--- /dev/null
+From b5c78d9b54478d5952bea7a429e4ce3b560d657c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2025 21:10:06 +0800
+Subject: pcmcia: Add error handling for add_interval() in do_validate_mem()
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+[ Upstream commit 4a81f78caa53e0633cf311ca1526377d9bff7479 ]
+
+In the do_validate_mem(), the call to add_interval() does not
+handle errors. If kmalloc() fails in add_interval(), it could
+result in a null pointer being inserted into the linked list,
+leading to illegal memory access when sub_interval() is called
+next.
+
+This patch adds an error handling for the add_interval(). If
+add_interval() returns an error, the function will return early
+with the error code.
+
+Fixes: 7b4884ca8853 ("pcmcia: validate late-added resources")
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pcmcia/rsrc_nonstatic.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c
+index 6e90927e65769..ab487edec2e5b 100644
+--- a/drivers/pcmcia/rsrc_nonstatic.c
++++ b/drivers/pcmcia/rsrc_nonstatic.c
+@@ -375,7 +375,9 @@ static int do_validate_mem(struct pcmcia_socket *s,
+
+ if (validate && !s->fake_cis) {
+ /* move it to the validated data set */
+- add_interval(&s_data->mem_db_valid, base, size);
++ ret = add_interval(&s_data->mem_db_valid, base, size);
++ if (ret)
++ return ret;
+ sub_interval(&s_data->mem_db, base, size);
+ }
+
+--
+2.51.0
+
net-phy-microchip-remove-the-use-of-.ack_interrupt.patch
net-phy-microchip-force-irq-polling-mode-for-lan88xx.patch
alsa-hda-hdmi-add-pin-fix-for-another-hp-elitedesk-800-g4-model.patch
+pcmcia-add-error-handling-for-add_interval-in-do_val.patch
+spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch
+spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch
+spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch
--- /dev/null
+From 81b7ff26c19055dafada090dcaf9fef12f159d42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:14:40 +0100
+Subject: spi: spi-fsl-lpspi: Fix transmissions when using CONT
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit 782a7c73078e1301c0c427f21c06377d77dfa541 ]
+
+Commit 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use
+CONT") breaks transmissions when CONT is used. The TDIE interrupt should
+not be disabled in all cases. If CONT is used and the TX transfer is not
+yet completed yet, but the interrupt handler is called because there are
+characters to be received, TDIE is replaced with FCIE. When the transfer
+is finally completed, SR_TDF is set but the interrupt handler isn't
+called again.
+
+Fixes: 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use CONT")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-1-6262b9aa9be4@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index bf3f600bdd2c8..7ece48667f52d 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -3,7 +3,7 @@
+ // Freescale i.MX7ULP LPSPI driver
+ //
+ // Copyright 2016 Freescale Semiconductor, Inc.
+-// Copyright 2018 NXP Semiconductors
++// Copyright 2018, 2023, 2025 NXP
+
+ #include <linux/clk.h>
+ #include <linux/completion.h>
+@@ -755,7 +755,7 @@ static irqreturn_t fsl_lpspi_isr(int irq, void *dev_id)
+ if (temp_SR & SR_MBF ||
+ readl(fsl_lpspi->base + IMX7ULP_FSR) & FSR_TXCOUNT) {
+ writel(SR_FCF, fsl_lpspi->base + IMX7ULP_SR);
+- fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE);
++ fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE | (temp_IER & IER_TDIE));
+ return IRQ_HANDLED;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 5c665bf2ae68cfaf2135e574f3a64877fe83815a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:14:42 +0100
+Subject: spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit e811b088a3641861fc9d2b2b840efc61a0f1907d ]
+
+In DMA mode fsl_lpspi_reset() is always called at the end, even when the
+transfer is aborted. In PIO mode aborts skip the reset leaving the FIFO
+filled and the module enabled.
+
+Fix it by always calling fsl_lpspi_reset().
+
+Fixes: a15dc3d657fa ("spi: lpspi: Fix CLK pin becomes low before one transfer")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-3-6262b9aa9be4@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index ab096368a1fd5..319cd96bd201b 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -705,12 +705,10 @@ static int fsl_lpspi_pio_transfer(struct spi_controller *controller,
+ fsl_lpspi_write_tx_fifo(fsl_lpspi);
+
+ ret = fsl_lpspi_wait_for_completion(controller);
+- if (ret)
+- return ret;
+
+ fsl_lpspi_reset(fsl_lpspi);
+
+- return 0;
++ return ret;
+ }
+
+ static int fsl_lpspi_transfer_one(struct spi_controller *controller,
+--
+2.51.0
+
--- /dev/null
+From cd12d5173fd1fa6a2c02e8905310dcbc4778efbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:14:41 +0100
+Subject: spi: spi-fsl-lpspi: Set correct chip-select polarity bit
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit cbe33705864ba2697a2939de715b81538cf32430 ]
+
+The driver currently supports multiple chip-selects, but only sets the
+polarity for the first one (CS 0). Fix it by setting the PCSPOL bit for
+the desired chip-select.
+
+Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-2-6262b9aa9be4@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index 7ece48667f52d..ab096368a1fd5 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -5,6 +5,7 @@
+ // Copyright 2016 Freescale Semiconductor, Inc.
+ // Copyright 2018, 2023, 2025 NXP
+
++#include <linux/bitfield.h>
+ #include <linux/clk.h>
+ #include <linux/completion.h>
+ #include <linux/delay.h>
+@@ -71,7 +72,7 @@
+ #define DER_TDDE BIT(0)
+ #define CFGR1_PCSCFG BIT(27)
+ #define CFGR1_PINCFG (BIT(24)|BIT(25))
+-#define CFGR1_PCSPOL BIT(8)
++#define CFGR1_PCSPOL_MASK GENMASK(11, 8)
+ #define CFGR1_NOSTALL BIT(3)
+ #define CFGR1_MASTER BIT(0)
+ #define FSR_TXCOUNT (0xFF)
+@@ -395,7 +396,9 @@ static int fsl_lpspi_config(struct fsl_lpspi_data *fsl_lpspi)
+ else
+ temp = CFGR1_PINCFG;
+ if (fsl_lpspi->config.mode & SPI_CS_HIGH)
+- temp |= CFGR1_PCSPOL;
++ temp |= FIELD_PREP(CFGR1_PCSPOL_MASK,
++ BIT(fsl_lpspi->config.chip_select));
++
+ writel(temp, fsl_lpspi->base + IMX7ULP_CFGR1);
+
+ temp = readl(fsl_lpspi->base + IMX7ULP_CR);
+--
+2.51.0
+
--- /dev/null
+From 9e33fd5769d0e56394af4a5c67f6b6805a0abf28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 14:23:41 +0200
+Subject: drm/bridge: ti-sn65dsi86: fix REFCLK setting
+
+From: Michael Walle <mwalle@kernel.org>
+
+[ Upstream commit bdd5a14e660062114bdebaef9ad52adf04970a89 ]
+
+The bridge has three bootstrap pins which are sampled to determine the
+frequency of the external reference clock. The driver will also
+(over)write that setting. But it seems this is racy after the bridge is
+enabled. It was observed that although the driver write the correct
+value (by sniffing on the I2C bus), the register has the wrong value.
+The datasheet states that the GPIO lines have to be stable for at least
+5us after asserting the EN signal. Thus, there seems to be some logic
+which samples the GPIO lines and this logic appears to overwrite the
+register value which was set by the driver. Waiting 20us after
+asserting the EN line resolves this issue.
+
+Fixes: a095f15c00e2 ("drm/bridge: add support for sn65dsi86 bridge driver")
+Signed-off-by: Michael Walle <mwalle@kernel.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20250821122341.1257286-1-mwalle@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/ti-sn65dsi86.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+index 1c9dd62d3c47b..1187bfb449f29 100644
+--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c
++++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+@@ -313,6 +313,17 @@ static int __maybe_unused ti_sn65dsi86_resume(struct device *dev)
+
+ gpiod_set_value(pdata->enable_gpio, 1);
+
++ /*
++ * After EN is deasserted and an external clock is detected, the bridge
++ * will sample GPIO3:1 to determine its frequency. The driver will
++ * overwrite this setting in ti_sn_bridge_set_refclk_freq(). But this is
++ * racy. Thus we have to wait a couple of us. According to the datasheet
++ * the GPIO lines has to be stable at least 5 us (td5) but it seems that
++ * is not enough and the refclk frequency value is still lost or
++ * overwritten by the bridge itself. Waiting for 20us seems to work.
++ */
++ usleep_range(20, 30);
++
+ /*
+ * If we have a reference clock we can enable communication w/ the
+ * panel (including the aux channel) w/out any need for an input clock
+--
+2.51.0
+
--- /dev/null
+From e26410b426d05750cadd91f4c0f8ed6243416674 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2025 21:10:06 +0800
+Subject: pcmcia: Add error handling for add_interval() in do_validate_mem()
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+[ Upstream commit 4a81f78caa53e0633cf311ca1526377d9bff7479 ]
+
+In the do_validate_mem(), the call to add_interval() does not
+handle errors. If kmalloc() fails in add_interval(), it could
+result in a null pointer being inserted into the linked list,
+leading to illegal memory access when sub_interval() is called
+next.
+
+This patch adds an error handling for the add_interval(). If
+add_interval() returns an error, the function will return early
+with the error code.
+
+Fixes: 7b4884ca8853 ("pcmcia: validate late-added resources")
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pcmcia/rsrc_nonstatic.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c
+index e6c90c0bb7646..58782f21a442a 100644
+--- a/drivers/pcmcia/rsrc_nonstatic.c
++++ b/drivers/pcmcia/rsrc_nonstatic.c
+@@ -375,7 +375,9 @@ static int do_validate_mem(struct pcmcia_socket *s,
+
+ if (validate && !s->fake_cis) {
+ /* move it to the validated data set */
+- add_interval(&s_data->mem_db_valid, base, size);
++ ret = add_interval(&s_data->mem_db_valid, base, size);
++ if (ret)
++ return ret;
+ sub_interval(&s_data->mem_db, base, size);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 132a21457dab32928127fb92cc2e70ae276d2539 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:17:11 -0700
+Subject: perf bpf-event: Fix use-after-free in synthesis
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit d7b67dd6f9db7bd2c49b415e901849b182ff0735 ]
+
+Calls to perf_env__insert_bpf_prog_info may fail as a sideband thread
+may already have inserted the bpf_prog_info. Such failures may yield
+info_linear being freed which then causes use-after-free issues with
+the internal bpf_prog_info info struct. Make it so that
+perf_env__insert_bpf_prog_info trigger early non-error paths and fix
+the use-after-free in perf_event__synthesize_one_bpf_prog. Add proper
+return error handling to perf_env__add_bpf_info (that calls
+perf_env__insert_bpf_prog_info) and propagate the return value in its
+callers.
+
+Closes: https://lore.kernel.org/lkml/CAP-5=fWJQcmUOP7MuCA2ihKnDAHUCOBLkQFEkQES-1ZZTrgf8Q@mail.gmail.com/
+Fixes: 03edb7020bb9 ("perf bpf: Fix two memory leakages when calling perf_env__insert_bpf_prog_info()")
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20250902181713.309797-2-irogers@google.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/bpf-event.c | 39 +++++++++++++++++++++++++------------
+ 1 file changed, 27 insertions(+), 12 deletions(-)
+
+diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c
+index 41b889ab4d6ab..e96a7fdfe283b 100644
+--- a/tools/perf/util/bpf-event.c
++++ b/tools/perf/util/bpf-event.c
+@@ -301,9 +301,15 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_session *session,
+
+ info_node->info_linear = info_linear;
+ if (!perf_env__insert_bpf_prog_info(env, info_node)) {
+- free(info_linear);
++ /*
++ * Insert failed, likely because of a duplicate event
++ * made by the sideband thread. Ignore synthesizing the
++ * metadata.
++ */
+ free(info_node);
++ goto out;
+ }
++ /* info_linear is now owned by info_node and shouldn't be freed below. */
+ info_linear = NULL;
+
+ /*
+@@ -459,18 +465,18 @@ int perf_event__synthesize_bpf_events(struct perf_session *session,
+ return err;
+ }
+
+-static void perf_env__add_bpf_info(struct perf_env *env, u32 id)
++static int perf_env__add_bpf_info(struct perf_env *env, u32 id)
+ {
+ struct bpf_prog_info_linear *info_linear;
+ struct bpf_prog_info_node *info_node;
+ struct btf *btf = NULL;
+ u64 arrays;
+ u32 btf_id;
+- int fd;
++ int fd, err = 0;
+
+ fd = bpf_prog_get_fd_by_id(id);
+ if (fd < 0)
+- return;
++ return -EINVAL;
+
+ arrays = 1UL << BPF_PROG_INFO_JITED_KSYMS;
+ arrays |= 1UL << BPF_PROG_INFO_JITED_FUNC_LENS;
+@@ -483,6 +489,7 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id)
+ info_linear = bpf_program__get_prog_info_linear(fd, arrays);
+ if (IS_ERR_OR_NULL(info_linear)) {
+ pr_debug("%s: failed to get BPF program info. aborting\n", __func__);
++ err = PTR_ERR(info_linear);
+ goto out;
+ }
+
+@@ -492,38 +499,46 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id)
+ if (info_node) {
+ info_node->info_linear = info_linear;
+ if (!perf_env__insert_bpf_prog_info(env, info_node)) {
++ pr_debug("%s: duplicate add bpf info request for id %u\n",
++ __func__, btf_id);
+ free(info_linear);
+ free(info_node);
++ goto out;
+ }
+- } else
++ } else {
+ free(info_linear);
++ err = -ENOMEM;
++ goto out;
++ }
+
+ if (btf_id == 0)
+ goto out;
+
+ btf = btf__load_from_kernel_by_id(btf_id);
+- if (libbpf_get_error(btf)) {
+- pr_debug("%s: failed to get BTF of id %u, aborting\n",
+- __func__, btf_id);
+- goto out;
++ if (!btf) {
++ err = -errno;
++ pr_debug("%s: failed to get BTF of id %u %d\n", __func__, btf_id, err);
++ } else {
++ perf_env__fetch_btf(env, btf_id, btf);
+ }
+- perf_env__fetch_btf(env, btf_id, btf);
+
+ out:
+ btf__free(btf);
+ close(fd);
++ return err;
+ }
+
+ static int bpf_event__sb_cb(union perf_event *event, void *data)
+ {
+ struct perf_env *env = data;
++ int ret = 0;
+
+ if (event->header.type != PERF_RECORD_BPF_EVENT)
+ return -1;
+
+ switch (event->bpf.type) {
+ case PERF_BPF_EVENT_PROG_LOAD:
+- perf_env__add_bpf_info(env, event->bpf.id);
++ ret = perf_env__add_bpf_info(env, event->bpf.id);
+
+ case PERF_BPF_EVENT_PROG_UNLOAD:
+ /*
+@@ -537,7 +552,7 @@ static int bpf_event__sb_cb(union perf_event *event, void *data)
+ break;
+ }
+
+- return 0;
++ return ret;
+ }
+
+ int evlist__add_bpf_sb_event(struct evlist *evlist, struct perf_env *env)
+--
+2.51.0
+
randstruct-gcc-plugin-fix-attribute-addition.patch
mm-slub-avoid-accessing-metadata-when-pointer-is-invalid-in-object_err.patch
alsa-hda-hdmi-add-pin-fix-for-another-hp-elitedesk-800-g4-model.patch
+pcmcia-add-error-handling-for-add_interval-in-do_val.patch
+spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch
+spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch
+spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch
+drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch
+perf-bpf-event-fix-use-after-free-in-synthesis.patch
--- /dev/null
+From 0ed010deb13010de90948e60465e7333bcc27f6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:14:40 +0100
+Subject: spi: spi-fsl-lpspi: Fix transmissions when using CONT
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit 782a7c73078e1301c0c427f21c06377d77dfa541 ]
+
+Commit 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use
+CONT") breaks transmissions when CONT is used. The TDIE interrupt should
+not be disabled in all cases. If CONT is used and the TX transfer is not
+yet completed yet, but the interrupt handler is called because there are
+characters to be received, TDIE is replaced with FCIE. When the transfer
+is finally completed, SR_TDF is set but the interrupt handler isn't
+called again.
+
+Fixes: 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use CONT")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-1-6262b9aa9be4@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index bf3f600bdd2c8..7ece48667f52d 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -3,7 +3,7 @@
+ // Freescale i.MX7ULP LPSPI driver
+ //
+ // Copyright 2016 Freescale Semiconductor, Inc.
+-// Copyright 2018 NXP Semiconductors
++// Copyright 2018, 2023, 2025 NXP
+
+ #include <linux/clk.h>
+ #include <linux/completion.h>
+@@ -755,7 +755,7 @@ static irqreturn_t fsl_lpspi_isr(int irq, void *dev_id)
+ if (temp_SR & SR_MBF ||
+ readl(fsl_lpspi->base + IMX7ULP_FSR) & FSR_TXCOUNT) {
+ writel(SR_FCF, fsl_lpspi->base + IMX7ULP_SR);
+- fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE);
++ fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE | (temp_IER & IER_TDIE));
+ return IRQ_HANDLED;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From e3def29096a5a67b29293a0d3026ed43f9645e15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:14:42 +0100
+Subject: spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit e811b088a3641861fc9d2b2b840efc61a0f1907d ]
+
+In DMA mode fsl_lpspi_reset() is always called at the end, even when the
+transfer is aborted. In PIO mode aborts skip the reset leaving the FIFO
+filled and the module enabled.
+
+Fix it by always calling fsl_lpspi_reset().
+
+Fixes: a15dc3d657fa ("spi: lpspi: Fix CLK pin becomes low before one transfer")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-3-6262b9aa9be4@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index ab096368a1fd5..319cd96bd201b 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -705,12 +705,10 @@ static int fsl_lpspi_pio_transfer(struct spi_controller *controller,
+ fsl_lpspi_write_tx_fifo(fsl_lpspi);
+
+ ret = fsl_lpspi_wait_for_completion(controller);
+- if (ret)
+- return ret;
+
+ fsl_lpspi_reset(fsl_lpspi);
+
+- return 0;
++ return ret;
+ }
+
+ static int fsl_lpspi_transfer_one(struct spi_controller *controller,
+--
+2.51.0
+
--- /dev/null
+From f6e62bcd76184318dfe7a9ec0027bec7faea4519 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:14:41 +0100
+Subject: spi: spi-fsl-lpspi: Set correct chip-select polarity bit
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit cbe33705864ba2697a2939de715b81538cf32430 ]
+
+The driver currently supports multiple chip-selects, but only sets the
+polarity for the first one (CS 0). Fix it by setting the PCSPOL bit for
+the desired chip-select.
+
+Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-2-6262b9aa9be4@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index 7ece48667f52d..ab096368a1fd5 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -5,6 +5,7 @@
+ // Copyright 2016 Freescale Semiconductor, Inc.
+ // Copyright 2018, 2023, 2025 NXP
+
++#include <linux/bitfield.h>
+ #include <linux/clk.h>
+ #include <linux/completion.h>
+ #include <linux/delay.h>
+@@ -71,7 +72,7 @@
+ #define DER_TDDE BIT(0)
+ #define CFGR1_PCSCFG BIT(27)
+ #define CFGR1_PINCFG (BIT(24)|BIT(25))
+-#define CFGR1_PCSPOL BIT(8)
++#define CFGR1_PCSPOL_MASK GENMASK(11, 8)
+ #define CFGR1_NOSTALL BIT(3)
+ #define CFGR1_MASTER BIT(0)
+ #define FSR_TXCOUNT (0xFF)
+@@ -395,7 +396,9 @@ static int fsl_lpspi_config(struct fsl_lpspi_data *fsl_lpspi)
+ else
+ temp = CFGR1_PINCFG;
+ if (fsl_lpspi->config.mode & SPI_CS_HIGH)
+- temp |= CFGR1_PCSPOL;
++ temp |= FIELD_PREP(CFGR1_PCSPOL_MASK,
++ BIT(fsl_lpspi->config.chip_select));
++
+ writel(temp, fsl_lpspi->base + IMX7ULP_CFGR1);
+
+ temp = readl(fsl_lpspi->base + IMX7ULP_CR);
+--
+2.51.0
+
--- /dev/null
+From 604775594aa9203f7f0d40cbb7ab678243ddb25c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2025 21:10:06 +0800
+Subject: pcmcia: Add error handling for add_interval() in do_validate_mem()
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+[ Upstream commit 4a81f78caa53e0633cf311ca1526377d9bff7479 ]
+
+In the do_validate_mem(), the call to add_interval() does not
+handle errors. If kmalloc() fails in add_interval(), it could
+result in a null pointer being inserted into the linked list,
+leading to illegal memory access when sub_interval() is called
+next.
+
+This patch adds an error handling for the add_interval(). If
+add_interval() returns an error, the function will return early
+with the error code.
+
+Fixes: 7b4884ca8853 ("pcmcia: validate late-added resources")
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pcmcia/rsrc_nonstatic.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c
+index 6b311d6f8bf02..12bcbeca4a448 100644
+--- a/drivers/pcmcia/rsrc_nonstatic.c
++++ b/drivers/pcmcia/rsrc_nonstatic.c
+@@ -375,7 +375,9 @@ static int do_validate_mem(struct pcmcia_socket *s,
+
+ if (validate && !s->fake_cis) {
+ /* move it to the validated data set */
+- add_interval(&s_data->mem_db_valid, base, size);
++ ret = add_interval(&s_data->mem_db_valid, base, size);
++ if (ret)
++ return ret;
+ sub_interval(&s_data->mem_db, base, size);
+ }
+
+--
+2.51.0
+
randstruct-gcc-plugin-remove-bogus-void-member.patch
randstruct-gcc-plugin-fix-attribute-addition.patch
alsa-hda-hdmi-add-pin-fix-for-another-hp-elitedesk-800-g4-model.patch
+pcmcia-add-error-handling-for-add_interval-in-do_val.patch
+spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch
+spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch
+spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch
--- /dev/null
+From 555aa44e206c5b471d5b83ae7c7d7853d6517d52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:14:40 +0100
+Subject: spi: spi-fsl-lpspi: Fix transmissions when using CONT
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit 782a7c73078e1301c0c427f21c06377d77dfa541 ]
+
+Commit 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use
+CONT") breaks transmissions when CONT is used. The TDIE interrupt should
+not be disabled in all cases. If CONT is used and the TX transfer is not
+yet completed yet, but the interrupt handler is called because there are
+characters to be received, TDIE is replaced with FCIE. When the transfer
+is finally completed, SR_TDF is set but the interrupt handler isn't
+called again.
+
+Fixes: 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use CONT")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-1-6262b9aa9be4@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index 2708bf15e1263..8a4925469dfb9 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -3,7 +3,7 @@
+ // Freescale i.MX7ULP LPSPI driver
+ //
+ // Copyright 2016 Freescale Semiconductor, Inc.
+-// Copyright 2018 NXP Semiconductors
++// Copyright 2018, 2023, 2025 NXP
+
+ #include <linux/clk.h>
+ #include <linux/completion.h>
+@@ -772,7 +772,7 @@ static irqreturn_t fsl_lpspi_isr(int irq, void *dev_id)
+ if (temp_SR & SR_MBF ||
+ readl(fsl_lpspi->base + IMX7ULP_FSR) & FSR_TXCOUNT) {
+ writel(SR_FCF, fsl_lpspi->base + IMX7ULP_SR);
+- fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE);
++ fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE | (temp_IER & IER_TDIE));
+ return IRQ_HANDLED;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 978e8cc7e4ccb74f8d4b7120b9c418fc258ac977 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:14:42 +0100
+Subject: spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit e811b088a3641861fc9d2b2b840efc61a0f1907d ]
+
+In DMA mode fsl_lpspi_reset() is always called at the end, even when the
+transfer is aborted. In PIO mode aborts skip the reset leaving the FIFO
+filled and the module enabled.
+
+Fix it by always calling fsl_lpspi_reset().
+
+Fixes: a15dc3d657fa ("spi: lpspi: Fix CLK pin becomes low before one transfer")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-3-6262b9aa9be4@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index 6cabad2923aec..789cdb001eb64 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -722,12 +722,10 @@ static int fsl_lpspi_pio_transfer(struct spi_controller *controller,
+ fsl_lpspi_write_tx_fifo(fsl_lpspi);
+
+ ret = fsl_lpspi_wait_for_completion(controller);
+- if (ret)
+- return ret;
+
+ fsl_lpspi_reset(fsl_lpspi);
+
+- return 0;
++ return ret;
+ }
+
+ static int fsl_lpspi_transfer_one(struct spi_controller *controller,
+--
+2.51.0
+
--- /dev/null
+From c9baab8936605e290dd262982d33cb1f2996b4b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:14:41 +0100
+Subject: spi: spi-fsl-lpspi: Set correct chip-select polarity bit
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit cbe33705864ba2697a2939de715b81538cf32430 ]
+
+The driver currently supports multiple chip-selects, but only sets the
+polarity for the first one (CS 0). Fix it by setting the PCSPOL bit for
+the desired chip-select.
+
+Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-2-6262b9aa9be4@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index 8a4925469dfb9..6cabad2923aec 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -5,6 +5,7 @@
+ // Copyright 2016 Freescale Semiconductor, Inc.
+ // Copyright 2018, 2023, 2025 NXP
+
++#include <linux/bitfield.h>
+ #include <linux/clk.h>
+ #include <linux/completion.h>
+ #include <linux/delay.h>
+@@ -74,7 +75,7 @@
+ #define DER_TDDE BIT(0)
+ #define CFGR1_PCSCFG BIT(27)
+ #define CFGR1_PINCFG (BIT(24)|BIT(25))
+-#define CFGR1_PCSPOL BIT(8)
++#define CFGR1_PCSPOL_MASK GENMASK(11, 8)
+ #define CFGR1_NOSTALL BIT(3)
+ #define CFGR1_MASTER BIT(0)
+ #define FSR_TXCOUNT (0xFF)
+@@ -415,7 +416,9 @@ static int fsl_lpspi_config(struct fsl_lpspi_data *fsl_lpspi)
+ else
+ temp = CFGR1_PINCFG;
+ if (fsl_lpspi->config.mode & SPI_CS_HIGH)
+- temp |= CFGR1_PCSPOL;
++ temp |= FIELD_PREP(CFGR1_PCSPOL_MASK,
++ BIT(fsl_lpspi->config.chip_select));
++
+ writel(temp, fsl_lpspi->base + IMX7ULP_CFGR1);
+
+ temp = readl(fsl_lpspi->base + IMX7ULP_CR);
+--
+2.51.0
+
--- /dev/null
+From 8faed373c4d8b83beffbf55f7082d01104dec7b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:40:50 +0100
+Subject: drm/amd/amdgpu: Fix missing error return on kzalloc failure
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 467e00b30dfe75c4cfc2197ceef1fddca06adc25 ]
+
+Currently the kzalloc failure check just sets reports the failure
+and sets the variable ret to -ENOMEM, which is not checked later
+for this specific error. Fix this by just returning -ENOMEM rather
+than setting ret.
+
+Fixes: 4fb930715468 ("drm/amd/amdgpu: remove redundant host to psp cmd buf allocations")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 1ee9d1a0962c13ba5ab7e47d33a80e3b8dc4b52e)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index df38eb9604ec3..0bc21106d9e87 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -373,7 +373,7 @@ static int psp_sw_init(void *handle)
+ psp->cmd = kzalloc(sizeof(struct psp_gfx_cmd_resp), GFP_KERNEL);
+ if (!psp->cmd) {
+ dev_err(adev->dev, "Failed to allocate memory to command buffer!\n");
+- ret = -ENOMEM;
++ return -ENOMEM;
+ }
+
+ if (amdgpu_sriov_vf(adev))
+--
+2.51.0
+
--- /dev/null
+From d70803644c507806bf16733a1cb5d0e91c43c1b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Apr 2023 17:22:20 +0530
+Subject: drm/amd/amdgpu: Fix style problems in amdgpu_psp.c
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit f14c8c3e1fc9e10c6d54999a96acb2b5087374df ]
+
+Fix the following checkpatch warnings & error in amdgpu_psp.c
+
+WARNING: Comparisons should place the constant on the right side of the test
+WARNING: braces {} are not necessary for single statement blocks
+WARNING: please, no space before tabs
+WARNING: braces {} are not necessary for single statement blocks
+ERROR: that open brace { should be on the previous line
+
+Suggested-by: Christian König <christian.koenig@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 467e00b30dfe ("drm/amd/amdgpu: Fix missing error return on kzalloc failure")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 51 ++++++++++---------------
+ 1 file changed, 20 insertions(+), 31 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index ff3678a1c0296..459a5af3a99ac 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -392,7 +392,7 @@ static int psp_sw_init(void *handle)
+ if ((psp_get_runtime_db_entry(adev,
+ PSP_RUNTIME_ENTRY_TYPE_PPTABLE_ERR_STATUS,
+ &scpm_entry)) &&
+- (SCPM_DISABLE != scpm_entry.scpm_status)) {
++ (scpm_entry.scpm_status != SCPM_DISABLE)) {
+ adev->scpm_enabled = true;
+ adev->scpm_status = scpm_entry.scpm_status;
+ } else {
+@@ -439,10 +439,9 @@ static int psp_sw_init(void *handle)
+
+ if (adev->ip_versions[MP0_HWIP][0] == IP_VERSION(11, 0, 0) ||
+ adev->ip_versions[MP0_HWIP][0] == IP_VERSION(11, 0, 7)) {
+- ret= psp_sysfs_init(adev);
+- if (ret) {
++ ret = psp_sysfs_init(adev);
++ if (ret)
+ return ret;
+- }
+ }
+
+ ret = amdgpu_bo_create_kernel(adev, PSP_1_MEG, PSP_1_MEG,
+@@ -641,7 +640,7 @@ psp_cmd_submit_buf(struct psp_context *psp,
+ skip_unsupport = (psp->cmd_buf_mem->resp.status == TEE_ERROR_NOT_SUPPORTED ||
+ psp->cmd_buf_mem->resp.status == PSP_ERR_UNKNOWN_COMMAND) && amdgpu_sriov_vf(psp->adev);
+
+- memcpy((void*)&cmd->resp, (void*)&psp->cmd_buf_mem->resp, sizeof(struct psp_gfx_resp));
++ memcpy(&cmd->resp, &psp->cmd_buf_mem->resp, sizeof(struct psp_gfx_resp));
+
+ /* In some cases, psp response status is not 0 even there is no
+ * problem while the command is submitted. Some version of PSP FW
+@@ -823,7 +822,7 @@ static int psp_tmr_load(struct psp_context *psp)
+ }
+
+ static void psp_prep_tmr_unload_cmd_buf(struct psp_context *psp,
+- struct psp_gfx_cmd_resp *cmd)
++ struct psp_gfx_cmd_resp *cmd)
+ {
+ if (amdgpu_sriov_vf(psp->adev))
+ cmd->cmd_id = GFX_CMD_ID_DESTROY_VMR;
+@@ -1052,7 +1051,7 @@ static void psp_prep_ta_load_cmd_buf(struct psp_gfx_cmd_resp *cmd,
+ struct ta_context *context)
+ {
+ cmd->cmd_id = context->ta_load_type;
+- cmd->cmd.cmd_load_ta.app_phy_addr_lo = lower_32_bits(ta_bin_mc);
++ cmd->cmd.cmd_load_ta.app_phy_addr_lo = lower_32_bits(ta_bin_mc);
+ cmd->cmd.cmd_load_ta.app_phy_addr_hi = upper_32_bits(ta_bin_mc);
+ cmd->cmd.cmd_load_ta.app_len = context->bin_desc.size_bytes;
+
+@@ -1158,9 +1157,8 @@ int psp_ta_load(struct psp_context *psp, struct ta_context *context)
+
+ context->resp_status = cmd->resp.status;
+
+- if (!ret) {
++ if (!ret)
+ context->session_id = cmd->resp.session_id;
+- }
+
+ release_psp_cmd_buf(psp);
+
+@@ -1490,8 +1488,7 @@ int psp_ras_invoke(struct psp_context *psp, uint32_t ta_cmd_id)
+ if (amdgpu_ras_intr_triggered())
+ return ret;
+
+- if (ras_cmd->if_version > RAS_TA_HOST_IF_VER)
+- {
++ if (ras_cmd->if_version > RAS_TA_HOST_IF_VER) {
+ DRM_WARN("RAS: Unsupported Interface");
+ return -EINVAL;
+ }
+@@ -1501,8 +1498,7 @@ int psp_ras_invoke(struct psp_context *psp, uint32_t ta_cmd_id)
+ dev_warn(psp->adev->dev, "ECC switch disabled\n");
+
+ ras_cmd->ras_status = TA_RAS_STATUS__ERROR_RAS_NOT_AVAILABLE;
+- }
+- else if (ras_cmd->ras_out_message.flags.reg_access_failure_flag)
++ } else if (ras_cmd->ras_out_message.flags.reg_access_failure_flag)
+ dev_warn(psp->adev->dev,
+ "RAS internal register access blocked\n");
+
+@@ -1598,11 +1594,10 @@ static int psp_ras_initialize(struct psp_context *psp)
+ if (ret)
+ dev_warn(adev->dev, "PSP set boot config failed\n");
+ else
+- dev_warn(adev->dev, "GECC will be disabled in next boot cycle "
+- "if set amdgpu_ras_enable and/or amdgpu_ras_mask to 0x0\n");
++ dev_warn(adev->dev, "GECC will be disabled in next boot cycle if set amdgpu_ras_enable and/or amdgpu_ras_mask to 0x0\n");
+ }
+ } else {
+- if (1 == boot_cfg) {
++ if (boot_cfg == 1) {
+ dev_info(adev->dev, "GECC is enabled\n");
+ } else {
+ /* enable GECC in next boot cycle if it is disabled
+@@ -2389,7 +2384,7 @@ static int psp_prep_load_ip_fw_cmd_buf(struct amdgpu_firmware_info *ucode,
+ }
+
+ static int psp_execute_non_psp_fw_load(struct psp_context *psp,
+- struct amdgpu_firmware_info *ucode)
++ struct amdgpu_firmware_info *ucode)
+ {
+ int ret = 0;
+ struct psp_gfx_cmd_resp *cmd = acquire_psp_cmd_buf(psp);
+@@ -2428,9 +2423,8 @@ static int psp_load_smu_fw(struct psp_context *psp)
+ (adev->ip_versions[MP0_HWIP][0] == IP_VERSION(11, 0, 4) ||
+ adev->ip_versions[MP0_HWIP][0] == IP_VERSION(11, 0, 2)))) {
+ ret = amdgpu_dpm_set_mp1_state(adev, PP_MP1_STATE_UNLOAD);
+- if (ret) {
++ if (ret)
+ DRM_WARN("Failed to set MP1 state prepare for reload\n");
+- }
+ }
+
+ ret = psp_execute_non_psp_fw_load(psp, ucode);
+@@ -2740,9 +2734,8 @@ static int psp_suspend(void *handle)
+ }
+
+ ret = psp_ring_stop(psp, PSP_RING_TYPE__KM);
+- if (ret) {
++ if (ret)
+ DRM_ERROR("PSP ring stop failed\n");
+- }
+
+ out:
+ return ret;
+@@ -3015,7 +3008,7 @@ static int parse_sos_bin_descriptor(struct psp_context *psp,
+ psp->sos.fw_version = le32_to_cpu(desc->fw_version);
+ psp->sos.feature_version = le32_to_cpu(desc->fw_version);
+ psp->sos.size_bytes = le32_to_cpu(desc->size_bytes);
+- psp->sos.start_addr = ucode_start_addr;
++ psp->sos.start_addr = ucode_start_addr;
+ break;
+ case PSP_FW_TYPE_PSP_SYS_DRV:
+ psp->sys.fw_version = le32_to_cpu(desc->fw_version);
+@@ -3501,7 +3494,7 @@ void psp_copy_fw(struct psp_context *psp, uint8_t *start_addr, uint32_t bin_size
+ drm_dev_exit(idx);
+ }
+
+-static DEVICE_ATTR(usbc_pd_fw, S_IRUGO | S_IWUSR,
++static DEVICE_ATTR(usbc_pd_fw, 0644,
+ psp_usbc_pd_fw_sysfs_read,
+ psp_usbc_pd_fw_sysfs_write);
+
+@@ -3686,8 +3679,7 @@ static void psp_sysfs_fini(struct amdgpu_device *adev)
+ device_remove_file(adev->dev, &dev_attr_usbc_pd_fw);
+ }
+
+-const struct amdgpu_ip_block_version psp_v3_1_ip_block =
+-{
++const struct amdgpu_ip_block_version psp_v3_1_ip_block = {
+ .type = AMD_IP_BLOCK_TYPE_PSP,
+ .major = 3,
+ .minor = 1,
+@@ -3695,8 +3687,7 @@ const struct amdgpu_ip_block_version psp_v3_1_ip_block =
+ .funcs = &psp_ip_funcs,
+ };
+
+-const struct amdgpu_ip_block_version psp_v10_0_ip_block =
+-{
++const struct amdgpu_ip_block_version psp_v10_0_ip_block = {
+ .type = AMD_IP_BLOCK_TYPE_PSP,
+ .major = 10,
+ .minor = 0,
+@@ -3704,8 +3695,7 @@ const struct amdgpu_ip_block_version psp_v10_0_ip_block =
+ .funcs = &psp_ip_funcs,
+ };
+
+-const struct amdgpu_ip_block_version psp_v11_0_ip_block =
+-{
++const struct amdgpu_ip_block_version psp_v11_0_ip_block = {
+ .type = AMD_IP_BLOCK_TYPE_PSP,
+ .major = 11,
+ .minor = 0,
+@@ -3721,8 +3711,7 @@ const struct amdgpu_ip_block_version psp_v11_0_8_ip_block = {
+ .funcs = &psp_ip_funcs,
+ };
+
+-const struct amdgpu_ip_block_version psp_v12_0_ip_block =
+-{
++const struct amdgpu_ip_block_version psp_v12_0_ip_block = {
+ .type = AMD_IP_BLOCK_TYPE_PSP,
+ .major = 12,
+ .minor = 0,
+--
+2.51.0
+
--- /dev/null
+From a353edecf8821c87c0f111141a7c842a43a1d47d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jun 2023 10:04:05 -0500
+Subject: drm/amd: Make flashing messages quieter
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 1cc506f08b4c4688c729e48d7c665910ed330724 ]
+
+Debug messages related to the kernel process of flashing an updated
+IFWI are needlessly noisy and also confusing.
