--- /dev/null
+From stable+bounces-177900-greg=kroah.com@vger.kernel.org Fri Sep 5 23:17:08 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 17:17:00 -0400
+Subject: ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup
+To: stable@vger.kernel.org
+Cc: Chris Chiu <chris.chiu@canonical.com>, Takashi Iwai <tiwai@suse.de>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250905211700.3421432-1-sashal@kernel.org>
+
+From: Chris Chiu <chris.chiu@canonical.com>
+
+[ Upstream commit f709b78aecab519dbcefa9a6603b94ad18c553e3 ]
+
+New HP ZBook with Realtek HDA codec ALC3247 needs the quirk
+ALC236_FIXUP_HP_GPIO_LED to fix the micmute LED.
+
+Signed-off-by: Chris Chiu <chris.chiu@canonical.com>
+Cc: <stable@vger.kernel.org>
+Link: https://patch.msgid.link/20250520132101.120685-1-chris.chiu@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+[ Adjust context ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10249,6 +10249,7 @@ static const struct hda_quirk alc269_fix
+ SND_PCI_QUIRK(0x103c, 0x8e18, "HP ZBook Firefly 14 G12A", ALC285_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8e19, "HP ZBook Firefly 14 G12A", ALC285_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8e1a, "HP ZBook Firefly 14 G12A", ALC285_FIXUP_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x8e1d, "HP ZBook X Gli 16 G12", ALC236_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8e3a, "HP Agusta", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x103c, 0x8e3b, "HP Agusta", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
--- /dev/null
+From stable+bounces-177880-greg=kroah.com@vger.kernel.org Fri Sep 5 21:02:18 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:01:16 -0400
+Subject: ALSA: hda/realtek: Add support for HP Agusta using CS35L41 HDA
+To: stable@vger.kernel.org
+Cc: Stefan Binding <sbinding@opensource.cirrus.com>, Takashi Iwai <tiwai@suse.de>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250905190116.3314799-1-sashal@kernel.org>
+
+From: Stefan Binding <sbinding@opensource.cirrus.com>
+
+[ Upstream commit 7150d57c370f9e61b7d0e82c58002f1c5a205ac4 ]
+
+Add support for HP Agusta.
+
+Laptops use 2 CS35L41 Amps with HDA, using Internal boost, with I2C
+
+Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com>
+Cc: <stable@vger.kernel.org>
+Link: https://patch.msgid.link/20250520124757.12597-1-sbinding@opensource.cirrus.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+[ Adjust context ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10249,6 +10249,8 @@ static const struct hda_quirk alc269_fix
+ SND_PCI_QUIRK(0x103c, 0x8e18, "HP ZBook Firefly 14 G12A", ALC285_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8e19, "HP ZBook Firefly 14 G12A", ALC285_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8e1a, "HP ZBook Firefly 14 G12A", ALC285_FIXUP_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x8e3a, "HP Agusta", ALC287_FIXUP_CS35L41_I2C_2),
++ SND_PCI_QUIRK(0x103c, 0x8e3b, "HP Agusta", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
+ SND_PCI_QUIRK(0x1043, 0x1054, "ASUS G614FH/FM/FP", ALC287_FIXUP_CS35L41_I2C_2),
--- /dev/null
+From stable+bounces-177959-greg=kroah.com@vger.kernel.org Sat Sep 6 15:27:11 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 09:26:32 -0400
+Subject: btrfs: adjust subpage bit start based on sectorsize
+To: stable@vger.kernel.org
+Cc: Josef Bacik <josef@toxicpanda.com>, Boris Burkov <boris@bur.io>, Qu Wenruo <wqu@suse.com>, David Sterba <dsterba@suse.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250906132632.3892771-1-sashal@kernel.org>
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+[ Upstream commit e08e49d986f82c30f42ad0ed43ebbede1e1e3739 ]
+
+When running machines with 64k page size and a 16k nodesize we started
+seeing tree log corruption in production. This turned out to be because
+we were not writing out dirty blocks sometimes, so this in fact affects
+all metadata writes.
+
+When writing out a subpage EB we scan the subpage bitmap for a dirty
+range. If the range isn't dirty we do
+
+ bit_start++;
+
+to move onto the next bit. The problem is the bitmap is based on the
+number of sectors that an EB has. So in this case, we have a 64k
+pagesize, 16k nodesize, but a 4k sectorsize. This means our bitmap is 4
+bits for every node. With a 64k page size we end up with 4 nodes per
+page.
