--- /dev/null
+From 73197a1c560960f16e597371bd2b7a6fda0653b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Aug 2026 22:57:40 +0800
+Subject: ALSA: usb-audio: Evaluate packsize caps at the right place
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 52521e8398839105ef8eb22b3f0993f9b0d11a57 ]
+
+We introduced the upper bound checks of the packet sizes by the
+ep->maxframesize for avoiding the URB submission errors. However, the
+check was applied at an incorrect place in the function
+snd_usb_endpoint_set_params() where ep->maxframesize isn't defined
+yet; the value is defined at a bit later position. So this ended up
+with a failure at the first run while the second run works.
+
+For fixing it, move the check at the correct place, right after the
+calculation of ep->maxframesize in the same function.
+
+Fixes: 7fe8dec3f628 ("ALSA: usb-audio: Cap the packet size pre-calculations")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=221292
+Cc: <stable@vger.kernel.org>
+Link: https://patch.msgid.link/20260410143220.1676344-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+[王YP: Move the check to `snd_usb_pcm_prepare()`. For linux-5.10.y,
+ ep->maxframesize is calculated in `snd_usb_pcm_prepare()`.]
+Signed-off-by: 王YP <pzqqt88198@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/endpoint.c | 3 ---
+ sound/usb/pcm.c | 7 +++++++
+ 2 files changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index 3ac4251f9cde6..730744104df61 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -1101,9 +1101,6 @@ int snd_usb_endpoint_set_params(struct snd_usb_endpoint *ep,
+ return -EINVAL;
+ }
+
+- ep->packsize[0] = min(ep->packsize[0], ep->maxframesize);
+- ep->packsize[1] = min(ep->packsize[1], ep->maxframesize);
+-
+ /* calculate the frequency in 16.16 format */
+ ep->freqm = ep->freqn;
+ ep->freqshift = INT_MIN;
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index f4494d0549172..802ed1dbd23b0 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -953,6 +953,13 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream)
+ subs->data_endpoint->curframesize =
+ bytes_to_frames(runtime, subs->data_endpoint->curpacksize);
+
++ subs->data_endpoint->packsize[0] = min(
++ subs->data_endpoint->packsize[0],
++ subs->data_endpoint->maxframesize);
++ subs->data_endpoint->packsize[1] = min(
++ subs->data_endpoint->packsize[1],
++ subs->data_endpoint->maxframesize);
++
+ /* reset the pointer */
+ subs->hwptr_done = 0;
+ subs->transfer_done = 0;
+--
+2.53.0
+
sctp-extract-sctp_v6_err_handle-function-from-sctp_v.patch
sctp-extract-sctp_v4_err_handle-function-from-sctp_v.patch
tls-don-t-abort-the-connection-on-signal-interrupted.patch
+spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch
+alsa-usb-audio-evaluate-packsize-caps-at-the-right-p.patch
--- /dev/null
+From 38b1b9d10ee97f5ab1f5ba97daee40fb7fbc75cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 May 2025 15:51:37 +0100
+Subject: spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit cac7e5054115fcc41b1cb050af8e8971f7c9b22b ]
+
+Repacking multiple smaller words into larger ones to make use of the
+full FIFO doesn't save anything in DMA mode, so don't bother doing it.
+
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-8-bea884630cfb@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-dspi.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index 580fdcbcd9b6c..2bf8cc137d31e 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -751,8 +751,12 @@ static void dspi_setup_accel(struct fsl_dspi *dspi)
+ struct spi_transfer *xfer = dspi->cur_transfer;
+ bool odd = !!(dspi->len & 1);
+
+- /* No accel for frames not multiple of 8 bits at the moment */
+- if (xfer->bits_per_word % 8)
++ /*
++ * No accel for DMA transfers or frames not multiples of 8 bits at the
++ * moment.
++ */
++ if (dspi->devtype_data->trans_mode == DSPI_DMA_MODE ||
++ xfer->bits_per_word % 8)
+ goto no_accel;
+
+ if (!odd && dspi->len <= dspi->devtype_data->fifo_size * 2) {
+@@ -761,10 +765,7 @@ static void dspi_setup_accel(struct fsl_dspi *dspi)
+ dspi->oper_bits_per_word = 8;
+ } else {
+ /* Start off with maximum supported by hardware */
+- if (dspi->devtype_data->trans_mode == DSPI_XSPI_MODE)
+- dspi->oper_bits_per_word = 32;
+- else
+- dspi->oper_bits_per_word = 16;
++ dspi->oper_bits_per_word = 32;
+
+ /*
+ * And go down only if the buffer can't be sent with
+--
+2.53.0
+
sctp-clear-control-chunk-transport-if-it-is-being-re.patch
tls-don-t-abort-the-connection-on-signal-interrupted.patch
hwmon-corsair-psu-fix-possible-out-of-bounds-access-.patch
+spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch
--- /dev/null
+From adbfdb6e441c7b35911ecd068c473436ae3599a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 May 2025 15:51:37 +0100
+Subject: spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit cac7e5054115fcc41b1cb050af8e8971f7c9b22b ]
+
+Repacking multiple smaller words into larger ones to make use of the
+full FIFO doesn't save anything in DMA mode, so don't bother doing it.
+
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-8-bea884630cfb@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-dspi.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index 580fdcbcd9b6c..2bf8cc137d31e 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -751,8 +751,12 @@ static void dspi_setup_accel(struct fsl_dspi *dspi)
+ struct spi_transfer *xfer = dspi->cur_transfer;
+ bool odd = !!(dspi->len & 1);
+
+- /* No accel for frames not multiple of 8 bits at the moment */
+- if (xfer->bits_per_word % 8)
++ /*
++ * No accel for DMA transfers or frames not multiples of 8 bits at the
++ * moment.
++ */
++ if (dspi->devtype_data->trans_mode == DSPI_DMA_MODE ||
++ xfer->bits_per_word % 8)
+ goto no_accel;
+
+ if (!odd && dspi->len <= dspi->devtype_data->fifo_size * 2) {
+@@ -761,10 +765,7 @@ static void dspi_setup_accel(struct fsl_dspi *dspi)
+ dspi->oper_bits_per_word = 8;
+ } else {
+ /* Start off with maximum supported by hardware */
+- if (dspi->devtype_data->trans_mode == DSPI_XSPI_MODE)
+- dspi->oper_bits_per_word = 32;
+- else
+- dspi->oper_bits_per_word = 16;
++ dspi->oper_bits_per_word = 32;
+
+ /*
+ * And go down only if the buffer can't be sent with
+--
+2.53.0
+
--- /dev/null
+From 69534a2a689605d4a8ad55dc8f8d43c5ec04c9db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2026 08:15:35 -0400
+Subject: KVM: x86: Check for invalid/obsolete root *after* making MMU pages
+ available
+
+From: Sean Christopherson <seanjc@google.com>
+
+[ Upstream commit 2abd5287f08319fa35764566b15c6e22cb1068db ]
+
+Check for a "stale" page fault, i.e. for an invalid and/or obsolete root,
+after making MMU pages available for the shadow MMU. If reclaiming shadow
+pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to
+map memory into an invalid root. On its own, populating an invalid root is
+"fine", but because child shadow pages inherit their parent's role, any
+children created during the map/fetch will be created as invalid pages,
+thus violating KVM's invariant that invalid pages are never on the list of
+active MMU pages.
