--- /dev/null
+From ce2a870c1427c1b6412e30b2ca98f3168b4224de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 10:03:18 +0800
+Subject: ASoC: fsl_sai: replace regmap_write with regmap_update_bits
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 0e270f32975fd21874185ba53653630dd40bf560 ]
+
+Use the regmap_write() for software reset in fsl_sai_config_disable would
+cause the FSL_SAI_CSR_BCE bit to be cleared. Refer to
+commit 197c53c8ecb34 ("ASoC: fsl_sai: Don't disable bitclock for i.MX8MP")
+FSL_SAI_CSR_BCE should not be cleared. So need to use regmap_update_bits()
+instead of regmap_write() for these bit operations.
+
+Fixes: dc78f7e59169d ("ASoC: fsl_sai: Force a software reset when starting in consumer mode")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://patch.msgid.link/20250807020318.2143219-1-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_sai.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c
+index d81a9322b03d..0314d4257b2d 100644
+--- a/sound/soc/fsl/fsl_sai.c
++++ b/sound/soc/fsl/fsl_sai.c
+@@ -578,9 +578,9 @@ static void fsl_sai_config_disable(struct fsl_sai *sai, int dir)
+ * are running concurrently.
+ */
+ /* Software Reset */
+- regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
+ /* Clear SR bit to finish the reset */
+- regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR, 0);
+ }
+
+ static int fsl_sai_trigger(struct snd_pcm_substream *substream, int cmd,
+@@ -710,11 +710,11 @@ static int fsl_sai_dai_probe(struct snd_soc_dai *cpu_dai)
+ unsigned int ofs = sai->soc_data->reg_offset;
+
+ /* Software Reset for both Tx and Rx */
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
+ /* Clear SR bit to finish the reset */
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), 0);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, 0);
+
+ regmap_update_bits(sai->regmap, FSL_SAI_TCR1(ofs),
+ FSL_SAI_CR1_RFW_MASK(sai->soc_data->fifo_depth),
+@@ -1256,11 +1256,11 @@ static int fsl_sai_runtime_resume(struct device *dev)
+
+ regcache_cache_only(sai->regmap, false);
+ regcache_mark_dirty(sai->regmap);
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
+ usleep_range(1000, 2000);
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), 0);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, 0);
+
+ ret = regcache_sync(sai->regmap);
+ if (ret)
+--
+2.50.1
+
--- /dev/null
+From e3b2d35c9552072c70cc60bceced7fe804a3411c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 01:43:30 +0000
+Subject: ASoC: soc-dai.c: add missing flag check at snd_soc_pcm_dai_probe()
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 5c5a7521e9364a40fe2c1b67ab79991e3e9085df ]
+
+dai->probed is used at snd_soc_pcm_dai_probe/remove(),
+and used to call real remove() function only when it was probed.
+
+ int snd_soc_pcm_dai_probe(...)
+ {
+ ...
+ for_each_rtd_dais(rtd, i, dai) {
+ ...
+
+ if (dai->driver->probe) {
+(A) int ret = dai->driver->probe(dai);
+
+ if (ret < 0)
+ return soc_dai_ret(dai, ret);
+ }
+
+=> dai->probed = 1;
+ }
+ ...
+ }
+
+ int snd_soc_pcm_dai_remove(...)
+ {
+ ...
+ for_each_rtd_dais(rtd, i, dai) {
+ ...
+=> if (dai->probed &&
+ ...) {
+ ...
+ }
+
+=> dai->probed = 0;
+ }
+ ...
+ }
+
+But on probe() case, we need to check dai->probed before calling
+real probe() function at (A), otherwise real probe() might be called
+multi times (but real remove() will be called only once).
+This patch checks it at probe().
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/87wn3u64e6.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 0e270f32975f ("ASoC: fsl_sai: replace regmap_write with regmap_update_bits")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-dai.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/soc-dai.c b/sound/soc/soc-dai.c
+index e2db2ad219b8..583b18d0f446 100644
+--- a/sound/soc/soc-dai.c
++++ b/sound/soc/soc-dai.c
+@@ -488,6 +488,9 @@ int snd_soc_pcm_dai_probe(struct snd_soc_pcm_runtime *rtd, int order)
+ if (dai->driver->probe_order != order)
+ continue;
+
++ if (dai->probed)
++ continue;
++
+ if (dai->driver->probe) {
+ int ret = dai->driver->probe(dai);
+
+--
+2.50.1
+
--- /dev/null
+From 0ab55386666309a559e25ae48fce2e5f99c56c55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 15:20:55 +0800
+Subject: drm/amdgpu: fix incorrect vm flags to map bo
+
+From: Jack Xiao <Jack.Xiao@amd.com>
+
+[ Upstream commit 040bc6d0e0e9c814c9c663f6f1544ebaff6824a8 ]
+
+It should use vm flags instead of pte flags
+to specify bo vm attributes.
+
+Fixes: 7946340fa389 ("drm/amdgpu: Move csa related code to separate file")
+Signed-off-by: Jack Xiao <Jack.Xiao@amd.com>
+Reviewed-by: Likun Gao <Likun.Gao@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit b08425fa77ad2f305fe57a33dceb456be03b653f)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
+index 08047bc4d588..2df9e81e2b49 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
+@@ -94,8 +94,8 @@ int amdgpu_map_static_csa(struct amdgpu_device *adev, struct amdgpu_vm *vm,
+ }
+
+ r = amdgpu_vm_bo_map(adev, *bo_va, csa_addr, 0, size,
+- AMDGPU_PTE_READABLE | AMDGPU_PTE_WRITEABLE |
+- AMDGPU_PTE_EXECUTABLE);
++ AMDGPU_VM_PAGE_READABLE | AMDGPU_VM_PAGE_WRITEABLE |
++ AMDGPU_VM_PAGE_EXECUTABLE);
+
+ if (r) {
+ DRM_ERROR("failed to do bo_map on static CSA, err=%d\n", r);
+--
+2.50.1
+
--- /dev/null
+From 504d9545c5e5e400f1c49ddd1c43b7f1fce121b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Aug 2025 18:52:02 +0000
+Subject: scsi: lpfc: Remove redundant assignment to avoid memory leak
+
+From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+
+[ Upstream commit eea6cafb5890db488fce1c69d05464214616d800 ]
+
+Remove the redundant assignment if kzalloc() succeeds to avoid memory
+leak.
+
+Fixes: bd2cdd5e400f ("scsi: lpfc: NVME Initiator: Add debugfs support")
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Link: https://lore.kernel.org/r/20250801185202.42631-1-jiashengjiangcool@gmail.com
+Reviewed-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_debugfs.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
+index f91eee01ce95..c3e77db18945 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.c
++++ b/drivers/scsi/lpfc/lpfc_debugfs.c
+@@ -6104,7 +6104,6 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
+ }
+ phba->nvmeio_trc_on = 1;
+ phba->nvmeio_trc_output_idx = 0;
+- phba->nvmeio_trc = NULL;
+ } else {
+ nvmeio_off:
+ phba->nvmeio_trc_size = 0;
+--
+2.50.1
+
pnfs-handle-rpc-size-limit-for-layoutcommits.patch
pnfs-fix-uninited-ptr-deref-in-block-scsi-layout.patch
rtc-ds1307-remove-clear-of-oscillator-stop-flag-osf-.patch
+scsi-lpfc-remove-redundant-assignment-to-avoid-memor.patch
+asoc-soc-dai.c-add-missing-flag-check-at-snd_soc_pcm.patch
+asoc-fsl_sai-replace-regmap_write-with-regmap_update.patch
+drm-amdgpu-fix-incorrect-vm-flags-to-map-bo.patch
--- /dev/null
+From ec79f4c56f6123625a433d19c80c40b103388d5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 10:03:18 +0800
+Subject: ASoC: fsl_sai: replace regmap_write with regmap_update_bits
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 0e270f32975fd21874185ba53653630dd40bf560 ]
+
+Use the regmap_write() for software reset in fsl_sai_config_disable would
+cause the FSL_SAI_CSR_BCE bit to be cleared. Refer to
+commit 197c53c8ecb34 ("ASoC: fsl_sai: Don't disable bitclock for i.MX8MP")
+FSL_SAI_CSR_BCE should not be cleared. So need to use regmap_update_bits()
+instead of regmap_write() for these bit operations.
+
+Fixes: dc78f7e59169d ("ASoC: fsl_sai: Force a software reset when starting in consumer mode")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://patch.msgid.link/20250807020318.2143219-1-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_sai.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c
+index 058b179f5453..45d8ef029a63 100644
+--- a/sound/soc/fsl/fsl_sai.c
++++ b/sound/soc/fsl/fsl_sai.c
+@@ -586,9 +586,9 @@ static void fsl_sai_config_disable(struct fsl_sai *sai, int dir)
+ * are running concurrently.
+ */
+ /* Software Reset */
+- regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
+ /* Clear SR bit to finish the reset */
+- regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR, 0);
+ }
+
+ static int fsl_sai_trigger(struct snd_pcm_substream *substream, int cmd,
+@@ -718,11 +718,11 @@ static int fsl_sai_dai_probe(struct snd_soc_dai *cpu_dai)
+ unsigned int ofs = sai->soc_data->reg_offset;
+
+ /* Software Reset for both Tx and Rx */
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
+ /* Clear SR bit to finish the reset */
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), 0);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, 0);
+
+ regmap_update_bits(sai->regmap, FSL_SAI_TCR1(ofs),
+ FSL_SAI_CR1_RFW_MASK(sai->soc_data->fifo_depth),
+@@ -1303,11 +1303,11 @@ static int fsl_sai_runtime_resume(struct device *dev)
+
+ regcache_cache_only(sai->regmap, false);
+ regcache_mark_dirty(sai->regmap);
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
+ usleep_range(1000, 2000);
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), 0);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, 0);
+
+ ret = regcache_sync(sai->regmap);
+ if (ret)
+--
+2.50.1
+
--- /dev/null
+From d4e36f2dceb523b6766a18d8f5e9fe574f8ad18c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 01:43:30 +0000
+Subject: ASoC: soc-dai.c: add missing flag check at snd_soc_pcm_dai_probe()
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 5c5a7521e9364a40fe2c1b67ab79991e3e9085df ]
+
+dai->probed is used at snd_soc_pcm_dai_probe/remove(),
+and used to call real remove() function only when it was probed.
+
+ int snd_soc_pcm_dai_probe(...)
+ {
+ ...
+ for_each_rtd_dais(rtd, i, dai) {
+ ...
+
+ if (dai->driver->probe) {
+(A) int ret = dai->driver->probe(dai);
+
+ if (ret < 0)
+ return soc_dai_ret(dai, ret);
+ }
+
+=> dai->probed = 1;
+ }
+ ...
+ }
+
+ int snd_soc_pcm_dai_remove(...)
+ {
+ ...
+ for_each_rtd_dais(rtd, i, dai) {
+ ...
+=> if (dai->probed &&
+ ...) {
+ ...
+ }
+
+=> dai->probed = 0;
+ }
+ ...
+ }
+
+But on probe() case, we need to check dai->probed before calling
+real probe() function at (A), otherwise real probe() might be called
+multi times (but real remove() will be called only once).
+This patch checks it at probe().
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/87wn3u64e6.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 0e270f32975f ("ASoC: fsl_sai: replace regmap_write with regmap_update_bits")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-dai.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/soc-dai.c b/sound/soc/soc-dai.c
+index 8165f5537043..703aa9a76d03 100644
+--- a/sound/soc/soc-dai.c
++++ b/sound/soc/soc-dai.c
+@@ -561,6 +561,9 @@ int snd_soc_pcm_dai_probe(struct snd_soc_pcm_runtime *rtd, int order)
+ if (dai->driver->probe_order != order)
+ continue;
+
++ if (dai->probed)
++ continue;
++
+ if (dai->driver->probe) {
+ int ret = dai->driver->probe(dai);
+
+--
+2.50.1
+
--- /dev/null
+From 33a9a7ebd87023da89e8339139792a6c49b4b125 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Aug 2023 22:54:50 +0000
+Subject: ASoC: soc-dai.h: merge DAI call back functions into ops
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 3e8bcec0787d1a73703c915c31cb00a2fd18ccbf ]
+
+snd_soc_dai_driver has .ops for call back functions (A), but it also
+has other call back functions (B). It is duplicated and confusable.
+
+ struct snd_soc_dai_driver {
+ ...
+ ^ int (*probe)(...);
+ | int (*remove)(...);
+(B) int (*compress_new)(...);
+ | int (*pcm_new)(...);
+ v ...
+(A) const struct snd_soc_dai_ops *ops;
+ ...
+ }
+
+This patch merges (B) into (A).
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/87v8dpb0w6.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 0e270f32975f ("ASoC: fsl_sai: replace regmap_write with regmap_update_bits")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/sound/soc-dai.h | 13 ++++++++
+ sound/soc/generic/audio-graph-card.c | 2 +-
+ sound/soc/soc-core.c | 25 ++++++++++++++++
+ sound/soc/soc-dai.c | 44 ++++++++++++++++------------
+ 4 files changed, 64 insertions(+), 20 deletions(-)
+
+diff --git a/include/sound/soc-dai.h b/include/sound/soc-dai.h
+index ef3bb1bcea4e..b42dbe2469af 100644
+--- a/include/sound/soc-dai.h
++++ b/include/sound/soc-dai.h
+@@ -266,6 +266,15 @@ int snd_soc_dai_compr_get_metadata(struct snd_soc_dai *dai,
+ struct snd_compr_metadata *metadata);
+
+ struct snd_soc_dai_ops {
++ /* DAI driver callbacks */
++ int (*probe)(struct snd_soc_dai *dai);
++ int (*remove)(struct snd_soc_dai *dai);
++ /* compress dai */
++ int (*compress_new)(struct snd_soc_pcm_runtime *rtd, int num);
++ /* Optional Callback used at pcm creation*/
++ int (*pcm_new)(struct snd_soc_pcm_runtime *rtd,
++ struct snd_soc_dai *dai);
++
+ /*
+ * DAI clocking configuration, all optional.
+ * Called by soc_card drivers, normally in their hw_params.
+@@ -347,6 +356,10 @@ struct snd_soc_dai_ops {
+ u64 *auto_selectable_formats;
+ int num_auto_selectable_formats;
+
++ /* probe ordering - for components with runtime dependencies */
++ int probe_order;
++ int remove_order;
++
+ /* bit field */
+ unsigned int no_capture_mute:1;
+ };
+diff --git a/sound/soc/generic/audio-graph-card.c b/sound/soc/generic/audio-graph-card.c
+index 89814f68ff56..e50527766dcc 100644
+--- a/sound/soc/generic/audio-graph-card.c
++++ b/sound/soc/generic/audio-graph-card.c
+@@ -114,7 +114,7 @@ static bool soc_component_is_pcm(struct snd_soc_dai_link_component *dlc)
+ struct snd_soc_dai *dai = snd_soc_find_dai_with_mutex(dlc);
+
+ if (dai && (dai->component->driver->pcm_construct ||
+- dai->driver->pcm_new))
++ (dai->driver->ops && dai->driver->ops->pcm_new)))
+ return true;
+
+ return false;
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index d28261ef1d4c..854d8f62008e 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -2454,6 +2454,7 @@ struct snd_soc_dai *snd_soc_register_dai(struct snd_soc_component *component,
+ {
+ struct device *dev = component->dev;
+ struct snd_soc_dai *dai;
++ struct snd_soc_dai_ops *ops; /* REMOVE ME */
+
+ dev_dbg(dev, "ASoC: dynamically register DAI %s\n", dev_name(dev));
+
+@@ -2484,6 +2485,30 @@ struct snd_soc_dai *snd_soc_register_dai(struct snd_soc_component *component,
+ if (!dai->name)
+ return NULL;
+
++ /* REMOVE ME */
++ if (dai_drv->probe ||
++ dai_drv->remove ||
++ dai_drv->compress_new ||
++ dai_drv->pcm_new ||
++ dai_drv->probe_order ||
++ dai_drv->remove_order) {
++
++ ops = devm_kzalloc(dev, sizeof(struct snd_soc_dai_ops), GFP_KERNEL);
++ if (!ops)
++ return NULL;
++ if (dai_drv->ops)
++ memcpy(ops, dai_drv->ops, sizeof(struct snd_soc_dai_ops));
++
++ ops->probe = dai_drv->probe;
++ ops->remove = dai_drv->remove;
++ ops->compress_new = dai_drv->compress_new;
++ ops->pcm_new = dai_drv->pcm_new;
++ ops->probe_order = dai_drv->probe_order;
++ ops->remove_order = dai_drv->remove_order;
++
++ dai_drv->ops = ops;
++ }
++
+ dai->component = component;
+ dai->dev = dev;
+ dai->driver = dai_drv;
+diff --git a/sound/soc/soc-dai.c b/sound/soc/soc-dai.c
+index 703aa9a76d03..4f7edef1e735 100644
+--- a/sound/soc/soc-dai.c
++++ b/sound/soc/soc-dai.c
+@@ -473,8 +473,9 @@ int snd_soc_dai_compress_new(struct snd_soc_dai *dai,
+ struct snd_soc_pcm_runtime *rtd, int num)
+ {
+ int ret = -ENOTSUPP;
+- if (dai->driver->compress_new)
+- ret = dai->driver->compress_new(rtd, num);
++ if (dai->driver->ops &&
++ dai->driver->ops->compress_new)
++ ret = dai->driver->ops->compress_new(rtd, num);
+ return soc_dai_ret(dai, ret);
+ }
+
+@@ -558,19 +559,20 @@ int snd_soc_pcm_dai_probe(struct snd_soc_pcm_runtime *rtd, int order)
+ int i;
+
+ for_each_rtd_dais(rtd, i, dai) {
+- if (dai->driver->probe_order != order)
+- continue;
+-
+ if (dai->probed)
+ continue;
+
+- if (dai->driver->probe) {
+- int ret = dai->driver->probe(dai);
++ if (dai->driver->ops) {
++ if (dai->driver->ops->probe_order != order)
++ continue;
+
+- if (ret < 0)
+- return soc_dai_ret(dai, ret);
+- }
++ if (dai->driver->ops->probe) {
++ int ret = dai->driver->ops->probe(dai);
+
++ if (ret < 0)
++ return soc_dai_ret(dai, ret);
++ }
++ }
+ dai->probed = 1;
+ }
+
+@@ -583,16 +585,19 @@ int snd_soc_pcm_dai_remove(struct snd_soc_pcm_runtime *rtd, int order)
+ int i, r, ret = 0;
+
+ for_each_rtd_dais(rtd, i, dai) {
+- if (dai->driver->remove_order != order)
++ if (!dai->probed)
+ continue;
+
+- if (dai->probed &&
+- dai->driver->remove) {
+- r = dai->driver->remove(dai);
+- if (r < 0)
+- ret = r; /* use last error */
+- }
++ if (dai->driver->ops) {
++ if (dai->driver->ops->remove_order != order)
++ continue;
+
++ if (dai->driver->ops->remove) {
++ r = dai->driver->ops->remove(dai);
++ if (r < 0)
++ ret = r; /* use last error */
++ }
++ }
+ dai->probed = 0;
+ }
+
+@@ -605,8 +610,9 @@ int snd_soc_pcm_dai_new(struct snd_soc_pcm_runtime *rtd)
+ int i;
+
+ for_each_rtd_dais(rtd, i, dai) {
+- if (dai->driver->pcm_new) {
+- int ret = dai->driver->pcm_new(rtd, dai);
++ if (dai->driver->ops &&
++ dai->driver->ops->pcm_new) {
++ int ret = dai->driver->ops->pcm_new(rtd, dai);
+ if (ret < 0)
+ return soc_dai_ret(dai, ret);
+ }
+--
+2.50.1
+
--- /dev/null
+From 5f312bc682481f0962fe9370d5a78e860b04d1f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 15:20:55 +0800
+Subject: drm/amdgpu: fix incorrect vm flags to map bo
+
+From: Jack Xiao <Jack.Xiao@amd.com>
+
+[ Upstream commit 040bc6d0e0e9c814c9c663f6f1544ebaff6824a8 ]
+
+It should use vm flags instead of pte flags
+to specify bo vm attributes.