+
+To make this easier this is how everything looks
+
+[0 16k 32k 48k ] logical address
+[0 4 8 12 ] radix tree offset
+[ 64k page ] folio
+[ 16k eb ][ 16k eb ][ 16k eb ][ 16k eb ] extent buffers
+[ | | | | | | | | | | | | | | | | ] bitmap
+
+Now we use all of our addressing based on fs_info->sectorsize_bits, so
+as you can see the above our 16k eb->start turns into radix entry 4.
+
+When we find a dirty range for our eb, we correctly do bit_start +=
+sectors_per_node, because if we start at bit 0, the next bit for the
+next eb is 4, to correspond to eb->start 16k.
+
+However if our range is clean, we will do bit_start++, which will now
+put us offset from our radix tree entries.
+
+In our case, assume that the first time we check the bitmap the block is
+not dirty, we increment bit_start so now it == 1, and then we loop
+around and check again. This time it is dirty, and we go to find that
+start using the following equation
+
+ start = folio_start + bit_start * fs_info->sectorsize;
+
+so in the case above, eb->start 0 is now dirty, and we calculate start
+as
+
+ 0 + 1 * fs_info->sectorsize = 4096
+ 4096 >> 12 = 1
+
+Now we're looking up the radix tree for 1, and we won't find an eb.
+What's worse is now we're using bit_start == 1, so we do bit_start +=
+sectors_per_node, which is now 5. If that eb is dirty we will run into
+the same thing, we will look at an offset that is not populated in the
+radix tree, and now we're skipping the writeout of dirty extent buffers.
+
+The best fix for this is to not use sectorsize_bits to address nodes,
+but that's a larger change. Since this is a fs corruption problem fix
+it simply by always using sectors_per_node to increment the start bit.
+
+Fixes: c4aec299fa8f ("btrfs: introduce submit_eb_subpage() to submit a subpage metadata page")
+CC: stable@vger.kernel.org # 5.15+
+Reviewed-by: Boris Burkov <boris@bur.io>
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+[ Adjust context ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/extent_io.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -1742,7 +1742,7 @@ static int submit_eb_subpage(struct page
+ subpage->bitmaps)) {
+ spin_unlock_irqrestore(&subpage->lock, flags);
+ spin_unlock(&page->mapping->private_lock);
+- bit_start++;
++ bit_start += sectors_per_node;
+ continue;
+ }
+
--- /dev/null
+From stable+bounces-177950-greg=kroah.com@vger.kernel.org Sat Sep 6 15:12:37 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 09:12:23 -0400
+Subject: cpufreq: intel_pstate: Do not update global.turbo_disabled after initialization
+To: stable@vger.kernel.org
+Cc: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>, Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250906131224.3883544-3-sashal@kernel.org>
+
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 0940f1a8011fd69be5082015068e0dc31c800c20 ]
+
+The global.turbo_disabled is updated quite often, especially in the
+passive mode in which case it is updated every time the scheduler calls
+into the driver. However, this is generally not necessary and it adds
+MSR read overhead to scheduler code paths (and that particular MSR is
+slow to read).
+
+For this reason, make the driver read MSR_IA32_MISC_ENABLE_TURBO_DISABLE
+just once at the cpufreq driver registration time and remove all of the
+in-flight updates of global.turbo_disabled.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Stable-dep-of: ac4e04d9e378 ("cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cpufreq/intel_pstate.c | 51 ++++++-----------------------------------
+ 1 file changed, 8 insertions(+), 43 deletions(-)
+
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -172,7 +172,6 @@ struct vid_data {
+ * based on the MSR_IA32_MISC_ENABLE value and whether or
+ * not the maximum reported turbo P-state is different from
+ * the maximum reported non-turbo one.
+- * @turbo_disabled_mf: The @turbo_disabled value reflected by cpuinfo.max_freq.
+ * @min_perf_pct: Minimum capacity limit in percent of the maximum turbo
+ * P-state capacity.