+
+Note, the underlying flaw has existed since KVM first started tracking
+invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root
+pagetables"), but the true badness only came along in 2020 (Linux 5.9)
+with the invariant that invalid shadow pages can't be on the list of
+active pages.
+
+Note #2, inheriting role.invalid when creating child shadow pages is also
+far from ideal; that flaw will be addressed separately.
+
+Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
+Fixes: f95eec9bed76 ("KVM: x86/mmu: Don't put invalid SPs back on the list of active pages")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/mmu/mmu.c | 9 +++++----
+ arch/x86/kvm/mmu/paging_tmpl.h | 10 ++++++----
+ 2 files changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
+index 7fc8a819b31ac..34f09908961c5 100644
+--- a/arch/x86/kvm/mmu/mmu.c
++++ b/arch/x86/kvm/mmu/mmu.c
+@@ -4281,16 +4281,17 @@ static int direct_page_fault(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault
+ return r;
+ }
+
+- r = RET_PF_RETRY;
+ write_lock(&vcpu->kvm->mmu_lock);
+
+- if (is_page_fault_stale(vcpu, fault))
+- goto out_unlock;
+-
+ r = make_mmu_pages_available(vcpu);
+ if (r)
+ goto out_unlock;
+
++ if (is_page_fault_stale(vcpu, fault)) {
++ r = RET_PF_RETRY;
++ goto out_unlock;
++ }
++
+ r = direct_map(vcpu, fault);
+
+ out_unlock:
+diff --git a/arch/x86/kvm/mmu/paging_tmpl.h b/arch/x86/kvm/mmu/paging_tmpl.h
+index 8d1ab32ee5f9e..2ea7bd1a6bb5f 100644
+--- a/arch/x86/kvm/mmu/paging_tmpl.h
++++ b/arch/x86/kvm/mmu/paging_tmpl.h
+@@ -865,15 +865,17 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault
+
+ orig_pfn = fault->pfn;
+
+- r = RET_PF_RETRY;
+ write_lock(&vcpu->kvm->mmu_lock);
+
+- if (is_page_fault_stale(vcpu, fault))
+- goto out_unlock;
+-
+ r = make_mmu_pages_available(vcpu);
+ if (r)
+ goto out_unlock;
++
++ if (is_page_fault_stale(vcpu, fault)) {
++ r = RET_PF_RETRY;
++ goto out_unlock;
++ }
++
+ r = FNAME(fetch)(vcpu, fault, &walker);
+
+ out_unlock:
+--
+2.53.0
+
--- /dev/null
+From cb2d269cf84a987d6367a982f0d26aa99775fe98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2026 08:15:34 -0400
+Subject: KVM: x86/mmu: Rename __direct_map() to direct_map()
+
+From: David Matlack <dmatlack@google.com>
+
+[ Upstream commit 6c882ef4fc7bd99b67ad152e75428b669281c521 ]
+
+Rename __direct_map() to direct_map() since the leading underscores are
+unnecessary. This also makes the page fault handler names more
+consistent: kvm_tdp_mmu_page_fault() calls kvm_tdp_mmu_map() and
+direct_page_fault() calls direct_map().
+
+Opportunistically make some trivial cleanups to comments that had to be
+modified anyway since they mentioned __direct_map(). Specifically, use
+"()" when referring to functions, and include kvm_tdp_mmu_map() among
+the various callers of disallowed_hugepage_adjust().
+
+No functional change intended.
+
+Signed-off-by: David Matlack <dmatlack@google.com>
+Reviewed-by: Isaku Yamahata <isaku.yamahata@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Message-Id: <20220921173546.2674386-11-dmatlack@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Stable-dep-of: 2abd5287f083 ("KVM: x86: Check for invalid/obsolete root *after* making MMU pages available")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/mmu/mmu.c | 61 ++++++++++++++++-----------------
+ arch/x86/kvm/mmu/mmu_internal.h | 3 +-
+ arch/x86/kvm/mmu/paging_tmpl.h | 6 +---
+ 3 files changed, 33 insertions(+), 37 deletions(-)
+
+diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
+index 3b612294a1820..7fc8a819b31ac 100644
+--- a/arch/x86/kvm/mmu/mmu.c
++++ b/arch/x86/kvm/mmu/mmu.c
+@@ -3102,11 +3102,11 @@ void disallowed_hugepage_adjust(struct kvm_page_fault *fault, u64 spte, int cur_
+ is_shadow_present_pte(spte) &&
+ !is_large_pte(spte)) {
+ /*
+- * A small SPTE exists for this pfn, but FNAME(fetch)
+- * and __direct_map would like to create a large PTE
+- * instead: just force them to go down another level,
+- * patching back for them into pfn the next 9 bits of
+- * the address.
++ * A small SPTE exists for this pfn, but FNAME(fetch),
++ * direct_map(), or kvm_tdp_mmu_map() would like to create a
++ * large PTE instead: just force them to go down another level,
++ * patching back for them into pfn the next 9 bits of the
++ * address.
+ */
+ u64 page_mask = KVM_PAGES_PER_HPAGE(cur_level) -
+ KVM_PAGES_PER_HPAGE(cur_level - 1);
+@@ -3115,7 +3115,7 @@ void disallowed_hugepage_adjust(struct kvm_page_fault *fault, u64 spte, int cur_
+ }
+ }
+
+-static int __direct_map(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault)
++static int direct_map(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault)
+ {
+ struct kvm_shadow_walk_iterator it;
+ struct kvm_mmu_page *sp;
+@@ -4157,6 +4157,9 @@ static int kvm_faultin_pfn(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault)
+ struct kvm_memory_slot *slot = fault->slot;
+ bool async;
+
++ fault->mmu_seq = vcpu->kvm->mmu_invalidate_seq;
++ smp_rmb();
++
+ /*
+ * Retry the page fault if the gfn hit a memslot that is being deleted
+ * or moved. This ensures any existing SPTEs for the old memslot will
+@@ -4213,8 +4216,7 @@ static int kvm_faultin_pfn(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault)
+ * root was invalidated by a memslot update or a relevant mmu_notifier fired.