+
+Fixes: 7946340fa389 ("drm/amdgpu: Move csa related code to separate file")
+Signed-off-by: Jack Xiao <Jack.Xiao@amd.com>
+Reviewed-by: Likun Gao <Likun.Gao@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit b08425fa77ad2f305fe57a33dceb456be03b653f)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
+index da21e60bb827..f5441ce15373 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
+@@ -93,8 +93,8 @@ int amdgpu_map_static_csa(struct amdgpu_device *adev, struct amdgpu_vm *vm,
+ }
+
+ r = amdgpu_vm_bo_map(adev, *bo_va, csa_addr, 0, size,
+- AMDGPU_PTE_READABLE | AMDGPU_PTE_WRITEABLE |
+- AMDGPU_PTE_EXECUTABLE);
++ AMDGPU_VM_PAGE_READABLE | AMDGPU_VM_PAGE_WRITEABLE |
++ AMDGPU_VM_PAGE_EXECUTABLE);
+
+ if (r) {
+ DRM_ERROR("failed to do bo_map on static CSA, err=%d\n", r);
+--
+2.50.1
+
--- /dev/null
+From f7191dc4eba8351ff4cc9e7970e8e639ac61ef7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Aug 2025 18:52:02 +0000
+Subject: scsi: lpfc: Remove redundant assignment to avoid memory leak
+
+From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+
+[ Upstream commit eea6cafb5890db488fce1c69d05464214616d800 ]
+
+Remove the redundant assignment if kzalloc() succeeds to avoid memory
+leak.
+
+Fixes: bd2cdd5e400f ("scsi: lpfc: NVME Initiator: Add debugfs support")
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Link: https://lore.kernel.org/r/20250801185202.42631-1-jiashengjiangcool@gmail.com
+Reviewed-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_debugfs.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
+index a15ad76aee21..b2578186df63 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.c
++++ b/drivers/scsi/lpfc/lpfc_debugfs.c
+@@ -6279,7 +6279,6 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
+ }
+ phba->nvmeio_trc_on = 1;
+ phba->nvmeio_trc_output_idx = 0;
+- phba->nvmeio_trc = NULL;
+ } else {
+ nvmeio_off:
+ phba->nvmeio_trc_size = 0;
+--
+2.50.1
+
pnfs-handle-rpc-size-limit-for-layoutcommits.patch
pnfs-fix-uninited-ptr-deref-in-block-scsi-layout.patch
rtc-ds1307-remove-clear-of-oscillator-stop-flag-osf-.patch
+scsi-lpfc-remove-redundant-assignment-to-avoid-memor.patch
+asoc-soc-dai.c-add-missing-flag-check-at-snd_soc_pcm.patch
+asoc-soc-dai.h-merge-dai-call-back-functions-into-op.patch
+asoc-fsl_sai-replace-regmap_write-with-regmap_update.patch
+drm-amdgpu-fix-incorrect-vm-flags-to-map-bo.patch
--- /dev/null
+From ae2e43e9b1b027fe198f77810e9142cc32a0e0b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 15:20:55 +0800
+Subject: drm/amdgpu: fix incorrect vm flags to map bo
+
+From: Jack Xiao <Jack.Xiao@amd.com>
+
+[ Upstream commit 040bc6d0e0e9c814c9c663f6f1544ebaff6824a8 ]
+
+It should use vm flags instead of pte flags
+to specify bo vm attributes.
+
+Fixes: 7946340fa389 ("drm/amdgpu: Move csa related code to separate file")
+Signed-off-by: Jack Xiao <Jack.Xiao@amd.com>
+Reviewed-by: Likun Gao <Likun.Gao@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit b08425fa77ad2f305fe57a33dceb456be03b653f)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
+index 35a8d3c96fc9..2e811e963e35 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
+@@ -94,8 +94,8 @@ int amdgpu_map_static_csa(struct amdgpu_device *adev, struct amdgpu_vm *vm,
+ }
+
+ r = amdgpu_vm_bo_map(adev, *bo_va, csa_addr, 0, size,
+- AMDGPU_PTE_READABLE | AMDGPU_PTE_WRITEABLE |
+- AMDGPU_PTE_EXECUTABLE);
++ AMDGPU_VM_PAGE_READABLE | AMDGPU_VM_PAGE_WRITEABLE |
++ AMDGPU_VM_PAGE_EXECUTABLE);
+
+ if (r) {
+ DRM_ERROR("failed to do bo_map on static CSA, err=%d\n", r);
+--
+2.50.1
+
--- /dev/null
+From ee9a0db117b513701e5f6c6117fac0fb4210d0db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Aug 2025 18:52:02 +0000
+Subject: scsi: lpfc: Remove redundant assignment to avoid memory leak
+
+From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+
+[ Upstream commit eea6cafb5890db488fce1c69d05464214616d800 ]
+
+Remove the redundant assignment if kzalloc() succeeds to avoid memory
+leak.
+
+Fixes: bd2cdd5e400f ("scsi: lpfc: NVME Initiator: Add debugfs support")
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Link: https://lore.kernel.org/r/20250801185202.42631-1-jiashengjiangcool@gmail.com
+Reviewed-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_debugfs.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
+index 291fccf02d45..f75431a948f3 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.c
++++ b/drivers/scsi/lpfc/lpfc_debugfs.c
+@@ -5886,7 +5886,6 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
+ }
+ phba->nvmeio_trc_on = 1;
+ phba->nvmeio_trc_output_idx = 0;
+- phba->nvmeio_trc = NULL;
+ } else {
+ nvmeio_off:
+ phba->nvmeio_trc_size = 0;
+--
+2.50.1
+
pnfs-handle-rpc-size-limit-for-layoutcommits.patch
pnfs-fix-uninited-ptr-deref-in-block-scsi-layout.patch
rtc-ds1307-remove-clear-of-oscillator-stop-flag-osf-.patch
+scsi-lpfc-remove-redundant-assignment-to-avoid-memor.patch
+drm-amdgpu-fix-incorrect-vm-flags-to-map-bo.patch
--- /dev/null
+From 8c79a9da611408aed4a468db1440bc8c36d0e0bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Aug 2023 22:55:53 +0000
+Subject: ASoC: fsl: merge DAI call back functions into ops
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 5e5f68ca836e740c1d788f04efa84b37ed185606 ]
+
+ALSA SoC merges DAI call backs into .ops.
+This patch merge these into one.
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/87jzu5b0ue.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 0e270f32975f ("ASoC: fsl_sai: replace regmap_write with regmap_update_bits")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_asrc.c | 16 ++++++++--------
+ sound/soc/fsl/fsl_aud2htx.c | 10 +++++-----
+ sound/soc/fsl/fsl_easrc.c | 16 ++++++++--------
+ sound/soc/fsl/fsl_esai.c | 20 ++++++++++----------
+ sound/soc/fsl/fsl_micfil.c | 14 +++++++-------
+ sound/soc/fsl/fsl_sai.c | 24 ++++++++++++------------
+ sound/soc/fsl/fsl_spdif.c | 17 ++++++++---------
+ sound/soc/fsl/fsl_ssi.c | 3 +--
+ sound/soc/fsl/fsl_xcvr.c | 16 ++++++++--------
+ 9 files changed, 67 insertions(+), 69 deletions(-)
+
+diff --git a/sound/soc/fsl/fsl_asrc.c b/sound/soc/fsl/fsl_asrc.c
+index c541e2a0202a..3ec5b88bd9a2 100644
+--- a/sound/soc/fsl/fsl_asrc.c
++++ b/sound/soc/fsl/fsl_asrc.c
+@@ -781,13 +781,6 @@ static int fsl_asrc_dai_trigger(struct snd_pcm_substream *substream, int cmd,
+ return 0;
+ }
+
+-static const struct snd_soc_dai_ops fsl_asrc_dai_ops = {
+- .startup = fsl_asrc_dai_startup,
+- .hw_params = fsl_asrc_dai_hw_params,
+- .hw_free = fsl_asrc_dai_hw_free,
+- .trigger = fsl_asrc_dai_trigger,
+-};
+-
+ static int fsl_asrc_dai_probe(struct snd_soc_dai *dai)
+ {
+ struct fsl_asrc *asrc = snd_soc_dai_get_drvdata(dai);
+@@ -798,12 +791,19 @@ static int fsl_asrc_dai_probe(struct snd_soc_dai *dai)
+ return 0;
+ }
+
++static const struct snd_soc_dai_ops fsl_asrc_dai_ops = {
++ .probe = fsl_asrc_dai_probe,
++ .startup = fsl_asrc_dai_startup,
++ .hw_params = fsl_asrc_dai_hw_params,
++ .hw_free = fsl_asrc_dai_hw_free,
++ .trigger = fsl_asrc_dai_trigger,
++};
++
+ #define FSL_ASRC_FORMATS (SNDRV_PCM_FMTBIT_S24_LE | \
+ SNDRV_PCM_FMTBIT_S16_LE | \
+ SNDRV_PCM_FMTBIT_S24_3LE)
+
+ static struct snd_soc_dai_driver fsl_asrc_dai = {
+- .probe = fsl_asrc_dai_probe,
+ .playback = {
+ .stream_name = "ASRC-Playback",
+ .channels_min = 1,
+diff --git a/sound/soc/fsl/fsl_aud2htx.c b/sound/soc/fsl/fsl_aud2htx.c
+index 1e421d9a03fb..402d9bbdbab5 100644
+--- a/sound/soc/fsl/fsl_aud2htx.c
++++ b/sound/soc/fsl/fsl_aud2htx.c
+@@ -49,10 +49,6 @@ static int fsl_aud2htx_trigger(struct snd_pcm_substream *substream, int cmd,
+ return 0;
+ }
+
+-static const struct snd_soc_dai_ops fsl_aud2htx_dai_ops = {
+- .trigger = fsl_aud2htx_trigger,
+-};
+-
+ static int fsl_aud2htx_dai_probe(struct snd_soc_dai *cpu_dai)
+ {
+ struct fsl_aud2htx *aud2htx = dev_get_drvdata(cpu_dai->dev);
+@@ -84,8 +80,12 @@ static int fsl_aud2htx_dai_probe(struct snd_soc_dai *cpu_dai)
+ return 0;
+ }
+
++static const struct snd_soc_dai_ops fsl_aud2htx_dai_ops = {
++ .probe = fsl_aud2htx_dai_probe,
++ .trigger = fsl_aud2htx_trigger,
++};
++
+ static struct snd_soc_dai_driver fsl_aud2htx_dai = {
+- .probe = fsl_aud2htx_dai_probe,
+ .playback = {
+ .stream_name = "CPU-Playback",
+ .channels_min = 1,
+diff --git a/sound/soc/fsl/fsl_easrc.c b/sound/soc/fsl/fsl_easrc.c
+index 84e6f9eb784d..210ca7199ada 100644
+--- a/sound/soc/fsl/fsl_easrc.c
++++ b/sound/soc/fsl/fsl_easrc.c
+@@ -1531,13 +1531,6 @@ static int fsl_easrc_hw_free(struct snd_pcm_substream *substream,
+ return 0;
+ }
+
+-static const struct snd_soc_dai_ops fsl_easrc_dai_ops = {
+- .startup = fsl_easrc_startup,
+- .trigger = fsl_easrc_trigger,
+- .hw_params = fsl_easrc_hw_params,
+- .hw_free = fsl_easrc_hw_free,
+-};
+-
+ static int fsl_easrc_dai_probe(struct snd_soc_dai *cpu_dai)
+ {
+ struct fsl_asrc *easrc = dev_get_drvdata(cpu_dai->dev);
+@@ -1548,8 +1541,15 @@ static int fsl_easrc_dai_probe(struct snd_soc_dai *cpu_dai)
+ return 0;
+ }
+
++static const struct snd_soc_dai_ops fsl_easrc_dai_ops = {
++ .probe = fsl_easrc_dai_probe,
++ .startup = fsl_easrc_startup,
++ .trigger = fsl_easrc_trigger,
++ .hw_params = fsl_easrc_hw_params,
++ .hw_free = fsl_easrc_hw_free,
++};
++
+ static struct snd_soc_dai_driver fsl_easrc_dai = {
+- .probe = fsl_easrc_dai_probe,
+ .playback = {
+ .stream_name = "ASRC-Playback",
+ .channels_min = 1,
+diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c
+index 17fefd27ec90..c7f4c1734825 100644
+--- a/sound/soc/fsl/fsl_esai.c
++++ b/sound/soc/fsl/fsl_esai.c
+@@ -785,15 +785,6 @@ static int fsl_esai_trigger(struct snd_pcm_substream *substream, int cmd,
+ return 0;
+ }
+
+-static const struct snd_soc_dai_ops fsl_esai_dai_ops = {
+- .startup = fsl_esai_startup,
+- .trigger = fsl_esai_trigger,
+- .hw_params = fsl_esai_hw_params,
+- .set_sysclk = fsl_esai_set_dai_sysclk,
+- .set_fmt = fsl_esai_set_dai_fmt,
+- .set_tdm_slot = fsl_esai_set_dai_tdm_slot,
+-};
+-
+ static int fsl_esai_dai_probe(struct snd_soc_dai *dai)
+ {
+ struct fsl_esai *esai_priv = snd_soc_dai_get_drvdata(dai);
+@@ -804,8 +795,17 @@ static int fsl_esai_dai_probe(struct snd_soc_dai *dai)
+ return 0;
+ }
+
++static const struct snd_soc_dai_ops fsl_esai_dai_ops = {
++ .probe = fsl_esai_dai_probe,
++ .startup = fsl_esai_startup,
++ .trigger = fsl_esai_trigger,
++ .hw_params = fsl_esai_hw_params,
++ .set_sysclk = fsl_esai_set_dai_sysclk,
++ .set_fmt = fsl_esai_set_dai_fmt,
++ .set_tdm_slot = fsl_esai_set_dai_tdm_slot,
++};
++
+ static struct snd_soc_dai_driver fsl_esai_dai = {
+- .probe = fsl_esai_dai_probe,
+ .playback = {
+ .stream_name = "CPU-Playback",
+ .channels_min = 1,
+diff --git a/sound/soc/fsl/fsl_micfil.c b/sound/soc/fsl/fsl_micfil.c
+index 8ee6f41563ea..1b6f5e33ff93 100644
+--- a/sound/soc/fsl/fsl_micfil.c
++++ b/sound/soc/fsl/fsl_micfil.c
+@@ -358,12 +358,6 @@ static int fsl_micfil_hw_params(struct snd_pcm_substream *substream,
+ return 0;
+ }
+
+-static const struct snd_soc_dai_ops fsl_micfil_dai_ops = {
+- .startup = fsl_micfil_startup,
+- .trigger = fsl_micfil_trigger,
+- .hw_params = fsl_micfil_hw_params,
+-};
+-
+ static int fsl_micfil_dai_probe(struct snd_soc_dai *cpu_dai)
+ {
+ struct fsl_micfil *micfil = dev_get_drvdata(cpu_dai->dev);
+@@ -400,8 +394,14 @@ static int fsl_micfil_dai_probe(struct snd_soc_dai *cpu_dai)
+ return 0;
+ }
+
++static const struct snd_soc_dai_ops fsl_micfil_dai_ops = {
++ .probe = fsl_micfil_dai_probe,
++ .startup = fsl_micfil_startup,
++ .trigger = fsl_micfil_trigger,
++ .hw_params = fsl_micfil_hw_params,
++};
++
+ static struct snd_soc_dai_driver fsl_micfil_dai = {
+- .probe = fsl_micfil_dai_probe,
+ .capture = {
+ .stream_name = "CPU-Capture",
+ .channels_min = 1,
+diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c
+index 27ad825c78f2..33d01a5e9b31 100644
+--- a/sound/soc/fsl/fsl_sai.c
++++ b/sound/soc/fsl/fsl_sai.c
+@@ -883,17 +883,6 @@ static int fsl_sai_startup(struct snd_pcm_substream *substream,
+ return ret;
+ }
+
+-static const struct snd_soc_dai_ops fsl_sai_pcm_dai_ops = {
+- .set_bclk_ratio = fsl_sai_set_dai_bclk_ratio,
+- .set_sysclk = fsl_sai_set_dai_sysclk,
+- .set_fmt = fsl_sai_set_dai_fmt,
+- .set_tdm_slot = fsl_sai_set_dai_tdm_slot,
+- .hw_params = fsl_sai_hw_params,
+- .hw_free = fsl_sai_hw_free,
+- .trigger = fsl_sai_trigger,
+- .startup = fsl_sai_startup,
+-};
+-
+ static int fsl_sai_dai_probe(struct snd_soc_dai *cpu_dai)
+ {
+ struct fsl_sai *sai = dev_get_drvdata(cpu_dai->dev);
+@@ -919,6 +908,18 @@ static int fsl_sai_dai_probe(struct snd_soc_dai *cpu_dai)
+ return 0;
+ }
+
++static const struct snd_soc_dai_ops fsl_sai_pcm_dai_ops = {
++ .probe = fsl_sai_dai_probe,
++ .set_bclk_ratio = fsl_sai_set_dai_bclk_ratio,
++ .set_sysclk = fsl_sai_set_dai_sysclk,
++ .set_fmt = fsl_sai_set_dai_fmt,
++ .set_tdm_slot = fsl_sai_set_dai_tdm_slot,
++ .hw_params = fsl_sai_hw_params,
++ .hw_free = fsl_sai_hw_free,
++ .trigger = fsl_sai_trigger,
++ .startup = fsl_sai_startup,
++};
++
+ static int fsl_sai_dai_resume(struct snd_soc_component *component)
+ {
+ struct fsl_sai *sai = snd_soc_component_get_drvdata(component);
+@@ -937,7 +938,6 @@ static int fsl_sai_dai_resume(struct snd_soc_component *component)
+ }
+
+ static struct snd_soc_dai_driver fsl_sai_dai_template = {
+- .probe = fsl_sai_dai_probe,
+ .playback = {
+ .stream_name = "CPU-Playback",
+ .channels_min = 1,
+diff --git a/sound/soc/fsl/fsl_spdif.c b/sound/soc/fsl/fsl_spdif.c
+index fb6806b2db85..d89963b8171d 100644
+--- a/sound/soc/fsl/fsl_spdif.c
++++ b/sound/soc/fsl/fsl_spdif.c