+
+Downgrade them to debug instead and clarify what they are actually
+doing.
+
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 467e00b30dfe ("drm/amd/amdgpu: Fix missing error return on kzalloc failure")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index cbee5c6cdb369..f720aa06fb3d6 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -3552,7 +3552,7 @@ static ssize_t amdgpu_psp_vbflash_write(struct file *filp, struct kobject *kobj,
+ adev->psp.vbflash_image_size += count;
+ mutex_unlock(&adev->psp.mutex);
+
+- dev_info(adev->dev, "VBIOS flash write PSP done");
++ dev_dbg(adev->dev, "IFWI staged for update");
+
+ return count;
+ }
+@@ -3572,7 +3572,7 @@ static ssize_t amdgpu_psp_vbflash_read(struct file *filp, struct kobject *kobj,
+ if (adev->psp.vbflash_image_size == 0)
+ return -EINVAL;
+
+- dev_info(adev->dev, "VBIOS flash to PSP started");
++ dev_dbg(adev->dev, "PSP IFWI flash process initiated");
+
+ ret = amdgpu_bo_create_kernel(adev, adev->psp.vbflash_image_size,
+ AMDGPU_GPU_PAGE_SIZE,
+@@ -3597,11 +3597,11 @@ static ssize_t amdgpu_psp_vbflash_read(struct file *filp, struct kobject *kobj,
+ adev->psp.vbflash_image_size = 0;
+
+ if (ret) {
+- dev_err(adev->dev, "Failed to load VBIOS FW, err = %d", ret);
++ dev_err(adev->dev, "Failed to load IFWI, err = %d", ret);
+ return ret;
+ }
+
+- dev_info(adev->dev, "VBIOS flash to PSP done");
++ dev_dbg(adev->dev, "PSP IFWI flash process done");
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 5e2a2f104b05e35e328c7a07cb30848923a299fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Oct 2022 18:07:44 +0800
+Subject: drm/amdgpu: Optimize RAS TA initialization and TA unload funcs
+
+From: Candice Li <candice.li@amd.com>
+
+[ Upstream commit bf7d777289d106963fd2080d298e6b88b7263b66 ]
+
+1. Save TA unload psp response status
+2. Add RAS TA loading status check for initializaiton
+3. Drop RAS context teardown to allow RAS TA to be reloaded
+
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Candice Li <candice.li@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 467e00b30dfe ("drm/amd/amdgpu: Fix missing error return on kzalloc failure")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index ae6643c8ade6c..d101333fe3a57 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -994,6 +994,8 @@ int psp_ta_unload(struct psp_context *psp, struct ta_context *context)
+
+ ret = psp_cmd_submit_buf(psp, NULL, cmd, psp->fence_buf_mc_addr);
+
++ context->resp_status = cmd->resp.status;
++
+ release_psp_cmd_buf(psp);
+
+ return ret;
+@@ -1569,6 +1571,11 @@ static int psp_ras_initialize(struct psp_context *psp)
+ if (amdgpu_sriov_vf(adev))
+ return 0;
+
++ if (psp->ras_context.context.initialized) {
++ dev_warn(adev->dev, "RAS WARN: TA has already been loaded\n");
++ return 0;
++ }
++
+ if (!adev->psp.ras_context.context.bin_desc.size_bytes ||
+ !adev->psp.ras_context.context.bin_desc.start_addr) {
+ dev_info(adev->dev, "RAS: optional ras ta ucode is not available\n");
+@@ -1619,7 +1626,7 @@ static int psp_ras_initialize(struct psp_context *psp)
+ psp->ras_context.context.mem_context.shared_mem_size = PSP_RAS_SHARED_MEM_SIZE;
+ psp->ras_context.context.ta_load_type = GFX_CMD_ID_LOAD_TA;
+
+- if (!psp->ras_context.context.initialized) {
++ if (!psp->ras_context.context.mem_context.shared_buf) {
+ ret = psp_ta_init_shared_buf(psp, &psp->ras_context.context.mem_context);
+ if (ret)
+ return ret;
+@@ -1640,7 +1647,6 @@ static int psp_ras_initialize(struct psp_context *psp)
+ else {
+ if (ras_cmd->ras_status)
+ dev_warn(psp->adev->dev, "RAS Init Status: 0x%X\n", ras_cmd->ras_status);
+- amdgpu_ras_fini(psp->adev);
+ }
+
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 36d157f41f0502f28d45f03623fbaf943d5293c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Nov 2022 14:37:08 +0800
+Subject: drm/amdgpu: remove the check of init status in psp_ras_initialize
+
+From: Tao Zhou <tao.zhou1@amd.com>
+
+[ Upstream commit 3e931368091f7d5d7902cee9d410eb6db2eea419 ]
+
+The initialized status indicates RAS TA is loaded, but in some cases
+(such as RAS fatal error) RAS TA could be destroyed although it's not
+unloaded. Hence we load RAS TA unconditionally here.
+
+Signed-off-by: Tao Zhou <tao.zhou1@amd.com>
+Reviewed-by: Candice Li <candice.li@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 467e00b30dfe ("drm/amd/amdgpu: Fix missing error return on kzalloc failure")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index d101333fe3a57..ff3678a1c0296 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -1571,11 +1571,6 @@ static int psp_ras_initialize(struct psp_context *psp)
+ if (amdgpu_sriov_vf(adev))
+ return 0;
+
+- if (psp->ras_context.context.initialized) {
+- dev_warn(adev->dev, "RAS WARN: TA has already been loaded\n");
+- return 0;
+- }
+-
+ if (!adev->psp.ras_context.context.bin_desc.size_bytes ||
+ !adev->psp.ras_context.context.bin_desc.start_addr) {
+ dev_info(adev->dev, "RAS: optional ras ta ucode is not available\n");
+@@ -1647,6 +1642,9 @@ static int psp_ras_initialize(struct psp_context *psp)
+ else {
+ if (ras_cmd->ras_status)
+ dev_warn(psp->adev->dev, "RAS Init Status: 0x%X\n", ras_cmd->ras_status);
++
++ /* fail to load RAS TA */
++ psp->ras_context.context.initialized = false;
+ }
+
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From edccf14314436c72dae90c0673908c7cb267e92a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Dec 2023 18:14:23 +0800
+Subject: drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c
+
+From: Hawking Zhang <Hawking.Zhang@amd.com>
+
+[ Upstream commit ac3ff8a90637e813005404a0110802aa384af4aa ]
+
+So kernel message has the device pcie bdf information,
+which helps issue debugging especially in multiple GPU
+system.
+
+Signed-off-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 467e00b30dfe ("drm/amd/amdgpu: Fix missing error return on kzalloc failure")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 144 ++++++++++++------------
+ 1 file changed, 75 insertions(+), 69 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index f720aa06fb3d6..df38eb9604ec3 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -222,21 +222,22 @@ static int psp_memory_training_init(struct psp_context *psp)
+ struct psp_memory_training_context *ctx = &psp->mem_train_ctx;
+
+ if (ctx->init != PSP_MEM_TRAIN_RESERVE_SUCCESS) {
+- DRM_DEBUG("memory training is not supported!\n");
++ dev_dbg(psp->adev->dev, "memory training is not supported!\n");
+ return 0;
+ }
+
+ ctx->sys_cache = kzalloc(ctx->train_data_size, GFP_KERNEL);
+ if (ctx->sys_cache == NULL) {
+- DRM_ERROR("alloc mem_train_ctx.sys_cache failed!\n");
++ dev_err(psp->adev->dev, "alloc mem_train_ctx.sys_cache failed!\n");
+ ret = -ENOMEM;
+ goto Err_out;
+ }
+
+- DRM_DEBUG("train_data_size:%llx,p2c_train_data_offset:%llx,c2p_train_data_offset:%llx.\n",
+- ctx->train_data_size,
+- ctx->p2c_train_data_offset,
+- ctx->c2p_train_data_offset);
++ dev_dbg(psp->adev->dev,
++ "train_data_size:%llx,p2c_train_data_offset:%llx,c2p_train_data_offset:%llx.\n",
++ ctx->train_data_size,
++ ctx->p2c_train_data_offset,
++ ctx->c2p_train_data_offset);
+ ctx->init = PSP_MEM_TRAIN_INIT_SUCCESS;
+ return 0;
+
+@@ -371,7 +372,7 @@ static int psp_sw_init(void *handle)
+
+ psp->cmd = kzalloc(sizeof(struct psp_gfx_cmd_resp), GFP_KERNEL);
+ if (!psp->cmd) {
+- DRM_ERROR("Failed to allocate memory to command buffer!\n");
++ dev_err(adev->dev, "Failed to allocate memory to command buffer!\n");
+ ret = -ENOMEM;
+ }
+
+@@ -426,13 +427,13 @@ static int psp_sw_init(void *handle)
+ if (mem_training_ctx->enable_mem_training) {
+ ret = psp_memory_training_init(psp);
+ if (ret) {
+- DRM_ERROR("Failed to initialize memory training!\n");
++ dev_err(adev->dev, "Failed to initialize memory training!\n");
+ return ret;
+ }
+
+ ret = psp_mem_training(psp, PSP_MEM_TRAIN_COLD_BOOT);
+ if (ret) {
+- DRM_ERROR("Failed to process memory training!\n");
++ dev_err(adev->dev, "Failed to process memory training!\n");
+ return ret;
+ }
+ }
+@@ -651,9 +652,11 @@ psp_cmd_submit_buf(struct psp_context *psp,
+ */
+ if (!skip_unsupport && (psp->cmd_buf_mem->resp.status || !timeout) && !ras_intr) {
+ if (ucode)
+- DRM_WARN("failed to load ucode %s(0x%X) ",
+- amdgpu_ucode_name(ucode->ucode_id), ucode->ucode_id);
+- DRM_WARN("psp gfx command %s(0x%X) failed and response status is (0x%X)\n",
++ dev_warn(psp->adev->dev,
++ "failed to load ucode %s(0x%X) ",
++ amdgpu_ucode_name(ucode->ucode_id), ucode->ucode_id);
++ dev_warn(psp->adev->dev,
++ "psp gfx command %s(0x%X) failed and response status is (0x%X)\n",
+ psp_gfx_cmd_name(psp->cmd_buf_mem->cmd_id), psp->cmd_buf_mem->cmd_id,
+ psp->cmd_buf_mem->resp.status);
+ /* If any firmware (including CAP) load fails under SRIOV, it should
+@@ -783,7 +786,7 @@ static int psp_tmr_init(struct psp_context *psp)
+ psp->fw_pri_buf) {
+ ret = psp_load_toc(psp, &tmr_size);
+ if (ret) {
+- DRM_ERROR("Failed to load toc\n");
++ dev_err(psp->adev->dev, "Failed to load toc\n");
+ return ret;
+ }
+ }
+@@ -826,7 +829,7 @@ static int psp_tmr_load(struct psp_context *psp)
+
+ psp_prep_tmr_cmd_buf(psp, cmd, psp->tmr_mc_addr, psp->tmr_bo);
+ if (psp->tmr_bo)
+- DRM_INFO("reserve 0x%lx from 0x%llx for PSP TMR\n",
++ dev_info(psp->adev->dev, "reserve 0x%lx from 0x%llx for PSP TMR\n",
+ amdgpu_bo_size(psp->tmr_bo), psp->tmr_mc_addr);
+
+ ret = psp_cmd_submit_buf(psp, NULL, cmd,
+@@ -1055,7 +1058,7 @@ int psp_reg_program(struct psp_context *psp, enum psp_reg_prog_id reg,
+ psp_prep_reg_prog_cmd_buf(cmd, reg, value);
+ ret = psp_cmd_submit_buf(psp, NULL, cmd, psp->fence_buf_mc_addr);
+ if (ret)
+- DRM_ERROR("PSP failed to program reg id %d", reg);
++ dev_err(psp->adev->dev, "PSP failed to program reg id %d\n", reg);
+
+ release_psp_cmd_buf(psp);
+
+@@ -1466,22 +1469,22 @@ static void psp_ras_ta_check_status(struct psp_context *psp)
+ switch (ras_cmd->ras_status) {
+ case TA_RAS_STATUS__ERROR_UNSUPPORTED_IP:
+ dev_warn(psp->adev->dev,
+- "RAS WARNING: cmd failed due to unsupported ip\n");
++ "RAS WARNING: cmd failed due to unsupported ip\n");
+ break;
+ case TA_RAS_STATUS__ERROR_UNSUPPORTED_ERROR_INJ:
+ dev_warn(psp->adev->dev,
+- "RAS WARNING: cmd failed due to unsupported error injection\n");
++ "RAS WARNING: cmd failed due to unsupported error injection\n");
+ break;
+ case TA_RAS_STATUS__SUCCESS:
+ break;
+ case TA_RAS_STATUS__TEE_ERROR_ACCESS_DENIED:
+ if (ras_cmd->cmd_id == TA_RAS_COMMAND__TRIGGER_ERROR)
+ dev_warn(psp->adev->dev,
+- "RAS WARNING: Inject error to critical region is not allowed\n");
++ "RAS WARNING: Inject error to critical region is not allowed\n");
+ break;
+ default:
+ dev_warn(psp->adev->dev,
+- "RAS WARNING: ras status = 0x%X\n", ras_cmd->ras_status);
++ "RAS WARNING: ras status = 0x%X\n", ras_cmd->ras_status);
+ break;
+ }
+ }
+@@ -1505,7 +1508,7 @@ int psp_ras_invoke(struct psp_context *psp, uint32_t ta_cmd_id)
+ return ret;
+
+ if (ras_cmd->if_version > RAS_TA_HOST_IF_VER) {
+- DRM_WARN("RAS: Unsupported Interface");
++ dev_warn(psp->adev->dev, "RAS: Unsupported Interface\n");
+ return -EINVAL;
+ }
+
+@@ -1652,7 +1655,7 @@ static int psp_ras_initialize(struct psp_context *psp)
+ psp->ras_context.context.initialized = true;
+ else {
+ if (ras_cmd->ras_status)
+- dev_warn(psp->adev->dev, "RAS Init Status: 0x%X\n", ras_cmd->ras_status);
++ dev_warn(adev->dev, "RAS Init Status: 0x%X\n", ras_cmd->ras_status);
+
+ /* fail to load RAS TA */
+ psp->ras_context.context.initialized = false;
+@@ -2036,7 +2039,7 @@ static int psp_hw_start(struct psp_context *psp)
+ (psp->funcs->bootloader_load_kdb != NULL)) {
+ ret = psp_bootloader_load_kdb(psp);
+ if (ret) {
+- DRM_ERROR("PSP load kdb failed!\n");
++ dev_err(adev->dev, "PSP load kdb failed!\n");
+ return ret;
+ }
+ }
+@@ -2045,7 +2048,7 @@ static int psp_hw_start(struct psp_context *psp)
+ (psp->funcs->bootloader_load_spl != NULL)) {
+ ret = psp_bootloader_load_spl(psp);
+ if (ret) {
+- DRM_ERROR("PSP load spl failed!\n");
++ dev_err(adev->dev, "PSP load spl failed!\n");
+ return ret;
+ }
+ }
+@@ -2054,7 +2057,7 @@ static int psp_hw_start(struct psp_context *psp)
+ (psp->funcs->bootloader_load_sysdrv != NULL)) {
+ ret = psp_bootloader_load_sysdrv(psp);
+ if (ret) {
+- DRM_ERROR("PSP load sys drv failed!\n");
++ dev_err(adev->dev, "PSP load sys drv failed!\n");
+ return ret;
+ }
+ }
+@@ -2063,7 +2066,7 @@ static int psp_hw_start(struct psp_context *psp)
+ (psp->funcs->bootloader_load_soc_drv != NULL)) {
+ ret = psp_bootloader_load_soc_drv(psp);
+ if (ret) {
+- DRM_ERROR("PSP load soc drv failed!\n");
++ dev_err(adev->dev, "PSP load soc drv failed!\n");
+ return ret;
+ }
+ }
+@@ -2072,7 +2075,7 @@ static int psp_hw_start(struct psp_context *psp)
+ (psp->funcs->bootloader_load_intf_drv != NULL)) {
+ ret = psp_bootloader_load_intf_drv(psp);
+ if (ret) {
+- DRM_ERROR("PSP load intf drv failed!\n");
++ dev_err(adev->dev, "PSP load intf drv failed!\n");
+ return ret;
+ }
+ }
+@@ -2081,7 +2084,7 @@ static int psp_hw_start(struct psp_context *psp)
+ (psp->funcs->bootloader_load_dbg_drv != NULL)) {
+ ret = psp_bootloader_load_dbg_drv(psp);
+ if (ret) {
+- DRM_ERROR("PSP load dbg drv failed!\n");
++ dev_err(adev->dev, "PSP load dbg drv failed!\n");
+ return ret;
+ }
+ }
+@@ -2090,7 +2093,7 @@ static int psp_hw_start(struct psp_context *psp)
+ (psp->funcs->bootloader_load_ras_drv != NULL)) {
+ ret = psp_bootloader_load_ras_drv(psp);
+ if (ret) {
+- DRM_ERROR("PSP load ras_drv failed!\n");
++ dev_err(adev->dev, "PSP load ras_drv failed!\n");
+ return ret;
+ }
+ }
+@@ -2099,7 +2102,7 @@ static int psp_hw_start(struct psp_context *psp)
+ (psp->funcs->bootloader_load_sos != NULL)) {
+ ret = psp_bootloader_load_sos(psp);
+ if (ret) {
+- DRM_ERROR("PSP load sos failed!\n");
++ dev_err(adev->dev, "PSP load sos failed!\n");
+ return ret;
+ }
+ }
+@@ -2107,7 +2110,7 @@ static int psp_hw_start(struct psp_context *psp)
+
+ ret = psp_ring_create(psp, PSP_RING_TYPE__KM);
+ if (ret) {
+- DRM_ERROR("PSP create ring failed!\n");
++ dev_err(adev->dev, "PSP create ring failed!\n");
+ return ret;
+ }
+
+@@ -2117,7 +2120,7 @@ static int psp_hw_start(struct psp_context *psp)
+ if (!psp_boottime_tmr(psp)) {
+ ret = psp_tmr_init(psp);
+ if (ret) {
+- DRM_ERROR("PSP tmr init failed!\n");
++ dev_err(adev->dev, "PSP tmr init failed!\n");
+ return ret;
+ }
+ }
+@@ -2136,7 +2139,7 @@ static int psp_hw_start(struct psp_context *psp)
+
+ ret = psp_tmr_load(psp);
+ if (ret) {
+- DRM_ERROR("PSP load tmr failed!\n");
++ dev_err(adev->dev, "PSP load tmr failed!\n");
+ return ret;
+ }
+
+@@ -2383,7 +2386,8 @@ static void psp_print_fw_hdr(struct psp_context *psp,
+ }
+ }
+
+-static int psp_prep_load_ip_fw_cmd_buf(struct amdgpu_firmware_info *ucode,
++static int psp_prep_load_ip_fw_cmd_buf(struct psp_context *psp,
++ struct amdgpu_firmware_info *ucode,
+ struct psp_gfx_cmd_resp *cmd)
+ {
+ int ret;
+@@ -2396,7 +2400,7 @@ static int psp_prep_load_ip_fw_cmd_buf(struct amdgpu_firmware_info *ucode,
+
+ ret = psp_get_fw_type(ucode, &cmd->cmd.cmd_load_ip_fw.fw_type);
+ if (ret)
+- DRM_ERROR("Unknown firmware type\n");
++ dev_err(psp->adev->dev, "Unknown firmware type\n");
+
+ return ret;
+ }
+@@ -2407,7 +2411,7 @@ static int psp_execute_non_psp_fw_load(struct psp_context *psp,
+ int ret = 0;
+ struct psp_gfx_cmd_resp *cmd = acquire_psp_cmd_buf(psp);
+
+- ret = psp_prep_load_ip_fw_cmd_buf(ucode, cmd);
++ ret = psp_prep_load_ip_fw_cmd_buf(psp, ucode, cmd);
+ if (!ret) {
+ ret = psp_cmd_submit_buf(psp, ucode, cmd,
+ psp->fence_buf_mc_addr);
+@@ -2442,13 +2446,13 @@ static int psp_load_smu_fw(struct psp_context *psp)
+ adev->ip_versions[MP0_HWIP][0] == IP_VERSION(11, 0, 2)))) {
+ ret = amdgpu_dpm_set_mp1_state(adev, PP_MP1_STATE_UNLOAD);
+ if (ret)
+- DRM_WARN("Failed to set MP1 state prepare for reload\n");
++ dev_err(adev->dev, "Failed to set MP1 state prepare for reload\n");
+ }
+
+ ret = psp_execute_non_psp_fw_load(psp, ucode);
+
+ if (ret)
+- DRM_ERROR("PSP load smu failed!\n");
++ dev_err(adev->dev, "PSP load smu failed!\n");
+
+ return ret;
+ }
+@@ -2543,7 +2547,7 @@ static int psp_load_non_psp_fw(struct psp_context *psp)
+ adev->virt.autoload_ucode_id : AMDGPU_UCODE_ID_RLC_G)) {
+ ret = psp_rlc_autoload_start(psp);
+ if (ret) {
+- DRM_ERROR("Failed to start rlc autoload\n");
++ dev_err(adev->dev, "Failed to start rlc autoload\n");
+ return ret;
+ }
+ }
+@@ -2565,7 +2569,7 @@ static int psp_load_fw(struct amdgpu_device *adev)
+
+ ret = psp_ring_init(psp, PSP_RING_TYPE__KM);
+ if (ret) {
+- DRM_ERROR("PSP ring init failed!\n");
++ dev_err(adev->dev, "PSP ring init failed!\n");
+ goto failed;
+ }
+ }
+@@ -2580,13 +2584,13 @@ static int psp_load_fw(struct amdgpu_device *adev)
+
+ ret = psp_asd_initialize(psp);
+ if (ret) {
+- DRM_ERROR("PSP load asd failed!\n");
++ dev_err(adev->dev, "PSP load asd failed!\n");
+ goto failed1;
+ }
+
+ ret = psp_rl_load(adev);
+ if (ret) {
+- DRM_ERROR("PSP load RL failed!\n");
++ dev_err(adev->dev, "PSP load RL failed!\n");
+ goto failed1;
+ }
+
+@@ -2606,7 +2610,7 @@ static int psp_load_fw(struct amdgpu_device *adev)
+ ret = psp_ras_initialize(psp);
+ if (ret)
+ dev_err(psp->adev->dev,
+- "RAS: Failed to initialize RAS\n");
++ "RAS: Failed to initialize RAS\n");
+
+ ret = psp_hdcp_initialize(psp);
+ if (ret)
+@@ -2659,7 +2663,7 @@ static int psp_hw_init(void *handle)
+
+ ret = psp_load_fw(adev);
+ if (ret) {
+- DRM_ERROR("PSP firmware loading failed\n");
++ dev_err(adev->dev, "PSP firmware loading failed\n");
+ goto failed;
+ }
+
+@@ -2706,7 +2710,7 @@ static int psp_suspend(void *handle)
+ psp->xgmi_context.context.initialized) {
+ ret = psp_xgmi_terminate(psp);
+ if (ret) {
+- DRM_ERROR("Failed to terminate xgmi ta\n");
++ dev_err(adev->dev, "Failed to terminate xgmi ta\n");
+ goto out;
+ }
+ }
+@@ -2714,46 +2718,46 @@ static int psp_suspend(void *handle)
+ if (psp->ta_fw) {
+ ret = psp_ras_terminate(psp);
+ if (ret) {
+- DRM_ERROR("Failed to terminate ras ta\n");
++ dev_err(adev->dev, "Failed to terminate ras ta\n");
+ goto out;
+ }
+ ret = psp_hdcp_terminate(psp);
+ if (ret) {
+- DRM_ERROR("Failed to terminate hdcp ta\n");
++ dev_err(adev->dev, "Failed to terminate hdcp ta\n");
+ goto out;
+ }
+ ret = psp_dtm_terminate(psp);
+ if (ret) {
+- DRM_ERROR("Failed to terminate dtm ta\n");
++ dev_err(adev->dev, "Failed to terminate dtm ta\n");
+ goto out;
+ }
+ ret = psp_rap_terminate(psp);
+ if (ret) {
+- DRM_ERROR("Failed to terminate rap ta\n");
++ dev_err(adev->dev, "Failed to terminate rap ta\n");
+ goto out;
+ }
+ ret = psp_securedisplay_terminate(psp);
+ if (ret) {
+- DRM_ERROR("Failed to terminate securedisplay ta\n");
++ dev_err(adev->dev, "Failed to terminate securedisplay ta\n");
+ goto out;
+ }
+ }
+
+ ret = psp_asd_terminate(psp);
+ if (ret) {
+- DRM_ERROR("Failed to terminate asd\n");
++ dev_err(adev->dev, "Failed to terminate asd\n");
+ goto out;
+ }
+
+ ret = psp_tmr_terminate(psp);
+ if (ret) {
+- DRM_ERROR("Failed to terminate tmr\n");
++ dev_err(adev->dev, "Failed to terminate tmr\n");
+ goto out;
+ }
+
+ ret = psp_ring_stop(psp, PSP_RING_TYPE__KM);
+ if (ret)
+- DRM_ERROR("PSP ring stop failed\n");
++ dev_err(adev->dev, "PSP ring stop failed\n");
+
+ out:
+ return ret;
+@@ -2765,12 +2769,12 @@ static int psp_resume(void *handle)
+ struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+ struct psp_context *psp = &adev->psp;
+
+- DRM_INFO("PSP is resuming...\n");
++ dev_info(adev->dev, "PSP is resuming...\n");
+
+ if (psp->mem_train_ctx.enable_mem_training) {
+ ret = psp_mem_training(psp, PSP_MEM_TRAIN_RESUME);
+ if (ret) {
+- DRM_ERROR("Failed to process memory training!\n");
++ dev_err(adev->dev, "Failed to process memory training!\n");
+ return ret;
+ }
+ }
+@@ -2787,7 +2791,7 @@ static int psp_resume(void *handle)
+
+ ret = psp_asd_initialize(psp);
+ if (ret) {
+- DRM_ERROR("PSP load asd failed!\n");
++ dev_err(adev->dev, "PSP load asd failed!\n");
+ goto failed;
+ }
+
+@@ -2811,7 +2815,7 @@ static int psp_resume(void *handle)
+ ret = psp_ras_initialize(psp);
+ if (ret)
+ dev_err(psp->adev->dev,
+- "RAS: Failed to initialize RAS\n");
++ "RAS: Failed to initialize RAS\n");
+
+ ret = psp_hdcp_initialize(psp);
+ if (ret)
+@@ -2839,7 +2843,7 @@ static int psp_resume(void *handle)
+ return 0;
+
+ failed:
+- DRM_ERROR("PSP resume failed\n");
++ dev_err(adev->dev, "PSP resume failed\n");
+ mutex_unlock(&adev->firmware.mutex);
+ return ret;
+ }
+@@ -2913,9 +2917,11 @@ int psp_ring_cmd_submit(struct psp_context *psp,
+ write_frame = ring_buffer_start + (psp_write_ptr_reg / rb_frame_size_dw);
+ /* Check invalid write_frame ptr address */
+ if ((write_frame < ring_buffer_start) || (ring_buffer_end < write_frame)) {
+- DRM_ERROR("ring_buffer_start = %p; ring_buffer_end = %p; write_frame = %p\n",
+- ring_buffer_start, ring_buffer_end, write_frame);
+- DRM_ERROR("write_frame is pointing to address out of bounds\n");
++ dev_err(adev->dev,
++ "ring_buffer_start = %p; ring_buffer_end = %p; write_frame = %p\n",
++ ring_buffer_start, ring_buffer_end, write_frame);
++ dev_err(adev->dev,
++ "write_frame is pointing to address out of bounds\n");
+ return -EINVAL;
+ }
+
+@@ -3427,7 +3433,7 @@ static ssize_t psp_usbc_pd_fw_sysfs_read(struct device *dev,
+ int ret;
+
+ if (!adev->ip_blocks[AMD_IP_BLOCK_TYPE_PSP].status.late_initialized) {
+- DRM_INFO("PSP block is not ready yet.");
++ dev_info(adev->dev, "PSP block is not ready yet\n.");
+ return -EBUSY;
+ }
+
+@@ -3436,7 +3442,7 @@ static ssize_t psp_usbc_pd_fw_sysfs_read(struct device *dev,
+ mutex_unlock(&adev->psp.mutex);
+
+ if (ret) {
+- DRM_ERROR("Failed to read USBC PD FW, err = %d", ret);
++ dev_err(adev->dev, "Failed to read USBC PD FW, err = %d\n", ret);
+ return ret;
+ }
+
+@@ -3458,7 +3464,7 @@ static ssize_t psp_usbc_pd_fw_sysfs_write(struct device *dev,
+ void *fw_pri_cpu_addr;
+
+ if (!adev->ip_blocks[AMD_IP_BLOCK_TYPE_PSP].status.late_initialized) {
+- DRM_INFO("PSP block is not ready yet.");
++ dev_err(adev->dev, "PSP block is not ready yet.");
+ return -EBUSY;
+ }
+
+@@ -3491,7 +3497,7 @@ static ssize_t psp_usbc_pd_fw_sysfs_write(struct device *dev,
+ release_firmware(usbc_pd_fw);
+ fail:
+ if (ret) {
+- DRM_ERROR("Failed to load USBC PD FW, err = %d", ret);
++ dev_err(adev->dev, "Failed to load USBC PD FW, err = %d", ret);
+ count = ret;
+ }
+
+@@ -3533,7 +3539,7 @@ static ssize_t amdgpu_psp_vbflash_write(struct file *filp, struct kobject *kobj,
+
+ /* Safeguard against memory drain */
+ if (adev->psp.vbflash_image_size > AMD_VBIOS_FILE_MAX_SIZE_B) {
+- dev_err(adev->dev, "File size cannot exceed %u", AMD_VBIOS_FILE_MAX_SIZE_B);
++ dev_err(adev->dev, "File size cannot exceed %u\n", AMD_VBIOS_FILE_MAX_SIZE_B);
+ kvfree(adev->psp.vbflash_tmp_buf);
+ adev->psp.vbflash_tmp_buf = NULL;
+ adev->psp.vbflash_image_size = 0;
+@@ -3552,7 +3558,7 @@ static ssize_t amdgpu_psp_vbflash_write(struct file *filp, struct kobject *kobj,
+ adev->psp.vbflash_image_size += count;
+ mutex_unlock(&adev->psp.mutex);
+
+- dev_dbg(adev->dev, "IFWI staged for update");
++ dev_dbg(adev->dev, "IFWI staged for update\n");
+
+ return count;
+ }
+@@ -3572,7 +3578,7 @@ static ssize_t amdgpu_psp_vbflash_read(struct file *filp, struct kobject *kobj,
+ if (adev->psp.vbflash_image_size == 0)
+ return -EINVAL;
+
+- dev_dbg(adev->dev, "PSP IFWI flash process initiated");
++ dev_dbg(adev->dev, "PSP IFWI flash process initiated\n");
+
+ ret = amdgpu_bo_create_kernel(adev, adev->psp.vbflash_image_size,
+ AMDGPU_GPU_PAGE_SIZE,
+@@ -3597,11 +3603,11 @@ static ssize_t amdgpu_psp_vbflash_read(struct file *filp, struct kobject *kobj,
+ adev->psp.vbflash_image_size = 0;
+
+ if (ret) {
+- dev_err(adev->dev, "Failed to load IFWI, err = %d", ret);
++ dev_err(adev->dev, "Failed to load IFWI, err = %d\n", ret);
+ return ret;
+ }
+
+- dev_dbg(adev->dev, "PSP IFWI flash process done");
++ dev_dbg(adev->dev, "PSP IFWI flash process done\n");
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From b2fe0c8a37ff1e52551736067338af947caa9335 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Nov 2022 14:23:58 +0530
+Subject: drm/amdgpu: Skip TMR allocation if not required
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+[ Upstream commit 5b03127d4745d6848f208463390e6a76d489eb03 ]
+
+On ASICs with PSPv13.0.6, TMR is reserved at boot time. There is no need
+to allocate TMR region by driver. However, it's still required to send
+SETUP_TMR command to PSP.