+ * @max_perf_pct: Maximum capacity limit in percent of the maximum turbo
+@@ -181,7 +180,6 @@ struct vid_data {
+ struct global_params {
+ bool no_turbo;
+ bool turbo_disabled;
+- bool turbo_disabled_mf;
+ int max_perf_pct;
+ int min_perf_pct;
+ };
+@@ -592,12 +590,13 @@ static void intel_pstate_hybrid_hwp_adju
+ cpu->pstate.min_pstate = intel_pstate_freq_to_hwp(cpu, freq);
+ }
+
+-static inline void update_turbo_state(void)
++static bool turbo_is_disabled(void)
+ {
+ u64 misc_en;
+
+ rdmsrl(MSR_IA32_MISC_ENABLE, misc_en);
+- global.turbo_disabled = misc_en & MSR_IA32_MISC_ENABLE_TURBO_DISABLE;
++
++ return !!(misc_en & MSR_IA32_MISC_ENABLE_TURBO_DISABLE);
+ }
+
+ static int min_perf_pct_min(void)
+@@ -1152,40 +1151,16 @@ static void intel_pstate_update_policies
+ static void __intel_pstate_update_max_freq(struct cpudata *cpudata,
+ struct cpufreq_policy *policy)
+ {
+- policy->cpuinfo.max_freq = global.turbo_disabled_mf ?
++ policy->cpuinfo.max_freq = global.turbo_disabled ?
+ cpudata->pstate.max_freq : cpudata->pstate.turbo_freq;
+ refresh_frequency_limits(policy);
+ }
+
+-static void intel_pstate_update_max_freq(unsigned int cpu)
+-{
+- struct cpufreq_policy *policy = cpufreq_cpu_acquire(cpu);
+-
+- if (!policy)
+- return;
+-
+- __intel_pstate_update_max_freq(all_cpu_data[cpu], policy);
+-
+- cpufreq_cpu_release(policy);
+-}
+-
+ static void intel_pstate_update_limits(unsigned int cpu)
+ {
+ mutex_lock(&intel_pstate_driver_lock);
+
+- update_turbo_state();
+- /*
+- * If turbo has been turned on or off globally, policy limits for
+- * all CPUs need to be updated to reflect that.
+- */
+- if (global.turbo_disabled_mf != global.turbo_disabled) {
+- global.turbo_disabled_mf = global.turbo_disabled;
+- arch_set_max_freq_ratio(global.turbo_disabled);
+- for_each_possible_cpu(cpu)
+- intel_pstate_update_max_freq(cpu);
+- } else {
+- cpufreq_update_policy(cpu);
+- }
++ cpufreq_update_policy(cpu);
+
+ mutex_unlock(&intel_pstate_driver_lock);
+ }
+@@ -1285,7 +1260,6 @@ static ssize_t show_no_turbo(struct kobj
+ return -EAGAIN;
+ }
+
+- update_turbo_state();
+ if (global.turbo_disabled)
+ ret = sprintf(buf, "%u\n", global.turbo_disabled);
+ else
+@@ -1315,7 +1289,6 @@ static ssize_t store_no_turbo(struct kob
+
+ mutex_lock(&intel_pstate_limits_lock);
+
+- update_turbo_state();
+ if (global.turbo_disabled) {
+ pr_notice_once("Turbo disabled by BIOS or unavailable on processor\n");
+ mutex_unlock(&intel_pstate_limits_lock);
+@@ -2296,8 +2269,6 @@ static void intel_pstate_adjust_pstate(s
+ struct sample *sample;
+ int target_pstate;
+
+- update_turbo_state();
+-
+ target_pstate = get_target_pstate(cpu);
+ target_pstate = intel_pstate_prepare_request(cpu, target_pstate);
+ trace_cpu_frequency(target_pstate * cpu->pstate.scaling, cpu->cpu);
+@@ -2607,7 +2578,6 @@ static int intel_pstate_set_policy(struc
+ * be invoked on them.
+ */
+ intel_pstate_clear_update_util_hook(policy->cpu);
+- update_turbo_state();
+ intel_pstate_set_pstate(cpu, pstate);
+ } else {
+ intel_pstate_set_update_util_hook(policy->cpu);
+@@ -2651,7 +2621,6 @@ static void intel_pstate_verify_cpu_poli
+ {
+ int max_freq;
+
+- update_turbo_state();
+ if (hwp_active) {
+ intel_pstate_get_hwp_cap(cpu);
+ max_freq = global.no_turbo || global.turbo_disabled ?