+@@ -761,14 +761,6 @@ static int fsl_spdif_trigger(struct snd_pcm_substream *substream,
+ return 0;
+ }
+
+-static const struct snd_soc_dai_ops fsl_spdif_dai_ops = {
+- .startup = fsl_spdif_startup,
+- .hw_params = fsl_spdif_hw_params,
+- .trigger = fsl_spdif_trigger,
+- .shutdown = fsl_spdif_shutdown,
+-};
+-
+-
+ /*
+ * FSL SPDIF IEC958 controller(mixer) functions
+ *
+@@ -1279,8 +1271,15 @@ static int fsl_spdif_dai_probe(struct snd_soc_dai *dai)
+ return 0;
+ }
+
++static const struct snd_soc_dai_ops fsl_spdif_dai_ops = {
++ .probe = fsl_spdif_dai_probe,
++ .startup = fsl_spdif_startup,
++ .hw_params = fsl_spdif_hw_params,
++ .trigger = fsl_spdif_trigger,
++ .shutdown = fsl_spdif_shutdown,
++};
++
+ static struct snd_soc_dai_driver fsl_spdif_dai = {
+- .probe = &fsl_spdif_dai_probe,
+ .playback = {
+ .stream_name = "CPU-Playback",
+ .channels_min = 2,
+diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
+index 6af00b62a60f..17887359dca1 100644
+--- a/sound/soc/fsl/fsl_ssi.c
++++ b/sound/soc/fsl/fsl_ssi.c
+@@ -1152,6 +1152,7 @@ static int fsl_ssi_dai_probe(struct snd_soc_dai *dai)
+ }
+
+ static const struct snd_soc_dai_ops fsl_ssi_dai_ops = {
++ .probe = fsl_ssi_dai_probe,
+ .startup = fsl_ssi_startup,
+ .shutdown = fsl_ssi_shutdown,
+ .hw_params = fsl_ssi_hw_params,
+@@ -1162,7 +1163,6 @@ static const struct snd_soc_dai_ops fsl_ssi_dai_ops = {
+ };
+
+ static struct snd_soc_dai_driver fsl_ssi_dai_template = {
+- .probe = fsl_ssi_dai_probe,
+ .playback = {
+ .stream_name = "CPU-Playback",
+ .channels_min = 1,
+@@ -1187,7 +1187,6 @@ static const struct snd_soc_component_driver fsl_ssi_component = {
+
+ static struct snd_soc_dai_driver fsl_ssi_ac97_dai = {
+ .symmetric_channels = 1,
+- .probe = fsl_ssi_dai_probe,
+ .playback = {
+ .stream_name = "CPU AC97 Playback",
+ .channels_min = 2,
+diff --git a/sound/soc/fsl/fsl_xcvr.c b/sound/soc/fsl/fsl_xcvr.c
+index c043efe4548d..4c5864e8267d 100644
+--- a/sound/soc/fsl/fsl_xcvr.c
++++ b/sound/soc/fsl/fsl_xcvr.c
+@@ -864,13 +864,6 @@ static struct snd_kcontrol_new fsl_xcvr_tx_ctls[] = {
+ },
+ };
+
+-static const struct snd_soc_dai_ops fsl_xcvr_dai_ops = {
+- .prepare = fsl_xcvr_prepare,
+- .startup = fsl_xcvr_startup,
+- .shutdown = fsl_xcvr_shutdown,
+- .trigger = fsl_xcvr_trigger,
+-};
+-
+ static int fsl_xcvr_dai_probe(struct snd_soc_dai *dai)
+ {
+ struct fsl_xcvr *xcvr = snd_soc_dai_get_drvdata(dai);
+@@ -887,8 +880,15 @@ static int fsl_xcvr_dai_probe(struct snd_soc_dai *dai)
+ return 0;
+ }
+
++static const struct snd_soc_dai_ops fsl_xcvr_dai_ops = {
++ .probe = fsl_xcvr_dai_probe,
++ .prepare = fsl_xcvr_prepare,
++ .startup = fsl_xcvr_startup,
++ .shutdown = fsl_xcvr_shutdown,
++ .trigger = fsl_xcvr_trigger,
++};
++
+ static struct snd_soc_dai_driver fsl_xcvr_dai = {
+- .probe = fsl_xcvr_dai_probe,
+ .ops = &fsl_xcvr_dai_ops,
+ .playback = {
+ .stream_name = "CPU-Playback",
+--
+2.50.1
+
--- /dev/null
+From e8d0e5ffa3cdaa18c715107256ec3c6149b2cc58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 10:03:18 +0800
+Subject: ASoC: fsl_sai: replace regmap_write with regmap_update_bits
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 0e270f32975fd21874185ba53653630dd40bf560 ]
+
+Use the regmap_write() for software reset in fsl_sai_config_disable would
+cause the FSL_SAI_CSR_BCE bit to be cleared. Refer to
+commit 197c53c8ecb34 ("ASoC: fsl_sai: Don't disable bitclock for i.MX8MP")
+FSL_SAI_CSR_BCE should not be cleared. So need to use regmap_update_bits()
+instead of regmap_write() for these bit operations.
+
+Fixes: dc78f7e59169d ("ASoC: fsl_sai: Force a software reset when starting in consumer mode")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://patch.msgid.link/20250807020318.2143219-1-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_sai.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c
+index 33d01a5e9b31..e622c8375a46 100644
+--- a/sound/soc/fsl/fsl_sai.c
++++ b/sound/soc/fsl/fsl_sai.c
+@@ -768,9 +768,9 @@ static void fsl_sai_config_disable(struct fsl_sai *sai, int dir)
+ * are running concurrently.
+ */
+ /* Software Reset */
+- regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
+ /* Clear SR bit to finish the reset */
+- regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR, 0);
+ }
+
+ static int fsl_sai_trigger(struct snd_pcm_substream *substream, int cmd,
+@@ -889,11 +889,11 @@ static int fsl_sai_dai_probe(struct snd_soc_dai *cpu_dai)
+ unsigned int ofs = sai->soc_data->reg_offset;
+
+ /* Software Reset for both Tx and Rx */
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
+ /* Clear SR bit to finish the reset */
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), 0);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, 0);
+
+ regmap_update_bits(sai->regmap, FSL_SAI_TCR1(ofs),
+ FSL_SAI_CR1_RFW_MASK(sai->soc_data->fifo_depth),
+@@ -1694,11 +1694,11 @@ static int fsl_sai_runtime_resume(struct device *dev)
+
+ regcache_cache_only(sai->regmap, false);
+ regcache_mark_dirty(sai->regmap);
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
+ usleep_range(1000, 2000);
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), 0);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, 0);
+
+ ret = regcache_sync(sai->regmap);
+ if (ret)
+--
+2.50.1
+
--- /dev/null
+From 57b42d920db61d9165e8868320e7b0ee39095783 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 01:43:30 +0000
+Subject: ASoC: soc-dai.c: add missing flag check at snd_soc_pcm_dai_probe()
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 5c5a7521e9364a40fe2c1b67ab79991e3e9085df ]
+
+dai->probed is used at snd_soc_pcm_dai_probe/remove(),
+and used to call real remove() function only when it was probed.
+
+ int snd_soc_pcm_dai_probe(...)
+ {
+ ...
+ for_each_rtd_dais(rtd, i, dai) {
+ ...
+
+ if (dai->driver->probe) {
+(A) int ret = dai->driver->probe(dai);
+
+ if (ret < 0)
+ return soc_dai_ret(dai, ret);
+ }
+
+=> dai->probed = 1;
+ }
+ ...
+ }
+
+ int snd_soc_pcm_dai_remove(...)
+ {
+ ...
+ for_each_rtd_dais(rtd, i, dai) {
+ ...
+=> if (dai->probed &&
+ ...) {
+ ...
+ }
+
+=> dai->probed = 0;
+ }
+ ...
+ }
+
+But on probe() case, we need to check dai->probed before calling
+real probe() function at (A), otherwise real probe() might be called
+multi times (but real remove() will be called only once).
+This patch checks it at probe().
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/87wn3u64e6.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 0e270f32975f ("ASoC: fsl_sai: replace regmap_write with regmap_update_bits")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-dai.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/soc-dai.c b/sound/soc/soc-dai.c
+index ba8a99124869..5eac6a7559c7 100644
+--- a/sound/soc/soc-dai.c
++++ b/sound/soc/soc-dai.c
+@@ -548,6 +548,9 @@ int snd_soc_pcm_dai_probe(struct snd_soc_pcm_runtime *rtd, int order)
+ if (dai->driver->probe_order != order)
+ continue;
+
++ if (dai->probed)
++ continue;
++
+ if (dai->driver->probe) {
+ int ret = dai->driver->probe(dai);
+
+--
+2.50.1
+
--- /dev/null
+From 90c3a048d1365c716dedd3b0469b0754ece214b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Aug 2023 22:54:50 +0000
+Subject: ASoC: soc-dai.h: merge DAI call back functions into ops
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 3e8bcec0787d1a73703c915c31cb00a2fd18ccbf ]
+
+snd_soc_dai_driver has .ops for call back functions (A), but it also
+has other call back functions (B). It is duplicated and confusable.
+
+ struct snd_soc_dai_driver {
+ ...
+ ^ int (*probe)(...);
+ | int (*remove)(...);
+(B) int (*compress_new)(...);
+ | int (*pcm_new)(...);
+ v ...
+(A) const struct snd_soc_dai_ops *ops;
+ ...
+ }
+
+This patch merges (B) into (A).
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/87v8dpb0w6.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 0e270f32975f ("ASoC: fsl_sai: replace regmap_write with regmap_update_bits")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/sound/soc-dai.h | 13 ++++++++
+ sound/soc/generic/audio-graph-card.c | 2 +-
+ sound/soc/soc-core.c | 25 ++++++++++++++++
+ sound/soc/soc-dai.c | 44 ++++++++++++++++------------
+ 4 files changed, 64 insertions(+), 20 deletions(-)
+
+diff --git a/include/sound/soc-dai.h b/include/sound/soc-dai.h
+index ea7509672086..9fece4e37828 100644
+--- a/include/sound/soc-dai.h
++++ b/include/sound/soc-dai.h
+@@ -272,6 +272,15 @@ int snd_soc_dai_compr_get_metadata(struct snd_soc_dai *dai,
+ struct snd_compr_metadata *metadata);
+
+ struct snd_soc_dai_ops {
++ /* DAI driver callbacks */
++ int (*probe)(struct snd_soc_dai *dai);
++ int (*remove)(struct snd_soc_dai *dai);
++ /* compress dai */
++ int (*compress_new)(struct snd_soc_pcm_runtime *rtd, int num);
++ /* Optional Callback used at pcm creation*/
++ int (*pcm_new)(struct snd_soc_pcm_runtime *rtd,
++ struct snd_soc_dai *dai);
++
+ /*
+ * DAI clocking configuration, all optional.
+ * Called by soc_card drivers, normally in their hw_params.
+@@ -353,6 +362,10 @@ struct snd_soc_dai_ops {
+ u64 *auto_selectable_formats;
+ int num_auto_selectable_formats;
+
++ /* probe ordering - for components with runtime dependencies */
++ int probe_order;
++ int remove_order;
++
+ /* bit field */
+ unsigned int no_capture_mute:1;
+ };
+diff --git a/sound/soc/generic/audio-graph-card.c b/sound/soc/generic/audio-graph-card.c
+index 5daa824a4ffc..e5481142c6c4 100644
+--- a/sound/soc/generic/audio-graph-card.c
++++ b/sound/soc/generic/audio-graph-card.c
+@@ -114,7 +114,7 @@ static bool soc_component_is_pcm(struct snd_soc_dai_link_component *dlc)
+ struct snd_soc_dai *dai = snd_soc_find_dai_with_mutex(dlc);
+
+ if (dai && (dai->component->driver->pcm_construct ||
+- dai->driver->pcm_new))
++ (dai->driver->ops && dai->driver->ops->pcm_new)))
+ return true;
+
+ return false;
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index 1ff7a0b0a236..80192b089f25 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -2426,6 +2426,7 @@ struct snd_soc_dai *snd_soc_register_dai(struct snd_soc_component *component,
+ {
+ struct device *dev = component->dev;
+ struct snd_soc_dai *dai;
++ struct snd_soc_dai_ops *ops; /* REMOVE ME */
+
+ dev_dbg(dev, "ASoC: dynamically register DAI %s\n", dev_name(dev));
+
+@@ -2456,6 +2457,30 @@ struct snd_soc_dai *snd_soc_register_dai(struct snd_soc_component *component,
+ if (!dai->name)
+ return NULL;
+
++ /* REMOVE ME */
++ if (dai_drv->probe ||
++ dai_drv->remove ||
++ dai_drv->compress_new ||
++ dai_drv->pcm_new ||
++ dai_drv->probe_order ||
++ dai_drv->remove_order) {
++
++ ops = devm_kzalloc(dev, sizeof(struct snd_soc_dai_ops), GFP_KERNEL);
++ if (!ops)
++ return NULL;
++ if (dai_drv->ops)
++ memcpy(ops, dai_drv->ops, sizeof(struct snd_soc_dai_ops));
++
++ ops->probe = dai_drv->probe;
++ ops->remove = dai_drv->remove;
++ ops->compress_new = dai_drv->compress_new;
++ ops->pcm_new = dai_drv->pcm_new;
++ ops->probe_order = dai_drv->probe_order;
++ ops->remove_order = dai_drv->remove_order;
++
++ dai_drv->ops = ops;
++ }
++
+ dai->component = component;
+ dai->dev = dev;
+ dai->driver = dai_drv;
+diff --git a/sound/soc/soc-dai.c b/sound/soc/soc-dai.c
+index 5eac6a7559c7..8e12f1059e72 100644
+--- a/sound/soc/soc-dai.c
++++ b/sound/soc/soc-dai.c
+@@ -460,8 +460,9 @@ int snd_soc_dai_compress_new(struct snd_soc_dai *dai,
+ struct snd_soc_pcm_runtime *rtd, int num)
+ {
+ int ret = -ENOTSUPP;
+- if (dai->driver->compress_new)
+- ret = dai->driver->compress_new(rtd, num);
++ if (dai->driver->ops &&
++ dai->driver->ops->compress_new)
++ ret = dai->driver->ops->compress_new(rtd, num);
+ return soc_dai_ret(dai, ret);
+ }
+
+@@ -545,19 +546,20 @@ int snd_soc_pcm_dai_probe(struct snd_soc_pcm_runtime *rtd, int order)
+ int i;
+
+ for_each_rtd_dais(rtd, i, dai) {
+- if (dai->driver->probe_order != order)
+- continue;
+-
+ if (dai->probed)
+ continue;
+
+- if (dai->driver->probe) {
+- int ret = dai->driver->probe(dai);
++ if (dai->driver->ops) {
++ if (dai->driver->ops->probe_order != order)
++ continue;
+
+- if (ret < 0)
+- return soc_dai_ret(dai, ret);
+- }
++ if (dai->driver->ops->probe) {
++ int ret = dai->driver->ops->probe(dai);
+
++ if (ret < 0)
++ return soc_dai_ret(dai, ret);
++ }
++ }
+ dai->probed = 1;
+ }
+
+@@ -570,16 +572,19 @@ int snd_soc_pcm_dai_remove(struct snd_soc_pcm_runtime *rtd, int order)
+ int i, r, ret = 0;
+
+ for_each_rtd_dais(rtd, i, dai) {
+- if (dai->driver->remove_order != order)
++ if (!dai->probed)
+ continue;
+
+- if (dai->probed &&
+- dai->driver->remove) {
+- r = dai->driver->remove(dai);
+- if (r < 0)
+- ret = r; /* use last error */
+- }
++ if (dai->driver->ops) {
++ if (dai->driver->ops->remove_order != order)
++ continue;
+
++ if (dai->driver->ops->remove) {
++ r = dai->driver->ops->remove(dai);
++ if (r < 0)
++ ret = r; /* use last error */
++ }
++ }
+ dai->probed = 0;
+ }
+
+@@ -592,8 +597,9 @@ int snd_soc_pcm_dai_new(struct snd_soc_pcm_runtime *rtd)
+ int i;
+
+ for_each_rtd_dais(rtd, i, dai) {
+- if (dai->driver->pcm_new) {
+- int ret = dai->driver->pcm_new(rtd, dai);
++ if (dai->driver->ops &&
++ dai->driver->ops->pcm_new) {
++ int ret = dai->driver->ops->pcm_new(rtd, dai);
+ if (ret < 0)
+ return soc_dai_ret(dai, ret);
+ }
+--
+2.50.1
+
--- /dev/null
+From 8c26bfb416e3f8dca9b9d6e909139eb4967896f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 15:20:55 +0800
+Subject: drm/amdgpu: fix incorrect vm flags to map bo
+
+From: Jack Xiao <Jack.Xiao@amd.com>
+
+[ Upstream commit 040bc6d0e0e9c814c9c663f6f1544ebaff6824a8 ]
+
+It should use vm flags instead of pte flags
+to specify bo vm attributes.