+
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 467e00b30dfe ("drm/amd/amdgpu: Fix missing error return on kzalloc failure")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 34 +++++++++++++++++++------
+ 1 file changed, 26 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index 459a5af3a99ac..cbee5c6cdb369 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -697,8 +697,13 @@ static void psp_prep_tmr_cmd_buf(struct psp_context *psp,
+ uint64_t tmr_mc, struct amdgpu_bo *tmr_bo)
+ {
+ struct amdgpu_device *adev = psp->adev;
+- uint32_t size = amdgpu_bo_size(tmr_bo);
+- uint64_t tmr_pa = amdgpu_gmc_vram_pa(adev, tmr_bo);
++ uint32_t size = 0;
++ uint64_t tmr_pa = 0;
++
++ if (tmr_bo) {
++ size = amdgpu_bo_size(tmr_bo);
++ tmr_pa = amdgpu_gmc_vram_pa(adev, tmr_bo);
++ }
+
+ if (amdgpu_sriov_vf(psp->adev))
+ cmd->cmd_id = GFX_CMD_ID_SETUP_VMR;
+@@ -743,6 +748,16 @@ static int psp_load_toc(struct psp_context *psp,
+ return ret;
+ }
+
++static bool psp_boottime_tmr(struct psp_context *psp)
++{
++ switch (psp->adev->ip_versions[MP0_HWIP][0]) {
++ case IP_VERSION(13, 0, 6):
++ return true;
++ default:
++ return false;
++ }
++}
++
+ /* Set up Trusted Memory Region */
+ static int psp_tmr_init(struct psp_context *psp)
+ {
+@@ -810,8 +825,9 @@ static int psp_tmr_load(struct psp_context *psp)
+ cmd = acquire_psp_cmd_buf(psp);
+
+ psp_prep_tmr_cmd_buf(psp, cmd, psp->tmr_mc_addr, psp->tmr_bo);
+- DRM_INFO("reserve 0x%lx from 0x%llx for PSP TMR\n",
+- amdgpu_bo_size(psp->tmr_bo), psp->tmr_mc_addr);
++ if (psp->tmr_bo)
++ DRM_INFO("reserve 0x%lx from 0x%llx for PSP TMR\n",
++ amdgpu_bo_size(psp->tmr_bo), psp->tmr_mc_addr);
+
+ ret = psp_cmd_submit_buf(psp, NULL, cmd,
+ psp->fence_buf_mc_addr);
+@@ -2098,10 +2114,12 @@ static int psp_hw_start(struct psp_context *psp)
+ if (amdgpu_sriov_vf(adev) && amdgpu_in_reset(adev))
+ goto skip_pin_bo;
+
+- ret = psp_tmr_init(psp);
+- if (ret) {
+- DRM_ERROR("PSP tmr init failed!\n");
+- return ret;
++ if (!psp_boottime_tmr(psp)) {
++ ret = psp_tmr_init(psp);
++ if (ret) {
++ DRM_ERROR("PSP tmr init failed!\n");
++ return ret;
++ }
+ }
+
+ skip_pin_bo:
+--
+2.51.0
+
--- /dev/null
+From 13b54d745f10ae45a42f42d79f30ad40881fe00f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 14:23:41 +0200
+Subject: drm/bridge: ti-sn65dsi86: fix REFCLK setting
+
+From: Michael Walle <mwalle@kernel.org>
+
+[ Upstream commit bdd5a14e660062114bdebaef9ad52adf04970a89 ]
+
+The bridge has three bootstrap pins which are sampled to determine the
+frequency of the external reference clock. The driver will also
+(over)write that setting. But it seems this is racy after the bridge is
+enabled. It was observed that although the driver write the correct
+value (by sniffing on the I2C bus), the register has the wrong value.
+The datasheet states that the GPIO lines have to be stable for at least
+5us after asserting the EN signal. Thus, there seems to be some logic
+which samples the GPIO lines and this logic appears to overwrite the
+register value which was set by the driver. Waiting 20us after
+asserting the EN line resolves this issue.
+
+Fixes: a095f15c00e2 ("drm/bridge: add support for sn65dsi86 bridge driver")
+Signed-off-by: Michael Walle <mwalle@kernel.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20250821122341.1257286-1-mwalle@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/ti-sn65dsi86.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+index 6595f954135ad..d31bb9153f4fb 100644
+--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c
++++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+@@ -375,6 +375,17 @@ static int __maybe_unused ti_sn65dsi86_resume(struct device *dev)
+
+ gpiod_set_value(pdata->enable_gpio, 1);
+
++ /*
++ * After EN is deasserted and an external clock is detected, the bridge
++ * will sample GPIO3:1 to determine its frequency. The driver will
++ * overwrite this setting in ti_sn_bridge_set_refclk_freq(). But this is
++ * racy. Thus we have to wait a couple of us. According to the datasheet
++ * the GPIO lines has to be stable at least 5 us (td5) but it seems that
++ * is not enough and the refclk frequency value is still lost or
++ * overwritten by the bridge itself. Waiting for 20us seems to work.
++ */
++ usleep_range(20, 30);
++
+ /*
+ * If we have a reference clock we can enable communication w/ the
+ * panel (including the aux channel) w/out any need for an input clock
+--
+2.51.0
+
--- /dev/null
+From d4cfc3c947923b2b492b296488db47aad7431763 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jul 2025 23:17:15 +0300
+Subject: hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM
+
+From: Vadim Pasternak <vadimp@nvidia.com>
+
+[ Upstream commit 1180c79fbf36e4c02e76ae4658509523437e52a4 ]
+
+The fans controlled by the driver can get stuck at 0 RPM if they are
+configured below a 20% duty cycle. The driver tries to avoid this by
+enforcing a minimum duty cycle of 20%, but this is done after the fans
+are registered with the thermal subsystem. This is too late as the
+thermal subsystem can set their current state before the driver is able
+to enforce the minimum duty cycle.
+
+Fix by setting the minimum duty cycle before registering the fans with
+the thermal subsystem.
+
+Fixes: d7efb2ebc7b3 ("hwmon: (mlxreg-fan) Extend driver to support multiply cooling devices")
+Reported-by: Nikolay Aleksandrov <razor@blackwall.org>
+Tested-by: Nikolay Aleksandrov <razor@blackwall.org>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
+Link: https://lore.kernel.org/r/20250730201715.1111133-1-vadimp@nvidia.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/mlxreg-fan.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c
+index 96017cc8da7ec..7514d57661048 100644
+--- a/drivers/hwmon/mlxreg-fan.c
++++ b/drivers/hwmon/mlxreg-fan.c
+@@ -551,15 +551,14 @@ static int mlxreg_fan_cooling_config(struct device *dev, struct mlxreg_fan *fan)
+ if (!pwm->connected)
+ continue;
+ pwm->fan = fan;
++ /* Set minimal PWM speed. */
++ pwm->last_hwmon_state = MLXREG_FAN_PWM_DUTY2STATE(MLXREG_FAN_MIN_DUTY);
+ pwm->cdev = devm_thermal_of_cooling_device_register(dev, NULL, mlxreg_fan_name[i],
+ pwm, &mlxreg_fan_cooling_ops);
+ if (IS_ERR(pwm->cdev)) {
+ dev_err(dev, "Failed to register cooling device\n");
+ return PTR_ERR(pwm->cdev);
+ }
+-
+- /* Set minimal PWM speed. */
+- pwm->last_hwmon_state = MLXREG_FAN_PWM_DUTY2STATE(MLXREG_FAN_MIN_DUTY);
+ }
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From c914d128e49bc98ce1f62727b7dde9d35715f5a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2025 21:10:06 +0800
+Subject: pcmcia: Add error handling for add_interval() in do_validate_mem()
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+[ Upstream commit 4a81f78caa53e0633cf311ca1526377d9bff7479 ]
+
+In the do_validate_mem(), the call to add_interval() does not
+handle errors. If kmalloc() fails in add_interval(), it could
+result in a null pointer being inserted into the linked list,
+leading to illegal memory access when sub_interval() is called
+next.
+
+This patch adds an error handling for the add_interval(). If
+add_interval() returns an error, the function will return early
+with the error code.
+
+Fixes: 7b4884ca8853 ("pcmcia: validate late-added resources")
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pcmcia/rsrc_nonstatic.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c
+index 8bda75990bce5..0a4e439d46094 100644
+--- a/drivers/pcmcia/rsrc_nonstatic.c
++++ b/drivers/pcmcia/rsrc_nonstatic.c
+@@ -375,7 +375,9 @@ static int do_validate_mem(struct pcmcia_socket *s,
+
+ if (validate && !s->fake_cis) {
+ /* move it to the validated data set */
+- add_interval(&s_data->mem_db_valid, base, size);
++ ret = add_interval(&s_data->mem_db_valid, base, size);
++ if (ret)
++ return ret;
+ sub_interval(&s_data->mem_db, base, size);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 2c5033f52e63524b5c8075e0422f16a9f4fd0f83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Mar 2025 14:39:56 +0800
+Subject: pcmcia: omap: Add missing check for platform_get_resource
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit ecef14f70ec9344a10c817248d2ac6cddee5921e ]
+
+Add missing check for platform_get_resource() and return error if it fails
+to catch the error.
+
+Fixes: d87d44f7ab35 ("ARM: omap1: move CF chipselect setup to board file")
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pcmcia/omap_cf.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pcmcia/omap_cf.c b/drivers/pcmcia/omap_cf.c
+index d3f827d4224a3..e22a752052f2f 100644
+--- a/drivers/pcmcia/omap_cf.c
++++ b/drivers/pcmcia/omap_cf.c
+@@ -215,6 +215,8 @@ static int __init omap_cf_probe(struct platform_device *pdev)
+ return -EINVAL;
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (!res)
++ return -EINVAL;
+
+ cf = kzalloc(sizeof *cf, GFP_KERNEL);
+ if (!cf)
+--
+2.51.0
+
--- /dev/null
+From 099ebc1711fb9c4c2a9658e12af98f7eb4168d06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:17:12 -0700
+Subject: perf bpf-utils: Constify bpil_array_desc
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 1654a0e4d576d9e43fbb10ccf6a1b307c5c18566 ]
+
+The array's contents is a compile time constant. Constify to make the
+code more intention revealing and avoid unintended errors.
+
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20250902181713.309797-3-irogers@google.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Stable-dep-of: 01be43f2a0ea ("perf bpf-utils: Harden get_bpf_prog_info_linear")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/bpf-utils.c | 18 ++++++------------
+ 1 file changed, 6 insertions(+), 12 deletions(-)
+
+diff --git a/tools/perf/util/bpf-utils.c b/tools/perf/util/bpf-utils.c
+index 80b1d2b3729ba..64a5583446964 100644
+--- a/tools/perf/util/bpf-utils.c
++++ b/tools/perf/util/bpf-utils.c
+@@ -20,7 +20,7 @@ struct bpil_array_desc {
+ */
+ };
+
+-static struct bpil_array_desc bpil_array_desc[] = {
++static const struct bpil_array_desc bpil_array_desc[] = {
+ [PERF_BPIL_JITED_INSNS] = {
+ offsetof(struct bpf_prog_info, jited_prog_insns),
+ offsetof(struct bpf_prog_info, jited_prog_len),
+@@ -129,12 +129,10 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+
+ /* step 2: calculate total size of all arrays */
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
++ const struct bpil_array_desc *desc = &bpil_array_desc[i];
+ bool include_array = (arrays & (1UL << i)) > 0;
+- struct bpil_array_desc *desc;
+ __u32 count, size;
+
+- desc = bpil_array_desc + i;
+-
+ /* kernel is too old to support this field */
+ if (info_len < desc->array_offset + sizeof(__u32) ||
+ info_len < desc->count_offset + sizeof(__u32) ||
+@@ -163,13 +161,12 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+ ptr = info_linear->data;
+
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
+- struct bpil_array_desc *desc;
++ const struct bpil_array_desc *desc = &bpil_array_desc[i];
+ __u32 count, size;
+
+ if ((arrays & (1UL << i)) == 0)
+ continue;
+
+- desc = bpil_array_desc + i;
+ count = bpf_prog_info_read_offset_u32(&info, desc->count_offset);
+ size = bpf_prog_info_read_offset_u32(&info, desc->size_offset);
+ bpf_prog_info_set_offset_u32(&info_linear->info,
+@@ -192,13 +189,12 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+
+ /* step 6: verify the data */
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
+- struct bpil_array_desc *desc;
++ const struct bpil_array_desc *desc = &bpil_array_desc[i];
+ __u32 v1, v2;
+
+ if ((arrays & (1UL << i)) == 0)
+ continue;
+
+- desc = bpil_array_desc + i;
+ v1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset);
+ v2 = bpf_prog_info_read_offset_u32(&info_linear->info,
+ desc->count_offset);
+@@ -224,13 +220,12 @@ void bpil_addr_to_offs(struct perf_bpil *info_linear)
+ int i;
+
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
+- struct bpil_array_desc *desc;
++ const struct bpil_array_desc *desc = &bpil_array_desc[i];
+ __u64 addr, offs;
+
+ if ((info_linear->arrays & (1UL << i)) == 0)
+ continue;
+
+- desc = bpil_array_desc + i;
+ addr = bpf_prog_info_read_offset_u64(&info_linear->info,
+ desc->array_offset);
+ offs = addr - ptr_to_u64(info_linear->data);
+@@ -244,13 +239,12 @@ void bpil_offs_to_addr(struct perf_bpil *info_linear)
+ int i;
+
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
+- struct bpil_array_desc *desc;
++ const struct bpil_array_desc *desc = &bpil_array_desc[i];
+ __u64 addr, offs;
+
+ if ((info_linear->arrays & (1UL << i)) == 0)
+ continue;
+
+- desc = bpil_array_desc + i;
+ offs = bpf_prog_info_read_offset_u64(&info_linear->info,
+ desc->array_offset);
+ addr = offs + ptr_to_u64(info_linear->data);
+--
+2.51.0
+
--- /dev/null
+From b868c41330df913dd57463a94ec2adea26b88a5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:17:13 -0700
+Subject: perf bpf-utils: Harden get_bpf_prog_info_linear
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 01be43f2a0eaeed83e94dee054742f37625c86d9 ]
+
+In get_bpf_prog_info_linear two calls to bpf_obj_get_info_by_fd are
+made, the first to compute memory requirements for a struct perf_bpil
+and the second to fill it in. Previously the code would warn when the
+second call didn't match the first. Such races can be common place in
+things like perf test, whose perf trace tests will frequently load BPF
+programs. Rather than a debug message, return actual errors for this
+case. Out of paranoia also validate the read bpf_prog_info array
+value. Change the type of ptr to avoid mismatched pointer type
+compiler warnings. Add some additional debug print outs and sanity
+asserts.
+
+Closes: https://lore.kernel.org/lkml/CAP-5=fWJQcmUOP7MuCA2ihKnDAHUCOBLkQFEkQES-1ZZTrgf8Q@mail.gmail.com/
+Fixes: 6ac22d036f86 ("perf bpf: Pull in bpf_program__get_prog_info_linear()")
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20250902181713.309797-4-irogers@google.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/bpf-utils.c | 43 ++++++++++++++++++++++++++++---------
+ 1 file changed, 33 insertions(+), 10 deletions(-)
+
+diff --git a/tools/perf/util/bpf-utils.c b/tools/perf/util/bpf-utils.c
+index 64a5583446964..5a66dc8594aa8 100644
+--- a/tools/perf/util/bpf-utils.c
++++ b/tools/perf/util/bpf-utils.c
+@@ -115,7 +115,7 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+ __u32 info_len = sizeof(info);
+ __u32 data_len = 0;
+ int i, err;
+- void *ptr;
++ __u8 *ptr;
+
+ if (arrays >> PERF_BPIL_LAST_ARRAY)
+ return ERR_PTR(-EINVAL);
+@@ -126,6 +126,8 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+ pr_debug("can't get prog info: %s", strerror(errno));
+ return ERR_PTR(-EFAULT);
+ }
++ if (info.type >= __MAX_BPF_PROG_TYPE)
++ pr_debug("%s:%d: unexpected program type %u\n", __func__, __LINE__, info.type);
+
+ /* step 2: calculate total size of all arrays */
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
+@@ -173,6 +175,8 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+ desc->count_offset, count);
+ bpf_prog_info_set_offset_u32(&info_linear->info,
+ desc->size_offset, size);
++ assert(ptr >= info_linear->data);
++ assert(ptr < &info_linear->data[data_len]);
+ bpf_prog_info_set_offset_u64(&info_linear->info,
+ desc->array_offset,
+ ptr_to_u64(ptr));
+@@ -186,26 +190,45 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+ free(info_linear);
+ return ERR_PTR(-EFAULT);
+ }
++ if (info_linear->info.type >= __MAX_BPF_PROG_TYPE) {
++ pr_debug("%s:%d: unexpected program type %u\n",
++ __func__, __LINE__, info_linear->info.type);
++ }
+
+ /* step 6: verify the data */
++ ptr = info_linear->data;
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
+ const struct bpil_array_desc *desc = &bpil_array_desc[i];
+- __u32 v1, v2;
++ __u32 count1, count2, size1, size2;
++ __u64 ptr2;
+
+ if ((arrays & (1UL << i)) == 0)
+ continue;
+
+- v1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset);
+- v2 = bpf_prog_info_read_offset_u32(&info_linear->info,
++ count1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset);
++ count2 = bpf_prog_info_read_offset_u32(&info_linear->info,
+ desc->count_offset);
+- if (v1 != v2)
+- pr_warning("%s: mismatch in element count\n", __func__);
++ if (count1 != count2) {
++ pr_warning("%s: mismatch in element count %u vs %u\n", __func__, count1, count2);
++ free(info_linear);
++ return ERR_PTR(-ERANGE);
++ }
+
+- v1 = bpf_prog_info_read_offset_u32(&info, desc->size_offset);
+- v2 = bpf_prog_info_read_offset_u32(&info_linear->info,
++ size1 = bpf_prog_info_read_offset_u32(&info, desc->size_offset);
++ size2 = bpf_prog_info_read_offset_u32(&info_linear->info,
+ desc->size_offset);
+- if (v1 != v2)
+- pr_warning("%s: mismatch in rec size\n", __func__);
++ if (size1 != size2) {
++ pr_warning("%s: mismatch in rec size %u vs %u\n", __func__, size1, size2);
++ free(info_linear);
++ return ERR_PTR(-ERANGE);
++ }
++ ptr2 = bpf_prog_info_read_offset_u64(&info_linear->info, desc->array_offset);
++ if (ptr_to_u64(ptr) != ptr2) {
++ pr_warning("%s: mismatch in array %p vs %llx\n", __func__, ptr, ptr2);
++ free(info_linear);
++ return ERR_PTR(-ERANGE);
++ }
++ ptr += roundup(count1 * size1, sizeof(__u64));
+ }
+
+ /* step 7: update info_len and data_len */
+--
+2.51.0
+
alsa-hda-hdmi-add-pin-fix-for-another-hp-elitedesk-800-g4-model.patch
alsa-hda-realtek-fix-headset-mic-for-tongfang-x6r5xxy.patch
revert-drm-amdgpu-avoid-extra-evict-restore-process.patch
+pcmcia-omap-add-missing-check-for-platform_get_resou.patch
+pcmcia-add-error-handling-for-add_interval-in-do_val.patch
+hwmon-mlxreg-fan-prevent-fans-from-getting-stuck-at-.patch
+spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch
+spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch
+spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch
+drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch
+perf-bpf-utils-constify-bpil_array_desc.patch
+perf-bpf-utils-harden-get_bpf_prog_info_linear.patch
+drm-amdgpu-optimize-ras-ta-initialization-and-ta-unl.patch
+drm-amdgpu-remove-the-check-of-init-status-in-psp_ra.patch
+drm-amd-amdgpu-fix-style-problems-in-amdgpu_psp.c.patch
+drm-amdgpu-skip-tmr-allocation-if-not-required.patch
+drm-amd-make-flashing-messages-quieter.patch
+drm-amdgpu-replace-drm_-with-dev_-in-amdgpu_psp.c.patch
+drm-amd-amdgpu-fix-missing-error-return-on-kzalloc-f.patch
+tools-gpio-rm-.-.cmd-on-make-clean.patch
+tools-gpio-remove-the-include-directory-on-make-clea.patch
--- /dev/null
+From 571189a100157ca3184777bb60aee5766e361a2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:14:40 +0100
+Subject: spi: spi-fsl-lpspi: Fix transmissions when using CONT
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit 782a7c73078e1301c0c427f21c06377d77dfa541 ]
+
+Commit 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use
+CONT") breaks transmissions when CONT is used. The TDIE interrupt should
+not be disabled in all cases. If CONT is used and the TX transfer is not
+yet completed yet, but the interrupt handler is called because there are
+characters to be received, TDIE is replaced with FCIE. When the transfer
+is finally completed, SR_TDF is set but the interrupt handler isn't
+called again.
+
+Fixes: 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use CONT")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-1-6262b9aa9be4@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index 246d133238822..e8d915a8914c7 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -3,7 +3,7 @@
+ // Freescale i.MX7ULP LPSPI driver
+ //
+ // Copyright 2016 Freescale Semiconductor, Inc.
+-// Copyright 2018 NXP Semiconductors
++// Copyright 2018, 2023, 2025 NXP
+
+ #include <linux/clk.h>
+ #include <linux/completion.h>
+@@ -755,7 +755,7 @@ static irqreturn_t fsl_lpspi_isr(int irq, void *dev_id)
+ if (temp_SR & SR_MBF ||
+ readl(fsl_lpspi->base + IMX7ULP_FSR) & FSR_TXCOUNT) {
+ writel(SR_FCF, fsl_lpspi->base + IMX7ULP_SR);
+- fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE);
++ fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE | (temp_IER & IER_TDIE));
+ return IRQ_HANDLED;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 2595163be372877b098b882deffc8380ac4d404b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:14:42 +0100
+Subject: spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit e811b088a3641861fc9d2b2b840efc61a0f1907d ]
+
+In DMA mode fsl_lpspi_reset() is always called at the end, even when the
+transfer is aborted. In PIO mode aborts skip the reset leaving the FIFO
+filled and the module enabled.
+
+Fix it by always calling fsl_lpspi_reset().
+
+Fixes: a15dc3d657fa ("spi: lpspi: Fix CLK pin becomes low before one transfer")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-3-6262b9aa9be4@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index ca773ca9ed77b..c0e15d8a913df 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -705,12 +705,10 @@ static int fsl_lpspi_pio_transfer(struct spi_controller *controller,
+ fsl_lpspi_write_tx_fifo(fsl_lpspi);
+
+ ret = fsl_lpspi_wait_for_completion(controller);
+- if (ret)
+- return ret;
+
+ fsl_lpspi_reset(fsl_lpspi);
+
+- return 0;
++ return ret;
+ }
+
+ static int fsl_lpspi_transfer_one(struct spi_controller *controller,
+--
+2.51.0
+
--- /dev/null
+From 54951f174b5efa767c53b70d349761ad2c9ce37c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:14:41 +0100
+Subject: spi: spi-fsl-lpspi: Set correct chip-select polarity bit
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit cbe33705864ba2697a2939de715b81538cf32430 ]
+
+The driver currently supports multiple chip-selects, but only sets the
+polarity for the first one (CS 0). Fix it by setting the PCSPOL bit for
+the desired chip-select.
+
+Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-2-6262b9aa9be4@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index e8d915a8914c7..ca773ca9ed77b 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -5,6 +5,7 @@
+ // Copyright 2016 Freescale Semiconductor, Inc.
+ // Copyright 2018, 2023, 2025 NXP
+
++#include <linux/bitfield.h>
+ #include <linux/clk.h>
+ #include <linux/completion.h>
+ #include <linux/delay.h>
+@@ -71,7 +72,7 @@
+ #define DER_TDDE BIT(0)
+ #define CFGR1_PCSCFG BIT(27)
+ #define CFGR1_PINCFG (BIT(24)|BIT(25))
+-#define CFGR1_PCSPOL BIT(8)
++#define CFGR1_PCSPOL_MASK GENMASK(11, 8)
+ #define CFGR1_NOSTALL BIT(3)
+ #define CFGR1_MASTER BIT(0)
+ #define FSR_TXCOUNT (0xFF)
+@@ -395,7 +396,9 @@ static int fsl_lpspi_config(struct fsl_lpspi_data *fsl_lpspi)
+ else
+ temp = CFGR1_PINCFG;
+ if (fsl_lpspi->config.mode & SPI_CS_HIGH)
+- temp |= CFGR1_PCSPOL;
++ temp |= FIELD_PREP(CFGR1_PCSPOL_MASK,
++ BIT(fsl_lpspi->config.chip_select));
++
+ writel(temp, fsl_lpspi->base + IMX7ULP_CFGR1);
+
+ temp = readl(fsl_lpspi->base + IMX7ULP_CR);
+--
+2.51.0
+
--- /dev/null
+From 5d441944e4c823a09ce2a33a677aeb139afc1dca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 14:36:20 +0800
+Subject: tools: gpio: remove the include directory on make clean
+
+From: zhang jiao <zhangjiao2@cmss.chinamobile.com>
+
+[ Upstream commit ed42d80f3bae89592fbb2ffaf8b6b2e720d53f6a ]
+
+Remove the generated include directory when running make clean.
+
+Fixes: 8674cea84dc6 ("tools/gpio: move to tools buildsystem")
+Signed-off-by: Zhang Jiao <zhangjiao2@cmss.chinamobile.com>
+Link: https://lore.kernel.org/r/20250903063621.2424-1-zhangjiao2@cmss.chinamobile.com
+[Bartosz: add Fixes tag, improve the commit message]
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/gpio/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/gpio/Makefile b/tools/gpio/Makefile
+index ed565eb52275f..342e056c8c665 100644
+--- a/tools/gpio/Makefile
++++ b/tools/gpio/Makefile
+@@ -77,7 +77,7 @@ $(OUTPUT)gpio-watch: $(GPIO_WATCH_IN)
+
+ clean:
+ rm -f $(ALL_PROGRAMS)
+- rm -f $(OUTPUT)include/linux/gpio.h
++ rm -rf $(OUTPUT)include
+ find $(or $(OUTPUT),.) -name '*.o' -delete -o -name '\.*.d' -delete -o -name '\.*.cmd' -delete
+
+ install: $(ALL_PROGRAMS)
+--
+2.51.0
+
--- /dev/null
+From 1cd58360d79e97c5af0d45b2c4caad0b800daa42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2024 14:29:42 +0800
+Subject: tools: gpio: rm .*.cmd on make clean
+
+From: zhangjiao <zhangjiao2@cmss.chinamobile.com>
+
+[ Upstream commit 931a36c4138ac418d487bd4db0d03780b46a77ba ]
+
+rm .*.cmd when calling make clean
+
+Signed-off-by: zhangjiao <zhangjiao2@cmss.chinamobile.com>
+Link: https://lore.kernel.org/r/20240829062942.11487-1-zhangjiao2@cmss.chinamobile.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Stable-dep-of: ed42d80f3bae ("tools: gpio: remove the include directory on make clean")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/gpio/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/gpio/Makefile b/tools/gpio/Makefile
+index d29c9c49e2512..ed565eb52275f 100644
+--- a/tools/gpio/Makefile
++++ b/tools/gpio/Makefile
+@@ -78,7 +78,7 @@ $(OUTPUT)gpio-watch: $(GPIO_WATCH_IN)
+ clean:
+ rm -f $(ALL_PROGRAMS)
+ rm -f $(OUTPUT)include/linux/gpio.h
+- find $(or $(OUTPUT),.) -name '*.o' -delete -o -name '\.*.d' -delete
++ find $(or $(OUTPUT),.) -name '*.o' -delete -o -name '\.*.d' -delete -o -name '\.*.cmd' -delete
+
+ install: $(ALL_PROGRAMS)
+ install -d -m 755 $(DESTDIR)$(bindir); \
+--
+2.51.0
+
--- /dev/null
+From 428ca91faf5ab4a8a337f8ddc5bd1ce5bca45cf3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2025 06:47:10 +0100
+Subject: block: add a queue_limits_commit_update_frozen helper
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit aa427d7b73b196f657d6d2cf0e94eff6b883fdef ]
+
+Add a helper that freezes the queue, updates the queue limits and
+unfreezes the queue and convert all open coded versions of that to the
+new helper.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Link: https://lore.kernel.org/r/20250110054726.1499538-3-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: 708e2371f77a ("scsi: sr: Reinstate rotational media flag")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-integrity.c | 4 +---
+ block/blk-settings.c | 24 ++++++++++++++++++++++++
+ block/blk-zoned.c | 7 +------
+ drivers/block/virtio_blk.c | 4 +---
+ drivers/scsi/sd.c | 17 +++++------------
+ drivers/scsi/sr.c | 5 +----
+ include/linux/blkdev.h | 2 ++
+ 7 files changed, 35 insertions(+), 28 deletions(-)
+
+diff --git a/block/blk-integrity.c b/block/blk-integrity.c
+index 83b696ba0cac3..3fe0681399f6e 100644
+--- a/block/blk-integrity.c
++++ b/block/blk-integrity.c
+@@ -218,9 +218,7 @@ static ssize_t flag_store(struct device *dev, const char *page, size_t count,
+ else
+ lim.integrity.flags |= flag;
+
+- blk_mq_freeze_queue(q);
+- err = queue_limits_commit_update(q, &lim);
+- blk_mq_unfreeze_queue(q);
++ err = queue_limits_commit_update_frozen(q, &lim);
+ if (err)
+ return err;
+ return count;
+diff --git a/block/blk-settings.c b/block/blk-settings.c
+index 9ae3eee4b5ae5..f24fffdb6c294 100644
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -444,6 +444,30 @@ int queue_limits_commit_update(struct request_queue *q,
+ }
+ EXPORT_SYMBOL_GPL(queue_limits_commit_update);
+
++/**
++ * queue_limits_commit_update_frozen - commit an atomic update of queue limits
++ * @q: queue to update
++ * @lim: limits to apply
++ *
++ * Apply the limits in @lim that were obtained from queue_limits_start_update()
++ * and updated with the new values by the caller to @q. Freezes the queue
++ * before the update and unfreezes it after.
