+
+ DECLARE_EVENT_CLASS(nfs4_getattr_event,
+--
+2.51.0
+
--- /dev/null
+From 2fafe849fdd308f8c60e1a447b3be380b799b6d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Oct 2025 09:24:26 -0500
+Subject: scsi: ipr: Enable/disable IRQD_NO_BALANCING during reset
+
+From: Wen Xiong <wenxiong@linux.ibm.com>
+
+[ Upstream commit 6ac3484fb13b2fc7f31cfc7f56093e7d0ce646a5 ]
+
+A dynamic remove/add storage adapter test hits EEH on PowerPC:
+
+ EEH: [c00000000004f75c] __eeh_send_failure_event+0x7c/0x160
+ EEH: [c000000000048444] eeh_dev_check_failure.part.0+0x254/0x650
+ EEH: [c008000001650678] eeh_readl+0x60/0x90 [ipr]
+ EEH: [c00800000166746c] ipr_cancel_op+0x2b8/0x524 [ipr]
+ EEH: [c008000001656524] ipr_eh_abort+0x6c/0x130 [ipr]
+ EEH: [c000000000ab0d20] scmd_eh_abort_handler+0x140/0x440
+ EEH: [c00000000017e558] process_one_work+0x298/0x590
+ EEH: [c00000000017eef8] worker_thread+0xa8/0x620
+ EEH: [c00000000018be34] kthread+0x124/0x130
+ EEH: [c00000000000cd64] ret_from_kernel_thread+0x5c/0x64
+
+A PCIe bus trace reveals that a vector of MSI-X is cleared to 0 by
+irqbalance daemon. If we disable irqbalance daemon, we won't see the
+issue.
+
+With debug enabled in ipr driver:
+
+ [ 44.103071] ipr: Entering __ipr_remove
+ [ 44.103083] ipr: Entering ipr_initiate_ioa_bringdown
+ [ 44.103091] ipr: Entering ipr_reset_shutdown_ioa
+ [ 44.103099] ipr: Leaving ipr_reset_shutdown_ioa
+ [ 44.103105] ipr: Leaving ipr_initiate_ioa_bringdown
+ [ 44.149918] ipr: Entering ipr_reset_ucode_download
+ [ 44.149935] ipr: Entering ipr_reset_alert
+ [ 44.150032] ipr: Entering ipr_reset_start_timer
+ [ 44.150038] ipr: Leaving ipr_reset_alert
+ [ 44.244343] scsi 1:2:3:0: alua: Detached
+ [ 44.254300] ipr: Entering ipr_reset_start_bist
+ [ 44.254320] ipr: Entering ipr_reset_start_timer
+ [ 44.254325] ipr: Leaving ipr_reset_start_bist
+ [ 44.364329] scsi 1:2:4:0: alua: Detached
+ [ 45.134341] scsi 1:2:5:0: alua: Detached
+ [ 45.860949] ipr: Entering ipr_reset_shutdown_ioa
+ [ 45.860962] ipr: Leaving ipr_reset_shutdown_ioa
+ [ 45.860966] ipr: Entering ipr_reset_alert
+ [ 45.861028] ipr: Entering ipr_reset_start_timer
+ [ 45.861035] ipr: Leaving ipr_reset_alert
+ [ 45.964302] ipr: Entering ipr_reset_start_bist
+ [ 45.964309] ipr: Entering ipr_reset_start_timer
+ [ 45.964313] ipr: Leaving ipr_reset_start_bist
+ [ 46.264301] ipr: Entering ipr_reset_bist_done
+ [ 46.264309] ipr: Leaving ipr_reset_bist_done
+
+During adapter reset, ipr device driver blocks config space access but
+can't block MMIO access for MSI-X entries. There is very small window:
+irqbalance daemon kicks in during adapter reset before ipr driver calls
+pci_restore_state(pdev) to restore MSI-X table.
+
+irqbalance daemon reads back all 0 for that MSI-X vector in
+__pci_read_msi_msg().