+
+Fixes: 7946340fa389 ("drm/amdgpu: Move csa related code to separate file")
+Signed-off-by: Jack Xiao <Jack.Xiao@amd.com>
+Reviewed-by: Likun Gao <Likun.Gao@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit b08425fa77ad2f305fe57a33dceb456be03b653f)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
+index c6d4d41c4393..35e635c833f0 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
+@@ -93,8 +93,8 @@ int amdgpu_map_static_csa(struct amdgpu_device *adev, struct amdgpu_vm *vm,
+ }
+
+ r = amdgpu_vm_bo_map(adev, *bo_va, csa_addr, 0, size,
+- AMDGPU_PTE_READABLE | AMDGPU_PTE_WRITEABLE |
+- AMDGPU_PTE_EXECUTABLE);
++ AMDGPU_VM_PAGE_READABLE | AMDGPU_VM_PAGE_WRITEABLE |
++ AMDGPU_VM_PAGE_EXECUTABLE);
+
+ if (r) {
+ DRM_ERROR("failed to do bo_map on static CSA, err=%d\n", r);
+--
+2.50.1
+
--- /dev/null
+From 693afcb417854a20e59982181ecd94b34e910470 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Aug 2025 18:52:02 +0000
+Subject: scsi: lpfc: Remove redundant assignment to avoid memory leak
+
+From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+
+[ Upstream commit eea6cafb5890db488fce1c69d05464214616d800 ]
+
+Remove the redundant assignment if kzalloc() succeeds to avoid memory
+leak.
+
+Fixes: bd2cdd5e400f ("scsi: lpfc: NVME Initiator: Add debugfs support")
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Link: https://lore.kernel.org/r/20250801185202.42631-1-jiashengjiangcool@gmail.com
+Reviewed-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_debugfs.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
+index 250d423710ca..f149753e62ec 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.c
++++ b/drivers/scsi/lpfc/lpfc_debugfs.c
+@@ -6287,7 +6287,6 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
+ }
+ phba->nvmeio_trc_on = 1;
+ phba->nvmeio_trc_output_idx = 0;
+- phba->nvmeio_trc = NULL;
+ } else {
+ nvmeio_off:
+ phba->nvmeio_trc_size = 0;
+--
+2.50.1
+
pnfs-handle-rpc-size-limit-for-layoutcommits.patch
pnfs-fix-uninited-ptr-deref-in-block-scsi-layout.patch
rtc-ds1307-remove-clear-of-oscillator-stop-flag-osf-.patch
+scsi-lpfc-remove-redundant-assignment-to-avoid-memor.patch
+asoc-soc-dai.c-add-missing-flag-check-at-snd_soc_pcm.patch
+asoc-soc-dai.h-merge-dai-call-back-functions-into-op.patch
+asoc-fsl-merge-dai-call-back-functions-into-ops.patch
+asoc-fsl_sai-replace-regmap_write-with-regmap_update.patch
+drm-amdgpu-fix-incorrect-vm-flags-to-map-bo.patch
--- /dev/null
+From dfa59b25b4b1bef5abc6a813756832ec37a7cb9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 10:03:18 +0800
+Subject: ASoC: fsl_sai: replace regmap_write with regmap_update_bits
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 0e270f32975fd21874185ba53653630dd40bf560 ]
+
+Use the regmap_write() for software reset in fsl_sai_config_disable would
+cause the FSL_SAI_CSR_BCE bit to be cleared. Refer to
+commit 197c53c8ecb34 ("ASoC: fsl_sai: Don't disable bitclock for i.MX8MP")
+FSL_SAI_CSR_BCE should not be cleared. So need to use regmap_update_bits()
+instead of regmap_write() for these bit operations.
+
+Fixes: dc78f7e59169d ("ASoC: fsl_sai: Force a software reset when starting in consumer mode")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://patch.msgid.link/20250807020318.2143219-1-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_sai.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c
+index 25d4b27f5b76..57614c0b711e 100644
+--- a/sound/soc/fsl/fsl_sai.c
++++ b/sound/soc/fsl/fsl_sai.c
+@@ -777,9 +777,9 @@ static void fsl_sai_config_disable(struct fsl_sai *sai, int dir)
+ * are running concurrently.
+ */
+ /* Software Reset */
+- regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
+ /* Clear SR bit to finish the reset */
+- regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR, 0);
+ }
+
+ static int fsl_sai_trigger(struct snd_pcm_substream *substream, int cmd,
+@@ -898,11 +898,11 @@ static int fsl_sai_dai_probe(struct snd_soc_dai *cpu_dai)
+ unsigned int ofs = sai->soc_data->reg_offset;
+
+ /* Software Reset for both Tx and Rx */
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
+ /* Clear SR bit to finish the reset */
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), 0);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, 0);
+
+ regmap_update_bits(sai->regmap, FSL_SAI_TCR1(ofs),
+ FSL_SAI_CR1_RFW_MASK(sai->soc_data->fifo_depth),
+@@ -1785,11 +1785,11 @@ static int fsl_sai_runtime_resume(struct device *dev)
+
+ regcache_cache_only(sai->regmap, false);
+ regcache_mark_dirty(sai->regmap);
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
+ usleep_range(1000, 2000);
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), 0);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, 0);
+
+ ret = regcache_sync(sai->regmap);
+ if (ret)
+--
+2.50.1
+
--- /dev/null
+From 209fd578ff6ca8fd4dd53a1dbca8affe0c575376 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 08:34:04 +0100
+Subject: cifs: Fix collect_sample() to handle any iterator type
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit b63335fb3d32579c5ff0b7038b9cc23688fff528 ]
+
+collect_sample() is used to gather samples of the data in a Write op for
+analysis to try and determine if the compression algorithm is likely to
+achieve anything more quickly than actually running the compression
+algorithm.
+
+However, collect_sample() assumes that the data it is going to be sampling
+is stored in an ITER_XARRAY-type iterator (which it now should never be)
+and doesn't actually check that it is before accessing the underlying
+xarray directly.
+
+Fix this by replacing the code with a loop that just uses the standard
+iterator functions to sample every other 2KiB block, skipping the
+intervening ones. It's not quite the same as the previous algorithm as it
+doesn't necessarily align to the pages within an ordinary write from the
+pagecache.
+
+Note that the btrfs code from which this was derived samples the inode's
+pagecache directly rather than the iterator - but that doesn't necessarily
+work for network filesystems if O_DIRECT is in operation.
+
+Fixes: 94ae8c3fee94 ("smb: client: compress: LZ77 code improvements cleanup")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+cc: Enzo Matsumiya <ematsumiya@suse.de>
+cc: Shyam Prasad N <sprasad@microsoft.com>
+cc: Tom Talpey <tom@talpey.com>
+cc: linux-cifs@vger.kernel.org
+cc: linux-fsdevel@vger.kernel.org
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/compress.c | 71 ++++++++++++----------------------------
+ 1 file changed, 21 insertions(+), 50 deletions(-)
+
+diff --git a/fs/smb/client/compress.c b/fs/smb/client/compress.c
+index 766b4de13da7..db709f5cd2e1 100644
+--- a/fs/smb/client/compress.c
++++ b/fs/smb/client/compress.c
+@@ -155,58 +155,29 @@ static int cmp_bkt(const void *_a, const void *_b)
+ }
+
+ /*
+- * TODO:
+- * Support other iter types, if required.
+- * Only ITER_XARRAY is supported for now.
++ * Collect some 2K samples with 2K gaps between.
+ */
+-static int collect_sample(const struct iov_iter *iter, ssize_t max, u8 *sample)
++static int collect_sample(const struct iov_iter *source, ssize_t max, u8 *sample)
+ {
+- struct folio *folios[16], *folio;
+- unsigned int nr, i, j, npages;
+- loff_t start = iter->xarray_start + iter->iov_offset;
+- pgoff_t last, index = start / PAGE_SIZE;
+- size_t len, off, foff;
+- void *p;
+- int s = 0;
+-
+- last = (start + max - 1) / PAGE_SIZE;
+- do {
+- nr = xa_extract(iter->xarray, (void **)folios, index, last, ARRAY_SIZE(folios),
+- XA_PRESENT);
+- if (nr == 0)
+- return -EIO;
+-
+- for (i = 0; i < nr; i++) {
+- folio = folios[i];
+- npages = folio_nr_pages(folio);
+- foff = start - folio_pos(folio);
+- off = foff % PAGE_SIZE;
+-
+- for (j = foff / PAGE_SIZE; j < npages; j++) {
+- size_t len2;
+-
+- len = min_t(size_t, max, PAGE_SIZE - off);
+- len2 = min_t(size_t, len, SZ_2K);
+-
+- p = kmap_local_page(folio_page(folio, j));
+- memcpy(&sample[s], p, len2);
+- kunmap_local(p);
+-
+- s += len2;
+-
+- if (len2 < SZ_2K || s >= max - SZ_2K)
+- return s;
+-
+- max -= len;
+- if (max <= 0)
+- return s;
+-
+- start += len;
+- off = 0;
+- index++;
+- }
+- }
+- } while (nr == ARRAY_SIZE(folios));
++ struct iov_iter iter = *source;
++ size_t s = 0;
++
++ while (iov_iter_count(&iter) >= SZ_2K) {
++ size_t part = umin(umin(iov_iter_count(&iter), SZ_2K), max);
++ size_t n;
++
++ n = copy_from_iter(sample + s, part, &iter);
++ if (n != part)
++ return -EFAULT;
++
++ s += n;
++ max -= n;
++
++ if (iov_iter_count(&iter) < PAGE_SIZE - SZ_2K)
++ break;
++
++ iov_iter_advance(&iter, SZ_2K);
++ }
+
+ return s;
+ }
+--
+2.50.1
+
--- /dev/null
+From ba840d194ff15d2835c716e7e1e1cfa6ce7dd86a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 15:20:55 +0800
+Subject: drm/amdgpu: fix incorrect vm flags to map bo
+
+From: Jack Xiao <Jack.Xiao@amd.com>
+
+[ Upstream commit 040bc6d0e0e9c814c9c663f6f1544ebaff6824a8 ]
+
+It should use vm flags instead of pte flags
+to specify bo vm attributes.
+
+Fixes: 7946340fa389 ("drm/amdgpu: Move csa related code to separate file")
+Signed-off-by: Jack Xiao <Jack.Xiao@amd.com>
+Reviewed-by: Likun Gao <Likun.Gao@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit b08425fa77ad2f305fe57a33dceb456be03b653f)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
+index 02138aa55793..dfb6cfd83760 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
+@@ -88,8 +88,8 @@ int amdgpu_map_static_csa(struct amdgpu_device *adev, struct amdgpu_vm *vm,
+ }
+
+ r = amdgpu_vm_bo_map(adev, *bo_va, csa_addr, 0, size,
+- AMDGPU_PTE_READABLE | AMDGPU_PTE_WRITEABLE |
+- AMDGPU_PTE_EXECUTABLE);
++ AMDGPU_VM_PAGE_READABLE | AMDGPU_VM_PAGE_WRITEABLE |
++ AMDGPU_VM_PAGE_EXECUTABLE);
+
+ if (r) {
+ DRM_ERROR("failed to do bo_map on static CSA, err=%d\n", r);
+--
+2.50.1
+
--- /dev/null
+From ec3518fa5464e26e4257165125abc40a61d97371 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 09:17:58 +0800
+Subject: drm/amdgpu: fix vram reservation issue
+
+From: YiPeng Chai <YiPeng.Chai@amd.com>
+
+[ Upstream commit 10ef476aad1c848449934e7bec2ab2374333c7b6 ]
+
+The vram block allocation flag must be cleared
+before making vram reservation, otherwise reserving
+addresses within the currently freed memory range
+will always fail.
+
+Fixes: c9cad937c0c5 ("drm/amdgpu: add drm buddy support to amdgpu")
+Signed-off-by: YiPeng Chai <YiPeng.Chai@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit d38eaf27de1b8584f42d6fb3f717b7ec44b3a7a1)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
+index 732c79e201c6..ea4df412decf 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
+@@ -648,9 +648,8 @@ static void amdgpu_vram_mgr_del(struct ttm_resource_manager *man,
+ list_for_each_entry(block, &vres->blocks, link)
+ vis_usage += amdgpu_vram_mgr_vis_size(adev, block);
+
+- amdgpu_vram_mgr_do_reserve(man);
+-
+ drm_buddy_free_list(mm, &vres->blocks, vres->flags);
++ amdgpu_vram_mgr_do_reserve(man);
+ mutex_unlock(&mgr->lock);
+
+ atomic64_sub(vis_usage, &mgr->vis_usage);
+--
+2.50.1
+
--- /dev/null
+From 67d80fb3b95c808dcb0cd2e83b32765a67d216b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Aug 2025 18:52:02 +0000
+Subject: scsi: lpfc: Remove redundant assignment to avoid memory leak
+
+From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+
+[ Upstream commit eea6cafb5890db488fce1c69d05464214616d800 ]
+
+Remove the redundant assignment if kzalloc() succeeds to avoid memory
+leak.
+
+Fixes: bd2cdd5e400f ("scsi: lpfc: NVME Initiator: Add debugfs support")
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Link: https://lore.kernel.org/r/20250801185202.42631-1-jiashengjiangcool@gmail.com
+Reviewed-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_debugfs.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
+index 3fd1aa5cc78c..1b601e45bc45 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.c
++++ b/drivers/scsi/lpfc/lpfc_debugfs.c
+@@ -6289,7 +6289,6 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
+ }
+ phba->nvmeio_trc_on = 1;
+ phba->nvmeio_trc_output_idx = 0;
+- phba->nvmeio_trc = NULL;
+ } else {
+ nvmeio_off:
+ phba->nvmeio_trc_size = 0;
+--
+2.50.1
+
pnfs-handle-rpc-size-limit-for-layoutcommits.patch
pnfs-fix-uninited-ptr-deref-in-block-scsi-layout.patch
rtc-ds1307-remove-clear-of-oscillator-stop-flag-osf-.patch
+scsi-lpfc-remove-redundant-assignment-to-avoid-memor.patch
+asoc-fsl_sai-replace-regmap_write-with-regmap_update.patch
+cifs-fix-collect_sample-to-handle-any-iterator-type.patch
+drm-amdgpu-fix-vram-reservation-issue.patch
+drm-amdgpu-fix-incorrect-vm-flags-to-map-bo.patch
--- /dev/null
+From bec4e8bc621d282b45601aac90fca45fc2f7da28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 10:03:18 +0800
+Subject: ASoC: fsl_sai: replace regmap_write with regmap_update_bits
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 0e270f32975fd21874185ba53653630dd40bf560 ]
+
+Use the regmap_write() for software reset in fsl_sai_config_disable would
+cause the FSL_SAI_CSR_BCE bit to be cleared. Refer to
+commit 197c53c8ecb34 ("ASoC: fsl_sai: Don't disable bitclock for i.MX8MP")
+FSL_SAI_CSR_BCE should not be cleared. So need to use regmap_update_bits()
+instead of regmap_write() for these bit operations.
+
+Fixes: dc78f7e59169d ("ASoC: fsl_sai: Force a software reset when starting in consumer mode")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://patch.msgid.link/20250807020318.2143219-1-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_sai.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c
+index f244e3679975..01944860a264 100644
+--- a/sound/soc/fsl/fsl_sai.c
++++ b/sound/soc/fsl/fsl_sai.c
+@@ -777,9 +777,9 @@ static void fsl_sai_config_disable(struct fsl_sai *sai, int dir)
+ * are running concurrently.
