--- /dev/null
+From 706110675a940badf7ca2f4226845874522eb2fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Oct 2025 22:25:49 +0900
+Subject: bfs: Reconstruct file type when loading from disk
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit 34ab4c75588c07cca12884f2bf6b0347c7a13872 ]
+
+syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when
+the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted
+or when the 32bits "attributes" field loaded from disk are corrupted.
+
+A documentation says that BFS uses only lower 9 bits of the "mode" field.
+But I can't find an explicit explanation that the unused upper 23 bits
+(especially, the S_IFMT bits) are initialized with 0.
+
+Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk.
+Also, verify that the value of the "attributes" field loaded from disk is
+either BFS_VREG or BFS_VDIR (because BFS supports only regular files and
+the root directory).
+
+Reported-by: syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Link: https://patch.msgid.link/fabce673-d5b9-4038-8287-0fd65d80203b@I-love.SAKURA.ne.jp
+Reviewed-by: Tigran Aivazian <aivazian.tigran@gmail.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/bfs/inode.c | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c
+index fd691e4815c56..fa4e002925852 100644
+--- a/fs/bfs/inode.c
++++ b/fs/bfs/inode.c
+@@ -60,7 +60,19 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino)
+ off = (ino - BFS_ROOT_INO) % BFS_INODES_PER_BLOCK;
+ di = (struct bfs_inode *)bh->b_data + off;
+
+- inode->i_mode = 0x0000FFFF & le32_to_cpu(di->i_mode);
++ /*
++ * https://martin.hinner.info/fs/bfs/bfs-structure.html explains that
++ * BFS in SCO UnixWare environment used only lower 9 bits of di->i_mode
++ * value. This means that, although bfs_write_inode() saves whole
++ * inode->i_mode bits (which include S_IFMT bits and S_IS{UID,GID,VTX}
++ * bits), middle 7 bits of di->i_mode value can be garbage when these
++ * bits were not saved by bfs_write_inode().
++ * Since we can't tell whether middle 7 bits are garbage, use only
++ * lower 12 bits (i.e. tolerate S_IS{UID,GID,VTX} bits possibly being
++ * garbage) and reconstruct S_IFMT bits for Linux environment from
++ * di->i_vtype value.
++ */
++ inode->i_mode = 0x00000FFF & le32_to_cpu(di->i_mode);
+ if (le32_to_cpu(di->i_vtype) == BFS_VDIR) {
+ inode->i_mode |= S_IFDIR;
+ inode->i_op = &bfs_dir_inops;
+@@ -70,6 +82,11 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino)
+ inode->i_op = &bfs_file_inops;
+ inode->i_fop = &bfs_file_operations;
+ inode->i_mapping->a_ops = &bfs_aops;
++ } else {
++ brelse(bh);
++ printf("Unknown vtype=%u %s:%08lx\n",
++ le32_to_cpu(di->i_vtype), inode->i_sb->s_id, ino);
++ goto error;
+ }
+
+ BFS_I(inode)->i_sblock = le32_to_cpu(di->i_sblock);
+--
+2.51.0
+
--- /dev/null
+From 2e9e270d7119dc7c72b1230875ea2e52ef67ad17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 14:05:27 +0000
+Subject: dma-mapping: Allow use of DMA_BIT_MASK(64) in global scope
+
+From: James Clark <james.clark@linaro.org>
+
+[ Upstream commit a50f7456f853ec3a6f07cbe1d16ad8a8b2501320 ]
+
+Clang doesn't like that (1ULL<<(64)) overflows when initializing a
+global scope variable, even if that part of the ternary isn't used when
+n = 64. The same initialization can be done without warnings in function
+scopes, and GCC doesn't mind either way.
+
+The build failure that highlighted this was already fixed in a different
+way [1], which also has detailed links to the Clang issues. However it's
+not going to be long before the same thing happens again, so it's better
+to fix the root cause.
+
+Fix it by using GENMASK_ULL() which does exactly the same thing, is much
+more readable anyway, and doesn't have a shift that overflows.
+
+[1]: https://lore.kernel.org/all/20250918-mmp-pdma-simplify-dma-addressing-v1-1-5c2be2b85696@riscstar.com/
+
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Link: https://lore.kernel.org/r/20251030-james-fix-dma_bit_mask-v1-1-ad1ce7cfab6e@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/dma-mapping.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
+index fb48f8ba5dcc8..c4fda94321bb4 100644
+--- a/include/linux/dma-mapping.h
++++ b/include/linux/dma-mapping.h
+@@ -73,7 +73,7 @@
+ */
+ #define DMA_MAPPING_ERROR (~(dma_addr_t)0)
+
+-#define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
++#define DMA_BIT_MASK(n) GENMASK_ULL(n - 1, 0)
+
+ #ifdef CONFIG_DMA_API_DEBUG
+ void debug_dma_mapping_error(struct device *dev, dma_addr_t dma_addr);
+--
+2.51.0
+
--- /dev/null
+From d6279aca63f8bbfc2585f5869d0127e63df6a8f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 15:40:41 +0530
+Subject: pinctrl: qcom: msm: Fix deadlock in pinmux configuration
+
+From: Praveen Talari <praveen.talari@oss.qualcomm.com>
+
+[ Upstream commit 1c2e70397b4125022dba80f6111271a37fb36bae ]
+
+Replace disable_irq() with disable_irq_nosync() in msm_pinmux_set_mux()
+to prevent deadlock when wakeup IRQ is triggered on the same
+GPIO being reconfigured.
+
+The issue occurs when a wakeup IRQ is triggered on a GPIO and the IRQ
+handler attempts to reconfigure the same GPIO's pinmux. In this scenario,
+msm_pinmux_set_mux() calls disable_irq() which waits for the currently
+running IRQ handler to complete, creating a circular dependency that
+results in deadlock.
+
+Using disable_irq_nosync() avoids waiting for the IRQ handler to
+complete, preventing the deadlock condition while still properly
+disabling the interrupt during pinmux reconfiguration.
+
+Suggested-by: Prasad Sodagudi <prasad.sodagudi@oss.qualcomm.com>
+Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com>
+Reviewed-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/qcom/pinctrl-msm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
+index 049a34f0e13f7..f72a1598de28a 100644
+--- a/drivers/pinctrl/qcom/pinctrl-msm.c
++++ b/drivers/pinctrl/qcom/pinctrl-msm.c
+@@ -213,7 +213,7 @@ static int msm_pinmux_set_mux(struct pinctrl_dev *pctldev,
+ */
+ if (d && i != gpio_func &&
+ !test_and_set_bit(d->hwirq, pctrl->disabled_for_mux))
+- disable_irq(irq);
++ disable_irq_nosync(irq);
+
+ raw_spin_lock_irqsave(&pctrl->lock, flags);
+
+--
+2.51.0
+
--- /dev/null
+From db6d70b7516aab8e8e8b2daae0e314db5d2e63d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 16:59:38 +0100
+Subject: platform/x86: acer-wmi: Ignore backlight event
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 444a9256f8d106e08a6bc2dc8ef28a8699e4b3ba ]
+
+On the Acer Nitro AN515-58, the event 4 - 0 is send by the ACPI
+firmware when the backlight up/down keys are pressed. Ignore this
+event to avoid spamming the kernel log with error messages, as the
+acpi-video driver already handles brightness up/down events.
+
+Reported-by: Bugaddr <Bugaddr@protonmail.com>
+Closes: https://bugaddr.tech/posts/2025-11-16-debugging-the-acer-nitro-5-an515-58-fn-f10-keyboard-backlight-bug-on-linux/#wmi-interface-issues
+Tested-by: Bugaddr <Bugaddr@protonmail.com>
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://patch.msgid.link/20251117155938.3030-1-W_Armin@gmx.de
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/acer-wmi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
+index ebec49957ed09..b35a0539a99c6 100644
+--- a/drivers/platform/x86/acer-wmi.c
++++ b/drivers/platform/x86/acer-wmi.c
+@@ -81,6 +81,7 @@ MODULE_ALIAS("wmi:676AA15E-6A47-4D9F-A2CC-1E6D18D14026");
+
+ enum acer_wmi_event_ids {
+ WMID_HOTKEY_EVENT = 0x1,
++ WMID_BACKLIGHT_EVENT = 0x4,
+ WMID_ACCEL_OR_KBD_DOCK_EVENT = 0x5,
+ };
+
+@@ -1890,6 +1891,9 @@ static void acer_wmi_notify(u32 value, void *context)
+ sparse_keymap_report_event(acer_wmi_input_dev, scancode, 1, true);
+ }
+ break;
++ case WMID_BACKLIGHT_EVENT:
++ /* Already handled by acpi-video */
++ break;
+ case WMID_ACCEL_OR_KBD_DOCK_EVENT:
+ acer_gsensor_event();
+ acer_kbd_dock_event(&return_value);
+--
+2.51.0
+
--- /dev/null
+From b50f7d14c9368c262382f22b0a3a5754e3a00409 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Oct 2025 05:18:38 +0000
+Subject: platform/x86: huawei-wmi: add keys for HONOR models
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jia Ston <ston.jia@outlook.com>
+
+[ Upstream commit 5c72329716d0858621021193330594d5d26bf44d ]
+
+HONOR MagicBook X16/X14 models produced in 2025 cannot use the Print
+Screen and YOYO keys properly, with the system reporting them as
+unknown key presses (codes: 0x028b and 0x028e).
+
+To resolve this, a key_entry is added for both the HONOR Print Screen
+key and the HONOR YOYO key, ensuring they function correctly on these
+models.
+
+Signed-off-by: Ston Jia <ston.jia@outlook.com>
+Link: https://patch.msgid.link/20251029051804.220111-1-ston.jia@outlook.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/huawei-wmi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/platform/x86/huawei-wmi.c b/drivers/platform/x86/huawei-wmi.c
+index 23ebd0c046e16..da9f80bde794f 100644
+--- a/drivers/platform/x86/huawei-wmi.c
++++ b/drivers/platform/x86/huawei-wmi.c
+@@ -82,6 +82,10 @@ static const struct key_entry huawei_wmi_keymap[] = {
+ { KE_KEY, 0x289, { KEY_WLAN } },
+ // Huawei |M| key
+ { KE_KEY, 0x28a, { KEY_CONFIG } },
++ // HONOR YOYO key
++ { KE_KEY, 0x28b, { KEY_NOTIFICATION_CENTER } },
++ // HONOR print screen
++ { KE_KEY, 0x28e, { KEY_PRINT } },
+ // Keyboard backlit
+ { KE_IGNORE, 0x293, { KEY_KBDILLUMTOGGLE } },
+ { KE_IGNORE, 0x294, { KEY_KBDILLUMUP } },
+--
+2.51.0
+
--- /dev/null
+From 104a36d1875b944b1687c0c1ec460062f26cb41b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 09:29:02 -0800
+Subject: samples: work around glibc redefining some of our defines wrong
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit a48f822908982353c3256e35a089e9e7d0d61580 ]
+
+Apparently as of version 2.42, glibc headers define AT_RENAME_NOREPLACE
+and some of the other flags for renameat2() and friends in <stdio.h>.
+
+Which would all be fine, except for inexplicable reasons glibc decided
+to define them _differently_ from the kernel definitions, which then
+makes some of our sample code that includes both kernel headers and user
+space headers unhappy, because the compiler will (correctly) complain
+about redefining things.
+
+Now, mixing kernel headers and user space headers is always a somewhat
+iffy proposition due to namespacing issues, but it's kind of inevitable
+in our sample and selftest code. And this is just glibc being stupid.
+
+Those defines come from the kernel, glibc is exposing the kernel
+interfaces, and glibc shouldn't make up some random new expressions for
+these values.
+
+It's not like glibc headers changed the actual result values, but they
+arbitrarily just decided to use a different expression to describe those
+values. The kernel just does
+
+ #define AT_RENAME_NOREPLACE 0x0001
+
+while glibc does
+
+ # define RENAME_NOREPLACE (1 << 0)
+ # define AT_RENAME_NOREPLACE RENAME_NOREPLACE
+
+instead. Same value in the end, but very different macro definition.
+
+For absolutely no reason.
+
+This has since been fixed in the glibc development tree, so eventually
+we'll end up with the canonical expressions and no clashes. But in the
+meantime the broken headers are in the glibc-2.42 release and have made
+it out into distributions.
+
+Do a minimal work-around to make the samples build cleanly by just
+undefining the affected macros in between the user space header include
+and the kernel header includes.
+
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/vfs/test-statx.c | 6 ++++++
+ samples/watch_queue/watch_test.c | 6 ++++++
+ 2 files changed, 12 insertions(+)
+
+diff --git a/samples/vfs/test-statx.c b/samples/vfs/test-statx.c
+index 49c7a46cee073..424a6fa15723c 100644
+--- a/samples/vfs/test-statx.c
++++ b/samples/vfs/test-statx.c
+@@ -19,6 +19,12 @@
+ #include <time.h>
+ #include <sys/syscall.h>
+ #include <sys/types.h>
++
++// Work around glibc header silliness
++#undef AT_RENAME_NOREPLACE
++#undef AT_RENAME_EXCHANGE
++#undef AT_RENAME_WHITEOUT
++
+ #include <linux/stat.h>
+ #include <linux/fcntl.h>
+ #define statx foo
+diff --git a/samples/watch_queue/watch_test.c b/samples/watch_queue/watch_test.c
+index 8c6cb57d5cfc5..24cf7d7a19725 100644
+--- a/samples/watch_queue/watch_test.c
++++ b/samples/watch_queue/watch_test.c
+@@ -16,6 +16,12 @@
+ #include <errno.h>
+ #include <sys/ioctl.h>
+ #include <limits.h>
++
++// Work around glibc header silliness
++#undef AT_RENAME_NOREPLACE
++#undef AT_RENAME_EXCHANGE
++#undef AT_RENAME_WHITEOUT
++
+ #include <linux/watch_queue.h>
+ #include <linux/unistd.h>
+ #include <linux/keyctl.h>
+--
+2.51.0
+
revert-xfrm-destroy-xfrm_state-synchronously-on-net-.patch
xfrm-also-call-xfrm_state_delete_tunnel-at-destroy-t.patch
xfrm-flush-all-states-in-xfrm_state_fini.patch
+spi-xilinx-increase-number-of-retries-before-declari.patch
+spi-imx-keep-dma-request-disabled-before-dma-transfe.patch
+dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch
+bfs-reconstruct-file-type-when-loading-from-disk.patch
+pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch
+platform-x86-acer-wmi-ignore-backlight-event.patch
+platform-x86-huawei-wmi-add-keys-for-honor-models.patch
+samples-work-around-glibc-redefining-some-of-our-def.patch
--- /dev/null
+From 1d27c929e65547ec8d67d1c2cf76e95370204005 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Oct 2025 13:53:20 +0800
+Subject: spi: imx: keep dma request disabled before dma transfer setup
+
+From: Robin Gong <yibin.gong@nxp.com>
+
+[ Upstream commit 86d57d9c07d54e8cb385ffe800930816ccdba0c1 ]
+
+Since sdma hardware configure postpone to transfer phase, have to disable
+dma request before dma transfer setup because there is a hardware
+limitation on sdma event enable(ENBLn) as below:
+
+"It is thus essential for the Arm platform to program them before any DMA
+ request is triggered to the SDMA, otherwise an unpredictable combination
+ of channels may be started."
+
+Signed-off-by: Carlos Song <carlos.song@nxp.com>
+Signed-off-by: Robin Gong <yibin.gong@nxp.com>
+Link: https://patch.msgid.link/20251024055320.408482-1-carlos.song@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-imx.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index f1a0073a8700f..a4e35c2f7d6ed 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -493,9 +493,15 @@ static void mx51_ecspi_trigger(struct spi_imx_data *spi_imx)
+ {
+ u32 reg;
+
+- reg = readl(spi_imx->base + MX51_ECSPI_CTRL);
+- reg |= MX51_ECSPI_CTRL_XCH;
+- writel(reg, spi_imx->base + MX51_ECSPI_CTRL);
++ if (spi_imx->usedma) {
++ reg = readl(spi_imx->base + MX51_ECSPI_DMA);
++ reg |= MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN;
++ writel(reg, spi_imx->base + MX51_ECSPI_DMA);
++ } else {
++ reg = readl(spi_imx->base + MX51_ECSPI_CTRL);
++ reg |= MX51_ECSPI_CTRL_XCH;
++ writel(reg, spi_imx->base + MX51_ECSPI_CTRL);
++ }
+ }
+
+ static void mx51_disable_dma(struct spi_imx_data *spi_imx)
+@@ -650,7 +656,6 @@ static void mx51_setup_wml(struct spi_imx_data *spi_imx)
+ writel(MX51_ECSPI_DMA_RX_WML(spi_imx->wml - 1) |
+ MX51_ECSPI_DMA_TX_WML(spi_imx->wml) |
+ MX51_ECSPI_DMA_RXT_WML(spi_imx->wml) |
+- MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN |
+ MX51_ECSPI_DMA_RXTDEN, spi_imx->base + MX51_ECSPI_DMA);
+ }
+
+@@ -1424,6 +1429,8 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx,
+ reinit_completion(&spi_imx->dma_tx_completion);
+ dma_async_issue_pending(master->dma_tx);
+
++ spi_imx->devtype_data->trigger(spi_imx);
++
+ transfer_timeout = spi_imx_calculate_timeout(spi_imx, transfer->len);
+
+ /* Wait SDMA to finish the data transfer.*/
+--
+2.51.0
+
--- /dev/null
+From cbbed0785d9f3515994d89bcf54c49bd1a347acc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Nov 2025 14:45:35 +0100
+Subject: spi: xilinx: increase number of retries before declaring stall
+
+From: Alvaro Gamez Machado <alvaro.gamez@hazent.com>
+
+[ Upstream commit 939edfaa10f1d22e6af6a84bf4bd96dc49c67302 ]
+
+SPI devices using a (relative) slow frequency need a larger time.
+
+For instance, microblaze running at 83.25MHz and performing a
+3 bytes transaction using a 10MHz/16 = 625kHz needed this stall
+value increased to at least 20. The SPI device is quite slow, but
+also is the microblaze, so set this value to 32 to give it even
+more margin.
+
+Signed-off-by: Alvaro Gamez Machado <alvaro.gamez@hazent.com>
+Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
+Link: https://patch.msgid.link/20251106134545.31942-1-alvaro.gamez@hazent.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-xilinx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c
+index 523edfdf5dcd1..d497fc4bc19eb 100644
+--- a/drivers/spi/spi-xilinx.c
++++ b/drivers/spi/spi-xilinx.c
+@@ -298,7 +298,7 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)
+
+ /* Read out all the data from the Rx FIFO */
+ rx_words = n_words;
+- stalled = 10;
++ stalled = 32;
+ while (rx_words) {
+ if (rx_words == n_words && !(stalled--) &&
+ !(sr & XSPI_SR_TX_EMPTY_MASK) &&
+--
+2.51.0
+
--- /dev/null
+From d42f9206c4c06f8b85707f62b056ceeff30156be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Oct 2025 22:25:49 +0900
+Subject: bfs: Reconstruct file type when loading from disk
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit 34ab4c75588c07cca12884f2bf6b0347c7a13872 ]
+
+syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when
+the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted
+or when the 32bits "attributes" field loaded from disk are corrupted.
+
+A documentation says that BFS uses only lower 9 bits of the "mode" field.
+But I can't find an explicit explanation that the unused upper 23 bits
+(especially, the S_IFMT bits) are initialized with 0.
+
+Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk.
+Also, verify that the value of the "attributes" field loaded from disk is
+either BFS_VREG or BFS_VDIR (because BFS supports only regular files and
+the root directory).
+
+Reported-by: syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Link: https://patch.msgid.link/fabce673-d5b9-4038-8287-0fd65d80203b@I-love.SAKURA.ne.jp
+Reviewed-by: Tigran Aivazian <aivazian.tigran@gmail.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/bfs/inode.c | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c
+index fd691e4815c56..fa4e002925852 100644
+--- a/fs/bfs/inode.c
++++ b/fs/bfs/inode.c
+@@ -60,7 +60,19 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino)
+ off = (ino - BFS_ROOT_INO) % BFS_INODES_PER_BLOCK;
+ di = (struct bfs_inode *)bh->b_data + off;
+
+- inode->i_mode = 0x0000FFFF & le32_to_cpu(di->i_mode);
++ /*
++ * https://martin.hinner.info/fs/bfs/bfs-structure.html explains that
++ * BFS in SCO UnixWare environment used only lower 9 bits of di->i_mode
++ * value. This means that, although bfs_write_inode() saves whole
++ * inode->i_mode bits (which include S_IFMT bits and S_IS{UID,GID,VTX}
++ * bits), middle 7 bits of di->i_mode value can be garbage when these
++ * bits were not saved by bfs_write_inode().
++ * Since we can't tell whether middle 7 bits are garbage, use only
++ * lower 12 bits (i.e. tolerate S_IS{UID,GID,VTX} bits possibly being
++ * garbage) and reconstruct S_IFMT bits for Linux environment from
++ * di->i_vtype value.
++ */
++ inode->i_mode = 0x00000FFF & le32_to_cpu(di->i_mode);
+ if (le32_to_cpu(di->i_vtype) == BFS_VDIR) {
+ inode->i_mode |= S_IFDIR;
+ inode->i_op = &bfs_dir_inops;
+@@ -70,6 +82,11 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino)
+ inode->i_op = &bfs_file_inops;
+ inode->i_fop = &bfs_file_operations;
+ inode->i_mapping->a_ops = &bfs_aops;
++ } else {
++ brelse(bh);
++ printf("Unknown vtype=%u %s:%08lx\n",
++ le32_to_cpu(di->i_vtype), inode->i_sb->s_id, ino);
++ goto error;
+ }
+
+ BFS_I(inode)->i_sblock = le32_to_cpu(di->i_sblock);
+--
+2.51.0
+
--- /dev/null
+From b61323372b217568965e6652aadc996b7e5830eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 14:05:27 +0000
+Subject: dma-mapping: Allow use of DMA_BIT_MASK(64) in global scope
+
+From: James Clark <james.clark@linaro.org>
+
+[ Upstream commit a50f7456f853ec3a6f07cbe1d16ad8a8b2501320 ]
+
+Clang doesn't like that (1ULL<<(64)) overflows when initializing a
+global scope variable, even if that part of the ternary isn't used when
+n = 64. The same initialization can be done without warnings in function
+scopes, and GCC doesn't mind either way.
+
+The build failure that highlighted this was already fixed in a different
+way [1], which also has detailed links to the Clang issues. However it's
+not going to be long before the same thing happens again, so it's better
+to fix the root cause.
+
+Fix it by using GENMASK_ULL() which does exactly the same thing, is much
+more readable anyway, and doesn't have a shift that overflows.
+
+[1]: https://lore.kernel.org/all/20250918-mmp-pdma-simplify-dma-addressing-v1-1-5c2be2b85696@riscstar.com/
+
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Link: https://lore.kernel.org/r/20251030-james-fix-dma_bit_mask-v1-1-ad1ce7cfab6e@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/dma-mapping.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
+index d7b91f82b0dce..e034355c35dd5 100644
+--- a/include/linux/dma-mapping.h
++++ b/include/linux/dma-mapping.h
+@@ -73,7 +73,7 @@
+ */
+ #define DMA_MAPPING_ERROR (~(dma_addr_t)0)
+
+-#define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
++#define DMA_BIT_MASK(n) GENMASK_ULL(n - 1, 0)
+
+ #ifdef CONFIG_DMA_API_DEBUG
+ void debug_dma_mapping_error(struct device *dev, dma_addr_t dma_addr);
+--
+2.51.0
+
--- /dev/null
+From aa0c3f824952fc9cb199045434e8271c29a5b7fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Nov 2025 21:16:45 +0900
+Subject: HID: elecom: Add support for ELECOM M-XT3URBK (018F)
+
+From: Naoki Ueki <naoki25519@gmail.com>
+
+[ Upstream commit cdcbb8e8d10f656642380ee13516290437b52b36 ]
+
+The ELECOM M-XT3URBK trackball has an additional device ID (0x018F), which
+shares the same report descriptor as the existing device (0x00FB). However,
+the driver does not currently recognize this new ID, resulting in only five
+buttons being functional.
+
+This patch adds the new device ID so that all six buttons work properly.
+
+Signed-off-by: Naoki Ueki <naoki25519@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-elecom.c | 6 ++++--
+ drivers/hid/hid-ids.h | 3 ++-
+ drivers/hid/hid-quirks.c | 3 ++-
+ 3 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c
+index 4fa45ee77503b..f76fec79e8903 100644
+--- a/drivers/hid/hid-elecom.c
++++ b/drivers/hid/hid-elecom.c
+@@ -75,7 +75,8 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ */
+ mouse_button_fixup(hdev, rdesc, *rsize, 20, 28, 22, 14, 8);
+ break;
+- case USB_DEVICE_ID_ELECOM_M_XT3URBK:
++ case USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB:
++ case USB_DEVICE_ID_ELECOM_M_XT3URBK_018F:
+ case USB_DEVICE_ID_ELECOM_M_XT3DRBK:
+ case USB_DEVICE_ID_ELECOM_M_XT4DRBK:
+ /*
+@@ -117,7 +118,8 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ static const struct hid_device_id elecom_devices[] = {
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index d897d48404d21..b68293a505518 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -415,7 +415,8 @@
+ #define USB_VENDOR_ID_ELECOM 0x056e
+ #define USB_DEVICE_ID_ELECOM_BM084 0x0061
+ #define USB_DEVICE_ID_ELECOM_M_XGL20DLBK 0x00e6
+-#define USB_DEVICE_ID_ELECOM_M_XT3URBK 0x00fb
++#define USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB 0x00fb
++#define USB_DEVICE_ID_ELECOM_M_XT3URBK_018F 0x018f
+ #define USB_DEVICE_ID_ELECOM_M_XT3DRBK 0x00fc
+ #define USB_DEVICE_ID_ELECOM_M_XT4DRBK 0x00fd
+ #define USB_DEVICE_ID_ELECOM_M_DT1URBK 0x00fe
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index c07c7dc06d914..4b645db5cd4bc 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -382,7 +382,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ #if IS_ENABLED(CONFIG_HID_ELECOM)
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) },
+--
+2.51.0
+
--- /dev/null
+From ba0cf0311492f386ecaef74d725b4088c0d88a1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 15:40:41 +0530
+Subject: pinctrl: qcom: msm: Fix deadlock in pinmux configuration
+
+From: Praveen Talari <praveen.talari@oss.qualcomm.com>
+
+[ Upstream commit 1c2e70397b4125022dba80f6111271a37fb36bae ]
+
+Replace disable_irq() with disable_irq_nosync() in msm_pinmux_set_mux()
+to prevent deadlock when wakeup IRQ is triggered on the same
+GPIO being reconfigured.
+
+The issue occurs when a wakeup IRQ is triggered on a GPIO and the IRQ
+handler attempts to reconfigure the same GPIO's pinmux. In this scenario,
+msm_pinmux_set_mux() calls disable_irq() which waits for the currently
+running IRQ handler to complete, creating a circular dependency that
+results in deadlock.
+
+Using disable_irq_nosync() avoids waiting for the IRQ handler to
+complete, preventing the deadlock condition while still properly
+disabling the interrupt during pinmux reconfiguration.
+
+Suggested-by: Prasad Sodagudi <prasad.sodagudi@oss.qualcomm.com>
+Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com>
+Reviewed-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/qcom/pinctrl-msm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
+index 676b16397b07c..1bb7be9ed92f2 100644
+--- a/drivers/pinctrl/qcom/pinctrl-msm.c
++++ b/drivers/pinctrl/qcom/pinctrl-msm.c
+@@ -213,7 +213,7 @@ static int msm_pinmux_set_mux(struct pinctrl_dev *pctldev,
+ */
+ if (d && i != gpio_func &&
+ !test_and_set_bit(d->hwirq, pctrl->disabled_for_mux))
+- disable_irq(irq);
++ disable_irq_nosync(irq);
+
+ raw_spin_lock_irqsave(&pctrl->lock, flags);
+
+--
+2.51.0
+
--- /dev/null
+From 3f676a16f68159f9551a2728dee95e092049db85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 16:59:38 +0100
+Subject: platform/x86: acer-wmi: Ignore backlight event
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 444a9256f8d106e08a6bc2dc8ef28a8699e4b3ba ]
+
+On the Acer Nitro AN515-58, the event 4 - 0 is send by the ACPI
+firmware when the backlight up/down keys are pressed. Ignore this
+event to avoid spamming the kernel log with error messages, as the
+acpi-video driver already handles brightness up/down events.
+
+Reported-by: Bugaddr <Bugaddr@protonmail.com>
+Closes: https://bugaddr.tech/posts/2025-11-16-debugging-the-acer-nitro-5-an515-58-fn-f10-keyboard-backlight-bug-on-linux/#wmi-interface-issues
+Tested-by: Bugaddr <Bugaddr@protonmail.com>
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://patch.msgid.link/20251117155938.3030-1-W_Armin@gmx.de
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/acer-wmi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
+index 7ef80f517e76e..ea5dbe8081570 100644
+--- a/drivers/platform/x86/acer-wmi.c
++++ b/drivers/platform/x86/acer-wmi.c
+@@ -86,6 +86,7 @@ MODULE_ALIAS("wmi:676AA15E-6A47-4D9F-A2CC-1E6D18D14026");
+
+ enum acer_wmi_event_ids {
+ WMID_HOTKEY_EVENT = 0x1,
++ WMID_BACKLIGHT_EVENT = 0x4,
+ WMID_ACCEL_OR_KBD_DOCK_EVENT = 0x5,
+ WMID_GAMING_TURBO_KEY_EVENT = 0x7,
+ WMID_AC_EVENT = 0x8,
+@@ -2060,6 +2061,9 @@ static void acer_wmi_notify(u32 value, void *context)
+ sparse_keymap_report_event(acer_wmi_input_dev, scancode, 1, true);
+ }
+ break;
++ case WMID_BACKLIGHT_EVENT:
++ /* Already handled by acpi-video */
++ break;
+ case WMID_ACCEL_OR_KBD_DOCK_EVENT:
+ acer_gsensor_event();
+ acer_kbd_dock_event(&return_value);
+--
+2.51.0
+
--- /dev/null
+From 5a1499d86eff5947b43c3a7985449eb6dfe5ca83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Oct 2025 05:18:38 +0000
+Subject: platform/x86: huawei-wmi: add keys for HONOR models
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jia Ston <ston.jia@outlook.com>
+
+[ Upstream commit 5c72329716d0858621021193330594d5d26bf44d ]
+
+HONOR MagicBook X16/X14 models produced in 2025 cannot use the Print
+Screen and YOYO keys properly, with the system reporting them as
+unknown key presses (codes: 0x028b and 0x028e).
+
+To resolve this, a key_entry is added for both the HONOR Print Screen
+key and the HONOR YOYO key, ensuring they function correctly on these
+models.
+
+Signed-off-by: Ston Jia <ston.jia@outlook.com>
+Link: https://patch.msgid.link/20251029051804.220111-1-ston.jia@outlook.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/huawei-wmi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/platform/x86/huawei-wmi.c b/drivers/platform/x86/huawei-wmi.c
+index 23ebd0c046e16..da9f80bde794f 100644
+--- a/drivers/platform/x86/huawei-wmi.c
++++ b/drivers/platform/x86/huawei-wmi.c
+@@ -82,6 +82,10 @@ static const struct key_entry huawei_wmi_keymap[] = {
+ { KE_KEY, 0x289, { KEY_WLAN } },
+ // Huawei |M| key
+ { KE_KEY, 0x28a, { KEY_CONFIG } },
++ // HONOR YOYO key
++ { KE_KEY, 0x28b, { KEY_NOTIFICATION_CENTER } },
++ // HONOR print screen
++ { KE_KEY, 0x28e, { KEY_PRINT } },
+ // Keyboard backlit
+ { KE_IGNORE, 0x293, { KEY_KBDILLUMTOGGLE } },
+ { KE_IGNORE, 0x294, { KEY_KBDILLUMUP } },
+--
+2.51.0
+
--- /dev/null
+From 293129f5d9b154599d0e7d9fddc78747eb994243 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 09:29:02 -0800
+Subject: samples: work around glibc redefining some of our defines wrong
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit a48f822908982353c3256e35a089e9e7d0d61580 ]
+
+Apparently as of version 2.42, glibc headers define AT_RENAME_NOREPLACE
+and some of the other flags for renameat2() and friends in <stdio.h>.
+
+Which would all be fine, except for inexplicable reasons glibc decided
+to define them _differently_ from the kernel definitions, which then
+makes some of our sample code that includes both kernel headers and user
+space headers unhappy, because the compiler will (correctly) complain
+about redefining things.
+
+Now, mixing kernel headers and user space headers is always a somewhat
+iffy proposition due to namespacing issues, but it's kind of inevitable
+in our sample and selftest code. And this is just glibc being stupid.
+
+Those defines come from the kernel, glibc is exposing the kernel
+interfaces, and glibc shouldn't make up some random new expressions for
+these values.
+
+It's not like glibc headers changed the actual result values, but they
+arbitrarily just decided to use a different expression to describe those
+values. The kernel just does
+
+ #define AT_RENAME_NOREPLACE 0x0001
+
+while glibc does
+
+ # define RENAME_NOREPLACE (1 << 0)
+ # define AT_RENAME_NOREPLACE RENAME_NOREPLACE
+
+instead. Same value in the end, but very different macro definition.
+
+For absolutely no reason.