+ */
+ static bool is_page_fault_stale(struct kvm_vcpu *vcpu,
+- struct kvm_page_fault *fault,
+- unsigned long mmu_seq)
++ struct kvm_page_fault *fault)
+ {
+ struct kvm_mmu_page *sp = to_shadow_page(vcpu->arch.mmu->root.hpa);
+
+@@ -4234,14 +4236,13 @@ static bool is_page_fault_stale(struct kvm_vcpu *vcpu,
+ return true;
+
+ return fault->slot &&
+- mmu_invalidate_retry_hva(vcpu->kvm, mmu_seq, fault->hva);
++ mmu_invalidate_retry_hva(vcpu->kvm, fault->mmu_seq, fault->hva);
+ }
+
+ static int direct_page_fault(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault)
+ {
+ bool is_tdp_mmu_fault = is_tdp_mmu(vcpu->arch.mmu);
+
+- unsigned long mmu_seq;
+ kvm_pfn_t orig_pfn;
+ int r;
+
+@@ -4259,43 +4260,41 @@ static int direct_page_fault(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault
+ if (r)
+ return r;
+
+- mmu_seq = vcpu->kvm->mmu_invalidate_seq;
+- smp_rmb();
+-
+ r = kvm_faultin_pfn(vcpu, fault);
+ if (r != RET_PF_CONTINUE)
+ return r;
+-
+ r = handle_abnormal_pfn(vcpu, fault, ACC_ALL);
+ if (r != RET_PF_CONTINUE)
+ return r;
+
+ orig_pfn = fault->pfn;
+
++ if (is_tdp_mmu_fault) {
++ r = RET_PF_RETRY;
++ read_lock(&vcpu->kvm->mmu_lock);
++
++ if (!is_page_fault_stale(vcpu, fault))
++ r = kvm_tdp_mmu_map(vcpu, fault);
++
++ read_unlock(&vcpu->kvm->mmu_lock);
++ kvm_release_pfn_clean(orig_pfn);
++ return r;
++ }
++
+ r = RET_PF_RETRY;
++ write_lock(&vcpu->kvm->mmu_lock);
+
+- if (is_tdp_mmu_fault)
+- read_lock(&vcpu->kvm->mmu_lock);
+- else
+- write_lock(&vcpu->kvm->mmu_lock);
++ if (is_page_fault_stale(vcpu, fault))
++ goto out_unlock;
+
+- if (is_page_fault_stale(vcpu, fault, mmu_seq))
++ r = make_mmu_pages_available(vcpu);
++ if (r)
+ goto out_unlock;
+
+- if (is_tdp_mmu_fault) {
+- r = kvm_tdp_mmu_map(vcpu, fault);
+- } else {
+- r = make_mmu_pages_available(vcpu);
+- if (r)
+- goto out_unlock;
+- r = __direct_map(vcpu, fault);
+- }
++ r = direct_map(vcpu, fault);
+
+ out_unlock:
+- if (is_tdp_mmu_fault)
+- read_unlock(&vcpu->kvm->mmu_lock);
+- else
+- write_unlock(&vcpu->kvm->mmu_lock);
++ write_unlock(&vcpu->kvm->mmu_lock);
+ kvm_release_pfn_clean(orig_pfn);
+ return r;
+ }
+diff --git a/arch/x86/kvm/mmu/mmu_internal.h b/arch/x86/kvm/mmu/mmu_internal.h
+index 5e4be3bb3624c..009024d421831 100644
+--- a/arch/x86/kvm/mmu/mmu_internal.h
++++ b/arch/x86/kvm/mmu/mmu_internal.h
+@@ -197,7 +197,7 @@ struct kvm_page_fault {
+
+ /*
+ * Maximum page size that can be created for this fault; input to
+- * FNAME(fetch), __direct_map and kvm_tdp_mmu_map.
++ * FNAME(fetch), direct_map() and kvm_tdp_mmu_map().
+ */
+ u8 max_level;
+
+@@ -220,6 +220,7 @@ struct kvm_page_fault {
+ struct kvm_memory_slot *slot;
+
+ /* Outputs of kvm_faultin_pfn. */
++ unsigned long mmu_seq;
+ kvm_pfn_t pfn;
+ hva_t hva;
+ bool map_writable;
+diff --git a/arch/x86/kvm/mmu/paging_tmpl.h b/arch/x86/kvm/mmu/paging_tmpl.h
+index 1c7d73b8081c6..8d1ab32ee5f9e 100644
+--- a/arch/x86/kvm/mmu/paging_tmpl.h
++++ b/arch/x86/kvm/mmu/paging_tmpl.h
+@@ -792,7 +792,6 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault
+ struct guest_walker walker;
+ kvm_pfn_t orig_pfn;
+ int r;
+- unsigned long mmu_seq;
+ bool is_self_change_mapping;
+
+ pgprintk("%s: addr %lx err %x\n", __func__, fault->addr, fault->error_code);
+@@ -837,9 +836,6 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault
+ else
+ fault->max_level = walker.level;
+
+- mmu_seq = vcpu->kvm->mmu_invalidate_seq;
+- smp_rmb();
+-
+ r = kvm_faultin_pfn(vcpu, fault);
+ if (r != RET_PF_CONTINUE)
+ return r;
+@@ -872,7 +868,7 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault
+ r = RET_PF_RETRY;
+ write_lock(&vcpu->kvm->mmu_lock);
+
+- if (is_page_fault_stale(vcpu, fault, mmu_seq))
++ if (is_page_fault_stale(vcpu, fault))
+ goto out_unlock;
+
+ r = make_mmu_pages_available(vcpu);
+--
+2.53.0
+
hwmon-corsair-psu-fix-possible-out-of-bounds-access-.patch
regulator-devres-add-api-for-reference-voltage-suppl.patch
hwmon-ads7828-fix-external-vref-regulator-handling.patch
+kvm-x86-mmu-rename-__direct_map-to-direct_map.patch
+kvm-x86-check-for-invalid-obsolete-root-after-making.patch
+spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch
--- /dev/null
+From ca61f282c139318702bd9ffed722e7d0a3577c10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 May 2025 15:51:37 +0100
+Subject: spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit cac7e5054115fcc41b1cb050af8e8971f7c9b22b ]
+
+Repacking multiple smaller words into larger ones to make use of the
+full FIFO doesn't save anything in DMA mode, so don't bother doing it.
+
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-8-bea884630cfb@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-dspi.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index 3a33156f52740..840b97ae6ec30 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -751,8 +751,12 @@ static void dspi_setup_accel(struct fsl_dspi *dspi)
+ struct spi_transfer *xfer = dspi->cur_transfer;
+ bool odd = !!(dspi->len & 1);
+
+- /* No accel for frames not multiple of 8 bits at the moment */
+- if (xfer->bits_per_word % 8)
++ /*
++ * No accel for DMA transfers or frames not multiples of 8 bits at the
++ * moment.