+ */
+ /* Software Reset */
+- regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
+ /* Clear SR bit to finish the reset */
+- regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR, 0);
+ }
+
+ static int fsl_sai_trigger(struct snd_pcm_substream *substream, int cmd,
+@@ -898,11 +898,11 @@ static int fsl_sai_dai_probe(struct snd_soc_dai *cpu_dai)
+ unsigned int ofs = sai->soc_data->reg_offset;
+
+ /* Software Reset for both Tx and Rx */
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
+ /* Clear SR bit to finish the reset */
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), 0);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, 0);
+
+ regmap_update_bits(sai->regmap, FSL_SAI_TCR1(ofs),
+ FSL_SAI_CR1_RFW_MASK(sai->soc_data->fifo_depth),
+@@ -1790,11 +1790,11 @@ static int fsl_sai_runtime_resume(struct device *dev)
+
+ regcache_cache_only(sai->regmap, false);
+ regcache_mark_dirty(sai->regmap);
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
+ usleep_range(1000, 2000);
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), 0);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, 0);
+
+ ret = regcache_sync(sai->regmap);
+ if (ret)
+--
+2.50.1
+
--- /dev/null
+From 70fc12f3e42d75bac461c93cbd9ff069e573b61c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 08:34:04 +0100
+Subject: cifs: Fix collect_sample() to handle any iterator type
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit b63335fb3d32579c5ff0b7038b9cc23688fff528 ]
+
+collect_sample() is used to gather samples of the data in a Write op for
+analysis to try and determine if the compression algorithm is likely to
+achieve anything more quickly than actually running the compression
+algorithm.
+
+However, collect_sample() assumes that the data it is going to be sampling
+is stored in an ITER_XARRAY-type iterator (which it now should never be)
+and doesn't actually check that it is before accessing the underlying
+xarray directly.
+
+Fix this by replacing the code with a loop that just uses the standard
+iterator functions to sample every other 2KiB block, skipping the
+intervening ones. It's not quite the same as the previous algorithm as it
+doesn't necessarily align to the pages within an ordinary write from the
+pagecache.
+
+Note that the btrfs code from which this was derived samples the inode's
+pagecache directly rather than the iterator - but that doesn't necessarily
+work for network filesystems if O_DIRECT is in operation.
+
+Fixes: 94ae8c3fee94 ("smb: client: compress: LZ77 code improvements cleanup")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+cc: Enzo Matsumiya <ematsumiya@suse.de>
+cc: Shyam Prasad N <sprasad@microsoft.com>
+cc: Tom Talpey <tom@talpey.com>
+cc: linux-cifs@vger.kernel.org
+cc: linux-fsdevel@vger.kernel.org
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/compress.c | 71 ++++++++++++----------------------------
+ 1 file changed, 21 insertions(+), 50 deletions(-)
+
+diff --git a/fs/smb/client/compress.c b/fs/smb/client/compress.c
+index 766b4de13da7..db709f5cd2e1 100644
+--- a/fs/smb/client/compress.c
++++ b/fs/smb/client/compress.c
+@@ -155,58 +155,29 @@ static int cmp_bkt(const void *_a, const void *_b)
+ }
+
+ /*
+- * TODO:
+- * Support other iter types, if required.
+- * Only ITER_XARRAY is supported for now.
++ * Collect some 2K samples with 2K gaps between.
+ */
+-static int collect_sample(const struct iov_iter *iter, ssize_t max, u8 *sample)
++static int collect_sample(const struct iov_iter *source, ssize_t max, u8 *sample)
+ {
+- struct folio *folios[16], *folio;
+- unsigned int nr, i, j, npages;
+- loff_t start = iter->xarray_start + iter->iov_offset;
+- pgoff_t last, index = start / PAGE_SIZE;
+- size_t len, off, foff;
+- void *p;
+- int s = 0;
+-
+- last = (start + max - 1) / PAGE_SIZE;
+- do {
+- nr = xa_extract(iter->xarray, (void **)folios, index, last, ARRAY_SIZE(folios),
+- XA_PRESENT);
+- if (nr == 0)
+- return -EIO;
+-
+- for (i = 0; i < nr; i++) {
+- folio = folios[i];
+- npages = folio_nr_pages(folio);
+- foff = start - folio_pos(folio);
+- off = foff % PAGE_SIZE;
+-
+- for (j = foff / PAGE_SIZE; j < npages; j++) {
+- size_t len2;
+-
+- len = min_t(size_t, max, PAGE_SIZE - off);
+- len2 = min_t(size_t, len, SZ_2K);
+-
+- p = kmap_local_page(folio_page(folio, j));
+- memcpy(&sample[s], p, len2);
+- kunmap_local(p);
+-
+- s += len2;
+-
+- if (len2 < SZ_2K || s >= max - SZ_2K)
+- return s;
+-
+- max -= len;
+- if (max <= 0)
+- return s;
+-
+- start += len;
+- off = 0;
+- index++;
+- }
+- }
+- } while (nr == ARRAY_SIZE(folios));
++ struct iov_iter iter = *source;
++ size_t s = 0;
++
++ while (iov_iter_count(&iter) >= SZ_2K) {
++ size_t part = umin(umin(iov_iter_count(&iter), SZ_2K), max);
++ size_t n;
++
++ n = copy_from_iter(sample + s, part, &iter);
++ if (n != part)
++ return -EFAULT;
++
++ s += n;
++ max -= n;
++
++ if (iov_iter_count(&iter) < PAGE_SIZE - SZ_2K)
++ break;
++
++ iov_iter_advance(&iter, SZ_2K);
++ }
+
+ return s;
+ }
+--
+2.50.1
+
--- /dev/null
+From cff79ea597a546d77ba916551db1457db637d082 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 15:20:55 +0800
+Subject: drm/amdgpu: fix incorrect vm flags to map bo
+
+From: Jack Xiao <Jack.Xiao@amd.com>
+
+[ Upstream commit 040bc6d0e0e9c814c9c663f6f1544ebaff6824a8 ]
+
+It should use vm flags instead of pte flags
+to specify bo vm attributes.
+
+Fixes: 7946340fa389 ("drm/amdgpu: Move csa related code to separate file")
+Signed-off-by: Jack Xiao <Jack.Xiao@amd.com>
+Reviewed-by: Likun Gao <Likun.Gao@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit b08425fa77ad2f305fe57a33dceb456be03b653f)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
+index 02138aa55793..dfb6cfd83760 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
+@@ -88,8 +88,8 @@ int amdgpu_map_static_csa(struct amdgpu_device *adev, struct amdgpu_vm *vm,
+ }
+
+ r = amdgpu_vm_bo_map(adev, *bo_va, csa_addr, 0, size,
+- AMDGPU_PTE_READABLE | AMDGPU_PTE_WRITEABLE |
+- AMDGPU_PTE_EXECUTABLE);
++ AMDGPU_VM_PAGE_READABLE | AMDGPU_VM_PAGE_WRITEABLE |
++ AMDGPU_VM_PAGE_EXECUTABLE);
+
+ if (r) {
+ DRM_ERROR("failed to do bo_map on static CSA, err=%d\n", r);
+--
+2.50.1
+
--- /dev/null
+From 4cfe9b60738fbd53e489e6c7bed3c43bd034da00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 09:17:58 +0800
+Subject: drm/amdgpu: fix vram reservation issue
+
+From: YiPeng Chai <YiPeng.Chai@amd.com>
+
+[ Upstream commit 10ef476aad1c848449934e7bec2ab2374333c7b6 ]
+
+The vram block allocation flag must be cleared
+before making vram reservation, otherwise reserving
+addresses within the currently freed memory range
+will always fail.
+
+Fixes: c9cad937c0c5 ("drm/amdgpu: add drm buddy support to amdgpu")
+Signed-off-by: YiPeng Chai <YiPeng.Chai@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit d38eaf27de1b8584f42d6fb3f717b7ec44b3a7a1)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
+index 07c936e90d8e..78f9e86ccc09 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
+@@ -648,9 +648,8 @@ static void amdgpu_vram_mgr_del(struct ttm_resource_manager *man,
+ list_for_each_entry(block, &vres->blocks, link)
+ vis_usage += amdgpu_vram_mgr_vis_size(adev, block);
+
+- amdgpu_vram_mgr_do_reserve(man);
+-
+ drm_buddy_free_list(mm, &vres->blocks, vres->flags);
++ amdgpu_vram_mgr_do_reserve(man);
+ mutex_unlock(&mgr->lock);
+
+ atomic64_sub(vis_usage, &mgr->vis_usage);
+--
+2.50.1
+
--- /dev/null
+From 74ef1f01fcc3c7d7be4fe92a2c0df6b454ea449e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Aug 2025 09:29:05 +0300
+Subject: drm/i915/psr: Do not trigger Frame Change events from frontbuffer
+ flush
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jouni Högander <jouni.hogander@intel.com>
+
+[ Upstream commit 184889dfe0568528fd6d14bba864dd57ed45bbf2 ]
+
+We want to get rid of triggering "Frame Change" events from
+frontbuffer flush calls. We are about to move using TRANS_PUSH
+register for this on LunarLake and onwards. Touching TRANS_PUSH
+register from fronbuffer flush would be problematic as it's written by
+DSB as well.
+
+Fix this by using intel_psr_exit when flush or invalidate is done on
+LunarLake and onwards. This is not possible on AlderLake and
+MeteorLake due to HW bug in PSR2 disable.
+
+This patch is also fixing problems with cursor plane where cursor is
+disappearing or duplicate cursor is seen on the screen.
+
+v2: Commit message updated
+
+Bspec: 68927, 68934, 66624
+Reported-by: Janna Martl <janna.martl109@gmail.com>
+Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/5522
+Fixes: 411ad63877bb ("drm/i915/psr: Use SFF_CTL on invalidate/flush for LunarLake onwards")
+Tested-by: Janna Martl <janna.martl109@gmail.com>
+Signed-off-by: Jouni Högander <jouni.hogander@intel.com>
+Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
+Link: https://lore.kernel.org/r/20250801062905.564453-1-jouni.hogander@intel.com
+(cherry picked from commit 46fb38cb20c0d185a6391ab524b23e0e0219c41f)
+Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/display/intel_psr.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/display/intel_psr.c b/drivers/gpu/drm/i915/display/intel_psr.c
+index 4e938bad808c..ccefdcb833dd 100644
+--- a/drivers/gpu/drm/i915/display/intel_psr.c
++++ b/drivers/gpu/drm/i915/display/intel_psr.c
+@@ -3171,7 +3171,9 @@ static void intel_psr_configure_full_frame_update(struct intel_dp *intel_dp)
+
+ static void _psr_invalidate_handle(struct intel_dp *intel_dp)
+ {
+- if (intel_dp->psr.psr2_sel_fetch_enabled) {
++ struct intel_display *display = to_intel_display(intel_dp);
++
++ if (DISPLAY_VER(display) < 20 && intel_dp->psr.psr2_sel_fetch_enabled) {
+ if (!intel_dp->psr.psr2_sel_fetch_cff_enabled) {
+ intel_dp->psr.psr2_sel_fetch_cff_enabled = true;
+ intel_psr_configure_full_frame_update(intel_dp);
+@@ -3259,7 +3261,7 @@ static void _psr_flush_handle(struct intel_dp *intel_dp)
+ struct intel_display *display = to_intel_display(intel_dp);
+ struct drm_i915_private *dev_priv = to_i915(display->drm);
+
+- if (intel_dp->psr.psr2_sel_fetch_enabled) {
++ if (DISPLAY_VER(display) < 20 && intel_dp->psr.psr2_sel_fetch_enabled) {
+ if (intel_dp->psr.psr2_sel_fetch_cff_enabled) {
+ /* can we turn CFF off? */
+ if (intel_dp->psr.busy_frontbuffer_bits == 0)
+@@ -3276,11 +3278,13 @@ static void _psr_flush_handle(struct intel_dp *intel_dp)
+ * existing SU configuration
+ */
+ intel_psr_configure_full_frame_update(intel_dp);
+- }
+
+- intel_psr_force_update(intel_dp);
++ intel_psr_force_update(intel_dp);
++ } else {
++ intel_psr_exit(intel_dp);
++ }
+
+- if (!intel_dp->psr.psr2_sel_fetch_enabled && !intel_dp->psr.active &&
++ if ((!intel_dp->psr.psr2_sel_fetch_enabled || DISPLAY_VER(display) >= 20) &&
+ !intel_dp->psr.busy_frontbuffer_bits)
+ queue_work(dev_priv->unordered_wq, &intel_dp->psr.work);
+ }
+--
+2.50.1
+
--- /dev/null
+From 4305faf02740ded6bc1f591adc0420043b05afaa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Aug 2025 18:52:02 +0000
+Subject: scsi: lpfc: Remove redundant assignment to avoid memory leak
+
+From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+
+[ Upstream commit eea6cafb5890db488fce1c69d05464214616d800 ]
+
+Remove the redundant assignment if kzalloc() succeeds to avoid memory
+leak.
+
+Fixes: bd2cdd5e400f ("scsi: lpfc: NVME Initiator: Add debugfs support")
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Link: https://lore.kernel.org/r/20250801185202.42631-1-jiashengjiangcool@gmail.com
+Reviewed-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_debugfs.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
+index 3fd1aa5cc78c..1b601e45bc45 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.c
++++ b/drivers/scsi/lpfc/lpfc_debugfs.c
+@@ -6289,7 +6289,6 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
+ }
+ phba->nvmeio_trc_on = 1;
+ phba->nvmeio_trc_output_idx = 0;
+- phba->nvmeio_trc = NULL;
+ } else {
+ nvmeio_off:
+ phba->nvmeio_trc_size = 0;
+--
+2.50.1
+
pnfs-handle-rpc-size-limit-for-layoutcommits.patch
pnfs-fix-uninited-ptr-deref-in-block-scsi-layout.patch
rtc-ds1307-remove-clear-of-oscillator-stop-flag-osf-.patch
+scsi-lpfc-remove-redundant-assignment-to-avoid-memor.patch
+asoc-fsl_sai-replace-regmap_write-with-regmap_update.patch
+cifs-fix-collect_sample-to-handle-any-iterator-type.patch
+drm-i915-psr-do-not-trigger-frame-change-events-from.patch
+drm-amdgpu-fix-vram-reservation-issue.patch
+drm-amdgpu-fix-incorrect-vm-flags-to-map-bo.patch
--- /dev/null
+From 7f230842b8bbea41cff38232fc54132a17ca3ad2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 10:03:18 +0800
+Subject: ASoC: fsl_sai: replace regmap_write with regmap_update_bits
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 0e270f32975fd21874185ba53653630dd40bf560 ]
+
+Use the regmap_write() for software reset in fsl_sai_config_disable would
+cause the FSL_SAI_CSR_BCE bit to be cleared. Refer to
+commit 197c53c8ecb34 ("ASoC: fsl_sai: Don't disable bitclock for i.MX8MP")
+FSL_SAI_CSR_BCE should not be cleared. So need to use regmap_update_bits()
+instead of regmap_write() for these bit operations.
+
+Fixes: dc78f7e59169d ("ASoC: fsl_sai: Force a software reset when starting in consumer mode")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://patch.msgid.link/20250807020318.2143219-1-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_sai.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c
+index 50af6b725670..10f0633ce68f 100644
+--- a/sound/soc/fsl/fsl_sai.c
++++ b/sound/soc/fsl/fsl_sai.c
+@@ -809,9 +809,9 @@ static void fsl_sai_config_disable(struct fsl_sai *sai, int dir)
+ * are running concurrently.
+ */
+ /* Software Reset */
+- regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
+ /* Clear SR bit to finish the reset */
+- regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR, 0);
+ }
+
+ static int fsl_sai_trigger(struct snd_pcm_substream *substream, int cmd,
+@@ -930,11 +930,11 @@ static int fsl_sai_dai_probe(struct snd_soc_dai *cpu_dai)
+ unsigned int ofs = sai->soc_data->reg_offset;
+
+ /* Software Reset for both Tx and Rx */
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
+ /* Clear SR bit to finish the reset */
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), 0);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, 0);
+
+ regmap_update_bits(sai->regmap, FSL_SAI_TCR1(ofs),
+ FSL_SAI_CR1_RFW_MASK(sai->soc_data->fifo_depth),
+@@ -1824,11 +1824,11 @@ static int fsl_sai_runtime_resume(struct device *dev)
+
+ regcache_cache_only(sai->regmap, false);
+ regcache_mark_dirty(sai->regmap);
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
+ usleep_range(1000, 2000);
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), 0);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, 0);
+
+ ret = regcache_sync(sai->regmap);
+ if (ret)
+--
+2.50.1
+
--- /dev/null
+From 6dbfa22e359ba315554b2db71bb9f5e20b7e9e94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 13:36:09 +0800
+Subject: block: fix kobject double initialization in add_disk
+
+From: Zheng Qixing <zhengqixing@huawei.com>
+
+[ Upstream commit 343dc5423bfe876c12bb80c56f5e44286e442a07 ]
+
+Device-mapper can call add_disk() multiple times for the same gendisk
+due to its two-phase creation process (dm create + dm load). This leads
+to kobject double initialization errors when the underlying iSCSI devices
+become temporarily unavailable and then reappear.
+
+However, if the first add_disk() call fails and is retried, the queue_kobj
+gets initialized twice, causing:
+
+kobject: kobject (ffff88810c27bb90): tried to init an initialized object,
+something is seriously wrong.