+
+This has since been fixed in the glibc development tree, so eventually
+we'll end up with the canonical expressions and no clashes. But in the
+meantime the broken headers are in the glibc-2.42 release and have made
+it out into distributions.
+
+Do a minimal work-around to make the samples build cleanly by just
+undefining the affected macros in between the user space header include
+and the kernel header includes.
+
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/vfs/test-statx.c | 6 ++++++
+ samples/watch_queue/watch_test.c | 6 ++++++
+ 2 files changed, 12 insertions(+)
+
+diff --git a/samples/vfs/test-statx.c b/samples/vfs/test-statx.c
+index 49c7a46cee073..424a6fa15723c 100644
+--- a/samples/vfs/test-statx.c
++++ b/samples/vfs/test-statx.c
+@@ -19,6 +19,12 @@
+ #include <time.h>
+ #include <sys/syscall.h>
+ #include <sys/types.h>
++
++// Work around glibc header silliness
++#undef AT_RENAME_NOREPLACE
++#undef AT_RENAME_EXCHANGE
++#undef AT_RENAME_WHITEOUT
++
+ #include <linux/stat.h>
+ #include <linux/fcntl.h>
+ #define statx foo
+diff --git a/samples/watch_queue/watch_test.c b/samples/watch_queue/watch_test.c
+index 8c6cb57d5cfc5..24cf7d7a19725 100644
+--- a/samples/watch_queue/watch_test.c
++++ b/samples/watch_queue/watch_test.c
+@@ -16,6 +16,12 @@
+ #include <errno.h>
+ #include <sys/ioctl.h>
+ #include <limits.h>
++
++// Work around glibc header silliness
++#undef AT_RENAME_NOREPLACE
++#undef AT_RENAME_EXCHANGE
++#undef AT_RENAME_WHITEOUT
++
+ #include <linux/watch_queue.h>
+ #include <linux/unistd.h>
+ #include <linux/keyctl.h>
+--
+2.51.0
+
drm-i915-selftests-fix-inconsistent-is_err-and-ptr_e.patch
leds-replace-all-non-returning-strlcpy-with-strscpy.patch
leds-spi-byte-use-devm_led_classdev_register_ext.patch
+spi-xilinx-increase-number-of-retries-before-declari.patch
+spi-imx-keep-dma-request-disabled-before-dma-transfe.patch
+dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch
+bfs-reconstruct-file-type-when-loading-from-disk.patch
+pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch
+platform-x86-acer-wmi-ignore-backlight-event.patch
+platform-x86-huawei-wmi-add-keys-for-honor-models.patch
+hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch
+samples-work-around-glibc-redefining-some-of-our-def.patch
--- /dev/null
+From d46799868513643b80db746e022e79ba8823e929 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Oct 2025 13:53:20 +0800
+Subject: spi: imx: keep dma request disabled before dma transfer setup
+
+From: Robin Gong <yibin.gong@nxp.com>
+
+[ Upstream commit 86d57d9c07d54e8cb385ffe800930816ccdba0c1 ]
+
+Since sdma hardware configure postpone to transfer phase, have to disable
+dma request before dma transfer setup because there is a hardware
+limitation on sdma event enable(ENBLn) as below:
+
+"It is thus essential for the Arm platform to program them before any DMA
+ request is triggered to the SDMA, otherwise an unpredictable combination
+ of channels may be started."
+
+Signed-off-by: Carlos Song <carlos.song@nxp.com>
+Signed-off-by: Robin Gong <yibin.gong@nxp.com>
+Link: https://patch.msgid.link/20251024055320.408482-1-carlos.song@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-imx.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index f22b867b8c8a9..bcc31951a9925 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -498,9 +498,15 @@ static void mx51_ecspi_trigger(struct spi_imx_data *spi_imx)
+ {
+ u32 reg;
+
+- reg = readl(spi_imx->base + MX51_ECSPI_CTRL);
+- reg |= MX51_ECSPI_CTRL_XCH;
+- writel(reg, spi_imx->base + MX51_ECSPI_CTRL);
++ if (spi_imx->usedma) {
++ reg = readl(spi_imx->base + MX51_ECSPI_DMA);
++ reg |= MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN;
++ writel(reg, spi_imx->base + MX51_ECSPI_DMA);
++ } else {
++ reg = readl(spi_imx->base + MX51_ECSPI_CTRL);
++ reg |= MX51_ECSPI_CTRL_XCH;
++ writel(reg, spi_imx->base + MX51_ECSPI_CTRL);
++ }
+ }
+
+ static void mx51_disable_dma(struct spi_imx_data *spi_imx)
+@@ -665,7 +671,6 @@ static void mx51_setup_wml(struct spi_imx_data *spi_imx)
+ writel(MX51_ECSPI_DMA_RX_WML(spi_imx->wml - 1) |
+ MX51_ECSPI_DMA_TX_WML(tx_wml) |
+ MX51_ECSPI_DMA_RXT_WML(spi_imx->wml) |
+- MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN |
+ MX51_ECSPI_DMA_RXTDEN, spi_imx->base + MX51_ECSPI_DMA);
+ }
+
+@@ -1422,6 +1427,8 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx,
+ reinit_completion(&spi_imx->dma_tx_completion);
+ dma_async_issue_pending(master->dma_tx);
+
++ spi_imx->devtype_data->trigger(spi_imx);
++
+ transfer_timeout = spi_imx_calculate_timeout(spi_imx, transfer->len);
+
+ /* Wait SDMA to finish the data transfer.*/
+--
+2.51.0
+
--- /dev/null
+From 5d18bd08274f48b3fb06c86c987ddd7abd53b53e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Nov 2025 14:45:35 +0100
+Subject: spi: xilinx: increase number of retries before declaring stall
+
+From: Alvaro Gamez Machado <alvaro.gamez@hazent.com>
+
+[ Upstream commit 939edfaa10f1d22e6af6a84bf4bd96dc49c67302 ]
+
+SPI devices using a (relative) slow frequency need a larger time.
+
+For instance, microblaze running at 83.25MHz and performing a
+3 bytes transaction using a 10MHz/16 = 625kHz needed this stall
+value increased to at least 20. The SPI device is quite slow, but
+also is the microblaze, so set this value to 32 to give it even
+more margin.
+
+Signed-off-by: Alvaro Gamez Machado <alvaro.gamez@hazent.com>
+Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
+Link: https://patch.msgid.link/20251106134545.31942-1-alvaro.gamez@hazent.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-xilinx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c
+index 523edfdf5dcd1..d497fc4bc19eb 100644
+--- a/drivers/spi/spi-xilinx.c
++++ b/drivers/spi/spi-xilinx.c
+@@ -298,7 +298,7 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)
+
+ /* Read out all the data from the Rx FIFO */
+ rx_words = n_words;
+- stalled = 10;
++ stalled = 32;
+ while (rx_words) {
+ if (rx_words == n_words && !(stalled--) &&
+ !(sr & XSPI_SR_TX_EMPTY_MASK) &&
+--
+2.51.0
+
--- /dev/null
+From 26beaa92d2b071182c8bd5a1d2974bf94c574952 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Nov 2025 13:20:53 +0800
+Subject: ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series
+
+From: Lushih Hsieh <bruce@mail.kh.edu.tw>
+
+[ Upstream commit 21a9ab5b90b3716a631d559e62818029b4e7f5b7 ]
+
+The PureAudio APA DAC and Lotus DAC5 series are USB Audio
+2.0 Class devices that support native Direct Stream Digital (DSD)
+playback via specific vendor protocols.
+
+Without these quirks, the devices may only function in standard
+PCM mode, or fail to correctly report their DSD format capabilities
+to the ALSA framework, preventing native DSD playback under Linux.
+
+This commit adds new quirk entries for the mentioned DAC models
+based on their respective Vendor/Product IDs (VID:PID), for example:
+0x16d0:0x0ab1 (APA DAC), 0x16d0:0xeca1 (DAC5 series), etc.
+
+The quirk ensures correct DSD format handling by setting the required
+SNDRV_PCM_FMTBIT_DSD_U32_BE format bit and defining the DSD-specific
+Audio Class 2.0 (AC2.0) endpoint configurations. This allows the ALSA
+DSD API to correctly address the device for high-bitrate DSD streams,
+bypassing the need for DoP (DSD over PCM).
+
+Test on APA DAC and Lotus DAC5 SE under Arch Linux.
+
+Tested-by: Lushih Hsieh <bruce@mail.kh.edu.tw>
+Signed-off-by: Lushih Hsieh <bruce@mail.kh.edu.tw>
+Link: https://patch.msgid.link/20251114052053.54989-1-bruce@mail.kh.edu.tw
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/quirks.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index aa5623e104c71..286ec4580718c 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1920,6 +1920,8 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ case USB_ID(0x16d0, 0x09d8): /* NuPrime IDA-8 */
+ case USB_ID(0x16d0, 0x09db): /* NuPrime Audio DAC-9 */
+ case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */
++ case USB_ID(0x16d0, 0x0ab1): /* PureAudio APA DAC */
++ case USB_ID(0x16d0, 0xeca1): /* PureAudio Lotus DAC5, DAC5 SE, DAC5 Pro */
+ case USB_ID(0x1db5, 0x0003): /* Bryston BDA3 */
+ case USB_ID(0x20a0, 0x4143): /* WaveIO USB Audio 2.0 */
+ case USB_ID(0x22e1, 0xca01): /* HDTA Serenade DSD */
+@@ -2187,6 +2189,10 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
+ QUIRK_FLAG_IGNORE_CLOCK_SOURCE),
+ DEVICE_FLG(0x1686, 0x00dd, /* Zoom R16/24 */
+ QUIRK_FLAG_TX_LENGTH | QUIRK_FLAG_CTL_MSG_DELAY_1M),
++ DEVICE_FLG(0x16d0, 0x0ab1, /* PureAudio APA DAC */
++ QUIRK_FLAG_DSD_RAW),
++ DEVICE_FLG(0x16d0, 0xeca1, /* PureAudio Lotus DAC5, DAC5 SE and DAC5 Pro */
++ QUIRK_FLAG_DSD_RAW),
+ DEVICE_FLG(0x17aa, 0x1046, /* Lenovo ThinkStation P620 Rear Line-in, Line-out and Microphone */
+ QUIRK_FLAG_DISABLE_AUTOSUSPEND),
+ DEVICE_FLG(0x17aa, 0x104d, /* Lenovo ThinkStation P620 Internal Speaker + Front Headset */
+--
+2.51.0
+
--- /dev/null
+From 0dca311a31722ed0e5e9404627d923bcc5bbc56d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Oct 2025 22:25:49 +0900
+Subject: bfs: Reconstruct file type when loading from disk
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit 34ab4c75588c07cca12884f2bf6b0347c7a13872 ]
+
+syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when
+the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted
+or when the 32bits "attributes" field loaded from disk are corrupted.
+
+A documentation says that BFS uses only lower 9 bits of the "mode" field.
+But I can't find an explicit explanation that the unused upper 23 bits
+(especially, the S_IFMT bits) are initialized with 0.
+
+Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk.
+Also, verify that the value of the "attributes" field loaded from disk is
+either BFS_VREG or BFS_VDIR (because BFS supports only regular files and
+the root directory).
+
+Reported-by: syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Link: https://patch.msgid.link/fabce673-d5b9-4038-8287-0fd65d80203b@I-love.SAKURA.ne.jp
+Reviewed-by: Tigran Aivazian <aivazian.tigran@gmail.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/bfs/inode.c | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c
+index 1926bec2c8500..07f7929d07fd8 100644
+--- a/fs/bfs/inode.c
++++ b/fs/bfs/inode.c
+@@ -60,7 +60,19 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino)
+ off = (ino - BFS_ROOT_INO) % BFS_INODES_PER_BLOCK;
+ di = (struct bfs_inode *)bh->b_data + off;
+
+- inode->i_mode = 0x0000FFFF & le32_to_cpu(di->i_mode);
++ /*
++ * https://martin.hinner.info/fs/bfs/bfs-structure.html explains that
++ * BFS in SCO UnixWare environment used only lower 9 bits of di->i_mode
++ * value. This means that, although bfs_write_inode() saves whole
++ * inode->i_mode bits (which include S_IFMT bits and S_IS{UID,GID,VTX}
++ * bits), middle 7 bits of di->i_mode value can be garbage when these
++ * bits were not saved by bfs_write_inode().
++ * Since we can't tell whether middle 7 bits are garbage, use only
++ * lower 12 bits (i.e. tolerate S_IS{UID,GID,VTX} bits possibly being
++ * garbage) and reconstruct S_IFMT bits for Linux environment from
++ * di->i_vtype value.
++ */
++ inode->i_mode = 0x00000FFF & le32_to_cpu(di->i_mode);
+ if (le32_to_cpu(di->i_vtype) == BFS_VDIR) {
+ inode->i_mode |= S_IFDIR;
+ inode->i_op = &bfs_dir_inops;
+@@ -70,6 +82,11 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino)
+ inode->i_op = &bfs_file_inops;
+ inode->i_fop = &bfs_file_operations;
+ inode->i_mapping->a_ops = &bfs_aops;
++ } else {
++ brelse(bh);
++ printf("Unknown vtype=%u %s:%08lx\n",
++ le32_to_cpu(di->i_vtype), inode->i_sb->s_id, ino);
++ goto error;
+ }
+
+ BFS_I(inode)->i_sblock = le32_to_cpu(di->i_sblock);
+--
+2.51.0
+
--- /dev/null
+From cdd6f27e6aba505ab8a797168701d7471022b67e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 14:05:27 +0000
+Subject: dma-mapping: Allow use of DMA_BIT_MASK(64) in global scope
+
+From: James Clark <james.clark@linaro.org>
+
+[ Upstream commit a50f7456f853ec3a6f07cbe1d16ad8a8b2501320 ]
+
+Clang doesn't like that (1ULL<<(64)) overflows when initializing a
+global scope variable, even if that part of the ternary isn't used when
+n = 64. The same initialization can be done without warnings in function
+scopes, and GCC doesn't mind either way.
+
+The build failure that highlighted this was already fixed in a different
+way [1], which also has detailed links to the Clang issues. However it's
+not going to be long before the same thing happens again, so it's better
+to fix the root cause.
+
+Fix it by using GENMASK_ULL() which does exactly the same thing, is much
+more readable anyway, and doesn't have a shift that overflows.
+
+[1]: https://lore.kernel.org/all/20250918-mmp-pdma-simplify-dma-addressing-v1-1-5c2be2b85696@riscstar.com/
+
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Link: https://lore.kernel.org/r/20251030-james-fix-dma_bit_mask-v1-1-ad1ce7cfab6e@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/dma-mapping.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
+index af3f39ecc1b87..ab400d957754c 100644
+--- a/include/linux/dma-mapping.h
++++ b/include/linux/dma-mapping.h
+@@ -74,7 +74,7 @@
+ */
+ #define DMA_MAPPING_ERROR (~(dma_addr_t)0)
+
+-#define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
++#define DMA_BIT_MASK(n) GENMASK_ULL(n - 1, 0)
+
+ #ifdef CONFIG_DMA_API_DEBUG
+ void debug_dma_mapping_error(struct device *dev, dma_addr_t dma_addr);
+--
+2.51.0
+
--- /dev/null
+From 498bcf5e281e379d53851228f6e763536bafe584 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 14:36:40 -0500
+Subject: drm/vmwgfx: Use kref in vmw_bo_dirty
+
+From: Ian Forbes <ian.forbes@broadcom.com>
+
+[ Upstream commit c1962742ffff7e245f935903a4658eb6f94f6058 ]
+
+Rather than using an ad hoc reference count use kref which is atomic
+and has underflow warnings.
+
+Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://patch.msgid.link/20251030193640.153697-1-ian.forbes@broadcom.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c b/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c
+index 7bc99b1279f7d..09e938498442c 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c
+@@ -50,22 +50,22 @@ enum vmw_bo_dirty_method {
+
+ /**
+ * struct vmw_bo_dirty - Dirty information for buffer objects
++ * @ref_count: Reference count for this structure. Must be first member!
+ * @start: First currently dirty bit
+ * @end: Last currently dirty bit + 1
+ * @method: The currently used dirty method
+ * @change_count: Number of consecutive method change triggers
+- * @ref_count: Reference count for this structure
+ * @bitmap_size: The size of the bitmap in bits. Typically equal to the
+ * nuber of pages in the bo.
+ * @bitmap: A bitmap where each bit represents a page. A set bit means a
+ * dirty page.
+ */
+ struct vmw_bo_dirty {
++ struct kref ref_count;
+ unsigned long start;
+ unsigned long end;
+ enum vmw_bo_dirty_method method;
+ unsigned int change_count;
+- unsigned int ref_count;
+ unsigned long bitmap_size;
+ unsigned long bitmap[];
+ };
+@@ -235,7 +235,7 @@ int vmw_bo_dirty_add(struct vmw_buffer_object *vbo)
+ int ret;
+
+ if (dirty) {
+- dirty->ref_count++;
++ kref_get(&dirty->ref_count);
+ return 0;
+ }
+
+@@ -249,7 +249,7 @@ int vmw_bo_dirty_add(struct vmw_buffer_object *vbo)
+ dirty->bitmap_size = num_pages;
+ dirty->start = dirty->bitmap_size;
+ dirty->end = 0;
+- dirty->ref_count = 1;
++ kref_init(&dirty->ref_count);
+ if (num_pages < PAGE_SIZE / sizeof(pte_t)) {
+ dirty->method = VMW_BO_DIRTY_PAGETABLE;
+ } else {
+@@ -288,10 +288,8 @@ void vmw_bo_dirty_release(struct vmw_buffer_object *vbo)
+ {
+ struct vmw_bo_dirty *dirty = vbo->dirty;
+
+- if (dirty && --dirty->ref_count == 0) {
+- kvfree(dirty);
++ if (dirty && kref_put(&dirty->ref_count, (void *)kvfree))
+ vbo->dirty = NULL;
+- }
+ }
+
+ /**
+--
+2.51.0
+
--- /dev/null
+From 12e2eed91b776bc434a393cecaf2e9126a420a19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Oct 2025 10:50:22 -0700
+Subject: ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct()
+
+From: Song Liu <song@kernel.org>
+
+[ Upstream commit 3e9a18e1c3e931abecf501cbb23d28d69f85bb56 ]
+
+ftrace_hash_ipmodify_enable() checks IPMODIFY and DIRECT ftrace_ops on
+the same kernel function. When needed, ftrace_hash_ipmodify_enable()
+calls ops->ops_func() to prepare the direct ftrace (BPF trampoline) to
+share the same function as the IPMODIFY ftrace (livepatch).
+
+ftrace_hash_ipmodify_enable() is called in register_ftrace_direct() path,
+but not called in modify_ftrace_direct() path. As a result, the following
+operations will break livepatch:
+
+1. Load livepatch to a kernel function;
+2. Attach fentry program to the kernel function;
+3. Attach fexit program to the kernel function.
+
+After 3, the kernel function being used will not be the livepatched
+version, but the original version.
+
+Fix this by adding __ftrace_hash_update_ipmodify() to
+__modify_ftrace_direct() and adjust some logic around the call.
+
+Signed-off-by: Song Liu <song@kernel.org>
+Reviewed-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20251027175023.1521602-3-song@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/ftrace.c | 40 +++++++++++++++++++++++++++++++---------
+ 1 file changed, 31 insertions(+), 9 deletions(-)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index a46e2f32ee5fc..e24906e7fcc5d 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -1895,7 +1895,8 @@ static void ftrace_hash_rec_enable_modify(struct ftrace_ops *ops,
+ */
+ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops,
+ struct ftrace_hash *old_hash,
+- struct ftrace_hash *new_hash)
++ struct ftrace_hash *new_hash,
++ bool update_target)
+ {
+ struct ftrace_page *pg;
+ struct dyn_ftrace *rec, *end = NULL;
+@@ -1930,10 +1931,13 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops,
+ if (rec->flags & FTRACE_FL_DISABLED)
+ continue;
+
+- /* We need to update only differences of filter_hash */
++ /*
++ * Unless we are updating the target of a direct function,
++ * we only need to update differences of filter_hash
++ */
+ in_old = !!ftrace_lookup_ip(old_hash, rec->ip);
+ in_new = !!ftrace_lookup_ip(new_hash, rec->ip);
+- if (in_old == in_new)
++ if (!update_target && (in_old == in_new))
+ continue;
+
+ if (in_new) {
+@@ -1944,7 +1948,16 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops,
+ if (is_ipmodify)
+ goto rollback;
+
+- FTRACE_WARN_ON(rec->flags & FTRACE_FL_DIRECT);
++ /*
++ * If this is called by __modify_ftrace_direct()
++ * then it is only changing where the direct
++ * pointer is jumping to, and the record already
++ * points to a direct trampoline. If it isn't,
++ * then it is a bug to update ipmodify on a direct
++ * caller.
++ */
++ FTRACE_WARN_ON(!update_target &&
++ (rec->flags & FTRACE_FL_DIRECT));
+
+ /*
+ * Another ops with IPMODIFY is already
+@@ -2001,7 +2014,7 @@ static int ftrace_hash_ipmodify_enable(struct ftrace_ops *ops)
+ if (ftrace_hash_empty(hash))
+ hash = NULL;
+
+- return __ftrace_hash_update_ipmodify(ops, EMPTY_HASH, hash);
++ return __ftrace_hash_update_ipmodify(ops, EMPTY_HASH, hash, false);
+ }
+
+ /* Disabling always succeeds */
+@@ -2012,7 +2025,7 @@ static void ftrace_hash_ipmodify_disable(struct ftrace_ops *ops)
+ if (ftrace_hash_empty(hash))
+ hash = NULL;
+
+- __ftrace_hash_update_ipmodify(ops, hash, EMPTY_HASH);
++ __ftrace_hash_update_ipmodify(ops, hash, EMPTY_HASH, false);
+ }
+
+ static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops,
+@@ -2026,7 +2039,7 @@ static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops,
+ if (ftrace_hash_empty(new_hash))
+ new_hash = NULL;
+
+- return __ftrace_hash_update_ipmodify(ops, old_hash, new_hash);
++ return __ftrace_hash_update_ipmodify(ops, old_hash, new_hash, false);
+ }
+
+ static void print_ip_ins(const char *fmt, const unsigned char *p)
+@@ -5736,7 +5749,7 @@ EXPORT_SYMBOL_GPL(unregister_ftrace_direct_multi);
+ static int
+ __modify_ftrace_direct_multi(struct ftrace_ops *ops, unsigned long addr)
+ {
+- struct ftrace_hash *hash;
++ struct ftrace_hash *hash = ops->func_hash->filter_hash;
+ struct ftrace_func_entry *entry, *iter;
+ static struct ftrace_ops tmp_ops = {
+ .func = ftrace_stub,
+@@ -5755,13 +5768,21 @@ __modify_ftrace_direct_multi(struct ftrace_ops *ops, unsigned long addr)
+ if (err)
+ return err;
+
++ /*
++ * Call __ftrace_hash_update_ipmodify() here, so that we can call
++ * ops->ops_func for the ops. This is needed because the above
++ * register_ftrace_function_nolock() worked on tmp_ops.
++ */
++ err = __ftrace_hash_update_ipmodify(ops, hash, hash, true);
++ if (err)
++ goto out;
++
+ /*
+ * Now the ftrace_ops_list_func() is called to do the direct callers.
+ * We can safely change the direct functions attached to each entry.
+ */
+ mutex_lock(&ftrace_lock);
+
+- hash = ops->func_hash->filter_hash;
+ size = 1 << hash->size_bits;
+ for (i = 0; i < size; i++) {
+ hlist_for_each_entry(iter, &hash->buckets[i], hlist) {
+@@ -5774,6 +5795,7 @@ __modify_ftrace_direct_multi(struct ftrace_ops *ops, unsigned long addr)
+
+ mutex_unlock(&ftrace_lock);
+
++out:
+ /* Removing the tmp_ops will add the updated direct callers to the functions */
+ unregister_ftrace_function(&tmp_ops);
+
+--
+2.51.0
+
--- /dev/null
+From 135bf778cbfe1828c04b8917c5cf0a1b8803f0ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Oct 2025 00:37:26 +0800
+Subject: HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list
+
+From: April Grimoire <april@aprilg.moe>
+
+[ Upstream commit 743c81cdc98fd4fef62a89eb70efff994112c2d9 ]
+
+SONiX AK870 PRO keyboard pretends to be an apple keyboard by VID:PID,
+rendering function keys not treated properly. Despite being a
+SONiX USB DEVICE, it uses a different name, so adding it to the list.
+
+Signed-off-by: April Grimoire <april@aprilg.moe>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-apple.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index 76b76b67fa860..2de1a97eafc14 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -320,6 +320,7 @@ static const struct apple_key_translation swapped_fn_leftctrl_keys[] = {
+
+ static const struct apple_non_apple_keyboard non_apple_keyboards[] = {
+ { "SONiX USB DEVICE" },
++ { "SONiX AK870 PRO" },
+ { "Keychron" },
+ { "AONE" },
+ { "GANSS" }
+--
+2.51.0
+
--- /dev/null
+From 8d33d3129bd65a48cdd8a5ba68275d74fda28710 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Nov 2025 21:16:45 +0900
+Subject: HID: elecom: Add support for ELECOM M-XT3URBK (018F)
+
+From: Naoki Ueki <naoki25519@gmail.com>
+
+[ Upstream commit cdcbb8e8d10f656642380ee13516290437b52b36 ]
+
+The ELECOM M-XT3URBK trackball has an additional device ID (0x018F), which
+shares the same report descriptor as the existing device (0x00FB). However,
+the driver does not currently recognize this new ID, resulting in only five
+buttons being functional.
+
+This patch adds the new device ID so that all six buttons work properly.
+
+Signed-off-by: Naoki Ueki <naoki25519@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-elecom.c | 6 ++++--
+ drivers/hid/hid-ids.h | 3 ++-
+ drivers/hid/hid-quirks.c | 3 ++-
+ 3 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c
+index 4fa45ee77503b..f76fec79e8903 100644
+--- a/drivers/hid/hid-elecom.c
++++ b/drivers/hid/hid-elecom.c
+@@ -75,7 +75,8 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ */
+ mouse_button_fixup(hdev, rdesc, *rsize, 20, 28, 22, 14, 8);
+ break;
+- case USB_DEVICE_ID_ELECOM_M_XT3URBK:
++ case USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB:
++ case USB_DEVICE_ID_ELECOM_M_XT3URBK_018F:
+ case USB_DEVICE_ID_ELECOM_M_XT3DRBK:
+ case USB_DEVICE_ID_ELECOM_M_XT4DRBK:
+ /*
+@@ -117,7 +118,8 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ static const struct hid_device_id elecom_devices[] = {
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index a91208c83e46b..524edddd84895 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -439,7 +439,8 @@
+ #define USB_VENDOR_ID_ELECOM 0x056e
+ #define USB_DEVICE_ID_ELECOM_BM084 0x0061
+ #define USB_DEVICE_ID_ELECOM_M_XGL20DLBK 0x00e6
+-#define USB_DEVICE_ID_ELECOM_M_XT3URBK 0x00fb
++#define USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB 0x00fb
++#define USB_DEVICE_ID_ELECOM_M_XT3URBK_018F 0x018f
+ #define USB_DEVICE_ID_ELECOM_M_XT3DRBK 0x00fc
+ #define USB_DEVICE_ID_ELECOM_M_XT4DRBK 0x00fd
+ #define USB_DEVICE_ID_ELECOM_M_DT1URBK 0x00fe
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 960392125ceac..249e626d1c6a3 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -393,7 +393,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ #if IS_ENABLED(CONFIG_HID_ELECOM)
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) },
+--
+2.51.0
+
--- /dev/null
+From 63d01d0e33dc462642db841383ac6f225f58ed27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 14:42:05 +0800
+Subject: LoongArch: Mask all interrupts during kexec/kdump
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit 863a320dc6fd7c855f47da4bb82a8de2d9102ea2 ]
+
+If the default state of the interrupt controllers in the first kernel
+don't mask any interrupts, it may cause the second kernel to potentially
+receive interrupts (which were previously allocated by the first kernel)
+immediately after a CPU becomes online during its boot process. These
+interrupts cannot be properly routed, leading to bad IRQ issues.
+
+This patch calls machine_kexec_mask_interrupts() to mask all interrupts
+during the kexec/kdump process.
+
+Signed-off-by: Tianyang Zhang <zhangtianyang@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/kernel/machine_kexec.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/loongarch/kernel/machine_kexec.c b/arch/loongarch/kernel/machine_kexec.c
+index 30aa420610a06..e50c9a81ff1aa 100644
+--- a/arch/loongarch/kernel/machine_kexec.c
++++ b/arch/loongarch/kernel/machine_kexec.c
+@@ -249,6 +249,7 @@ void machine_crash_shutdown(struct pt_regs *regs)
+ #ifdef CONFIG_SMP
+ crash_smp_send_stop();
+ #endif
++ machine_kexec_mask_interrupts();
+ cpumask_set_cpu(crashing_cpu, &cpus_in_crash);
+
+ pr_info("Starting crashdump kernel...\n");
+@@ -286,6 +287,7 @@ void machine_kexec(struct kimage *image)
+
+ /* We do not want to be bothered. */
+ local_irq_disable();
++ machine_kexec_mask_interrupts();
+
+ pr_notice("EFI boot flag 0x%lx\n", efi_boot);
+ pr_notice("Command line at 0x%lx\n", cmdline_ptr);
+--
+2.51.0
+
--- /dev/null
+From 0f50a16d1fed08e0bb7bd02f87fdc146de681040 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 15:40:41 +0530
+Subject: pinctrl: qcom: msm: Fix deadlock in pinmux configuration
+
+From: Praveen Talari <praveen.talari@oss.qualcomm.com>
+
+[ Upstream commit 1c2e70397b4125022dba80f6111271a37fb36bae ]
+
+Replace disable_irq() with disable_irq_nosync() in msm_pinmux_set_mux()
+to prevent deadlock when wakeup IRQ is triggered on the same
+GPIO being reconfigured.
+
+The issue occurs when a wakeup IRQ is triggered on a GPIO and the IRQ
+handler attempts to reconfigure the same GPIO's pinmux. In this scenario,
+msm_pinmux_set_mux() calls disable_irq() which waits for the currently
+running IRQ handler to complete, creating a circular dependency that
+results in deadlock.
+
+Using disable_irq_nosync() avoids waiting for the IRQ handler to
+complete, preventing the deadlock condition while still properly
+disabling the interrupt during pinmux reconfiguration.
+
+Suggested-by: Prasad Sodagudi <prasad.sodagudi@oss.qualcomm.com>
+Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com>
+Reviewed-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/qcom/pinctrl-msm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
+index 34fc47c5c65aa..4f92078dc689d 100644
+--- a/drivers/pinctrl/qcom/pinctrl-msm.c
++++ b/drivers/pinctrl/qcom/pinctrl-msm.c
+@@ -214,7 +214,7 @@ static int msm_pinmux_set_mux(struct pinctrl_dev *pctldev,
+ */
+ if (d && i != gpio_func &&
+ !test_and_set_bit(d->hwirq, pctrl->disabled_for_mux))
+- disable_irq(irq);
++ disable_irq_nosync(irq);
+
+ raw_spin_lock_irqsave(&pctrl->lock, flags);
+
+--
+2.51.0
+
--- /dev/null
+From c70f3c17dd5ecd4c73fdd4eabf17f71b2ffb05e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 16:59:38 +0100
+Subject: platform/x86: acer-wmi: Ignore backlight event
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 444a9256f8d106e08a6bc2dc8ef28a8699e4b3ba ]
+
+On the Acer Nitro AN515-58, the event 4 - 0 is send by the ACPI
+firmware when the backlight up/down keys are pressed. Ignore this
+event to avoid spamming the kernel log with error messages, as the
+acpi-video driver already handles brightness up/down events.
+
+Reported-by: Bugaddr <Bugaddr@protonmail.com>
+Closes: https://bugaddr.tech/posts/2025-11-16-debugging-the-acer-nitro-5-an515-58-fn-f10-keyboard-backlight-bug-on-linux/#wmi-interface-issues
+Tested-by: Bugaddr <Bugaddr@protonmail.com>
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://patch.msgid.link/20251117155938.3030-1-W_Armin@gmx.de
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/acer-wmi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
+index da765a7dedbc4..46311befc81ae 100644
+--- a/drivers/platform/x86/acer-wmi.c
++++ b/drivers/platform/x86/acer-wmi.c
+@@ -86,6 +86,7 @@ MODULE_ALIAS("wmi:676AA15E-6A47-4D9F-A2CC-1E6D18D14026");
+
+ enum acer_wmi_event_ids {
+ WMID_HOTKEY_EVENT = 0x1,
++ WMID_BACKLIGHT_EVENT = 0x4,
+ WMID_ACCEL_OR_KBD_DOCK_EVENT = 0x5,
+ WMID_GAMING_TURBO_KEY_EVENT = 0x7,
+ WMID_AC_EVENT = 0x8,
+@@ -1992,6 +1993,9 @@ static void acer_wmi_notify(u32 value, void *context)
+ sparse_keymap_report_event(acer_wmi_input_dev, scancode, 1, true);
+ }
+ break;
++ case WMID_BACKLIGHT_EVENT:
++ /* Already handled by acpi-video */
++ break;
+ case WMID_ACCEL_OR_KBD_DOCK_EVENT:
+ acer_gsensor_event();
+ acer_kbd_dock_event(&return_value);
+--
+2.51.0
+
--- /dev/null
+From a87827a3960e8d906066d629d7ddd7415843f77c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Oct 2025 05:18:38 +0000
+Subject: platform/x86: huawei-wmi: add keys for HONOR models
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jia Ston <ston.jia@outlook.com>
+
+[ Upstream commit 5c72329716d0858621021193330594d5d26bf44d ]
+
+HONOR MagicBook X16/X14 models produced in 2025 cannot use the Print
+Screen and YOYO keys properly, with the system reporting them as
+unknown key presses (codes: 0x028b and 0x028e).