++ */
++ if (dspi->devtype_data->trans_mode == DSPI_DMA_MODE ||
++ xfer->bits_per_word % 8)
+ goto no_accel;
+
+ if (!odd && dspi->len <= dspi->devtype_data->fifo_size * 2) {
+@@ -761,10 +765,7 @@ static void dspi_setup_accel(struct fsl_dspi *dspi)
+ dspi->oper_bits_per_word = 8;
+ } else {
+ /* Start off with maximum supported by hardware */
+- if (dspi->devtype_data->trans_mode == DSPI_XSPI_MODE)
+- dspi->oper_bits_per_word = 32;
+- else
+- dspi->oper_bits_per_word = 16;
++ dspi->oper_bits_per_word = 32;
+
+ /*
+ * And go down only if the buffer can't be sent with
+--
+2.53.0
+
--- /dev/null
+From e52937a68369296de98c7e296d0436495c29f6a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Oct 2024 19:57:14 +0800
+Subject: mm/vmscan: wake up flushers conditionally to avoid cgroup OOM
+
+From: Zeng Jingxiang <linuszeng@tencent.com>
+
+[ Upstream commit 1bc542c6a0d1444559ab75823a89a94d244bf933 ]
+
+Commit 14aa8b2d5c2e ("mm/mglru: don't sync disk for each aging cycle")
+removed the opportunity to wake up flushers during the MGLRU page
+reclamation process can lead to an increased likelihood of triggering OOM
+when encountering many dirty pages during reclamation on MGLRU.
+
+This leads to premature OOM if there are too many dirty pages in cgroup:
+Killed
+
+dd invoked oom-killer: gfp_mask=0x101cca(GFP_HIGHUSER_MOVABLE|__GFP_WRITE),
+order=0, oom_score_adj=0
+
+Call Trace:
+ <TASK>
+ dump_stack_lvl+0x5f/0x80
+ dump_stack+0x14/0x20
+ dump_header+0x46/0x1b0
+ oom_kill_process+0x104/0x220
+ out_of_memory+0x112/0x5a0
+ mem_cgroup_out_of_memory+0x13b/0x150
+ try_charge_memcg+0x44f/0x5c0
+ charge_memcg+0x34/0x50
+ __mem_cgroup_charge+0x31/0x90
+ filemap_add_folio+0x4b/0xf0
+ __filemap_get_folio+0x1a4/0x5b0
+ ? srso_return_thunk+0x5/0x5f
+ ? __block_commit_write+0x82/0xb0
+ ext4_da_write_begin+0xe5/0x270
+ generic_perform_write+0x134/0x2b0
+ ext4_buffered_write_iter+0x57/0xd0
+ ext4_file_write_iter+0x76/0x7d0
+ ? selinux_file_permission+0x119/0x150
+ ? srso_return_thunk+0x5/0x5f
+ ? srso_return_thunk+0x5/0x5f
+ vfs_write+0x30c/0x440
+ ksys_write+0x65/0xe0
+ __x64_sys_write+0x1e/0x30
+ x64_sys_call+0x11c2/0x1d50
+ do_syscall_64+0x47/0x110
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+ memory: usage 308224kB, limit 308224kB, failcnt 2589
+ swap: usage 0kB, limit 9007199254740988kB, failcnt 0
+
+ ...
+ file_dirty 303247360
+ file_writeback 0
+ ...
+
+oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,
+mems_allowed=0,oom_memcg=/test,task_memcg=/test,task=dd,pid=4404,uid=0
+Memory cgroup out of memory: Killed process 4404 (dd) total-vm:10512kB,
+anon-rss:1152kB, file-rss:1824kB, shmem-rss:0kB, UID:0 pgtables:76kB
+oom_score_adj:0
+
+The flusher wake up was removed to decrease SSD wearing, but if we are
+seeing all dirty folios at the tail of an LRU, not waking up the flusher
+could lead to thrashing easily. So wake it up when a memcg is about to
+OOM due to dirty caches.
+
+I did run the build kernel test[1] on V6, with -j16 1G memcg on my local
+branch:
+
+Without the patch(10 times):
+user 1449.394
+system 368.78 372.58 363.03 362.31 360.84 372.70 368.72 364.94 373.51
+366.58 (avg 367.399)
+real 164.883
+
+With the V6 patch(10 times):
+user 1447.525
+system 360.87 360.63 372.39 364.09 368.49 365.15 359.93 362.04 359.72
+354.60 (avg 362.79)
+real 164.514
+
+Test results show that this patch has about 1% performance improvement,
+which should be caused by noise.
+
+Link: https://lkml.kernel.org/r/20241026115714.1437435-1-jingxiangzeng.cas@gmail.com
+Link: https://lore.kernel.org/all/CACePvbV4L-gRN9UKKuUnksfVJjOTq_5Sti2-e=pb_w51kucLKQ@mail.gmail.com/ [1]
+Fixes: 14aa8b2d5c2e ("mm/mglru: don't sync disk for each aging cycle")
+Suggested-by: Wei Xu <weixugc@google.com>
+Signed-off-by: Zeng Jingxiang <linuszeng@tencent.com>
+Signed-off-by: Kairui Song <kasong@tencent.com>
+Reviewed-by: Wei Xu <weixugc@google.com>
+Tested-by: Chris Li <chrisl@kernel.org>
+Cc: T.J. Mercier <tjmercier@google.com>
+Cc: Yu Zhao <yuzhao@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/vmscan.c | 25 ++++++++++++++++++++++---
+ 1 file changed, 22 insertions(+), 3 deletions(-)
+
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index deeb4310fd54c..20f4cb33d8e8a 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -4313,6 +4313,7 @@ static bool sort_folio(struct lruvec *lruvec, struct folio *folio, struct scan_c
+ int tier_idx)
+ {
+ bool success;
++ bool dirty, writeback;
+ int gen = folio_lru_gen(folio);
+ int type = folio_is_file_lru(folio);
+ int zone = folio_zonenum(folio);
+@@ -4358,9 +4359,17 @@ static bool sort_folio(struct lruvec *lruvec, struct folio *folio, struct scan_c
+ return true;
+ }
+
++ dirty = folio_test_dirty(folio);
++ writeback = folio_test_writeback(folio);
++ if (type == LRU_GEN_FILE && dirty) {
++ sc->nr.file_taken += delta;
++ if (!writeback)
++ sc->nr.unqueued_dirty += delta;
++ }
++
+ /* waiting for writeback */
+- if (folio_test_locked(folio) || folio_test_writeback(folio) ||
+- (type == LRU_GEN_FILE && folio_test_dirty(folio))) {
++ if (folio_test_locked(folio) || writeback ||
++ (type == LRU_GEN_FILE && dirty)) {
+ gen = folio_inc_gen(lruvec, folio, true);
+ list_move(&folio->lru, &lrugen->folios[gen][type][zone]);
+ return true;
+@@ -4476,7 +4485,8 @@ static int scan_folios(struct lruvec *lruvec, struct scan_control *sc,
+ trace_mm_vmscan_lru_isolate(sc->reclaim_idx, sc->order, MAX_LRU_BATCH,
+ scanned, skipped, isolated,
+ type ? LRU_INACTIVE_FILE : LRU_INACTIVE_ANON);
+-
++ if (type == LRU_GEN_FILE)
++ sc->nr.file_taken += isolated;
+ /*
+ * There might not be eligible folios due to reclaim_idx. Check the
+ * remaining to prevent livelock if it's not making progress.