+ Call Trace:
+ <TASK>
+ dump_stack_lvl+0x5b/0x80
+ kobject_init.cold+0x43/0x51
+ blk_register_queue+0x46/0x280
+ add_disk_fwnode+0xb5/0x280
+ dm_setup_md_queue+0x194/0x1c0
+ table_load+0x297/0x2d0
+ ctl_ioctl+0x2a2/0x480
+ dm_ctl_ioctl+0xe/0x20
+ __x64_sys_ioctl+0xc7/0x110
+ do_syscall_64+0x72/0x390
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+Fix this by separating kobject initialization from sysfs registration:
+ - Initialize queue_kobj early during gendisk allocation
+ - add_disk() only adds the already-initialized kobject to sysfs
+ - del_gendisk() removes from sysfs but doesn't destroy the kobject
+ - Final cleanup happens when the disk is released
+
+Fixes: 2bd85221a625 ("block: untangle request_queue refcounting from sysfs")
+Reported-by: Li Lingfeng <lilingfeng3@huawei.com>
+Closes: https://lore.kernel.org/all/83591d0b-2467-433c-bce0-5581298eb161@huawei.com/
+Signed-off-by: Zheng Qixing <zhengqixing@huawei.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Link: https://lore.kernel.org/r/20250808053609.3237836-1-zhengqixing@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-sysfs.c | 12 +++++-------
+ block/blk.h | 1 +
+ block/genhd.c | 2 ++
+ 3 files changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
+index c611444480b3..de39746de18b 100644
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -821,7 +821,7 @@ static void blk_queue_release(struct kobject *kobj)
+ /* nothing to do here, all data is associated with the parent gendisk */
+ }
+
+-static const struct kobj_type blk_queue_ktype = {
++const struct kobj_type blk_queue_ktype = {
+ .default_groups = blk_queue_attr_groups,
+ .sysfs_ops = &queue_sysfs_ops,
+ .release = blk_queue_release,
+@@ -849,15 +849,14 @@ int blk_register_queue(struct gendisk *disk)
+ struct request_queue *q = disk->queue;
+ int ret;
+
+- kobject_init(&disk->queue_kobj, &blk_queue_ktype);
+ ret = kobject_add(&disk->queue_kobj, &disk_to_dev(disk)->kobj, "queue");
+ if (ret < 0)
+- goto out_put_queue_kobj;
++ return ret;
+
+ if (queue_is_mq(q)) {
+ ret = blk_mq_sysfs_register(disk);
+ if (ret)
+- goto out_put_queue_kobj;
++ goto out_del_queue_kobj;
+ }
+ mutex_lock(&q->sysfs_lock);
+
+@@ -908,8 +907,8 @@ int blk_register_queue(struct gendisk *disk)
+ mutex_unlock(&q->sysfs_lock);
+ if (queue_is_mq(q))
+ blk_mq_sysfs_unregister(disk);
+-out_put_queue_kobj:
+- kobject_put(&disk->queue_kobj);
++out_del_queue_kobj:
++ kobject_del(&disk->queue_kobj);
+ return ret;
+ }
+
+@@ -960,5 +959,4 @@ void blk_unregister_queue(struct gendisk *disk)
+ elevator_set_none(q);
+
+ blk_debugfs_remove(disk);
+- kobject_put(&disk->queue_kobj);
+ }
+diff --git a/block/blk.h b/block/blk.h
+index fae7653a941f..4746a7704856 100644
+--- a/block/blk.h
++++ b/block/blk.h
+@@ -19,6 +19,7 @@ struct elevator_type;
+ /* Max future timer expiry for timeouts */
+ #define BLK_MAX_TIMEOUT (5 * HZ)
+
++extern const struct kobj_type blk_queue_ktype;
+ extern struct dentry *blk_debugfs_root;
+
+ struct blk_flush_queue {
+diff --git a/block/genhd.c b/block/genhd.c
+index c26733f6324b..9bbc38d12792 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -1303,6 +1303,7 @@ static void disk_release(struct device *dev)
+ disk_free_zone_resources(disk);
+ xa_destroy(&disk->part_tbl);
+
++ kobject_put(&disk->queue_kobj);
+ disk->queue->disk = NULL;
+ blk_put_queue(disk->queue);
+
+@@ -1486,6 +1487,7 @@ struct gendisk *__alloc_disk_node(struct request_queue *q, int node_id,
+ INIT_LIST_HEAD(&disk->slave_bdevs);
+ #endif
+ mutex_init(&disk->rqos_state_mutex);
++ kobject_init(&disk->queue_kobj, &blk_queue_ktype);
+ return disk;
+
+ out_erase_part0:
+--
+2.50.1
+
--- /dev/null
+From a914b5c9240f384e22f606323af092d925ad65c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 08:34:04 +0100
+Subject: cifs: Fix collect_sample() to handle any iterator type
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit b63335fb3d32579c5ff0b7038b9cc23688fff528 ]
+
+collect_sample() is used to gather samples of the data in a Write op for
+analysis to try and determine if the compression algorithm is likely to
+achieve anything more quickly than actually running the compression
+algorithm.
+
+However, collect_sample() assumes that the data it is going to be sampling
+is stored in an ITER_XARRAY-type iterator (which it now should never be)
+and doesn't actually check that it is before accessing the underlying
+xarray directly.
+
+Fix this by replacing the code with a loop that just uses the standard
+iterator functions to sample every other 2KiB block, skipping the
+intervening ones. It's not quite the same as the previous algorithm as it
+doesn't necessarily align to the pages within an ordinary write from the
+pagecache.
+
+Note that the btrfs code from which this was derived samples the inode's
+pagecache directly rather than the iterator - but that doesn't necessarily
+work for network filesystems if O_DIRECT is in operation.
+
+Fixes: 94ae8c3fee94 ("smb: client: compress: LZ77 code improvements cleanup")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+cc: Enzo Matsumiya <ematsumiya@suse.de>
+cc: Shyam Prasad N <sprasad@microsoft.com>
+cc: Tom Talpey <tom@talpey.com>
+cc: linux-cifs@vger.kernel.org
+cc: linux-fsdevel@vger.kernel.org
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/compress.c | 71 ++++++++++++----------------------------
+ 1 file changed, 21 insertions(+), 50 deletions(-)
+
+diff --git a/fs/smb/client/compress.c b/fs/smb/client/compress.c
+index 766b4de13da7..db709f5cd2e1 100644
+--- a/fs/smb/client/compress.c
++++ b/fs/smb/client/compress.c
+@@ -155,58 +155,29 @@ static int cmp_bkt(const void *_a, const void *_b)
+ }
+
+ /*
+- * TODO:
+- * Support other iter types, if required.
+- * Only ITER_XARRAY is supported for now.
++ * Collect some 2K samples with 2K gaps between.
+ */
+-static int collect_sample(const struct iov_iter *iter, ssize_t max, u8 *sample)
++static int collect_sample(const struct iov_iter *source, ssize_t max, u8 *sample)
+ {
+- struct folio *folios[16], *folio;
+- unsigned int nr, i, j, npages;
+- loff_t start = iter->xarray_start + iter->iov_offset;
+- pgoff_t last, index = start / PAGE_SIZE;
+- size_t len, off, foff;
+- void *p;
+- int s = 0;
+-
+- last = (start + max - 1) / PAGE_SIZE;
+- do {
+- nr = xa_extract(iter->xarray, (void **)folios, index, last, ARRAY_SIZE(folios),
+- XA_PRESENT);
+- if (nr == 0)
+- return -EIO;
+-
+- for (i = 0; i < nr; i++) {
+- folio = folios[i];
+- npages = folio_nr_pages(folio);
+- foff = start - folio_pos(folio);
+- off = foff % PAGE_SIZE;
+-
+- for (j = foff / PAGE_SIZE; j < npages; j++) {
+- size_t len2;
+-
+- len = min_t(size_t, max, PAGE_SIZE - off);
+- len2 = min_t(size_t, len, SZ_2K);
+-
+- p = kmap_local_page(folio_page(folio, j));
+- memcpy(&sample[s], p, len2);
+- kunmap_local(p);
+-
+- s += len2;
+-
+- if (len2 < SZ_2K || s >= max - SZ_2K)
+- return s;
+-
+- max -= len;
+- if (max <= 0)
+- return s;
+-
+- start += len;
+- off = 0;
+- index++;
+- }
+- }
+- } while (nr == ARRAY_SIZE(folios));
++ struct iov_iter iter = *source;
++ size_t s = 0;
++
++ while (iov_iter_count(&iter) >= SZ_2K) {
++ size_t part = umin(umin(iov_iter_count(&iter), SZ_2K), max);
++ size_t n;
++
++ n = copy_from_iter(sample + s, part, &iter);
++ if (n != part)
++ return -EFAULT;
++
++ s += n;
++ max -= n;
++
++ if (iov_iter_count(&iter) < PAGE_SIZE - SZ_2K)
++ break;
++
++ iov_iter_advance(&iter, SZ_2K);
++ }
+
+ return s;
+ }
+--
+2.50.1
+
--- /dev/null
+From a4b043da1f18f31195ea7c0f25e87b0ac2b86d48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 15:20:55 +0800
+Subject: drm/amdgpu: fix incorrect vm flags to map bo
+
+From: Jack Xiao <Jack.Xiao@amd.com>
+
+[ Upstream commit 040bc6d0e0e9c814c9c663f6f1544ebaff6824a8 ]
+
+It should use vm flags instead of pte flags
+to specify bo vm attributes.
+
+Fixes: 7946340fa389 ("drm/amdgpu: Move csa related code to separate file")
+Signed-off-by: Jack Xiao <Jack.Xiao@amd.com>
+Reviewed-by: Likun Gao <Likun.Gao@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit b08425fa77ad2f305fe57a33dceb456be03b653f)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
+index 02138aa55793..dfb6cfd83760 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
+@@ -88,8 +88,8 @@ int amdgpu_map_static_csa(struct amdgpu_device *adev, struct amdgpu_vm *vm,
+ }
+
+ r = amdgpu_vm_bo_map(adev, *bo_va, csa_addr, 0, size,
+- AMDGPU_PTE_READABLE | AMDGPU_PTE_WRITEABLE |
+- AMDGPU_PTE_EXECUTABLE);
++ AMDGPU_VM_PAGE_READABLE | AMDGPU_VM_PAGE_WRITEABLE |
++ AMDGPU_VM_PAGE_EXECUTABLE);
+
+ if (r) {
+ DRM_ERROR("failed to do bo_map on static CSA, err=%d\n", r);
+--
+2.50.1
+
--- /dev/null
+From ddf1e44fdd027dec482a0d7cfee4125c1b075942 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 09:17:58 +0800
+Subject: drm/amdgpu: fix vram reservation issue
+
+From: YiPeng Chai <YiPeng.Chai@amd.com>
+
+[ Upstream commit 10ef476aad1c848449934e7bec2ab2374333c7b6 ]
+
+The vram block allocation flag must be cleared
+before making vram reservation, otherwise reserving
+addresses within the currently freed memory range
+will always fail.
+
+Fixes: c9cad937c0c5 ("drm/amdgpu: add drm buddy support to amdgpu")
+Signed-off-by: YiPeng Chai <YiPeng.Chai@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit d38eaf27de1b8584f42d6fb3f717b7ec44b3a7a1)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
+index 07c936e90d8e..78f9e86ccc09 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
+@@ -648,9 +648,8 @@ static void amdgpu_vram_mgr_del(struct ttm_resource_manager *man,
+ list_for_each_entry(block, &vres->blocks, link)
+ vis_usage += amdgpu_vram_mgr_vis_size(adev, block);
+
+- amdgpu_vram_mgr_do_reserve(man);
+-
+ drm_buddy_free_list(mm, &vres->blocks, vres->flags);
++ amdgpu_vram_mgr_do_reserve(man);
+ mutex_unlock(&mgr->lock);
+
+ atomic64_sub(vis_usage, &mgr->vis_usage);
+--
+2.50.1
+
--- /dev/null
+From 3d78c1cf060b8733f70a92bdc7ee6233c3fe5410 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 15:46:48 +0300
+Subject: drm/i915/fbc: fix the implementation of wa_18038517565
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vinod Govindapillai <vinod.govindapillai@intel.com>
+
+[ Upstream commit fd56b9c9507f32b16159f9a922e1af5628254567 ]
+
+As per the wa_18038517565, we need to disable FBC compressor
+clock gating before enabling FBC and enable after disabling
+FBC. Placing the enabling of clock gating in the fbc deactivate
+function can make the above wa logic go wrong in case of
+frontbuffer rendering FBC mechanism. FBC deactivate can get
+called during fb invalidate and then the corresponding FBC
+activate can get called without properly disabling the clock
+gating and can result in compression stalled. So move the
+enable clock gating at the end of one FBC session after FBC
+is completely disabled for a pipe.
+
+Bspec: 74212, 72197, 69741, 65555
+Fixes: 010363c46189 ("drm/i915/display: implement wa_18038517565")
+Signed-off-by: Vinod Govindapillai <vinod.govindapillai@intel.com>
+Reviewed-by: Jouni Högander <jouni.hogander@intel.com>
+Link: https://lore.kernel.org/r/20250729124648.288497-1-vinod.govindapillai@intel.com
+(cherry picked from commit 82dde0407ab126f8413fd6c51429e5057ced5ba2)
+Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/display/intel_fbc.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/display/intel_fbc.c b/drivers/gpu/drm/i915/display/intel_fbc.c
+index bed2bba20b55..6ddbc682ec1c 100644
+--- a/drivers/gpu/drm/i915/display/intel_fbc.c
++++ b/drivers/gpu/drm/i915/display/intel_fbc.c
+@@ -550,10 +550,6 @@ static void ilk_fbc_deactivate(struct intel_fbc *fbc)
+ if (dpfc_ctl & DPFC_CTL_EN) {
+ dpfc_ctl &= ~DPFC_CTL_EN;
+ intel_de_write(display, ILK_DPFC_CONTROL(fbc->id), dpfc_ctl);
+-
+- /* wa_18038517565 Enable DPFC clock gating after FBC disable */
+- if (display->platform.dg2 || DISPLAY_VER(display) >= 14)
+- fbc_compressor_clkgate_disable_wa(fbc, false);
+ }
+ }
+
+@@ -1708,6 +1704,10 @@ static void __intel_fbc_disable(struct intel_fbc *fbc)
+
+ __intel_fbc_cleanup_cfb(fbc);
+
++ /* wa_18038517565 Enable DPFC clock gating after FBC disable */
++ if (display->platform.dg2 || DISPLAY_VER(display) >= 14)
++ fbc_compressor_clkgate_disable_wa(fbc, false);
++
+ fbc->state.plane = NULL;
+ fbc->flip_pending = false;
+ fbc->busy_bits = 0;
+--
+2.50.1
+
--- /dev/null
+From 318736ea23e7e4960963f489425fc75cd6e2f38b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Aug 2025 09:29:05 +0300
+Subject: drm/i915/psr: Do not trigger Frame Change events from frontbuffer
+ flush
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jouni Högander <jouni.hogander@intel.com>
+
+[ Upstream commit 184889dfe0568528fd6d14bba864dd57ed45bbf2 ]
+
+We want to get rid of triggering "Frame Change" events from
+frontbuffer flush calls. We are about to move using TRANS_PUSH
+register for this on LunarLake and onwards. Touching TRANS_PUSH
+register from fronbuffer flush would be problematic as it's written by
+DSB as well.
+
+Fix this by using intel_psr_exit when flush or invalidate is done on
+LunarLake and onwards. This is not possible on AlderLake and
+MeteorLake due to HW bug in PSR2 disable.
+
+This patch is also fixing problems with cursor plane where cursor is
+disappearing or duplicate cursor is seen on the screen.
+
+v2: Commit message updated
+
+Bspec: 68927, 68934, 66624
+Reported-by: Janna Martl <janna.martl109@gmail.com>
+Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/5522
+Fixes: 411ad63877bb ("drm/i915/psr: Use SFF_CTL on invalidate/flush for LunarLake onwards")
+Tested-by: Janna Martl <janna.martl109@gmail.com>
+Signed-off-by: Jouni Högander <jouni.hogander@intel.com>
+Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com>
+Link: https://lore.kernel.org/r/20250801062905.564453-1-jouni.hogander@intel.com
+(cherry picked from commit 46fb38cb20c0d185a6391ab524b23e0e0219c41f)
+Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/display/intel_psr.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/display/intel_psr.c b/drivers/gpu/drm/i915/display/intel_psr.c
+index 430ad4ef7146..7da0ad854ed2 100644
+--- a/drivers/gpu/drm/i915/display/intel_psr.c
++++ b/drivers/gpu/drm/i915/display/intel_psr.c
+@@ -3250,7 +3250,9 @@ static void intel_psr_configure_full_frame_update(struct intel_dp *intel_dp)
+
+ static void _psr_invalidate_handle(struct intel_dp *intel_dp)
+ {
+- if (intel_dp->psr.psr2_sel_fetch_enabled) {
++ struct intel_display *display = to_intel_display(intel_dp);
++
++ if (DISPLAY_VER(display) < 20 && intel_dp->psr.psr2_sel_fetch_enabled) {
+ if (!intel_dp->psr.psr2_sel_fetch_cff_enabled) {
+ intel_dp->psr.psr2_sel_fetch_cff_enabled = true;
+ intel_psr_configure_full_frame_update(intel_dp);
+@@ -3338,7 +3340,7 @@ static void _psr_flush_handle(struct intel_dp *intel_dp)
+ struct intel_display *display = to_intel_display(intel_dp);
+ struct drm_i915_private *dev_priv = to_i915(display->drm);
+
+- if (intel_dp->psr.psr2_sel_fetch_enabled) {
++ if (DISPLAY_VER(display) < 20 && intel_dp->psr.psr2_sel_fetch_enabled) {
+ if (intel_dp->psr.psr2_sel_fetch_cff_enabled) {
+ /* can we turn CFF off? */
+ if (intel_dp->psr.busy_frontbuffer_bits == 0)
+@@ -3355,11 +3357,13 @@ static void _psr_flush_handle(struct intel_dp *intel_dp)
+ * existing SU configuration
+ */
+ intel_psr_configure_full_frame_update(intel_dp);
+- }
+
+- intel_psr_force_update(intel_dp);
++ intel_psr_force_update(intel_dp);
++ } else {
++ intel_psr_exit(intel_dp);
++ }
+
+- if (!intel_dp->psr.psr2_sel_fetch_enabled && !intel_dp->psr.active &&
++ if ((!intel_dp->psr.psr2_sel_fetch_enabled || DISPLAY_VER(display) >= 20) &&
+ !intel_dp->psr.busy_frontbuffer_bits)
+ queue_work(dev_priv->unordered_wq, &intel_dp->psr.work);
+ }
+--
+2.50.1
+
--- /dev/null
+From ae67a1547226e56102c8ee3b55a86e33f032e21c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Aug 2025 00:23:10 +0530
+Subject: drm/xe/hwmon: Add SW clamp for power limits writes
+
+From: Karthik Poosa <karthik.poosa@intel.com>
+
+[ Upstream commit 55d49f06162e45686399df4ae6292167f0deab7c ]
+
+Clamp writes to power limits powerX_crit/currX_crit, powerX_cap,
+powerX_max, to the maximum supported by the pcode mailbox
+when sysfs-provided values exceed this limit.