+
+To resolve this, a key_entry is added for both the HONOR Print Screen
+key and the HONOR YOYO key, ensuring they function correctly on these
+models.
+
+Signed-off-by: Ston Jia <ston.jia@outlook.com>
+Link: https://patch.msgid.link/20251029051804.220111-1-ston.jia@outlook.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/huawei-wmi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/platform/x86/huawei-wmi.c b/drivers/platform/x86/huawei-wmi.c
+index ae5daecff1771..201e1f2e2c2f0 100644
+--- a/drivers/platform/x86/huawei-wmi.c
++++ b/drivers/platform/x86/huawei-wmi.c
+@@ -82,6 +82,10 @@ static const struct key_entry huawei_wmi_keymap[] = {
+ { KE_KEY, 0x289, { KEY_WLAN } },
+ // Huawei |M| key
+ { KE_KEY, 0x28a, { KEY_CONFIG } },
++ // HONOR YOYO key
++ { KE_KEY, 0x28b, { KEY_NOTIFICATION_CENTER } },
++ // HONOR print screen
++ { KE_KEY, 0x28e, { KEY_PRINT } },
+ // Keyboard backlit
+ { KE_IGNORE, 0x293, { KEY_KBDILLUMTOGGLE } },
+ { KE_IGNORE, 0x294, { KEY_KBDILLUMUP } },
+--
+2.51.0
+
--- /dev/null
+From a93238837093ee768de9616e4ff14ddf6eb89908 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 09:29:02 -0800
+Subject: samples: work around glibc redefining some of our defines wrong
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit a48f822908982353c3256e35a089e9e7d0d61580 ]
+
+Apparently as of version 2.42, glibc headers define AT_RENAME_NOREPLACE
+and some of the other flags for renameat2() and friends in <stdio.h>.
+
+Which would all be fine, except for inexplicable reasons glibc decided
+to define them _differently_ from the kernel definitions, which then
+makes some of our sample code that includes both kernel headers and user
+space headers unhappy, because the compiler will (correctly) complain
+about redefining things.
+
+Now, mixing kernel headers and user space headers is always a somewhat
+iffy proposition due to namespacing issues, but it's kind of inevitable
+in our sample and selftest code. And this is just glibc being stupid.
+
+Those defines come from the kernel, glibc is exposing the kernel
+interfaces, and glibc shouldn't make up some random new expressions for
+these values.
+
+It's not like glibc headers changed the actual result values, but they
+arbitrarily just decided to use a different expression to describe those
+values. The kernel just does
+
+ #define AT_RENAME_NOREPLACE 0x0001
+
+while glibc does
+
+ # define RENAME_NOREPLACE (1 << 0)
+ # define AT_RENAME_NOREPLACE RENAME_NOREPLACE
+
+instead. Same value in the end, but very different macro definition.
+
+For absolutely no reason.
+
+This has since been fixed in the glibc development tree, so eventually
+we'll end up with the canonical expressions and no clashes. But in the
+meantime the broken headers are in the glibc-2.42 release and have made
+it out into distributions.
+
+Do a minimal work-around to make the samples build cleanly by just
+undefining the affected macros in between the user space header include
+and the kernel header includes.
+
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/vfs/test-statx.c | 6 ++++++
+ samples/watch_queue/watch_test.c | 6 ++++++
+ 2 files changed, 12 insertions(+)
+
+diff --git a/samples/vfs/test-statx.c b/samples/vfs/test-statx.c
+index 49c7a46cee073..424a6fa15723c 100644
+--- a/samples/vfs/test-statx.c
++++ b/samples/vfs/test-statx.c
+@@ -19,6 +19,12 @@
+ #include <time.h>
+ #include <sys/syscall.h>
+ #include <sys/types.h>
++
++// Work around glibc header silliness
++#undef AT_RENAME_NOREPLACE
++#undef AT_RENAME_EXCHANGE
++#undef AT_RENAME_WHITEOUT
++
+ #include <linux/stat.h>
+ #include <linux/fcntl.h>
+ #define statx foo
+diff --git a/samples/watch_queue/watch_test.c b/samples/watch_queue/watch_test.c
+index 8c6cb57d5cfc5..24cf7d7a19725 100644
+--- a/samples/watch_queue/watch_test.c
++++ b/samples/watch_queue/watch_test.c
+@@ -16,6 +16,12 @@
+ #include <errno.h>
+ #include <sys/ioctl.h>
+ #include <limits.h>
++
++// Work around glibc header silliness
++#undef AT_RENAME_NOREPLACE
++#undef AT_RENAME_EXCHANGE
++#undef AT_RENAME_WHITEOUT
++
+ #include <linux/watch_queue.h>
+ #include <linux/unistd.h>
+ #include <linux/keyctl.h>
+--
+2.51.0
+
xfrm-flush-all-states-in-xfrm_state_fini.patch
leds-replace-all-non-returning-strlcpy-with-strscpy.patch
leds-spi-byte-use-devm_led_classdev_register_ext.patch
+ftrace-bpf-fix-ipmodify-direct-in-modify_ftrace_dire.patch
+spi-xilinx-increase-number-of-retries-before-declari.patch
+spi-imx-keep-dma-request-disabled-before-dma-transfe.patch
+dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch
+drm-vmwgfx-use-kref-in-vmw_bo_dirty.patch
+smb-fix-invalid-username-check-in-smb3_fs_context_pa.patch
+alsa-usb-audio-add-native-dsd-quirks-for-pureaudio-d.patch
+bfs-reconstruct-file-type-when-loading-from-disk.patch
+pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch
+platform-x86-acer-wmi-ignore-backlight-event.patch
+hid-apple-add-sonix-ak870-pro-to-non_apple_keyboards.patch
+platform-x86-huawei-wmi-add-keys-for-honor-models.patch
+hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch
+loongarch-mask-all-interrupts-during-kexec-kdump.patch
+samples-work-around-glibc-redefining-some-of-our-def.patch
--- /dev/null
+From b09a7694af1b8cccb21427df34e2d6fe08326487 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Nov 2025 15:05:39 +0800
+Subject: smb: fix invalid username check in smb3_fs_context_parse_param()
+
+From: Yiqi Sun <sunyiqixm@gmail.com>
+
+[ Upstream commit ed6612165b74f09db00ef0abaf9831895ab28b7f ]
+
+Since the maximum return value of strnlen(..., CIFS_MAX_USERNAME_LEN)
+is CIFS_MAX_USERNAME_LEN, length check in smb3_fs_context_parse_param()
+is always FALSE and invalid.
+
+Fix the comparison in if statement.
+
+Signed-off-by: Yiqi Sun <sunyiqixm@gmail.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/fs_context.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c
+index e6d2e4162b081..9000299e98cb4 100644
+--- a/fs/smb/client/fs_context.c
++++ b/fs/smb/client/fs_context.c
+@@ -1183,7 +1183,7 @@ static int smb3_fs_context_parse_param(struct fs_context *fc,
+ break;
+ }
+
+- if (strnlen(param->string, CIFS_MAX_USERNAME_LEN) >
++ if (strnlen(param->string, CIFS_MAX_USERNAME_LEN) ==
+ CIFS_MAX_USERNAME_LEN) {
+ pr_warn("username too long\n");
+ goto cifs_parse_mount_err;
+--
+2.51.0
+
--- /dev/null
+From 3b44054ac061bd9f2504e32443e05fe48bc36755 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Oct 2025 13:53:20 +0800
+Subject: spi: imx: keep dma request disabled before dma transfer setup
+
+From: Robin Gong <yibin.gong@nxp.com>
+
+[ Upstream commit 86d57d9c07d54e8cb385ffe800930816ccdba0c1 ]
+
+Since sdma hardware configure postpone to transfer phase, have to disable
+dma request before dma transfer setup because there is a hardware
+limitation on sdma event enable(ENBLn) as below:
+
+"It is thus essential for the Arm platform to program them before any DMA
+ request is triggered to the SDMA, otherwise an unpredictable combination
+ of channels may be started."
+
+Signed-off-by: Carlos Song <carlos.song@nxp.com>
+Signed-off-by: Robin Gong <yibin.gong@nxp.com>
+Link: https://patch.msgid.link/20251024055320.408482-1-carlos.song@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-imx.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index 13a6ebef01894..e929a5af38eea 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -503,9 +503,15 @@ static void mx51_ecspi_trigger(struct spi_imx_data *spi_imx)
+ {
+ u32 reg;
+
+- reg = readl(spi_imx->base + MX51_ECSPI_CTRL);
+- reg |= MX51_ECSPI_CTRL_XCH;
+- writel(reg, spi_imx->base + MX51_ECSPI_CTRL);
++ if (spi_imx->usedma) {
++ reg = readl(spi_imx->base + MX51_ECSPI_DMA);
++ reg |= MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN;
++ writel(reg, spi_imx->base + MX51_ECSPI_DMA);
++ } else {
++ reg = readl(spi_imx->base + MX51_ECSPI_CTRL);
++ reg |= MX51_ECSPI_CTRL_XCH;
++ writel(reg, spi_imx->base + MX51_ECSPI_CTRL);
++ }
+ }
+
+ static void mx51_disable_dma(struct spi_imx_data *spi_imx)
+@@ -689,7 +695,6 @@ static void mx51_setup_wml(struct spi_imx_data *spi_imx)
+ writel(MX51_ECSPI_DMA_RX_WML(spi_imx->wml - 1) |
+ MX51_ECSPI_DMA_TX_WML(tx_wml) |
+ MX51_ECSPI_DMA_RXT_WML(spi_imx->wml) |
+- MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN |
+ MX51_ECSPI_DMA_RXTDEN, spi_imx->base + MX51_ECSPI_DMA);
+ }
+
+@@ -1449,6 +1454,8 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx,
+ reinit_completion(&spi_imx->dma_tx_completion);
+ dma_async_issue_pending(controller->dma_tx);
+
++ spi_imx->devtype_data->trigger(spi_imx);
++
+ transfer_timeout = spi_imx_calculate_timeout(spi_imx, transfer->len);
+
+ /* Wait SDMA to finish the data transfer.*/
+--
+2.51.0
+
--- /dev/null
+From f8a9f82cdff71b324c5b85889d7ee24a1da2f2b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Nov 2025 14:45:35 +0100
+Subject: spi: xilinx: increase number of retries before declaring stall
+
+From: Alvaro Gamez Machado <alvaro.gamez@hazent.com>
+
+[ Upstream commit 939edfaa10f1d22e6af6a84bf4bd96dc49c67302 ]
+
+SPI devices using a (relative) slow frequency need a larger time.
+
+For instance, microblaze running at 83.25MHz and performing a
+3 bytes transaction using a 10MHz/16 = 625kHz needed this stall
+value increased to at least 20. The SPI device is quite slow, but
+also is the microblaze, so set this value to 32 to give it even
+more margin.
+
+Signed-off-by: Alvaro Gamez Machado <alvaro.gamez@hazent.com>
+Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
+Link: https://patch.msgid.link/20251106134545.31942-1-alvaro.gamez@hazent.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-xilinx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c
+index 7377d3b813022..8e2ed8a068ca2 100644
+--- a/drivers/spi/spi-xilinx.c
++++ b/drivers/spi/spi-xilinx.c
+@@ -298,7 +298,7 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)
+
+ /* Read out all the data from the Rx FIFO */
+ rx_words = n_words;
+- stalled = 10;
++ stalled = 32;
+ while (rx_words) {
+ if (rx_words == n_words && !(stalled--) &&
+ !(sr & XSPI_SR_TX_EMPTY_MASK) &&
+--
+2.51.0
+
--- /dev/null
+From 4bb06f09739d439dab9a887ccdfca8d4d245dcad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Nov 2025 13:20:53 +0800
+Subject: ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series
+
+From: Lushih Hsieh <bruce@mail.kh.edu.tw>
+
+[ Upstream commit 21a9ab5b90b3716a631d559e62818029b4e7f5b7 ]
+
+The PureAudio APA DAC and Lotus DAC5 series are USB Audio
+2.0 Class devices that support native Direct Stream Digital (DSD)
+playback via specific vendor protocols.
+
+Without these quirks, the devices may only function in standard
+PCM mode, or fail to correctly report their DSD format capabilities
+to the ALSA framework, preventing native DSD playback under Linux.
+
+This commit adds new quirk entries for the mentioned DAC models
+based on their respective Vendor/Product IDs (VID:PID), for example:
+0x16d0:0x0ab1 (APA DAC), 0x16d0:0xeca1 (DAC5 series), etc.
+
+The quirk ensures correct DSD format handling by setting the required
+SNDRV_PCM_FMTBIT_DSD_U32_BE format bit and defining the DSD-specific
+Audio Class 2.0 (AC2.0) endpoint configurations. This allows the ALSA
+DSD API to correctly address the device for high-bitrate DSD streams,
+bypassing the need for DoP (DSD over PCM).
+
+Test on APA DAC and Lotus DAC5 SE under Arch Linux.
+
+Tested-by: Lushih Hsieh <bruce@mail.kh.edu.tw>
+Signed-off-by: Lushih Hsieh <bruce@mail.kh.edu.tw>
+Link: https://patch.msgid.link/20251114052053.54989-1-bruce@mail.kh.edu.tw
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/quirks.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 5ebd4670b4a06..a74bb3a2f9e03 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -2022,6 +2022,8 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ case USB_ID(0x16d0, 0x09d8): /* NuPrime IDA-8 */
+ case USB_ID(0x16d0, 0x09db): /* NuPrime Audio DAC-9 */
+ case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */
++ case USB_ID(0x16d0, 0x0ab1): /* PureAudio APA DAC */
++ case USB_ID(0x16d0, 0xeca1): /* PureAudio Lotus DAC5, DAC5 SE, DAC5 Pro */
+ case USB_ID(0x1db5, 0x0003): /* Bryston BDA3 */
+ case USB_ID(0x20a0, 0x4143): /* WaveIO USB Audio 2.0 */
+ case USB_ID(0x22e1, 0xca01): /* HDTA Serenade DSD */
+@@ -2289,6 +2291,10 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
+ QUIRK_FLAG_IGNORE_CLOCK_SOURCE),
+ DEVICE_FLG(0x1686, 0x00dd, /* Zoom R16/24 */
+ QUIRK_FLAG_TX_LENGTH | QUIRK_FLAG_CTL_MSG_DELAY_1M),
++ DEVICE_FLG(0x16d0, 0x0ab1, /* PureAudio APA DAC */
++ QUIRK_FLAG_DSD_RAW),
++ DEVICE_FLG(0x16d0, 0xeca1, /* PureAudio Lotus DAC5, DAC5 SE and DAC5 Pro */
++ QUIRK_FLAG_DSD_RAW),
+ DEVICE_FLG(0x17aa, 0x1046, /* Lenovo ThinkStation P620 Rear Line-in, Line-out and Microphone */
+ QUIRK_FLAG_DISABLE_AUTOSUSPEND),
+ DEVICE_FLG(0x17aa, 0x104d, /* Lenovo ThinkStation P620 Internal Speaker + Front Headset */
+--
+2.51.0
+
--- /dev/null
+From a822ed737fe9906dbcd5861d3c55414bf2df9fad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Oct 2025 22:25:49 +0900
+Subject: bfs: Reconstruct file type when loading from disk
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit 34ab4c75588c07cca12884f2bf6b0347c7a13872 ]
+
+syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when
+the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted
+or when the 32bits "attributes" field loaded from disk are corrupted.
+
+A documentation says that BFS uses only lower 9 bits of the "mode" field.
+But I can't find an explicit explanation that the unused upper 23 bits
+(especially, the S_IFMT bits) are initialized with 0.
+
+Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk.
+Also, verify that the value of the "attributes" field loaded from disk is
+either BFS_VREG or BFS_VDIR (because BFS supports only regular files and
+the root directory).
+
+Reported-by: syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Link: https://patch.msgid.link/fabce673-d5b9-4038-8287-0fd65d80203b@I-love.SAKURA.ne.jp
+Reviewed-by: Tigran Aivazian <aivazian.tigran@gmail.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/bfs/inode.c | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c
+index db81570c96375..ecf7f74779c6a 100644
+--- a/fs/bfs/inode.c
++++ b/fs/bfs/inode.c
+@@ -60,7 +60,19 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino)
+ off = (ino - BFS_ROOT_INO) % BFS_INODES_PER_BLOCK;
+ di = (struct bfs_inode *)bh->b_data + off;
+
+- inode->i_mode = 0x0000FFFF & le32_to_cpu(di->i_mode);
++ /*
++ * https://martin.hinner.info/fs/bfs/bfs-structure.html explains that
++ * BFS in SCO UnixWare environment used only lower 9 bits of di->i_mode
++ * value. This means that, although bfs_write_inode() saves whole
++ * inode->i_mode bits (which include S_IFMT bits and S_IS{UID,GID,VTX}
++ * bits), middle 7 bits of di->i_mode value can be garbage when these
++ * bits were not saved by bfs_write_inode().
++ * Since we can't tell whether middle 7 bits are garbage, use only
++ * lower 12 bits (i.e. tolerate S_IS{UID,GID,VTX} bits possibly being
++ * garbage) and reconstruct S_IFMT bits for Linux environment from
++ * di->i_vtype value.
++ */
++ inode->i_mode = 0x00000FFF & le32_to_cpu(di->i_mode);
+ if (le32_to_cpu(di->i_vtype) == BFS_VDIR) {
+ inode->i_mode |= S_IFDIR;
+ inode->i_op = &bfs_dir_inops;
+@@ -70,6 +82,11 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino)
+ inode->i_op = &bfs_file_inops;
+ inode->i_fop = &bfs_file_operations;
+ inode->i_mapping->a_ops = &bfs_aops;
++ } else {
++ brelse(bh);
++ printf("Unknown vtype=%u %s:%08lx\n",
++ le32_to_cpu(di->i_vtype), inode->i_sb->s_id, ino);
++ goto error;
+ }
+
+ BFS_I(inode)->i_sblock = le32_to_cpu(di->i_sblock);
+--
+2.51.0
+
--- /dev/null
+From 47cf1b579261c19c923d2a503f26c9fd17be030d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Nov 2025 20:02:04 +0800
+Subject: Bluetooth: btrtl: Avoid loading the config file on security chips
+
+From: Max Chou <max.chou@realtek.com>
+
+[ Upstream commit cd8dbd9ef600435439bb0e70af0a1d9e2193aecb ]
+
+For chips with security enabled, it's only possible to load firmware
+with a valid signature pattern.
+If key_id is not zero, it indicates a security chip, and the driver will
+not load the config file.
+
+- Example log for a security chip.
+
+Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a
+ lmp_ver=0c lmp_subver=8922
+Bluetooth: hci0: RTL: rom_version status=0 version=1
+Bluetooth: hci0: RTL: btrtl_initialize: key id 1
+Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin
+Bluetooth: hci0: RTL: cfg_sz 0, total sz 71301
+Bluetooth: hci0: RTL: fw version 0x41c0c905
+
+- Example log for a normal chip.
+
+Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a
+ lmp_ver=0c lmp_subver=8922
+Bluetooth: hci0: RTL: rom_version status=0 version=1
+Bluetooth: hci0: RTL: btrtl_initialize: key id 0
+Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin
+Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_config.bin
+Bluetooth: hci0: RTL: cfg_sz 6, total sz 71307
+Bluetooth: hci0: RTL: fw version 0x41c0c905
+
+Tested-by: Hilda Wu <hildawu@realtek.com>
+Signed-off-by: Nial Ni <niall_ni@realsil.com.cn>
+Signed-off-by: Max Chou <max.chou@realtek.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btrtl.c | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
+index c4431c5976b40..5e332b30696f6 100644
+--- a/drivers/bluetooth/btrtl.c
++++ b/drivers/bluetooth/btrtl.c
+@@ -50,7 +50,7 @@
+
+ #define RTL_CHIP_SUBVER (&(struct rtl_vendor_cmd) {{0x10, 0x38, 0x04, 0x28, 0x80}})
+ #define RTL_CHIP_REV (&(struct rtl_vendor_cmd) {{0x10, 0x3A, 0x04, 0x28, 0x80}})
+-#define RTL_SEC_PROJ (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0x0D, 0x00, 0xb0}})
++#define RTL_SEC_PROJ (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0xAD, 0x00, 0xb0}})
+
+ #define RTL_PATCH_SNIPPETS 0x01
+ #define RTL_PATCH_DUMMY_HEADER 0x02
+@@ -534,7 +534,6 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev,
+ {
+ struct rtl_epatch_header_v2 *hdr;
+ int rc;
+- u8 reg_val[2];
+ u8 key_id;
+ u32 num_sections;
+ struct rtl_section *section;
+@@ -549,14 +548,7 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev,
+ .len = btrtl_dev->fw_len - 7, /* Cut the tail */
+ };
+
+- rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val);
+- if (rc < 0)
+- return -EIO;
+- key_id = reg_val[0];
+-
+- rtl_dev_dbg(hdev, "%s: key id %u", __func__, key_id);
+-
+- btrtl_dev->key_id = key_id;
++ key_id = btrtl_dev->key_id;
+
+ hdr = rtl_iov_pull_data(&iov, sizeof(*hdr));
+ if (!hdr)
+@@ -1070,6 +1062,8 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
+ u16 hci_rev, lmp_subver;
+ u8 hci_ver, lmp_ver, chip_type = 0;
+ int ret;
++ int rc;
++ u8 key_id;
+ u8 reg_val[2];
+
+ btrtl_dev = kzalloc(sizeof(*btrtl_dev), GFP_KERNEL);
+@@ -1180,6 +1174,14 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
+ goto err_free;
+ }
+
++ rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val);
++ if (rc < 0)
++ goto err_free;
++
++ key_id = reg_val[0];
++ btrtl_dev->key_id = key_id;
++ rtl_dev_info(hdev, "%s: key id %u", __func__, key_id);
++
+ btrtl_dev->fw_len = -EIO;
+ if (lmp_subver == RTL_ROM_LMP_8852A && hci_rev == 0x000c) {
+ snprintf(fw_name, sizeof(fw_name), "%s_v2.bin",
+@@ -1202,7 +1204,7 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
+ goto err_free;
+ }
+
+- if (btrtl_dev->ic_info->cfg_name) {
++ if (btrtl_dev->ic_info->cfg_name && !btrtl_dev->key_id) {
+ if (postfix) {
+ snprintf(cfg_name, sizeof(cfg_name), "%s-%s.bin",
+ btrtl_dev->ic_info->cfg_name, postfix);
+--
+2.51.0
+
--- /dev/null
+From 9aeb742f7c35afc0e97bc1ede3ce1523f745ff99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 14:05:27 +0000
+Subject: dma-mapping: Allow use of DMA_BIT_MASK(64) in global scope
+
+From: James Clark <james.clark@linaro.org>
+
+[ Upstream commit a50f7456f853ec3a6f07cbe1d16ad8a8b2501320 ]
+
+Clang doesn't like that (1ULL<<(64)) overflows when initializing a
+global scope variable, even if that part of the ternary isn't used when
+n = 64. The same initialization can be done without warnings in function
+scopes, and GCC doesn't mind either way.
+
+The build failure that highlighted this was already fixed in a different
+way [1], which also has detailed links to the Clang issues. However it's
+not going to be long before the same thing happens again, so it's better
+to fix the root cause.
+
+Fix it by using GENMASK_ULL() which does exactly the same thing, is much
+more readable anyway, and doesn't have a shift that overflows.
+
+[1]: https://lore.kernel.org/all/20250918-mmp-pdma-simplify-dma-addressing-v1-1-5c2be2b85696@riscstar.com/
+
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Link: https://lore.kernel.org/r/20251030-james-fix-dma_bit_mask-v1-1-ad1ce7cfab6e@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/dma-mapping.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
+index 22b9099927fad..803f64e169c59 100644
+--- a/include/linux/dma-mapping.h
++++ b/include/linux/dma-mapping.h
+@@ -74,7 +74,7 @@
+ */
+ #define DMA_MAPPING_ERROR (~(dma_addr_t)0)
+
+-#define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
++#define DMA_BIT_MASK(n) GENMASK_ULL(n - 1, 0)
+
+ #ifdef CONFIG_DMA_API_DEBUG
+ void debug_dma_mapping_error(struct device *dev, dma_addr_t dma_addr);
+--
+2.51.0
+
--- /dev/null
+From a0afd9f96da8ce0e4f632e090e4fe54f178b4f05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Oct 2025 14:37:07 -0400
+Subject: drm/amdkfd: Fix GPU mappings for APU after prefetch
+
+From: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+
+[ Upstream commit eac32ff42393efa6657efc821231b8d802c1d485 ]
+
+Fix the following corner case:-
+ Consider a 2M huge page SVM allocation, followed by prefetch call for
+the first 4K page. The whole range is initially mapped with single PTE.
+After the prefetch, this range gets split to first page + rest of the
+pages. Currently, the first page mapping is not updated on MI300A (APU)
+since page hasn't migrated. However, after range split PTE mapping it not
+valid.
+
+Fix this by forcing page table update for the whole range when prefetch
+is called. Calling prefetch on APU doesn't improve performance. If all
+it deteriotes. However, functionality has to be supported.
+
+v2: Use apu_prefer_gtt as this issue doesn't apply to APUs with carveout
+VRAM
+
+v3: Simplify by setting the flag for all ASICs as it doesn't affect dGPU
+
+v4: Remove v2 and v3 changes. Force update_mapping when range is split
+at a size that is not aligned to prange granularity
+
+Suggested-by: Philip Yang <Philip.Yang@amd.com>
+Signed-off-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Reviewed-by: Philip Yang<Philip.Yang@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 076470b9f6f8d9c7c8ca73a9f054942a686f9ba7)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+index 0d950a20741d8..99ce4fe5eb170 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+@@ -3675,6 +3675,8 @@ svm_range_set_attr(struct kfd_process *p, struct mm_struct *mm,
+ svm_range_apply_attrs(p, prange, nattr, attrs, &update_mapping);
+ /* TODO: unmap ranges from GPU that lost access */
+ }
++ update_mapping |= !p->xnack_enabled && !list_empty(&remap_list);
++
+ list_for_each_entry_safe(prange, next, &remove_list, update_list) {
+ pr_debug("unlink old 0x%p prange 0x%p [0x%lx 0x%lx]\n",
+ prange->svms, prange, prange->start,
+--
+2.51.0
+
--- /dev/null
+From 0efa6b657cc441f76fdf6d4faa9631659541977d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 14:36:40 -0500
+Subject: drm/vmwgfx: Use kref in vmw_bo_dirty
+
+From: Ian Forbes <ian.forbes@broadcom.com>
+
+[ Upstream commit c1962742ffff7e245f935903a4658eb6f94f6058 ]
+
+Rather than using an ad hoc reference count use kref which is atomic
+and has underflow warnings.
+
+Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://patch.msgid.link/20251030193640.153697-1-ian.forbes@broadcom.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c b/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c
+index 74ff2812d66a1..de2498749e276 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c
+@@ -51,22 +51,22 @@ enum vmw_bo_dirty_method {
+
+ /**
+ * struct vmw_bo_dirty - Dirty information for buffer objects
++ * @ref_count: Reference count for this structure. Must be first member!
+ * @start: First currently dirty bit
+ * @end: Last currently dirty bit + 1
+ * @method: The currently used dirty method
+ * @change_count: Number of consecutive method change triggers
+- * @ref_count: Reference count for this structure
+ * @bitmap_size: The size of the bitmap in bits. Typically equal to the
+ * nuber of pages in the bo.
+ * @bitmap: A bitmap where each bit represents a page. A set bit means a
+ * dirty page.
+ */
+ struct vmw_bo_dirty {
++ struct kref ref_count;
+ unsigned long start;
+ unsigned long end;
+ enum vmw_bo_dirty_method method;
+ unsigned int change_count;
+- unsigned int ref_count;
+ unsigned long bitmap_size;
+ unsigned long bitmap[];
+ };
+@@ -235,7 +235,7 @@ int vmw_bo_dirty_add(struct vmw_bo *vbo)
+ int ret;
+
+ if (dirty) {
+- dirty->ref_count++;
++ kref_get(&dirty->ref_count);
+ return 0;
+ }
+
+@@ -249,7 +249,7 @@ int vmw_bo_dirty_add(struct vmw_bo *vbo)
+ dirty->bitmap_size = num_pages;
+ dirty->start = dirty->bitmap_size;
+ dirty->end = 0;
+- dirty->ref_count = 1;
++ kref_init(&dirty->ref_count);
+ if (num_pages < PAGE_SIZE / sizeof(pte_t)) {
+ dirty->method = VMW_BO_DIRTY_PAGETABLE;
+ } else {
+@@ -288,10 +288,8 @@ void vmw_bo_dirty_release(struct vmw_bo *vbo)
+ {
+ struct vmw_bo_dirty *dirty = vbo->dirty;
+
+- if (dirty && --dirty->ref_count == 0) {
+- kvfree(dirty);
++ if (dirty && kref_put(&dirty->ref_count, (void *)kvfree))
+ vbo->dirty = NULL;
+- }
+ }
+
+ /**
+--
+2.51.0
+
--- /dev/null
+From 828cc6365285ec3517b4642357aaaa0db78267ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Oct 2025 10:50:22 -0700
+Subject: ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct()
+
+From: Song Liu <song@kernel.org>
+
+[ Upstream commit 3e9a18e1c3e931abecf501cbb23d28d69f85bb56 ]
+
+ftrace_hash_ipmodify_enable() checks IPMODIFY and DIRECT ftrace_ops on
+the same kernel function. When needed, ftrace_hash_ipmodify_enable()
+calls ops->ops_func() to prepare the direct ftrace (BPF trampoline) to
+share the same function as the IPMODIFY ftrace (livepatch).
+
+ftrace_hash_ipmodify_enable() is called in register_ftrace_direct() path,
+but not called in modify_ftrace_direct() path. As a result, the following
+operations will break livepatch:
+
+1. Load livepatch to a kernel function;
+2. Attach fentry program to the kernel function;
+3. Attach fexit program to the kernel function.
+
+After 3, the kernel function being used will not be the livepatched
+version, but the original version.
+
+Fix this by adding __ftrace_hash_update_ipmodify() to
+__modify_ftrace_direct() and adjust some logic around the call.
+
+Signed-off-by: Song Liu <song@kernel.org>
+Reviewed-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20251027175023.1521602-3-song@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/ftrace.c | 40 +++++++++++++++++++++++++++++++---------
+ 1 file changed, 31 insertions(+), 9 deletions(-)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 1f61b36bc4803..b2442aabccfd0 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -1969,7 +1969,8 @@ static void ftrace_hash_rec_enable_modify(struct ftrace_ops *ops)
+ */
+ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops,
+ struct ftrace_hash *old_hash,
+- struct ftrace_hash *new_hash)
++ struct ftrace_hash *new_hash,
++ bool update_target)
+ {
+ struct ftrace_page *pg;
+ struct dyn_ftrace *rec, *end = NULL;
+@@ -2004,10 +2005,13 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops,
+ if (rec->flags & FTRACE_FL_DISABLED)
+ continue;
+
+- /* We need to update only differences of filter_hash */
++ /*
++ * Unless we are updating the target of a direct function,
++ * we only need to update differences of filter_hash
++ */
+ in_old = !!ftrace_lookup_ip(old_hash, rec->ip);
+ in_new = !!ftrace_lookup_ip(new_hash, rec->ip);
+- if (in_old == in_new)
++ if (!update_target && (in_old == in_new))
+ continue;
+
+ if (in_new) {
+@@ -2018,7 +2022,16 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops,
+ if (is_ipmodify)
+ goto rollback;
+
+- FTRACE_WARN_ON(rec->flags & FTRACE_FL_DIRECT);
++ /*
++ * If this is called by __modify_ftrace_direct()
++ * then it is only changing where the direct
++ * pointer is jumping to, and the record already
++ * points to a direct trampoline. If it isn't,
++ * then it is a bug to update ipmodify on a direct
++ * caller.
++ */
++ FTRACE_WARN_ON(!update_target &&
++ (rec->flags & FTRACE_FL_DIRECT));
+
+ /*
+ * Another ops with IPMODIFY is already
+@@ -2075,7 +2088,7 @@ static int ftrace_hash_ipmodify_enable(struct ftrace_ops *ops)
+ if (ftrace_hash_empty(hash))
+ hash = NULL;
+
+- return __ftrace_hash_update_ipmodify(ops, EMPTY_HASH, hash);
++ return __ftrace_hash_update_ipmodify(ops, EMPTY_HASH, hash, false);
+ }
+
+ /* Disabling always succeeds */
+@@ -2086,7 +2099,7 @@ static void ftrace_hash_ipmodify_disable(struct ftrace_ops *ops)
+ if (ftrace_hash_empty(hash))
+ hash = NULL;
+
+- __ftrace_hash_update_ipmodify(ops, hash, EMPTY_HASH);
++ __ftrace_hash_update_ipmodify(ops, hash, EMPTY_HASH, false);
+ }
+
+ static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops,
+@@ -2100,7 +2113,7 @@ static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops,
+ if (ftrace_hash_empty(new_hash))
+ new_hash = NULL;
+
+- return __ftrace_hash_update_ipmodify(ops, old_hash, new_hash);
++ return __ftrace_hash_update_ipmodify(ops, old_hash, new_hash, false);
+ }
+
+ static void print_ip_ins(const char *fmt, const unsigned char *p)
+@@ -6055,7 +6068,7 @@ EXPORT_SYMBOL_GPL(unregister_ftrace_direct);
+ static int
+ __modify_ftrace_direct(struct ftrace_ops *ops, unsigned long addr)
+ {
+- struct ftrace_hash *hash;
++ struct ftrace_hash *hash = ops->func_hash->filter_hash;
+ struct ftrace_func_entry *entry, *iter;
+ static struct ftrace_ops tmp_ops = {
+ .func = ftrace_stub,
+@@ -6075,13 +6088,21 @@ __modify_ftrace_direct(struct ftrace_ops *ops, unsigned long addr)
+ if (err)
+ return err;
+
++ /*
++ * Call __ftrace_hash_update_ipmodify() here, so that we can call
++ * ops->ops_func for the ops. This is needed because the above
++ * register_ftrace_function_nolock() worked on tmp_ops.