+@@ -4610,6 +4620,7 @@ static int evict_folios(struct lruvec *lruvec, struct scan_control *sc, int swap
+ return scanned;
+ retry:
+ reclaimed = shrink_folio_list(&list, pgdat, sc, &stat, false);
++ sc->nr.unqueued_dirty += stat.nr_unqueued_dirty;
+ sc->nr_reclaimed += reclaimed;
+ trace_mm_vmscan_lru_shrink_inactive(pgdat->node_id,
+ scanned, reclaimed, &stat, sc->priority,
+@@ -4821,6 +4832,13 @@ static bool try_to_shrink_lruvec(struct lruvec *lruvec, struct scan_control *sc)
+ cond_resched();
+ }
+
++ /*
++ * If too many file cache in the coldest generation can't be evicted
++ * due to being dirty, wake up the flusher.
++ */
++ if (sc->nr.unqueued_dirty && sc->nr.unqueued_dirty == sc->nr.file_taken)
++ wakeup_flusher_threads(WB_REASON_VMSCAN);
++
+ /* whether this lruvec should be rotated */
+ return nr_to_scan < 0;
+ }
+@@ -5966,6 +5984,7 @@ static void shrink_node(pg_data_t *pgdat, struct scan_control *sc)
+ bool reclaimable = false;
+
+ if (lru_gen_enabled() && root_reclaim(sc)) {
++ memset(&sc->nr, 0, sizeof(sc->nr));
+ lru_gen_shrink_node(pgdat, sc);
+ return;
+ }
+--
+2.53.0
+
--- /dev/null
+From e2ae5ebf404a8a679fdcaa433a3b43fcbc340f0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Aug 2026 18:13:36 +0200
+Subject: mtd: spinand: fix direct mapping creation sizes
+
+From: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+
+[ Upstream commit e4a0cf9f1d90e6888e5373da3314f761024f6c97 ]
+
+Continuous mode is only supported for data reads, thus writing
+requires only single flash page mapping.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/spi/core.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
+index 48ac009cbaad2..a480243385e2e 100644
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -1036,18 +1036,13 @@ static int spinand_create_dirmap(struct spinand_device *spinand,
+ unsigned int plane)
+ {
+ struct nand_device *nand = spinand_to_nand(spinand);
+- struct spi_mem_dirmap_info info = {
+- .length = nanddev_page_size(nand) +
+- nanddev_per_page_oobsize(nand),
+- };
++ struct spi_mem_dirmap_info info = { 0 };
+ struct spi_mem_dirmap_desc *desc;
+
+- if (spinand->cont_read_possible)
+- info.length = nanddev_eraseblock_size(nand);
+-
+ /* The plane number is passed in MSB just above the column address */
+ info.offset = plane << fls(nand->memorg.pagesize);
+
++ info.length = nanddev_page_size(nand) + nanddev_per_page_oobsize(nand);
+ info.op_tmpl = *spinand->op_templates.update_cache;
+ desc = devm_spi_mem_dirmap_create(&spinand->spimem->spi->dev,
+ spinand->spimem, &info);
+@@ -1056,6 +1051,8 @@ static int spinand_create_dirmap(struct spinand_device *spinand,
+
+ spinand->dirmaps[plane].wdesc = desc;
+
++ if (spinand->cont_read_possible)
++ info.length = nanddev_eraseblock_size(nand);
+ info.op_tmpl = *spinand->op_templates.read_cache;
+ desc = devm_spi_mem_dirmap_create(&spinand->spimem->spi->dev,
+ spinand->spimem, &info);
+@@ -1071,6 +1068,7 @@ static int spinand_create_dirmap(struct spinand_device *spinand,
+ return 0;
+ }
+
++ info.length = nanddev_page_size(nand) + nanddev_per_page_oobsize(nand);
+ info.op_tmpl = *spinand->op_templates.update_cache;
+ info.op_tmpl.data.ecc = true;
+ desc = devm_spi_mem_dirmap_create(&spinand->spimem->spi->dev,
+@@ -1080,6 +1078,8 @@ static int spinand_create_dirmap(struct spinand_device *spinand,
+
+ spinand->dirmaps[plane].wdesc_ecc = desc;
+
++ if (spinand->cont_read_possible)
++ info.length = nanddev_eraseblock_size(nand);
+ info.op_tmpl = *spinand->op_templates.read_cache;
+ info.op_tmpl.data.ecc = true;
+ desc = devm_spi_mem_dirmap_create(&spinand->spimem->spi->dev,
+--
+2.53.0
+
--- /dev/null
+From 2a690438191571ec45791997ae1e06575fd3555a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Aug 2026 18:13:38 +0200
+Subject: mtd: spinand: repeat reading in regular mode if continuous reading
+ fails
+
+From: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+
+[ Upstream commit 010dc7f2dd6a0078ade3f88f627ed5fbf45ceb94 ]
+
+Continuous reading may result in multiple flash pages reading in one
+operation. Unfortunately, not all spinand controllers support such
+large reading. They will read less data. Unfortunately, the operation
+can't be continued.
+
+In this case:
+ * disable continuous reading on this (not good enough) spi controller
+ * repeat reading in regular mode.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/spi/core.c | 25 +++++++++++++++++++++----
+ 1 file changed, 21 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
+index 10339209e7322..bf16901b77b64 100644
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -427,8 +427,16 @@ static int spinand_read_from_cache_op(struct spinand_device *spinand,
+ * Dirmap accesses are allowed to toggle the CS.
+ * Toggling the CS during a continuous read is forbidden.
+ */
+- if (nbytes && req->continuous)
+- return -EIO;
++ if (nbytes && req->continuous) {
++ /*
++ * Spi controller with broken support of continuous
++ * reading was detected. Disable future use of
++ * continuous reading and return -EAGAIN to retry
++ * reading within regular mode.
++ */
++ spinand->cont_read_possible = false;
++ return -EAGAIN;
++ }
+ }
+
+ if (req->datalen)
+@@ -849,10 +857,19 @@ static int spinand_mtd_read(struct mtd_info *mtd, loff_t from,
+
+ old_stats = mtd->ecc_stats;
+
+- if (spinand_use_cont_read(mtd, from, ops))
++ if (spinand_use_cont_read(mtd, from, ops)) {
+ ret = spinand_mtd_continuous_page_read(mtd, from, ops, &max_bitflips);
+- else
++ if (ret == -EAGAIN && !spinand->cont_read_possible) {
++ /*
++ * Spi controller with broken support of continuous
++ * reading was detected (see spinand_read_from_cache_op()),
++ * repeat reading in regular mode.