+@@ -2748,8 +2717,6 @@ static int __intel_pstate_cpu_init(struc
+
+ /* cpuinfo and default policy values */
+ policy->cpuinfo.min_freq = cpu->pstate.min_freq;
+- update_turbo_state();
+- global.turbo_disabled_mf = global.turbo_disabled;
+ policy->cpuinfo.max_freq = global.turbo_disabled ?
+ cpu->pstate.max_freq : cpu->pstate.turbo_freq;
+
+@@ -2915,8 +2882,6 @@ static int intel_cpufreq_target(struct c
+ struct cpufreq_freqs freqs;
+ int target_pstate;
+
+- update_turbo_state();
+-
+ freqs.old = policy->cur;
+ freqs.new = target_freq;
+
+@@ -2938,8 +2903,6 @@ static unsigned int intel_cpufreq_fast_s
+ struct cpudata *cpu = all_cpu_data[policy->cpu];
+ int target_pstate;
+
+- update_turbo_state();
+-
+ target_pstate = intel_pstate_freq_to_hwp(cpu, target_freq);
+
+ target_pstate = intel_cpufreq_update_pstate(policy, target_pstate, true);
+@@ -2957,7 +2920,6 @@ static void intel_cpufreq_adjust_perf(un
+ int old_pstate = cpu->pstate.current_pstate;
+ int cap_pstate, min_pstate, max_pstate, target_pstate;
+
+- update_turbo_state();
+ cap_pstate = global.turbo_disabled ? HWP_GUARANTEED_PERF(hwp_cap) :
+ HWP_HIGHEST_PERF(hwp_cap);
+
+@@ -3147,6 +3109,9 @@ static int intel_pstate_register_driver(
+
+ memset(&global, 0, sizeof(global));
+ global.max_perf_pct = 100;
++ global.turbo_disabled = turbo_is_disabled();
++
++ arch_set_max_freq_ratio(global.turbo_disabled);
+
+ intel_pstate_driver = driver;
+ ret = cpufreq_register_driver(intel_pstate_driver);
--- /dev/null
+From stable+bounces-177949-greg=kroah.com@vger.kernel.org Sat Sep 6 15:12:38 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 09:12:22 -0400
+Subject: cpufreq: intel_pstate: Fold intel_pstate_max_within_limits() into caller
+To: stable@vger.kernel.org
+Cc: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>, Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250906131224.3883544-2-sashal@kernel.org>
+
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 032c5565eb80edb6f2faeb31939540c897987119 ]
+
+Fold intel_pstate_max_within_limits() into its only caller.
+
+No functional impact.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Stable-dep-of: ac4e04d9e378 ("cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cpufreq/intel_pstate.c | 13 ++++---------
+ 1 file changed, 4 insertions(+), 9 deletions(-)
+
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -2027,14 +2027,6 @@ static void intel_pstate_set_min_pstate(
+ intel_pstate_set_pstate(cpu, cpu->pstate.min_pstate);
+ }
+
+-static void intel_pstate_max_within_limits(struct cpudata *cpu)
+-{
+- int pstate = max(cpu->pstate.min_pstate, cpu->max_perf_ratio);
+-
+- update_turbo_state();
+- intel_pstate_set_pstate(cpu, pstate);
+-}
+-
+ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
+ {
+ int perf_ctl_max_phys = pstate_funcs.get_max_physical(cpu->cpu);
+@@ -2608,12 +2600,15 @@ static int intel_pstate_set_policy(struc
+ intel_pstate_update_perf_limits(cpu, policy->min, policy->max);
+
+ if (cpu->policy == CPUFREQ_POLICY_PERFORMANCE) {
++ int pstate = max(cpu->pstate.min_pstate, cpu->max_perf_ratio);
++
+ /*
+ * NOHZ_FULL CPUs need this as the governor callback may not
+ * be invoked on them.