++ */
++ err = __ftrace_hash_update_ipmodify(ops, hash, hash, true);
++ if (err)
++ goto out;
++
+ /*
+ * Now the ftrace_ops_list_func() is called to do the direct callers.
+ * We can safely change the direct functions attached to each entry.
+ */
+ mutex_lock(&ftrace_lock);
+
+- hash = ops->func_hash->filter_hash;
+ size = 1 << hash->size_bits;
+ for (i = 0; i < size; i++) {
+ hlist_for_each_entry(iter, &hash->buckets[i], hlist) {
+@@ -6096,6 +6117,7 @@ __modify_ftrace_direct(struct ftrace_ops *ops, unsigned long addr)
+
+ mutex_unlock(&ftrace_lock);
+
++out:
+ /* Removing the tmp_ops will add the updated direct callers to the functions */
+ unregister_ftrace_function(&tmp_ops);
+
+--
+2.51.0
+
--- /dev/null
+From d31719a0f80bcbd27d92062721afb7367d1a8b92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Oct 2025 00:37:26 +0800
+Subject: HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list
+
+From: April Grimoire <april@aprilg.moe>
+
+[ Upstream commit 743c81cdc98fd4fef62a89eb70efff994112c2d9 ]
+
+SONiX AK870 PRO keyboard pretends to be an apple keyboard by VID:PID,
+rendering function keys not treated properly. Despite being a
+SONiX USB DEVICE, it uses a different name, so adding it to the list.
+
+Signed-off-by: April Grimoire <april@aprilg.moe>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-apple.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index 25d1edb6a2107..a0f79803df3bd 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -354,6 +354,7 @@ static const struct apple_key_translation swapped_fn_leftctrl_keys[] = {
+
+ static const struct apple_non_apple_keyboard non_apple_keyboards[] = {
+ { "SONiX USB DEVICE" },
++ { "SONiX AK870 PRO" },
+ { "Keychron" },
+ { "AONE" },
+ { "GANSS" },
+--
+2.51.0
+
--- /dev/null
+From 872be643da534aa340486b83ac2a77d508c6b155 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Nov 2025 21:16:45 +0900
+Subject: HID: elecom: Add support for ELECOM M-XT3URBK (018F)
+
+From: Naoki Ueki <naoki25519@gmail.com>
+
+[ Upstream commit cdcbb8e8d10f656642380ee13516290437b52b36 ]
+
+The ELECOM M-XT3URBK trackball has an additional device ID (0x018F), which
+shares the same report descriptor as the existing device (0x00FB). However,
+the driver does not currently recognize this new ID, resulting in only five
+buttons being functional.
+
+This patch adds the new device ID so that all six buttons work properly.
+
+Signed-off-by: Naoki Ueki <naoki25519@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-elecom.c | 6 ++++--
+ drivers/hid/hid-ids.h | 3 ++-
+ drivers/hid/hid-quirks.c | 3 ++-
+ 3 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c
+index defcf91fdd14b..b57b6deb36f42 100644
+--- a/drivers/hid/hid-elecom.c
++++ b/drivers/hid/hid-elecom.c
+@@ -75,7 +75,8 @@ static const __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ */
+ mouse_button_fixup(hdev, rdesc, *rsize, 20, 28, 22, 14, 8);
+ break;
+- case USB_DEVICE_ID_ELECOM_M_XT3URBK:
++ case USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB:
++ case USB_DEVICE_ID_ELECOM_M_XT3URBK_018F:
+ case USB_DEVICE_ID_ELECOM_M_XT3DRBK:
+ case USB_DEVICE_ID_ELECOM_M_XT4DRBK:
+ /*
+@@ -117,7 +118,8 @@ static const __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ static const struct hid_device_id elecom_devices[] = {
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index a85027fbf726a..e0ac6dc07da09 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -445,7 +445,8 @@
+ #define USB_VENDOR_ID_ELECOM 0x056e
+ #define USB_DEVICE_ID_ELECOM_BM084 0x0061
+ #define USB_DEVICE_ID_ELECOM_M_XGL20DLBK 0x00e6
+-#define USB_DEVICE_ID_ELECOM_M_XT3URBK 0x00fb
++#define USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB 0x00fb
++#define USB_DEVICE_ID_ELECOM_M_XT3URBK_018F 0x018f
+ #define USB_DEVICE_ID_ELECOM_M_XT3DRBK 0x00fc
+ #define USB_DEVICE_ID_ELECOM_M_XT4DRBK 0x00fd
+ #define USB_DEVICE_ID_ELECOM_M_DT1URBK 0x00fe
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index fa946666969b8..2da21415e676c 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -405,7 +405,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ #if IS_ENABLED(CONFIG_HID_ELECOM)
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) },
+--
+2.51.0
+
--- /dev/null
+From a6ddd804052d45d779e24c77d3eb4a8326e569b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 11:06:25 -0500
+Subject: HID: hid-input: Extend Elan ignore battery quirk to USB
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit 534ca75e8e3b713514b3f2da85dab96831cf5b2a ]
+
+USB Elan devices have the same problem as the I2C ones with a fake
+battery device showing up.
+
+Reviewed-by: Hans de Goede <hansg@kernel.org>
+Reported-by: André Barata <andretiagob@protonmail.com>
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220722
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-input.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index f073d5621050a..fa3efe9701c96 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -386,10 +386,11 @@ static const struct hid_device_id hid_battery_quirks[] = {
+ { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_CHROMEBOOK_TROGDOR_POMPOM),
+ HID_BATTERY_QUIRK_AVOID_QUERY },
+ /*
+- * Elan I2C-HID touchscreens seem to all report a non present battery,
+- * set HID_BATTERY_QUIRK_IGNORE for all Elan I2C-HID devices.
++ * Elan HID touchscreens seem to all report a non present battery,
++ * set HID_BATTERY_QUIRK_IGNORE for all Elan I2C and USB HID devices.
+ */
+ { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_IGNORE },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_IGNORE },
+ {}
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 1740bb43c3ad0f50e670951d1535047cf6613189 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 14:42:05 +0800
+Subject: LoongArch: Mask all interrupts during kexec/kdump
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit 863a320dc6fd7c855f47da4bb82a8de2d9102ea2 ]
+
+If the default state of the interrupt controllers in the first kernel
+don't mask any interrupts, it may cause the second kernel to potentially
+receive interrupts (which were previously allocated by the first kernel)
+immediately after a CPU becomes online during its boot process. These
+interrupts cannot be properly routed, leading to bad IRQ issues.
+
+This patch calls machine_kexec_mask_interrupts() to mask all interrupts
+during the kexec/kdump process.
+
+Signed-off-by: Tianyang Zhang <zhangtianyang@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/kernel/machine_kexec.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/loongarch/kernel/machine_kexec.c b/arch/loongarch/kernel/machine_kexec.c
+index f9381800e291c..8ef4e4595d61a 100644
+--- a/arch/loongarch/kernel/machine_kexec.c
++++ b/arch/loongarch/kernel/machine_kexec.c
+@@ -249,6 +249,7 @@ void machine_crash_shutdown(struct pt_regs *regs)
+ #ifdef CONFIG_SMP
+ crash_smp_send_stop();
+ #endif
++ machine_kexec_mask_interrupts();
+ cpumask_set_cpu(crashing_cpu, &cpus_in_crash);
+
+ pr_info("Starting crashdump kernel...\n");
+@@ -286,6 +287,7 @@ void machine_kexec(struct kimage *image)
+
+ /* We do not want to be bothered. */
+ local_irq_disable();
++ machine_kexec_mask_interrupts();
+
+ pr_notice("EFI boot flag 0x%lx\n", efi_boot);
+ pr_notice("Command line at 0x%lx\n", cmdline_ptr);
+--
+2.51.0
+
--- /dev/null
+From fda0b29e2d3681b92570788f00ae323058a3948f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 14:48:30 -0800
+Subject: nvme: fix admin request_queue lifetime
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit 03b3bcd319b3ab5182bc9aaa0421351572c78ac0 ]
+
+The namespaces can access the controller's admin request_queue, and
+stale references on the namespaces may exist after tearing down the
+controller. Ensure the admin request_queue is active by moving the
+controller's 'put' to after all controller references have been released
+to ensure no one is can access the request_queue. This fixes a reported
+use-after-free bug:
+
+ BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0
+ Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287
+ CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G E 6.13.2-ga1582f1a031e #15
+ Tainted: [E]=UNSIGNED_MODULE
+ Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025
+ Call Trace:
+ <TASK>
+ dump_stack_lvl+0x4f/0x60
+ print_report+0xc4/0x620
+ ? _raw_spin_lock_irqsave+0x70/0xb0
+ ? _raw_read_unlock_irqrestore+0x30/0x30
+ ? blk_queue_enter+0x41c/0x4a0
+ kasan_report+0xab/0xe0
+ ? blk_queue_enter+0x41c/0x4a0
+ blk_queue_enter+0x41c/0x4a0
+ ? __irq_work_queue_local+0x75/0x1d0
+ ? blk_queue_start_drain+0x70/0x70
+ ? irq_work_queue+0x18/0x20
+ ? vprintk_emit.part.0+0x1cc/0x350
+ ? wake_up_klogd_work_func+0x60/0x60
+ blk_mq_alloc_request+0x2b7/0x6b0
+ ? __blk_mq_alloc_requests+0x1060/0x1060
+ ? __switch_to+0x5b7/0x1060
+ nvme_submit_user_cmd+0xa9/0x330
+ nvme_user_cmd.isra.0+0x240/0x3f0
+ ? force_sigsegv+0xe0/0xe0
+ ? nvme_user_cmd64+0x400/0x400
+ ? vfs_fileattr_set+0x9b0/0x9b0
+ ? cgroup_update_frozen_flag+0x24/0x1c0
+ ? cgroup_leave_frozen+0x204/0x330
+ ? nvme_ioctl+0x7c/0x2c0
+ blkdev_ioctl+0x1a8/0x4d0
+ ? blkdev_common_ioctl+0x1930/0x1930
+ ? fdget+0x54/0x380
+ __x64_sys_ioctl+0x129/0x190
+ do_syscall_64+0x5b/0x160
+ entry_SYSCALL_64_after_hwframe+0x4b/0x53
+ RIP: 0033:0x7f765f703b0b
+ Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48
+ RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
+ RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b
+ RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003
+ RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000
+ R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003
+ R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60
+ </TASK>
+
+Reported-by: Casey Chen <cachen@purestorage.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index a3b9f8ea235f7..a766290b1ee89 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -4645,7 +4645,6 @@ void nvme_remove_admin_tag_set(struct nvme_ctrl *ctrl)
+ */
+ nvme_stop_keep_alive(ctrl);
+ blk_mq_destroy_queue(ctrl->admin_q);
+- blk_put_queue(ctrl->admin_q);
+ if (ctrl->ops->flags & NVME_F_FABRICS) {
+ blk_mq_destroy_queue(ctrl->fabrics_q);
+ blk_put_queue(ctrl->fabrics_q);
+@@ -4790,6 +4789,8 @@ static void nvme_free_ctrl(struct device *dev)
+ container_of(dev, struct nvme_ctrl, ctrl_device);
+ struct nvme_subsystem *subsys = ctrl->subsys;
+
++ if (ctrl->admin_q)
++ blk_put_queue(ctrl->admin_q);
+ if (!subsys || ctrl->instance != subsys->instance)
+ ida_free(&nvme_instance_ida, ctrl->instance);
+ nvme_free_cels(ctrl);
+--
+2.51.0
+
--- /dev/null
+From 0de476e77afafb9fde5f69a9b12790477fe81051 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 15:40:41 +0530
+Subject: pinctrl: qcom: msm: Fix deadlock in pinmux configuration
+
+From: Praveen Talari <praveen.talari@oss.qualcomm.com>
+
+[ Upstream commit 1c2e70397b4125022dba80f6111271a37fb36bae ]
+
+Replace disable_irq() with disable_irq_nosync() in msm_pinmux_set_mux()
+to prevent deadlock when wakeup IRQ is triggered on the same
+GPIO being reconfigured.
+
+The issue occurs when a wakeup IRQ is triggered on a GPIO and the IRQ
+handler attempts to reconfigure the same GPIO's pinmux. In this scenario,
+msm_pinmux_set_mux() calls disable_irq() which waits for the currently
+running IRQ handler to complete, creating a circular dependency that
+results in deadlock.
+
+Using disable_irq_nosync() avoids waiting for the IRQ handler to
+complete, preventing the deadlock condition while still properly
+disabling the interrupt during pinmux reconfiguration.
+
+Suggested-by: Prasad Sodagudi <prasad.sodagudi@oss.qualcomm.com>
+Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com>
+Reviewed-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/qcom/pinctrl-msm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
+index 5532328097894..27eb585bf42df 100644
+--- a/drivers/pinctrl/qcom/pinctrl-msm.c
++++ b/drivers/pinctrl/qcom/pinctrl-msm.c
+@@ -214,7 +214,7 @@ static int msm_pinmux_set_mux(struct pinctrl_dev *pctldev,
+ */
+ if (d && i != gpio_func &&
+ !test_and_set_bit(d->hwirq, pctrl->disabled_for_mux))
+- disable_irq(irq);
++ disable_irq_nosync(irq);
+
+ raw_spin_lock_irqsave(&pctrl->lock, flags);
+
+--
+2.51.0
+
--- /dev/null
+From 542672df9e481b149aaf6f09d04c71e8db7ce337 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 16:59:38 +0100
+Subject: platform/x86: acer-wmi: Ignore backlight event
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 444a9256f8d106e08a6bc2dc8ef28a8699e4b3ba ]
+
+On the Acer Nitro AN515-58, the event 4 - 0 is send by the ACPI
+firmware when the backlight up/down keys are pressed. Ignore this
+event to avoid spamming the kernel log with error messages, as the
+acpi-video driver already handles brightness up/down events.
+
+Reported-by: Bugaddr <Bugaddr@protonmail.com>
+Closes: https://bugaddr.tech/posts/2025-11-16-debugging-the-acer-nitro-5-an515-58-fn-f10-keyboard-backlight-bug-on-linux/#wmi-interface-issues
+Tested-by: Bugaddr <Bugaddr@protonmail.com>
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://patch.msgid.link/20251117155938.3030-1-W_Armin@gmx.de
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/acer-wmi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
+index c5679e4a58a76..d7602962b3cad 100644
+--- a/drivers/platform/x86/acer-wmi.c
++++ b/drivers/platform/x86/acer-wmi.c
+@@ -93,6 +93,7 @@ MODULE_ALIAS("wmi:676AA15E-6A47-4D9F-A2CC-1E6D18D14026");
+
+ enum acer_wmi_event_ids {
+ WMID_HOTKEY_EVENT = 0x1,
++ WMID_BACKLIGHT_EVENT = 0x4,
+ WMID_ACCEL_OR_KBD_DOCK_EVENT = 0x5,
+ WMID_GAMING_TURBO_KEY_EVENT = 0x7,
+ WMID_AC_EVENT = 0x8,
+@@ -2317,6 +2318,9 @@ static void acer_wmi_notify(union acpi_object *obj, void *context)
+ sparse_keymap_report_event(acer_wmi_input_dev, scancode, 1, true);
+ }
+ break;
++ case WMID_BACKLIGHT_EVENT:
++ /* Already handled by acpi-video */
++ break;
+ case WMID_ACCEL_OR_KBD_DOCK_EVENT:
+ acer_gsensor_event();
+ acer_kbd_dock_event(&return_value);
+--
+2.51.0
+
--- /dev/null
+From aea9ea381b33a1f5375f61a86c0e33c7bdc8d16d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 15:50:57 +0200
+Subject: platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Antheas Kapenekakis <lkml@antheas.dev>
+
+[ Upstream commit f945afe01c6768dcfed7868c671a26e1164c2284 ]
+
+The Lenovo Legion Go 2 takes a long time to resume from suspend.
+This is due to it having an nvme resume handler that interferes
+with IOMMU mappings. It is a common issue with older Lenovo
+laptops. Adding it to that quirk list fixes this issue.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4618
+Suggested-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20251008135057.731928-1-lkml@antheas.dev
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc/pmc-quirks.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+index 9fd2829ee2ab4..271cbeaa59af3 100644
+--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c
++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+@@ -198,6 +198,23 @@ static const struct dmi_system_id fwbug_list[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "82ND"),
+ }
+ },
++ /* https://gitlab.freedesktop.org/drm/amd/-/issues/4618 */
++ {
++ .ident = "Lenovo Legion Go 2",
++ .driver_data = &quirk_s2idle_bug,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "83N0"),
++ }
++ },
++ {
++ .ident = "Lenovo Legion Go 2",
++ .driver_data = &quirk_s2idle_bug,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "83N1"),
++ }
++ },
+ /* https://gitlab.freedesktop.org/drm/amd/-/issues/2684 */
+ {
+ .ident = "HP Laptop 15s-eq2xxx",
+--
+2.51.0
+
--- /dev/null
+From d422f0123d721984b705d4a418d6dab3feb7a86e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Oct 2025 17:21:51 +0200
+Subject: platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Antheas Kapenekakis <lkml@antheas.dev>
+
+[ Upstream commit c0ddc54016636dd8dedfaf1a3b482a95058e1db2 ]
+
+The Xbox Ally features a Van Gogh SoC that has spurious interrupts
+during resume. We get the following logs:
+
+atkbd_receive_byte: 20 callbacks suppressed
+atkbd serio0: Spurious ACK on isa0060/serio0. Some program might be trying to access hardware directly.
+
+So, add the spurious_8042 quirk for it. It does not have a keyboard, so
+this does not result in any functional loss.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4659
+Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20251024152152.3981721-3-lkml@antheas.dev
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc/pmc-quirks.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+index 271cbeaa59af3..a5031339dac8c 100644
+--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c
++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+@@ -116,6 +116,14 @@ static const struct dmi_system_id fwbug_list[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "21A1"),
+ }
+ },
++ {
++ .ident = "ROG Xbox Ally RC73YA",
++ .driver_data = &quirk_spurious_8042,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_BOARD_NAME, "RC73YA"),
++ }
++ },
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=218024 */
+ {
+ .ident = "V14 G4 AMN",
+--
+2.51.0
+
--- /dev/null
+From d451b35997f798f22b76b5bca158dde4af899cf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Oct 2025 05:18:38 +0000
+Subject: platform/x86: huawei-wmi: add keys for HONOR models
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jia Ston <ston.jia@outlook.com>
+
+[ Upstream commit 5c72329716d0858621021193330594d5d26bf44d ]
+
+HONOR MagicBook X16/X14 models produced in 2025 cannot use the Print
+Screen and YOYO keys properly, with the system reporting them as
+unknown key presses (codes: 0x028b and 0x028e).
+
+To resolve this, a key_entry is added for both the HONOR Print Screen
+key and the HONOR YOYO key, ensuring they function correctly on these
+models.
+
+Signed-off-by: Ston Jia <ston.jia@outlook.com>
+Link: https://patch.msgid.link/20251029051804.220111-1-ston.jia@outlook.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/huawei-wmi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/platform/x86/huawei-wmi.c b/drivers/platform/x86/huawei-wmi.c
+index d81fd5df4a000..d7a6111b2fe13 100644
+--- a/drivers/platform/x86/huawei-wmi.c
++++ b/drivers/platform/x86/huawei-wmi.c
+@@ -81,6 +81,10 @@ static const struct key_entry huawei_wmi_keymap[] = {
+ { KE_KEY, 0x289, { KEY_WLAN } },
+ // Huawei |M| key
+ { KE_KEY, 0x28a, { KEY_CONFIG } },
++ // HONOR YOYO key
++ { KE_KEY, 0x28b, { KEY_NOTIFICATION_CENTER } },
++ // HONOR print screen
++ { KE_KEY, 0x28e, { KEY_PRINT } },
+ // Keyboard backlit
+ { KE_IGNORE, 0x293, { KEY_KBDILLUMTOGGLE } },
+ { KE_IGNORE, 0x294, { KEY_KBDILLUMUP } },
+--
+2.51.0
+
--- /dev/null
+From c7345be42d8e36e791fc53708a4f5c6fd9e79d21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 09:29:02 -0800
+Subject: samples: work around glibc redefining some of our defines wrong
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit a48f822908982353c3256e35a089e9e7d0d61580 ]
+
+Apparently as of version 2.42, glibc headers define AT_RENAME_NOREPLACE
+and some of the other flags for renameat2() and friends in <stdio.h>.
+
+Which would all be fine, except for inexplicable reasons glibc decided
+to define them _differently_ from the kernel definitions, which then
+makes some of our sample code that includes both kernel headers and user
+space headers unhappy, because the compiler will (correctly) complain
+about redefining things.
+
+Now, mixing kernel headers and user space headers is always a somewhat
+iffy proposition due to namespacing issues, but it's kind of inevitable
+in our sample and selftest code. And this is just glibc being stupid.
+
+Those defines come from the kernel, glibc is exposing the kernel
+interfaces, and glibc shouldn't make up some random new expressions for
+these values.
+
+It's not like glibc headers changed the actual result values, but they
+arbitrarily just decided to use a different expression to describe those
+values. The kernel just does
+
+ #define AT_RENAME_NOREPLACE 0x0001
+
+while glibc does
+
+ # define RENAME_NOREPLACE (1 << 0)
+ # define AT_RENAME_NOREPLACE RENAME_NOREPLACE
+
+instead. Same value in the end, but very different macro definition.
+
+For absolutely no reason.
+
+This has since been fixed in the glibc development tree, so eventually
+we'll end up with the canonical expressions and no clashes. But in the
+meantime the broken headers are in the glibc-2.42 release and have made
+it out into distributions.
+
+Do a minimal work-around to make the samples build cleanly by just
+undefining the affected macros in between the user space header include
+and the kernel header includes.
+
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/vfs/test-statx.c | 6 ++++++
+ samples/watch_queue/watch_test.c | 6 ++++++
+ 2 files changed, 12 insertions(+)
+
+diff --git a/samples/vfs/test-statx.c b/samples/vfs/test-statx.c
+index 49c7a46cee073..424a6fa15723c 100644
+--- a/samples/vfs/test-statx.c
++++ b/samples/vfs/test-statx.c
+@@ -19,6 +19,12 @@
+ #include <time.h>
+ #include <sys/syscall.h>
+ #include <sys/types.h>
++
++// Work around glibc header silliness
++#undef AT_RENAME_NOREPLACE
++#undef AT_RENAME_EXCHANGE
++#undef AT_RENAME_WHITEOUT
++
+ #include <linux/stat.h>
+ #include <linux/fcntl.h>
+ #define statx foo
+diff --git a/samples/watch_queue/watch_test.c b/samples/watch_queue/watch_test.c
+index 8c6cb57d5cfc5..24cf7d7a19725 100644
+--- a/samples/watch_queue/watch_test.c
++++ b/samples/watch_queue/watch_test.c
+@@ -16,6 +16,12 @@
+ #include <errno.h>
+ #include <sys/ioctl.h>
+ #include <limits.h>
++
++// Work around glibc header silliness
++#undef AT_RENAME_NOREPLACE
++#undef AT_RENAME_EXCHANGE
++#undef AT_RENAME_WHITEOUT
++
+ #include <linux/watch_queue.h>
+ #include <linux/unistd.h>
+ #include <linux/keyctl.h>
+--
+2.51.0
+
revert-xfrm-destroy-xfrm_state-synchronously-on-net-.patch
xfrm-also-call-xfrm_state_delete_tunnel-at-destroy-t.patch
xfrm-flush-all-states-in-xfrm_state_fini.patch
+ftrace-bpf-fix-ipmodify-direct-in-modify_ftrace_dire.patch
+spi-xilinx-increase-number-of-retries-before-declari.patch
+spi-imx-keep-dma-request-disabled-before-dma-transfe.patch
+dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch
+drm-vmwgfx-use-kref-in-vmw_bo_dirty.patch
+bluetooth-btrtl-avoid-loading-the-config-file-on-sec.patch
+smb-fix-invalid-username-check-in-smb3_fs_context_pa.patch
+drm-amdkfd-fix-gpu-mappings-for-apu-after-prefetch.patch
+alsa-usb-audio-add-native-dsd-quirks-for-pureaudio-d.patch
+bfs-reconstruct-file-type-when-loading-from-disk.patch
+hid-hid-input-extend-elan-ignore-battery-quirk-to-us.patch
+nvme-fix-admin-request_queue-lifetime.patch
+pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch
+platform-x86-acer-wmi-ignore-backlight-event.patch
+hid-apple-add-sonix-ak870-pro-to-non_apple_keyboards.patch
+platform-x86-huawei-wmi-add-keys-for-honor-models.patch
+platform-x86-amd-pmc-add-lenovo-legion-go-2-to-pmc-q.patch
+platform-x86-amd-pmc-add-spurious_8042-to-xbox-ally.patch
+hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch
+loongarch-mask-all-interrupts-during-kexec-kdump.patch
+samples-work-around-glibc-redefining-some-of-our-def.patch
--- /dev/null
+From 7619d8e6319b6c81d81476b2302a4fce96115ad0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Nov 2025 15:05:39 +0800
+Subject: smb: fix invalid username check in smb3_fs_context_parse_param()
+
+From: Yiqi Sun <sunyiqixm@gmail.com>
+
+[ Upstream commit ed6612165b74f09db00ef0abaf9831895ab28b7f ]
+
+Since the maximum return value of strnlen(..., CIFS_MAX_USERNAME_LEN)
+is CIFS_MAX_USERNAME_LEN, length check in smb3_fs_context_parse_param()
+is always FALSE and invalid.
+
+Fix the comparison in if statement.
+
+Signed-off-by: Yiqi Sun <sunyiqixm@gmail.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/fs_context.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c
+index 9a4492106c25f..17133adfe798b 100644
+--- a/fs/smb/client/fs_context.c
++++ b/fs/smb/client/fs_context.c
+@@ -1415,7 +1415,7 @@ static int smb3_fs_context_parse_param(struct fs_context *fc,
+ break;
+ }
+
+- if (strnlen(param->string, CIFS_MAX_USERNAME_LEN) >
++ if (strnlen(param->string, CIFS_MAX_USERNAME_LEN) ==
+ CIFS_MAX_USERNAME_LEN) {
+ pr_warn("username too long\n");
+ goto cifs_parse_mount_err;
+--
+2.51.0
+
--- /dev/null
+From 22896868c6f1397f45d1f162b6efdf08e1823e58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Oct 2025 13:53:20 +0800
+Subject: spi: imx: keep dma request disabled before dma transfer setup
+
+From: Robin Gong <yibin.gong@nxp.com>
+
+[ Upstream commit 86d57d9c07d54e8cb385ffe800930816ccdba0c1 ]
+
+Since sdma hardware configure postpone to transfer phase, have to disable
+dma request before dma transfer setup because there is a hardware
+limitation on sdma event enable(ENBLn) as below:
+
+"It is thus essential for the Arm platform to program them before any DMA
+ request is triggered to the SDMA, otherwise an unpredictable combination
+ of channels may be started."
+
+Signed-off-by: Carlos Song <carlos.song@nxp.com>
+Signed-off-by: Robin Gong <yibin.gong@nxp.com>
+Link: https://patch.msgid.link/20251024055320.408482-1-carlos.song@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-imx.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index 810541eed213e..94d0f7695d07a 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -503,9 +503,15 @@ static void mx51_ecspi_trigger(struct spi_imx_data *spi_imx)
+ {
+ u32 reg;
+
+- reg = readl(spi_imx->base + MX51_ECSPI_CTRL);
+- reg |= MX51_ECSPI_CTRL_XCH;
+- writel(reg, spi_imx->base + MX51_ECSPI_CTRL);
++ if (spi_imx->usedma) {
++ reg = readl(spi_imx->base + MX51_ECSPI_DMA);
++ reg |= MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN;
++ writel(reg, spi_imx->base + MX51_ECSPI_DMA);
++ } else {
++ reg = readl(spi_imx->base + MX51_ECSPI_CTRL);
++ reg |= MX51_ECSPI_CTRL_XCH;
++ writel(reg, spi_imx->base + MX51_ECSPI_CTRL);
++ }
+ }
+
+ static void mx51_ecspi_disable(struct spi_imx_data *spi_imx)
+@@ -699,7 +705,6 @@ static void mx51_setup_wml(struct spi_imx_data *spi_imx)
+ writel(MX51_ECSPI_DMA_RX_WML(spi_imx->wml - 1) |
+ MX51_ECSPI_DMA_TX_WML(tx_wml) |
+ MX51_ECSPI_DMA_RXT_WML(spi_imx->wml) |
+- MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN |
+ MX51_ECSPI_DMA_RXTDEN, spi_imx->base + MX51_ECSPI_DMA);
+ }
+
+@@ -1458,6 +1463,8 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx,
+ reinit_completion(&spi_imx->dma_tx_completion);
+ dma_async_issue_pending(controller->dma_tx);
+
++ spi_imx->devtype_data->trigger(spi_imx);
++
+ transfer_timeout = spi_imx_calculate_timeout(spi_imx, transfer->len);
+
+ /* Wait SDMA to finish the data transfer.*/
+--
+2.51.0
+
--- /dev/null
+From 639e37c79757d72462a7de03fd6cde312f790f73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Nov 2025 14:45:35 +0100
+Subject: spi: xilinx: increase number of retries before declaring stall
+
+From: Alvaro Gamez Machado <alvaro.gamez@hazent.com>
+
+[ Upstream commit 939edfaa10f1d22e6af6a84bf4bd96dc49c67302 ]
+
+SPI devices using a (relative) slow frequency need a larger time.
+
+For instance, microblaze running at 83.25MHz and performing a
+3 bytes transaction using a 10MHz/16 = 625kHz needed this stall
+value increased to at least 20. The SPI device is quite slow, but
+also is the microblaze, so set this value to 32 to give it even
+more margin.
+
+Signed-off-by: Alvaro Gamez Machado <alvaro.gamez@hazent.com>
+Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
+Link: https://patch.msgid.link/20251106134545.31942-1-alvaro.gamez@hazent.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-xilinx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c
+index 7795328427a68..f5e41813b9582 100644
+--- a/drivers/spi/spi-xilinx.c
++++ b/drivers/spi/spi-xilinx.c
+@@ -299,7 +299,7 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)
+
+ /* Read out all the data from the Rx FIFO */
+ rx_words = n_words;
+- stalled = 10;
++ stalled = 32;
+ while (rx_words) {
+ if (rx_words == n_words && !(stalled--) &&
+ !(sr & XSPI_SR_TX_EMPTY_MASK) &&
+--
+2.51.0
+
--- /dev/null
+From 1495e12945b59eb6b58e28f902ca945278511b86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 08:02:28 +0530
+Subject: ACPI: MRRM: Fix memory leaks and improve error handling
+
+From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+
+[ Upstream commit 4b93d211bbffd3dce76664d95f2306d23e7215ce ]
+
+Add proper error handling and resource cleanup to prevent memory leaks
+in add_boot_memory_ranges(). The function now checks for NULL return
+from kobject_create_and_add(), uses local buffer for range names to
+avoid dynamic allocation, and implements a cleanup path that removes
+previously created sysfs groups and kobjects on failure.
+
+This prevents resource leaks when kobject creation or sysfs group
+creation fails during boot memory range initialization.