++ */
++ ret = spinand_mtd_regular_page_read(mtd, from, ops, &max_bitflips);
++ }
++ } else {
+ ret = spinand_mtd_regular_page_read(mtd, from, ops, &max_bitflips);
++ }
+
+ if (ops->stats) {
+ ops->stats->uncorrectable_errors +=
+--
+2.53.0
+
--- /dev/null
+From 4e91bcda764fef48c244cba38ee1ebde14e5ab07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Aug 2026 18:13:37 +0200
+Subject: mtd: spinand: try a regular dirmap if creating a dirmap for
+ continuous reading fails
+
+From: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+
+[ Upstream commit 004f8ea0d9917398aabff7388b3bf62a84a4088b ]
+
+Continuous reading may result in multiple flash pages reading in one
+operation. Typically only one flash page has read/written (a little bit
+more than 2-4 Kb), but continuous reading requires the spi controller
+to read up to 512 Kb in one operation without toggling CS in beetween.
+
+Roughly speaking spi controllers can be divided on 2 categories:
+ * spi controllers without dirmap acceleration support
+ * spi controllers with dirmap acceleration support
+
+Firt of them will have issues with continuous reading if restriction on
+the transfer length is implemented in the adjust_op_size() handler.
+Second group often supports acceleration of single page only reading.
+Thus enabling of continuous reading can break flash reading.
+
+This patch tries to create dirmap for continuous reading first and
+fallback to regular reading if spi controller refuses to create it.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/spi/core.c | 43 ++++++++++++++++++++++++++++++-------
+ 1 file changed, 35 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
+index a480243385e2e..10339209e7322 100644
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -1032,6 +1032,39 @@ static int spinand_mtd_block_isreserved(struct mtd_info *mtd, loff_t offs)
+ return ret;
+ }
+
++static struct spi_mem_dirmap_desc *spinand_create_rdesc(
++ struct spinand_device *spinand,
++ struct spi_mem_dirmap_info *info)
++{
++ struct nand_device *nand = spinand_to_nand(spinand);
++ struct spi_mem_dirmap_desc *desc = NULL;
++
++ if (spinand->cont_read_possible) {
++ /*
++ * spi controller may return an error if info->length is
++ * too large
++ */
++ info->length = nanddev_eraseblock_size(nand);
++ desc = devm_spi_mem_dirmap_create(&spinand->spimem->spi->dev,
++ spinand->spimem, info);
++ }
++
++ if (IS_ERR_OR_NULL(desc)) {
++ /*
++ * continuous reading is not supported by flash or
++ * its spi controller, use regular reading
++ */
++ spinand->cont_read_possible = false;
++
++ info->length = nanddev_page_size(nand) +
++ nanddev_per_page_oobsize(nand);
++ desc = devm_spi_mem_dirmap_create(&spinand->spimem->spi->dev,
++ spinand->spimem, info);
++ }
++
++ return desc;
++}
++
+ static int spinand_create_dirmap(struct spinand_device *spinand,
+ unsigned int plane)
+ {
+@@ -1051,11 +1084,8 @@ static int spinand_create_dirmap(struct spinand_device *spinand,
+
+ spinand->dirmaps[plane].wdesc = desc;
+
+- if (spinand->cont_read_possible)
+- info.length = nanddev_eraseblock_size(nand);
+ info.op_tmpl = *spinand->op_templates.read_cache;
+- desc = devm_spi_mem_dirmap_create(&spinand->spimem->spi->dev,
+- spinand->spimem, &info);
++ desc = spinand_create_rdesc(spinand, &info);
+ if (IS_ERR(desc))
+ return PTR_ERR(desc);
+
+@@ -1078,12 +1108,9 @@ static int spinand_create_dirmap(struct spinand_device *spinand,
+
+ spinand->dirmaps[plane].wdesc_ecc = desc;
+
+- if (spinand->cont_read_possible)
+- info.length = nanddev_eraseblock_size(nand);
+ info.op_tmpl = *spinand->op_templates.read_cache;
+ info.op_tmpl.data.ecc = true;
+- desc = devm_spi_mem_dirmap_create(&spinand->spimem->spi->dev,
+- spinand->spimem, &info);
++ desc = spinand_create_rdesc(spinand, &info);
+ if (IS_ERR(desc))
+ return PTR_ERR(desc);
+
+--
+2.53.0
+
--- /dev/null
+From 837f293acc3d475a9489a946d2b8860d4a2a5853 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2026 14:39:02 +0200
+Subject: net: fec: do not release NULL pages when RX buffer allocation fails
+
+From: Mehmet Fide <mehmet.fide@screeningeagle.com>
+
+fec_enet_alloc_rxq_buffers() leaves the loop as soon as
+page_pool_dev_alloc_pages() returns NULL and jumps to err_alloc, which
+calls fec_enet_free_buffers(). That helper walks the whole ring and
+hands every rx_skb_info[i].page to page_pool_put_full_page(), including
+the entries the allocation loop never reached. Those are still NULL,
+because the queue was allocated with kzalloc(), and
+page_pool_put_full_page() dereferences the page, so an open that runs
+out of memory oopses instead of returning -ENOMEM:
+
+ Unable to handle kernel NULL pointer dereference at virtual address 00000014 when read
+ Internal error: Oops: 5 [#1] SMP ARM
+ CPU: 0 PID: 384 Comm: connmand Not tainted 6.18.43 #1
+ Hardware name: Freescale Vybrid VF5xx/VF6xx (Device Tree)
+ PC is at fec_enet_free_buffers+0xb0/0x2a8
+ Call trace:
+ fec_enet_free_buffers from fec_enet_open+0x1e0/0x504
+ fec_enet_open from __dev_open+0x114/0x238
+ __dev_open from __dev_change_flags+0x190/0x208
+ __dev_change_flags from netif_change_flags+0x1c/0x58
+ netif_change_flags from dev_change_flags+0x44/0x74
+ dev_change_flags from devinet_ioctl+0x3a4/0x768
+
+Seen on a Colibri VF50, 128 MiB of RAM, on the first ifup after boot.
+
+Skip the entries that hold no page, and clear the ones that do after
+releasing them, so that a later failed open cannot release the same page
+a second time.
+
+Mainline is not affected. Commit a2ae70c0efe4 ("net: fec: add
+fec_alloc_rxq_buffers_pp() to allocate buffers from page pool") replaced
+this loop with fec_free_rxq_buffers(), which skips and clears the empty
+entries. That commit is part of the XDP zero copy series and is not a
+stable candidate, so this is the equivalent minimal fix for 6.18.y.