+
+irqbalance daemon:
+
+ msi_domain_set_affinity()
+ ->irq_chip_set_affinity_patent()
+ ->xive_irq_set_affinity()
+ ->irq_chip_compose_msi_msg()
+ ->pseries_msi_compose_msg()
+ ->__pci_read_msi_msg(): read all 0 since didn't call pci_restore_state
+ ->irq_chip_write_msi_msg()
+ -> pci_write_msg_msi(): write 0 to the msix vector entry
+
+When ipr driver calls pci_restore_state(pdev) in
+ipr_reset_restore_cfg_space(), the MSI-X vector entry has been cleared
+by irqbalance daemon in pci_write_msg_msix().
+
+ pci_restore_state()
+ ->__pci_restore_msix_state()
+
+Below is the MSI-X table for ipr adapter after irqbalance daemon kicked
+in during adapter reset:
+
+ Dump MSIx table: index=0 address_lo=c800 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=1 address_lo=c810 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=2 address_lo=c820 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=3 address_lo=c830 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=4 address_lo=c840 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=5 address_lo=c850 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=6 address_lo=c860 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=7 address_lo=c870 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=8 address_lo=0 address_hi=0 msg_data=0
+ ---------> Hit EEH since msix vector of index=8 are 0
+ Dump MSIx table: index=9 address_lo=c890 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=10 address_lo=c8a0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=11 address_lo=c8b0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=12 address_lo=c8c0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=13 address_lo=c8d0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=14 address_lo=c8e0 address_hi=10000000 msg_data=0
+ Dump MSIx table: index=15 address_lo=c8f0 address_hi=10000000 msg_data=0
+
+ [ 46.264312] ipr: Entering ipr_reset_restore_cfg_space
+ [ 46.267439] ipr: Entering ipr_fail_all_ops
+ [ 46.267447] ipr: Leaving ipr_fail_all_ops
+ [ 46.267451] ipr: Leaving ipr_reset_restore_cfg_space
+ [ 46.267454] ipr: Entering ipr_ioa_bringdown_done
+ [ 46.267458] ipr: Leaving ipr_ioa_bringdown_done
+ [ 46.267467] ipr: Entering ipr_worker_thread
+ [ 46.267470] ipr: Leaving ipr_worker_thread
+
+IRQ balancing is not required during adapter reset.
+
+Enable "IRQ_NO_BALANCING" flag before starting adapter reset and disable
+it after calling pci_restore_state(). The irqbalance daemon is disabled
+for this short period of time (~2s).
+
+Co-developed-by: Kyle Mahlkuch <Kyle.Mahlkuch@ibm.com>
+Signed-off-by: Kyle Mahlkuch <Kyle.Mahlkuch@ibm.com>
+Signed-off-by: Wen Xiong <wenxiong@linux.ibm.com>
+Link: https://patch.msgid.link/20251028142427.3969819-2-wenxiong@linux.ibm.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ipr.c | 28 +++++++++++++++++++++++++++-
+ 1 file changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
+index 4e13797b2a4ab..5cda5b3f0020c 100644
+--- a/drivers/scsi/ipr.c
++++ b/drivers/scsi/ipr.c
+@@ -61,8 +61,8 @@
+ #include <linux/hdreg.h>
+ #include <linux/reboot.h>
+ #include <linux/stringify.h>
++#include <linux/irq.h>
+ #include <asm/io.h>
+-#include <asm/irq.h>
+ #include <asm/processor.h>
+ #include <scsi/scsi.h>
+ #include <scsi/scsi_host.h>
+@@ -7892,6 +7892,30 @@ static int ipr_dump_mailbox_wait(struct ipr_cmnd *ipr_cmd)
+ return IPR_RC_JOB_RETURN;
+ }
+
++/**
++ * ipr_set_affinity_nobalance
++ * @ioa_cfg: ipr_ioa_cfg struct for an ipr device
++ * @flag: bool
++ * true: ensable "IRQ_NO_BALANCING" bit for msix interrupt
++ * false: disable "IRQ_NO_BALANCING" bit for msix interrupt
++ * Description: This function will be called to disable/enable
++ * "IRQ_NO_BALANCING" to avoid irqbalance daemon
++ * kicking in during adapter reset.