+
+Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
+Reviewed-by: Tony Luck <tony.luck@intel.com>
+Link: https://patch.msgid.link/20251030023228.3956296-1-kaushlendra.kumar@intel.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_mrrm.c | 43 ++++++++++++++++++++++++++++++----------
+ 1 file changed, 33 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/acpi/acpi_mrrm.c b/drivers/acpi/acpi_mrrm.c
+index a6dbf623e5571..6d69554c940ed 100644
+--- a/drivers/acpi/acpi_mrrm.c
++++ b/drivers/acpi/acpi_mrrm.c
+@@ -152,26 +152,49 @@ ATTRIBUTE_GROUPS(memory_range);
+
+ static __init int add_boot_memory_ranges(void)
+ {
+- struct kobject *pkobj, *kobj;
++ struct kobject *pkobj, *kobj, **kobjs;
+ int ret = -EINVAL;
+- char *name;
++ char name[16];
++ int i;
+
+ pkobj = kobject_create_and_add("memory_ranges", acpi_kobj);
++ if (!pkobj)
++ return -ENOMEM;
+
+- for (int i = 0; i < mrrm_mem_entry_num; i++) {
+- name = kasprintf(GFP_KERNEL, "range%d", i);
+- if (!name) {
+- ret = -ENOMEM;
+- break;
+- }
++ kobjs = kcalloc(mrrm_mem_entry_num, sizeof(*kobjs), GFP_KERNEL);
++ if (!kobjs) {
++ kobject_put(pkobj);
++ return -ENOMEM;
++ }
+
++ for (i = 0; i < mrrm_mem_entry_num; i++) {
++ scnprintf(name, sizeof(name), "range%d", i);
+ kobj = kobject_create_and_add(name, pkobj);
++ if (!kobj) {
++ ret = -ENOMEM;
++ goto cleanup;
++ }
+
+ ret = sysfs_create_groups(kobj, memory_range_groups);
+- if (ret)
+- return ret;
++ if (ret) {
++ kobject_put(kobj);
++ goto cleanup;
++ }
++ kobjs[i] = kobj;
+ }
+
++ kfree(kobjs);
++ return 0;
++
++cleanup:
++ for (int j = 0; j < i; j++) {
++ if (kobjs[j]) {
++ sysfs_remove_groups(kobjs[j], memory_range_groups);
++ kobject_put(kobjs[j]);
++ }
++ }
++ kfree(kobjs);
++ kobject_put(pkobj);
+ return ret;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 647b0a96c040bb8937b6b3cef163aa74495fc094 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Nov 2025 22:23:25 +0800
+Subject: ALSA: hda/tas2781: Add new quirk for HP new projects
+
+From: Baojun Xu <baojun.xu@ti.com>
+
+[ Upstream commit 7a39c723b7472b8aaa2e0a67d2b6c7cf1c45cafb ]
+
+Add new vendor_id and subsystem_id in quirk for HP new projects.
+
+Signed-off-by: Baojun Xu <baojun.xu@ti.com>
+Link: https://patch.msgid.link/20251108142325.2563-1-baojun.xu@ti.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/codecs/realtek/alc269.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/sound/hda/codecs/realtek/alc269.c b/sound/hda/codecs/realtek/alc269.c
+index 796f555dd381d..5e0c0f1e231b8 100644
+--- a/sound/hda/codecs/realtek/alc269.c
++++ b/sound/hda/codecs/realtek/alc269.c
+@@ -6685,6 +6685,15 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x8e60, "HP Trekker ", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x103c, 0x8e61, "HP Trekker ", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x103c, 0x8e62, "HP Trekker ", ALC287_FIXUP_CS35L41_I2C_2),
++ SND_PCI_QUIRK(0x103c, 0x8ed5, "HP Merino13X", ALC245_FIXUP_TAS2781_SPI_2),
++ SND_PCI_QUIRK(0x103c, 0x8ed6, "HP Merino13", ALC245_FIXUP_TAS2781_SPI_2),
++ SND_PCI_QUIRK(0x103c, 0x8ed7, "HP Merino14", ALC245_FIXUP_TAS2781_SPI_2),
++ SND_PCI_QUIRK(0x103c, 0x8ed8, "HP Merino16", ALC245_FIXUP_TAS2781_SPI_2),
++ SND_PCI_QUIRK(0x103c, 0x8ed9, "HP Merino14W", ALC245_FIXUP_TAS2781_SPI_2),
++ SND_PCI_QUIRK(0x103c, 0x8eda, "HP Merino16W", ALC245_FIXUP_TAS2781_SPI_2),
++ SND_PCI_QUIRK(0x103c, 0x8f40, "HP Lampas14", ALC287_FIXUP_TAS2781_I2C),
++ SND_PCI_QUIRK(0x103c, 0x8f41, "HP Lampas16", ALC287_FIXUP_TAS2781_I2C),
++ SND_PCI_QUIRK(0x103c, 0x8f42, "HP LampasW14", ALC287_FIXUP_TAS2781_I2C),
+ SND_PCI_QUIRK(0x1043, 0x1032, "ASUS VivoBook X513EA", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1043, 0x1034, "ASUS GU605C", ALC285_FIXUP_ASUS_GU605_SPI_SPEAKER2_TO_DAC1),
+ SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+--
+2.51.0
+
--- /dev/null
+From 2aa2722ad15c67efe96e2413fa8f829bf98f2cf0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Nov 2025 13:20:53 +0800
+Subject: ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series
+
+From: Lushih Hsieh <bruce@mail.kh.edu.tw>
+
+[ Upstream commit 21a9ab5b90b3716a631d559e62818029b4e7f5b7 ]
+
+The PureAudio APA DAC and Lotus DAC5 series are USB Audio
+2.0 Class devices that support native Direct Stream Digital (DSD)
+playback via specific vendor protocols.
+
+Without these quirks, the devices may only function in standard
+PCM mode, or fail to correctly report their DSD format capabilities
+to the ALSA framework, preventing native DSD playback under Linux.
+
+This commit adds new quirk entries for the mentioned DAC models
+based on their respective Vendor/Product IDs (VID:PID), for example:
+0x16d0:0x0ab1 (APA DAC), 0x16d0:0xeca1 (DAC5 series), etc.
+
+The quirk ensures correct DSD format handling by setting the required
+SNDRV_PCM_FMTBIT_DSD_U32_BE format bit and defining the DSD-specific
+Audio Class 2.0 (AC2.0) endpoint configurations. This allows the ALSA
+DSD API to correctly address the device for high-bitrate DSD streams,
+bypassing the need for DoP (DSD over PCM).
+
+Test on APA DAC and Lotus DAC5 SE under Arch Linux.
+
+Tested-by: Lushih Hsieh <bruce@mail.kh.edu.tw>
+Signed-off-by: Lushih Hsieh <bruce@mail.kh.edu.tw>
+Link: https://patch.msgid.link/20251114052053.54989-1-bruce@mail.kh.edu.tw
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/quirks.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index b04f52adb1f48..70f9e0cc28fac 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -2022,6 +2022,8 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ case USB_ID(0x16d0, 0x09d8): /* NuPrime IDA-8 */
+ case USB_ID(0x16d0, 0x09db): /* NuPrime Audio DAC-9 */
+ case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */
++ case USB_ID(0x16d0, 0x0ab1): /* PureAudio APA DAC */
++ case USB_ID(0x16d0, 0xeca1): /* PureAudio Lotus DAC5, DAC5 SE, DAC5 Pro */
+ case USB_ID(0x1db5, 0x0003): /* Bryston BDA3 */
+ case USB_ID(0x20a0, 0x4143): /* WaveIO USB Audio 2.0 */
+ case USB_ID(0x22e1, 0xca01): /* HDTA Serenade DSD */
+@@ -2289,6 +2291,10 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
+ QUIRK_FLAG_IGNORE_CLOCK_SOURCE),
+ DEVICE_FLG(0x1686, 0x00dd, /* Zoom R16/24 */
+ QUIRK_FLAG_TX_LENGTH | QUIRK_FLAG_CTL_MSG_DELAY_1M),
++ DEVICE_FLG(0x16d0, 0x0ab1, /* PureAudio APA DAC */
++ QUIRK_FLAG_DSD_RAW),
++ DEVICE_FLG(0x16d0, 0xeca1, /* PureAudio Lotus DAC5, DAC5 SE and DAC5 Pro */
++ QUIRK_FLAG_DSD_RAW),
+ DEVICE_FLG(0x17aa, 0x1046, /* Lenovo ThinkStation P620 Rear Line-in, Line-out and Microphone */
+ QUIRK_FLAG_DISABLE_AUTOSUSPEND),
+ DEVICE_FLG(0x17aa, 0x104d, /* Lenovo ThinkStation P620 Internal Speaker + Front Headset */
+--
+2.51.0
+
--- /dev/null
+From ec61551b9c19afcc1b086acf76b175c515a4b20b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 13:04:27 +0000
+Subject: arm64: Reject modules with internal alternative callbacks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Adrian Barnaś <abarnas@google.com>
+
+[ Upstream commit 8e8ae788964aa2573b4335026db4068540fa6a86 ]
+
+During module loading, check if a callback function used by the
+alternatives specified in the '.altinstruction' ELF section (if present)
+is located in core kernel .text. If not fail module loading before
+callback is called.
+
+Reported-by: Fanqin Cui <cuifq1@chinatelecom.cn>
+Closes: https://lore.kernel.org/all/20250807072700.348514-1-fanqincui@163.com/
+Signed-off-by: Adrian Barnaś <abarnas@google.com>
+Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+[will: Folded in 'noinstr' tweak from Mark]
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/alternative.h | 7 +++++--
+ arch/arm64/kernel/alternative.c | 19 ++++++++++++-------
+ arch/arm64/kernel/module.c | 9 +++++++--
+ 3 files changed, 24 insertions(+), 11 deletions(-)
+
+diff --git a/arch/arm64/include/asm/alternative.h b/arch/arm64/include/asm/alternative.h
+index 00d97b8a757f4..51746005239bc 100644
+--- a/arch/arm64/include/asm/alternative.h
++++ b/arch/arm64/include/asm/alternative.h
+@@ -26,9 +26,12 @@ void __init apply_alternatives_all(void);
+ bool alternative_is_applied(u16 cpucap);
+
+ #ifdef CONFIG_MODULES
+-void apply_alternatives_module(void *start, size_t length);
++int apply_alternatives_module(void *start, size_t length);
+ #else
+-static inline void apply_alternatives_module(void *start, size_t length) { }
++static inline int apply_alternatives_module(void *start, size_t length)
++{
++ return 0;
++}
+ #endif
+
+ void alt_cb_patch_nops(struct alt_instr *alt, __le32 *origptr,
+diff --git a/arch/arm64/kernel/alternative.c b/arch/arm64/kernel/alternative.c
+index 8ff6610af4966..f5ec7e7c1d3fd 100644
+--- a/arch/arm64/kernel/alternative.c
++++ b/arch/arm64/kernel/alternative.c
+@@ -139,9 +139,9 @@ static noinstr void clean_dcache_range_nopatch(u64 start, u64 end)
+ } while (cur += d_size, cur < end);
+ }
+
+-static void __apply_alternatives(const struct alt_region *region,
+- bool is_module,
+- unsigned long *cpucap_mask)
++static int __apply_alternatives(const struct alt_region *region,
++ bool is_module,
++ unsigned long *cpucap_mask)
+ {
+ struct alt_instr *alt;
+ __le32 *origptr, *updptr;
+@@ -166,10 +166,13 @@ static void __apply_alternatives(const struct alt_region *region,
+ updptr = is_module ? origptr : lm_alias(origptr);
+ nr_inst = alt->orig_len / AARCH64_INSN_SIZE;
+
+- if (ALT_HAS_CB(alt))
++ if (ALT_HAS_CB(alt)) {
+ alt_cb = ALT_REPL_PTR(alt);
+- else
++ if (is_module && !core_kernel_text((unsigned long)alt_cb))
++ return -ENOEXEC;
++ } else {
+ alt_cb = patch_alternative;
++ }
+
+ alt_cb(alt, origptr, updptr, nr_inst);
+
+@@ -193,6 +196,8 @@ static void __apply_alternatives(const struct alt_region *region,
+ bitmap_and(applied_alternatives, applied_alternatives,
+ system_cpucaps, ARM64_NCAPS);
+ }
++
++ return 0;
+ }
+
+ static void __init apply_alternatives_vdso(void)
+@@ -277,7 +282,7 @@ void __init apply_boot_alternatives(void)
+ }
+
+ #ifdef CONFIG_MODULES
+-void apply_alternatives_module(void *start, size_t length)
++int apply_alternatives_module(void *start, size_t length)
+ {
+ struct alt_region region = {
+ .begin = start,
+@@ -287,7 +292,7 @@ void apply_alternatives_module(void *start, size_t length)
+
+ bitmap_fill(all_capabilities, ARM64_NCAPS);
+
+- __apply_alternatives(®ion, true, &all_capabilities[0]);
++ return __apply_alternatives(®ion, true, &all_capabilities[0]);
+ }
+ #endif
+
+diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c
+index d6d443c4a01ac..0b15c57285add 100644
+--- a/arch/arm64/kernel/module.c
++++ b/arch/arm64/kernel/module.c
+@@ -489,8 +489,13 @@ int module_finalize(const Elf_Ehdr *hdr,
+ int ret;
+
+ s = find_section(hdr, sechdrs, ".altinstructions");
+- if (s)
+- apply_alternatives_module((void *)s->sh_addr, s->sh_size);
++ if (s) {
++ ret = apply_alternatives_module((void *)s->sh_addr, s->sh_size);
++ if (ret < 0) {
++ pr_err("module %s: error occurred when applying alternatives\n", me->name);
++ return ret;
++ }
++ }
+
+ if (scs_is_dynamic()) {
+ s = find_section(hdr, sechdrs, ".init.eh_frame");
+--
+2.51.0
+
--- /dev/null
+From e60845265cb8d991d04da73613ddfadd9f5d8c48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 20:56:46 +0530
+Subject: ASoC: SDCA: bug fix while parsing mipi-sdca-control-cn-list
+
+From: Niranjan H Y <niranjan.hy@ti.com>
+
+[ Upstream commit eb2d6774cc0d9d6ab8f924825695a85c14b2e0c2 ]
+
+"struct sdca_control" declares "values" field as integer array.
+But the memory allocated to it is of char array. This causes
+crash for sdca_parse_function API. This patch addresses the
+issue by allocating correct data size.
+
+Signed-off-by: Niranjan H Y <niranjan.hy@ti.com>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://patch.msgid.link/20251110152646.192-1-niranjan.hy@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sdca/sdca_functions.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/sdca/sdca_functions.c b/sound/soc/sdca/sdca_functions.c
+index 13f68f7b6dd6a..0ccb6775f4de3 100644
+--- a/sound/soc/sdca/sdca_functions.c
++++ b/sound/soc/sdca/sdca_functions.c
+@@ -894,7 +894,8 @@ static int find_sdca_entity_control(struct device *dev, struct sdca_entity *enti
+ return ret;
+ }
+
+- control->values = devm_kzalloc(dev, hweight64(control->cn_list), GFP_KERNEL);
++ control->values = devm_kcalloc(dev, hweight64(control->cn_list),
++ sizeof(int), GFP_KERNEL);
+ if (!control->values)
+ return -ENOMEM;
+
+--
+2.51.0
+
--- /dev/null
+From 804085541932045c013892daddcaa12d10624d7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Oct 2025 22:25:49 +0900
+Subject: bfs: Reconstruct file type when loading from disk
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit 34ab4c75588c07cca12884f2bf6b0347c7a13872 ]
+
+syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when
+the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted
+or when the 32bits "attributes" field loaded from disk are corrupted.
+
+A documentation says that BFS uses only lower 9 bits of the "mode" field.
+But I can't find an explicit explanation that the unused upper 23 bits
+(especially, the S_IFMT bits) are initialized with 0.
+
+Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk.
+Also, verify that the value of the "attributes" field loaded from disk is
+either BFS_VREG or BFS_VDIR (because BFS supports only regular files and
+the root directory).
+
+Reported-by: syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Link: https://patch.msgid.link/fabce673-d5b9-4038-8287-0fd65d80203b@I-love.SAKURA.ne.jp
+Reviewed-by: Tigran Aivazian <aivazian.tigran@gmail.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/bfs/inode.c | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c
+index 1d41ce477df58..984b365df0460 100644
+--- a/fs/bfs/inode.c
++++ b/fs/bfs/inode.c
+@@ -61,7 +61,19 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino)
+ off = (ino - BFS_ROOT_INO) % BFS_INODES_PER_BLOCK;
+ di = (struct bfs_inode *)bh->b_data + off;
+
+- inode->i_mode = 0x0000FFFF & le32_to_cpu(di->i_mode);
++ /*
++ * https://martin.hinner.info/fs/bfs/bfs-structure.html explains that
++ * BFS in SCO UnixWare environment used only lower 9 bits of di->i_mode
++ * value. This means that, although bfs_write_inode() saves whole
++ * inode->i_mode bits (which include S_IFMT bits and S_IS{UID,GID,VTX}
++ * bits), middle 7 bits of di->i_mode value can be garbage when these
++ * bits were not saved by bfs_write_inode().
++ * Since we can't tell whether middle 7 bits are garbage, use only
++ * lower 12 bits (i.e. tolerate S_IS{UID,GID,VTX} bits possibly being
++ * garbage) and reconstruct S_IFMT bits for Linux environment from
++ * di->i_vtype value.
++ */
++ inode->i_mode = 0x00000FFF & le32_to_cpu(di->i_mode);
+ if (le32_to_cpu(di->i_vtype) == BFS_VDIR) {
+ inode->i_mode |= S_IFDIR;
+ inode->i_op = &bfs_dir_inops;
+@@ -71,6 +83,11 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino)
+ inode->i_op = &bfs_file_inops;
+ inode->i_fop = &bfs_file_operations;
+ inode->i_mapping->a_ops = &bfs_aops;
++ } else {
++ brelse(bh);
++ printf("Unknown vtype=%u %s:%08lx\n",
++ le32_to_cpu(di->i_vtype), inode->i_sb->s_id, ino);
++ goto error;
+ }
+
+ BFS_I(inode)->i_sblock = le32_to_cpu(di->i_sblock);
+--
+2.51.0
+
--- /dev/null
+From 1d239a2dade4e6dc98453f59245afb84ce5f0a73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Nov 2025 20:02:04 +0800
+Subject: Bluetooth: btrtl: Avoid loading the config file on security chips
+
+From: Max Chou <max.chou@realtek.com>
+
+[ Upstream commit cd8dbd9ef600435439bb0e70af0a1d9e2193aecb ]
+
+For chips with security enabled, it's only possible to load firmware
+with a valid signature pattern.
+If key_id is not zero, it indicates a security chip, and the driver will
+not load the config file.
+
+- Example log for a security chip.
+
+Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a
+ lmp_ver=0c lmp_subver=8922
+Bluetooth: hci0: RTL: rom_version status=0 version=1
+Bluetooth: hci0: RTL: btrtl_initialize: key id 1
+Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin
+Bluetooth: hci0: RTL: cfg_sz 0, total sz 71301
+Bluetooth: hci0: RTL: fw version 0x41c0c905
+
+- Example log for a normal chip.
+
+Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a
+ lmp_ver=0c lmp_subver=8922
+Bluetooth: hci0: RTL: rom_version status=0 version=1
+Bluetooth: hci0: RTL: btrtl_initialize: key id 0
+Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin
+Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_config.bin
+Bluetooth: hci0: RTL: cfg_sz 6, total sz 71307
+Bluetooth: hci0: RTL: fw version 0x41c0c905
+
+Tested-by: Hilda Wu <hildawu@realtek.com>
+Signed-off-by: Nial Ni <niall_ni@realsil.com.cn>
+Signed-off-by: Max Chou <max.chou@realtek.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btrtl.c | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
+index 1d4a7887abccf..52794db2739bf 100644
+--- a/drivers/bluetooth/btrtl.c
++++ b/drivers/bluetooth/btrtl.c
+@@ -50,7 +50,7 @@
+
+ #define RTL_CHIP_SUBVER (&(struct rtl_vendor_cmd) {{0x10, 0x38, 0x04, 0x28, 0x80}})
+ #define RTL_CHIP_REV (&(struct rtl_vendor_cmd) {{0x10, 0x3A, 0x04, 0x28, 0x80}})
+-#define RTL_SEC_PROJ (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0x0D, 0x00, 0xb0}})
++#define RTL_SEC_PROJ (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0xAD, 0x00, 0xb0}})
+
+ #define RTL_PATCH_SNIPPETS 0x01
+ #define RTL_PATCH_DUMMY_HEADER 0x02
+@@ -534,7 +534,6 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev,
+ {
+ struct rtl_epatch_header_v2 *hdr;
+ int rc;
+- u8 reg_val[2];
+ u8 key_id;
+ u32 num_sections;
+ struct rtl_section *section;
+@@ -549,14 +548,7 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev,
+ .len = btrtl_dev->fw_len - 7, /* Cut the tail */
+ };
+
+- rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val);
+- if (rc < 0)
+- return -EIO;
+- key_id = reg_val[0];
+-
+- rtl_dev_dbg(hdev, "%s: key id %u", __func__, key_id);
+-
+- btrtl_dev->key_id = key_id;
++ key_id = btrtl_dev->key_id;
+
+ hdr = rtl_iov_pull_data(&iov, sizeof(*hdr));
+ if (!hdr)
+@@ -1070,6 +1062,8 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
+ u16 hci_rev, lmp_subver;
+ u8 hci_ver, lmp_ver, chip_type = 0;
+ int ret;
++ int rc;
++ u8 key_id;
+ u8 reg_val[2];
+
+ btrtl_dev = kzalloc(sizeof(*btrtl_dev), GFP_KERNEL);
+@@ -1180,6 +1174,14 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
+ goto err_free;
+ }
+
++ rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val);
++ if (rc < 0)
++ goto err_free;
++
++ key_id = reg_val[0];
++ btrtl_dev->key_id = key_id;
++ rtl_dev_info(hdev, "%s: key id %u", __func__, key_id);
++
+ btrtl_dev->fw_len = -EIO;
+ if (lmp_subver == RTL_ROM_LMP_8852A && hci_rev == 0x000c) {
+ snprintf(fw_name, sizeof(fw_name), "%s_v2.bin",
+@@ -1202,7 +1204,7 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
+ goto err_free;
+ }
+
+- if (btrtl_dev->ic_info->cfg_name) {
++ if (btrtl_dev->ic_info->cfg_name && !btrtl_dev->key_id) {
+ if (postfix) {
+ snprintf(cfg_name, sizeof(cfg_name), "%s-%s.bin",
+ btrtl_dev->ic_info->cfg_name, postfix);
+--
+2.51.0
+
--- /dev/null
+From 51a1912d46ceb70602de50c167e440966b9836f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 14:05:27 +0000
+Subject: dma-mapping: Allow use of DMA_BIT_MASK(64) in global scope
+
+From: James Clark <james.clark@linaro.org>
+
+[ Upstream commit a50f7456f853ec3a6f07cbe1d16ad8a8b2501320 ]
+
+Clang doesn't like that (1ULL<<(64)) overflows when initializing a
+global scope variable, even if that part of the ternary isn't used when
+n = 64. The same initialization can be done without warnings in function
+scopes, and GCC doesn't mind either way.
+
+The build failure that highlighted this was already fixed in a different
+way [1], which also has detailed links to the Clang issues. However it's
+not going to be long before the same thing happens again, so it's better
+to fix the root cause.
+
+Fix it by using GENMASK_ULL() which does exactly the same thing, is much
+more readable anyway, and doesn't have a shift that overflows.
+
+[1]: https://lore.kernel.org/all/20250918-mmp-pdma-simplify-dma-addressing-v1-1-5c2be2b85696@riscstar.com/
+
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Link: https://lore.kernel.org/r/20251030-james-fix-dma_bit_mask-v1-1-ad1ce7cfab6e@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/dma-mapping.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
+index 55c03e5fe8cb3..277daf71ec8c7 100644
+--- a/include/linux/dma-mapping.h
++++ b/include/linux/dma-mapping.h
+@@ -70,7 +70,7 @@
+ */
+ #define DMA_MAPPING_ERROR (~(dma_addr_t)0)
+
+-#define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
++#define DMA_BIT_MASK(n) GENMASK_ULL(n - 1, 0)
+
+ struct dma_iova_state {
+ dma_addr_t addr;
+--
+2.51.0
+
--- /dev/null
+From aceb137aa316b4a112199df47c78c40633197032 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Oct 2025 14:37:07 -0400
+Subject: drm/amdkfd: Fix GPU mappings for APU after prefetch
+
+From: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+
+[ Upstream commit eac32ff42393efa6657efc821231b8d802c1d485 ]
+
+Fix the following corner case:-
+ Consider a 2M huge page SVM allocation, followed by prefetch call for
+the first 4K page. The whole range is initially mapped with single PTE.
+After the prefetch, this range gets split to first page + rest of the
+pages. Currently, the first page mapping is not updated on MI300A (APU)
+since page hasn't migrated. However, after range split PTE mapping it not
+valid.
+
+Fix this by forcing page table update for the whole range when prefetch
+is called. Calling prefetch on APU doesn't improve performance. If all
+it deteriotes. However, functionality has to be supported.
+
+v2: Use apu_prefer_gtt as this issue doesn't apply to APUs with carveout
+VRAM
+
+v3: Simplify by setting the flag for all ASICs as it doesn't affect dGPU
+
+v4: Remove v2 and v3 changes. Force update_mapping when range is split
+at a size that is not aligned to prange granularity
+
+Suggested-by: Philip Yang <Philip.Yang@amd.com>
+Signed-off-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Reviewed-by: Philip Yang<Philip.Yang@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 076470b9f6f8d9c7c8ca73a9f054942a686f9ba7)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+index 827507cfed7aa..fab6e7721c803 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+@@ -3688,6 +3688,8 @@ svm_range_set_attr(struct kfd_process *p, struct mm_struct *mm,
+ svm_range_apply_attrs(p, prange, nattr, attrs, &update_mapping);
+ /* TODO: unmap ranges from GPU that lost access */
+ }
++ update_mapping |= !p->xnack_enabled && !list_empty(&remap_list);
++
+ list_for_each_entry_safe(prange, next, &remove_list, update_list) {
+ pr_debug("unlink old 0x%p prange 0x%p [0x%lx 0x%lx]\n",
+ prange->svms, prange, prange->start,
+--
+2.51.0
+
--- /dev/null
+From 728acaa791d20fd52cc11825b97f427af6e0cd42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 14:36:40 -0500
+Subject: drm/vmwgfx: Use kref in vmw_bo_dirty
+
+From: Ian Forbes <ian.forbes@broadcom.com>
+
+[ Upstream commit c1962742ffff7e245f935903a4658eb6f94f6058 ]
+
+Rather than using an ad hoc reference count use kref which is atomic
+and has underflow warnings.
+
+Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://patch.msgid.link/20251030193640.153697-1-ian.forbes@broadcom.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c b/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c
+index 7de20e56082c8..fd4e76486f2d1 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c
+@@ -32,22 +32,22 @@ enum vmw_bo_dirty_method {
+
+ /**
+ * struct vmw_bo_dirty - Dirty information for buffer objects
++ * @ref_count: Reference count for this structure. Must be first member!
+ * @start: First currently dirty bit
+ * @end: Last currently dirty bit + 1
+ * @method: The currently used dirty method
+ * @change_count: Number of consecutive method change triggers
+- * @ref_count: Reference count for this structure
+ * @bitmap_size: The size of the bitmap in bits. Typically equal to the
+ * nuber of pages in the bo.
+ * @bitmap: A bitmap where each bit represents a page. A set bit means a
+ * dirty page.
+ */
+ struct vmw_bo_dirty {
++ struct kref ref_count;
+ unsigned long start;
+ unsigned long end;
+ enum vmw_bo_dirty_method method;
+ unsigned int change_count;
+- unsigned int ref_count;
+ unsigned long bitmap_size;
+ unsigned long bitmap[];
+ };
+@@ -221,7 +221,7 @@ int vmw_bo_dirty_add(struct vmw_bo *vbo)
+ int ret;
+
+ if (dirty) {
+- dirty->ref_count++;
++ kref_get(&dirty->ref_count);
+ return 0;
+ }
+
+@@ -235,7 +235,7 @@ int vmw_bo_dirty_add(struct vmw_bo *vbo)
+ dirty->bitmap_size = num_pages;
+ dirty->start = dirty->bitmap_size;
+ dirty->end = 0;
+- dirty->ref_count = 1;
++ kref_init(&dirty->ref_count);
+ if (num_pages < PAGE_SIZE / sizeof(pte_t)) {
+ dirty->method = VMW_BO_DIRTY_PAGETABLE;
+ } else {
+@@ -274,10 +274,8 @@ void vmw_bo_dirty_release(struct vmw_bo *vbo)
+ {
+ struct vmw_bo_dirty *dirty = vbo->dirty;
+
+- if (dirty && --dirty->ref_count == 0) {
+- kvfree(dirty);
++ if (dirty && kref_put(&dirty->ref_count, (void *)kvfree))
+ vbo->dirty = NULL;
+- }
+ }
+
+ /**
+--
+2.51.0
+
--- /dev/null
+From faa0a326d2bf62cb7b313399a7f34ebcea28a2a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Oct 2025 10:50:22 -0700
+Subject: ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct()
+
+From: Song Liu <song@kernel.org>
+
+[ Upstream commit 3e9a18e1c3e931abecf501cbb23d28d69f85bb56 ]
+
+ftrace_hash_ipmodify_enable() checks IPMODIFY and DIRECT ftrace_ops on
+the same kernel function. When needed, ftrace_hash_ipmodify_enable()
+calls ops->ops_func() to prepare the direct ftrace (BPF trampoline) to
+share the same function as the IPMODIFY ftrace (livepatch).
+
+ftrace_hash_ipmodify_enable() is called in register_ftrace_direct() path,
+but not called in modify_ftrace_direct() path. As a result, the following
+operations will break livepatch:
+
+1. Load livepatch to a kernel function;
+2. Attach fentry program to the kernel function;
+3. Attach fexit program to the kernel function.
+
+After 3, the kernel function being used will not be the livepatched
+version, but the original version.
+
+Fix this by adding __ftrace_hash_update_ipmodify() to
+__modify_ftrace_direct() and adjust some logic around the call.
+
+Signed-off-by: Song Liu <song@kernel.org>
+Reviewed-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20251027175023.1521602-3-song@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/ftrace.c | 40 +++++++++++++++++++++++++++++++---------
+ 1 file changed, 31 insertions(+), 9 deletions(-)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index cbeb7e8331310..59cfacb8a5bbd 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -1971,7 +1971,8 @@ static void ftrace_hash_rec_enable_modify(struct ftrace_ops *ops)
+ */
+ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops,
+ struct ftrace_hash *old_hash,
+- struct ftrace_hash *new_hash)
++ struct ftrace_hash *new_hash,
++ bool update_target)
+ {
+ struct ftrace_page *pg;
+ struct dyn_ftrace *rec, *end = NULL;
+@@ -2006,10 +2007,13 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops,
+ if (rec->flags & FTRACE_FL_DISABLED)
+ continue;
+
+- /* We need to update only differences of filter_hash */
++ /*
++ * Unless we are updating the target of a direct function,
++ * we only need to update differences of filter_hash
++ */
+ in_old = !!ftrace_lookup_ip(old_hash, rec->ip);
+ in_new = !!ftrace_lookup_ip(new_hash, rec->ip);
+- if (in_old == in_new)
++ if (!update_target && (in_old == in_new))
+ continue;
+
+ if (in_new) {
+@@ -2020,7 +2024,16 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops,
+ if (is_ipmodify)
+ goto rollback;
+
+- FTRACE_WARN_ON(rec->flags & FTRACE_FL_DIRECT);
++ /*
++ * If this is called by __modify_ftrace_direct()
++ * then it is only changing where the direct
++ * pointer is jumping to, and the record already
++ * points to a direct trampoline. If it isn't,
++ * then it is a bug to update ipmodify on a direct
++ * caller.
++ */
++ FTRACE_WARN_ON(!update_target &&
++ (rec->flags & FTRACE_FL_DIRECT));
+
+ /*
+ * Another ops with IPMODIFY is already
+@@ -2076,7 +2089,7 @@ static int ftrace_hash_ipmodify_enable(struct ftrace_ops *ops)
+ if (ftrace_hash_empty(hash))
+ hash = NULL;
+
+- return __ftrace_hash_update_ipmodify(ops, EMPTY_HASH, hash);
++ return __ftrace_hash_update_ipmodify(ops, EMPTY_HASH, hash, false);
+ }
+
+ /* Disabling always succeeds */
+@@ -2087,7 +2100,7 @@ static void ftrace_hash_ipmodify_disable(struct ftrace_ops *ops)
+ if (ftrace_hash_empty(hash))
+ hash = NULL;
+
+- __ftrace_hash_update_ipmodify(ops, hash, EMPTY_HASH);
++ __ftrace_hash_update_ipmodify(ops, hash, EMPTY_HASH, false);
+ }
+
+ static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops,
+@@ -2101,7 +2114,7 @@ static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops,
+ if (ftrace_hash_empty(new_hash))
+ new_hash = NULL;
+
+- return __ftrace_hash_update_ipmodify(ops, old_hash, new_hash);
++ return __ftrace_hash_update_ipmodify(ops, old_hash, new_hash, false);
+ }
+
+ static void print_ip_ins(const char *fmt, const unsigned char *p)
+@@ -6114,7 +6127,7 @@ EXPORT_SYMBOL_GPL(unregister_ftrace_direct);
+ static int
+ __modify_ftrace_direct(struct ftrace_ops *ops, unsigned long addr)
+ {
+- struct ftrace_hash *hash;
++ struct ftrace_hash *hash = ops->func_hash->filter_hash;
+ struct ftrace_func_entry *entry, *iter;
+ static struct ftrace_ops tmp_ops = {
+ .func = ftrace_stub,
+@@ -6134,13 +6147,21 @@ __modify_ftrace_direct(struct ftrace_ops *ops, unsigned long addr)
+ if (err)
+ return err;
+
++ /*
++ * Call __ftrace_hash_update_ipmodify() here, so that we can call
++ * ops->ops_func for the ops. This is needed because the above
++ * register_ftrace_function_nolock() worked on tmp_ops.
++ */
++ err = __ftrace_hash_update_ipmodify(ops, hash, hash, true);
++ if (err)
++ goto out;
++
+ /*
+ * Now the ftrace_ops_list_func() is called to do the direct callers.
+ * We can safely change the direct functions attached to each entry.