+ */
+ intel_pstate_clear_update_util_hook(policy->cpu);
+- intel_pstate_max_within_limits(cpu);
++ update_turbo_state();
++ intel_pstate_set_pstate(cpu, pstate);
+ } else {
+ intel_pstate_set_update_util_hook(policy->cpu);
+ }
--- /dev/null
+From stable+bounces-177948-greg=kroah.com@vger.kernel.org Sat Sep 6 15:12:30 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 09:12:21 -0400
+Subject: cpufreq: intel_pstate: Revise global turbo disable check
+To: stable@vger.kernel.org
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>, "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250906131224.3883544-1-sashal@kernel.org>
+
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+
+[ Upstream commit 37b6ddba967c601479bea418a7ac6ff16b6232b7 ]
+
+Setting global turbo flag based on CPU 0 P-state limits is problematic
+as it limits max P-state request on every CPU on the system just based
+on its P-state limits.
+
+There are two cases in which global.turbo_disabled flag is set:
+- When the MSR_IA32_MISC_ENABLE_TURBO_DISABLE bit is set to 1
+in the MSR MSR_IA32_MISC_ENABLE. This bit can be only changed by
+the system BIOS before power up.
+- When the max non turbo P-state is same as max turbo P-state for CPU 0.
+
+The second check is not a valid to decide global turbo state based on
+the CPU 0. CPU 0 max turbo P-state can be same as max non turbo P-state,
+but for other CPUs this may not be true.
+
+There is no guarantee that max P-state limits are same for every CPU. This
+is possible that during fusing max P-state for a CPU is constrained. Also
+with the Intel Speed Select performance profile, CPU 0 may not be present
+in all profiles. In this case the max non turbo and turbo P-state can be
+set to the lowest possible P-state by the hardware when switched to
+such profile. Since max non turbo and turbo P-state is same,
+global.turbo_disabled flag will be set.
+
+Once global.turbo_disabled is set, any scaling max and min frequency
+update for any CPU will result in its max P-state constrained to the max
+non turbo P-state.
+
+Hence remove the check of max non turbo P-state equal to max turbo P-state
+of CPU 0 to set global turbo disabled flag.
+
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+[ rjw: Subject edit ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Stable-dep-of: ac4e04d9e378 ("cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cpufreq/intel_pstate.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -595,13 +595,9 @@ static void intel_pstate_hybrid_hwp_adju
+ static inline void update_turbo_state(void)
+ {
+ u64 misc_en;
+- struct cpudata *cpu;
+
+- cpu = all_cpu_data[0];
+ rdmsrl(MSR_IA32_MISC_ENABLE, misc_en);
+- global.turbo_disabled =
+- (misc_en & MSR_IA32_MISC_ENABLE_TURBO_DISABLE ||
+- cpu->pstate.max_pstate == cpu->pstate.turbo_pstate);
++ global.turbo_disabled = misc_en & MSR_IA32_MISC_ENABLE_TURBO_DISABLE;
+ }
+
+ static int min_perf_pct_min(void)
--- /dev/null
+From stable+bounces-177951-greg=kroah.com@vger.kernel.org Sat Sep 6 15:12:45 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 09:12:24 -0400
+Subject: cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode
+To: stable@vger.kernel.org
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>, "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250906131224.3883544-4-sashal@kernel.org>
+
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+
+[ Upstream commit ac4e04d9e378f5aa826c2406ad7871ae1b6a6fb9 ]
+
+When turbo mode is unavailable on a Skylake-X system, executing the
+command:
+
+ # echo 1 > /sys/devices/system/cpu/intel_pstate/no_turbo
+
+results in an unchecked MSR access error:
+
+ WRMSR to 0x199 (attempted to write 0x0000000100001300).
+
+This issue was reproduced on an OEM (Original Equipment Manufacturer)
+system and is not a common problem across all Skylake-X systems.
+
+This error occurs because the MSR 0x199 Turbo Engage Bit (bit 32) is set
+when turbo mode is disabled. The issue arises when intel_pstate fails to
+detect that turbo mode is disabled. Here intel_pstate relies on
+MSR_IA32_MISC_ENABLE bit 38 to determine the status of turbo mode.
+However, on this system, bit 38 is not set even when turbo mode is
+disabled.
+
+According to the Intel Software Developer's Manual (SDM), the BIOS sets
+this bit during platform initialization to enable or disable
+opportunistic processor performance operations. Logically, this bit
+should be set in such cases. However, the SDM also specifies that "OS
+and applications must use CPUID leaf 06H to detect processors with
+opportunistic processor performance operations enabled."
+
+Therefore, in addition to checking MSR_IA32_MISC_ENABLE bit 38, verify
+that CPUID.06H:EAX[1] is 0 to accurately determine if turbo mode is
+disabled.