++ **/
++static void ipr_set_affinity_nobalance(struct ipr_ioa_cfg *ioa_cfg, bool flag)
++{
++ int irq, i;
++
++ for (i = 0; i < ioa_cfg->nvectors; i++) {
++ irq = pci_irq_vector(ioa_cfg->pdev, i);
++
++ if (flag)
++ irq_set_status_flags(irq, IRQ_NO_BALANCING);
++ else
++ irq_clear_status_flags(irq, IRQ_NO_BALANCING);
++ }
++}
++
+ /**
+ * ipr_reset_restore_cfg_space - Restore PCI config space.
+ * @ipr_cmd: ipr command struct
+@@ -7916,6 +7940,7 @@ static int ipr_reset_restore_cfg_space(struct ipr_cmnd *ipr_cmd)
+ return IPR_RC_JOB_CONTINUE;
+ }
+
++ ipr_set_affinity_nobalance(ioa_cfg, false);
+ ipr_fail_all_ops(ioa_cfg);
+
+ if (ioa_cfg->sis64) {
+@@ -7995,6 +8020,7 @@ static int ipr_reset_start_bist(struct ipr_cmnd *ipr_cmd)
+ rc = pci_write_config_byte(ioa_cfg->pdev, PCI_BIST, PCI_BIST_START);
+
+ if (rc == PCIBIOS_SUCCESSFUL) {
++ ipr_set_affinity_nobalance(ioa_cfg, true);
+ ipr_cmd->job_step = ipr_reset_bist_done;
+ ipr_reset_start_timer(ipr_cmd, IPR_WAIT_FOR_BIST_TIMEOUT);
+ rc = IPR_RC_JOB_RETURN;
+--
+2.51.0
+
--- /dev/null
+From 0515dc7d00d23db6b0a02677456272225b8f2e72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Dec 2025 14:56:27 +0800
+Subject: scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe
+ failure scanned in again after probe failed"
+
+From: Xingui Yang <yangxingui@huawei.com>
+
+[ Upstream commit 278712d20bc8ec29d1ad6ef9bdae9000ef2c220c ]
+
+This reverts commit ab2068a6fb84751836a84c26ca72b3beb349619d.
+
+When probing the exp-attached sata device, libsas/libata will issue a
+hard reset in sas_probe_sata() -> ata_sas_async_probe(), then a
+broadcast event will be received after the disk probe fails, and this
+commit causes the probe will be re-executed on the disk, and a faulty
+disk may get into an indefinite loop of probe.
+
+Therefore, revert this commit, although it can fix some temporary issues
+with disk probe failure.
+
+Signed-off-by: Xingui Yang <yangxingui@huawei.com>
+Reviewed-by: Jason Yan <yanaijie@huawei.com>
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Link: https://patch.msgid.link/20251202065627.140361-1-yangxingui@huawei.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_internal.h | 14 --------------
+ 1 file changed, 14 deletions(-)
+
+diff --git a/drivers/scsi/libsas/sas_internal.h b/drivers/scsi/libsas/sas_internal.h
+index 277e45fed85d6..a6dc7dc07fce3 100644
+--- a/drivers/scsi/libsas/sas_internal.h
++++ b/drivers/scsi/libsas/sas_internal.h
+@@ -133,20 +133,6 @@ static inline void sas_fail_probe(struct domain_device *dev, const char *func, i
+ func, dev->parent ? "exp-attached" :
+ "direct-attached",
+ SAS_ADDR(dev->sas_addr), err);
+-
+- /*
+- * If the device probe failed, the expander phy attached address
+- * needs to be reset so that the phy will not be treated as flutter
+- * in the next revalidation
+- */
+- if (dev->parent && !dev_is_expander(dev->dev_type)) {
+- struct sas_phy *phy = dev->phy;
+- struct domain_device *parent = dev->parent;
+- struct ex_phy *ex_phy = &parent->ex_dev.ex_phy[phy->number];
+-
+- memset(ex_phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
+- }
+-
+ sas_unregister_dev(dev->port, dev);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 3efdc3147e63b5e655c3abab6b8da2b2a7a1adf1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Nov 2025 06:32:02 +0000
+Subject: scsi: ufs: core: Fix EH failure after W-LUN resume error
+
+From: Brian Kao <powenkao@google.com>
+
+[ Upstream commit b4bb6daf4ac4d4560044ecdd81e93aa2f6acbb06 ]
+
+When a W-LUN resume fails, its parent devices in the SCSI hierarchy,
+including the scsi_target, may be runtime suspended. Subsequently, the
+error handler in ufshcd_recover_pm_error() fails to set the W-LUN device
+back to active because the parent target is not active. This results in
+the following errors:
+
+ google-ufshcd 3c2d0000.ufs: ufshcd_err_handler started; HBA state eh_fatal; ...