+Although the pcode already performs clamping, values beyond the pcode
+mailbox's supported range get truncated, leading to incorrect
+critical power settings.
+This patch ensures proper clamping to prevent such truncation.
+
+v2:
+ - Address below review comments. (Riana)
+ - Split comments into multiple sentences.
+ - Use local variables for readability.
+ - Add a debug log.
+ - Use u64 instead of unsigned long.
+
+v3:
+ - Change drm_dbg logs to drm_info. (Badal)
+
+v4:
+ - Rephrase the drm_info log. (Rodrigo, Riana)
+ - Rename variable max_mbx_power_limit to max_supp_power_limit, as
+ limit is same for platforms with and without mailbox power limit
+ support.
+
+Signed-off-by: Karthik Poosa <karthik.poosa@intel.com>
+Fixes: 92d44a422d0d ("drm/xe/hwmon: Expose card reactive critical power")
+Fixes: fb1b70607f73 ("drm/xe/hwmon: Expose power attributes")
+Reviewed-by: Riana Tauro <riana.tauro@intel.com>
+Link: https://lore.kernel.org/r/20250808185310.3466529-1-karthik.poosa@intel.com
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+(cherry picked from commit d301eb950da59f962bafe874cf5eb6d61a85b2c2)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_hwmon.c | 29 +++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/xe_hwmon.c b/drivers/gpu/drm/xe/xe_hwmon.c
+index f008e8049700..be2948dfc8b3 100644
+--- a/drivers/gpu/drm/xe/xe_hwmon.c
++++ b/drivers/gpu/drm/xe/xe_hwmon.c
+@@ -329,6 +329,7 @@ static int xe_hwmon_power_max_write(struct xe_hwmon *hwmon, u32 attr, int channe
+ int ret = 0;
+ u32 reg_val;
+ struct xe_reg rapl_limit;
++ u64 max_supp_power_limit = 0;
+
+ mutex_lock(&hwmon->hwmon_lock);
+
+@@ -353,6 +354,20 @@ static int xe_hwmon_power_max_write(struct xe_hwmon *hwmon, u32 attr, int channe
+ goto unlock;
+ }
+
++ /*
++ * If the sysfs value exceeds the maximum pcode supported power limit value, clamp it to
++ * the supported maximum (U12.3 format).
++ * This is to avoid truncation during reg_val calculation below and ensure the valid
++ * power limit is sent for pcode which would clamp it to card-supported value.
++ */
++ max_supp_power_limit = ((PWR_LIM_VAL) >> hwmon->scl_shift_power) * SF_POWER;
++ if (value > max_supp_power_limit) {
++ value = max_supp_power_limit;
++ drm_info(&hwmon->xe->drm,
++ "Power limit clamped as selected %s exceeds channel %d limit\n",
++ PWR_ATTR_TO_STR(attr), channel);
++ }
++
+ /* Computation in 64-bits to avoid overflow. Round to nearest. */
+ reg_val = DIV_ROUND_CLOSEST_ULL((u64)value << hwmon->scl_shift_power, SF_POWER);
+ reg_val = PWR_LIM_EN | REG_FIELD_PREP(PWR_LIM_VAL, reg_val);
+@@ -697,9 +712,23 @@ static int xe_hwmon_power_curr_crit_write(struct xe_hwmon *hwmon, int channel,
+ {
+ int ret;
+ u32 uval;
++ u64 max_crit_power_curr = 0;
+
+ mutex_lock(&hwmon->hwmon_lock);
+
++ /*
++ * If the sysfs value exceeds the pcode mailbox cmd POWER_SETUP_SUBCOMMAND_WRITE_I1
++ * max supported value, clamp it to the command's max (U10.6 format).
++ * This is to avoid truncation during uval calculation below and ensure the valid power
++ * limit is sent for pcode which would clamp it to card-supported value.
++ */
++ max_crit_power_curr = (POWER_SETUP_I1_DATA_MASK >> POWER_SETUP_I1_SHIFT) * scale_factor;
++ if (value > max_crit_power_curr) {
++ value = max_crit_power_curr;
++ drm_info(&hwmon->xe->drm,
++ "Power limit clamped as selected exceeds channel %d limit\n",
++ channel);
++ }
+ uval = DIV_ROUND_CLOSEST_ULL(value << POWER_SETUP_I1_SHIFT, scale_factor);
+ ret = xe_hwmon_pcode_write_i1(hwmon, uval);
+
+--
+2.50.1
+
--- /dev/null
+From fc9b75911a7b9c1551614498137147a862a8bc81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 10:38:10 +0100
+Subject: drm/xe/migrate: don't overflow max copy size
+
+From: Matthew Auld <matthew.auld@intel.com>
+
+[ Upstream commit 4126cb327a2e3273c81fcef1c594c5b7b645c44c ]
+
+With non-page aligned copy, we need to use 4 byte aligned pitch, however
+the size itself might still be close to our maximum of ~8M, and so the
+dimensions of the copy can easily exceed the S16_MAX limit of the copy
+command leading to the following assert:
+
+xe 0000:03:00.0: [drm] Assertion `size / pitch <= ((s16)(((u16)~0U) >> 1))` failed!
+platform: BATTLEMAGE subplatform: 1
+graphics: Xe2_HPG 20.01 step A0
+media: Xe2_HPM 13.01 step A1
+tile: 0 VRAM 10.0 GiB
+GT: 0 type 1
+
+WARNING: CPU: 23 PID: 10605 at drivers/gpu/drm/xe/xe_migrate.c:673 emit_copy+0x4b5/0x4e0 [xe]
+
+To fix this account for the pitch when calculating the number of current
+bytes to copy.
+
+Fixes: 270172f64b11 ("drm/xe: Update xe_ttm_access_memory to use GPU for non-visible access")
+Signed-off-by: Matthew Auld <matthew.auld@intel.com>
+Cc: Maciej Patelczyk <maciej.patelczyk@intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Stuart Summers <stuart.summers@intel.com>
+Link: https://lore.kernel.org/r/20250731093807.207572-7-matthew.auld@intel.com
+(cherry picked from commit 8c2d61e0e916e077fda7e7b8e67f25ffe0f361fc)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_migrate.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/xe_migrate.c b/drivers/gpu/drm/xe/xe_migrate.c
+index c0e2656a14d2..02c0a4a7372c 100644
+--- a/drivers/gpu/drm/xe/xe_migrate.c
++++ b/drivers/gpu/drm/xe/xe_migrate.c
+@@ -1887,6 +1887,12 @@ int xe_migrate_access_memory(struct xe_migrate *m, struct xe_bo *bo,
+ else
+ current_bytes = min_t(int, bytes_left, cursor.size);
+
++ if (current_bytes & ~PAGE_MASK) {
++ int pitch = 4;
++
++ current_bytes = min_t(int, current_bytes, S16_MAX * pitch);
++ }
++
+ if (fence)
+ dma_fence_put(fence);
+
+--
+2.50.1
+
--- /dev/null
+From 8feae911fab38c015e1af56c39aac822b149e73f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 10:38:09 +0100
+Subject: drm/xe/migrate: prevent infinite recursion
+
+From: Matthew Auld <matthew.auld@intel.com>
+
+[ Upstream commit 9d7a1cbebbb691891671def57407ba2f8ee914e8 ]
+
+If the buf + offset is not aligned to XE_CAHELINE_BYTES we fallback to
+using a bounce buffer. However the bounce buffer here is allocated on
+the stack, and the only alignment requirement here is that it's
+naturally aligned to u8, and not XE_CACHELINE_BYTES. If the bounce
+buffer is also misaligned we then recurse back into the function again,
+however the new bounce buffer might also not be aligned, and might never
+be until we eventually blow through the stack, as we keep recursing.
+
+Instead of using the stack use kmalloc, which should respect the
+power-of-two alignment request here. Fixes a kernel panic when
+triggering this path through eudebug.
+
+v2 (Stuart):
+ - Add build bug check for power-of-two restriction
+ - s/EINVAL/ENOMEM/
+
+Fixes: 270172f64b11 ("drm/xe: Update xe_ttm_access_memory to use GPU for non-visible access")
+Signed-off-by: Matthew Auld <matthew.auld@intel.com>
+Cc: Maciej Patelczyk <maciej.patelczyk@intel.com>
+Cc: Stuart Summers <stuart.summers@intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Stuart Summers <stuart.summers@intel.com>
+Link: https://lore.kernel.org/r/20250731093807.207572-6-matthew.auld@intel.com
+(cherry picked from commit 38b34e928a08ba594c4bbf7118aa3aadacd62fff)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_migrate.c | 29 +++++++++++++++++------------
+ 1 file changed, 17 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_migrate.c b/drivers/gpu/drm/xe/xe_migrate.c
+index 07a5161c7d5b..c0e2656a14d2 100644
+--- a/drivers/gpu/drm/xe/xe_migrate.c
++++ b/drivers/gpu/drm/xe/xe_migrate.c
+@@ -1820,15 +1820,19 @@ int xe_migrate_access_memory(struct xe_migrate *m, struct xe_bo *bo,
+ if (!IS_ALIGNED(len, XE_CACHELINE_BYTES) ||
+ !IS_ALIGNED((unsigned long)buf + offset, XE_CACHELINE_BYTES)) {
+ int buf_offset = 0;
++ void *bounce;
++ int err;
++
++ BUILD_BUG_ON(!is_power_of_2(XE_CACHELINE_BYTES));
++ bounce = kmalloc(XE_CACHELINE_BYTES, GFP_KERNEL);
++ if (!bounce)
++ return -ENOMEM;
+
+ /*
+ * Less than ideal for large unaligned access but this should be
+ * fairly rare, can fixup if this becomes common.
+ */
+ do {
+- u8 bounce[XE_CACHELINE_BYTES];
+- void *ptr = (void *)bounce;
+- int err;
+ int copy_bytes = min_t(int, bytes_left,
+ XE_CACHELINE_BYTES -
+ (offset & XE_CACHELINE_MASK));
+@@ -1837,22 +1841,22 @@ int xe_migrate_access_memory(struct xe_migrate *m, struct xe_bo *bo,
+ err = xe_migrate_access_memory(m, bo,
+ offset &
+ ~XE_CACHELINE_MASK,
+- (void *)ptr,
+- sizeof(bounce), 0);
++ bounce,
++ XE_CACHELINE_BYTES, 0);
+ if (err)
+- return err;
++ break;
+
+ if (write) {
+- memcpy(ptr + ptr_offset, buf + buf_offset, copy_bytes);
++ memcpy(bounce + ptr_offset, buf + buf_offset, copy_bytes);
+
+ err = xe_migrate_access_memory(m, bo,
+ offset & ~XE_CACHELINE_MASK,
+- (void *)ptr,
+- sizeof(bounce), write);
++ bounce,
++ XE_CACHELINE_BYTES, write);
+ if (err)
+- return err;
++ break;
+ } else {
+- memcpy(buf + buf_offset, ptr + ptr_offset,
++ memcpy(buf + buf_offset, bounce + ptr_offset,
+ copy_bytes);
+ }
+
+@@ -1861,7 +1865,8 @@ int xe_migrate_access_memory(struct xe_migrate *m, struct xe_bo *bo,
+ offset += copy_bytes;
+ } while (bytes_left);
+
+- return 0;
++ kfree(bounce);
++ return err;
+ }
+
+ dma_addr = xe_migrate_dma_map(xe, buf, len + page_offset, write);
+--
+2.50.1
+
--- /dev/null
+From 58d365955ad4a06c65b180f665cb71761f5b1ad2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 10:38:11 +0100
+Subject: drm/xe/migrate: prevent potential UAF
+
+From: Matthew Auld <matthew.auld@intel.com>
+
+[ Upstream commit 145832fbdd17b1d77ffd6cdd1642259e101d1b7e ]
+
+If we hit the error path, the previous fence (if there is one) has
+already been put() prior to this, so doing a fence_wait could lead to
+UAF. Tweak the flow to do to the put() until after we do the wait.
+
+Fixes: 270172f64b11 ("drm/xe: Update xe_ttm_access_memory to use GPU for non-visible access")
+Signed-off-by: Matthew Auld <matthew.auld@intel.com>
+Cc: Maciej Patelczyk <maciej.patelczyk@intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Stuart Summers <stuart.summers@intel.com>
+Link: https://lore.kernel.org/r/20250731093807.207572-8-matthew.auld@intel.com
+(cherry picked from commit 9b7ca35ed28fe5fad86e9d9c24ebd1271e4c9c3e)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_migrate.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_migrate.c b/drivers/gpu/drm/xe/xe_migrate.c
+index 02c0a4a7372c..1e3fd139dfcb 100644
+--- a/drivers/gpu/drm/xe/xe_migrate.c
++++ b/drivers/gpu/drm/xe/xe_migrate.c
+@@ -1893,9 +1893,6 @@ int xe_migrate_access_memory(struct xe_migrate *m, struct xe_bo *bo,
+ current_bytes = min_t(int, current_bytes, S16_MAX * pitch);
+ }
+
+- if (fence)
+- dma_fence_put(fence);
+-
+ __fence = xe_migrate_vram(m, current_bytes,
+ (unsigned long)buf & ~PAGE_MASK,
+ dma_addr + current_page,
+@@ -1903,11 +1900,15 @@ int xe_migrate_access_memory(struct xe_migrate *m, struct xe_bo *bo,
+ XE_MIGRATE_COPY_TO_VRAM :
+ XE_MIGRATE_COPY_TO_SRAM);
+ if (IS_ERR(__fence)) {
+- if (fence)
++ if (fence) {
+ dma_fence_wait(fence, false);
++ dma_fence_put(fence);
++ }
+ fence = __fence;
+ goto out_err;
+ }
++
++ dma_fence_put(fence);
+ fence = __fence;
+
+ buf += current_bytes;
+--
+2.50.1
+
--- /dev/null
+From fbfc3618e5418680bae1254c11cbc5b24c84a99d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Aug 2025 18:52:02 +0000
+Subject: scsi: lpfc: Remove redundant assignment to avoid memory leak
+
+From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+
+[ Upstream commit eea6cafb5890db488fce1c69d05464214616d800 ]
+
+Remove the redundant assignment if kzalloc() succeeds to avoid memory
+leak.
+
+Fixes: bd2cdd5e400f ("scsi: lpfc: NVME Initiator: Add debugfs support")
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Link: https://lore.kernel.org/r/20250801185202.42631-1-jiashengjiangcool@gmail.com
+Reviewed-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_debugfs.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
+index 3fd1aa5cc78c..1b601e45bc45 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.c
++++ b/drivers/scsi/lpfc/lpfc_debugfs.c
+@@ -6289,7 +6289,6 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
+ }
+ phba->nvmeio_trc_on = 1;
+ phba->nvmeio_trc_output_idx = 0;
+- phba->nvmeio_trc = NULL;
+ } else {
+ nvmeio_off:
+ phba->nvmeio_trc_size = 0;
+--
+2.50.1
+
--- /dev/null
+From 26befda42bd0f7ef847871c6c83aef382d05b4de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 04:27:11 +0530
+Subject: scsi: ufs: core: Fix interrupt handling for MCQ Mode
+
+From: Nitin Rawat <quic_nitirawa@quicinc.com>
+
+[ Upstream commit 034d319c8899e8c5c0a35c6692c7fc7e8c12c374 ]
+
+Commit 3c7ac40d7322 ("scsi: ufs: core: Delegate the interrupt service
+routine to a threaded IRQ handler") introduced a regression where the UFS
+interrupt status register (IS) was not cleared in ufshcd_intr() when
+operating in MCQ mode. As a result, the IS register remained uncleared.
+
+This led to a persistent issue during UIC interrupts:
+ufshcd_is_auto_hibern8_error() consistently returned true because the
+UFSHCD_UIC_HIBERN8_MASK bit was set, while the active command was neither
+UIC_CMD_DME_HIBER_ENTER nor UIC_CMD_DME_HIBER_EXIT. This caused
+continuous auto hibern8 enter errors and device failed to boot.
+
+To fix this, ensure that the interrupt status register is properly
+cleared in the ufshcd_intr() function for both MCQ mode with ESI enabled.