+ */
+ mutex_lock(&ftrace_lock);
+
+- hash = ops->func_hash->filter_hash;
+ size = 1 << hash->size_bits;
+ for (i = 0; i < size; i++) {
+ hlist_for_each_entry(iter, &hash->buckets[i], hlist) {
+@@ -6155,6 +6176,7 @@ __modify_ftrace_direct(struct ftrace_ops *ops, unsigned long addr)
+
+ mutex_unlock(&ftrace_lock);
+
++out:
+ /* Removing the tmp_ops will add the updated direct callers to the functions */
+ unregister_ftrace_function(&tmp_ops);
+
+--
+2.51.0
+
--- /dev/null
+From 70962d20768f3659eb60dd3ae1ee13569246fdb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Oct 2025 00:37:26 +0800
+Subject: HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list
+
+From: April Grimoire <april@aprilg.moe>
+
+[ Upstream commit 743c81cdc98fd4fef62a89eb70efff994112c2d9 ]
+
+SONiX AK870 PRO keyboard pretends to be an apple keyboard by VID:PID,
+rendering function keys not treated properly. Despite being a
+SONiX USB DEVICE, it uses a different name, so adding it to the list.
+
+Signed-off-by: April Grimoire <april@aprilg.moe>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-apple.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index 61404d7a43ee1..57da4f86a9fa7 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -355,6 +355,7 @@ static const struct apple_key_translation swapped_fn_leftctrl_keys[] = {
+
+ static const struct apple_non_apple_keyboard non_apple_keyboards[] = {
+ { "SONiX USB DEVICE" },
++ { "SONiX AK870 PRO" },
+ { "Keychron" },
+ { "AONE" },
+ { "GANSS" },
+--
+2.51.0
+
--- /dev/null
+From fdcd06268abab1f62d1a1668ccf5553beff01f49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Nov 2025 21:16:45 +0900
+Subject: HID: elecom: Add support for ELECOM M-XT3URBK (018F)
+
+From: Naoki Ueki <naoki25519@gmail.com>
+
+[ Upstream commit cdcbb8e8d10f656642380ee13516290437b52b36 ]
+
+The ELECOM M-XT3URBK trackball has an additional device ID (0x018F), which
+shares the same report descriptor as the existing device (0x00FB). However,
+the driver does not currently recognize this new ID, resulting in only five
+buttons being functional.
+
+This patch adds the new device ID so that all six buttons work properly.
+
+Signed-off-by: Naoki Ueki <naoki25519@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-elecom.c | 6 ++++--
+ drivers/hid/hid-ids.h | 3 ++-
+ drivers/hid/hid-quirks.c | 3 ++-
+ 3 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c
+index 69771fd350060..981d1b6e96589 100644
+--- a/drivers/hid/hid-elecom.c
++++ b/drivers/hid/hid-elecom.c
+@@ -75,7 +75,8 @@ static const __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ */
+ mouse_button_fixup(hdev, rdesc, *rsize, 20, 28, 22, 14, 8);
+ break;
+- case USB_DEVICE_ID_ELECOM_M_XT3URBK:
++ case USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB:
++ case USB_DEVICE_ID_ELECOM_M_XT3URBK_018F:
+ case USB_DEVICE_ID_ELECOM_M_XT3DRBK:
+ case USB_DEVICE_ID_ELECOM_M_XT4DRBK:
+ /*
+@@ -119,7 +120,8 @@ static const __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ static const struct hid_device_id elecom_devices[] = {
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 85db279baa72e..c4589075a5ed6 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -449,7 +449,8 @@
+ #define USB_VENDOR_ID_ELECOM 0x056e
+ #define USB_DEVICE_ID_ELECOM_BM084 0x0061
+ #define USB_DEVICE_ID_ELECOM_M_XGL20DLBK 0x00e6
+-#define USB_DEVICE_ID_ELECOM_M_XT3URBK 0x00fb
++#define USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB 0x00fb
++#define USB_DEVICE_ID_ELECOM_M_XT3URBK_018F 0x018f
+ #define USB_DEVICE_ID_ELECOM_M_XT3DRBK 0x00fc
+ #define USB_DEVICE_ID_ELECOM_M_XT4DRBK 0x00fd
+ #define USB_DEVICE_ID_ELECOM_M_DT1URBK 0x00fe
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 22760ac50f2d9..c89a015686c07 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -410,7 +410,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ #if IS_ENABLED(CONFIG_HID_ELECOM)
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) },
+--
+2.51.0
+
--- /dev/null
+From 1d1e23e2dba577a92fc747d8ac72c718c71bfc7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 11:06:25 -0500
+Subject: HID: hid-input: Extend Elan ignore battery quirk to USB
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit 534ca75e8e3b713514b3f2da85dab96831cf5b2a ]
+
+USB Elan devices have the same problem as the I2C ones with a fake
+battery device showing up.
+
+Reviewed-by: Hans de Goede <hansg@kernel.org>
+Reported-by: André Barata <andretiagob@protonmail.com>
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220722
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-input.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 2c743e35c1d33..bc7de9ef45ecd 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -386,10 +386,11 @@ static const struct hid_device_id hid_battery_quirks[] = {
+ { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_CHROMEBOOK_TROGDOR_POMPOM),
+ HID_BATTERY_QUIRK_AVOID_QUERY },
+ /*
+- * Elan I2C-HID touchscreens seem to all report a non present battery,
+- * set HID_BATTERY_QUIRK_IGNORE for all Elan I2C-HID devices.
++ * Elan HID touchscreens seem to all report a non present battery,
++ * set HID_BATTERY_QUIRK_IGNORE for all Elan I2C and USB HID devices.
+ */
+ { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_IGNORE },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_IGNORE },
+ {}
+ };
+
+--
+2.51.0
+
--- /dev/null
+From c3a5b8bd69f6d9c956bb022373a4778d2df31a37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Oct 2025 15:35:15 +0900
+Subject: HID: lenovo: fixup Lenovo Yoga Slim 7x Keyboard rdesc
+
+From: Lauri Tirkkonen <lauri@hacktheplanet.fi>
+
+[ Upstream commit a45f15808fb753a14c6041fd1e5bef5d552bd2e3 ]
+
+The keyboard of this device has the following in its report description
+for Usage (Keyboard) in Collection (Application):
+
+ # 0x15, 0x00, // Logical Minimum (0) 52
+ # 0x25, 0x65, // Logical Maximum (101) 54
+ # 0x05, 0x07, // Usage Page (Keyboard) 56
+ # 0x19, 0x00, // Usage Minimum (0) 58
+ # 0x29, 0xdd, // Usage Maximum (221) 60
+ # 0x81, 0x00, // Input (Data,Arr,Abs) 62
+
+Since the Usage Min/Max range exceeds the Logical Min/Max range,
+keypresses outside the Logical range are not recognized. This includes,
+for example, the Japanese language keyboard variant's keys for |, _ and
+\.
+
+Fixup the report description to make the Logical range match the Usage
+range, fixing the interpretation of keypresses above 101 on this device.
+
+Signed-off-by: Lauri Tirkkonen <lauri@hacktheplanet.fi>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-lenovo.c | 17 +++++++++++++++++
+ 2 files changed, 18 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 52ae7c29f9e08..85db279baa72e 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -718,6 +718,7 @@
+ #define USB_DEVICE_ID_ITE_LENOVO_YOGA2 0x8350
+ #define I2C_DEVICE_ID_ITE_LENOVO_LEGION_Y720 0x837a
+ #define USB_DEVICE_ID_ITE_LENOVO_YOGA900 0x8396
++#define I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_KEYBOARD 0x8987
+ #define USB_DEVICE_ID_ITE8595 0x8595
+ #define USB_DEVICE_ID_ITE_MEDION_E1239T 0xce50
+
+diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c
+index 654879814f97a..9cc3e029e9f61 100644
+--- a/drivers/hid/hid-lenovo.c
++++ b/drivers/hid/hid-lenovo.c
+@@ -148,6 +148,14 @@ static const __u8 lenovo_tpIIbtkbd_need_fixup_collection[] = {
+ 0x81, 0x01, /* Input (Const,Array,Abs,No Wrap,Linear,Preferred State,No Null Position) */
+ };
+
++static const __u8 lenovo_yoga7x_kbd_need_fixup_collection[] = {
++ 0x15, 0x00, // Logical Minimum (0)
++ 0x25, 0x65, // Logical Maximum (101)
++ 0x05, 0x07, // Usage Page (Keyboard)
++ 0x19, 0x00, // Usage Minimum (0)
++ 0x29, 0xDD, // Usage Maximum (221)
++};
++
+ static const __u8 *lenovo_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ unsigned int *rsize)
+ {
+@@ -177,6 +185,13 @@ static const __u8 *lenovo_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ rdesc[260] = 0x01; /* report count (2) = 0x01 */
+ }
+ break;
++ case I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_KEYBOARD:
++ if (*rsize == 176 &&
++ memcmp(&rdesc[52], lenovo_yoga7x_kbd_need_fixup_collection,
++ sizeof(lenovo_yoga7x_kbd_need_fixup_collection)) == 0) {
++ rdesc[55] = rdesc[61]; // logical maximum = usage maximum
++ }
++ break;
+ }
+ return rdesc;
+ }
+@@ -1538,6 +1553,8 @@ static const struct hid_device_id lenovo_devices[] = {
+ USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X12_TAB) },
+ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+ USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X12_TAB2) },
++ { HID_DEVICE(BUS_I2C, HID_GROUP_GENERIC,
++ USB_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_KEYBOARD) },
+ { }
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 7dfce754d9ddbf924757751845058bf95d678641 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 14:42:05 +0800
+Subject: LoongArch: Mask all interrupts during kexec/kdump
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit 863a320dc6fd7c855f47da4bb82a8de2d9102ea2 ]
+
+If the default state of the interrupt controllers in the first kernel
+don't mask any interrupts, it may cause the second kernel to potentially
+receive interrupts (which were previously allocated by the first kernel)
+immediately after a CPU becomes online during its boot process. These
+interrupts cannot be properly routed, leading to bad IRQ issues.
+
+This patch calls machine_kexec_mask_interrupts() to mask all interrupts
+during the kexec/kdump process.
+
+Signed-off-by: Tianyang Zhang <zhangtianyang@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/kernel/machine_kexec.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/loongarch/kernel/machine_kexec.c b/arch/loongarch/kernel/machine_kexec.c
+index f9381800e291c..8ef4e4595d61a 100644
+--- a/arch/loongarch/kernel/machine_kexec.c
++++ b/arch/loongarch/kernel/machine_kexec.c
+@@ -249,6 +249,7 @@ void machine_crash_shutdown(struct pt_regs *regs)
+ #ifdef CONFIG_SMP
+ crash_smp_send_stop();
+ #endif
++ machine_kexec_mask_interrupts();
+ cpumask_set_cpu(crashing_cpu, &cpus_in_crash);
+
+ pr_info("Starting crashdump kernel...\n");
+@@ -286,6 +287,7 @@ void machine_kexec(struct kimage *image)
+
+ /* We do not want to be bothered. */
+ local_irq_disable();
++ machine_kexec_mask_interrupts();
+
+ pr_notice("EFI boot flag 0x%lx\n", efi_boot);
+ pr_notice("Command line at 0x%lx\n", cmdline_ptr);
+--
+2.51.0
+
--- /dev/null
+From de17352d58c606b9320371856926c7140d1ddd1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 14:48:30 -0800
+Subject: nvme: fix admin request_queue lifetime
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit 03b3bcd319b3ab5182bc9aaa0421351572c78ac0 ]
+
+The namespaces can access the controller's admin request_queue, and
+stale references on the namespaces may exist after tearing down the
+controller. Ensure the admin request_queue is active by moving the
+controller's 'put' to after all controller references have been released
+to ensure no one is can access the request_queue. This fixes a reported
+use-after-free bug:
+
+ BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0
+ Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287
+ CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G E 6.13.2-ga1582f1a031e #15
+ Tainted: [E]=UNSIGNED_MODULE
+ Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025
+ Call Trace:
+ <TASK>
+ dump_stack_lvl+0x4f/0x60
+ print_report+0xc4/0x620
+ ? _raw_spin_lock_irqsave+0x70/0xb0
+ ? _raw_read_unlock_irqrestore+0x30/0x30
+ ? blk_queue_enter+0x41c/0x4a0
+ kasan_report+0xab/0xe0
+ ? blk_queue_enter+0x41c/0x4a0
+ blk_queue_enter+0x41c/0x4a0
+ ? __irq_work_queue_local+0x75/0x1d0
+ ? blk_queue_start_drain+0x70/0x70
+ ? irq_work_queue+0x18/0x20
+ ? vprintk_emit.part.0+0x1cc/0x350
+ ? wake_up_klogd_work_func+0x60/0x60
+ blk_mq_alloc_request+0x2b7/0x6b0
+ ? __blk_mq_alloc_requests+0x1060/0x1060
+ ? __switch_to+0x5b7/0x1060
+ nvme_submit_user_cmd+0xa9/0x330
+ nvme_user_cmd.isra.0+0x240/0x3f0
+ ? force_sigsegv+0xe0/0xe0
+ ? nvme_user_cmd64+0x400/0x400
+ ? vfs_fileattr_set+0x9b0/0x9b0
+ ? cgroup_update_frozen_flag+0x24/0x1c0
+ ? cgroup_leave_frozen+0x204/0x330
+ ? nvme_ioctl+0x7c/0x2c0
+ blkdev_ioctl+0x1a8/0x4d0
+ ? blkdev_common_ioctl+0x1930/0x1930
+ ? fdget+0x54/0x380
+ __x64_sys_ioctl+0x129/0x190
+ do_syscall_64+0x5b/0x160
+ entry_SYSCALL_64_after_hwframe+0x4b/0x53
+ RIP: 0033:0x7f765f703b0b
+ Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48
+ RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
+ RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b
+ RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003
+ RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000
+ R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003
+ R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60
+ </TASK>
+
+Reported-by: Casey Chen <cachen@purestorage.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 5714d49932822..28c598008124c 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -4896,7 +4896,6 @@ void nvme_remove_admin_tag_set(struct nvme_ctrl *ctrl)
+ */
+ nvme_stop_keep_alive(ctrl);
+ blk_mq_destroy_queue(ctrl->admin_q);
+- blk_put_queue(ctrl->admin_q);
+ if (ctrl->ops->flags & NVME_F_FABRICS) {
+ blk_mq_destroy_queue(ctrl->fabrics_q);
+ blk_put_queue(ctrl->fabrics_q);
+@@ -5040,6 +5039,8 @@ static void nvme_free_ctrl(struct device *dev)
+ container_of(dev, struct nvme_ctrl, ctrl_device);
+ struct nvme_subsystem *subsys = ctrl->subsys;
+
++ if (ctrl->admin_q)
++ blk_put_queue(ctrl->admin_q);
+ if (!subsys || ctrl->instance != subsys->instance)
+ ida_free(&nvme_instance_ida, ctrl->instance);
+ nvme_free_cels(ctrl);
+--
+2.51.0
+
--- /dev/null
+From 5604855f17d51414f147886b598db4a4169a0eb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 15:40:41 +0530
+Subject: pinctrl: qcom: msm: Fix deadlock in pinmux configuration
+
+From: Praveen Talari <praveen.talari@oss.qualcomm.com>
+
+[ Upstream commit 1c2e70397b4125022dba80f6111271a37fb36bae ]
+
+Replace disable_irq() with disable_irq_nosync() in msm_pinmux_set_mux()
+to prevent deadlock when wakeup IRQ is triggered on the same
+GPIO being reconfigured.
+
+The issue occurs when a wakeup IRQ is triggered on a GPIO and the IRQ
+handler attempts to reconfigure the same GPIO's pinmux. In this scenario,
+msm_pinmux_set_mux() calls disable_irq() which waits for the currently
+running IRQ handler to complete, creating a circular dependency that
+results in deadlock.
+
+Using disable_irq_nosync() avoids waiting for the IRQ handler to
+complete, preventing the deadlock condition while still properly
+disabling the interrupt during pinmux reconfiguration.
+
+Suggested-by: Prasad Sodagudi <prasad.sodagudi@oss.qualcomm.com>
+Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com>
+Reviewed-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/qcom/pinctrl-msm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
+index 83eb075b6bfa1..3d6601dc6fcc5 100644
+--- a/drivers/pinctrl/qcom/pinctrl-msm.c
++++ b/drivers/pinctrl/qcom/pinctrl-msm.c
+@@ -215,7 +215,7 @@ static int msm_pinmux_set_mux(struct pinctrl_dev *pctldev,
+ */
+ if (d && i != gpio_func &&
+ !test_and_set_bit(d->hwirq, pctrl->disabled_for_mux))
+- disable_irq(irq);
++ disable_irq_nosync(irq);
+
+ raw_spin_lock_irqsave(&pctrl->lock, flags);
+
+--
+2.51.0
+
--- /dev/null
+From af37fa6437c878210f989384b1856c4527f9e759 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 16:59:38 +0100
+Subject: platform/x86: acer-wmi: Ignore backlight event
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 444a9256f8d106e08a6bc2dc8ef28a8699e4b3ba ]
+
+On the Acer Nitro AN515-58, the event 4 - 0 is send by the ACPI
+firmware when the backlight up/down keys are pressed. Ignore this
+event to avoid spamming the kernel log with error messages, as the
+acpi-video driver already handles brightness up/down events.
+
+Reported-by: Bugaddr <Bugaddr@protonmail.com>
+Closes: https://bugaddr.tech/posts/2025-11-16-debugging-the-acer-nitro-5-an515-58-fn-f10-keyboard-backlight-bug-on-linux/#wmi-interface-issues
+Tested-by: Bugaddr <Bugaddr@protonmail.com>
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://patch.msgid.link/20251117155938.3030-1-W_Armin@gmx.de
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/acer-wmi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
+index 13eb22b35aa8f..d848afc91f87d 100644
+--- a/drivers/platform/x86/acer-wmi.c
++++ b/drivers/platform/x86/acer-wmi.c
+@@ -102,6 +102,7 @@ MODULE_ALIAS("wmi:676AA15E-6A47-4D9F-A2CC-1E6D18D14026");
+
+ enum acer_wmi_event_ids {
+ WMID_HOTKEY_EVENT = 0x1,
++ WMID_BACKLIGHT_EVENT = 0x4,
+ WMID_ACCEL_OR_KBD_DOCK_EVENT = 0x5,
+ WMID_GAMING_TURBO_KEY_EVENT = 0x7,
+ WMID_AC_EVENT = 0x8,
+@@ -2369,6 +2370,9 @@ static void acer_wmi_notify(union acpi_object *obj, void *context)
+ sparse_keymap_report_event(acer_wmi_input_dev, scancode, 1, true);
+ }
+ break;
++ case WMID_BACKLIGHT_EVENT:
++ /* Already handled by acpi-video */
++ break;
+ case WMID_ACCEL_OR_KBD_DOCK_EVENT:
+ acer_gsensor_event();
+ acer_kbd_dock_event(&return_value);
+--
+2.51.0
+
--- /dev/null
+From c035e88ad8846e7568f7f78fae115427644448d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 15:50:57 +0200
+Subject: platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Antheas Kapenekakis <lkml@antheas.dev>
+
+[ Upstream commit f945afe01c6768dcfed7868c671a26e1164c2284 ]
+
+The Lenovo Legion Go 2 takes a long time to resume from suspend.
+This is due to it having an nvme resume handler that interferes
+with IOMMU mappings. It is a common issue with older Lenovo
+laptops. Adding it to that quirk list fixes this issue.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4618
+Suggested-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20251008135057.731928-1-lkml@antheas.dev
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc/pmc-quirks.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+index d63aaad7ef599..0fadcf5f288ac 100644
+--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c
++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+@@ -204,6 +204,23 @@ static const struct dmi_system_id fwbug_list[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "82ND"),
+ }
+ },
++ /* https://gitlab.freedesktop.org/drm/amd/-/issues/4618 */
++ {
++ .ident = "Lenovo Legion Go 2",
++ .driver_data = &quirk_s2idle_bug,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "83N0"),
++ }
++ },
++ {
++ .ident = "Lenovo Legion Go 2",
++ .driver_data = &quirk_s2idle_bug,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "83N1"),
++ }
++ },
+ /* https://gitlab.freedesktop.org/drm/amd/-/issues/2684 */
+ {
+ .ident = "HP Laptop 15s-eq2xxx",
+--
+2.51.0
+
--- /dev/null
+From b2d409fdf2953b7c32e755b51a418dc94598f809 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Oct 2025 17:21:51 +0200
+Subject: platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Antheas Kapenekakis <lkml@antheas.dev>
+
+[ Upstream commit c0ddc54016636dd8dedfaf1a3b482a95058e1db2 ]
+
+The Xbox Ally features a Van Gogh SoC that has spurious interrupts
+during resume. We get the following logs:
+
+atkbd_receive_byte: 20 callbacks suppressed
+atkbd serio0: Spurious ACK on isa0060/serio0. Some program might be trying to access hardware directly.
+
+So, add the spurious_8042 quirk for it. It does not have a keyboard, so
+this does not result in any functional loss.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4659
+Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20251024152152.3981721-3-lkml@antheas.dev
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc/pmc-quirks.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+index 0fadcf5f288ac..404e62ad293a9 100644
+--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c
++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+@@ -122,6 +122,14 @@ static const struct dmi_system_id fwbug_list[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "21A1"),
+ }
+ },
++ {
++ .ident = "ROG Xbox Ally RC73YA",
++ .driver_data = &quirk_spurious_8042,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_BOARD_NAME, "RC73YA"),
++ }
++ },
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=218024 */
+ {
+ .ident = "V14 G4 AMN",
+--
+2.51.0
+
--- /dev/null
+From f1d03893b76db2e2913f8e44c808a162fe3798b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Oct 2025 17:21:50 +0200
+Subject: platform/x86/amd/pmc: Add support for Van Gogh SoC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Antheas Kapenekakis <lkml@antheas.dev>
+
+[ Upstream commit db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb ]
+
+The ROG Xbox Ally (non-X) SoC features a similar architecture to the
+Steam Deck. While the Steam Deck supports S3 (s2idle causes a crash),
+this support was dropped by the Xbox Ally which only S0ix suspend.
+
+Since the handler is missing here, this causes the device to not suspend
+and the AMD GPU driver to crash while trying to resume afterwards due to
+a power hang.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4659
+Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Acked-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Link: https://patch.msgid.link/20251024152152.3981721-2-lkml@antheas.dev
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc/pmc.c | 3 +++
+ drivers/platform/x86/amd/pmc/pmc.h | 1 +
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmc/pmc.c b/drivers/platform/x86/amd/pmc/pmc.c
+index bd318fd02ccf4..cae3fcafd4d7b 100644
+--- a/drivers/platform/x86/amd/pmc/pmc.c
++++ b/drivers/platform/x86/amd/pmc/pmc.c
+@@ -106,6 +106,7 @@ static void amd_pmc_get_ip_info(struct amd_pmc_dev *dev)
+ switch (dev->cpu_id) {
+ case AMD_CPU_ID_PCO:
+ case AMD_CPU_ID_RN:
++ case AMD_CPU_ID_VG:
+ case AMD_CPU_ID_YC:
+ case AMD_CPU_ID_CB:
+ dev->num_ips = 12;
+@@ -517,6 +518,7 @@ static int amd_pmc_get_os_hint(struct amd_pmc_dev *dev)
+ case AMD_CPU_ID_PCO:
+ return MSG_OS_HINT_PCO;
+ case AMD_CPU_ID_RN:
++ case AMD_CPU_ID_VG:
+ case AMD_CPU_ID_YC:
+ case AMD_CPU_ID_CB:
+ case AMD_CPU_ID_PS:
+@@ -717,6 +719,7 @@ static const struct pci_device_id pmc_pci_ids[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, AMD_CPU_ID_RV) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, AMD_CPU_ID_SP) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, AMD_CPU_ID_SHP) },
++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, AMD_CPU_ID_VG) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M20H_ROOT) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M60H_ROOT) },
+ { }
+diff --git a/drivers/platform/x86/amd/pmc/pmc.h b/drivers/platform/x86/amd/pmc/pmc.h
+index 62f3e51020fdf..fe3f53eb59558 100644
+--- a/drivers/platform/x86/amd/pmc/pmc.h
++++ b/drivers/platform/x86/amd/pmc/pmc.h
+@@ -156,6 +156,7 @@ void amd_mp2_stb_deinit(struct amd_pmc_dev *dev);
+ #define AMD_CPU_ID_RN 0x1630
+ #define AMD_CPU_ID_PCO AMD_CPU_ID_RV
+ #define AMD_CPU_ID_CZN AMD_CPU_ID_RN
++#define AMD_CPU_ID_VG 0x1645
+ #define AMD_CPU_ID_YC 0x14B5
+ #define AMD_CPU_ID_CB 0x14D8
+ #define AMD_CPU_ID_PS 0x14E8
+--
+2.51.0
+
--- /dev/null
+From e9e9d3059ba59d836282e2604b83ffce65c06e4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Oct 2025 16:40:01 +0530
+Subject: platform/x86: hp-wmi: Add Omen 16-wf1xxx fan support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Krishna Chomal <krishna.chomal108@gmail.com>
+
+[ Upstream commit fb146a38cb119c8d69633851c7a2ce2c8d34861a ]
+
+The newer HP Omen laptops, such as Omen 16-wf1xxx, use the same
+WMI-based thermal profile interface as Victus 16-r1000 and 16-s1000
+models.
+
+Add the DMI board name "8C78" to the victus_s_thermal_profile_boards
+list to enable proper fan and thermal mode control.
+
+Tested on: HP Omen 16-wf1xxx (board 8C78)
+Result:
+* Fan RPMs are readable
+* echo 0 | sudo tee /sys/devices/platform/hp-wmi/hwmon/*/pwm1_enable
+ allows the fans to run on max RPM.
+
+Signed-off-by: Krishna Chomal <krishna.chomal108@gmail.com>
+Link: https://patch.msgid.link/20251018111001.56625-1-krishna.chomal108@gmail.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/hp/hp-wmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c
+index 9a668e2587952..e10c75d91f248 100644
+--- a/drivers/platform/x86/hp/hp-wmi.c
++++ b/drivers/platform/x86/hp/hp-wmi.c
+@@ -95,7 +95,7 @@ static const char * const victus_thermal_profile_boards[] = {
+ /* DMI Board names of Victus 16-r and Victus 16-s laptops */
+ static const char * const victus_s_thermal_profile_boards[] = {
+ "8BBE", "8BD4", "8BD5",
+- "8C99", "8C9C"
++ "8C78", "8C99", "8C9C",
+ };
+
+ enum hp_wmi_radio {
+--
+2.51.0
+
--- /dev/null
+From 5791007ea564a1fd58c5c45a0eda4e812b0912b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Nov 2025 12:47:41 +0100
+Subject: platform/x86: hp-wmi: Add Omen MAX 16-ah0xx fan support and thermal
+ profile
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marcos Vega <marcosmola2@gmail.com>
+
+[ Upstream commit fa0498f8047536b877819ce4ab154d332b243d43 ]
+
+New HP Omen laptops follow the same WMI thermal profile as Victus
+16-r1000 and 16-s1000.
+
+Add DMI board 8D41 to victus_s_thermal_profile_boards.
+
+Signed-off-by: Marcos Vega <marcosmola2@gmail.com>
+Link: https://patch.msgid.link/20251108114739.9255-3-marcosmola2@gmail.com
+[ij: changelog taken partially from v1]
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/hp/hp-wmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c
+index e10c75d91f248..ad9d9f97960f2 100644
+--- a/drivers/platform/x86/hp/hp-wmi.c
++++ b/drivers/platform/x86/hp/hp-wmi.c
+@@ -96,6 +96,7 @@ static const char * const victus_thermal_profile_boards[] = {
+ static const char * const victus_s_thermal_profile_boards[] = {
+ "8BBE", "8BD4", "8BD5",
+ "8C78", "8C99", "8C9C",
++ "8D41",
+ };
+
+ enum hp_wmi_radio {
+--
+2.51.0
+
--- /dev/null
+From 90bd390c334dc75a19a380e3649cb5919afe8289 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Oct 2025 21:10:44 +0300
+Subject: platform/x86: hp-wmi: mark Victus 16-r0 and 16-s0 for victus_s fan
+ and thermal profile support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Edip Hazuri <edip@medip.dev>
+
+[ Upstream commit 54afb047cd7eb40149f3fc42d69fd4ddde2be9f0 ]
+
+This patch adds Victus 16-r0 (8bbe) and Victus 16-s0(8bd4, 8bd5) laptop
+DMI board name into existing list
+
+Signed-off-by: Edip Hazuri <edip@medip.dev>
+Link: https://patch.msgid.link/20251015181042.23961-3-edip@medip.dev
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/hp/hp-wmi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c
+index 8b3533d6ba091..9a668e2587952 100644
+--- a/drivers/platform/x86/hp/hp-wmi.c
++++ b/drivers/platform/x86/hp/hp-wmi.c
+@@ -92,8 +92,9 @@ static const char * const victus_thermal_profile_boards[] = {
+ "8A25"
+ };
+
+-/* DMI Board names of Victus 16-r1000 and Victus 16-s1000 laptops */
++/* DMI Board names of Victus 16-r and Victus 16-s laptops */
+ static const char * const victus_s_thermal_profile_boards[] = {
++ "8BBE", "8BD4", "8BD5",
+ "8C99", "8C9C"
+ };
+
+--
+2.51.0
+
--- /dev/null
+From 5a1a79da6c2b3d8c4c9fc28b66b627bfc3e8578d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Oct 2025 05:18:38 +0000
+Subject: platform/x86: huawei-wmi: add keys for HONOR models
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jia Ston <ston.jia@outlook.com>
+
+[ Upstream commit 5c72329716d0858621021193330594d5d26bf44d ]
+
+HONOR MagicBook X16/X14 models produced in 2025 cannot use the Print
+Screen and YOYO keys properly, with the system reporting them as
+unknown key presses (codes: 0x028b and 0x028e).
+
+To resolve this, a key_entry is added for both the HONOR Print Screen
+key and the HONOR YOYO key, ensuring they function correctly on these
+models.
+
+Signed-off-by: Ston Jia <ston.jia@outlook.com>
+Link: https://patch.msgid.link/20251029051804.220111-1-ston.jia@outlook.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/huawei-wmi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/platform/x86/huawei-wmi.c b/drivers/platform/x86/huawei-wmi.c
+index c3772df34679f..8a4c54089ace3 100644
+--- a/drivers/platform/x86/huawei-wmi.c
++++ b/drivers/platform/x86/huawei-wmi.c
+@@ -81,6 +81,10 @@ static const struct key_entry huawei_wmi_keymap[] = {
+ { KE_KEY, 0x289, { KEY_WLAN } },
+ // Huawei |M| key
+ { KE_KEY, 0x28a, { KEY_CONFIG } },
++ // HONOR YOYO key
++ { KE_KEY, 0x28b, { KEY_NOTIFICATION_CENTER } },
++ // HONOR print screen
++ { KE_KEY, 0x28e, { KEY_PRINT } },
+ // Keyboard backlit
+ { KE_IGNORE, 0x293, { KEY_KBDILLUMTOGGLE } },
+ { KE_IGNORE, 0x294, { KEY_KBDILLUMUP } },
+--
+2.51.0
+
--- /dev/null
+From 1ec689d4c4d9b2bc700093f4d972a3a41e0d642f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 15:50:41 -0800
+Subject: platform/x86/intel/hid: Add Nova Lake support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+
+[ Upstream commit ddf5ffff3a5fe95bed178f5554596b93c52afbc9 ]
+
+Add ACPI ID for Nova Lake.
+
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Link: https://patch.msgid.link/20251110235041.123685-1-srinivas.pandruvada@linux.intel.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/hid.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c
+index f25a427cccdac..9c07a7faf18fe 100644
+--- a/drivers/platform/x86/intel/hid.c
++++ b/drivers/platform/x86/intel/hid.c
+@@ -55,6 +55,7 @@ static const struct acpi_device_id intel_hid_ids[] = {
+ { "INTC10CB" },
+ { "INTC10CC" },
+ { "INTC10F1" },
++ { "INTC10F2" },
+ { }
+ };
+ MODULE_DEVICE_TABLE(acpi, intel_hid_ids);
+--
+2.51.0
+
--- /dev/null
+From 325fecc1bdf03b0c7bcc8539fc4b89e1a62526b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Oct 2025 14:17:33 -0700
+Subject: platform/x86: intel-uncore-freq: Add additional client processors
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+
+[ Upstream commit a229809c18926e79aeca232d5b502157beb0dec3 ]
+
+Add Intel uncore frequency driver support for Pantherlake, Wildcatlake
+and Novalake processors.
+
+Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Link: https://patch.msgid.link/20251022211733.3565526-1-sathyanarayanan.kuppuswamy@linux.intel.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/x86/intel/uncore-frequency/uncore-frequency.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c
+index 2a6897035150c..0dfc552b28024 100644
+--- a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c
++++ b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c
+@@ -256,6 +256,10 @@ static const struct x86_cpu_id intel_uncore_cpu_ids[] = {
+ X86_MATCH_VFM(INTEL_ARROWLAKE, NULL),
+ X86_MATCH_VFM(INTEL_ARROWLAKE_H, NULL),
+ X86_MATCH_VFM(INTEL_LUNARLAKE_M, NULL),
++ X86_MATCH_VFM(INTEL_PANTHERLAKE_L, NULL),
++ X86_MATCH_VFM(INTEL_WILDCATLAKE_L, NULL),
++ X86_MATCH_VFM(INTEL_NOVALAKE, NULL),
++ X86_MATCH_VFM(INTEL_NOVALAKE_L, NULL),
+ {}
+ };
+ MODULE_DEVICE_TABLE(x86cpu, intel_uncore_cpu_ids);
+--
+2.51.0
+
--- /dev/null
+From 85cee045fcb78876badd950e6f49b168edf5bd86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 09:29:02 -0800
+Subject: samples: work around glibc redefining some of our defines wrong
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit a48f822908982353c3256e35a089e9e7d0d61580 ]
+
+Apparently as of version 2.42, glibc headers define AT_RENAME_NOREPLACE
+and some of the other flags for renameat2() and friends in <stdio.h>.