+ ufs_device_wlun 0:0:0:49488: START_STOP failed for power mode: 1, result 40000
+ ufs_device_wlun 0:0:0:49488: ufshcd_wl_runtime_resume failed: -5
+ ...
+ ufs_device_wlun 0:0:0:49488: runtime PM trying to activate child device 0:0:0:49488 but parent (target0:0:0) is not active
+
+Address this by:
+
+ 1. Ensuring the W-LUN's parent scsi_target is runtime resumed before
+ attempting to set the W-LUN to active within
+ ufshcd_recover_pm_error().
+
+ 2. Explicitly checking for power.runtime_error on the HBA and W-LUN
+ devices before calling pm_runtime_set_active() to clear the error
+ state.
+
+ 3. Adding pm_runtime_get_sync(hba->dev) in
+ ufshcd_err_handling_prepare() to ensure the HBA itself is active
+ during error recovery, even if a child device resume failed.
+
+These changes ensure the device power states are managed correctly
+during error recovery.
+
+Signed-off-by: Brian Kao <powenkao@google.com>
+Tested-by: Brian Kao <powenkao@google.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://patch.msgid.link/20251112063214.1195761-1-powenkao@google.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufshcd.c | 36 ++++++++++++++++++++++++++++--------
+ 1 file changed, 28 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index 50d8a816d943a..9f53ee92486dc 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -6383,6 +6383,11 @@ static void ufshcd_clk_scaling_suspend(struct ufs_hba *hba, bool suspend)
+
+ static void ufshcd_err_handling_prepare(struct ufs_hba *hba)
+ {
++ /*
++ * A WLUN resume failure could potentially lead to the HBA being
++ * runtime suspended, so take an extra reference on hba->dev.
++ */
++ pm_runtime_get_sync(hba->dev);
+ ufshcd_rpm_get_sync(hba);
+ if (pm_runtime_status_suspended(&hba->ufs_device_wlun->sdev_gendev) ||
+ hba->is_sys_suspended) {
+@@ -6423,6 +6428,7 @@ static void ufshcd_err_handling_unprepare(struct ufs_hba *hba)
+ if (ufshcd_is_clkscaling_supported(hba))
+ ufshcd_clk_scaling_suspend(hba, false);
+ ufshcd_rpm_put(hba);
++ pm_runtime_put(hba->dev);
+ }
+
+ static inline bool ufshcd_err_handling_should_stop(struct ufs_hba *hba)
+@@ -6437,28 +6443,42 @@ static inline bool ufshcd_err_handling_should_stop(struct ufs_hba *hba)
+ #ifdef CONFIG_PM
+ static void ufshcd_recover_pm_error(struct ufs_hba *hba)
+ {
++ struct scsi_target *starget = hba->ufs_device_wlun->sdev_target;
+ struct Scsi_Host *shost = hba->host;
+ struct scsi_device *sdev;
+ struct request_queue *q;
+- int ret;
++ bool resume_sdev_queues = false;
+
+ hba->is_sys_suspended = false;
++
+ /*
+- * Set RPM status of wlun device to RPM_ACTIVE,
+- * this also clears its runtime error.