+
+[ 4.553226] ufshcd-qcom 1d84000.ufs: ufshcd_check_errors: Auto
+Hibern8 Enter failed - status: 0x00000040, upmcrs: 0x00000001
+[ 4.553229] ufshcd-qcom 1d84000.ufs: ufshcd_check_errors: saved_err
+0x40 saved_uic_err 0x0
+[ 4.553311] host_regs: 00000000: d5c7033f 20e0071f 00000400 00000000
+[ 4.553312] host_regs: 00000010: 01000000 00010217 00000c96 00000000
+[ 4.553314] host_regs: 00000020: 00000440 00170ef5 00000000 00000000
+[ 4.553316] host_regs: 00000030: 0000010f 00000001 00000000 00000000
+[ 4.553317] host_regs: 00000040: 00000000 00000000 00000000 00000000
+[ 4.553319] host_regs: 00000050: fffdf000 0000000f 00000000 00000000
+[ 4.553320] host_regs: 00000060: 00000001 80000000 00000000 00000000
+[ 4.553322] host_regs: 00000070: fffde000 0000000f 00000000 00000000
+[ 4.553323] host_regs: 00000080: 00000001 00000000 00000000 00000000
+[ 4.553325] host_regs: 00000090: 00000002 d0020000 00000000 01930200
+
+Fixes: 3c7ac40d7322 ("scsi: ufs: core: Delegate the interrupt service routine to a threaded IRQ handler")
+Co-developed-by: Palash Kambar <quic_pkambar@quicinc.com>
+Signed-off-by: Palash Kambar <quic_pkambar@quicinc.com>
+Signed-off-by: Nitin Rawat <quic_nitirawa@quicinc.com>
+Link: https://lore.kernel.org/r/20250728225711.29273-1-quic_nitirawa@quicinc.com
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-QRD
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufshcd.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index f07878c50f14..3cc566e8bd1d 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -7110,14 +7110,19 @@ static irqreturn_t ufshcd_threaded_intr(int irq, void *__hba)
+ static irqreturn_t ufshcd_intr(int irq, void *__hba)
+ {
+ struct ufs_hba *hba = __hba;
++ u32 intr_status, enabled_intr_status;
+
+ /* Move interrupt handling to thread when MCQ & ESI are not enabled */
+ if (!hba->mcq_enabled || !hba->mcq_esi_enabled)
+ return IRQ_WAKE_THREAD;
+
++ intr_status = ufshcd_readl(hba, REG_INTERRUPT_STATUS);
++ enabled_intr_status = intr_status & ufshcd_readl(hba, REG_INTERRUPT_ENABLE);
++
++ ufshcd_writel(hba, intr_status, REG_INTERRUPT_STATUS);
++
+ /* Directly handle interrupts since MCQ ESI handlers does the hard job */
+- return ufshcd_sl_intr(hba, ufshcd_readl(hba, REG_INTERRUPT_STATUS) &
+- ufshcd_readl(hba, REG_INTERRUPT_ENABLE));
++ return ufshcd_sl_intr(hba, enabled_intr_status);
+ }
+
+ static int ufshcd_clear_tm_cmd(struct ufs_hba *hba, int tag)
+--
+2.50.1
+
pnfs-handle-rpc-size-limit-for-layoutcommits.patch
pnfs-fix-uninited-ptr-deref-in-block-scsi-layout.patch
rtc-ds1307-remove-clear-of-oscillator-stop-flag-osf-.patch
+scsi-ufs-core-fix-interrupt-handling-for-mcq-mode.patch
+scsi-lpfc-remove-redundant-assignment-to-avoid-memor.patch
+asoc-fsl_sai-replace-regmap_write-with-regmap_update.patch
+ublk-check-for-unprivileged-daemon-on-each-i-o-fetch.patch
+block-fix-kobject-double-initialization-in-add_disk.patch
+cifs-fix-collect_sample-to-handle-any-iterator-type.patch
+drm-i915-fbc-fix-the-implementation-of-wa_1803851756.patch
+drm-i915-psr-do-not-trigger-frame-change-events-from.patch
+drm-xe-migrate-prevent-infinite-recursion.patch
+drm-xe-migrate-don-t-overflow-max-copy-size.patch
+drm-xe-migrate-prevent-potential-uaf.patch
+drm-xe-hwmon-add-sw-clamp-for-power-limits-writes.patch
+drm-amdgpu-fix-vram-reservation-issue.patch
+drm-amdgpu-fix-incorrect-vm-flags-to-map-bo.patch
+x86-sev-improve-handling-of-writes-to-intercepted-ts.patch
--- /dev/null
+From 7a0fbe3c5387cc958127cca3c65f252f744e99db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 09:52:15 -0600
+Subject: ublk: check for unprivileged daemon on each I/O fetch
+
+From: Caleb Sander Mateos <csander@purestorage.com>
+
+[ Upstream commit 5058a62875e1916e5133a1639f0207ea2148c0bc ]
+
+Commit ab03a61c6614 ("ublk: have a per-io daemon instead of a per-queue
+daemon") allowed each ublk I/O to have an independent daemon task.
+However, nr_privileged_daemon is only computed based on whether the last
+I/O fetched in each ublk queue has an unprivileged daemon task.
+Fix this by checking whether every fetched I/O's daemon is privileged.
+Change nr_privileged_daemon from a count of queues to a boolean
+indicating whether any I/Os have an unprivileged daemon.
+
+Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
+Fixes: ab03a61c6614 ("ublk: have a per-io daemon instead of a per-queue daemon")
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20250808155216.296170-1-csander@purestorage.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/ublk_drv.c | 16 +++++++---------
+ 1 file changed, 7 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
+index 3e60558bf525..dabb468fa0b9 100644
+--- a/drivers/block/ublk_drv.c
++++ b/drivers/block/ublk_drv.c
+@@ -215,7 +215,7 @@ struct ublk_device {
+
+ struct completion completion;
+ unsigned int nr_queues_ready;
+- unsigned int nr_privileged_daemon;
++ bool unprivileged_daemons;
+ struct mutex cancel_mutex;
+ bool canceling;
+ pid_t ublksrv_tgid;
+@@ -1532,7 +1532,7 @@ static void ublk_reset_ch_dev(struct ublk_device *ub)
+ /* set to NULL, otherwise new tasks cannot mmap io_cmd_buf */
+ ub->mm = NULL;
+ ub->nr_queues_ready = 0;
+- ub->nr_privileged_daemon = 0;
++ ub->unprivileged_daemons = false;
+ ub->ublksrv_tgid = -1;
+ }
+
+@@ -1945,12 +1945,10 @@ static void ublk_mark_io_ready(struct ublk_device *ub, struct ublk_queue *ubq)
+ __must_hold(&ub->mutex)
+ {
+ ubq->nr_io_ready++;
+- if (ublk_queue_ready(ubq)) {
++ if (ublk_queue_ready(ubq))
+ ub->nr_queues_ready++;
+-
+- if (capable(CAP_SYS_ADMIN))
+- ub->nr_privileged_daemon++;
+- }
++ if (!ub->unprivileged_daemons && !capable(CAP_SYS_ADMIN))
++ ub->unprivileged_daemons = true;
+
+ if (ub->nr_queues_ready == ub->dev_info.nr_hw_queues) {
+ /* now we are ready for handling ublk io request */
+@@ -2759,8 +2757,8 @@ static int ublk_ctrl_start_dev(struct ublk_device *ub,
+
+ ublk_apply_params(ub);
+
+- /* don't probe partitions if any one ubq daemon is un-trusted */
+- if (ub->nr_privileged_daemon != ub->nr_queues_ready)
++ /* don't probe partitions if any daemon task is un-trusted */
++ if (ub->unprivileged_daemons)
+ set_bit(GD_SUPPRESS_PART_SCAN, &disk->state);
+
+ ublk_get_device(ub);
+--
+2.50.1
+
--- /dev/null
+From 7ee2dd9f433e66d2020fa0cb2f1b2c7fb06fd52e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jul 2025 13:18:53 +0530
+Subject: x86/sev: Improve handling of writes to intercepted TSC MSRs
+
+From: Nikunj A Dadhania <nikunj@amd.com>
+
+[ Upstream commit 5eb1bcdb6a8c088514019c3a9bda5d565beed1af ]
+
+Currently, when a Secure TSC enabled SNP guest attempts to write to the
+intercepted GUEST_TSC_FREQ MSR (a read-only MSR), the guest kernel response
+incorrectly implies a VMM configuration error, when in fact it is the usual
+VMM configuration to intercept writes to read-only MSRs, unless explicitly
+documented.
+
+Modify the intercepted TSC MSR #VC handling:
+* Write to GUEST_TSC_FREQ will generate a #GP instead of terminating the
+ guest
+* Write to MSR_IA32_TSC will generate a #GP instead of silently ignoring it
+
+However, continue to terminate the guest when reading from intercepted
+GUEST_TSC_FREQ MSR with Secure TSC enabled, as intercepted reads indicate an
+improper VMM configuration for Secure TSC enabled SNP guests.
+
+ [ bp: simplify comment. ]
+
+Fixes: 38cc6495cdec ("x86/sev: Prevent GUEST_TSC_FREQ MSR interception for Secure TSC enabled guests")
+Suggested-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Nikunj A Dadhania <nikunj@amd.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
+Link: https://lore.kernel.org/20250722074853.22253-1-nikunj@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/coco/sev/vc-handle.c | 31 ++++++++++++++++---------------
+ 1 file changed, 16 insertions(+), 15 deletions(-)
+
+diff --git a/arch/x86/coco/sev/vc-handle.c b/arch/x86/coco/sev/vc-handle.c
+index faf1fce89ed4..c3b4acbde0d8 100644
+--- a/arch/x86/coco/sev/vc-handle.c
++++ b/arch/x86/coco/sev/vc-handle.c
+@@ -371,29 +371,30 @@ static enum es_result __vc_handle_msr_caa(struct pt_regs *regs, bool write)
+ * executing with Secure TSC enabled, so special handling is required for
+ * accesses of MSR_IA32_TSC and MSR_AMD64_GUEST_TSC_FREQ.
+ */
+-static enum es_result __vc_handle_secure_tsc_msrs(struct pt_regs *regs, bool write)
++static enum es_result __vc_handle_secure_tsc_msrs(struct es_em_ctxt *ctxt, bool write)
+ {
++ struct pt_regs *regs = ctxt->regs;
+ u64 tsc;
+
+ /*
+- * GUEST_TSC_FREQ should not be intercepted when Secure TSC is enabled.
+- * Terminate the SNP guest when the interception is enabled.
++ * Writing to MSR_IA32_TSC can cause subsequent reads of the TSC to
++ * return undefined values, and GUEST_TSC_FREQ is read-only. Generate
++ * a #GP on all writes.
+ */
+- if (regs->cx == MSR_AMD64_GUEST_TSC_FREQ)
+- return ES_VMM_ERROR;
++ if (write) {
++ ctxt->fi.vector = X86_TRAP_GP;
++ ctxt->fi.error_code = 0;
++ return ES_EXCEPTION;
++ }
+
+ /*
+- * Writes: Writing to MSR_IA32_TSC can cause subsequent reads of the TSC
+- * to return undefined values, so ignore all writes.
+- *
+- * Reads: Reads of MSR_IA32_TSC should return the current TSC value, use
+- * the value returned by rdtsc_ordered().
++ * GUEST_TSC_FREQ read should not be intercepted when Secure TSC is
++ * enabled. Terminate the guest if a read is attempted.
+ */
+- if (write) {
+- WARN_ONCE(1, "TSC MSR writes are verboten!\n");
+- return ES_OK;
+- }
++ if (regs->cx == MSR_AMD64_GUEST_TSC_FREQ)
++ return ES_VMM_ERROR;
+
++ /* Reads of MSR_IA32_TSC should return the current TSC value. */
+ tsc = rdtsc_ordered();
+ regs->ax = lower_32_bits(tsc);
+ regs->dx = upper_32_bits(tsc);
+@@ -416,7 +417,7 @@ static enum es_result vc_handle_msr(struct ghcb *ghcb, struct es_em_ctxt *ctxt)
+ case MSR_IA32_TSC:
+ case MSR_AMD64_GUEST_TSC_FREQ:
+ if (sev_status & MSR_AMD64_SNP_SECURE_TSC)
+- return __vc_handle_secure_tsc_msrs(regs, write);
++ return __vc_handle_secure_tsc_msrs(ctxt, write);
+ break;
+ default:
+ break;
+--
+2.50.1
+
--- /dev/null
+From 78bf587cb7ef62dd962c68ba67d5bf28c607c19d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 10:03:18 +0800
+Subject: ASoC: fsl_sai: replace regmap_write with regmap_update_bits
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 0e270f32975fd21874185ba53653630dd40bf560 ]
+
+Use the regmap_write() for software reset in fsl_sai_config_disable would
+cause the FSL_SAI_CSR_BCE bit to be cleared. Refer to
+commit 197c53c8ecb34 ("ASoC: fsl_sai: Don't disable bitclock for i.MX8MP")
+FSL_SAI_CSR_BCE should not be cleared. So need to use regmap_update_bits()
+instead of regmap_write() for these bit operations.
+
+Fixes: dc78f7e59169d ("ASoC: fsl_sai: Force a software reset when starting in consumer mode")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://patch.msgid.link/20250807020318.2143219-1-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_sai.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c
+index 886f5c29939b..a6948a57636a 100644
+--- a/sound/soc/fsl/fsl_sai.c
++++ b/sound/soc/fsl/fsl_sai.c
+@@ -768,9 +768,9 @@ static void fsl_sai_config_disable(struct fsl_sai *sai, int dir)
+ * are running concurrently.
+ */
+ /* Software Reset */
+- regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
+ /* Clear SR bit to finish the reset */
+- regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR, 0);
+ }
+
+ static int fsl_sai_trigger(struct snd_pcm_substream *substream, int cmd,
+@@ -889,11 +889,11 @@ static int fsl_sai_dai_probe(struct snd_soc_dai *cpu_dai)
+ unsigned int ofs = sai->soc_data->reg_offset;
+
+ /* Software Reset for both Tx and Rx */
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
+ /* Clear SR bit to finish the reset */
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), 0);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, 0);
+
+ regmap_update_bits(sai->regmap, FSL_SAI_TCR1(ofs),
+ FSL_SAI_CR1_RFW_MASK(sai->soc_data->fifo_depth),
+@@ -1710,11 +1710,11 @@ static int fsl_sai_runtime_resume(struct device *dev)
+
+ regcache_cache_only(sai->regmap, false);
+ regcache_mark_dirty(sai->regmap);
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, FSL_SAI_CSR_SR);
+ usleep_range(1000, 2000);
+- regmap_write(sai->regmap, FSL_SAI_TCSR(ofs), 0);
+- regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_TCSR(ofs), FSL_SAI_CSR_SR, 0);
++ regmap_update_bits(sai->regmap, FSL_SAI_RCSR(ofs), FSL_SAI_CSR_SR, 0);
+
+ ret = regcache_sync(sai->regmap);
+ if (ret)
+--
+2.50.1
+
--- /dev/null
+From 35b9a44f28cabaf86fa83b46b4c4da96352ce5ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 15:20:55 +0800
+Subject: drm/amdgpu: fix incorrect vm flags to map bo
+
+From: Jack Xiao <Jack.Xiao@amd.com>
+
+[ Upstream commit 040bc6d0e0e9c814c9c663f6f1544ebaff6824a8 ]
+
+It should use vm flags instead of pte flags
+to specify bo vm attributes.
+
+Fixes: 7946340fa389 ("drm/amdgpu: Move csa related code to separate file")
+Signed-off-by: Jack Xiao <Jack.Xiao@amd.com>
+Reviewed-by: Likun Gao <Likun.Gao@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit b08425fa77ad2f305fe57a33dceb456be03b653f)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
+index 720011019741..384834fbd590 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
+@@ -89,8 +89,8 @@ int amdgpu_map_static_csa(struct amdgpu_device *adev, struct amdgpu_vm *vm,
+ }
+
+ r = amdgpu_vm_bo_map(adev, *bo_va, csa_addr, 0, size,
+- AMDGPU_PTE_READABLE | AMDGPU_PTE_WRITEABLE |
+- AMDGPU_PTE_EXECUTABLE);
++ AMDGPU_VM_PAGE_READABLE | AMDGPU_VM_PAGE_WRITEABLE |
++ AMDGPU_VM_PAGE_EXECUTABLE);
+
+ if (r) {
+ DRM_ERROR("failed to do bo_map on static CSA, err=%d\n", r);
+--
+2.50.1
+
--- /dev/null
+From c9876cd4e15326f2f2492322b56ae5ab35520266 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Aug 2025 18:52:02 +0000
+Subject: scsi: lpfc: Remove redundant assignment to avoid memory leak
+
+From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+
+[ Upstream commit eea6cafb5890db488fce1c69d05464214616d800 ]
+
+Remove the redundant assignment if kzalloc() succeeds to avoid memory
+leak.
+
+Fixes: bd2cdd5e400f ("scsi: lpfc: NVME Initiator: Add debugfs support")
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Link: https://lore.kernel.org/r/20250801185202.42631-1-jiashengjiangcool@gmail.com
+Reviewed-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_debugfs.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
+index 20662b4f339e..6b6c964e8076 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.c
++++ b/drivers/scsi/lpfc/lpfc_debugfs.c
+@@ -6291,7 +6291,6 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
+ }
+ phba->nvmeio_trc_on = 1;
+ phba->nvmeio_trc_output_idx = 0;
+- phba->nvmeio_trc = NULL;
+ } else {
+ nvmeio_off:
+ phba->nvmeio_trc_size = 0;
+--
+2.50.1
+
pnfs-handle-rpc-size-limit-for-layoutcommits.patch
pnfs-fix-uninited-ptr-deref-in-block-scsi-layout.patch
rtc-ds1307-remove-clear-of-oscillator-stop-flag-osf-.patch
+scsi-lpfc-remove-redundant-assignment-to-avoid-memor.patch
+asoc-fsl_sai-replace-regmap_write-with-regmap_update.patch
+drm-amdgpu-fix-incorrect-vm-flags-to-map-bo.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