+
+Which would all be fine, except for inexplicable reasons glibc decided
+to define them _differently_ from the kernel definitions, which then
+makes some of our sample code that includes both kernel headers and user
+space headers unhappy, because the compiler will (correctly) complain
+about redefining things.
+
+Now, mixing kernel headers and user space headers is always a somewhat
+iffy proposition due to namespacing issues, but it's kind of inevitable
+in our sample and selftest code. And this is just glibc being stupid.
+
+Those defines come from the kernel, glibc is exposing the kernel
+interfaces, and glibc shouldn't make up some random new expressions for
+these values.
+
+It's not like glibc headers changed the actual result values, but they
+arbitrarily just decided to use a different expression to describe those
+values. The kernel just does
+
+ #define AT_RENAME_NOREPLACE 0x0001
+
+while glibc does
+
+ # define RENAME_NOREPLACE (1 << 0)
+ # define AT_RENAME_NOREPLACE RENAME_NOREPLACE
+
+instead. Same value in the end, but very different macro definition.
+
+For absolutely no reason.
+
+This has since been fixed in the glibc development tree, so eventually
+we'll end up with the canonical expressions and no clashes. But in the
+meantime the broken headers are in the glibc-2.42 release and have made
+it out into distributions.
+
+Do a minimal work-around to make the samples build cleanly by just
+undefining the affected macros in between the user space header include
+and the kernel header includes.
+
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/vfs/test-statx.c | 6 ++++++
+ samples/watch_queue/watch_test.c | 6 ++++++
+ 2 files changed, 12 insertions(+)
+
+diff --git a/samples/vfs/test-statx.c b/samples/vfs/test-statx.c
+index 49c7a46cee073..424a6fa15723c 100644
+--- a/samples/vfs/test-statx.c
++++ b/samples/vfs/test-statx.c
+@@ -19,6 +19,12 @@
+ #include <time.h>
+ #include <sys/syscall.h>
+ #include <sys/types.h>
++
++// Work around glibc header silliness
++#undef AT_RENAME_NOREPLACE
++#undef AT_RENAME_EXCHANGE
++#undef AT_RENAME_WHITEOUT
++
+ #include <linux/stat.h>
+ #include <linux/fcntl.h>
+ #define statx foo
+diff --git a/samples/watch_queue/watch_test.c b/samples/watch_queue/watch_test.c
+index 8c6cb57d5cfc5..24cf7d7a19725 100644
+--- a/samples/watch_queue/watch_test.c
++++ b/samples/watch_queue/watch_test.c
+@@ -16,6 +16,12 @@
+ #include <errno.h>
+ #include <sys/ioctl.h>
+ #include <limits.h>
++
++// Work around glibc header silliness
++#undef AT_RENAME_NOREPLACE
++#undef AT_RENAME_EXCHANGE
++#undef AT_RENAME_WHITEOUT
++
+ #include <linux/watch_queue.h>
+ #include <linux/unistd.h>
+ #include <linux/keyctl.h>
+--
+2.51.0
+
--- /dev/null
+From 1ecfe4db629fa982a9091770f821b38864036565 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Nov 2025 19:43:55 +0800
+Subject: sched_ext: Fix possible deadlock in the deferred_irq_workfn()
+
+From: Zqiang <qiang.zhang@linux.dev>
+
+[ Upstream commit a257e974210320ede524f340ffe16bf4bf0dda1e ]
+
+For PREEMPT_RT=y kernels, the deferred_irq_workfn() is executed in
+the per-cpu irq_work/* task context and not disable-irq, if the rq
+returned by container_of() is current CPU's rq, the following scenarios
+may occur:
+
+lock(&rq->__lock);
+<Interrupt>
+ lock(&rq->__lock);
+
+This commit use IRQ_WORK_INIT_HARD() to replace init_irq_work() to
+initialize rq->scx.deferred_irq_work, make the deferred_irq_workfn()
+is always invoked in hard-irq context.
+
+Signed-off-by: Zqiang <qiang.zhang@linux.dev>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/ext.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c
+index 1e4740de66c28..16a7ae9b29ae4 100644
+--- a/kernel/sched/ext.c
++++ b/kernel/sched/ext.c
+@@ -5377,7 +5377,7 @@ void __init init_sched_ext_class(void)
+ BUG_ON(!zalloc_cpumask_var_node(&rq->scx.cpus_to_kick_if_idle, GFP_KERNEL, n));
+ BUG_ON(!zalloc_cpumask_var_node(&rq->scx.cpus_to_preempt, GFP_KERNEL, n));
+ BUG_ON(!zalloc_cpumask_var_node(&rq->scx.cpus_to_wait, GFP_KERNEL, n));
+- init_irq_work(&rq->scx.deferred_irq_work, deferred_irq_workfn);
++ rq->scx.deferred_irq_work = IRQ_WORK_INIT_HARD(deferred_irq_workfn);
+ init_irq_work(&rq->scx.kick_cpus_irq_work, kick_cpus_irq_workfn);
+
+ if (cpu_online(cpu))
+--
+2.51.0
+
--- /dev/null
+From ba53fd523e525c91bb46b9d94b553baf9bf40086 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 20:53:10 +0800
+Subject: sched_ext: Use IRQ_WORK_INIT_HARD() to initialize
+ rq->scx.kick_cpus_irq_work
+
+From: Zqiang <qiang.zhang@linux.dev>
+
+[ Upstream commit 36c6f3c03d104faf1aa90922f2310549c175420f ]
+
+For PREEMPT_RT kernels, the kick_cpus_irq_workfn() be invoked in
+the per-cpu irq_work/* task context and there is no rcu-read critical
+section to protect. this commit therefore use IRQ_WORK_INIT_HARD() to
+initialize the per-cpu rq->scx.kick_cpus_irq_work in the
+init_sched_ext_class().
+
+Signed-off-by: Zqiang <qiang.zhang@linux.dev>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/ext.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c
+index 16a7ae9b29ae4..9592579db949d 100644
+--- a/kernel/sched/ext.c
++++ b/kernel/sched/ext.c
+@@ -5378,7 +5378,7 @@ void __init init_sched_ext_class(void)
+ BUG_ON(!zalloc_cpumask_var_node(&rq->scx.cpus_to_preempt, GFP_KERNEL, n));
+ BUG_ON(!zalloc_cpumask_var_node(&rq->scx.cpus_to_wait, GFP_KERNEL, n));
+ rq->scx.deferred_irq_work = IRQ_WORK_INIT_HARD(deferred_irq_workfn);
+- init_irq_work(&rq->scx.kick_cpus_irq_work, kick_cpus_irq_workfn);
++ rq->scx.kick_cpus_irq_work = IRQ_WORK_INIT_HARD(kick_cpus_irq_workfn);
+
+ if (cpu_online(cpu))
+ cpu_rq(cpu)->scx.flags |= SCX_RQ_ONLINE;
+--
+2.51.0
+
--- /dev/null
+ftrace-bpf-fix-ipmodify-direct-in-modify_ftrace_dire.patch
+spi-xilinx-increase-number-of-retries-before-declari.patch
+spi-imx-keep-dma-request-disabled-before-dma-transfe.patch
+dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch
+acpi-mrrm-fix-memory-leaks-and-improve-error-handlin.patch
+drm-vmwgfx-use-kref-in-vmw_bo_dirty.patch
+arm64-reject-modules-with-internal-alternative-callb.patch
+alsa-hda-tas2781-add-new-quirk-for-hp-new-projects.patch
+bluetooth-btrtl-avoid-loading-the-config-file-on-sec.patch
+asoc-sdca-bug-fix-while-parsing-mipi-sdca-control-cn.patch
+smb-fix-invalid-username-check-in-smb3_fs_context_pa.patch
+drm-amdkfd-fix-gpu-mappings-for-apu-after-prefetch.patch
+alsa-usb-audio-add-native-dsd-quirks-for-pureaudio-d.patch
+hid-lenovo-fixup-lenovo-yoga-slim-7x-keyboard-rdesc.patch
+bfs-reconstruct-file-type-when-loading-from-disk.patch
+hid-hid-input-extend-elan-ignore-battery-quirk-to-us.patch
+platform-x86-amd-pmc-add-support-for-van-gogh-soc.patch
+platform-x86-hp-wmi-mark-victus-16-r0-and-16-s0-for-.patch
+nvme-fix-admin-request_queue-lifetime.patch
+pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch
+platform-x86-acer-wmi-ignore-backlight-event.patch
+hid-apple-add-sonix-ak870-pro-to-non_apple_keyboards.patch
+platform-x86-huawei-wmi-add-keys-for-honor-models.patch
+platform-x86-intel-uncore-freq-add-additional-client.patch
+platform-x86-amd-pmc-add-lenovo-legion-go-2-to-pmc-q.patch
+platform-x86-amd-pmc-add-spurious_8042-to-xbox-ally.patch
+sched_ext-fix-possible-deadlock-in-the-deferred_irq_.patch
+platform-x86-intel-hid-add-nova-lake-support.patch
+hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch
+sched_ext-use-irq_work_init_hard-to-initialize-rq-sc.patch
+loongarch-mask-all-interrupts-during-kexec-kdump.patch
+samples-work-around-glibc-redefining-some-of-our-def.patch
+platform-x86-hp-wmi-add-omen-16-wf1xxx-fan-support.patch
+platform-x86-hp-wmi-add-omen-max-16-ah0xx-fan-suppor.patch
--- /dev/null
+From f703e47320a2a87a1dcdf86f1112cbf1a586dd04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Nov 2025 15:05:39 +0800
+Subject: smb: fix invalid username check in smb3_fs_context_parse_param()
+
+From: Yiqi Sun <sunyiqixm@gmail.com>
+
+[ Upstream commit ed6612165b74f09db00ef0abaf9831895ab28b7f ]
+
+Since the maximum return value of strnlen(..., CIFS_MAX_USERNAME_LEN)
+is CIFS_MAX_USERNAME_LEN, length check in smb3_fs_context_parse_param()
+is always FALSE and invalid.
+
+Fix the comparison in if statement.
+
+Signed-off-by: Yiqi Sun <sunyiqixm@gmail.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/fs_context.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c
+index c9cd00b96cde1..44dc5e24482e8 100644
+--- a/fs/smb/client/fs_context.c
++++ b/fs/smb/client/fs_context.c
+@@ -1472,7 +1472,7 @@ static int smb3_fs_context_parse_param(struct fs_context *fc,
+ break;
+ }
+
+- if (strnlen(param->string, CIFS_MAX_USERNAME_LEN) >
++ if (strnlen(param->string, CIFS_MAX_USERNAME_LEN) ==
+ CIFS_MAX_USERNAME_LEN) {
+ pr_warn("username too long\n");
+ goto cifs_parse_mount_err;
+--
+2.51.0
+
--- /dev/null
+From 9b2ef82e3201748da289a6e65d1ddaa90d1bbbbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Oct 2025 13:53:20 +0800
+Subject: spi: imx: keep dma request disabled before dma transfer setup
+
+From: Robin Gong <yibin.gong@nxp.com>
+
+[ Upstream commit 86d57d9c07d54e8cb385ffe800930816ccdba0c1 ]
+
+Since sdma hardware configure postpone to transfer phase, have to disable
+dma request before dma transfer setup because there is a hardware
+limitation on sdma event enable(ENBLn) as below:
+
+"It is thus essential for the Arm platform to program them before any DMA
+ request is triggered to the SDMA, otherwise an unpredictable combination
+ of channels may be started."
+
+Signed-off-by: Carlos Song <carlos.song@nxp.com>
+Signed-off-by: Robin Gong <yibin.gong@nxp.com>
+Link: https://patch.msgid.link/20251024055320.408482-1-carlos.song@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-imx.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index 155ddeb8fcd46..bbf1fd4fe1e92 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -519,9 +519,15 @@ static void mx51_ecspi_trigger(struct spi_imx_data *spi_imx)
+ {
+ u32 reg;
+
+- reg = readl(spi_imx->base + MX51_ECSPI_CTRL);
+- reg |= MX51_ECSPI_CTRL_XCH;
+- writel(reg, spi_imx->base + MX51_ECSPI_CTRL);
++ if (spi_imx->usedma) {
++ reg = readl(spi_imx->base + MX51_ECSPI_DMA);
++ reg |= MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN;
++ writel(reg, spi_imx->base + MX51_ECSPI_DMA);
++ } else {
++ reg = readl(spi_imx->base + MX51_ECSPI_CTRL);
++ reg |= MX51_ECSPI_CTRL_XCH;
++ writel(reg, spi_imx->base + MX51_ECSPI_CTRL);
++ }
+ }
+
+ static void mx51_ecspi_disable(struct spi_imx_data *spi_imx)
+@@ -759,7 +765,6 @@ static void mx51_setup_wml(struct spi_imx_data *spi_imx)
+ writel(MX51_ECSPI_DMA_RX_WML(spi_imx->wml - 1) |
+ MX51_ECSPI_DMA_TX_WML(tx_wml) |
+ MX51_ECSPI_DMA_RXT_WML(spi_imx->wml) |
+- MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN |
+ MX51_ECSPI_DMA_RXTDEN, spi_imx->base + MX51_ECSPI_DMA);
+ }
+
+@@ -1520,6 +1525,8 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx,
+ reinit_completion(&spi_imx->dma_tx_completion);
+ dma_async_issue_pending(controller->dma_tx);
+
++ spi_imx->devtype_data->trigger(spi_imx);
++
+ transfer_timeout = spi_imx_calculate_timeout(spi_imx, transfer->len);
+
+ /* Wait SDMA to finish the data transfer.*/
+--
+2.51.0
+
--- /dev/null
+From 00cb310f1e4acad8c51bc40bb76b36e4e70bf31c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Nov 2025 14:45:35 +0100
+Subject: spi: xilinx: increase number of retries before declaring stall
+
+From: Alvaro Gamez Machado <alvaro.gamez@hazent.com>
+
+[ Upstream commit 939edfaa10f1d22e6af6a84bf4bd96dc49c67302 ]
+
+SPI devices using a (relative) slow frequency need a larger time.
+
+For instance, microblaze running at 83.25MHz and performing a
+3 bytes transaction using a 10MHz/16 = 625kHz needed this stall
+value increased to at least 20. The SPI device is quite slow, but
+also is the microblaze, so set this value to 32 to give it even
+more margin.
+
+Signed-off-by: Alvaro Gamez Machado <alvaro.gamez@hazent.com>
+Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
+Link: https://patch.msgid.link/20251106134545.31942-1-alvaro.gamez@hazent.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-xilinx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c
+index d59cc8a184846..c86dc56f38b45 100644
+--- a/drivers/spi/spi-xilinx.c
++++ b/drivers/spi/spi-xilinx.c
+@@ -300,7 +300,7 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)
+
+ /* Read out all the data from the Rx FIFO */
+ rx_words = n_words;
+- stalled = 10;
++ stalled = 32;
+ while (rx_words) {
+ if (rx_words == n_words && !(stalled--) &&
+ !(sr & XSPI_SR_TX_EMPTY_MASK) &&
+--
+2.51.0
+
--- /dev/null
+From c06092e62c35c7e668e87c328c8d2aab8e77892d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Nov 2025 13:20:53 +0800
+Subject: ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series
+
+From: Lushih Hsieh <bruce@mail.kh.edu.tw>
+
+[ Upstream commit 21a9ab5b90b3716a631d559e62818029b4e7f5b7 ]
+
+The PureAudio APA DAC and Lotus DAC5 series are USB Audio
+2.0 Class devices that support native Direct Stream Digital (DSD)
+playback via specific vendor protocols.
+
+Without these quirks, the devices may only function in standard
+PCM mode, or fail to correctly report their DSD format capabilities
+to the ALSA framework, preventing native DSD playback under Linux.
+
+This commit adds new quirk entries for the mentioned DAC models
+based on their respective Vendor/Product IDs (VID:PID), for example:
+0x16d0:0x0ab1 (APA DAC), 0x16d0:0xeca1 (DAC5 series), etc.
+
+The quirk ensures correct DSD format handling by setting the required
+SNDRV_PCM_FMTBIT_DSD_U32_BE format bit and defining the DSD-specific
+Audio Class 2.0 (AC2.0) endpoint configurations. This allows the ALSA
+DSD API to correctly address the device for high-bitrate DSD streams,
+bypassing the need for DoP (DSD over PCM).
+
+Test on APA DAC and Lotus DAC5 SE under Arch Linux.
+
+Tested-by: Lushih Hsieh <bruce@mail.kh.edu.tw>
+Signed-off-by: Lushih Hsieh <bruce@mail.kh.edu.tw>
+Link: https://patch.msgid.link/20251114052053.54989-1-bruce@mail.kh.edu.tw
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/quirks.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 68238e62020b0..44274f39d6937 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1922,6 +1922,8 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ case USB_ID(0x16d0, 0x09d8): /* NuPrime IDA-8 */
+ case USB_ID(0x16d0, 0x09db): /* NuPrime Audio DAC-9 */
+ case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */
++ case USB_ID(0x16d0, 0x0ab1): /* PureAudio APA DAC */
++ case USB_ID(0x16d0, 0xeca1): /* PureAudio Lotus DAC5, DAC5 SE, DAC5 Pro */
+ case USB_ID(0x1db5, 0x0003): /* Bryston BDA3 */
+ case USB_ID(0x20a0, 0x4143): /* WaveIO USB Audio 2.0 */
+ case USB_ID(0x22e1, 0xca01): /* HDTA Serenade DSD */
+@@ -2189,6 +2191,10 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
+ QUIRK_FLAG_IGNORE_CLOCK_SOURCE),
+ DEVICE_FLG(0x1686, 0x00dd, /* Zoom R16/24 */
+ QUIRK_FLAG_TX_LENGTH | QUIRK_FLAG_CTL_MSG_DELAY_1M),
++ DEVICE_FLG(0x16d0, 0x0ab1, /* PureAudio APA DAC */
++ QUIRK_FLAG_DSD_RAW),
++ DEVICE_FLG(0x16d0, 0xeca1, /* PureAudio Lotus DAC5, DAC5 SE and DAC5 Pro */
++ QUIRK_FLAG_DSD_RAW),
+ DEVICE_FLG(0x17aa, 0x1046, /* Lenovo ThinkStation P620 Rear Line-in, Line-out and Microphone */
+ QUIRK_FLAG_DISABLE_AUTOSUSPEND),
+ DEVICE_FLG(0x17aa, 0x104d, /* Lenovo ThinkStation P620 Internal Speaker + Front Headset */
+--
+2.51.0
+
--- /dev/null
+From f77efdee134d92dca41ea3fb19302491fd5c9614 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Oct 2025 22:25:49 +0900
+Subject: bfs: Reconstruct file type when loading from disk
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit 34ab4c75588c07cca12884f2bf6b0347c7a13872 ]
+
+syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when
+the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted
+or when the 32bits "attributes" field loaded from disk are corrupted.
+
+A documentation says that BFS uses only lower 9 bits of the "mode" field.
+But I can't find an explicit explanation that the unused upper 23 bits
+(especially, the S_IFMT bits) are initialized with 0.
+
+Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk.
+Also, verify that the value of the "attributes" field loaded from disk is
+either BFS_VREG or BFS_VDIR (because BFS supports only regular files and
+the root directory).
+
+Reported-by: syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Link: https://patch.msgid.link/fabce673-d5b9-4038-8287-0fd65d80203b@I-love.SAKURA.ne.jp
+Reviewed-by: Tigran Aivazian <aivazian.tigran@gmail.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/bfs/inode.c | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c
+index e6a76ae9eb444..42805e3dbdaec 100644
+--- a/fs/bfs/inode.c
++++ b/fs/bfs/inode.c
+@@ -60,7 +60,19 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino)
+ off = (ino - BFS_ROOT_INO) % BFS_INODES_PER_BLOCK;
+ di = (struct bfs_inode *)bh->b_data + off;
+
+- inode->i_mode = 0x0000FFFF & le32_to_cpu(di->i_mode);
++ /*
++ * https://martin.hinner.info/fs/bfs/bfs-structure.html explains that
++ * BFS in SCO UnixWare environment used only lower 9 bits of di->i_mode
++ * value. This means that, although bfs_write_inode() saves whole
++ * inode->i_mode bits (which include S_IFMT bits and S_IS{UID,GID,VTX}
++ * bits), middle 7 bits of di->i_mode value can be garbage when these
++ * bits were not saved by bfs_write_inode().
++ * Since we can't tell whether middle 7 bits are garbage, use only
++ * lower 12 bits (i.e. tolerate S_IS{UID,GID,VTX} bits possibly being
++ * garbage) and reconstruct S_IFMT bits for Linux environment from
++ * di->i_vtype value.
++ */
++ inode->i_mode = 0x00000FFF & le32_to_cpu(di->i_mode);
+ if (le32_to_cpu(di->i_vtype) == BFS_VDIR) {
+ inode->i_mode |= S_IFDIR;
+ inode->i_op = &bfs_dir_inops;
+@@ -70,6 +82,11 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino)
+ inode->i_op = &bfs_file_inops;
+ inode->i_fop = &bfs_file_operations;
+ inode->i_mapping->a_ops = &bfs_aops;
++ } else {
++ brelse(bh);
++ printf("Unknown vtype=%u %s:%08lx\n",
++ le32_to_cpu(di->i_vtype), inode->i_sb->s_id, ino);
++ goto error;
+ }
+
+ BFS_I(inode)->i_sblock = le32_to_cpu(di->i_sblock);
+--
+2.51.0
+
--- /dev/null
+From f88f7869bf2fa2384b36927e97ab38e92eace032 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Nov 2025 20:02:04 +0800
+Subject: Bluetooth: btrtl: Avoid loading the config file on security chips
+
+From: Max Chou <max.chou@realtek.com>
+
+[ Upstream commit cd8dbd9ef600435439bb0e70af0a1d9e2193aecb ]
+
+For chips with security enabled, it's only possible to load firmware
+with a valid signature pattern.
+If key_id is not zero, it indicates a security chip, and the driver will
+not load the config file.
+
+- Example log for a security chip.
+
+Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a
+ lmp_ver=0c lmp_subver=8922
+Bluetooth: hci0: RTL: rom_version status=0 version=1
+Bluetooth: hci0: RTL: btrtl_initialize: key id 1
+Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin
+Bluetooth: hci0: RTL: cfg_sz 0, total sz 71301
+Bluetooth: hci0: RTL: fw version 0x41c0c905
+
+- Example log for a normal chip.
+
+Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a
+ lmp_ver=0c lmp_subver=8922
+Bluetooth: hci0: RTL: rom_version status=0 version=1
+Bluetooth: hci0: RTL: btrtl_initialize: key id 0
+Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin
+Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_config.bin
+Bluetooth: hci0: RTL: cfg_sz 6, total sz 71307
+Bluetooth: hci0: RTL: fw version 0x41c0c905
+
+Tested-by: Hilda Wu <hildawu@realtek.com>
+Signed-off-by: Nial Ni <niall_ni@realsil.com.cn>
+Signed-off-by: Max Chou <max.chou@realtek.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btrtl.c | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
+index 24dae5440c036..3d995790a5071 100644
+--- a/drivers/bluetooth/btrtl.c
++++ b/drivers/bluetooth/btrtl.c
+@@ -49,7 +49,7 @@
+
+ #define RTL_CHIP_SUBVER (&(struct rtl_vendor_cmd) {{0x10, 0x38, 0x04, 0x28, 0x80}})
+ #define RTL_CHIP_REV (&(struct rtl_vendor_cmd) {{0x10, 0x3A, 0x04, 0x28, 0x80}})
+-#define RTL_SEC_PROJ (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0x0D, 0x00, 0xb0}})
++#define RTL_SEC_PROJ (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0xAD, 0x00, 0xb0}})
+
+ #define RTL_PATCH_SNIPPETS 0x01
+ #define RTL_PATCH_DUMMY_HEADER 0x02
+@@ -513,7 +513,6 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev,
+ {
+ struct rtl_epatch_header_v2 *hdr;
+ int rc;
+- u8 reg_val[2];
+ u8 key_id;
+ u32 num_sections;
+ struct rtl_section *section;
+@@ -528,14 +527,7 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev,
+ .len = btrtl_dev->fw_len - 7, /* Cut the tail */
+ };
+
+- rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val);
+- if (rc < 0)
+- return -EIO;
+- key_id = reg_val[0];
+-
+- rtl_dev_dbg(hdev, "%s: key id %u", __func__, key_id);
+-
+- btrtl_dev->key_id = key_id;
++ key_id = btrtl_dev->key_id;
+
+ hdr = rtl_iov_pull_data(&iov, sizeof(*hdr));
+ if (!hdr)
+@@ -1049,6 +1041,8 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
+ u16 hci_rev, lmp_subver;
+ u8 hci_ver, lmp_ver, chip_type = 0;
+ int ret;
++ int rc;
++ u8 key_id;
+ u8 reg_val[2];
+
+ btrtl_dev = kzalloc(sizeof(*btrtl_dev), GFP_KERNEL);
+@@ -1159,6 +1153,14 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
+ goto err_free;
+ }
+
++ rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val);
++ if (rc < 0)
++ goto err_free;
++
++ key_id = reg_val[0];
++ btrtl_dev->key_id = key_id;
++ rtl_dev_info(hdev, "%s: key id %u", __func__, key_id);
++
+ btrtl_dev->fw_len = -EIO;
+ if (lmp_subver == RTL_ROM_LMP_8852A && hci_rev == 0x000c) {
+ snprintf(fw_name, sizeof(fw_name), "%s_v2.bin",
+@@ -1181,7 +1183,7 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
+ goto err_free;
+ }
+
+- if (btrtl_dev->ic_info->cfg_name) {
++ if (btrtl_dev->ic_info->cfg_name && !btrtl_dev->key_id) {
+ if (postfix) {
+ snprintf(cfg_name, sizeof(cfg_name), "%s-%s.bin",
+ btrtl_dev->ic_info->cfg_name, postfix);
+--
+2.51.0
+
--- /dev/null
+From a661ee914b7b7a135d43fa60f04b705eca07c4b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 14:05:27 +0000
+Subject: dma-mapping: Allow use of DMA_BIT_MASK(64) in global scope
+
+From: James Clark <james.clark@linaro.org>
+
+[ Upstream commit a50f7456f853ec3a6f07cbe1d16ad8a8b2501320 ]
+
+Clang doesn't like that (1ULL<<(64)) overflows when initializing a
+global scope variable, even if that part of the ternary isn't used when
+n = 64. The same initialization can be done without warnings in function
+scopes, and GCC doesn't mind either way.
+
+The build failure that highlighted this was already fixed in a different
+way [1], which also has detailed links to the Clang issues. However it's
+not going to be long before the same thing happens again, so it's better
+to fix the root cause.
+
+Fix it by using GENMASK_ULL() which does exactly the same thing, is much
+more readable anyway, and doesn't have a shift that overflows.
+
+[1]: https://lore.kernel.org/all/20250918-mmp-pdma-simplify-dma-addressing-v1-1-5c2be2b85696@riscstar.com/
+
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Link: https://lore.kernel.org/r/20251030-james-fix-dma_bit_mask-v1-1-ad1ce7cfab6e@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/dma-mapping.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
+index 608e8296ba206..48656f6344b65 100644
+--- a/include/linux/dma-mapping.h
++++ b/include/linux/dma-mapping.h
+@@ -74,7 +74,7 @@
+ */
+ #define DMA_MAPPING_ERROR (~(dma_addr_t)0)
+
+-#define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
++#define DMA_BIT_MASK(n) GENMASK_ULL(n - 1, 0)
+
+ #ifdef CONFIG_DMA_API_DEBUG
+ void debug_dma_mapping_error(struct device *dev, dma_addr_t dma_addr);
+--
+2.51.0
+
--- /dev/null
+From a5f3bfbcecec01728a015fb021edae3b44a1367e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 14:36:40 -0500
+Subject: drm/vmwgfx: Use kref in vmw_bo_dirty
+
+From: Ian Forbes <ian.forbes@broadcom.com>
+
+[ Upstream commit c1962742ffff7e245f935903a4658eb6f94f6058 ]
+
+Rather than using an ad hoc reference count use kref which is atomic
+and has underflow warnings.
+
+Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://patch.msgid.link/20251030193640.153697-1-ian.forbes@broadcom.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c b/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c
+index 74ff2812d66a1..de2498749e276 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c
+@@ -51,22 +51,22 @@ enum vmw_bo_dirty_method {
+
+ /**
+ * struct vmw_bo_dirty - Dirty information for buffer objects
++ * @ref_count: Reference count for this structure. Must be first member!
+ * @start: First currently dirty bit
+ * @end: Last currently dirty bit + 1
+ * @method: The currently used dirty method
+ * @change_count: Number of consecutive method change triggers
+- * @ref_count: Reference count for this structure
+ * @bitmap_size: The size of the bitmap in bits. Typically equal to the
+ * nuber of pages in the bo.
+ * @bitmap: A bitmap where each bit represents a page. A set bit means a
+ * dirty page.
+ */
+ struct vmw_bo_dirty {
++ struct kref ref_count;
+ unsigned long start;
+ unsigned long end;
+ enum vmw_bo_dirty_method method;
+ unsigned int change_count;
+- unsigned int ref_count;
+ unsigned long bitmap_size;
+ unsigned long bitmap[];
+ };
+@@ -235,7 +235,7 @@ int vmw_bo_dirty_add(struct vmw_bo *vbo)
+ int ret;
+
+ if (dirty) {
+- dirty->ref_count++;
++ kref_get(&dirty->ref_count);
+ return 0;
+ }
+
+@@ -249,7 +249,7 @@ int vmw_bo_dirty_add(struct vmw_bo *vbo)
+ dirty->bitmap_size = num_pages;
+ dirty->start = dirty->bitmap_size;
+ dirty->end = 0;
+- dirty->ref_count = 1;
++ kref_init(&dirty->ref_count);
+ if (num_pages < PAGE_SIZE / sizeof(pte_t)) {
+ dirty->method = VMW_BO_DIRTY_PAGETABLE;
+ } else {
+@@ -288,10 +288,8 @@ void vmw_bo_dirty_release(struct vmw_bo *vbo)
+ {
+ struct vmw_bo_dirty *dirty = vbo->dirty;
+
+- if (dirty && --dirty->ref_count == 0) {
+- kvfree(dirty);
++ if (dirty && kref_put(&dirty->ref_count, (void *)kvfree))
+ vbo->dirty = NULL;
+- }
+ }
+
+ /**
+--
+2.51.0
+
--- /dev/null
+From 3820ac32fb40eb5640fe959efa63cd756ad81ef6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Oct 2025 10:50:22 -0700
+Subject: ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct()
+
+From: Song Liu <song@kernel.org>
+
+[ Upstream commit 3e9a18e1c3e931abecf501cbb23d28d69f85bb56 ]
+
+ftrace_hash_ipmodify_enable() checks IPMODIFY and DIRECT ftrace_ops on
+the same kernel function. When needed, ftrace_hash_ipmodify_enable()
+calls ops->ops_func() to prepare the direct ftrace (BPF trampoline) to
+share the same function as the IPMODIFY ftrace (livepatch).
+
+ftrace_hash_ipmodify_enable() is called in register_ftrace_direct() path,
+but not called in modify_ftrace_direct() path. As a result, the following
+operations will break livepatch:
+
+1. Load livepatch to a kernel function;
+2. Attach fentry program to the kernel function;
+3. Attach fexit program to the kernel function.
+
+After 3, the kernel function being used will not be the livepatched
+version, but the original version.
+
+Fix this by adding __ftrace_hash_update_ipmodify() to
+__modify_ftrace_direct() and adjust some logic around the call.
+
+Signed-off-by: Song Liu <song@kernel.org>
+Reviewed-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20251027175023.1521602-3-song@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/ftrace.c | 40 +++++++++++++++++++++++++++++++---------
+ 1 file changed, 31 insertions(+), 9 deletions(-)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 44e31eebb7aaa..8f2d44e741510 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -1937,7 +1937,8 @@ static void ftrace_hash_rec_enable_modify(struct ftrace_ops *ops,
+ */
+ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops,
+ struct ftrace_hash *old_hash,
+- struct ftrace_hash *new_hash)
++ struct ftrace_hash *new_hash,
++ bool update_target)
+ {
+ struct ftrace_page *pg;
+ struct dyn_ftrace *rec, *end = NULL;
+@@ -1972,10 +1973,13 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops,
+ if (rec->flags & FTRACE_FL_DISABLED)
+ continue;
+
+- /* We need to update only differences of filter_hash */
++ /*
++ * Unless we are updating the target of a direct function,
++ * we only need to update differences of filter_hash
++ */
+ in_old = !!ftrace_lookup_ip(old_hash, rec->ip);
+ in_new = !!ftrace_lookup_ip(new_hash, rec->ip);
+- if (in_old == in_new)
++ if (!update_target && (in_old == in_new))
+ continue;
+
+ if (in_new) {
+@@ -1986,7 +1990,16 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops,
+ if (is_ipmodify)
+ goto rollback;
+
+- FTRACE_WARN_ON(rec->flags & FTRACE_FL_DIRECT);
++ /*
++ * If this is called by __modify_ftrace_direct()
++ * then it is only changing where the direct
++ * pointer is jumping to, and the record already
++ * points to a direct trampoline. If it isn't,
++ * then it is a bug to update ipmodify on a direct
++ * caller.