++ * Ensure the parent's error status is cleared before proceeding
++ * to the child, as the parent must be active to activate the child.
+ */
+- ret = pm_runtime_set_active(&hba->ufs_device_wlun->sdev_gendev);
++ if (hba->dev->power.runtime_error) {
++ /* hba->dev has no functional parent thus simplily set RPM_ACTIVE */
++ pm_runtime_set_active(hba->dev);
++ resume_sdev_queues = true;
++ }
++
++ if (hba->ufs_device_wlun->sdev_gendev.power.runtime_error) {
++ /*
++ * starget, parent of wlun, might be suspended if wlun resume failed.
++ * Make sure parent is resumed before set child (wlun) active.
++ */
++ pm_runtime_get_sync(&starget->dev);
++ pm_runtime_set_active(&hba->ufs_device_wlun->sdev_gendev);
++ pm_runtime_put_sync(&starget->dev);
++ resume_sdev_queues = true;
++ }
+
+- /* hba device might have a runtime error otherwise */
+- if (ret)
+- ret = pm_runtime_set_active(hba->dev);
+ /*
+ * If wlun device had runtime error, we also need to resume those
+ * consumer scsi devices in case any of them has failed to be
+ * resumed due to supplier runtime resume failure. This is to unblock
+ * blk_queue_enter in case there are bios waiting inside it.
+ */
+- if (!ret) {
++ if (resume_sdev_queues) {
+ shost_for_each_device(sdev, shost) {
+ q = sdev->request_queue;
+ if (q->dev && (q->rpm_status == RPM_SUSPENDED ||
+--
+2.51.0
+
nfsd-set-security-label-during-create-operations.patch
nfsd-nfsv4-file-creation-neglects-setting-acl.patch
tls-use-__sk_dst_get-and-dst_dev_rcu-in-get_netdev_for_sock.patch
+csky-fix-csky_cmpxchg_fixup-not-working.patch
+arm-9461-1-disable-highpte-on-preempt_rt-kernels.patch
+alpha-don-t-reference-obsolete-termio-struct-for-tc-.patch
+dm-snapshot-fix-scheduling-while-atomic-on-real-time.patch
+nfsv4-ensure-the-open-stateid-seqid-doesn-t-go-backw.patch
+nfs-fix-up-the-automount-fs_context-to-use-the-corre.patch
+bcache-fix-improper-use-of-bi_end_io.patch
+smb-client-fix-nt_status_unable_to_free_vm-value.patch
+smb-client-fix-nt_status_device_door_open-value.patch
+smb-client-fix-nt_status_no_data_detected-value.patch
+scsi-ipr-enable-disable-irqd_no_balancing-during-res.patch
+scsi-ufs-core-fix-eh-failure-after-w-lun-resume-erro.patch
+scsi-revert-scsi-libsas-fix-exp-attached-device-scan.patch
--- /dev/null
+From bb95e70e78ed1cd6eb9df4e30fec3573ed3d3c75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Dec 2025 09:17:57 +0800
+Subject: smb/client: fix NT_STATUS_DEVICE_DOOR_OPEN value
+
+From: ChenXiaoSong <chenxiaosong@kylinos.cn>
+
+[ Upstream commit b2b50fca34da5ec231008edba798ddf92986bd7f ]
+
+This was reported by the KUnit tests in the later patches.
+
+See MS-ERREF 2.3.1 STATUS_DEVICE_DOOR_OPEN. Keep it consistent with the
+value in the documentation.