+
+Fixes: 95698ff6177b ("net: fec: using page pool to manage RX buffers")
+Cc: stable@vger.kernel.org
+Signed-off-by: Mehmet Fide <mehmet.fide@screeningeagle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fec_main.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index d8189c433847c..22cd47d19ce24 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -3323,8 +3323,15 @@ static void fec_enet_free_buffers(struct net_device *ndev)
+
+ for (q = 0; q < fep->num_rx_queues; q++) {
+ rxq = fep->rx_queue[q];
+- for (i = 0; i < rxq->bd.ring_size; i++)
+- page_pool_put_full_page(rxq->page_pool, rxq->rx_skb_info[i].page, false);
++ for (i = 0; i < rxq->bd.ring_size; i++) {
++ struct page *page = rxq->rx_skb_info[i].page;
++
++ if (!page)
++ continue;
++
++ page_pool_put_full_page(rxq->page_pool, page, false);
++ rxq->rx_skb_info[i].page = NULL;
++ }
+
+ for (i = 0; i < XDP_STATS_TOTAL; i++)
+ rxq->stats[i] = 0;
+--
+2.53.0
+
hwmon-ltc4282-avoid-overflow-in-maximum-power-calcul.patch
hwmon-ltc4282-clamp-negative-current-limits.patch
hwmon-ltc4282-fix-parsing-adi-current-limit-sense-mi.patch
+mm-vmscan-wake-up-flushers-conditionally-to-avoid-cg.patch
+net-fec-do-not-release-null-pages-when-rx-buffer-all.patch
+spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch
+mtd-spinand-fix-direct-mapping-creation-sizes.patch
+mtd-spinand-try-a-regular-dirmap-if-creating-a-dirma.patch
+mtd-spinand-repeat-reading-in-regular-mode-if-contin.patch
+swapfile-call-cond_resched-before-locking-si-lock.patch
--- /dev/null
+From e833fe14d7c215a7ce6c8ba9a0bef91ad2733476 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 May 2025 15:51:37 +0100
+Subject: spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit cac7e5054115fcc41b1cb050af8e8971f7c9b22b ]
+
+Repacking multiple smaller words into larger ones to make use of the
+full FIFO doesn't save anything in DMA mode, so don't bother doing it.
+
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-8-bea884630cfb@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-dspi.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index e26363ae74890..bc7479c834ff6 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -746,8 +746,12 @@ static void dspi_setup_accel(struct fsl_dspi *dspi)
+ struct spi_transfer *xfer = dspi->cur_transfer;
+ bool odd = !!(dspi->len & 1);
+
+- /* No accel for frames not multiple of 8 bits at the moment */
+- if (xfer->bits_per_word % 8)
++ /*
++ * No accel for DMA transfers or frames not multiples of 8 bits at the
++ * moment.
++ */
++ if (dspi->devtype_data->trans_mode == DSPI_DMA_MODE ||
++ xfer->bits_per_word % 8)
+ goto no_accel;
+
+ if (!odd && dspi->len <= dspi->devtype_data->fifo_size * 2) {
+@@ -756,10 +760,7 @@ static void dspi_setup_accel(struct fsl_dspi *dspi)
+ dspi->oper_bits_per_word = 8;
+ } else {
+ /* Start off with maximum supported by hardware */
+- if (dspi->devtype_data->trans_mode == DSPI_XSPI_MODE)
+- dspi->oper_bits_per_word = 32;
+- else
+- dspi->oper_bits_per_word = 16;
++ dspi->oper_bits_per_word = 32;
+
+ /*
+ * And go down only if the buffer can't be sent with
+--
+2.53.0
+
--- /dev/null
+From 726cf412ad28f0045a7b8b507b3e01b51972ea0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Aug 2026 10:51:47 +0200
+Subject: swapfile: call cond_resched() before locking si->lock
+
+From: Guillaume Morin <guillaume@morinfr.org>
+
+The 6.12 backport of commit 66366d291f66 ("mm/swap: add cond_resched()
+in swap_reclaim_full_clusters to prevent softlockup"),
+added a cond_resched() after locking si->lock. Move cond_resched()
+before spin_lock().
+
+Signed-off-by: Guillaume Morin <guillaume@morinfr.org>
+Fixes: 60cbe67d1342 ("mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup")
+Link: https://lore.kernel.org/stable/ansgKOOXi6KE3oKf@bender.morinfr.org/
+Cc: stable@vger.kernel.org
+Cc: Chris Li <chrisl@kernel.org>
+Cc: Zijiang Huang <kerayhuang@tencent.com>
+Cc: gregkh@linuxfoundation.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/swapfile.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mm/swapfile.c b/mm/swapfile.c
+index 552df432c37f4..ed0a5ed25e65b 100644
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -770,11 +770,11 @@ static void swap_reclaim_full_clusters(struct swap_info_struct *si, bool force)
+ }
+ offset++;
+ }
++ cond_resched();
+ spin_lock(&si->lock);
+
+ if (to_scan <= 0)
+ break;
+- cond_resched();
+ }
+ }
+
+--
+2.53.0
+
--- /dev/null
+From 73f77319ec84f27513393a21d2181970a0e94774 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2026 14:39:02 +0200
+Subject: net: fec: do not release NULL pages when RX buffer allocation fails
+
+From: Mehmet Fide <mehmet.fide@screeningeagle.com>
+
+fec_enet_alloc_rxq_buffers() leaves the loop as soon as
+page_pool_dev_alloc_pages() returns NULL and jumps to err_alloc, which
+calls fec_enet_free_buffers(). That helper walks the whole ring and
+hands every rx_skb_info[i].page to page_pool_put_full_page(), including
+the entries the allocation loop never reached. Those are still NULL,
+because the queue was allocated with kzalloc(), and
+page_pool_put_full_page() dereferences the page, so an open that runs
+out of memory oopses instead of returning -ENOMEM:
+
+ Unable to handle kernel NULL pointer dereference at virtual address 00000014 when read
+ Internal error: Oops: 5 [#1] SMP ARM
+ CPU: 0 PID: 384 Comm: connmand Not tainted 6.18.43 #1
+ Hardware name: Freescale Vybrid VF5xx/VF6xx (Device Tree)
+ PC is at fec_enet_free_buffers+0xb0/0x2a8
+ Call trace:
+ fec_enet_free_buffers from fec_enet_open+0x1e0/0x504
+ fec_enet_open from __dev_open+0x114/0x238
+ __dev_open from __dev_change_flags+0x190/0x208
+ __dev_change_flags from netif_change_flags+0x1c/0x58
+ netif_change_flags from dev_change_flags+0x44/0x74
+ dev_change_flags from devinet_ioctl+0x3a4/0x768
+
+Seen on a Colibri VF50, 128 MiB of RAM, on the first ifup after boot.
+
+Skip the entries that hold no page, and clear the ones that do after
+releasing them, so that a later failed open cannot release the same page
+a second time.
+
+Mainline is not affected. Commit a2ae70c0efe4 ("net: fec: add
+fec_alloc_rxq_buffers_pp() to allocate buffers from page pool") replaced
+this loop with fec_free_rxq_buffers(), which skips and clears the empty
+entries. That commit is part of the XDP zero copy series and is not a
+stable candidate, so this is the equivalent minimal fix for 6.18.y.