++ */
++ FTRACE_WARN_ON(!update_target &&
++ (rec->flags & FTRACE_FL_DIRECT));
+
+ /*
+ * Another ops with IPMODIFY is already
+@@ -2043,7 +2056,7 @@ static int ftrace_hash_ipmodify_enable(struct ftrace_ops *ops)
+ if (ftrace_hash_empty(hash))
+ hash = NULL;
+
+- return __ftrace_hash_update_ipmodify(ops, EMPTY_HASH, hash);
++ return __ftrace_hash_update_ipmodify(ops, EMPTY_HASH, hash, false);
+ }
+
+ /* Disabling always succeeds */
+@@ -2054,7 +2067,7 @@ static void ftrace_hash_ipmodify_disable(struct ftrace_ops *ops)
+ if (ftrace_hash_empty(hash))
+ hash = NULL;
+
+- __ftrace_hash_update_ipmodify(ops, hash, EMPTY_HASH);
++ __ftrace_hash_update_ipmodify(ops, hash, EMPTY_HASH, false);
+ }
+
+ static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops,
+@@ -2068,7 +2081,7 @@ static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops,
+ if (ftrace_hash_empty(new_hash))
+ new_hash = NULL;
+
+- return __ftrace_hash_update_ipmodify(ops, old_hash, new_hash);
++ return __ftrace_hash_update_ipmodify(ops, old_hash, new_hash, false);
+ }
+
+ static void print_ip_ins(const char *fmt, const unsigned char *p)
+@@ -5531,7 +5544,7 @@ EXPORT_SYMBOL_GPL(unregister_ftrace_direct);
+ static int
+ __modify_ftrace_direct(struct ftrace_ops *ops, unsigned long addr)
+ {
+- struct ftrace_hash *hash;
++ struct ftrace_hash *hash = ops->func_hash->filter_hash;
+ struct ftrace_func_entry *entry, *iter;
+ static struct ftrace_ops tmp_ops = {
+ .func = ftrace_stub,
+@@ -5551,13 +5564,21 @@ __modify_ftrace_direct(struct ftrace_ops *ops, unsigned long addr)
+ if (err)
+ return err;
+
++ /*
++ * Call __ftrace_hash_update_ipmodify() here, so that we can call
++ * ops->ops_func for the ops. This is needed because the above
++ * register_ftrace_function_nolock() worked on tmp_ops.
++ */
++ err = __ftrace_hash_update_ipmodify(ops, hash, hash, true);
++ if (err)
++ goto out;
++
+ /*
+ * Now the ftrace_ops_list_func() is called to do the direct callers.
+ * We can safely change the direct functions attached to each entry.
+ */
+ mutex_lock(&ftrace_lock);
+
+- hash = ops->func_hash->filter_hash;
+ size = 1 << hash->size_bits;
+ for (i = 0; i < size; i++) {
+ hlist_for_each_entry(iter, &hash->buckets[i], hlist) {
+@@ -5572,6 +5593,7 @@ __modify_ftrace_direct(struct ftrace_ops *ops, unsigned long addr)
+
+ mutex_unlock(&ftrace_lock);
+
++out:
+ /* Removing the tmp_ops will add the updated direct callers to the functions */
+ unregister_ftrace_function(&tmp_ops);
+
+--
+2.51.0
+
--- /dev/null
+From 661f43795194cacc8e284dfc9e99869941d84c0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Oct 2025 00:37:26 +0800
+Subject: HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list
+
+From: April Grimoire <april@aprilg.moe>
+
+[ Upstream commit 743c81cdc98fd4fef62a89eb70efff994112c2d9 ]
+
+SONiX AK870 PRO keyboard pretends to be an apple keyboard by VID:PID,
+rendering function keys not treated properly. Despite being a
+SONiX USB DEVICE, it uses a different name, so adding it to the list.
+
+Signed-off-by: April Grimoire <april@aprilg.moe>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-apple.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index 7cf17c671da48..2b8021628d3c6 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -341,6 +341,7 @@ static const struct apple_key_translation swapped_fn_leftctrl_keys[] = {
+
+ static const struct apple_non_apple_keyboard non_apple_keyboards[] = {
+ { "SONiX USB DEVICE" },
++ { "SONiX AK870 PRO" },
+ { "Keychron" },
+ { "AONE" },
+ { "GANSS" },
+--
+2.51.0
+
--- /dev/null
+From 4f21b1156f048493a837cc190bb8d18d428bb16b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Nov 2025 21:16:45 +0900
+Subject: HID: elecom: Add support for ELECOM M-XT3URBK (018F)
+
+From: Naoki Ueki <naoki25519@gmail.com>
+
+[ Upstream commit cdcbb8e8d10f656642380ee13516290437b52b36 ]
+
+The ELECOM M-XT3URBK trackball has an additional device ID (0x018F), which
+shares the same report descriptor as the existing device (0x00FB). However,
+the driver does not currently recognize this new ID, resulting in only five
+buttons being functional.
+
+This patch adds the new device ID so that all six buttons work properly.
+
+Signed-off-by: Naoki Ueki <naoki25519@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-elecom.c | 6 ++++--
+ drivers/hid/hid-ids.h | 3 ++-
+ drivers/hid/hid-quirks.c | 3 ++-
+ 3 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c
+index 4fa45ee77503b..f76fec79e8903 100644
+--- a/drivers/hid/hid-elecom.c
++++ b/drivers/hid/hid-elecom.c
+@@ -75,7 +75,8 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ */
+ mouse_button_fixup(hdev, rdesc, *rsize, 20, 28, 22, 14, 8);
+ break;
+- case USB_DEVICE_ID_ELECOM_M_XT3URBK:
++ case USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB:
++ case USB_DEVICE_ID_ELECOM_M_XT3URBK_018F:
+ case USB_DEVICE_ID_ELECOM_M_XT3DRBK:
+ case USB_DEVICE_ID_ELECOM_M_XT4DRBK:
+ /*
+@@ -117,7 +118,8 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ static const struct hid_device_id elecom_devices[] = {
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 6a538dca21a9a..ca9c70c8f3cf1 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -439,7 +439,8 @@
+ #define USB_VENDOR_ID_ELECOM 0x056e
+ #define USB_DEVICE_ID_ELECOM_BM084 0x0061
+ #define USB_DEVICE_ID_ELECOM_M_XGL20DLBK 0x00e6
+-#define USB_DEVICE_ID_ELECOM_M_XT3URBK 0x00fb
++#define USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB 0x00fb
++#define USB_DEVICE_ID_ELECOM_M_XT3URBK_018F 0x018f
+ #define USB_DEVICE_ID_ELECOM_M_XT3DRBK 0x00fc
+ #define USB_DEVICE_ID_ELECOM_M_XT4DRBK 0x00fd
+ #define USB_DEVICE_ID_ELECOM_M_DT1URBK 0x00fe
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index fa946666969b8..2da21415e676c 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -405,7 +405,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ #if IS_ENABLED(CONFIG_HID_ELECOM)
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) },
+- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) },
+--
+2.51.0
+
--- /dev/null
+From d440f4a4b87ab8856103d9c74b17b753cd928bd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Oct 2025 11:06:25 -0500
+Subject: HID: hid-input: Extend Elan ignore battery quirk to USB
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit 534ca75e8e3b713514b3f2da85dab96831cf5b2a ]
+
+USB Elan devices have the same problem as the I2C ones with a fake
+battery device showing up.
+
+Reviewed-by: Hans de Goede <hansg@kernel.org>
+Reported-by: André Barata <andretiagob@protonmail.com>
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220722
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-input.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index f073d5621050a..fa3efe9701c96 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -386,10 +386,11 @@ static const struct hid_device_id hid_battery_quirks[] = {
+ { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_CHROMEBOOK_TROGDOR_POMPOM),
+ HID_BATTERY_QUIRK_AVOID_QUERY },
+ /*
+- * Elan I2C-HID touchscreens seem to all report a non present battery,
+- * set HID_BATTERY_QUIRK_IGNORE for all Elan I2C-HID devices.
++ * Elan HID touchscreens seem to all report a non present battery,
++ * set HID_BATTERY_QUIRK_IGNORE for all Elan I2C and USB HID devices.
+ */
+ { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_IGNORE },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_IGNORE },
+ {}
+ };
+
+--
+2.51.0
+
--- /dev/null
+From bf8926b3cf42d10572600389efa549a6187e4f64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Nov 2025 14:42:05 +0800
+Subject: LoongArch: Mask all interrupts during kexec/kdump
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit 863a320dc6fd7c855f47da4bb82a8de2d9102ea2 ]
+
+If the default state of the interrupt controllers in the first kernel
+don't mask any interrupts, it may cause the second kernel to potentially
+receive interrupts (which were previously allocated by the first kernel)
+immediately after a CPU becomes online during its boot process. These
+interrupts cannot be properly routed, leading to bad IRQ issues.
+
+This patch calls machine_kexec_mask_interrupts() to mask all interrupts
+during the kexec/kdump process.
+
+Signed-off-by: Tianyang Zhang <zhangtianyang@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/kernel/machine_kexec.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/loongarch/kernel/machine_kexec.c b/arch/loongarch/kernel/machine_kexec.c
+index 30aa420610a06..e50c9a81ff1aa 100644
+--- a/arch/loongarch/kernel/machine_kexec.c
++++ b/arch/loongarch/kernel/machine_kexec.c
+@@ -249,6 +249,7 @@ void machine_crash_shutdown(struct pt_regs *regs)
+ #ifdef CONFIG_SMP
+ crash_smp_send_stop();
+ #endif
++ machine_kexec_mask_interrupts();
+ cpumask_set_cpu(crashing_cpu, &cpus_in_crash);
+
+ pr_info("Starting crashdump kernel...\n");
+@@ -286,6 +287,7 @@ void machine_kexec(struct kimage *image)
+
+ /* We do not want to be bothered. */
+ local_irq_disable();
++ machine_kexec_mask_interrupts();
+
+ pr_notice("EFI boot flag 0x%lx\n", efi_boot);
+ pr_notice("Command line at 0x%lx\n", cmdline_ptr);
+--
+2.51.0
+
--- /dev/null
+From db690b902086c7157f37445715338102be2a2eb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Nov 2025 14:48:30 -0800
+Subject: nvme: fix admin request_queue lifetime
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit 03b3bcd319b3ab5182bc9aaa0421351572c78ac0 ]
+
+The namespaces can access the controller's admin request_queue, and
+stale references on the namespaces may exist after tearing down the
+controller. Ensure the admin request_queue is active by moving the
+controller's 'put' to after all controller references have been released
+to ensure no one is can access the request_queue. This fixes a reported
+use-after-free bug:
+
+ BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0
+ Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287
+ CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G E 6.13.2-ga1582f1a031e #15
+ Tainted: [E]=UNSIGNED_MODULE
+ Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025
+ Call Trace:
+ <TASK>
+ dump_stack_lvl+0x4f/0x60
+ print_report+0xc4/0x620
+ ? _raw_spin_lock_irqsave+0x70/0xb0
+ ? _raw_read_unlock_irqrestore+0x30/0x30
+ ? blk_queue_enter+0x41c/0x4a0
+ kasan_report+0xab/0xe0
+ ? blk_queue_enter+0x41c/0x4a0
+ blk_queue_enter+0x41c/0x4a0
+ ? __irq_work_queue_local+0x75/0x1d0
+ ? blk_queue_start_drain+0x70/0x70
+ ? irq_work_queue+0x18/0x20
+ ? vprintk_emit.part.0+0x1cc/0x350
+ ? wake_up_klogd_work_func+0x60/0x60
+ blk_mq_alloc_request+0x2b7/0x6b0
+ ? __blk_mq_alloc_requests+0x1060/0x1060
+ ? __switch_to+0x5b7/0x1060
+ nvme_submit_user_cmd+0xa9/0x330
+ nvme_user_cmd.isra.0+0x240/0x3f0
+ ? force_sigsegv+0xe0/0xe0
+ ? nvme_user_cmd64+0x400/0x400
+ ? vfs_fileattr_set+0x9b0/0x9b0
+ ? cgroup_update_frozen_flag+0x24/0x1c0
+ ? cgroup_leave_frozen+0x204/0x330
+ ? nvme_ioctl+0x7c/0x2c0
+ blkdev_ioctl+0x1a8/0x4d0
+ ? blkdev_common_ioctl+0x1930/0x1930
+ ? fdget+0x54/0x380
+ __x64_sys_ioctl+0x129/0x190
+ do_syscall_64+0x5b/0x160
+ entry_SYSCALL_64_after_hwframe+0x4b/0x53
+ RIP: 0033:0x7f765f703b0b
+ Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48
+ RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
+ RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b
+ RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003
+ RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000
+ R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003
+ R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60
+ </TASK>
+
+Reported-by: Casey Chen <cachen@purestorage.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 78d00e25a1790..f09ebcbe11798 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -4318,7 +4318,6 @@ EXPORT_SYMBOL_GPL(nvme_alloc_admin_tag_set);
+ void nvme_remove_admin_tag_set(struct nvme_ctrl *ctrl)
+ {
+ blk_mq_destroy_queue(ctrl->admin_q);
+- blk_put_queue(ctrl->admin_q);
+ if (ctrl->ops->flags & NVME_F_FABRICS) {
+ blk_mq_destroy_queue(ctrl->fabrics_q);
+ blk_put_queue(ctrl->fabrics_q);
+@@ -4463,6 +4462,8 @@ static void nvme_free_ctrl(struct device *dev)
+ container_of(dev, struct nvme_ctrl, ctrl_device);
+ struct nvme_subsystem *subsys = ctrl->subsys;
+
++ if (ctrl->admin_q)
++ blk_put_queue(ctrl->admin_q);
+ if (!subsys || ctrl->instance != subsys->instance)
+ ida_free(&nvme_instance_ida, ctrl->instance);
+
+--
+2.51.0
+
--- /dev/null
+From ba8474ab92a3fbfa7848d6357e7723c0769a4719 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Nov 2025 15:40:41 +0530
+Subject: pinctrl: qcom: msm: Fix deadlock in pinmux configuration
+
+From: Praveen Talari <praveen.talari@oss.qualcomm.com>
+
+[ Upstream commit 1c2e70397b4125022dba80f6111271a37fb36bae ]
+
+Replace disable_irq() with disable_irq_nosync() in msm_pinmux_set_mux()
+to prevent deadlock when wakeup IRQ is triggered on the same
+GPIO being reconfigured.
+
+The issue occurs when a wakeup IRQ is triggered on a GPIO and the IRQ
+handler attempts to reconfigure the same GPIO's pinmux. In this scenario,
+msm_pinmux_set_mux() calls disable_irq() which waits for the currently
+running IRQ handler to complete, creating a circular dependency that
+results in deadlock.
+
+Using disable_irq_nosync() avoids waiting for the IRQ handler to
+complete, preventing the deadlock condition while still properly
+disabling the interrupt during pinmux reconfiguration.
+
+Suggested-by: Prasad Sodagudi <prasad.sodagudi@oss.qualcomm.com>
+Signed-off-by: Praveen Talari <praveen.talari@oss.qualcomm.com>
+Reviewed-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/qcom/pinctrl-msm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
+index 13dc8bc1d0cff..688f3d01f4af8 100644
+--- a/drivers/pinctrl/qcom/pinctrl-msm.c
++++ b/drivers/pinctrl/qcom/pinctrl-msm.c
+@@ -214,7 +214,7 @@ static int msm_pinmux_set_mux(struct pinctrl_dev *pctldev,
+ */
+ if (d && i != gpio_func &&
+ !test_and_set_bit(d->hwirq, pctrl->disabled_for_mux))
+- disable_irq(irq);
++ disable_irq_nosync(irq);
+
+ raw_spin_lock_irqsave(&pctrl->lock, flags);
+
+--
+2.51.0
+
--- /dev/null
+From 9c85c9458eace3fff0e5392b5493d1124e218ba9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Nov 2025 16:59:38 +0100
+Subject: platform/x86: acer-wmi: Ignore backlight event
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit 444a9256f8d106e08a6bc2dc8ef28a8699e4b3ba ]
+
+On the Acer Nitro AN515-58, the event 4 - 0 is send by the ACPI
+firmware when the backlight up/down keys are pressed. Ignore this
+event to avoid spamming the kernel log with error messages, as the
+acpi-video driver already handles brightness up/down events.
+
+Reported-by: Bugaddr <Bugaddr@protonmail.com>
+Closes: https://bugaddr.tech/posts/2025-11-16-debugging-the-acer-nitro-5-an515-58-fn-f10-keyboard-backlight-bug-on-linux/#wmi-interface-issues
+Tested-by: Bugaddr <Bugaddr@protonmail.com>
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://patch.msgid.link/20251117155938.3030-1-W_Armin@gmx.de
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/acer-wmi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
+index 868faccfb8628..e7a43f824272f 100644
+--- a/drivers/platform/x86/acer-wmi.c
++++ b/drivers/platform/x86/acer-wmi.c
+@@ -86,6 +86,7 @@ MODULE_ALIAS("wmi:676AA15E-6A47-4D9F-A2CC-1E6D18D14026");
+
+ enum acer_wmi_event_ids {
+ WMID_HOTKEY_EVENT = 0x1,
++ WMID_BACKLIGHT_EVENT = 0x4,
+ WMID_ACCEL_OR_KBD_DOCK_EVENT = 0x5,
+ WMID_GAMING_TURBO_KEY_EVENT = 0x7,
+ WMID_AC_EVENT = 0x8,
+@@ -1992,6 +1993,9 @@ static void acer_wmi_notify(u32 value, void *context)
+ sparse_keymap_report_event(acer_wmi_input_dev, scancode, 1, true);
+ }
+ break;
++ case WMID_BACKLIGHT_EVENT:
++ /* Already handled by acpi-video */
++ break;
+ case WMID_ACCEL_OR_KBD_DOCK_EVENT:
+ acer_gsensor_event();
+ acer_kbd_dock_event(&return_value);
+--
+2.51.0
+
--- /dev/null
+From 77c24369eb34bc3a173553db95c11e098fa57810 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Oct 2025 15:50:57 +0200
+Subject: platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Antheas Kapenekakis <lkml@antheas.dev>
+
+[ Upstream commit f945afe01c6768dcfed7868c671a26e1164c2284 ]
+
+The Lenovo Legion Go 2 takes a long time to resume from suspend.
+This is due to it having an nvme resume handler that interferes
+with IOMMU mappings. It is a common issue with older Lenovo
+laptops. Adding it to that quirk list fixes this issue.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4618
+Suggested-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20251008135057.731928-1-lkml@antheas.dev
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc/pmc-quirks.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+index 9fd2829ee2ab4..271cbeaa59af3 100644
+--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c
++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+@@ -198,6 +198,23 @@ static const struct dmi_system_id fwbug_list[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "82ND"),
+ }
+ },
++ /* https://gitlab.freedesktop.org/drm/amd/-/issues/4618 */
++ {
++ .ident = "Lenovo Legion Go 2",
++ .driver_data = &quirk_s2idle_bug,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "83N0"),
++ }
++ },
++ {
++ .ident = "Lenovo Legion Go 2",
++ .driver_data = &quirk_s2idle_bug,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "83N1"),
++ }
++ },
+ /* https://gitlab.freedesktop.org/drm/amd/-/issues/2684 */
+ {
+ .ident = "HP Laptop 15s-eq2xxx",
+--
+2.51.0
+
--- /dev/null
+From c0adab8801d3371352d3c591152670795d7ae44a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Oct 2025 17:21:51 +0200
+Subject: platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Antheas Kapenekakis <lkml@antheas.dev>
+
+[ Upstream commit c0ddc54016636dd8dedfaf1a3b482a95058e1db2 ]
+
+The Xbox Ally features a Van Gogh SoC that has spurious interrupts
+during resume. We get the following logs:
+
+atkbd_receive_byte: 20 callbacks suppressed
+atkbd serio0: Spurious ACK on isa0060/serio0. Some program might be trying to access hardware directly.
+
+So, add the spurious_8042 quirk for it. It does not have a keyboard, so
+this does not result in any functional loss.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4659
+Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Link: https://patch.msgid.link/20251024152152.3981721-3-lkml@antheas.dev
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmc/pmc-quirks.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/platform/x86/amd/pmc/pmc-quirks.c b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+index 271cbeaa59af3..a5031339dac8c 100644
+--- a/drivers/platform/x86/amd/pmc/pmc-quirks.c
++++ b/drivers/platform/x86/amd/pmc/pmc-quirks.c
+@@ -116,6 +116,14 @@ static const struct dmi_system_id fwbug_list[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "21A1"),
+ }
+ },
++ {
++ .ident = "ROG Xbox Ally RC73YA",
++ .driver_data = &quirk_spurious_8042,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_BOARD_NAME, "RC73YA"),
++ }
++ },
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=218024 */
+ {
+ .ident = "V14 G4 AMN",
+--
+2.51.0
+
--- /dev/null
+From af281cd54bfe236ed7d0e22cba9337ddf172afe6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Oct 2025 05:18:38 +0000
+Subject: platform/x86: huawei-wmi: add keys for HONOR models
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jia Ston <ston.jia@outlook.com>
+
+[ Upstream commit 5c72329716d0858621021193330594d5d26bf44d ]
+
+HONOR MagicBook X16/X14 models produced in 2025 cannot use the Print
+Screen and YOYO keys properly, with the system reporting them as
+unknown key presses (codes: 0x028b and 0x028e).
+
+To resolve this, a key_entry is added for both the HONOR Print Screen
+key and the HONOR YOYO key, ensuring they function correctly on these
+models.
+
+Signed-off-by: Ston Jia <ston.jia@outlook.com>
+Link: https://patch.msgid.link/20251029051804.220111-1-ston.jia@outlook.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/huawei-wmi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/platform/x86/huawei-wmi.c b/drivers/platform/x86/huawei-wmi.c
+index 0ef1c46b617b6..29ef391d33052 100644
+--- a/drivers/platform/x86/huawei-wmi.c
++++ b/drivers/platform/x86/huawei-wmi.c
+@@ -81,6 +81,10 @@ static const struct key_entry huawei_wmi_keymap[] = {
+ { KE_KEY, 0x289, { KEY_WLAN } },
+ // Huawei |M| key
+ { KE_KEY, 0x28a, { KEY_CONFIG } },
++ // HONOR YOYO key
++ { KE_KEY, 0x28b, { KEY_NOTIFICATION_CENTER } },
++ // HONOR print screen
++ { KE_KEY, 0x28e, { KEY_PRINT } },
+ // Keyboard backlit
+ { KE_IGNORE, 0x293, { KEY_KBDILLUMTOGGLE } },
+ { KE_IGNORE, 0x294, { KEY_KBDILLUMUP } },
+--
+2.51.0
+
--- /dev/null
+From f853b8d5620f6eaf3f0151a21e506600fe1603df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Nov 2025 09:29:02 -0800
+Subject: samples: work around glibc redefining some of our defines wrong
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit a48f822908982353c3256e35a089e9e7d0d61580 ]
+
+Apparently as of version 2.42, glibc headers define AT_RENAME_NOREPLACE
+and some of the other flags for renameat2() and friends in <stdio.h>.
+
+Which would all be fine, except for inexplicable reasons glibc decided
+to define them _differently_ from the kernel definitions, which then
+makes some of our sample code that includes both kernel headers and user
+space headers unhappy, because the compiler will (correctly) complain
+about redefining things.
+
+Now, mixing kernel headers and user space headers is always a somewhat
+iffy proposition due to namespacing issues, but it's kind of inevitable
+in our sample and selftest code. And this is just glibc being stupid.
+
+Those defines come from the kernel, glibc is exposing the kernel
+interfaces, and glibc shouldn't make up some random new expressions for
+these values.
+
+It's not like glibc headers changed the actual result values, but they
+arbitrarily just decided to use a different expression to describe those
+values. The kernel just does
+
+ #define AT_RENAME_NOREPLACE 0x0001
+
+while glibc does
+
+ # define RENAME_NOREPLACE (1 << 0)
+ # define AT_RENAME_NOREPLACE RENAME_NOREPLACE
+
+instead. Same value in the end, but very different macro definition.
+
+For absolutely no reason.
+
+This has since been fixed in the glibc development tree, so eventually
+we'll end up with the canonical expressions and no clashes. But in the
+meantime the broken headers are in the glibc-2.42 release and have made
+it out into distributions.
+
+Do a minimal work-around to make the samples build cleanly by just
+undefining the affected macros in between the user space header include
+and the kernel header includes.
+
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/vfs/test-statx.c | 6 ++++++
+ samples/watch_queue/watch_test.c | 6 ++++++
+ 2 files changed, 12 insertions(+)
+
+diff --git a/samples/vfs/test-statx.c b/samples/vfs/test-statx.c
+index 49c7a46cee073..424a6fa15723c 100644
+--- a/samples/vfs/test-statx.c
++++ b/samples/vfs/test-statx.c
+@@ -19,6 +19,12 @@
+ #include <time.h>
+ #include <sys/syscall.h>
+ #include <sys/types.h>
++
++// Work around glibc header silliness
++#undef AT_RENAME_NOREPLACE
++#undef AT_RENAME_EXCHANGE
++#undef AT_RENAME_WHITEOUT
++
+ #include <linux/stat.h>
+ #include <linux/fcntl.h>
+ #define statx foo
+diff --git a/samples/watch_queue/watch_test.c b/samples/watch_queue/watch_test.c
+index 8c6cb57d5cfc5..24cf7d7a19725 100644
+--- a/samples/watch_queue/watch_test.c
++++ b/samples/watch_queue/watch_test.c
+@@ -16,6 +16,12 @@
+ #include <errno.h>
+ #include <sys/ioctl.h>
+ #include <limits.h>
++
++// Work around glibc header silliness
++#undef AT_RENAME_NOREPLACE
++#undef AT_RENAME_EXCHANGE
++#undef AT_RENAME_WHITEOUT
++
+ #include <linux/watch_queue.h>
+ #include <linux/unistd.h>
+ #include <linux/keyctl.h>
+--
+2.51.0
+
xfrm-also-call-xfrm_state_delete_tunnel-at-destroy-t.patch
xfrm-flush-all-states-in-xfrm_state_fini.patch
leds-spi-byte-use-devm_led_classdev_register_ext.patch
+ftrace-bpf-fix-ipmodify-direct-in-modify_ftrace_dire.patch
+spi-xilinx-increase-number-of-retries-before-declari.patch
+spi-imx-keep-dma-request-disabled-before-dma-transfe.patch
+dma-mapping-allow-use-of-dma_bit_mask-64-in-global-s.patch
+drm-vmwgfx-use-kref-in-vmw_bo_dirty.patch
+bluetooth-btrtl-avoid-loading-the-config-file-on-sec.patch
+smb-fix-invalid-username-check-in-smb3_fs_context_pa.patch
+alsa-usb-audio-add-native-dsd-quirks-for-pureaudio-d.patch
+bfs-reconstruct-file-type-when-loading-from-disk.patch
+hid-hid-input-extend-elan-ignore-battery-quirk-to-us.patch
+nvme-fix-admin-request_queue-lifetime.patch
+pinctrl-qcom-msm-fix-deadlock-in-pinmux-configuratio.patch
+platform-x86-acer-wmi-ignore-backlight-event.patch
+hid-apple-add-sonix-ak870-pro-to-non_apple_keyboards.patch
+platform-x86-huawei-wmi-add-keys-for-honor-models.patch
+platform-x86-amd-pmc-add-lenovo-legion-go-2-to-pmc-q.patch
+platform-x86-amd-pmc-add-spurious_8042-to-xbox-ally.patch
+hid-elecom-add-support-for-elecom-m-xt3urbk-018f.patch
+loongarch-mask-all-interrupts-during-kexec-kdump.patch
+samples-work-around-glibc-redefining-some-of-our-def.patch
--- /dev/null
+From 11bd38f0ee8b09c925e0b8618a445f82385ceb7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Nov 2025 15:05:39 +0800
+Subject: smb: fix invalid username check in smb3_fs_context_parse_param()
+
+From: Yiqi Sun <sunyiqixm@gmail.com>
+
+[ Upstream commit ed6612165b74f09db00ef0abaf9831895ab28b7f ]
+
+Since the maximum return value of strnlen(..., CIFS_MAX_USERNAME_LEN)
+is CIFS_MAX_USERNAME_LEN, length check in smb3_fs_context_parse_param()
+is always FALSE and invalid.
+
+Fix the comparison in if statement.
+
+Signed-off-by: Yiqi Sun <sunyiqixm@gmail.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/fs_context.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c
+index a64c0b0dbec78..6358f2483c869 100644
+--- a/fs/smb/client/fs_context.c
++++ b/fs/smb/client/fs_context.c
+@@ -1386,7 +1386,7 @@ static int smb3_fs_context_parse_param(struct fs_context *fc,
+ break;
+ }
+
+- if (strnlen(param->string, CIFS_MAX_USERNAME_LEN) >
++ if (strnlen(param->string, CIFS_MAX_USERNAME_LEN) ==
+ CIFS_MAX_USERNAME_LEN) {
+ pr_warn("username too long\n");
+ goto cifs_parse_mount_err;
+--
+2.51.0
+
--- /dev/null
+From a5478ca7d8a4192ce0ac6e10b4389fd0d26394c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Oct 2025 13:53:20 +0800
+Subject: spi: imx: keep dma request disabled before dma transfer setup
+
+From: Robin Gong <yibin.gong@nxp.com>
+
+[ Upstream commit 86d57d9c07d54e8cb385ffe800930816ccdba0c1 ]
+
+Since sdma hardware configure postpone to transfer phase, have to disable
+dma request before dma transfer setup because there is a hardware
+limitation on sdma event enable(ENBLn) as below:
+
+"It is thus essential for the Arm platform to program them before any DMA
+ request is triggered to the SDMA, otherwise an unpredictable combination
+ of channels may be started."
+
+Signed-off-by: Carlos Song <carlos.song@nxp.com>
+Signed-off-by: Robin Gong <yibin.gong@nxp.com>
+Link: https://patch.msgid.link/20251024055320.408482-1-carlos.song@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-imx.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index da4442954375b..76f8747c29432 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -503,9 +503,15 @@ static void mx51_ecspi_trigger(struct spi_imx_data *spi_imx)
+ {
+ u32 reg;
+
+- reg = readl(spi_imx->base + MX51_ECSPI_CTRL);
+- reg |= MX51_ECSPI_CTRL_XCH;
+- writel(reg, spi_imx->base + MX51_ECSPI_CTRL);
++ if (spi_imx->usedma) {
++ reg = readl(spi_imx->base + MX51_ECSPI_DMA);
++ reg |= MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN;
++ writel(reg, spi_imx->base + MX51_ECSPI_DMA);
++ } else {
++ reg = readl(spi_imx->base + MX51_ECSPI_CTRL);
++ reg |= MX51_ECSPI_CTRL_XCH;
++ writel(reg, spi_imx->base + MX51_ECSPI_CTRL);
++ }
+ }
+
+ static void mx51_ecspi_disable(struct spi_imx_data *spi_imx)
+@@ -699,7 +705,6 @@ static void mx51_setup_wml(struct spi_imx_data *spi_imx)
+ writel(MX51_ECSPI_DMA_RX_WML(spi_imx->wml - 1) |
+ MX51_ECSPI_DMA_TX_WML(tx_wml) |
+ MX51_ECSPI_DMA_RXT_WML(spi_imx->wml) |
+- MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN |
+ MX51_ECSPI_DMA_RXTDEN, spi_imx->base + MX51_ECSPI_DMA);
+ }
+
+@@ -1458,6 +1463,8 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx,
+ reinit_completion(&spi_imx->dma_tx_completion);
+ dma_async_issue_pending(controller->dma_tx);
+
++ spi_imx->devtype_data->trigger(spi_imx);
++
+ transfer_timeout = spi_imx_calculate_timeout(spi_imx, transfer->len);
+
+ /* Wait SDMA to finish the data transfer.*/
+--
+2.51.0
+
--- /dev/null
+From 6b86a9a708166b61d8035692e251e8fef56309b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Nov 2025 14:45:35 +0100
+Subject: spi: xilinx: increase number of retries before declaring stall
+
+From: Alvaro Gamez Machado <alvaro.gamez@hazent.com>
+
+[ Upstream commit 939edfaa10f1d22e6af6a84bf4bd96dc49c67302 ]
+
+SPI devices using a (relative) slow frequency need a larger time.
+
+For instance, microblaze running at 83.25MHz and performing a
+3 bytes transaction using a 10MHz/16 = 625kHz needed this stall
+value increased to at least 20. The SPI device is quite slow, but
+also is the microblaze, so set this value to 32 to give it even
+more margin.
+
+Signed-off-by: Alvaro Gamez Machado <alvaro.gamez@hazent.com>
+Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
+Link: https://patch.msgid.link/20251106134545.31942-1-alvaro.gamez@hazent.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-xilinx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c
+index 8e6e3876aa9af..b5405d9974ba6 100644
+--- a/drivers/spi/spi-xilinx.c
++++ b/drivers/spi/spi-xilinx.c
+@@ -299,7 +299,7 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)
+
+ /* Read out all the data from the Rx FIFO */
+ rx_words = n_words;
+- stalled = 10;
++ stalled = 32;
+ while (rx_words) {
+ if (rx_words == n_words && !(stalled--) &&
+ !(sr & XSPI_SR_TX_EMPTY_MASK) &&
+--
+2.51.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