++ *
++ * Returns 0 if successful, else a negative error code.
++ */
++int queue_limits_commit_update_frozen(struct request_queue *q,
++ struct queue_limits *lim)
++{
++ int ret;
++
++ blk_mq_freeze_queue(q);
++ ret = queue_limits_commit_update(q, lim);
++ blk_mq_unfreeze_queue(q);
++
++ return ret;
++}
++EXPORT_SYMBOL_GPL(queue_limits_commit_update_frozen);
++
+ /**
+ * queue_limits_set - apply queue limits to queue
+ * @q: queue to update
+diff --git a/block/blk-zoned.c b/block/blk-zoned.c
+index 5915fb98ffdce..f1160cc2cf85d 100644
+--- a/block/blk-zoned.c
++++ b/block/blk-zoned.c
+@@ -1510,7 +1510,6 @@ static int disk_update_zone_resources(struct gendisk *disk,
+ unsigned int nr_seq_zones, nr_conv_zones;
+ unsigned int pool_size;
+ struct queue_limits lim;
+- int ret;
+
+ disk->nr_zones = args->nr_zones;
+ disk->zone_capacity = args->zone_capacity;
+@@ -1561,11 +1560,7 @@ static int disk_update_zone_resources(struct gendisk *disk,
+ }
+
+ commit:
+- blk_mq_freeze_queue(q);
+- ret = queue_limits_commit_update(q, &lim);
+- blk_mq_unfreeze_queue(q);
+-
+- return ret;
++ return queue_limits_commit_update_frozen(q, &lim);
+ }
+
+ static int blk_revalidate_conv_zone(struct blk_zone *zone, unsigned int idx,
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index fd6c565f8a507..4bedcb49a73a7 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -1106,9 +1106,7 @@ cache_type_store(struct device *dev, struct device_attribute *attr,
+ lim.features |= BLK_FEAT_WRITE_CACHE;
+ else
+ lim.features &= ~BLK_FEAT_WRITE_CACHE;
+- blk_mq_freeze_queue(disk->queue);
+- i = queue_limits_commit_update(disk->queue, &lim);
+- blk_mq_unfreeze_queue(disk->queue);
++ i = queue_limits_commit_update_frozen(disk->queue, &lim);
+ if (i)
+ return i;
+ return count;
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index e1b06f803a94b..ee1d5dec3bc60 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -177,9 +177,8 @@ cache_type_store(struct device *dev, struct device_attribute *attr,
+
+ lim = queue_limits_start_update(sdkp->disk->queue);
+ sd_set_flush_flag(sdkp, &lim);
+- blk_mq_freeze_queue(sdkp->disk->queue);
+- ret = queue_limits_commit_update(sdkp->disk->queue, &lim);
+- blk_mq_unfreeze_queue(sdkp->disk->queue);
++ ret = queue_limits_commit_update_frozen(sdkp->disk->queue,
++ &lim);
+ if (ret)
+ return ret;
+ return count;
+@@ -483,9 +482,7 @@ provisioning_mode_store(struct device *dev, struct device_attribute *attr,
+
+ lim = queue_limits_start_update(sdkp->disk->queue);
+ sd_config_discard(sdkp, &lim, mode);
+- blk_mq_freeze_queue(sdkp->disk->queue);
+- err = queue_limits_commit_update(sdkp->disk->queue, &lim);
+- blk_mq_unfreeze_queue(sdkp->disk->queue);
++ err = queue_limits_commit_update_frozen(sdkp->disk->queue, &lim);
+ if (err)
+ return err;
+ return count;
+@@ -594,9 +591,7 @@ max_write_same_blocks_store(struct device *dev, struct device_attribute *attr,
+
+ lim = queue_limits_start_update(sdkp->disk->queue);
+ sd_config_write_same(sdkp, &lim);
+- blk_mq_freeze_queue(sdkp->disk->queue);
+- err = queue_limits_commit_update(sdkp->disk->queue, &lim);
+- blk_mq_unfreeze_queue(sdkp->disk->queue);
++ err = queue_limits_commit_update_frozen(sdkp->disk->queue, &lim);
+ if (err)
+ return err;
+ return count;
+@@ -3803,9 +3798,7 @@ static int sd_revalidate_disk(struct gendisk *disk)
+ sd_config_write_same(sdkp, &lim);
+ kfree(buffer);
+
+- blk_mq_freeze_queue(sdkp->disk->queue);
+- err = queue_limits_commit_update(sdkp->disk->queue, &lim);
+- blk_mq_unfreeze_queue(sdkp->disk->queue);
++ err = queue_limits_commit_update_frozen(sdkp->disk->queue, &lim);
+ if (err)
+ return err;
+
+diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
+index 198bec87bb8e7..b17796d5ee665 100644
+--- a/drivers/scsi/sr.c
++++ b/drivers/scsi/sr.c
+@@ -797,10 +797,7 @@ static int get_sectorsize(struct scsi_cd *cd)
+
+ lim = queue_limits_start_update(q);
+ lim.logical_block_size = sector_size;
+- blk_mq_freeze_queue(q);
+- err = queue_limits_commit_update(q, &lim);
+- blk_mq_unfreeze_queue(q);
+- return err;
++ return queue_limits_commit_update_frozen(q, &lim);
+ }
+
+ static int get_capabilities(struct scsi_cd *cd)
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index a901aed77141f..cd9c97f6f9484 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -990,6 +990,8 @@ queue_limits_start_update(struct request_queue *q)
+ mutex_lock(&q->limits_lock);
+ return q->limits;
+ }
++int queue_limits_commit_update_frozen(struct request_queue *q,
++ struct queue_limits *lim);
+ int queue_limits_commit_update(struct request_queue *q,
+ struct queue_limits *lim);
+ int queue_limits_set(struct request_queue *q, struct queue_limits *lim);
+--
+2.51.0
+
--- /dev/null
+From 719f645e0aeb203de503ed35a63fd871720d39f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:40:50 +0100
+Subject: drm/amd/amdgpu: Fix missing error return on kzalloc failure
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 467e00b30dfe75c4cfc2197ceef1fddca06adc25 ]
+
+Currently the kzalloc failure check just sets reports the failure
+and sets the variable ret to -ENOMEM, which is not checked later
+for this specific error. Fix this by just returning -ENOMEM rather
+than setting ret.
+
+Fixes: 4fb930715468 ("drm/amd/amdgpu: remove redundant host to psp cmd buf allocations")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 1ee9d1a0962c13ba5ab7e47d33a80e3b8dc4b52e)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index 3d42f6c3308ed..8553ac4c0ad3f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -433,7 +433,7 @@ static int psp_sw_init(void *handle)
+ psp->cmd = kzalloc(sizeof(struct psp_gfx_cmd_resp), GFP_KERNEL);
+ if (!psp->cmd) {
+ dev_err(adev->dev, "Failed to allocate memory to command buffer!\n");
+- ret = -ENOMEM;
++ return -ENOMEM;
+ }
+
+ adev->psp.xgmi_context.supports_extended_data =
+--
+2.51.0
+
--- /dev/null
+From 684968e8abd0f6856eb55d989c11c6e4c02a450d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 14:23:41 +0200
+Subject: drm/bridge: ti-sn65dsi86: fix REFCLK setting
+
+From: Michael Walle <mwalle@kernel.org>
+
+[ Upstream commit bdd5a14e660062114bdebaef9ad52adf04970a89 ]
+
+The bridge has three bootstrap pins which are sampled to determine the
+frequency of the external reference clock. The driver will also
+(over)write that setting. But it seems this is racy after the bridge is
+enabled. It was observed that although the driver write the correct
+value (by sniffing on the I2C bus), the register has the wrong value.
+The datasheet states that the GPIO lines have to be stable for at least
+5us after asserting the EN signal. Thus, there seems to be some logic
+which samples the GPIO lines and this logic appears to overwrite the
+register value which was set by the driver. Waiting 20us after
+asserting the EN line resolves this issue.
+
+Fixes: a095f15c00e2 ("drm/bridge: add support for sn65dsi86 bridge driver")
+Signed-off-by: Michael Walle <mwalle@kernel.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20250821122341.1257286-1-mwalle@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/ti-sn65dsi86.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+index 4d17d1e1c38b4..9859ec688e567 100644
+--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c
++++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+@@ -375,6 +375,17 @@ static int __maybe_unused ti_sn65dsi86_resume(struct device *dev)
+
+ gpiod_set_value_cansleep(pdata->enable_gpio, 1);
+
++ /*
++ * After EN is deasserted and an external clock is detected, the bridge
++ * will sample GPIO3:1 to determine its frequency. The driver will
++ * overwrite this setting in ti_sn_bridge_set_refclk_freq(). But this is
++ * racy. Thus we have to wait a couple of us. According to the datasheet
++ * the GPIO lines has to be stable at least 5 us (td5) but it seems that
++ * is not enough and the refclk frequency value is still lost or
++ * overwritten by the bridge itself. Waiting for 20us seems to work.
++ */
++ usleep_range(20, 30);
++
+ /*
+ * If we have a reference clock we can enable communication w/ the
+ * panel (including the aux channel) w/out any need for an input clock
+--
+2.51.0
+
--- /dev/null
+From 9eb0f4df7b68677bf4c050fc0a7305e65ca830a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jul 2025 23:17:15 +0300
+Subject: hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM
+
+From: Vadim Pasternak <vadimp@nvidia.com>
+
+[ Upstream commit 1180c79fbf36e4c02e76ae4658509523437e52a4 ]
+
+The fans controlled by the driver can get stuck at 0 RPM if they are
+configured below a 20% duty cycle. The driver tries to avoid this by
+enforcing a minimum duty cycle of 20%, but this is done after the fans
+are registered with the thermal subsystem. This is too late as the
+thermal subsystem can set their current state before the driver is able
+to enforce the minimum duty cycle.
+
+Fix by setting the minimum duty cycle before registering the fans with
+the thermal subsystem.
+
+Fixes: d7efb2ebc7b3 ("hwmon: (mlxreg-fan) Extend driver to support multiply cooling devices")
+Reported-by: Nikolay Aleksandrov <razor@blackwall.org>
+Tested-by: Nikolay Aleksandrov <razor@blackwall.org>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
+Link: https://lore.kernel.org/r/20250730201715.1111133-1-vadimp@nvidia.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/mlxreg-fan.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c
+index a5f89aab3fb4d..c25a54d5b39ad 100644
+--- a/drivers/hwmon/mlxreg-fan.c
++++ b/drivers/hwmon/mlxreg-fan.c
+@@ -561,15 +561,14 @@ static int mlxreg_fan_cooling_config(struct device *dev, struct mlxreg_fan *fan)
+ if (!pwm->connected)
+ continue;
+ pwm->fan = fan;
++ /* Set minimal PWM speed. */
++ pwm->last_hwmon_state = MLXREG_FAN_PWM_DUTY2STATE(MLXREG_FAN_MIN_DUTY);
+ pwm->cdev = devm_thermal_of_cooling_device_register(dev, NULL, mlxreg_fan_name[i],
+ pwm, &mlxreg_fan_cooling_ops);
+ if (IS_ERR(pwm->cdev)) {
+ dev_err(dev, "Failed to register cooling device\n");
+ return PTR_ERR(pwm->cdev);
+ }
+-
+- /* Set minimal PWM speed. */
+- pwm->last_hwmon_state = MLXREG_FAN_PWM_DUTY2STATE(MLXREG_FAN_MIN_DUTY);
+ }
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 339ec34840777937fc0e2e9a6452ac91edc41eff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 15:34:52 +0800
+Subject: md: prevent incorrect update of resync/recovery offset
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 7202082b7b7a256d04ec96131c7f859df0a79f64 ]
+
+In md_do_sync(), when md_sync_action returns ACTION_FROZEN, subsequent
+call to md_sync_position() will return MaxSector. This causes
+'curr_resync' (and later 'recovery_offset') to be set to MaxSector too,
+which incorrectly signals that recovery/resync has completed, even though
+disk data has not actually been updated.
+
+To fix this issue, skip updating any offset values when the sync action
+is FROZEN. The same holds true for IDLE.
+
+Fixes: 7d9f107a4e94 ("md: use new helpers in md_do_sync()")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Link: https://lore.kernel.org/linux-raid/20250904073452.3408516-1-linan666@huaweicloud.com
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 4b32917236703..d263076442924 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -8996,6 +8996,11 @@ void md_do_sync(struct md_thread *thread)
+ }
+
+ action = md_sync_action(mddev);
++ if (action == ACTION_FROZEN || action == ACTION_IDLE) {
++ set_bit(MD_RECOVERY_INTR, &mddev->recovery);
++ goto skip;
++ }
++
+ desc = md_sync_action_name(action);
+ mddev->last_sync_action = action;
+
+--
+2.51.0
+
--- /dev/null
+From 9a9c24d7db6b526c6ec70a0f618a7d62cbff781a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2025 21:10:06 +0800
+Subject: pcmcia: Add error handling for add_interval() in do_validate_mem()
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+[ Upstream commit 4a81f78caa53e0633cf311ca1526377d9bff7479 ]
+
+In the do_validate_mem(), the call to add_interval() does not
+handle errors. If kmalloc() fails in add_interval(), it could
+result in a null pointer being inserted into the linked list,
+leading to illegal memory access when sub_interval() is called
+next.
+
+This patch adds an error handling for the add_interval(). If
+add_interval() returns an error, the function will return early
+with the error code.
+
+Fixes: 7b4884ca8853 ("pcmcia: validate late-added resources")
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pcmcia/rsrc_nonstatic.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c
+index bf9d070a44966..da494fe451baf 100644
+--- a/drivers/pcmcia/rsrc_nonstatic.c
++++ b/drivers/pcmcia/rsrc_nonstatic.c
+@@ -375,7 +375,9 @@ static int do_validate_mem(struct pcmcia_socket *s,
+
+ if (validate && !s->fake_cis) {
+ /* move it to the validated data set */
+- add_interval(&s_data->mem_db_valid, base, size);
++ ret = add_interval(&s_data->mem_db_valid, base, size);
++ if (ret)
++ return ret;
+ sub_interval(&s_data->mem_db, base, size);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 8da52c3cf42ee738d3954516750f39e4c8c21653 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Mar 2025 14:39:56 +0800
+Subject: pcmcia: omap: Add missing check for platform_get_resource
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit ecef14f70ec9344a10c817248d2ac6cddee5921e ]
+
+Add missing check for platform_get_resource() and return error if it fails
+to catch the error.
+
+Fixes: d87d44f7ab35 ("ARM: omap1: move CF chipselect setup to board file")
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pcmcia/omap_cf.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pcmcia/omap_cf.c b/drivers/pcmcia/omap_cf.c
+index 80137c7afe0d9..5b639c942f17a 100644
+--- a/drivers/pcmcia/omap_cf.c
++++ b/drivers/pcmcia/omap_cf.c
+@@ -215,6 +215,8 @@ static int __init omap_cf_probe(struct platform_device *pdev)
+ return -EINVAL;
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (!res)
++ return -EINVAL;
+
+ cf = kzalloc(sizeof *cf, GFP_KERNEL);
+ if (!cf)
+--
+2.51.0
+
--- /dev/null
+From 761a3b784bf54359ad7425b885a06fdcf2019303 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:17:11 -0700
+Subject: perf bpf-event: Fix use-after-free in synthesis
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit d7b67dd6f9db7bd2c49b415e901849b182ff0735 ]
+
+Calls to perf_env__insert_bpf_prog_info may fail as a sideband thread
+may already have inserted the bpf_prog_info. Such failures may yield
+info_linear being freed which then causes use-after-free issues with
+the internal bpf_prog_info info struct. Make it so that
+perf_env__insert_bpf_prog_info trigger early non-error paths and fix
+the use-after-free in perf_event__synthesize_one_bpf_prog. Add proper
+return error handling to perf_env__add_bpf_info (that calls
+perf_env__insert_bpf_prog_info) and propagate the return value in its
+callers.
+
+Closes: https://lore.kernel.org/lkml/CAP-5=fWJQcmUOP7MuCA2ihKnDAHUCOBLkQFEkQES-1ZZTrgf8Q@mail.gmail.com/
+Fixes: 03edb7020bb9 ("perf bpf: Fix two memory leakages when calling perf_env__insert_bpf_prog_info()")
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20250902181713.309797-2-irogers@google.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/bpf-event.c | 39 +++++++++++++++++++++++++------------
+ 1 file changed, 27 insertions(+), 12 deletions(-)
+
+diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c
+index c81444059ad07..d9123c9637baa 100644
+--- a/tools/perf/util/bpf-event.c
++++ b/tools/perf/util/bpf-event.c
+@@ -290,9 +290,15 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_session *session,
+
+ info_node->info_linear = info_linear;
+ if (!perf_env__insert_bpf_prog_info(env, info_node)) {
+- free(info_linear);
++ /*
++ * Insert failed, likely because of a duplicate event
++ * made by the sideband thread. Ignore synthesizing the
++ * metadata.
++ */
+ free(info_node);
++ goto out;
+ }
++ /* info_linear is now owned by info_node and shouldn't be freed below. */
+ info_linear = NULL;
+
+ /*
+@@ -451,18 +457,18 @@ int perf_event__synthesize_bpf_events(struct perf_session *session,
+ return err;
+ }
+
+-static void perf_env__add_bpf_info(struct perf_env *env, u32 id)
++static int perf_env__add_bpf_info(struct perf_env *env, u32 id)
+ {
+ struct bpf_prog_info_node *info_node;
+ struct perf_bpil *info_linear;
+ struct btf *btf = NULL;
+ u64 arrays;
+ u32 btf_id;
+- int fd;
++ int fd, err = 0;
+
+ fd = bpf_prog_get_fd_by_id(id);
+ if (fd < 0)
+- return;
++ return -EINVAL;
+
+ arrays = 1UL << PERF_BPIL_JITED_KSYMS;
+ arrays |= 1UL << PERF_BPIL_JITED_FUNC_LENS;
+@@ -475,6 +481,7 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id)
+ info_linear = get_bpf_prog_info_linear(fd, arrays);
+ if (IS_ERR_OR_NULL(info_linear)) {
+ pr_debug("%s: failed to get BPF program info. aborting\n", __func__);
++ err = PTR_ERR(info_linear);
+ goto out;
+ }
+
+@@ -484,38 +491,46 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id)
+ if (info_node) {
+ info_node->info_linear = info_linear;
+ if (!perf_env__insert_bpf_prog_info(env, info_node)) {
++ pr_debug("%s: duplicate add bpf info request for id %u\n",
++ __func__, btf_id);
+ free(info_linear);
+ free(info_node);
++ goto out;
+ }
+- } else
++ } else {
+ free(info_linear);
++ err = -ENOMEM;
++ goto out;
++ }
+
+ if (btf_id == 0)
+ goto out;
+
+ btf = btf__load_from_kernel_by_id(btf_id);
+- if (libbpf_get_error(btf)) {
+- pr_debug("%s: failed to get BTF of id %u, aborting\n",
+- __func__, btf_id);
+- goto out;
++ if (!btf) {
++ err = -errno;
++ pr_debug("%s: failed to get BTF of id %u %d\n", __func__, btf_id, err);
++ } else {
++ perf_env__fetch_btf(env, btf_id, btf);
+ }
+- perf_env__fetch_btf(env, btf_id, btf);
+
+ out:
+ btf__free(btf);
+ close(fd);
++ return err;
+ }
+
+ static int bpf_event__sb_cb(union perf_event *event, void *data)
+ {
+ struct perf_env *env = data;
++ int ret = 0;
+
+ if (event->header.type != PERF_RECORD_BPF_EVENT)
+ return -1;
+
+ switch (event->bpf.type) {
+ case PERF_BPF_EVENT_PROG_LOAD:
+- perf_env__add_bpf_info(env, event->bpf.id);
++ ret = perf_env__add_bpf_info(env, event->bpf.id);
+
+ case PERF_BPF_EVENT_PROG_UNLOAD:
+ /*
+@@ -529,7 +544,7 @@ static int bpf_event__sb_cb(union perf_event *event, void *data)
+ break;
+ }
+
+- return 0;
++ return ret;
+ }
+
+ int evlist__add_bpf_sb_event(struct evlist *evlist, struct perf_env *env)
+--
+2.51.0
+
--- /dev/null
+From 206745c6f048651ec100ab253520f3dc092cbd10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:17:12 -0700
+Subject: perf bpf-utils: Constify bpil_array_desc
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 1654a0e4d576d9e43fbb10ccf6a1b307c5c18566 ]
+
+The array's contents is a compile time constant. Constify to make the
+code more intention revealing and avoid unintended errors.
+
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20250902181713.309797-3-irogers@google.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Stable-dep-of: 01be43f2a0ea ("perf bpf-utils: Harden get_bpf_prog_info_linear")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/bpf-utils.c | 18 ++++++------------
+ 1 file changed, 6 insertions(+), 12 deletions(-)
+
+diff --git a/tools/perf/util/bpf-utils.c b/tools/perf/util/bpf-utils.c
+index 80b1d2b3729ba..64a5583446964 100644
+--- a/tools/perf/util/bpf-utils.c
++++ b/tools/perf/util/bpf-utils.c
+@@ -20,7 +20,7 @@ struct bpil_array_desc {
+ */
+ };
+
+-static struct bpil_array_desc bpil_array_desc[] = {
++static const struct bpil_array_desc bpil_array_desc[] = {
+ [PERF_BPIL_JITED_INSNS] = {
+ offsetof(struct bpf_prog_info, jited_prog_insns),
+ offsetof(struct bpf_prog_info, jited_prog_len),
+@@ -129,12 +129,10 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+
+ /* step 2: calculate total size of all arrays */
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
++ const struct bpil_array_desc *desc = &bpil_array_desc[i];
+ bool include_array = (arrays & (1UL << i)) > 0;
+- struct bpil_array_desc *desc;
+ __u32 count, size;
+
+- desc = bpil_array_desc + i;
+-
+ /* kernel is too old to support this field */
+ if (info_len < desc->array_offset + sizeof(__u32) ||
+ info_len < desc->count_offset + sizeof(__u32) ||
+@@ -163,13 +161,12 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+ ptr = info_linear->data;
+
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
+- struct bpil_array_desc *desc;
++ const struct bpil_array_desc *desc = &bpil_array_desc[i];
+ __u32 count, size;
+
+ if ((arrays & (1UL << i)) == 0)
+ continue;
+
+- desc = bpil_array_desc + i;
+ count = bpf_prog_info_read_offset_u32(&info, desc->count_offset);
+ size = bpf_prog_info_read_offset_u32(&info, desc->size_offset);
+ bpf_prog_info_set_offset_u32(&info_linear->info,
+@@ -192,13 +189,12 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+
+ /* step 6: verify the data */
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
+- struct bpil_array_desc *desc;
++ const struct bpil_array_desc *desc = &bpil_array_desc[i];
+ __u32 v1, v2;
+
+ if ((arrays & (1UL << i)) == 0)
+ continue;
+
+- desc = bpil_array_desc + i;
+ v1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset);
+ v2 = bpf_prog_info_read_offset_u32(&info_linear->info,
+ desc->count_offset);
+@@ -224,13 +220,12 @@ void bpil_addr_to_offs(struct perf_bpil *info_linear)
+ int i;
+
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
+- struct bpil_array_desc *desc;
++ const struct bpil_array_desc *desc = &bpil_array_desc[i];
+ __u64 addr, offs;
+
+ if ((info_linear->arrays & (1UL << i)) == 0)
+ continue;
+
+- desc = bpil_array_desc + i;
+ addr = bpf_prog_info_read_offset_u64(&info_linear->info,
+ desc->array_offset);
+ offs = addr - ptr_to_u64(info_linear->data);
+@@ -244,13 +239,12 @@ void bpil_offs_to_addr(struct perf_bpil *info_linear)
+ int i;
+
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
+- struct bpil_array_desc *desc;
++ const struct bpil_array_desc *desc = &bpil_array_desc[i];
+ __u64 addr, offs;
+
+ if ((info_linear->arrays & (1UL << i)) == 0)
+ continue;
+
+- desc = bpil_array_desc + i;
+ offs = bpf_prog_info_read_offset_u64(&info_linear->info,
+ desc->array_offset);
+ addr = offs + ptr_to_u64(info_linear->data);
+--
+2.51.0
+
--- /dev/null
+From c12872e189eefe9d7bcfdb5edfef2dfee3ceeded Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:17:13 -0700
+Subject: perf bpf-utils: Harden get_bpf_prog_info_linear
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 01be43f2a0eaeed83e94dee054742f37625c86d9 ]
+
+In get_bpf_prog_info_linear two calls to bpf_obj_get_info_by_fd are
+made, the first to compute memory requirements for a struct perf_bpil
+and the second to fill it in. Previously the code would warn when the
+second call didn't match the first. Such races can be common place in
+things like perf test, whose perf trace tests will frequently load BPF
+programs. Rather than a debug message, return actual errors for this
+case. Out of paranoia also validate the read bpf_prog_info array
+value. Change the type of ptr to avoid mismatched pointer type
+compiler warnings. Add some additional debug print outs and sanity
+asserts.
+
+Closes: https://lore.kernel.org/lkml/CAP-5=fWJQcmUOP7MuCA2ihKnDAHUCOBLkQFEkQES-1ZZTrgf8Q@mail.gmail.com/
+Fixes: 6ac22d036f86 ("perf bpf: Pull in bpf_program__get_prog_info_linear()")
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20250902181713.309797-4-irogers@google.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/bpf-utils.c | 43 ++++++++++++++++++++++++++++---------
+ 1 file changed, 33 insertions(+), 10 deletions(-)
+
+diff --git a/tools/perf/util/bpf-utils.c b/tools/perf/util/bpf-utils.c
+index 64a5583446964..5a66dc8594aa8 100644
+--- a/tools/perf/util/bpf-utils.c
++++ b/tools/perf/util/bpf-utils.c
+@@ -115,7 +115,7 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+ __u32 info_len = sizeof(info);
+ __u32 data_len = 0;
+ int i, err;
+- void *ptr;
++ __u8 *ptr;
+
+ if (arrays >> PERF_BPIL_LAST_ARRAY)
+ return ERR_PTR(-EINVAL);
+@@ -126,6 +126,8 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+ pr_debug("can't get prog info: %s", strerror(errno));
+ return ERR_PTR(-EFAULT);
+ }
++ if (info.type >= __MAX_BPF_PROG_TYPE)
++ pr_debug("%s:%d: unexpected program type %u\n", __func__, __LINE__, info.type);
+
+ /* step 2: calculate total size of all arrays */
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
+@@ -173,6 +175,8 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+ desc->count_offset, count);
+ bpf_prog_info_set_offset_u32(&info_linear->info,
+ desc->size_offset, size);
++ assert(ptr >= info_linear->data);
++ assert(ptr < &info_linear->data[data_len]);
+ bpf_prog_info_set_offset_u64(&info_linear->info,
+ desc->array_offset,
+ ptr_to_u64(ptr));
+@@ -186,26 +190,45 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+ free(info_linear);
+ return ERR_PTR(-EFAULT);
+ }
++ if (info_linear->info.type >= __MAX_BPF_PROG_TYPE) {
++ pr_debug("%s:%d: unexpected program type %u\n",
++ __func__, __LINE__, info_linear->info.type);
++ }
+
+ /* step 6: verify the data */
++ ptr = info_linear->data;
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
+ const struct bpil_array_desc *desc = &bpil_array_desc[i];
+- __u32 v1, v2;
++ __u32 count1, count2, size1, size2;
++ __u64 ptr2;
+
+ if ((arrays & (1UL << i)) == 0)
+ continue;
+
+- v1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset);
+- v2 = bpf_prog_info_read_offset_u32(&info_linear->info,
++ count1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset);
++ count2 = bpf_prog_info_read_offset_u32(&info_linear->info,
+ desc->count_offset);
+- if (v1 != v2)
+- pr_warning("%s: mismatch in element count\n", __func__);
++ if (count1 != count2) {
++ pr_warning("%s: mismatch in element count %u vs %u\n", __func__, count1, count2);
++ free(info_linear);
++ return ERR_PTR(-ERANGE);
++ }
+
+- v1 = bpf_prog_info_read_offset_u32(&info, desc->size_offset);
+- v2 = bpf_prog_info_read_offset_u32(&info_linear->info,
++ size1 = bpf_prog_info_read_offset_u32(&info, desc->size_offset);
++ size2 = bpf_prog_info_read_offset_u32(&info_linear->info,
+ desc->size_offset);
+- if (v1 != v2)
+- pr_warning("%s: mismatch in rec size\n", __func__);
++ if (size1 != size2) {
++ pr_warning("%s: mismatch in rec size %u vs %u\n", __func__, size1, size2);
++ free(info_linear);
++ return ERR_PTR(-ERANGE);
++ }
++ ptr2 = bpf_prog_info_read_offset_u64(&info_linear->info, desc->array_offset);
++ if (ptr_to_u64(ptr) != ptr2) {
++ pr_warning("%s: mismatch in array %p vs %llx\n", __func__, ptr, ptr2);
++ free(info_linear);
++ return ERR_PTR(-ERANGE);
++ }
++ ptr += roundup(count1 * size1, sizeof(__u64));
+ }
+
+ /* step 7: update info_len and data_len */
+--
+2.51.0
+
--- /dev/null
+From dd731f45df7f3f4481f43ca46ef04b87d981a954 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 17:47:09 +0200
+Subject: platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Antheas Kapenekakis <lkml@antheas.dev>
+
+[ Upstream commit cf3940ac737d05c85395f343fe33a3cfcadb47db ]
+
+Currently, the ignore_key_wlan quirk applies to keycodes 0x5D, 0x5E, and
+0x5F. However, the relevant code for the Asus Zenbook Duo is only 0x5F.
+Since this code is emitted by other Asus devices, such as from the Z13
+for its ROG button, remove the extra codes before expanding the quirk.
+
+For the Duo devices, which are the only ones that use this quirk, there
+should be no effect.
+
+Fixes: 9286dfd5735b ("platform/x86: asus-wmi: Fix spurious rfkill on UX8406MA")
+Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
+Link: https://lore.kernel.org/r/20250808154710.8981-1-lkml@antheas.dev
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/asus-nb-wmi.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
+index 90ad0045fec5f..8f06adf828361 100644
+--- a/drivers/platform/x86/asus-nb-wmi.c
++++ b/drivers/platform/x86/asus-nb-wmi.c
+@@ -654,8 +654,6 @@ static void asus_nb_wmi_key_filter(struct asus_wmi_driver *asus_wmi, int *code,
+ if (atkbd_reports_vol_keys)
+ *code = ASUS_WMI_KEY_IGNORE;
+ break;
+- case 0x5D: /* Wireless console Toggle */
+- case 0x5E: /* Wireless console Enable */
+ case 0x5F: /* Wireless console Disable */
+ if (quirks->ignore_key_wlan)
+ *code = ASUS_WMI_KEY_IGNORE;
+--
+2.51.0
+
--- /dev/null
+From 33261cd0a8b1621d9bdd7536a57475823a562d50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 07:38:59 -0400
+Subject: platform/x86/intel: power-domains: Use topology_logical_package_id()
+ for package ID
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David Arcari <darcari@redhat.com>
+
+[ Upstream commit aa28991fd5dc4c01a40caab2bd9af8c5e06f9899 ]
+
+Currently, tpmi_get_logical_id() calls topology_physical_package_id()
+to set the pkg_id of the info structure. Since some VM hosts assign non
+contiguous package IDs, topology_physical_package_id() can return a
+larger value than topology_max_packages(). This will result in an
+invalid reference into tpmi_power_domain_mask[] as that is allocatead
+based on topology_max_packages() as the maximum package ID.