+
+Fixes: 4521e1a0ce17 ("cpufreq: intel_pstate: Reflect current no_turbo state correctly")
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: All applicable <stable@vger.kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cpufreq/intel_pstate.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -594,6 +594,9 @@ static bool turbo_is_disabled(void)
+ {
+ u64 misc_en;
+
++ if (!cpu_feature_enabled(X86_FEATURE_IDA))
++ return true;
++
+ rdmsrl(MSR_IA32_MISC_ENABLE, misc_en);
+
+ return !!(misc_en & MSR_IA32_MISC_ENABLE_TURBO_DISABLE);
--- /dev/null
+From stable+bounces-177893-greg=kroah.com@vger.kernel.org Fri Sep 5 22:07:02 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 16:06:21 -0400
+Subject: dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status()
+To: stable@vger.kernel.org
+Cc: Qiu-ji Chen <chenqiuji666@gmail.com>, AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>, Vinod Koul <vkoul@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250905200621.3390323-1-sashal@kernel.org>
+
+From: Qiu-ji Chen <chenqiuji666@gmail.com>
+
+[ Upstream commit 157ae5ffd76a2857ccb4b7ce40bc5a344ca00395 ]
+
+Fix a potential deadlock bug. Observe that in the mtk-cqdma.c
+file, functions like mtk_cqdma_issue_pending() and
+mtk_cqdma_free_active_desc() properly acquire the pc lock before the vc
+lock when handling pc and vc fields. However, mtk_cqdma_tx_status()
+violates this order by first acquiring the vc lock before invoking
+mtk_cqdma_find_active_desc(), which subsequently takes the pc lock. This
+reversed locking sequence (vc → pc) contradicts the established
+pc → vc order and creates deadlock risks.
+
+Fix the issue by moving the vc lock acquisition code from
+mtk_cqdma_find_active_desc() to mtk_cqdma_tx_status(). Ensure the pc lock
+is acquired before the vc lock in the calling function to maintain correct
+locking hierarchy. Note that since mtk_cqdma_find_active_desc() is a
+static function with only one caller (mtk_cqdma_tx_status()), this
+modification safely eliminates the deadlock possibility without affecting
+other components.
+
+This possible bug is found by an experimental static analysis tool
+developed by our team. This tool analyzes the locking APIs to extract
+function pairs that can be concurrently executed, and then analyzes the
+instructions in the paired functions to identify possible concurrency bugs
+including deadlocks, data races and atomicity violations.
+
+Fixes: b1f01e48df5a ("dmaengine: mediatek: Add MediaTek Command-Queue DMA controller for MT6765 SoC")
+Cc: stable@vger.kernel.org
+Signed-off-by: Qiu-ji Chen <chenqiuji666@gmail.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20250508073634.3719-1-chenqiuji666@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/mediatek/mtk-cqdma.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/dma/mediatek/mtk-cqdma.c
++++ b/drivers/dma/mediatek/mtk-cqdma.c
+@@ -420,15 +420,11 @@ static struct virt_dma_desc *mtk_cqdma_f
+ {
+ struct mtk_cqdma_vchan *cvc = to_cqdma_vchan(c);
+ struct virt_dma_desc *vd;
+- unsigned long flags;
+
+- spin_lock_irqsave(&cvc->pc->lock, flags);
+ list_for_each_entry(vd, &cvc->pc->queue, node)
+ if (vd->tx.cookie == cookie) {
+- spin_unlock_irqrestore(&cvc->pc->lock, flags);
+ return vd;
+ }
+- spin_unlock_irqrestore(&cvc->pc->lock, flags);
+
+ list_for_each_entry(vd, &cvc->vc.desc_issued, node)
+ if (vd->tx.cookie == cookie)
+@@ -452,9 +448,11 @@ static enum dma_status mtk_cqdma_tx_stat
+ if (ret == DMA_COMPLETE || !txstate)
+ return ret;
+
++ spin_lock_irqsave(&cvc->pc->lock, flags);
+ spin_lock_irqsave(&cvc->vc.lock, flags);
+ vd = mtk_cqdma_find_active_desc(c, cookie);
+ spin_unlock_irqrestore(&cvc->vc.lock, flags);
++ spin_unlock_irqrestore(&cvc->pc->lock, flags);
+
+ if (vd) {
+ cvd = to_cqdma_vdesc(vd);
--- /dev/null
+From stable+bounces-177922-greg=kroah.com@vger.kernel.org Sat Sep 6 04:13:43 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 22:13:36 -0400
+Subject: iio: chemical: pms7003: use aligned_s64 for timestamp
+To: stable@vger.kernel.org
+Cc: "David Lechner" <dlechner@baylibre.com>, "Nuno Sá" <nuno.sa@analog.com>, Stable@vger.kernel.org, "Jonathan Cameron" <Jonathan.Cameron@huawei.com>, "Sasha Levin" <sashal@kernel.org>
+Message-ID: <20250906021336.3665419-1-sashal@kernel.org>
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit 6ffa698674053e82e811520642db2650d00d2c01 ]
+
+Follow the pattern of other drivers and use aligned_s64 for the
+timestamp. This will ensure that the timestamp is correctly aligned on
+all architectures.