+
+Fixes: 95698ff6177b ("net: fec: using page pool to manage RX buffers")
+Cc: stable@vger.kernel.org
+Signed-off-by: Mehmet Fide <mehmet.fide@screeningeagle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fec_main.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index a2cf8cbe2539e..7699a970cb25e 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -3341,8 +3341,15 @@ static void fec_enet_free_buffers(struct net_device *ndev)
+
+ for (q = 0; q < fep->num_rx_queues; q++) {
+ rxq = fep->rx_queue[q];
+- for (i = 0; i < rxq->bd.ring_size; i++)
+- page_pool_put_full_page(rxq->page_pool, rxq->rx_skb_info[i].page, false);
++ for (i = 0; i < rxq->bd.ring_size; i++) {
++ struct page *page = rxq->rx_skb_info[i].page;
++
++ if (!page)
++ continue;
++
++ page_pool_put_full_page(rxq->page_pool, page, false);
++ rxq->rx_skb_info[i].page = NULL;
++ }
+
+ for (i = 0; i < XDP_STATS_TOTAL; i++)
+ rxq->stats[i] = 0;
+--
+2.53.0
+
hwmon-ltc4282-avoid-overflow-in-maximum-power-calcul.patch
hwmon-ltc4282-clamp-negative-current-limits.patch
hwmon-ltc4282-fix-parsing-adi-current-limit-sense-mi.patch
+net-fec-do-not-release-null-pages-when-rx-buffer-all.patch
--- /dev/null
+From de0c7a5a01201e46f45accd3ae4cb0be9c5320aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2026 14:39:02 +0200
+Subject: net: fec: do not release NULL pages when RX buffer allocation fails
+
+From: Mehmet Fide <mehmet.fide@screeningeagle.com>
+
+fec_enet_alloc_rxq_buffers() leaves the loop as soon as
+page_pool_dev_alloc_pages() returns NULL and jumps to err_alloc, which
+calls fec_enet_free_buffers(). That helper walks the whole ring and
+hands every rx_skb_info[i].page to page_pool_put_full_page(), including
+the entries the allocation loop never reached. Those are still NULL,
+because the queue was allocated with kzalloc(), and
+page_pool_put_full_page() dereferences the page, so an open that runs
+out of memory oopses instead of returning -ENOMEM:
+
+ Unable to handle kernel NULL pointer dereference at virtual address 00000014 when read
+ Internal error: Oops: 5 [#1] SMP ARM
+ CPU: 0 PID: 384 Comm: connmand Not tainted 6.18.43 #1
+ Hardware name: Freescale Vybrid VF5xx/VF6xx (Device Tree)
+ PC is at fec_enet_free_buffers+0xb0/0x2a8
+ Call trace:
+ fec_enet_free_buffers from fec_enet_open+0x1e0/0x504
+ fec_enet_open from __dev_open+0x114/0x238
+ __dev_open from __dev_change_flags+0x190/0x208
+ __dev_change_flags from netif_change_flags+0x1c/0x58
+ netif_change_flags from dev_change_flags+0x44/0x74
+ dev_change_flags from devinet_ioctl+0x3a4/0x768
+
+Seen on a Colibri VF50, 128 MiB of RAM, on the first ifup after boot.
+
+Skip the entries that hold no page, and clear the ones that do after
+releasing them, so that a later failed open cannot release the same page
+a second time.
+
+Mainline is not affected. Commit a2ae70c0efe4 ("net: fec: add
+fec_alloc_rxq_buffers_pp() to allocate buffers from page pool") replaced
+this loop with fec_free_rxq_buffers(), which skips and clears the empty
+entries. That commit is part of the XDP zero copy series and is not a
+stable candidate, so this is the equivalent minimal fix for 6.18.y.
+
+Fixes: 95698ff6177b ("net: fec: using page pool to manage RX buffers")
+Cc: stable@vger.kernel.org
+Signed-off-by: Mehmet Fide <mehmet.fide@screeningeagle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fec_main.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 49297b83c3fdb..ec7fe943e5682 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -3322,8 +3322,15 @@ static void fec_enet_free_buffers(struct net_device *ndev)
+
+ for (q = 0; q < fep->num_rx_queues; q++) {
+ rxq = fep->rx_queue[q];
+- for (i = 0; i < rxq->bd.ring_size; i++)
+- page_pool_put_full_page(rxq->page_pool, rxq->rx_skb_info[i].page, false);
++ for (i = 0; i < rxq->bd.ring_size; i++) {
++ struct page *page = rxq->rx_skb_info[i].page;
++
++ if (!page)
++ continue;
++
++ page_pool_put_full_page(rxq->page_pool, page, false);
++ rxq->rx_skb_info[i].page = NULL;
++ }
+
+ for (i = 0; i < XDP_STATS_TOTAL; i++)
+ rxq->stats[i] = 0;
+--
+2.53.0
+
hwmon-corsair-psu-fix-possible-out-of-bounds-access-.patch
regulator-devres-add-api-for-reference-voltage-suppl.patch
hwmon-ads7828-fix-external-vref-regulator-handling.patch
+net-fec-do-not-release-null-pages-when-rx-buffer-all.patch
+spi-spi-fsl-dspi-avoid-setup_accel-logic-for-dma-tra.patch
--- /dev/null
+From 463a34e9f649f0bd5490abd3cb00f2fb62656602 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 May 2025 15:51:37 +0100
+Subject: spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit cac7e5054115fcc41b1cb050af8e8971f7c9b22b ]
+
+Repacking multiple smaller words into larger ones to make use of the
+full FIFO doesn't save anything in DMA mode, so don't bother doing it.
+
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-8-bea884630cfb@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-dspi.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index 3206c84c6f22f..b7dc2add9114e 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -751,8 +751,12 @@ static void dspi_setup_accel(struct fsl_dspi *dspi)
+ struct spi_transfer *xfer = dspi->cur_transfer;
+ bool odd = !!(dspi->len & 1);
+
+- /* No accel for frames not multiple of 8 bits at the moment */
+- if (xfer->bits_per_word % 8)
++ /*
++ * No accel for DMA transfers or frames not multiples of 8 bits at the
++ * moment.
++ */
++ if (dspi->devtype_data->trans_mode == DSPI_DMA_MODE ||
++ xfer->bits_per_word % 8)
+ goto no_accel;
+
+ if (!odd && dspi->len <= dspi->devtype_data->fifo_size * 2) {
+@@ -761,10 +765,7 @@ static void dspi_setup_accel(struct fsl_dspi *dspi)
+ dspi->oper_bits_per_word = 8;
+ } else {
+ /* Start off with maximum supported by hardware */
+- if (dspi->devtype_data->trans_mode == DSPI_XSPI_MODE)
+- dspi->oper_bits_per_word = 32;
+- else
+- dspi->oper_bits_per_word = 16;
++ dspi->oper_bits_per_word = 32;
+
+ /*
+ * And go down only if the buffer can't be sent with
+--
+2.53.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