+
+Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/nterr.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/nterr.h b/fs/smb/client/nterr.h
+index 7ce063a1dc3f6..d46d42559eea2 100644
+--- a/fs/smb/client/nterr.h
++++ b/fs/smb/client/nterr.h
+@@ -44,7 +44,7 @@ extern const struct nt_err_code_struct nt_errs[];
+ #define NT_STATUS_NO_DATA_DETECTED 0x8000001c
+ #define NT_STATUS_STOPPED_ON_SYMLINK 0x8000002d
+ #define NT_STATUS_DEVICE_REQUIRES_CLEANING 0x80000288
+-#define NT_STATUS_DEVICE_DOOR_OPEN 0x80000288
++#define NT_STATUS_DEVICE_DOOR_OPEN 0x80000289
+ #define NT_STATUS_UNSUCCESSFUL 0xC0000000 | 0x0001
+ #define NT_STATUS_NOT_IMPLEMENTED 0xC0000000 | 0x0002
+ #define NT_STATUS_INVALID_INFO_CLASS 0xC0000000 | 0x0003
+--
+2.51.0
+
--- /dev/null
+From 789b60772ba2ed339acc78335bb38582c06e69f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Dec 2025 09:13:06 +0800
+Subject: smb/client: fix NT_STATUS_NO_DATA_DETECTED value
+
+From: ChenXiaoSong <chenxiaosong@kylinos.cn>
+
+[ Upstream commit a1237c203f1757480dc2f3b930608ee00072d3cc ]
+
+This was reported by the KUnit tests in the later patches.
+
+See MS-ERREF 2.3.1 STATUS_NO_DATA_DETECTED. Keep it consistent with the
+value in the documentation.
+
+Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/nterr.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/nterr.h b/fs/smb/client/nterr.h
+index d46d42559eea2..e3a341316a711 100644
+--- a/fs/smb/client/nterr.h
++++ b/fs/smb/client/nterr.h
+@@ -41,7 +41,7 @@ extern const struct nt_err_code_struct nt_errs[];
+ #define NT_STATUS_MEDIA_CHANGED 0x8000001c
+ #define NT_STATUS_END_OF_MEDIA 0x8000001e
+ #define NT_STATUS_MEDIA_CHECK 0x80000020
+-#define NT_STATUS_NO_DATA_DETECTED 0x8000001c
++#define NT_STATUS_NO_DATA_DETECTED 0x80000022
+ #define NT_STATUS_STOPPED_ON_SYMLINK 0x8000002d
+ #define NT_STATUS_DEVICE_REQUIRES_CLEANING 0x80000288
+ #define NT_STATUS_DEVICE_DOOR_OPEN 0x80000289
+--
+2.51.0
+
--- /dev/null
+From de68f0124e91bd35a241b88c3a809b7170c194f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Dec 2025 09:22:53 +0800
+Subject: smb/client: fix NT_STATUS_UNABLE_TO_FREE_VM value
+
+From: ChenXiaoSong <chenxiaosong@kylinos.cn>
+
+[ Upstream commit 9f99caa8950a76f560a90074e3a4b93cfa8b3d84 ]
+
+This was reported by the KUnit tests in the later patches.
+
+See MS-ERREF 2.3.1 STATUS_UNABLE_TO_FREE_VM. Keep it consistent with the
+value in the documentation.
+
+Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
+Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/nterr.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/nterr.h b/fs/smb/client/nterr.h
+index edd4741cab0a1..7ce063a1dc3f6 100644
+--- a/fs/smb/client/nterr.h
++++ b/fs/smb/client/nterr.h
+@@ -70,7 +70,7 @@ extern const struct nt_err_code_struct nt_errs[];
+ #define NT_STATUS_NO_MEMORY 0xC0000000 | 0x0017
+ #define NT_STATUS_CONFLICTING_ADDRESSES 0xC0000000 | 0x0018
+ #define NT_STATUS_NOT_MAPPED_VIEW 0xC0000000 | 0x0019
+-#define NT_STATUS_UNABLE_TO_FREE_VM 0x80000000 | 0x001a
++#define NT_STATUS_UNABLE_TO_FREE_VM 0xC0000000 | 0x001a
+ #define NT_STATUS_UNABLE_TO_DELETE_SECTION 0xC0000000 | 0x001b
+ #define NT_STATUS_INVALID_SYSTEM_SERVICE 0xC0000000 | 0x001c
+ #define NT_STATUS_ILLEGAL_INSTRUCTION 0xC0000000 | 0x001d
+--
+2.51.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