+
+Fixes: 17ca2780458c ("platform/x86/intel: TPMI domain id and CPU mapping")
+Signed-off-by: David Arcari <darcari@redhat.com>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Link: https://lore.kernel.org/r/20250829113859.1772827-1-darcari@redhat.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/tpmi_power_domains.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/intel/tpmi_power_domains.c b/drivers/platform/x86/intel/tpmi_power_domains.c
+index 12fb0943b5dc3..7e0b86535d02c 100644
+--- a/drivers/platform/x86/intel/tpmi_power_domains.c
++++ b/drivers/platform/x86/intel/tpmi_power_domains.c
+@@ -167,7 +167,7 @@ static int tpmi_get_logical_id(unsigned int cpu, struct tpmi_cpu_info *info)
+
+ info->punit_thread_id = FIELD_GET(LP_ID_MASK, data);
+ info->punit_core_id = FIELD_GET(MODULE_ID_MASK, data);
+- info->pkg_id = topology_physical_package_id(cpu);
++ info->pkg_id = topology_logical_package_id(cpu);
+ info->linux_cpu = cpu;
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 1b100d93085c2f3045427baa6d9587fd845212b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 19:35:50 +0800
+Subject: scsi: sr: Reinstate rotational media flag
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 708e2371f77a9d3f2f1d54d1ec835d71b9d0dafe ]
+
+Reinstate the rotational media flag for the CD-ROM driver. The flag has
+been cleared since commit bd4a633b6f7c ("block: move the nonrot flag to
+queue_limits") and this breaks some applications.
+
+Move queue limit configuration from get_sectorsize() to
+sr_revalidate_disk() and set the rotational flag.
+
+Cc: Christoph Hellwig <hch@lst.de>
+Fixes: bd4a633b6f7c ("block: move the nonrot flag to queue_limits")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20250827113550.2614535-1-ming.lei@redhat.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/sr.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
+index b17796d5ee665..add13e3068983 100644
+--- a/drivers/scsi/sr.c
++++ b/drivers/scsi/sr.c
+@@ -475,13 +475,21 @@ static blk_status_t sr_init_command(struct scsi_cmnd *SCpnt)
+
+ static int sr_revalidate_disk(struct scsi_cd *cd)
+ {
++ struct request_queue *q = cd->device->request_queue;
+ struct scsi_sense_hdr sshdr;
++ struct queue_limits lim;
++ int sector_size;
+
+ /* if the unit is not ready, nothing more to do */
+ if (scsi_test_unit_ready(cd->device, SR_TIMEOUT, MAX_RETRIES, &sshdr))
+ return 0;
+ sr_cd_check(&cd->cdi);
+- return get_sectorsize(cd);
++ sector_size = get_sectorsize(cd);
++
++ lim = queue_limits_start_update(q);
++ lim.logical_block_size = sector_size;
++ lim.features |= BLK_FEAT_ROTATIONAL;
++ return queue_limits_commit_update_frozen(q, &lim);
+ }
+
+ static int sr_block_open(struct gendisk *disk, blk_mode_t mode)
+@@ -721,10 +729,8 @@ static int sr_probe(struct device *dev)
+
+ static int get_sectorsize(struct scsi_cd *cd)
+ {
+- struct request_queue *q = cd->device->request_queue;
+ static const u8 cmd[10] = { READ_CAPACITY };
+ unsigned char buffer[8] = { };
+- struct queue_limits lim;
+ int err;
+ int sector_size;
+ struct scsi_failure failure_defs[] = {
+@@ -795,9 +801,7 @@ static int get_sectorsize(struct scsi_cd *cd)
+ set_capacity(cd->disk, cd->capacity);
+ }
+
+- lim = queue_limits_start_update(q);
+- lim.logical_block_size = sector_size;
+- return queue_limits_commit_update_frozen(q, &lim);
++ return sector_size;
+ }
+
+ static int get_capabilities(struct scsi_cd *cd)
+--
+2.51.0
+
alsa-hda-hdmi-add-pin-fix-for-another-hp-elitedesk-800-g4-model.patch
alsa-hda-realtek-fix-headset-mic-for-tongfang-x6r5xxy.patch
revert-drm-amdgpu-avoid-extra-evict-restore-process.patch
+pcmcia-omap-add-missing-check-for-platform_get_resou.patch
+pcmcia-add-error-handling-for-add_interval-in-do_val.patch
+platform-x86-asus-wmi-remove-extra-keys-from-ignore_.patch
+platform-x86-intel-power-domains-use-topology_logica.patch
+hwmon-mlxreg-fan-prevent-fans-from-getting-stuck-at-.patch
+block-add-a-queue_limits_commit_update_frozen-helper.patch
+scsi-sr-reinstate-rotational-media-flag.patch
+spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch
+spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch
+spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch
+spi-spi-fsl-lpspi-clear-status-register-after-disabl.patch
+drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch
+perf-bpf-event-fix-use-after-free-in-synthesis.patch
+perf-bpf-utils-constify-bpil_array_desc.patch
+perf-bpf-utils-harden-get_bpf_prog_info_linear.patch
+drm-amd-amdgpu-fix-missing-error-return-on-kzalloc-f.patch
+tools-gpio-remove-the-include-directory-on-make-clea.patch
+md-prevent-incorrect-update-of-resync-recovery-offse.patch
--- /dev/null
+From 1d390f8d080ec585a5477958f3ad529e7075f5d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:14:43 +0100
+Subject: spi: spi-fsl-lpspi: Clear status register after disabling the module
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit dedf9c93dece441e9a0a4836458bc93677008ddd ]
+
+Clear the error flags after disabling the module to avoid the case when
+a flag is set again between flag clear and module disable. And use
+SR_CLEAR_MASK to replace hardcoded value for improved readability.
+
+Although fsl_lpspi_reset() was only introduced in commit a15dc3d657fa
+("spi: lpspi: Fix CLK pin becomes low before one transfer"), the
+original driver only reset SR in the interrupt handler, making it
+vulnerable to the same issue. Therefore the fixes commit is set at the
+introduction of the driver.
+
+Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: Ciprian Marian Costea <ciprianmarian.costea@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-4-6262b9aa9be4@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index 2843b559e9413..5e96913fd9466 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -83,6 +83,8 @@
+ #define TCR_RXMSK BIT(19)
+ #define TCR_TXMSK BIT(18)
+
++#define SR_CLEAR_MASK GENMASK(13, 8)
++
+ struct fsl_lpspi_devtype_data {
+ u8 prescale_max;
+ };
+@@ -532,14 +534,13 @@ static int fsl_lpspi_reset(struct fsl_lpspi_data *fsl_lpspi)
+ fsl_lpspi_intctrl(fsl_lpspi, 0);
+ }
+
+- /* W1C for all flags in SR */
+- temp = 0x3F << 8;
+- writel(temp, fsl_lpspi->base + IMX7ULP_SR);
+-
+ /* Clear FIFO and disable module */
+ temp = CR_RRF | CR_RTF;
+ writel(temp, fsl_lpspi->base + IMX7ULP_CR);
+
++ /* W1C for all flags in SR */
++ writel(SR_CLEAR_MASK, fsl_lpspi->base + IMX7ULP_SR);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 53dbd9828d5e4486481fe64746778a82dd8c7b95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:14:40 +0100
+Subject: spi: spi-fsl-lpspi: Fix transmissions when using CONT
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit 782a7c73078e1301c0c427f21c06377d77dfa541 ]
+
+Commit 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use
+CONT") breaks transmissions when CONT is used. The TDIE interrupt should
+not be disabled in all cases. If CONT is used and the TX transfer is not
+yet completed yet, but the interrupt handler is called because there are
+characters to be received, TDIE is replaced with FCIE. When the transfer
+is finally completed, SR_TDF is set but the interrupt handler isn't
+called again.
+
+Fixes: 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use CONT")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-1-6262b9aa9be4@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index f8cacb9c7408f..50633115e83dd 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -3,7 +3,7 @@
+ // Freescale i.MX7ULP LPSPI driver
+ //
+ // Copyright 2016 Freescale Semiconductor, Inc.
+-// Copyright 2018 NXP Semiconductors
++// Copyright 2018, 2023, 2025 NXP
+
+ #include <linux/clk.h>
+ #include <linux/completion.h>
+@@ -780,7 +780,7 @@ static irqreturn_t fsl_lpspi_isr(int irq, void *dev_id)
+ if (temp_SR & SR_MBF ||
+ readl(fsl_lpspi->base + IMX7ULP_FSR) & FSR_TXCOUNT) {
+ writel(SR_FCF, fsl_lpspi->base + IMX7ULP_SR);
+- fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE);
++ fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE | (temp_IER & IER_TDIE));
+ return IRQ_HANDLED;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From f1b6916607045493ca6ca79ce1388d395ea34fe8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:14:42 +0100
+Subject: spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit e811b088a3641861fc9d2b2b840efc61a0f1907d ]
+
+In DMA mode fsl_lpspi_reset() is always called at the end, even when the
+transfer is aborted. In PIO mode aborts skip the reset leaving the FIFO
+filled and the module enabled.
+
+Fix it by always calling fsl_lpspi_reset().
+
+Fixes: a15dc3d657fa ("spi: lpspi: Fix CLK pin becomes low before one transfer")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-3-6262b9aa9be4@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index 9d05d18451c6d..2843b559e9413 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -730,12 +730,10 @@ static int fsl_lpspi_pio_transfer(struct spi_controller *controller,
+ fsl_lpspi_write_tx_fifo(fsl_lpspi);
+
+ ret = fsl_lpspi_wait_for_completion(controller);
+- if (ret)
+- return ret;
+
+ fsl_lpspi_reset(fsl_lpspi);
+
+- return 0;
++ return ret;
+ }
+
+ static int fsl_lpspi_transfer_one(struct spi_controller *controller,
+--
+2.51.0
+
--- /dev/null
+From fbadc6ce62f34f08771a0961e22c578a130a82ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:14:41 +0100
+Subject: spi: spi-fsl-lpspi: Set correct chip-select polarity bit
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit cbe33705864ba2697a2939de715b81538cf32430 ]
+
+The driver currently supports multiple chip-selects, but only sets the
+polarity for the first one (CS 0). Fix it by setting the PCSPOL bit for
+the desired chip-select.
+
+Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-2-6262b9aa9be4@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index 50633115e83dd..9d05d18451c6d 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -5,6 +5,7 @@
+ // Copyright 2016 Freescale Semiconductor, Inc.
+ // Copyright 2018, 2023, 2025 NXP
+
++#include <linux/bitfield.h>
+ #include <linux/clk.h>
+ #include <linux/completion.h>
+ #include <linux/delay.h>
+@@ -70,7 +71,7 @@
+ #define DER_TDDE BIT(0)
+ #define CFGR1_PCSCFG BIT(27)
+ #define CFGR1_PINCFG (BIT(24)|BIT(25))
+-#define CFGR1_PCSPOL BIT(8)
++#define CFGR1_PCSPOL_MASK GENMASK(11, 8)
+ #define CFGR1_NOSTALL BIT(3)
+ #define CFGR1_HOST BIT(0)
+ #define FSR_TXCOUNT (0xFF)
+@@ -420,7 +421,9 @@ static int fsl_lpspi_config(struct fsl_lpspi_data *fsl_lpspi)
+ else
+ temp = CFGR1_PINCFG;
+ if (fsl_lpspi->config.mode & SPI_CS_HIGH)
+- temp |= CFGR1_PCSPOL;
++ temp |= FIELD_PREP(CFGR1_PCSPOL_MASK,
++ BIT(fsl_lpspi->config.chip_select));
++
+ writel(temp, fsl_lpspi->base + IMX7ULP_CFGR1);
+
+ temp = readl(fsl_lpspi->base + IMX7ULP_CR);
+--
+2.51.0
+
--- /dev/null
+From ab54bc3ea045c3d0826972232bda30a472f6db5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 14:36:20 +0800
+Subject: tools: gpio: remove the include directory on make clean
+
+From: zhang jiao <zhangjiao2@cmss.chinamobile.com>
+
+[ Upstream commit ed42d80f3bae89592fbb2ffaf8b6b2e720d53f6a ]
+
+Remove the generated include directory when running make clean.
+
+Fixes: 8674cea84dc6 ("tools/gpio: move to tools buildsystem")
+Signed-off-by: Zhang Jiao <zhangjiao2@cmss.chinamobile.com>
+Link: https://lore.kernel.org/r/20250903063621.2424-1-zhangjiao2@cmss.chinamobile.com
+[Bartosz: add Fixes tag, improve the commit message]
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/gpio/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/gpio/Makefile b/tools/gpio/Makefile
+index ed565eb52275f..342e056c8c665 100644
+--- a/tools/gpio/Makefile
++++ b/tools/gpio/Makefile
+@@ -77,7 +77,7 @@ $(OUTPUT)gpio-watch: $(GPIO_WATCH_IN)
+
+ clean:
+ rm -f $(ALL_PROGRAMS)
+- rm -f $(OUTPUT)include/linux/gpio.h
++ rm -rf $(OUTPUT)include
+ find $(or $(OUTPUT),.) -name '*.o' -delete -o -name '\.*.d' -delete -o -name '\.*.cmd' -delete
+
+ install: $(ALL_PROGRAMS)
+--
+2.51.0
+
--- /dev/null
+From 2a68f439cee1f366f69c761a8eaebf11cce2299c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:40:50 +0100
+Subject: drm/amd/amdgpu: Fix missing error return on kzalloc failure
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 467e00b30dfe75c4cfc2197ceef1fddca06adc25 ]
+
+Currently the kzalloc failure check just sets reports the failure
+and sets the variable ret to -ENOMEM, which is not checked later
+for this specific error. Fix this by just returning -ENOMEM rather
+than setting ret.
+
+Fixes: 4fb930715468 ("drm/amd/amdgpu: remove redundant host to psp cmd buf allocations")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 1ee9d1a0962c13ba5ab7e47d33a80e3b8dc4b52e)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index 7d8b98aa5271c..f9ceda7861f1b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -447,7 +447,7 @@ static int psp_sw_init(struct amdgpu_ip_block *ip_block)
+ psp->cmd = kzalloc(sizeof(struct psp_gfx_cmd_resp), GFP_KERNEL);
+ if (!psp->cmd) {
+ dev_err(adev->dev, "Failed to allocate memory to command buffer!\n");
+- ret = -ENOMEM;
++ return -ENOMEM;
+ }
+
+ adev->psp.xgmi_context.supports_extended_data =
+--
+2.51.0
+
--- /dev/null
+From 9dc8c01c43d3352012b09a4eda3ec2990c0e9490 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 14:23:41 +0200
+Subject: drm/bridge: ti-sn65dsi86: fix REFCLK setting
+
+From: Michael Walle <mwalle@kernel.org>
+
+[ Upstream commit bdd5a14e660062114bdebaef9ad52adf04970a89 ]
+
+The bridge has three bootstrap pins which are sampled to determine the
+frequency of the external reference clock. The driver will also
+(over)write that setting. But it seems this is racy after the bridge is
+enabled. It was observed that although the driver write the correct
+value (by sniffing on the I2C bus), the register has the wrong value.
+The datasheet states that the GPIO lines have to be stable for at least
+5us after asserting the EN signal. Thus, there seems to be some logic
+which samples the GPIO lines and this logic appears to overwrite the
+register value which was set by the driver. Waiting 20us after
+asserting the EN line resolves this issue.
+
+Fixes: a095f15c00e2 ("drm/bridge: add support for sn65dsi86 bridge driver")
+Signed-off-by: Michael Walle <mwalle@kernel.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20250821122341.1257286-1-mwalle@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/ti-sn65dsi86.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+index 834b42a4d31f8..4545ac42778ab 100644
+--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c
++++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+@@ -392,6 +392,17 @@ static int __maybe_unused ti_sn65dsi86_resume(struct device *dev)
+
+ gpiod_set_value_cansleep(pdata->enable_gpio, 1);
+
++ /*
++ * After EN is deasserted and an external clock is detected, the bridge
++ * will sample GPIO3:1 to determine its frequency. The driver will
++ * overwrite this setting in ti_sn_bridge_set_refclk_freq(). But this is
++ * racy. Thus we have to wait a couple of us. According to the datasheet
++ * the GPIO lines has to be stable at least 5 us (td5) but it seems that
++ * is not enough and the refclk frequency value is still lost or
++ * overwritten by the bridge itself. Waiting for 20us seems to work.
++ */
++ usleep_range(20, 30);
++
+ /*
+ * If we have a reference clock we can enable communication w/ the
+ * panel (including the aux channel) w/out any need for an input clock
+--
+2.51.0
+
--- /dev/null
+From 1bbad472fe51a31f2977ab920ccb4f1bde236ad9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 May 2025 21:22:15 +0200
+Subject: drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+[ Upstream commit d6e020819612a4a06207af858e0978be4d3e3140 ]
+
+The intel-media-driver is currently broken on DG1 because
+it uses EXEC_CAPTURE with recovarable contexts. Relax the
+check to allow that.
+
+I've also submitted a fix for the intel-media-driver:
+https://github.com/intel/media-driver/pull/1920
+
+Cc: stable@vger.kernel.org # v6.0+
+Cc: Matthew Auld <matthew.auld@intel.com>
+Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Testcase: igt/gem_exec_capture/capture-invisible
+Fixes: 71b1669ea9bd ("drm/i915/uapi: tweak error capture on recoverable contexts")
+Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Link: https://lore.kernel.org/r/20250411144313.11660-2-ville.syrjala@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
+index ca7e9216934a7..ea9d5063ce78c 100644
+--- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
+@@ -2013,7 +2013,7 @@ static int eb_capture_stage(struct i915_execbuffer *eb)
+ continue;
+
+ if (i915_gem_context_is_recoverable(eb->gem_context) &&
+- (IS_DGFX(eb->i915) || GRAPHICS_VER_FULL(eb->i915) > IP_VER(12, 0)))
++ GRAPHICS_VER_FULL(eb->i915) > IP_VER(12, 10))
+ return -EINVAL;
+
+ for_each_batch_create_order(eb, j) {
+--
+2.51.0
+
--- /dev/null
+From fb2e15e3ff917f56bd5e386be0b8ef6a546fd212 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 11:51:20 -0700
+Subject: hwmon: (ina238) Correctly clamp power limits
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit c2623573178bab32990695fb729e9b69710ed66d ]
+
+ina238_write_power() was attempting to clamp the user input but was
+throwing away the result. Ensure that we clamp the value to the
+appropriate range before it is converted into a register value.
+
+Fixes: 0d9f596b1fe34 ("hwmon: (ina238) Modify the calculation formula to adapt to different chips")
+Cc: Wenliang Yan <wenliang202407@163.com>
+Cc: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/ina238.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/ina238.c b/drivers/hwmon/ina238.c
+index 0562f9a4dcf12..5c90c3e59f80c 100644
+--- a/drivers/hwmon/ina238.c
++++ b/drivers/hwmon/ina238.c
+@@ -426,9 +426,10 @@ static int ina238_write_power(struct device *dev, u32 attr, long val)
+ * Unsigned postive values. Compared against the 24-bit power register,
+ * lower 8-bits are truncated. Same conversion to/from uW as POWER
+ * register.
++ * The first clamp_val() is to establish a baseline to avoid overflows.
+ */
+- regval = clamp_val(val, 0, LONG_MAX);
+- regval = div_u64(val * 4 * 100 * data->rshunt, data->config->power_calculate_factor *
++ regval = clamp_val(val, 0, LONG_MAX / 2);
++ regval = div_u64(regval * 4 * 100 * data->rshunt, data->config->power_calculate_factor *
+ 1000ULL * INA238_FIXED_SHUNT * data->gain);
+ regval = clamp_val(regval >> 8, 0, U16_MAX);
+
+--
+2.51.0
+
--- /dev/null
+From c74393a2905820430e2be306b9a3e4e2089f2d2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 06:49:51 -0700
+Subject: hwmon: (ina238) Correctly clamp shunt voltage limit
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit bd7e7bc2cc2024035dfbc8239c9f4d8675793445 ]
+
+When clamping a register value, the result needs to be masked against the
+register size. This was missing, resulting in errors when trying to write
+negative limits. Fix by masking the clamping result against the register
+size.
+
+Fixes: eacb52f010a80 ("hwmon: Driver for Texas Instruments INA238")
+Cc: Nathan Rossi <nathan.rossi@digi.com>
+Cc: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/ina238.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/ina238.c b/drivers/hwmon/ina238.c
+index a2cb615fa2789..0562f9a4dcf12 100644
+--- a/drivers/hwmon/ina238.c
++++ b/drivers/hwmon/ina238.c
+@@ -300,7 +300,7 @@ static int ina238_write_in(struct device *dev, u32 attr, int channel,
+ regval = clamp_val(val, -163, 163);
+ regval = (regval * 1000 * 4) /
+ (INA238_SHUNT_VOLTAGE_LSB * data->gain);
+- regval = clamp_val(regval, S16_MIN, S16_MAX);
++ regval = clamp_val(regval, S16_MIN, S16_MAX) & 0xffff;
+
+ switch (attr) {
+ case hwmon_in_max:
+--
+2.51.0
+
--- /dev/null
+From ace49179ecbdb79d21973db7e0ce8465823864e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 15:05:10 +1200
+Subject: hwmon: (ina238) Correctly clamp temperature
+
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+
+[ Upstream commit 98fd069dd87386d87eaf439e3c7b5767618926d2 ]
+
+ina238_write_temp() was attempting to clamp the user input but was
+throwing away the result. Ensure that we clamp the value to the
+appropriate range before it is converted into a register value.
+
+Fixes: 0d9f596b1fe3 ("hwmon: (ina238) Modify the calculation formula to adapt to different chips")
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Link: https://lore.kernel.org/r/20250829030512.1179998-3-chris.packham@alliedtelesis.co.nz
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/ina238.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/ina238.c b/drivers/hwmon/ina238.c
+index 9a5fd16a4ec2a..a2cb615fa2789 100644
+--- a/drivers/hwmon/ina238.c
++++ b/drivers/hwmon/ina238.c
+@@ -481,7 +481,7 @@ static int ina238_write_temp(struct device *dev, u32 attr, long val)
+ return -EOPNOTSUPP;
+
+ /* Signed */
+- regval = clamp_val(val, -40000, 125000);
++ val = clamp_val(val, -40000, 125000);
+ regval = div_s64(val * 10000, data->config->temp_lsb) << data->config->temp_shift;
+ regval = clamp_val(regval, S16_MIN, S16_MAX) & (0xffff << data->config->temp_shift);
+
+--
+2.51.0
+
--- /dev/null
+From 7d731c107747a9bec17bf269e137e8ce0f96d1d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jul 2025 23:17:15 +0300
+Subject: hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM
+
+From: Vadim Pasternak <vadimp@nvidia.com>
+
+[ Upstream commit 1180c79fbf36e4c02e76ae4658509523437e52a4 ]
+
+The fans controlled by the driver can get stuck at 0 RPM if they are
+configured below a 20% duty cycle. The driver tries to avoid this by
+enforcing a minimum duty cycle of 20%, but this is done after the fans
+are registered with the thermal subsystem. This is too late as the
+thermal subsystem can set their current state before the driver is able
+to enforce the minimum duty cycle.
+
+Fix by setting the minimum duty cycle before registering the fans with
+the thermal subsystem.
+
+Fixes: d7efb2ebc7b3 ("hwmon: (mlxreg-fan) Extend driver to support multiply cooling devices")
+Reported-by: Nikolay Aleksandrov <razor@blackwall.org>
+Tested-by: Nikolay Aleksandrov <razor@blackwall.org>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
+Link: https://lore.kernel.org/r/20250730201715.1111133-1-vadimp@nvidia.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/mlxreg-fan.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c
+index a5f89aab3fb4d..c25a54d5b39ad 100644
+--- a/drivers/hwmon/mlxreg-fan.c
++++ b/drivers/hwmon/mlxreg-fan.c
+@@ -561,15 +561,14 @@ static int mlxreg_fan_cooling_config(struct device *dev, struct mlxreg_fan *fan)
+ if (!pwm->connected)
+ continue;
+ pwm->fan = fan;
++ /* Set minimal PWM speed. */
++ pwm->last_hwmon_state = MLXREG_FAN_PWM_DUTY2STATE(MLXREG_FAN_MIN_DUTY);
+ pwm->cdev = devm_thermal_of_cooling_device_register(dev, NULL, mlxreg_fan_name[i],
+ pwm, &mlxreg_fan_cooling_ops);
+ if (IS_ERR(pwm->cdev)) {
+ dev_err(dev, "Failed to register cooling device\n");
+ return PTR_ERR(pwm->cdev);
+ }
+-
+- /* Set minimal PWM speed. */
+- pwm->last_hwmon_state = MLXREG_FAN_PWM_DUTY2STATE(MLXREG_FAN_MIN_DUTY);
+ }
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 04c99469b7884bedc565d75a65d37472ca73b85f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 15:34:52 +0800
+Subject: md: prevent incorrect update of resync/recovery offset
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 7202082b7b7a256d04ec96131c7f859df0a79f64 ]
+
+In md_do_sync(), when md_sync_action returns ACTION_FROZEN, subsequent
+call to md_sync_position() will return MaxSector. This causes
+'curr_resync' (and later 'recovery_offset') to be set to MaxSector too,
+which incorrectly signals that recovery/resync has completed, even though
+disk data has not actually been updated.
+
+To fix this issue, skip updating any offset values when the sync action
+is FROZEN. The same holds true for IDLE.
+
+Fixes: 7d9f107a4e94 ("md: use new helpers in md_do_sync()")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Link: https://lore.kernel.org/linux-raid/20250904073452.3408516-1-linan666@huaweicloud.com
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 8746b22060a7c..3f355bb85797f 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -9089,6 +9089,11 @@ void md_do_sync(struct md_thread *thread)
+ }
+
+ action = md_sync_action(mddev);
++ if (action == ACTION_FROZEN || action == ACTION_IDLE) {
++ set_bit(MD_RECOVERY_INTR, &mddev->recovery);
++ goto skip;
++ }
++
+ desc = md_sync_action_name(action);
+ mddev->last_sync_action = action;
+
+--
+2.51.0
+
--- /dev/null
+From 67ad16feec1671bc71afe83a65089ef017efc8c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 09:41:40 +0800
+Subject: md/raid1: fix data lost for writemostly rdev
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 93dec51e716db88f32d770dc9ab268964fff320b ]
+
+If writemostly is enabled, alloc_behind_master_bio() will allocate a new
+bio for rdev, with bi_opf set to 0. Later, raid1_write_request() will
+clone from this bio, hence bi_opf is still 0 for the cloned bio. Submit
+this cloned bio will end up to be read, causing write data lost.
+
+Fix this problem by inheriting bi_opf from original bio for
+behind_mast_bio.
+
+Fixes: e879a0d9cb08 ("md/raid1,raid10: don't ignore IO flags")
+Reported-and-tested-by: Ian Dall <ian@beware.dropbear.id.au>
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220507
+Link: https://lore.kernel.org/linux-raid/20250903014140.3690499-1-yukuai1@huaweicloud.com
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Li Nan <linan122@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 6cee738a645ff..6d52336057946 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1226,7 +1226,7 @@ static void alloc_behind_master_bio(struct r1bio *r1_bio,
+ int i = 0;
+ struct bio *behind_bio = NULL;
+
+- behind_bio = bio_alloc_bioset(NULL, vcnt, 0, GFP_NOIO,
++ behind_bio = bio_alloc_bioset(NULL, vcnt, bio->bi_opf, GFP_NOIO,
+ &r1_bio->mddev->bio_set);
+
+ /* discard op, we don't support writezero/writesame yet */
+--
+2.51.0
+
--- /dev/null
+From 116686c2743fb50d551dc6af69ff4ecbf7d1ac3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2025 21:10:06 +0800
+Subject: pcmcia: Add error handling for add_interval() in do_validate_mem()
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+[ Upstream commit 4a81f78caa53e0633cf311ca1526377d9bff7479 ]
+
+In the do_validate_mem(), the call to add_interval() does not
+handle errors. If kmalloc() fails in add_interval(), it could
+result in a null pointer being inserted into the linked list,
+leading to illegal memory access when sub_interval() is called
+next.
+
+This patch adds an error handling for the add_interval(). If
+add_interval() returns an error, the function will return early
+with the error code.
+
+Fixes: 7b4884ca8853 ("pcmcia: validate late-added resources")
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pcmcia/rsrc_nonstatic.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c
+index bf9d070a44966..da494fe451baf 100644
+--- a/drivers/pcmcia/rsrc_nonstatic.c
++++ b/drivers/pcmcia/rsrc_nonstatic.c
+@@ -375,7 +375,9 @@ static int do_validate_mem(struct pcmcia_socket *s,
+
+ if (validate && !s->fake_cis) {
+ /* move it to the validated data set */
+- add_interval(&s_data->mem_db_valid, base, size);
++ ret = add_interval(&s_data->mem_db_valid, base, size);
++ if (ret)
++ return ret;
+ sub_interval(&s_data->mem_db, base, size);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 336c93cf06c48a76d8a976c2ba89eae268ac8712 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Mar 2025 14:39:56 +0800
+Subject: pcmcia: omap: Add missing check for platform_get_resource
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit ecef14f70ec9344a10c817248d2ac6cddee5921e ]
+
+Add missing check for platform_get_resource() and return error if it fails
+to catch the error.
+
+Fixes: d87d44f7ab35 ("ARM: omap1: move CF chipselect setup to board file")
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pcmcia/omap_cf.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pcmcia/omap_cf.c b/drivers/pcmcia/omap_cf.c
+index 1b1dff56ec7b1..441cdf83f5a44 100644
+--- a/drivers/pcmcia/omap_cf.c
++++ b/drivers/pcmcia/omap_cf.c
+@@ -215,6 +215,8 @@ static int __init omap_cf_probe(struct platform_device *pdev)
+ return -EINVAL;
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (!res)
++ return -EINVAL;
+
+ cf = kzalloc(sizeof *cf, GFP_KERNEL);
+ if (!cf)
+--
+2.51.0
+
--- /dev/null
+From 52045be13093db3df91e90bc927b451e58c33e6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:17:11 -0700
+Subject: perf bpf-event: Fix use-after-free in synthesis
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit d7b67dd6f9db7bd2c49b415e901849b182ff0735 ]
+
+Calls to perf_env__insert_bpf_prog_info may fail as a sideband thread
+may already have inserted the bpf_prog_info. Such failures may yield
+info_linear being freed which then causes use-after-free issues with
+the internal bpf_prog_info info struct. Make it so that
+perf_env__insert_bpf_prog_info trigger early non-error paths and fix
+the use-after-free in perf_event__synthesize_one_bpf_prog. Add proper
+return error handling to perf_env__add_bpf_info (that calls
+perf_env__insert_bpf_prog_info) and propagate the return value in its
+callers.
+
+Closes: https://lore.kernel.org/lkml/CAP-5=fWJQcmUOP7MuCA2ihKnDAHUCOBLkQFEkQES-1ZZTrgf8Q@mail.gmail.com/
+Fixes: 03edb7020bb9 ("perf bpf: Fix two memory leakages when calling perf_env__insert_bpf_prog_info()")
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20250902181713.309797-2-irogers@google.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/bpf-event.c | 39 +++++++++++++++++++++++++------------
+ 1 file changed, 27 insertions(+), 12 deletions(-)
+
+diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c
+index c81444059ad07..d9123c9637baa 100644
+--- a/tools/perf/util/bpf-event.c
++++ b/tools/perf/util/bpf-event.c
+@@ -290,9 +290,15 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_session *session,
+
+ info_node->info_linear = info_linear;
+ if (!perf_env__insert_bpf_prog_info(env, info_node)) {
+- free(info_linear);
++ /*
++ * Insert failed, likely because of a duplicate event
++ * made by the sideband thread. Ignore synthesizing the
++ * metadata.
++ */
+ free(info_node);
++ goto out;
+ }
++ /* info_linear is now owned by info_node and shouldn't be freed below. */
+ info_linear = NULL;
+
+ /*
+@@ -451,18 +457,18 @@ int perf_event__synthesize_bpf_events(struct perf_session *session,
+ return err;
+ }
+
+-static void perf_env__add_bpf_info(struct perf_env *env, u32 id)
++static int perf_env__add_bpf_info(struct perf_env *env, u32 id)
+ {
+ struct bpf_prog_info_node *info_node;
+ struct perf_bpil *info_linear;
+ struct btf *btf = NULL;
+ u64 arrays;
+ u32 btf_id;
+- int fd;
++ int fd, err = 0;
+
+ fd = bpf_prog_get_fd_by_id(id);
+ if (fd < 0)
+- return;
++ return -EINVAL;
+
+ arrays = 1UL << PERF_BPIL_JITED_KSYMS;
+ arrays |= 1UL << PERF_BPIL_JITED_FUNC_LENS;
+@@ -475,6 +481,7 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id)
+ info_linear = get_bpf_prog_info_linear(fd, arrays);
+ if (IS_ERR_OR_NULL(info_linear)) {
+ pr_debug("%s: failed to get BPF program info. aborting\n", __func__);
++ err = PTR_ERR(info_linear);
+ goto out;
+ }
+
+@@ -484,38 +491,46 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id)
+ if (info_node) {
+ info_node->info_linear = info_linear;
+ if (!perf_env__insert_bpf_prog_info(env, info_node)) {
++ pr_debug("%s: duplicate add bpf info request for id %u\n",
++ __func__, btf_id);
+ free(info_linear);
+ free(info_node);
++ goto out;
+ }
+- } else
++ } else {
+ free(info_linear);
++ err = -ENOMEM;
++ goto out;
++ }
+
+ if (btf_id == 0)
+ goto out;
+
+ btf = btf__load_from_kernel_by_id(btf_id);
+- if (libbpf_get_error(btf)) {
+- pr_debug("%s: failed to get BTF of id %u, aborting\n",
+- __func__, btf_id);
+- goto out;
++ if (!btf) {
++ err = -errno;
++ pr_debug("%s: failed to get BTF of id %u %d\n", __func__, btf_id, err);
++ } else {
++ perf_env__fetch_btf(env, btf_id, btf);
+ }
+- perf_env__fetch_btf(env, btf_id, btf);
+
+ out:
+ btf__free(btf);
+ close(fd);
++ return err;
+ }
+
+ static int bpf_event__sb_cb(union perf_event *event, void *data)
+ {
+ struct perf_env *env = data;
++ int ret = 0;
+
+ if (event->header.type != PERF_RECORD_BPF_EVENT)
+ return -1;
+
+ switch (event->bpf.type) {
+ case PERF_BPF_EVENT_PROG_LOAD:
+- perf_env__add_bpf_info(env, event->bpf.id);
++ ret = perf_env__add_bpf_info(env, event->bpf.id);
+
+ case PERF_BPF_EVENT_PROG_UNLOAD:
+ /*
+@@ -529,7 +544,7 @@ static int bpf_event__sb_cb(union perf_event *event, void *data)
+ break;
+ }
+
+- return 0;
++ return ret;
+ }
+
+ int evlist__add_bpf_sb_event(struct evlist *evlist, struct perf_env *env)
+--
+2.51.0
+
--- /dev/null
+From 937ebef2a7a7791e3dfc2ece8eda8013c085c626 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:17:12 -0700
+Subject: perf bpf-utils: Constify bpil_array_desc
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 1654a0e4d576d9e43fbb10ccf6a1b307c5c18566 ]
+
+The array's contents is a compile time constant. Constify to make the
+code more intention revealing and avoid unintended errors.
+
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20250902181713.309797-3-irogers@google.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Stable-dep-of: 01be43f2a0ea ("perf bpf-utils: Harden get_bpf_prog_info_linear")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/bpf-utils.c | 18 ++++++------------
+ 1 file changed, 6 insertions(+), 12 deletions(-)
+
+diff --git a/tools/perf/util/bpf-utils.c b/tools/perf/util/bpf-utils.c
+index 80b1d2b3729ba..64a5583446964 100644
+--- a/tools/perf/util/bpf-utils.c
++++ b/tools/perf/util/bpf-utils.c
+@@ -20,7 +20,7 @@ struct bpil_array_desc {
+ */
+ };
+
+-static struct bpil_array_desc bpil_array_desc[] = {
++static const struct bpil_array_desc bpil_array_desc[] = {
+ [PERF_BPIL_JITED_INSNS] = {
+ offsetof(struct bpf_prog_info, jited_prog_insns),
+ offsetof(struct bpf_prog_info, jited_prog_len),
+@@ -129,12 +129,10 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+
+ /* step 2: calculate total size of all arrays */
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
++ const struct bpil_array_desc *desc = &bpil_array_desc[i];
+ bool include_array = (arrays & (1UL << i)) > 0;
+- struct bpil_array_desc *desc;
+ __u32 count, size;
+
+- desc = bpil_array_desc + i;
+-
+ /* kernel is too old to support this field */
+ if (info_len < desc->array_offset + sizeof(__u32) ||
+ info_len < desc->count_offset + sizeof(__u32) ||
+@@ -163,13 +161,12 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+ ptr = info_linear->data;
+
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
+- struct bpil_array_desc *desc;
++ const struct bpil_array_desc *desc = &bpil_array_desc[i];
+ __u32 count, size;
+
+ if ((arrays & (1UL << i)) == 0)
+ continue;
+
+- desc = bpil_array_desc + i;
+ count = bpf_prog_info_read_offset_u32(&info, desc->count_offset);
+ size = bpf_prog_info_read_offset_u32(&info, desc->size_offset);
+ bpf_prog_info_set_offset_u32(&info_linear->info,
+@@ -192,13 +189,12 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+
+ /* step 6: verify the data */
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
+- struct bpil_array_desc *desc;
++ const struct bpil_array_desc *desc = &bpil_array_desc[i];
+ __u32 v1, v2;
+
+ if ((arrays & (1UL << i)) == 0)
+ continue;
+
+- desc = bpil_array_desc + i;
+ v1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset);
+ v2 = bpf_prog_info_read_offset_u32(&info_linear->info,
+ desc->count_offset);
+@@ -224,13 +220,12 @@ void bpil_addr_to_offs(struct perf_bpil *info_linear)
+ int i;
+
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
+- struct bpil_array_desc *desc;
++ const struct bpil_array_desc *desc = &bpil_array_desc[i];
+ __u64 addr, offs;
+
+ if ((info_linear->arrays & (1UL << i)) == 0)
+ continue;
+
+- desc = bpil_array_desc + i;
+ addr = bpf_prog_info_read_offset_u64(&info_linear->info,
+ desc->array_offset);
+ offs = addr - ptr_to_u64(info_linear->data);
+@@ -244,13 +239,12 @@ void bpil_offs_to_addr(struct perf_bpil *info_linear)
+ int i;
+
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
+- struct bpil_array_desc *desc;
++ const struct bpil_array_desc *desc = &bpil_array_desc[i];
+ __u64 addr, offs;
+
+ if ((info_linear->arrays & (1UL << i)) == 0)
+ continue;
+
+- desc = bpil_array_desc + i;
+ offs = bpf_prog_info_read_offset_u64(&info_linear->info,
+ desc->array_offset);
+ addr = offs + ptr_to_u64(info_linear->data);
+--
+2.51.0
+
--- /dev/null
+From d6a123b071d2efc9c4c6c06cc59e660212c95759 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:17:13 -0700
+Subject: perf bpf-utils: Harden get_bpf_prog_info_linear
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 01be43f2a0eaeed83e94dee054742f37625c86d9 ]
+
+In get_bpf_prog_info_linear two calls to bpf_obj_get_info_by_fd are
+made, the first to compute memory requirements for a struct perf_bpil
+and the second to fill it in. Previously the code would warn when the
+second call didn't match the first. Such races can be common place in
+things like perf test, whose perf trace tests will frequently load BPF
+programs. Rather than a debug message, return actual errors for this
+case. Out of paranoia also validate the read bpf_prog_info array
+value. Change the type of ptr to avoid mismatched pointer type
+compiler warnings. Add some additional debug print outs and sanity
+asserts.
+
+Closes: https://lore.kernel.org/lkml/CAP-5=fWJQcmUOP7MuCA2ihKnDAHUCOBLkQFEkQES-1ZZTrgf8Q@mail.gmail.com/
+Fixes: 6ac22d036f86 ("perf bpf: Pull in bpf_program__get_prog_info_linear()")
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20250902181713.309797-4-irogers@google.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/bpf-utils.c | 43 ++++++++++++++++++++++++++++---------
+ 1 file changed, 33 insertions(+), 10 deletions(-)
+
+diff --git a/tools/perf/util/bpf-utils.c b/tools/perf/util/bpf-utils.c
+index 64a5583446964..5a66dc8594aa8 100644
+--- a/tools/perf/util/bpf-utils.c
++++ b/tools/perf/util/bpf-utils.c
+@@ -115,7 +115,7 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+ __u32 info_len = sizeof(info);
+ __u32 data_len = 0;
+ int i, err;
+- void *ptr;
++ __u8 *ptr;
+
+ if (arrays >> PERF_BPIL_LAST_ARRAY)
+ return ERR_PTR(-EINVAL);
+@@ -126,6 +126,8 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+ pr_debug("can't get prog info: %s", strerror(errno));
+ return ERR_PTR(-EFAULT);
+ }
++ if (info.type >= __MAX_BPF_PROG_TYPE)
++ pr_debug("%s:%d: unexpected program type %u\n", __func__, __LINE__, info.type);
+
+ /* step 2: calculate total size of all arrays */
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
+@@ -173,6 +175,8 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+ desc->count_offset, count);
+ bpf_prog_info_set_offset_u32(&info_linear->info,
+ desc->size_offset, size);
++ assert(ptr >= info_linear->data);
++ assert(ptr < &info_linear->data[data_len]);
+ bpf_prog_info_set_offset_u64(&info_linear->info,
+ desc->array_offset,
+ ptr_to_u64(ptr));
+@@ -186,26 +190,45 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+ free(info_linear);
+ return ERR_PTR(-EFAULT);
+ }
++ if (info_linear->info.type >= __MAX_BPF_PROG_TYPE) {
++ pr_debug("%s:%d: unexpected program type %u\n",
++ __func__, __LINE__, info_linear->info.type);
++ }
+
+ /* step 6: verify the data */
++ ptr = info_linear->data;
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
+ const struct bpil_array_desc *desc = &bpil_array_desc[i];
+- __u32 v1, v2;
++ __u32 count1, count2, size1, size2;
++ __u64 ptr2;
+
+ if ((arrays & (1UL << i)) == 0)
+ continue;
+
+- v1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset);
+- v2 = bpf_prog_info_read_offset_u32(&info_linear->info,
++ count1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset);
++ count2 = bpf_prog_info_read_offset_u32(&info_linear->info,
+ desc->count_offset);
+- if (v1 != v2)
+- pr_warning("%s: mismatch in element count\n", __func__);
++ if (count1 != count2) {
++ pr_warning("%s: mismatch in element count %u vs %u\n", __func__, count1, count2);
++ free(info_linear);
++ return ERR_PTR(-ERANGE);
++ }
+
+- v1 = bpf_prog_info_read_offset_u32(&info, desc->size_offset);
+- v2 = bpf_prog_info_read_offset_u32(&info_linear->info,
++ size1 = bpf_prog_info_read_offset_u32(&info, desc->size_offset);
++ size2 = bpf_prog_info_read_offset_u32(&info_linear->info,
+ desc->size_offset);
+- if (v1 != v2)
+- pr_warning("%s: mismatch in rec size\n", __func__);
++ if (size1 != size2) {
++ pr_warning("%s: mismatch in rec size %u vs %u\n", __func__, size1, size2);
++ free(info_linear);
++ return ERR_PTR(-ERANGE);
++ }
++ ptr2 = bpf_prog_info_read_offset_u64(&info_linear->info, desc->array_offset);
++ if (ptr_to_u64(ptr) != ptr2) {
++ pr_warning("%s: mismatch in array %p vs %llx\n", __func__, ptr, ptr2);
++ free(info_linear);
++ return ERR_PTR(-ERANGE);
++ }
++ ptr += roundup(count1 * size1, sizeof(__u64));
+ }
+
+ /* step 7: update info_len and data_len */
+--
+2.51.0
+
--- /dev/null
+From eeeb2949c26b671462c7b011417ecf63c1fb3339 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 22:40:07 +0200
+Subject: platform/x86: acer-wmi: Stop using ACPI bitmap for platform profile
+ choices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit b0908e03fdd488a5ffd5b80d86dcfc77207464e7 ]
+
+It turns out that the platform firmware on some models does not return
+valid data when reading the bitmap of supported platform profiles.
+This prevents the driver from loading on said models, even when the
+platform profile interface itself works.
+
+Fix this by stop using said bitmap until we have figured out how
+the OEM software itself detects available platform profiles.
+
+Tested-by: Lynne Megido <lynne@bune.city>
+Reported-by: Lynne Megido <lynne@bune.city>
+Closes: https://lore.kernel.org/platform-driver-x86/3f56e68f-85df-4c0a-982c-43f9d635be38@bune.city/
+Fixes: 191e21f1a4c3 ("platform/x86: acer-wmi: use an ACPI bitmap to set the platform profile choices")
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Link: https://lore.kernel.org/r/20250826204007.5088-1-W_Armin@gmx.de
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/acer-wmi.c | 71 ++++++---------------------------
+ 1 file changed, 12 insertions(+), 59 deletions(-)
+
+diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
+index 69336bd778eea..13eb22b35aa8f 100644
+--- a/drivers/platform/x86/acer-wmi.c
++++ b/drivers/platform/x86/acer-wmi.c
+@@ -129,6 +129,7 @@ enum acer_wmi_predator_v4_oc {
+ enum acer_wmi_gaming_misc_setting {
+ ACER_WMID_MISC_SETTING_OC_1 = 0x0005,
+ ACER_WMID_MISC_SETTING_OC_2 = 0x0007,
++ /* Unreliable on some models */
+ ACER_WMID_MISC_SETTING_SUPPORTED_PROFILES = 0x000A,
+ ACER_WMID_MISC_SETTING_PLATFORM_PROFILE = 0x000B,
+ };
+@@ -794,9 +795,6 @@ static bool platform_profile_support;
+ */
+ static int last_non_turbo_profile = INT_MIN;
+
+-/* The most performant supported profile */
+-static int acer_predator_v4_max_perf;
+-
+ enum acer_predator_v4_thermal_profile {
+ ACER_PREDATOR_V4_THERMAL_PROFILE_QUIET = 0x00,
+ ACER_PREDATOR_V4_THERMAL_PROFILE_BALANCED = 0x01,
+@@ -2014,7 +2012,7 @@ acer_predator_v4_platform_profile_set(struct device *dev,
+ if (err)
+ return err;
+
+- if (tp != acer_predator_v4_max_perf)
++ if (tp != ACER_PREDATOR_V4_THERMAL_PROFILE_TURBO)
+ last_non_turbo_profile = tp;
+
+ return 0;
+@@ -2023,55 +2021,14 @@ acer_predator_v4_platform_profile_set(struct device *dev,
+ static int
+ acer_predator_v4_platform_profile_probe(void *drvdata, unsigned long *choices)
+ {
+- unsigned long supported_profiles;
+- int err;
++ set_bit(PLATFORM_PROFILE_PERFORMANCE, choices);
++ set_bit(PLATFORM_PROFILE_BALANCED_PERFORMANCE, choices);
++ set_bit(PLATFORM_PROFILE_BALANCED, choices);
++ set_bit(PLATFORM_PROFILE_QUIET, choices);
++ set_bit(PLATFORM_PROFILE_LOW_POWER, choices);
+
+- err = WMID_gaming_get_misc_setting(ACER_WMID_MISC_SETTING_SUPPORTED_PROFILES,
+- (u8 *)&supported_profiles);
+- if (err)
+- return err;
+-
+- /* Iterate through supported profiles in order of increasing performance */
+- if (test_bit(ACER_PREDATOR_V4_THERMAL_PROFILE_ECO, &supported_profiles)) {
+- set_bit(PLATFORM_PROFILE_LOW_POWER, choices);
+- acer_predator_v4_max_perf = ACER_PREDATOR_V4_THERMAL_PROFILE_ECO;
+- last_non_turbo_profile = ACER_PREDATOR_V4_THERMAL_PROFILE_ECO;
+- }
+-
+- if (test_bit(ACER_PREDATOR_V4_THERMAL_PROFILE_QUIET, &supported_profiles)) {
+- set_bit(PLATFORM_PROFILE_QUIET, choices);
+- acer_predator_v4_max_perf = ACER_PREDATOR_V4_THERMAL_PROFILE_QUIET;
+- last_non_turbo_profile = ACER_PREDATOR_V4_THERMAL_PROFILE_QUIET;
+- }
+-
+- if (test_bit(ACER_PREDATOR_V4_THERMAL_PROFILE_BALANCED, &supported_profiles)) {
+- set_bit(PLATFORM_PROFILE_BALANCED, choices);
+- acer_predator_v4_max_perf = ACER_PREDATOR_V4_THERMAL_PROFILE_BALANCED;
+- last_non_turbo_profile = ACER_PREDATOR_V4_THERMAL_PROFILE_BALANCED;
+- }
+-
+- if (test_bit(ACER_PREDATOR_V4_THERMAL_PROFILE_PERFORMANCE, &supported_profiles)) {
+- set_bit(PLATFORM_PROFILE_BALANCED_PERFORMANCE, choices);
+- acer_predator_v4_max_perf = ACER_PREDATOR_V4_THERMAL_PROFILE_PERFORMANCE;
+-
+- /* We only use this profile as a fallback option in case no prior
+- * profile is supported.
+- */
+- if (last_non_turbo_profile < 0)
+- last_non_turbo_profile = ACER_PREDATOR_V4_THERMAL_PROFILE_PERFORMANCE;
+- }
+-
+- if (test_bit(ACER_PREDATOR_V4_THERMAL_PROFILE_TURBO, &supported_profiles)) {
+- set_bit(PLATFORM_PROFILE_PERFORMANCE, choices);
+- acer_predator_v4_max_perf = ACER_PREDATOR_V4_THERMAL_PROFILE_TURBO;
+-
+- /* We need to handle the hypothetical case where only the turbo profile
+- * is supported. In this case the turbo toggle will essentially be a
+- * no-op.
+- */
+- if (last_non_turbo_profile < 0)
+- last_non_turbo_profile = ACER_PREDATOR_V4_THERMAL_PROFILE_TURBO;
+- }
++ /* Set default non-turbo profile */
++ last_non_turbo_profile = ACER_PREDATOR_V4_THERMAL_PROFILE_BALANCED;
+
+ return 0;
+ }
+@@ -2108,19 +2065,15 @@ static int acer_thermal_profile_change(void)
+ if (cycle_gaming_thermal_profile) {
+ platform_profile_cycle();
+ } else {
+- /* Do nothing if no suitable platform profiles where found */
+- if (last_non_turbo_profile < 0)
+- return 0;
+-
+ err = WMID_gaming_get_misc_setting(
+ ACER_WMID_MISC_SETTING_PLATFORM_PROFILE, ¤t_tp);
+ if (err)
+ return err;
+
+- if (current_tp == acer_predator_v4_max_perf)
++ if (current_tp == ACER_PREDATOR_V4_THERMAL_PROFILE_TURBO)
+ tp = last_non_turbo_profile;
+ else
+- tp = acer_predator_v4_max_perf;
++ tp = ACER_PREDATOR_V4_THERMAL_PROFILE_TURBO;
+
+ err = WMID_gaming_set_misc_setting(
+ ACER_WMID_MISC_SETTING_PLATFORM_PROFILE, tp);
+@@ -2128,7 +2081,7 @@ static int acer_thermal_profile_change(void)
+ return err;
+
+ /* Store last profile for toggle */
+- if (current_tp != acer_predator_v4_max_perf)
++ if (current_tp != ACER_PREDATOR_V4_THERMAL_PROFILE_TURBO)
+ last_non_turbo_profile = current_tp;
+
+ platform_profile_notify(platform_profile_device);
+--
+2.51.0
+
--- /dev/null
+From be32abf3e37cb11e5ed02387839dbe61781dcdd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 07:24:33 +0200
+Subject: platform/x86: asus-wmi: Fix racy registrations
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 5549202b9c02c2ecbc8634768a3da8d9e82d548d ]
+
+asus_wmi_register_driver() may be called from multiple drivers
+concurrently, which can lead to the racy list operations, eventually
+corrupting the memory and hitting Oops on some ASUS machines.
+Also, the error handling is missing, and it forgot to unregister ACPI
+lps0 dev ops in the error case.
+
+This patch covers those issues by introducing a simple mutex at
+acpi_wmi_register_driver() & *_unregister_driver, and adding the
+proper call of asus_s2idle_check_unregister() in the error path.
+
+Fixes: feea7bd6b02d ("platform/x86: asus-wmi: Refactor Ally suspend/resume")
+Link: https://bugzilla.suse.com/show_bug.cgi?id=1246924
+Link: https://lore.kernel.org/07815053-0e31-4e8e-8049-b652c929323b@kernel.org
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/20250827052441.23382-1-tiwai@suse.de
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/asus-wmi.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
+index f7191fdded14d..e72a2b5d158e9 100644
+--- a/drivers/platform/x86/asus-wmi.c
++++ b/drivers/platform/x86/asus-wmi.c
+@@ -5088,16 +5088,22 @@ static int asus_wmi_probe(struct platform_device *pdev)
+
+ asus_s2idle_check_register();
+
+- return asus_wmi_add(pdev);
++ ret = asus_wmi_add(pdev);
++ if (ret)
++ asus_s2idle_check_unregister();
++
++ return ret;
+ }
+
+ static bool used;
++static DEFINE_MUTEX(register_mutex);
+
+ int __init_or_module asus_wmi_register_driver(struct asus_wmi_driver *driver)
+ {
+ struct platform_driver *platform_driver;
+ struct platform_device *platform_device;
+
++ guard(mutex)(®ister_mutex);
+ if (used)
+ return -EBUSY;
+
+@@ -5120,6 +5126,7 @@ EXPORT_SYMBOL_GPL(asus_wmi_register_driver);
+
+ void asus_wmi_unregister_driver(struct asus_wmi_driver *driver)
+ {
++ guard(mutex)(®ister_mutex);
+ asus_s2idle_check_unregister();
+
+ platform_device_unregister(driver->platform_device);
+--
+2.51.0
+
--- /dev/null
+From bad2d68fd880f75031e53aab1762abbf9a20fe7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 17:47:09 +0200
+Subject: platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Antheas Kapenekakis <lkml@antheas.dev>
+
+[ Upstream commit cf3940ac737d05c85395f343fe33a3cfcadb47db ]
+
+Currently, the ignore_key_wlan quirk applies to keycodes 0x5D, 0x5E, and
+0x5F. However, the relevant code for the Asus Zenbook Duo is only 0x5F.
+Since this code is emitted by other Asus devices, such as from the Z13
+for its ROG button, remove the extra codes before expanding the quirk.
+
+For the Duo devices, which are the only ones that use this quirk, there
+should be no effect.
+
+Fixes: 9286dfd5735b ("platform/x86: asus-wmi: Fix spurious rfkill on UX8406MA")
+Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
+Link: https://lore.kernel.org/r/20250808154710.8981-1-lkml@antheas.dev
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/asus-nb-wmi.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
+index f84c3d03c1de7..e6726be5890e7 100644
+--- a/drivers/platform/x86/asus-nb-wmi.c
++++ b/drivers/platform/x86/asus-nb-wmi.c
+@@ -655,8 +655,6 @@ static void asus_nb_wmi_key_filter(struct asus_wmi_driver *asus_wmi, int *code,
+ if (atkbd_reports_vol_keys)
+ *code = ASUS_WMI_KEY_IGNORE;
+ break;
+- case 0x5D: /* Wireless console Toggle */
+- case 0x5E: /* Wireless console Enable */
+ case 0x5F: /* Wireless console Disable */
+ if (quirks->ignore_key_wlan)
+ *code = ASUS_WMI_KEY_IGNORE;
+--
+2.51.0
+
--- /dev/null
+From b779261adebce0478d6dbd6d84bb7606855f2546 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 07:38:59 -0400
+Subject: platform/x86/intel: power-domains: Use topology_logical_package_id()
+ for package ID
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David Arcari <darcari@redhat.com>
+
+[ Upstream commit aa28991fd5dc4c01a40caab2bd9af8c5e06f9899 ]
+
+Currently, tpmi_get_logical_id() calls topology_physical_package_id()
+to set the pkg_id of the info structure. Since some VM hosts assign non
+contiguous package IDs, topology_physical_package_id() can return a
+larger value than topology_max_packages(). This will result in an
+invalid reference into tpmi_power_domain_mask[] as that is allocatead
+based on topology_max_packages() as the maximum package ID.
+
+Fixes: 17ca2780458c ("platform/x86/intel: TPMI domain id and CPU mapping")
+Signed-off-by: David Arcari <darcari@redhat.com>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Link: https://lore.kernel.org/r/20250829113859.1772827-1-darcari@redhat.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/tpmi_power_domains.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/intel/tpmi_power_domains.c b/drivers/platform/x86/intel/tpmi_power_domains.c
+index 9d8247bb9cfa5..8641353b2e061 100644
+--- a/drivers/platform/x86/intel/tpmi_power_domains.c
++++ b/drivers/platform/x86/intel/tpmi_power_domains.c
+@@ -178,7 +178,7 @@ static int tpmi_get_logical_id(unsigned int cpu, struct tpmi_cpu_info *info)
+
+ info->punit_thread_id = FIELD_GET(LP_ID_MASK, data);
+ info->punit_core_id = FIELD_GET(MODULE_ID_MASK, data);
+- info->pkg_id = topology_physical_package_id(cpu);
++ info->pkg_id = topology_logical_package_id(cpu);
+ info->linux_cpu = cpu;
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From a7ecaf4a24e5b222976cc5301f2c88ab101f56ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 19:35:50 +0800
+Subject: scsi: sr: Reinstate rotational media flag
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 708e2371f77a9d3f2f1d54d1ec835d71b9d0dafe ]
+
+Reinstate the rotational media flag for the CD-ROM driver. The flag has
+been cleared since commit bd4a633b6f7c ("block: move the nonrot flag to
+queue_limits") and this breaks some applications.
+
+Move queue limit configuration from get_sectorsize() to
+sr_revalidate_disk() and set the rotational flag.
+
+Cc: Christoph Hellwig <hch@lst.de>
+Fixes: bd4a633b6f7c ("block: move the nonrot flag to queue_limits")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20250827113550.2614535-1-ming.lei@redhat.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/sr.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
+index b17796d5ee665..add13e3068983 100644
+--- a/drivers/scsi/sr.c
++++ b/drivers/scsi/sr.c
+@@ -475,13 +475,21 @@ static blk_status_t sr_init_command(struct scsi_cmnd *SCpnt)
+
+ static int sr_revalidate_disk(struct scsi_cd *cd)
+ {
++ struct request_queue *q = cd->device->request_queue;
+ struct scsi_sense_hdr sshdr;
++ struct queue_limits lim;
++ int sector_size;
+
+ /* if the unit is not ready, nothing more to do */
+ if (scsi_test_unit_ready(cd->device, SR_TIMEOUT, MAX_RETRIES, &sshdr))
+ return 0;
+ sr_cd_check(&cd->cdi);
+- return get_sectorsize(cd);
++ sector_size = get_sectorsize(cd);
++
++ lim = queue_limits_start_update(q);
++ lim.logical_block_size = sector_size;
++ lim.features |= BLK_FEAT_ROTATIONAL;
++ return queue_limits_commit_update_frozen(q, &lim);
+ }
+
+ static int sr_block_open(struct gendisk *disk, blk_mode_t mode)
+@@ -721,10 +729,8 @@ static int sr_probe(struct device *dev)
+
+ static int get_sectorsize(struct scsi_cd *cd)
+ {
+- struct request_queue *q = cd->device->request_queue;
+ static const u8 cmd[10] = { READ_CAPACITY };
+ unsigned char buffer[8] = { };
+- struct queue_limits lim;
+ int err;
+ int sector_size;
+ struct scsi_failure failure_defs[] = {
+@@ -795,9 +801,7 @@ static int get_sectorsize(struct scsi_cd *cd)
+ set_capacity(cd->disk, cd->capacity);
+ }
+
+- lim = queue_limits_start_update(q);
+- lim.logical_block_size = sector_size;
+- return queue_limits_commit_update_frozen(q, &lim);
++ return sector_size;
+ }
+
+ static int get_capabilities(struct scsi_cd *cd)
+--
+2.51.0
+
alsa-hda-realtek-fix-headset-mic-for-tongfang-x6r5xxy.patch
alsa-hda-tas2781-fix-tas2563-efi-data-endianness.patch
alsa-hda-tas2781-reorder-tas2563-calibration-variables.patch
+pcmcia-omap-add-missing-check-for-platform_get_resou.patch
+pcmcia-add-error-handling-for-add_interval-in-do_val.patch
+platform-x86-asus-wmi-remove-extra-keys-from-ignore_.patch
+platform-x86-asus-wmi-fix-racy-registrations.patch
+platform-x86-acer-wmi-stop-using-acpi-bitmap-for-pla.patch
+platform-x86-intel-power-domains-use-topology_logica.patch
+hwmon-mlxreg-fan-prevent-fans-from-getting-stuck-at-.patch
+hwmon-ina238-correctly-clamp-temperature.patch
+scsi-sr-reinstate-rotational-media-flag.patch
+spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch
+spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch
+spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch
+spi-spi-fsl-lpspi-clear-status-register-after-disabl.patch
+hwmon-ina238-correctly-clamp-shunt-voltage-limit.patch
+hwmon-ina238-correctly-clamp-power-limits.patch
+drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch
+perf-bpf-event-fix-use-after-free-in-synthesis.patch
+perf-bpf-utils-constify-bpil_array_desc.patch
+perf-bpf-utils-harden-get_bpf_prog_info_linear.patch
+spi-spi-qpic-snand-unregister-ecc-engine-on-probe-er.patch
+drm-amd-amdgpu-fix-missing-error-return-on-kzalloc-f.patch
+tools-gpio-remove-the-include-directory-on-make-clea.patch
+md-raid1-fix-data-lost-for-writemostly-rdev.patch
+md-prevent-incorrect-update-of-resync-recovery-offse.patch
+drm-i915-gem-allow-exec_capture-on-recoverable-conte.patch
--- /dev/null
+From 2f660c9efa85d20b3b3513fd93998d610c977dab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:14:43 +0100
+Subject: spi: spi-fsl-lpspi: Clear status register after disabling the module
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit dedf9c93dece441e9a0a4836458bc93677008ddd ]
+
+Clear the error flags after disabling the module to avoid the case when
+a flag is set again between flag clear and module disable. And use
+SR_CLEAR_MASK to replace hardcoded value for improved readability.
+
+Although fsl_lpspi_reset() was only introduced in commit a15dc3d657fa
+("spi: lpspi: Fix CLK pin becomes low before one transfer"), the
+original driver only reset SR in the interrupt handler, making it
+vulnerable to the same issue. Therefore the fixes commit is set at the
+introduction of the driver.
+
+Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: Ciprian Marian Costea <ciprianmarian.costea@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-4-6262b9aa9be4@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index 0bb25b473271c..90e4028ca14fc 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -83,6 +83,8 @@
+ #define TCR_RXMSK BIT(19)
+ #define TCR_TXMSK BIT(18)
+
++#define SR_CLEAR_MASK GENMASK(13, 8)
++
+ struct fsl_lpspi_devtype_data {
+ u8 prescale_max;
+ };
+@@ -536,14 +538,13 @@ static int fsl_lpspi_reset(struct fsl_lpspi_data *fsl_lpspi)
+ fsl_lpspi_intctrl(fsl_lpspi, 0);
+ }
+
+- /* W1C for all flags in SR */
+- temp = 0x3F << 8;
+- writel(temp, fsl_lpspi->base + IMX7ULP_SR);
+-
+ /* Clear FIFO and disable module */
+ temp = CR_RRF | CR_RTF;
+ writel(temp, fsl_lpspi->base + IMX7ULP_CR);
+
++ /* W1C for all flags in SR */
++ writel(SR_CLEAR_MASK, fsl_lpspi->base + IMX7ULP_SR);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 496dd08f37d6248a78b54877b7199e9d819b3e4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:14:40 +0100
+Subject: spi: spi-fsl-lpspi: Fix transmissions when using CONT
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit 782a7c73078e1301c0c427f21c06377d77dfa541 ]
+
+Commit 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use
+CONT") breaks transmissions when CONT is used. The TDIE interrupt should
+not be disabled in all cases. If CONT is used and the TX transfer is not
+yet completed yet, but the interrupt handler is called because there are
+characters to be received, TDIE is replaced with FCIE. When the transfer
+is finally completed, SR_TDF is set but the interrupt handler isn't
+called again.
+
+Fixes: 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use CONT")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-1-6262b9aa9be4@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index 1a22d356a73d9..fbe58cbf33864 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -3,7 +3,7 @@
+ // Freescale i.MX7ULP LPSPI driver
+ //
+ // Copyright 2016 Freescale Semiconductor, Inc.
+-// Copyright 2018 NXP Semiconductors
++// Copyright 2018, 2023, 2025 NXP
+
+ #include <linux/clk.h>
+ #include <linux/completion.h>
+@@ -786,7 +786,7 @@ static irqreturn_t fsl_lpspi_isr(int irq, void *dev_id)
+ if (temp_SR & SR_MBF ||
+ readl(fsl_lpspi->base + IMX7ULP_FSR) & FSR_TXCOUNT) {
+ writel(SR_FCF, fsl_lpspi->base + IMX7ULP_SR);
+- fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE);
++ fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE | (temp_IER & IER_TDIE));
+ return IRQ_HANDLED;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From a51db581285dd744127eb750942620d8a8b2567d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:14:42 +0100
+Subject: spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit e811b088a3641861fc9d2b2b840efc61a0f1907d ]
+
+In DMA mode fsl_lpspi_reset() is always called at the end, even when the
+transfer is aborted. In PIO mode aborts skip the reset leaving the FIFO
+filled and the module enabled.
+
+Fix it by always calling fsl_lpspi_reset().
+
+Fixes: a15dc3d657fa ("spi: lpspi: Fix CLK pin becomes low before one transfer")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-3-6262b9aa9be4@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index 55570c814dcdd..0bb25b473271c 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -734,12 +734,10 @@ static int fsl_lpspi_pio_transfer(struct spi_controller *controller,
+ fsl_lpspi_write_tx_fifo(fsl_lpspi);
+
+ ret = fsl_lpspi_wait_for_completion(controller);
+- if (ret)
+- return ret;
+
+ fsl_lpspi_reset(fsl_lpspi);
+
+- return 0;
++ return ret;
+ }
+
+ static int fsl_lpspi_transfer_one(struct spi_controller *controller,
+--
+2.51.0
+
--- /dev/null
+From 09615b42c36048e07e15d7ae5f2ef1a9d4951406 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:14:41 +0100
+Subject: spi: spi-fsl-lpspi: Set correct chip-select polarity bit
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit cbe33705864ba2697a2939de715b81538cf32430 ]
+
+The driver currently supports multiple chip-selects, but only sets the
+polarity for the first one (CS 0). Fix it by setting the PCSPOL bit for
+the desired chip-select.
+
+Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-2-6262b9aa9be4@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index fbe58cbf33864..55570c814dcdd 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -5,6 +5,7 @@
+ // Copyright 2016 Freescale Semiconductor, Inc.
+ // Copyright 2018, 2023, 2025 NXP
+
++#include <linux/bitfield.h>
+ #include <linux/clk.h>
+ #include <linux/completion.h>
+ #include <linux/delay.h>
+@@ -70,7 +71,7 @@
+ #define DER_TDDE BIT(0)
+ #define CFGR1_PCSCFG BIT(27)
+ #define CFGR1_PINCFG (BIT(24)|BIT(25))
+-#define CFGR1_PCSPOL BIT(8)
++#define CFGR1_PCSPOL_MASK GENMASK(11, 8)
+ #define CFGR1_NOSTALL BIT(3)
+ #define CFGR1_HOST BIT(0)
+ #define FSR_TXCOUNT (0xFF)
+@@ -424,7 +425,9 @@ static int fsl_lpspi_config(struct fsl_lpspi_data *fsl_lpspi)
+ else
+ temp = CFGR1_PINCFG;
+ if (fsl_lpspi->config.mode & SPI_CS_HIGH)
+- temp |= CFGR1_PCSPOL;
++ temp |= FIELD_PREP(CFGR1_PCSPOL_MASK,
++ BIT(fsl_lpspi->config.chip_select));
++
+ writel(temp, fsl_lpspi->base + IMX7ULP_CFGR1);
+
+ temp = readl(fsl_lpspi->base + IMX7ULP_CR);
+--
+2.51.0
+
--- /dev/null
+From b68201a09a624dd1a85f8c4bd303edd35de5583e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 13:56:24 +0200
+Subject: spi: spi-qpic-snand: unregister ECC engine on probe error and device
+ remove
+
+From: Gabor Juhos <j4g8y7@gmail.com>
+
+[ Upstream commit 1991a458528588ff34e98b6365362560d208710f ]
+
+The on-host hardware ECC engine remains registered both when
+the spi_register_controller() function returns with an error
+and also on device removal.
+
+Change the qcom_spi_probe() function to unregister the engine
+on the error path, and add the missing unregistering call to
+qcom_spi_remove() to avoid possible use-after-free issues.
+
+Fixes: 7304d1909080 ("spi: spi-qpic: add driver for QCOM SPI NAND flash Interface")
+Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
+Message-ID: <20250903-qpic-snand-unregister-ecceng-v1-1-ef5387b0abdc@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-qpic-snand.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-qpic-snand.c b/drivers/spi/spi-qpic-snand.c
+index e98e997680c75..cfc81327f7a44 100644
+--- a/drivers/spi/spi-qpic-snand.c
++++ b/drivers/spi/spi-qpic-snand.c
+@@ -1615,11 +1615,13 @@ static int qcom_spi_probe(struct platform_device *pdev)
+ ret = spi_register_controller(ctlr);
+ if (ret) {
+ dev_err(&pdev->dev, "spi_register_controller failed.\n");
+- goto err_spi_init;
++ goto err_register_controller;
+ }
+
+ return 0;
+
++err_register_controller:
++ nand_ecc_unregister_on_host_hw_engine(&snandc->qspi->ecc_eng);
+ err_spi_init:
+ qcom_nandc_unalloc(snandc);
+ err_snand_alloc:
+@@ -1641,7 +1643,7 @@ static void qcom_spi_remove(struct platform_device *pdev)
+ struct resource *res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+
+ spi_unregister_controller(ctlr);
+-
++ nand_ecc_unregister_on_host_hw_engine(&snandc->qspi->ecc_eng);
+ qcom_nandc_unalloc(snandc);
+
+ clk_disable_unprepare(snandc->aon_clk);
+--
+2.51.0
+
--- /dev/null
+From 4f64f7de1601771bb5fd159756cae16d321dea31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 14:36:20 +0800
+Subject: tools: gpio: remove the include directory on make clean
+
+From: zhang jiao <zhangjiao2@cmss.chinamobile.com>
+
+[ Upstream commit ed42d80f3bae89592fbb2ffaf8b6b2e720d53f6a ]
+
+Remove the generated include directory when running make clean.
+
+Fixes: 8674cea84dc6 ("tools/gpio: move to tools buildsystem")
+Signed-off-by: Zhang Jiao <zhangjiao2@cmss.chinamobile.com>
+Link: https://lore.kernel.org/r/20250903063621.2424-1-zhangjiao2@cmss.chinamobile.com
+[Bartosz: add Fixes tag, improve the commit message]
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/gpio/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/gpio/Makefile b/tools/gpio/Makefile
+index ed565eb52275f..342e056c8c665 100644
+--- a/tools/gpio/Makefile
++++ b/tools/gpio/Makefile
+@@ -77,7 +77,7 @@ $(OUTPUT)gpio-watch: $(GPIO_WATCH_IN)
+
+ clean:
+ rm -f $(ALL_PROGRAMS)
+- rm -f $(OUTPUT)include/linux/gpio.h
++ rm -rf $(OUTPUT)include
+ find $(or $(OUTPUT),.) -name '*.o' -delete -o -name '\.*.d' -delete -o -name '\.*.cmd' -delete
+
+ install: $(ALL_PROGRAMS)
+--
+2.51.0
+
--- /dev/null
+From d0420667c9d67d75aa17a275e972b321eec017aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:40:50 +0100
+Subject: drm/amd/amdgpu: Fix missing error return on kzalloc failure
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit 467e00b30dfe75c4cfc2197ceef1fddca06adc25 ]
+
+Currently the kzalloc failure check just sets reports the failure
+and sets the variable ret to -ENOMEM, which is not checked later
+for this specific error. Fix this by just returning -ENOMEM rather
+than setting ret.
+
+Fixes: 4fb930715468 ("drm/amd/amdgpu: remove redundant host to psp cmd buf allocations")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 1ee9d1a0962c13ba5ab7e47d33a80e3b8dc4b52e)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index e9a83865ae012..c83445c2e37f3 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -409,7 +409,7 @@ static int psp_sw_init(void *handle)
+ psp->cmd = kzalloc(sizeof(struct psp_gfx_cmd_resp), GFP_KERNEL);
+ if (!psp->cmd) {
+ dev_err(adev->dev, "Failed to allocate memory to command buffer!\n");
+- ret = -ENOMEM;
++ return -ENOMEM;
+ }
+
+ adev->psp.xgmi_context.supports_extended_data =
+--
+2.51.0
+
--- /dev/null
+From ebad0221338175633b59238bc49f93650b5610c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Dec 2023 18:14:23 +0800
+Subject: drm/amdgpu: Replace DRM_* with dev_* in amdgpu_psp.c
+
+From: Hawking Zhang <Hawking.Zhang@amd.com>
+
+[ Upstream commit ac3ff8a90637e813005404a0110802aa384af4aa ]
+
+So kernel message has the device pcie bdf information,
+which helps issue debugging especially in multiple GPU
+system.
+
+Signed-off-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: 467e00b30dfe ("drm/amd/amdgpu: Fix missing error return on kzalloc failure")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 144 ++++++++++++------------
+ 1 file changed, 75 insertions(+), 69 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index ffa5e72a84ebc..e9a83865ae012 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -291,21 +291,22 @@ static int psp_memory_training_init(struct psp_context *psp)
+ struct psp_memory_training_context *ctx = &psp->mem_train_ctx;
+
+ if (ctx->init != PSP_MEM_TRAIN_RESERVE_SUCCESS) {
+- DRM_DEBUG("memory training is not supported!\n");
++ dev_dbg(psp->adev->dev, "memory training is not supported!\n");
+ return 0;
+ }
+
+ ctx->sys_cache = kzalloc(ctx->train_data_size, GFP_KERNEL);
+ if (ctx->sys_cache == NULL) {
+- DRM_ERROR("alloc mem_train_ctx.sys_cache failed!\n");
++ dev_err(psp->adev->dev, "alloc mem_train_ctx.sys_cache failed!\n");
+ ret = -ENOMEM;
+ goto Err_out;
+ }
+
+- DRM_DEBUG("train_data_size:%llx,p2c_train_data_offset:%llx,c2p_train_data_offset:%llx.\n",
+- ctx->train_data_size,
+- ctx->p2c_train_data_offset,
+- ctx->c2p_train_data_offset);
++ dev_dbg(psp->adev->dev,
++ "train_data_size:%llx,p2c_train_data_offset:%llx,c2p_train_data_offset:%llx.\n",
++ ctx->train_data_size,
++ ctx->p2c_train_data_offset,
++ ctx->c2p_train_data_offset);
+ ctx->init = PSP_MEM_TRAIN_INIT_SUCCESS;
+ return 0;
+
+@@ -407,7 +408,7 @@ static int psp_sw_init(void *handle)
+
+ psp->cmd = kzalloc(sizeof(struct psp_gfx_cmd_resp), GFP_KERNEL);
+ if (!psp->cmd) {
+- DRM_ERROR("Failed to allocate memory to command buffer!\n");
++ dev_err(adev->dev, "Failed to allocate memory to command buffer!\n");
+ ret = -ENOMEM;
+ }
+
+@@ -454,13 +455,13 @@ static int psp_sw_init(void *handle)
+ if (mem_training_ctx->enable_mem_training) {
+ ret = psp_memory_training_init(psp);
+ if (ret) {
+- DRM_ERROR("Failed to initialize memory training!\n");
++ dev_err(adev->dev, "Failed to initialize memory training!\n");
+ return ret;
+ }
+
+ ret = psp_mem_training(psp, PSP_MEM_TRAIN_COLD_BOOT);
+ if (ret) {
+- DRM_ERROR("Failed to process memory training!\n");
++ dev_err(adev->dev, "Failed to process memory training!\n");
+ return ret;
+ }
+ }
+@@ -674,9 +675,11 @@ psp_cmd_submit_buf(struct psp_context *psp,
+ */
+ if (!skip_unsupport && (psp->cmd_buf_mem->resp.status || !timeout) && !ras_intr) {
+ if (ucode)
+- DRM_WARN("failed to load ucode %s(0x%X) ",
+- amdgpu_ucode_name(ucode->ucode_id), ucode->ucode_id);
+- DRM_WARN("psp gfx command %s(0x%X) failed and response status is (0x%X)\n",
++ dev_warn(psp->adev->dev,
++ "failed to load ucode %s(0x%X) ",
++ amdgpu_ucode_name(ucode->ucode_id), ucode->ucode_id);
++ dev_warn(psp->adev->dev,
++ "psp gfx command %s(0x%X) failed and response status is (0x%X)\n",
+ psp_gfx_cmd_name(psp->cmd_buf_mem->cmd_id), psp->cmd_buf_mem->cmd_id,
+ psp->cmd_buf_mem->resp.status);
+ /* If any firmware (including CAP) load fails under SRIOV, it should
+@@ -806,7 +809,7 @@ static int psp_tmr_init(struct psp_context *psp)
+ psp->fw_pri_buf) {
+ ret = psp_load_toc(psp, &tmr_size);
+ if (ret) {
+- DRM_ERROR("Failed to load toc\n");
++ dev_err(psp->adev->dev, "Failed to load toc\n");
+ return ret;
+ }
+ }
+@@ -854,7 +857,7 @@ static int psp_tmr_load(struct psp_context *psp)
+
+ psp_prep_tmr_cmd_buf(psp, cmd, psp->tmr_mc_addr, psp->tmr_bo);
+ if (psp->tmr_bo)
+- DRM_INFO("reserve 0x%lx from 0x%llx for PSP TMR\n",
++ dev_info(psp->adev->dev, "reserve 0x%lx from 0x%llx for PSP TMR\n",
+ amdgpu_bo_size(psp->tmr_bo), psp->tmr_mc_addr);
+
+ ret = psp_cmd_submit_buf(psp, NULL, cmd,
+@@ -1112,7 +1115,7 @@ int psp_reg_program(struct psp_context *psp, enum psp_reg_prog_id reg,
+ psp_prep_reg_prog_cmd_buf(cmd, reg, value);
+ ret = psp_cmd_submit_buf(psp, NULL, cmd, psp->fence_buf_mc_addr);
+ if (ret)
+- DRM_ERROR("PSP failed to program reg id %d", reg);
++ dev_err(psp->adev->dev, "PSP failed to program reg id %d\n", reg);
+
+ release_psp_cmd_buf(psp);
+
+@@ -1492,22 +1495,22 @@ static void psp_ras_ta_check_status(struct psp_context *psp)
+ switch (ras_cmd->ras_status) {
+ case TA_RAS_STATUS__ERROR_UNSUPPORTED_IP:
+ dev_warn(psp->adev->dev,
+- "RAS WARNING: cmd failed due to unsupported ip\n");
++ "RAS WARNING: cmd failed due to unsupported ip\n");
+ break;
+ case TA_RAS_STATUS__ERROR_UNSUPPORTED_ERROR_INJ:
+ dev_warn(psp->adev->dev,
+- "RAS WARNING: cmd failed due to unsupported error injection\n");
++ "RAS WARNING: cmd failed due to unsupported error injection\n");
+ break;
+ case TA_RAS_STATUS__SUCCESS:
+ break;
+ case TA_RAS_STATUS__TEE_ERROR_ACCESS_DENIED:
+ if (ras_cmd->cmd_id == TA_RAS_COMMAND__TRIGGER_ERROR)
+ dev_warn(psp->adev->dev,
+- "RAS WARNING: Inject error to critical region is not allowed\n");
++ "RAS WARNING: Inject error to critical region is not allowed\n");
+ break;
+ default:
+ dev_warn(psp->adev->dev,
+- "RAS WARNING: ras status = 0x%X\n", ras_cmd->ras_status);
++ "RAS WARNING: ras status = 0x%X\n", ras_cmd->ras_status);
+ break;
+ }
+ }
+@@ -1531,7 +1534,7 @@ int psp_ras_invoke(struct psp_context *psp, uint32_t ta_cmd_id)
+ return ret;
+
+ if (ras_cmd->if_version > RAS_TA_HOST_IF_VER) {
+- DRM_WARN("RAS: Unsupported Interface");
++ dev_warn(psp->adev->dev, "RAS: Unsupported Interface\n");
+ return -EINVAL;
+ }
+
+@@ -1681,7 +1684,7 @@ int psp_ras_initialize(struct psp_context *psp)
+ psp->ras_context.context.initialized = true;
+ else {
+ if (ras_cmd->ras_status)
+- dev_warn(psp->adev->dev, "RAS Init Status: 0x%X\n", ras_cmd->ras_status);
++ dev_warn(adev->dev, "RAS Init Status: 0x%X\n", ras_cmd->ras_status);
+
+ /* fail to load RAS TA */
+ psp->ras_context.context.initialized = false;
+@@ -2101,7 +2104,7 @@ static int psp_hw_start(struct psp_context *psp)
+ (psp->funcs->bootloader_load_kdb != NULL)) {
+ ret = psp_bootloader_load_kdb(psp);
+ if (ret) {
+- DRM_ERROR("PSP load kdb failed!\n");
++ dev_err(adev->dev, "PSP load kdb failed!\n");
+ return ret;
+ }
+ }
+@@ -2110,7 +2113,7 @@ static int psp_hw_start(struct psp_context *psp)
+ (psp->funcs->bootloader_load_spl != NULL)) {
+ ret = psp_bootloader_load_spl(psp);
+ if (ret) {
+- DRM_ERROR("PSP load spl failed!\n");
++ dev_err(adev->dev, "PSP load spl failed!\n");
+ return ret;
+ }
+ }
+@@ -2119,7 +2122,7 @@ static int psp_hw_start(struct psp_context *psp)
+ (psp->funcs->bootloader_load_sysdrv != NULL)) {
+ ret = psp_bootloader_load_sysdrv(psp);
+ if (ret) {
+- DRM_ERROR("PSP load sys drv failed!\n");
++ dev_err(adev->dev, "PSP load sys drv failed!\n");
+ return ret;
+ }
+ }
+@@ -2128,7 +2131,7 @@ static int psp_hw_start(struct psp_context *psp)
+ (psp->funcs->bootloader_load_soc_drv != NULL)) {
+ ret = psp_bootloader_load_soc_drv(psp);
+ if (ret) {
+- DRM_ERROR("PSP load soc drv failed!\n");
++ dev_err(adev->dev, "PSP load soc drv failed!\n");
+ return ret;
+ }
+ }
+@@ -2137,7 +2140,7 @@ static int psp_hw_start(struct psp_context *psp)
+ (psp->funcs->bootloader_load_intf_drv != NULL)) {
+ ret = psp_bootloader_load_intf_drv(psp);
+ if (ret) {
+- DRM_ERROR("PSP load intf drv failed!\n");
++ dev_err(adev->dev, "PSP load intf drv failed!\n");
+ return ret;
+ }
+ }
+@@ -2146,7 +2149,7 @@ static int psp_hw_start(struct psp_context *psp)
+ (psp->funcs->bootloader_load_dbg_drv != NULL)) {
+ ret = psp_bootloader_load_dbg_drv(psp);
+ if (ret) {
+- DRM_ERROR("PSP load dbg drv failed!\n");
++ dev_err(adev->dev, "PSP load dbg drv failed!\n");
+ return ret;
+ }
+ }
+@@ -2155,7 +2158,7 @@ static int psp_hw_start(struct psp_context *psp)
+ (psp->funcs->bootloader_load_ras_drv != NULL)) {
+ ret = psp_bootloader_load_ras_drv(psp);
+ if (ret) {
+- DRM_ERROR("PSP load ras_drv failed!\n");
++ dev_err(adev->dev, "PSP load ras_drv failed!\n");
+ return ret;
+ }
+ }
+@@ -2164,7 +2167,7 @@ static int psp_hw_start(struct psp_context *psp)
+ (psp->funcs->bootloader_load_sos != NULL)) {
+ ret = psp_bootloader_load_sos(psp);
+ if (ret) {
+- DRM_ERROR("PSP load sos failed!\n");
++ dev_err(adev->dev, "PSP load sos failed!\n");
+ return ret;
+ }
+ }
+@@ -2172,7 +2175,7 @@ static int psp_hw_start(struct psp_context *psp)
+
+ ret = psp_ring_create(psp, PSP_RING_TYPE__KM);
+ if (ret) {
+- DRM_ERROR("PSP create ring failed!\n");
++ dev_err(adev->dev, "PSP create ring failed!\n");
+ return ret;
+ }
+
+@@ -2182,7 +2185,7 @@ static int psp_hw_start(struct psp_context *psp)
+ if (!psp_boottime_tmr(psp)) {
+ ret = psp_tmr_init(psp);
+ if (ret) {
+- DRM_ERROR("PSP tmr init failed!\n");
++ dev_err(adev->dev, "PSP tmr init failed!\n");
+ return ret;
+ }
+ }
+@@ -2201,7 +2204,7 @@ static int psp_hw_start(struct psp_context *psp)
+
+ ret = psp_tmr_load(psp);
+ if (ret) {
+- DRM_ERROR("PSP load tmr failed!\n");
++ dev_err(adev->dev, "PSP load tmr failed!\n");
+ return ret;
+ }
+
+@@ -2448,7 +2451,8 @@ static void psp_print_fw_hdr(struct psp_context *psp,
+ }
+ }
+
+-static int psp_prep_load_ip_fw_cmd_buf(struct amdgpu_firmware_info *ucode,
++static int psp_prep_load_ip_fw_cmd_buf(struct psp_context *psp,
++ struct amdgpu_firmware_info *ucode,
+ struct psp_gfx_cmd_resp *cmd)
+ {
+ int ret;
+@@ -2461,7 +2465,7 @@ static int psp_prep_load_ip_fw_cmd_buf(struct amdgpu_firmware_info *ucode,
+
+ ret = psp_get_fw_type(ucode, &cmd->cmd.cmd_load_ip_fw.fw_type);
+ if (ret)
+- DRM_ERROR("Unknown firmware type\n");
++ dev_err(psp->adev->dev, "Unknown firmware type\n");
+
+ return ret;
+ }
+@@ -2472,7 +2476,7 @@ int psp_execute_ip_fw_load(struct psp_context *psp,
+ int ret = 0;
+ struct psp_gfx_cmd_resp *cmd = acquire_psp_cmd_buf(psp);
+
+- ret = psp_prep_load_ip_fw_cmd_buf(ucode, cmd);
++ ret = psp_prep_load_ip_fw_cmd_buf(psp, ucode, cmd);
+ if (!ret) {
+ ret = psp_cmd_submit_buf(psp, ucode, cmd,
+ psp->fence_buf_mc_addr);
+@@ -2507,13 +2511,13 @@ static int psp_load_smu_fw(struct psp_context *psp)
+ adev->ip_versions[MP0_HWIP][0] == IP_VERSION(11, 0, 2)))) {
+ ret = amdgpu_dpm_set_mp1_state(adev, PP_MP1_STATE_UNLOAD);
+ if (ret)
+- DRM_WARN("Failed to set MP1 state prepare for reload\n");
++ dev_err(adev->dev, "Failed to set MP1 state prepare for reload\n");
+ }
+
+ ret = psp_execute_ip_fw_load(psp, ucode);
+
+ if (ret)
+- DRM_ERROR("PSP load smu failed!\n");
++ dev_err(adev->dev, "PSP load smu failed!\n");
+
+ return ret;
+ }
+@@ -2609,7 +2613,7 @@ static int psp_load_non_psp_fw(struct psp_context *psp)
+ adev->virt.autoload_ucode_id : AMDGPU_UCODE_ID_RLC_G)) {
+ ret = psp_rlc_autoload_start(psp);
+ if (ret) {
+- DRM_ERROR("Failed to start rlc autoload\n");
++ dev_err(adev->dev, "Failed to start rlc autoload\n");
+ return ret;
+ }
+ }
+@@ -2631,7 +2635,7 @@ static int psp_load_fw(struct amdgpu_device *adev)
+
+ ret = psp_ring_init(psp, PSP_RING_TYPE__KM);
+ if (ret) {
+- DRM_ERROR("PSP ring init failed!\n");
++ dev_err(adev->dev, "PSP ring init failed!\n");
+ goto failed;
+ }
+ }
+@@ -2646,13 +2650,13 @@ static int psp_load_fw(struct amdgpu_device *adev)
+
+ ret = psp_asd_initialize(psp);
+ if (ret) {
+- DRM_ERROR("PSP load asd failed!\n");
++ dev_err(adev->dev, "PSP load asd failed!\n");
+ goto failed1;
+ }
+
+ ret = psp_rl_load(adev);
+ if (ret) {
+- DRM_ERROR("PSP load RL failed!\n");
++ dev_err(adev->dev, "PSP load RL failed!\n");
+ goto failed1;
+ }
+
+@@ -2672,7 +2676,7 @@ static int psp_load_fw(struct amdgpu_device *adev)
+ ret = psp_ras_initialize(psp);
+ if (ret)
+ dev_err(psp->adev->dev,
+- "RAS: Failed to initialize RAS\n");
++ "RAS: Failed to initialize RAS\n");
+
+ ret = psp_hdcp_initialize(psp);
+ if (ret)
+@@ -2725,7 +2729,7 @@ static int psp_hw_init(void *handle)
+
+ ret = psp_load_fw(adev);
+ if (ret) {
+- DRM_ERROR("PSP firmware loading failed\n");
++ dev_err(adev->dev, "PSP firmware loading failed\n");
+ goto failed;
+ }
+
+@@ -2772,7 +2776,7 @@ static int psp_suspend(void *handle)
+ psp->xgmi_context.context.initialized) {
+ ret = psp_xgmi_terminate(psp);
+ if (ret) {
+- DRM_ERROR("Failed to terminate xgmi ta\n");
++ dev_err(adev->dev, "Failed to terminate xgmi ta\n");
+ goto out;
+ }
+ }
+@@ -2780,46 +2784,46 @@ static int psp_suspend(void *handle)
+ if (psp->ta_fw) {
+ ret = psp_ras_terminate(psp);
+ if (ret) {
+- DRM_ERROR("Failed to terminate ras ta\n");
++ dev_err(adev->dev, "Failed to terminate ras ta\n");
+ goto out;
+ }
+ ret = psp_hdcp_terminate(psp);
+ if (ret) {
+- DRM_ERROR("Failed to terminate hdcp ta\n");
++ dev_err(adev->dev, "Failed to terminate hdcp ta\n");
+ goto out;
+ }
+ ret = psp_dtm_terminate(psp);
+ if (ret) {
+- DRM_ERROR("Failed to terminate dtm ta\n");
++ dev_err(adev->dev, "Failed to terminate dtm ta\n");
+ goto out;
+ }
+ ret = psp_rap_terminate(psp);
+ if (ret) {
+- DRM_ERROR("Failed to terminate rap ta\n");
++ dev_err(adev->dev, "Failed to terminate rap ta\n");
+ goto out;
+ }
+ ret = psp_securedisplay_terminate(psp);
+ if (ret) {
+- DRM_ERROR("Failed to terminate securedisplay ta\n");
++ dev_err(adev->dev, "Failed to terminate securedisplay ta\n");
+ goto out;
+ }
+ }
+
+ ret = psp_asd_terminate(psp);
+ if (ret) {
+- DRM_ERROR("Failed to terminate asd\n");
++ dev_err(adev->dev, "Failed to terminate asd\n");
+ goto out;
+ }
+
+ ret = psp_tmr_terminate(psp);
+ if (ret) {
+- DRM_ERROR("Failed to terminate tmr\n");
++ dev_err(adev->dev, "Failed to terminate tmr\n");
+ goto out;
+ }
+
+ ret = psp_ring_stop(psp, PSP_RING_TYPE__KM);
+ if (ret)
+- DRM_ERROR("PSP ring stop failed\n");
++ dev_err(adev->dev, "PSP ring stop failed\n");
+
+ out:
+ return ret;
+@@ -2831,12 +2835,12 @@ static int psp_resume(void *handle)
+ struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+ struct psp_context *psp = &adev->psp;
+
+- DRM_INFO("PSP is resuming...\n");
++ dev_info(adev->dev, "PSP is resuming...\n");
+
+ if (psp->mem_train_ctx.enable_mem_training) {
+ ret = psp_mem_training(psp, PSP_MEM_TRAIN_RESUME);
+ if (ret) {
+- DRM_ERROR("Failed to process memory training!\n");
++ dev_err(adev->dev, "Failed to process memory training!\n");
+ return ret;
+ }
+ }
+@@ -2853,7 +2857,7 @@ static int psp_resume(void *handle)
+
+ ret = psp_asd_initialize(psp);
+ if (ret) {
+- DRM_ERROR("PSP load asd failed!\n");
++ dev_err(adev->dev, "PSP load asd failed!\n");
+ goto failed;
+ }
+
+@@ -2877,7 +2881,7 @@ static int psp_resume(void *handle)
+ ret = psp_ras_initialize(psp);
+ if (ret)
+ dev_err(psp->adev->dev,
+- "RAS: Failed to initialize RAS\n");
++ "RAS: Failed to initialize RAS\n");
+
+ ret = psp_hdcp_initialize(psp);
+ if (ret)
+@@ -2905,7 +2909,7 @@ static int psp_resume(void *handle)
+ return 0;
+
+ failed:
+- DRM_ERROR("PSP resume failed\n");
++ dev_err(adev->dev, "PSP resume failed\n");
+ mutex_unlock(&adev->firmware.mutex);
+ return ret;
+ }
+@@ -2966,9 +2970,11 @@ int psp_ring_cmd_submit(struct psp_context *psp,
+ write_frame = ring_buffer_start + (psp_write_ptr_reg / rb_frame_size_dw);
+ /* Check invalid write_frame ptr address */
+ if ((write_frame < ring_buffer_start) || (ring_buffer_end < write_frame)) {
+- DRM_ERROR("ring_buffer_start = %p; ring_buffer_end = %p; write_frame = %p\n",
+- ring_buffer_start, ring_buffer_end, write_frame);
+- DRM_ERROR("write_frame is pointing to address out of bounds\n");
++ dev_err(adev->dev,
++ "ring_buffer_start = %p; ring_buffer_end = %p; write_frame = %p\n",
++ ring_buffer_start, ring_buffer_end, write_frame);
++ dev_err(adev->dev,
++ "write_frame is pointing to address out of bounds\n");
+ return -EINVAL;
+ }
+
+@@ -3495,7 +3501,7 @@ static ssize_t psp_usbc_pd_fw_sysfs_read(struct device *dev,
+ int ret;
+
+ if (!adev->ip_blocks[AMD_IP_BLOCK_TYPE_PSP].status.late_initialized) {
+- DRM_INFO("PSP block is not ready yet.");
++ dev_info(adev->dev, "PSP block is not ready yet\n.");
+ return -EBUSY;
+ }
+
+@@ -3504,7 +3510,7 @@ static ssize_t psp_usbc_pd_fw_sysfs_read(struct device *dev,
+ mutex_unlock(&adev->psp.mutex);
+
+ if (ret) {
+- DRM_ERROR("Failed to read USBC PD FW, err = %d", ret);
++ dev_err(adev->dev, "Failed to read USBC PD FW, err = %d\n", ret);
+ return ret;
+ }
+
+@@ -3526,7 +3532,7 @@ static ssize_t psp_usbc_pd_fw_sysfs_write(struct device *dev,
+ void *fw_pri_cpu_addr;
+
+ if (!adev->ip_blocks[AMD_IP_BLOCK_TYPE_PSP].status.late_initialized) {
+- DRM_INFO("PSP block is not ready yet.");
++ dev_err(adev->dev, "PSP block is not ready yet.");
+ return -EBUSY;
+ }
+
+@@ -3559,7 +3565,7 @@ static ssize_t psp_usbc_pd_fw_sysfs_write(struct device *dev,
+ release_firmware(usbc_pd_fw);
+ fail:
+ if (ret) {
+- DRM_ERROR("Failed to load USBC PD FW, err = %d", ret);
++ dev_err(adev->dev, "Failed to load USBC PD FW, err = %d", ret);
+ count = ret;
+ }
+
+@@ -3606,7 +3612,7 @@ static ssize_t amdgpu_psp_vbflash_write(struct file *filp, struct kobject *kobj,
+
+ /* Safeguard against memory drain */
+ if (adev->psp.vbflash_image_size > AMD_VBIOS_FILE_MAX_SIZE_B) {
+- dev_err(adev->dev, "File size cannot exceed %u", AMD_VBIOS_FILE_MAX_SIZE_B);
++ dev_err(adev->dev, "File size cannot exceed %u\n", AMD_VBIOS_FILE_MAX_SIZE_B);
+ kvfree(adev->psp.vbflash_tmp_buf);
+ adev->psp.vbflash_tmp_buf = NULL;
+ adev->psp.vbflash_image_size = 0;
+@@ -3625,7 +3631,7 @@ static ssize_t amdgpu_psp_vbflash_write(struct file *filp, struct kobject *kobj,
+ adev->psp.vbflash_image_size += count;
+ mutex_unlock(&adev->psp.mutex);
+
+- dev_dbg(adev->dev, "IFWI staged for update");
++ dev_dbg(adev->dev, "IFWI staged for update\n");
+
+ return count;
+ }
+@@ -3645,7 +3651,7 @@ static ssize_t amdgpu_psp_vbflash_read(struct file *filp, struct kobject *kobj,
+ if (adev->psp.vbflash_image_size == 0)
+ return -EINVAL;
+
+- dev_dbg(adev->dev, "PSP IFWI flash process initiated");
++ dev_dbg(adev->dev, "PSP IFWI flash process initiated\n");
+
+ ret = amdgpu_bo_create_kernel(adev, adev->psp.vbflash_image_size,
+ AMDGPU_GPU_PAGE_SIZE,
+@@ -3670,11 +3676,11 @@ static ssize_t amdgpu_psp_vbflash_read(struct file *filp, struct kobject *kobj,
+ adev->psp.vbflash_image_size = 0;
+
+ if (ret) {
+- dev_err(adev->dev, "Failed to load IFWI, err = %d", ret);
++ dev_err(adev->dev, "Failed to load IFWI, err = %d\n", ret);
+ return ret;
+ }
+
+- dev_dbg(adev->dev, "PSP IFWI flash process done");
++ dev_dbg(adev->dev, "PSP IFWI flash process done\n");
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From b4e89c2a5059ff01627fa0b8491cdb198d44377a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 14:23:41 +0200
+Subject: drm/bridge: ti-sn65dsi86: fix REFCLK setting
+
+From: Michael Walle <mwalle@kernel.org>
+
+[ Upstream commit bdd5a14e660062114bdebaef9ad52adf04970a89 ]
+
+The bridge has three bootstrap pins which are sampled to determine the
+frequency of the external reference clock. The driver will also
+(over)write that setting. But it seems this is racy after the bridge is
+enabled. It was observed that although the driver write the correct
+value (by sniffing on the I2C bus), the register has the wrong value.
+The datasheet states that the GPIO lines have to be stable for at least
+5us after asserting the EN signal. Thus, there seems to be some logic
+which samples the GPIO lines and this logic appears to overwrite the
+register value which was set by the driver. Waiting 20us after
+asserting the EN line resolves this issue.
+
+Fixes: a095f15c00e2 ("drm/bridge: add support for sn65dsi86 bridge driver")
+Signed-off-by: Michael Walle <mwalle@kernel.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20250821122341.1257286-1-mwalle@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/ti-sn65dsi86.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+index 59cbff209acd6..560935f2e8cbe 100644
+--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c
++++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+@@ -375,6 +375,17 @@ static int __maybe_unused ti_sn65dsi86_resume(struct device *dev)
+
+ gpiod_set_value_cansleep(pdata->enable_gpio, 1);
+
++ /*
++ * After EN is deasserted and an external clock is detected, the bridge
++ * will sample GPIO3:1 to determine its frequency. The driver will
++ * overwrite this setting in ti_sn_bridge_set_refclk_freq(). But this is
++ * racy. Thus we have to wait a couple of us. According to the datasheet
++ * the GPIO lines has to be stable at least 5 us (td5) but it seems that
++ * is not enough and the refclk frequency value is still lost or
++ * overwritten by the bridge itself. Waiting for 20us seems to work.
++ */
++ usleep_range(20, 30);
++
+ /*
+ * If we have a reference clock we can enable communication w/ the
+ * panel (including the aux channel) w/out any need for an input clock
+--
+2.51.0
+
--- /dev/null
+From c08217bcf10b8af09299c427773e7297ce50c649 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jul 2025 23:17:15 +0300
+Subject: hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM
+
+From: Vadim Pasternak <vadimp@nvidia.com>
+
+[ Upstream commit 1180c79fbf36e4c02e76ae4658509523437e52a4 ]
+
+The fans controlled by the driver can get stuck at 0 RPM if they are
+configured below a 20% duty cycle. The driver tries to avoid this by
+enforcing a minimum duty cycle of 20%, but this is done after the fans
+are registered with the thermal subsystem. This is too late as the
+thermal subsystem can set their current state before the driver is able
+to enforce the minimum duty cycle.
+
+Fix by setting the minimum duty cycle before registering the fans with
+the thermal subsystem.
+
+Fixes: d7efb2ebc7b3 ("hwmon: (mlxreg-fan) Extend driver to support multiply cooling devices")
+Reported-by: Nikolay Aleksandrov <razor@blackwall.org>
+Tested-by: Nikolay Aleksandrov <razor@blackwall.org>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
+Link: https://lore.kernel.org/r/20250730201715.1111133-1-vadimp@nvidia.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/mlxreg-fan.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c
+index a5f89aab3fb4d..c25a54d5b39ad 100644
+--- a/drivers/hwmon/mlxreg-fan.c
++++ b/drivers/hwmon/mlxreg-fan.c
+@@ -561,15 +561,14 @@ static int mlxreg_fan_cooling_config(struct device *dev, struct mlxreg_fan *fan)
+ if (!pwm->connected)
+ continue;
+ pwm->fan = fan;
++ /* Set minimal PWM speed. */
++ pwm->last_hwmon_state = MLXREG_FAN_PWM_DUTY2STATE(MLXREG_FAN_MIN_DUTY);
+ pwm->cdev = devm_thermal_of_cooling_device_register(dev, NULL, mlxreg_fan_name[i],
+ pwm, &mlxreg_fan_cooling_ops);
+ if (IS_ERR(pwm->cdev)) {
+ dev_err(dev, "Failed to register cooling device\n");
+ return PTR_ERR(pwm->cdev);
+ }
+-
+- /* Set minimal PWM speed. */
+- pwm->last_hwmon_state = MLXREG_FAN_PWM_DUTY2STATE(MLXREG_FAN_MIN_DUTY);
+ }
+
+ return 0;
+--
+2.51.0
+
--- /dev/null
+From 005dabe333427aeb250c14f76482893563c3ddcd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2025 21:10:06 +0800
+Subject: pcmcia: Add error handling for add_interval() in do_validate_mem()
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+[ Upstream commit 4a81f78caa53e0633cf311ca1526377d9bff7479 ]
+
+In the do_validate_mem(), the call to add_interval() does not
+handle errors. If kmalloc() fails in add_interval(), it could
+result in a null pointer being inserted into the linked list,
+leading to illegal memory access when sub_interval() is called
+next.
+
+This patch adds an error handling for the add_interval(). If
+add_interval() returns an error, the function will return early
+with the error code.
+
+Fixes: 7b4884ca8853 ("pcmcia: validate late-added resources")
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pcmcia/rsrc_nonstatic.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c
+index bf9d070a44966..da494fe451baf 100644
+--- a/drivers/pcmcia/rsrc_nonstatic.c
++++ b/drivers/pcmcia/rsrc_nonstatic.c
+@@ -375,7 +375,9 @@ static int do_validate_mem(struct pcmcia_socket *s,
+
+ if (validate && !s->fake_cis) {
+ /* move it to the validated data set */
+- add_interval(&s_data->mem_db_valid, base, size);
++ ret = add_interval(&s_data->mem_db_valid, base, size);
++ if (ret)
++ return ret;
+ sub_interval(&s_data->mem_db, base, size);
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 0907d7688e94c594f96c09fb72adc5d1e8e61139 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Mar 2025 14:39:56 +0800
+Subject: pcmcia: omap: Add missing check for platform_get_resource
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit ecef14f70ec9344a10c817248d2ac6cddee5921e ]
+
+Add missing check for platform_get_resource() and return error if it fails
+to catch the error.
+
+Fixes: d87d44f7ab35 ("ARM: omap1: move CF chipselect setup to board file")
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pcmcia/omap_cf.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pcmcia/omap_cf.c b/drivers/pcmcia/omap_cf.c
+index e613818dc0bc9..25382612e48ac 100644
+--- a/drivers/pcmcia/omap_cf.c
++++ b/drivers/pcmcia/omap_cf.c
+@@ -215,6 +215,8 @@ static int __init omap_cf_probe(struct platform_device *pdev)
+ return -EINVAL;
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (!res)
++ return -EINVAL;
+
+ cf = kzalloc(sizeof *cf, GFP_KERNEL);
+ if (!cf)
+--
+2.51.0
+
--- /dev/null
+From f5a9e2f96fd45e3bfe0e40289303ae91b49cb1b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:17:11 -0700
+Subject: perf bpf-event: Fix use-after-free in synthesis
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit d7b67dd6f9db7bd2c49b415e901849b182ff0735 ]
+
+Calls to perf_env__insert_bpf_prog_info may fail as a sideband thread
+may already have inserted the bpf_prog_info. Such failures may yield
+info_linear being freed which then causes use-after-free issues with
+the internal bpf_prog_info info struct. Make it so that
+perf_env__insert_bpf_prog_info trigger early non-error paths and fix
+the use-after-free in perf_event__synthesize_one_bpf_prog. Add proper
+return error handling to perf_env__add_bpf_info (that calls
+perf_env__insert_bpf_prog_info) and propagate the return value in its
+callers.
+
+Closes: https://lore.kernel.org/lkml/CAP-5=fWJQcmUOP7MuCA2ihKnDAHUCOBLkQFEkQES-1ZZTrgf8Q@mail.gmail.com/
+Fixes: 03edb7020bb9 ("perf bpf: Fix two memory leakages when calling perf_env__insert_bpf_prog_info()")
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20250902181713.309797-2-irogers@google.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/bpf-event.c | 39 +++++++++++++++++++++++++------------
+ 1 file changed, 27 insertions(+), 12 deletions(-)
+
+diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c
+index b94b4f16a60a5..1573d6b6478d2 100644
+--- a/tools/perf/util/bpf-event.c
++++ b/tools/perf/util/bpf-event.c
+@@ -289,9 +289,15 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_session *session,
+
+ info_node->info_linear = info_linear;
+ if (!perf_env__insert_bpf_prog_info(env, info_node)) {
+- free(info_linear);
++ /*
++ * Insert failed, likely because of a duplicate event
++ * made by the sideband thread. Ignore synthesizing the
++ * metadata.
++ */
+ free(info_node);
++ goto out;
+ }
++ /* info_linear is now owned by info_node and shouldn't be freed below. */
+ info_linear = NULL;
+
+ /*
+@@ -447,18 +453,18 @@ int perf_event__synthesize_bpf_events(struct perf_session *session,
+ return err;
+ }
+
+-static void perf_env__add_bpf_info(struct perf_env *env, u32 id)
++static int perf_env__add_bpf_info(struct perf_env *env, u32 id)
+ {
+ struct bpf_prog_info_node *info_node;
+ struct perf_bpil *info_linear;
+ struct btf *btf = NULL;
+ u64 arrays;
+ u32 btf_id;
+- int fd;
++ int fd, err = 0;
+
+ fd = bpf_prog_get_fd_by_id(id);
+ if (fd < 0)
+- return;
++ return -EINVAL;
+
+ arrays = 1UL << PERF_BPIL_JITED_KSYMS;
+ arrays |= 1UL << PERF_BPIL_JITED_FUNC_LENS;
+@@ -471,6 +477,7 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id)
+ info_linear = get_bpf_prog_info_linear(fd, arrays);
+ if (IS_ERR_OR_NULL(info_linear)) {
+ pr_debug("%s: failed to get BPF program info. aborting\n", __func__);
++ err = PTR_ERR(info_linear);
+ goto out;
+ }
+
+@@ -480,38 +487,46 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id)
+ if (info_node) {
+ info_node->info_linear = info_linear;
+ if (!perf_env__insert_bpf_prog_info(env, info_node)) {
++ pr_debug("%s: duplicate add bpf info request for id %u\n",
++ __func__, btf_id);
+ free(info_linear);
+ free(info_node);
++ goto out;
+ }
+- } else
++ } else {
+ free(info_linear);
++ err = -ENOMEM;
++ goto out;
++ }
+
+ if (btf_id == 0)
+ goto out;
+
+ btf = btf__load_from_kernel_by_id(btf_id);
+- if (libbpf_get_error(btf)) {
+- pr_debug("%s: failed to get BTF of id %u, aborting\n",
+- __func__, btf_id);
+- goto out;
++ if (!btf) {
++ err = -errno;
++ pr_debug("%s: failed to get BTF of id %u %d\n", __func__, btf_id, err);
++ } else {
++ perf_env__fetch_btf(env, btf_id, btf);
+ }
+- perf_env__fetch_btf(env, btf_id, btf);
+
+ out:
+ btf__free(btf);
+ close(fd);
++ return err;
+ }
+
+ static int bpf_event__sb_cb(union perf_event *event, void *data)
+ {
+ struct perf_env *env = data;
++ int ret = 0;
+
+ if (event->header.type != PERF_RECORD_BPF_EVENT)
+ return -1;
+
+ switch (event->bpf.type) {
+ case PERF_BPF_EVENT_PROG_LOAD:
+- perf_env__add_bpf_info(env, event->bpf.id);
++ ret = perf_env__add_bpf_info(env, event->bpf.id);
+
+ case PERF_BPF_EVENT_PROG_UNLOAD:
+ /*
+@@ -525,7 +540,7 @@ static int bpf_event__sb_cb(union perf_event *event, void *data)
+ break;
+ }
+
+- return 0;
++ return ret;
+ }
+
+ int evlist__add_bpf_sb_event(struct evlist *evlist, struct perf_env *env)
+--
+2.51.0
+
--- /dev/null
+From de76efe03d963e6bf4dca34c0eefc6e1d8e82e94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:17:12 -0700
+Subject: perf bpf-utils: Constify bpil_array_desc
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 1654a0e4d576d9e43fbb10ccf6a1b307c5c18566 ]
+
+The array's contents is a compile time constant. Constify to make the
+code more intention revealing and avoid unintended errors.
+
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20250902181713.309797-3-irogers@google.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Stable-dep-of: 01be43f2a0ea ("perf bpf-utils: Harden get_bpf_prog_info_linear")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/bpf-utils.c | 18 ++++++------------
+ 1 file changed, 6 insertions(+), 12 deletions(-)
+
+diff --git a/tools/perf/util/bpf-utils.c b/tools/perf/util/bpf-utils.c
+index 80b1d2b3729ba..64a5583446964 100644
+--- a/tools/perf/util/bpf-utils.c
++++ b/tools/perf/util/bpf-utils.c
+@@ -20,7 +20,7 @@ struct bpil_array_desc {
+ */
+ };
+
+-static struct bpil_array_desc bpil_array_desc[] = {
++static const struct bpil_array_desc bpil_array_desc[] = {
+ [PERF_BPIL_JITED_INSNS] = {
+ offsetof(struct bpf_prog_info, jited_prog_insns),
+ offsetof(struct bpf_prog_info, jited_prog_len),
+@@ -129,12 +129,10 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+
+ /* step 2: calculate total size of all arrays */
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
++ const struct bpil_array_desc *desc = &bpil_array_desc[i];
+ bool include_array = (arrays & (1UL << i)) > 0;
+- struct bpil_array_desc *desc;
+ __u32 count, size;
+
+- desc = bpil_array_desc + i;
+-
+ /* kernel is too old to support this field */
+ if (info_len < desc->array_offset + sizeof(__u32) ||
+ info_len < desc->count_offset + sizeof(__u32) ||
+@@ -163,13 +161,12 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+ ptr = info_linear->data;
+
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
+- struct bpil_array_desc *desc;
++ const struct bpil_array_desc *desc = &bpil_array_desc[i];
+ __u32 count, size;
+
+ if ((arrays & (1UL << i)) == 0)
+ continue;
+
+- desc = bpil_array_desc + i;
+ count = bpf_prog_info_read_offset_u32(&info, desc->count_offset);
+ size = bpf_prog_info_read_offset_u32(&info, desc->size_offset);
+ bpf_prog_info_set_offset_u32(&info_linear->info,
+@@ -192,13 +189,12 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+
+ /* step 6: verify the data */
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
+- struct bpil_array_desc *desc;
++ const struct bpil_array_desc *desc = &bpil_array_desc[i];
+ __u32 v1, v2;
+
+ if ((arrays & (1UL << i)) == 0)
+ continue;
+
+- desc = bpil_array_desc + i;
+ v1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset);
+ v2 = bpf_prog_info_read_offset_u32(&info_linear->info,
+ desc->count_offset);
+@@ -224,13 +220,12 @@ void bpil_addr_to_offs(struct perf_bpil *info_linear)
+ int i;
+
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
+- struct bpil_array_desc *desc;
++ const struct bpil_array_desc *desc = &bpil_array_desc[i];
+ __u64 addr, offs;
+
+ if ((info_linear->arrays & (1UL << i)) == 0)
+ continue;
+
+- desc = bpil_array_desc + i;
+ addr = bpf_prog_info_read_offset_u64(&info_linear->info,
+ desc->array_offset);
+ offs = addr - ptr_to_u64(info_linear->data);
+@@ -244,13 +239,12 @@ void bpil_offs_to_addr(struct perf_bpil *info_linear)
+ int i;
+
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
+- struct bpil_array_desc *desc;
++ const struct bpil_array_desc *desc = &bpil_array_desc[i];
+ __u64 addr, offs;
+
+ if ((info_linear->arrays & (1UL << i)) == 0)
+ continue;
+
+- desc = bpil_array_desc + i;
+ offs = bpf_prog_info_read_offset_u64(&info_linear->info,
+ desc->array_offset);
+ addr = offs + ptr_to_u64(info_linear->data);
+--
+2.51.0
+
--- /dev/null
+From a2b018b9d5ca7983542823bdfac4585899bfb8d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:17:13 -0700
+Subject: perf bpf-utils: Harden get_bpf_prog_info_linear
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 01be43f2a0eaeed83e94dee054742f37625c86d9 ]
+
+In get_bpf_prog_info_linear two calls to bpf_obj_get_info_by_fd are
+made, the first to compute memory requirements for a struct perf_bpil
+and the second to fill it in. Previously the code would warn when the
+second call didn't match the first. Such races can be common place in
+things like perf test, whose perf trace tests will frequently load BPF
+programs. Rather than a debug message, return actual errors for this
+case. Out of paranoia also validate the read bpf_prog_info array
+value. Change the type of ptr to avoid mismatched pointer type
+compiler warnings. Add some additional debug print outs and sanity
+asserts.
+
+Closes: https://lore.kernel.org/lkml/CAP-5=fWJQcmUOP7MuCA2ihKnDAHUCOBLkQFEkQES-1ZZTrgf8Q@mail.gmail.com/
+Fixes: 6ac22d036f86 ("perf bpf: Pull in bpf_program__get_prog_info_linear()")
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Link: https://lore.kernel.org/r/20250902181713.309797-4-irogers@google.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/bpf-utils.c | 43 ++++++++++++++++++++++++++++---------
+ 1 file changed, 33 insertions(+), 10 deletions(-)
+
+diff --git a/tools/perf/util/bpf-utils.c b/tools/perf/util/bpf-utils.c
+index 64a5583446964..5a66dc8594aa8 100644
+--- a/tools/perf/util/bpf-utils.c
++++ b/tools/perf/util/bpf-utils.c
+@@ -115,7 +115,7 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+ __u32 info_len = sizeof(info);
+ __u32 data_len = 0;
+ int i, err;
+- void *ptr;
++ __u8 *ptr;
+
+ if (arrays >> PERF_BPIL_LAST_ARRAY)
+ return ERR_PTR(-EINVAL);
+@@ -126,6 +126,8 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+ pr_debug("can't get prog info: %s", strerror(errno));
+ return ERR_PTR(-EFAULT);
+ }
++ if (info.type >= __MAX_BPF_PROG_TYPE)
++ pr_debug("%s:%d: unexpected program type %u\n", __func__, __LINE__, info.type);
+
+ /* step 2: calculate total size of all arrays */
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
+@@ -173,6 +175,8 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+ desc->count_offset, count);
+ bpf_prog_info_set_offset_u32(&info_linear->info,
+ desc->size_offset, size);
++ assert(ptr >= info_linear->data);
++ assert(ptr < &info_linear->data[data_len]);
+ bpf_prog_info_set_offset_u64(&info_linear->info,
+ desc->array_offset,
+ ptr_to_u64(ptr));
+@@ -186,26 +190,45 @@ get_bpf_prog_info_linear(int fd, __u64 arrays)
+ free(info_linear);
+ return ERR_PTR(-EFAULT);
+ }
++ if (info_linear->info.type >= __MAX_BPF_PROG_TYPE) {
++ pr_debug("%s:%d: unexpected program type %u\n",
++ __func__, __LINE__, info_linear->info.type);
++ }
+
+ /* step 6: verify the data */
++ ptr = info_linear->data;
+ for (i = PERF_BPIL_FIRST_ARRAY; i < PERF_BPIL_LAST_ARRAY; ++i) {
+ const struct bpil_array_desc *desc = &bpil_array_desc[i];
+- __u32 v1, v2;
++ __u32 count1, count2, size1, size2;
++ __u64 ptr2;
+
+ if ((arrays & (1UL << i)) == 0)
+ continue;
+
+- v1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset);
+- v2 = bpf_prog_info_read_offset_u32(&info_linear->info,
++ count1 = bpf_prog_info_read_offset_u32(&info, desc->count_offset);
++ count2 = bpf_prog_info_read_offset_u32(&info_linear->info,
+ desc->count_offset);
+- if (v1 != v2)
+- pr_warning("%s: mismatch in element count\n", __func__);
++ if (count1 != count2) {
++ pr_warning("%s: mismatch in element count %u vs %u\n", __func__, count1, count2);
++ free(info_linear);
++ return ERR_PTR(-ERANGE);
++ }
+
+- v1 = bpf_prog_info_read_offset_u32(&info, desc->size_offset);
+- v2 = bpf_prog_info_read_offset_u32(&info_linear->info,
++ size1 = bpf_prog_info_read_offset_u32(&info, desc->size_offset);
++ size2 = bpf_prog_info_read_offset_u32(&info_linear->info,
+ desc->size_offset);
+- if (v1 != v2)
+- pr_warning("%s: mismatch in rec size\n", __func__);
++ if (size1 != size2) {
++ pr_warning("%s: mismatch in rec size %u vs %u\n", __func__, size1, size2);
++ free(info_linear);
++ return ERR_PTR(-ERANGE);
++ }
++ ptr2 = bpf_prog_info_read_offset_u64(&info_linear->info, desc->array_offset);
++ if (ptr_to_u64(ptr) != ptr2) {
++ pr_warning("%s: mismatch in array %p vs %llx\n", __func__, ptr, ptr2);
++ free(info_linear);
++ return ERR_PTR(-ERANGE);
++ }
++ ptr += roundup(count1 * size1, sizeof(__u64));
+ }
+
+ /* step 7: update info_len and data_len */
+--
+2.51.0
+
alsa-hda-hdmi-add-pin-fix-for-another-hp-elitedesk-800-g4-model.patch
alsa-hda-realtek-fix-headset-mic-for-tongfang-x6r5xxy.patch
revert-drm-amdgpu-avoid-extra-evict-restore-process.patch
+pcmcia-omap-add-missing-check-for-platform_get_resou.patch
+pcmcia-add-error-handling-for-add_interval-in-do_val.patch
+hwmon-mlxreg-fan-prevent-fans-from-getting-stuck-at-.patch
+spi-spi-fsl-lpspi-fix-transmissions-when-using-cont.patch
+spi-spi-fsl-lpspi-set-correct-chip-select-polarity-b.patch
+spi-spi-fsl-lpspi-reset-fifo-and-disable-module-on-t.patch
+spi-spi-fsl-lpspi-clear-status-register-after-disabl.patch
+drm-bridge-ti-sn65dsi86-fix-refclk-setting.patch
+perf-bpf-event-fix-use-after-free-in-synthesis.patch
+perf-bpf-utils-constify-bpil_array_desc.patch
+perf-bpf-utils-harden-get_bpf_prog_info_linear.patch
+drm-amdgpu-replace-drm_-with-dev_-in-amdgpu_psp.c.patch
+drm-amd-amdgpu-fix-missing-error-return-on-kzalloc-f.patch
+tools-gpio-rm-.-.cmd-on-make-clean.patch
+tools-gpio-remove-the-include-directory-on-make-clea.patch
--- /dev/null
+From a818f1abe80666aeb2ca6a66272c4354299be95f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:14:43 +0100
+Subject: spi: spi-fsl-lpspi: Clear status register after disabling the module
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit dedf9c93dece441e9a0a4836458bc93677008ddd ]
+
+Clear the error flags after disabling the module to avoid the case when
+a flag is set again between flag clear and module disable. And use
+SR_CLEAR_MASK to replace hardcoded value for improved readability.
+
+Although fsl_lpspi_reset() was only introduced in commit a15dc3d657fa
+("spi: lpspi: Fix CLK pin becomes low before one transfer"), the
+original driver only reset SR in the interrupt handler, making it
+vulnerable to the same issue. Therefore the fixes commit is set at the
+introduction of the driver.
+
+Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: Ciprian Marian Costea <ciprianmarian.costea@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-4-6262b9aa9be4@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index d437ed1349edb..8ef82a11ebb0f 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -83,6 +83,8 @@
+ #define TCR_RXMSK BIT(19)
+ #define TCR_TXMSK BIT(18)
+
++#define SR_CLEAR_MASK GENMASK(13, 8)
++
+ struct fsl_lpspi_devtype_data {
+ u8 prescale_max;
+ };
+@@ -532,14 +534,13 @@ static int fsl_lpspi_reset(struct fsl_lpspi_data *fsl_lpspi)
+ fsl_lpspi_intctrl(fsl_lpspi, 0);
+ }
+
+- /* W1C for all flags in SR */
+- temp = 0x3F << 8;
+- writel(temp, fsl_lpspi->base + IMX7ULP_SR);
+-
+ /* Clear FIFO and disable module */
+ temp = CR_RRF | CR_RTF;
+ writel(temp, fsl_lpspi->base + IMX7ULP_CR);
+
++ /* W1C for all flags in SR */
++ writel(SR_CLEAR_MASK, fsl_lpspi->base + IMX7ULP_SR);
++
+ return 0;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 17c038db0641e1c5754531ad3c4b19371386fd6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:14:40 +0100
+Subject: spi: spi-fsl-lpspi: Fix transmissions when using CONT
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit 782a7c73078e1301c0c427f21c06377d77dfa541 ]
+
+Commit 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use
+CONT") breaks transmissions when CONT is used. The TDIE interrupt should
+not be disabled in all cases. If CONT is used and the TX transfer is not
+yet completed yet, but the interrupt handler is called because there are
+characters to be received, TDIE is replaced with FCIE. When the transfer
+is finally completed, SR_TDF is set but the interrupt handler isn't
+called again.
+
+Fixes: 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use CONT")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-1-6262b9aa9be4@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index fa899ab2014c6..06c4fccf2f16d 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -3,7 +3,7 @@
+ // Freescale i.MX7ULP LPSPI driver
+ //
+ // Copyright 2016 Freescale Semiconductor, Inc.
+-// Copyright 2018 NXP Semiconductors
++// Copyright 2018, 2023, 2025 NXP
+
+ #include <linux/clk.h>
+ #include <linux/completion.h>
+@@ -780,7 +780,7 @@ static irqreturn_t fsl_lpspi_isr(int irq, void *dev_id)
+ if (temp_SR & SR_MBF ||
+ readl(fsl_lpspi->base + IMX7ULP_FSR) & FSR_TXCOUNT) {
+ writel(SR_FCF, fsl_lpspi->base + IMX7ULP_SR);
+- fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE);
++ fsl_lpspi_intctrl(fsl_lpspi, IER_FCIE | (temp_IER & IER_TDIE));
+ return IRQ_HANDLED;
+ }
+
+--
+2.51.0
+
--- /dev/null
+From 85d8d1ecb4e1da5d74bede9fffc085432b6f0b59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:14:42 +0100
+Subject: spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit e811b088a3641861fc9d2b2b840efc61a0f1907d ]
+
+In DMA mode fsl_lpspi_reset() is always called at the end, even when the
+transfer is aborted. In PIO mode aborts skip the reset leaving the FIFO
+filled and the module enabled.
+
+Fix it by always calling fsl_lpspi_reset().
+
+Fixes: a15dc3d657fa ("spi: lpspi: Fix CLK pin becomes low before one transfer")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-3-6262b9aa9be4@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index b1ed34d237948..d437ed1349edb 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -730,12 +730,10 @@ static int fsl_lpspi_pio_transfer(struct spi_controller *controller,
+ fsl_lpspi_write_tx_fifo(fsl_lpspi);
+
+ ret = fsl_lpspi_wait_for_completion(controller);
+- if (ret)
+- return ret;
+
+ fsl_lpspi_reset(fsl_lpspi);
+
+- return 0;
++ return ret;
+ }
+
+ static int fsl_lpspi_transfer_one(struct spi_controller *controller,
+--
+2.51.0
+
--- /dev/null
+From eb93399bae1ec4baeb1d89ef648ec45b482d3284 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:14:41 +0100
+Subject: spi: spi-fsl-lpspi: Set correct chip-select polarity bit
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit cbe33705864ba2697a2939de715b81538cf32430 ]
+
+The driver currently supports multiple chip-selects, but only sets the
+polarity for the first one (CS 0). Fix it by setting the PCSPOL bit for
+the desired chip-select.
+
+Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-2-6262b9aa9be4@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index 06c4fccf2f16d..b1ed34d237948 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -5,6 +5,7 @@
+ // Copyright 2016 Freescale Semiconductor, Inc.
+ // Copyright 2018, 2023, 2025 NXP
+
++#include <linux/bitfield.h>
+ #include <linux/clk.h>
+ #include <linux/completion.h>
+ #include <linux/delay.h>
+@@ -70,7 +71,7 @@
+ #define DER_TDDE BIT(0)
+ #define CFGR1_PCSCFG BIT(27)
+ #define CFGR1_PINCFG (BIT(24)|BIT(25))
+-#define CFGR1_PCSPOL BIT(8)
++#define CFGR1_PCSPOL_MASK GENMASK(11, 8)
+ #define CFGR1_NOSTALL BIT(3)
+ #define CFGR1_HOST BIT(0)
+ #define FSR_TXCOUNT (0xFF)
+@@ -420,7 +421,9 @@ static int fsl_lpspi_config(struct fsl_lpspi_data *fsl_lpspi)
+ else
+ temp = CFGR1_PINCFG;
+ if (fsl_lpspi->config.mode & SPI_CS_HIGH)
+- temp |= CFGR1_PCSPOL;
++ temp |= FIELD_PREP(CFGR1_PCSPOL_MASK,
++ BIT(fsl_lpspi->config.chip_select));
++
+ writel(temp, fsl_lpspi->base + IMX7ULP_CFGR1);
+
+ temp = readl(fsl_lpspi->base + IMX7ULP_CR);
+--
+2.51.0
+
--- /dev/null
+From d124889361340972c20753ef3351252088cbf77a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 14:36:20 +0800
+Subject: tools: gpio: remove the include directory on make clean
+
+From: zhang jiao <zhangjiao2@cmss.chinamobile.com>
+
+[ Upstream commit ed42d80f3bae89592fbb2ffaf8b6b2e720d53f6a ]
+
+Remove the generated include directory when running make clean.
+
+Fixes: 8674cea84dc6 ("tools/gpio: move to tools buildsystem")
+Signed-off-by: Zhang Jiao <zhangjiao2@cmss.chinamobile.com>
+Link: https://lore.kernel.org/r/20250903063621.2424-1-zhangjiao2@cmss.chinamobile.com
+[Bartosz: add Fixes tag, improve the commit message]
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/gpio/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/gpio/Makefile b/tools/gpio/Makefile
+index ed565eb52275f..342e056c8c665 100644
+--- a/tools/gpio/Makefile
++++ b/tools/gpio/Makefile
+@@ -77,7 +77,7 @@ $(OUTPUT)gpio-watch: $(GPIO_WATCH_IN)
+
+ clean:
+ rm -f $(ALL_PROGRAMS)
+- rm -f $(OUTPUT)include/linux/gpio.h
++ rm -rf $(OUTPUT)include
+ find $(or $(OUTPUT),.) -name '*.o' -delete -o -name '\.*.d' -delete -o -name '\.*.cmd' -delete
+
+ install: $(ALL_PROGRAMS)
+--
+2.51.0
+
--- /dev/null
+From 3ed4eb85daa67c420c5f73a3cfa3f32b4854a0e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2024 14:29:42 +0800
+Subject: tools: gpio: rm .*.cmd on make clean
+
+From: zhangjiao <zhangjiao2@cmss.chinamobile.com>
+
+[ Upstream commit 931a36c4138ac418d487bd4db0d03780b46a77ba ]
+
+rm .*.cmd when calling make clean
+
+Signed-off-by: zhangjiao <zhangjiao2@cmss.chinamobile.com>
+Link: https://lore.kernel.org/r/20240829062942.11487-1-zhangjiao2@cmss.chinamobile.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Stable-dep-of: ed42d80f3bae ("tools: gpio: remove the include directory on make clean")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/gpio/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/gpio/Makefile b/tools/gpio/Makefile
+index d29c9c49e2512..ed565eb52275f 100644
+--- a/tools/gpio/Makefile
++++ b/tools/gpio/Makefile
+@@ -78,7 +78,7 @@ $(OUTPUT)gpio-watch: $(GPIO_WATCH_IN)
+ clean:
+ rm -f $(ALL_PROGRAMS)
+ rm -f $(OUTPUT)include/linux/gpio.h
+- find $(or $(OUTPUT),.) -name '*.o' -delete -o -name '\.*.d' -delete
++ find $(or $(OUTPUT),.) -name '*.o' -delete -o -name '\.*.d' -delete -o -name '\.*.cmd' -delete
+
+ install: $(ALL_PROGRAMS)
+ install -d -m 755 $(DESTDIR)$(bindir); \
+--
+2.51.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