+
+Also move the unaligned.h header while touching this since it was the
+only one not in alphabetical order.
+
+Fixes: 13e945631c2f ("iio:chemical:pms7003: Fix timestamp alignment and prevent data leak.")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Link: https://patch.msgid.link/20250417-iio-more-timestamp-alignment-v1-4-eafac1e22318@baylibre.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+[ linux/unaligned.h => asm/unaligned.h ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/chemical/pms7003.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/chemical/pms7003.c
++++ b/drivers/iio/chemical/pms7003.c
+@@ -5,7 +5,6 @@
+ * Copyright (c) Tomasz Duszynski <tduszyns@gmail.com>
+ */
+
+-#include <asm/unaligned.h>
+ #include <linux/completion.h>
+ #include <linux/device.h>
+ #include <linux/errno.h>
+@@ -19,6 +18,8 @@
+ #include <linux/module.h>
+ #include <linux/mutex.h>
+ #include <linux/serdev.h>
++#include <linux/types.h>
++#include <asm/unaligned.h>
+
+ #define PMS7003_DRIVER_NAME "pms7003"
+
+@@ -76,7 +77,7 @@ struct pms7003_state {
+ /* Used to construct scan to push to the IIO buffer */
+ struct {
+ u16 data[3]; /* PM1, PM2P5, PM10 */
+- s64 ts;
++ aligned_s64 ts;
+ } scan;
+ };
+
--- /dev/null
+From stable+bounces-177923-greg=kroah.com@vger.kernel.org Sat Sep 6 04:14:16 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 22:14:06 -0400
+Subject: iio: imu: inv_mpu6050: align buffer for timestamp
+To: stable@vger.kernel.org
+Cc: David Lechner <dlechner@baylibre.com>, Stable@vger.kernel.org, Jonathan Cameron <Jonathan.Cameron@huawei.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250906021407.3665934-1-sashal@kernel.org>
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit 1d2d8524eaffc4d9a116213520d2c650e07c9cc6 ]
+
+Align the buffer used with iio_push_to_buffers_with_timestamp() to
+ensure the s64 timestamp is aligned to 8 bytes.
+
+Fixes: 0829edc43e0a ("iio: imu: inv_mpu6050: read the full fifo when processing data")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Link: https://patch.msgid.link/20250417-iio-more-timestamp-alignment-v1-7-eafac1e22318@baylibre.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+[ Adjust context ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
+@@ -52,7 +52,7 @@ irqreturn_t inv_mpu6050_read_fifo(int ir
+ u16 fifo_count;
+ u32 fifo_period;
+ s64 timestamp;
+- u8 data[INV_MPU6050_OUTPUT_DATA_SIZE];
++ u8 data[INV_MPU6050_OUTPUT_DATA_SIZE] __aligned(8);
+ int int_status;
+ size_t i, nb;
+
--- /dev/null
+From stable+bounces-177921-greg=kroah.com@vger.kernel.org Sat Sep 6 04:13:43 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 22:13:34 -0400
+Subject: iio: light: opt3001: fix deadlock due to concurrent flag access
+To: stable@vger.kernel.org
+Cc: Luca Ceresoli <luca.ceresoli@bootlin.com>, Jonathan Cameron <Jonathan.Cameron@huawei.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250906021334.3665365-1-sashal@kernel.org>
+
+From: Luca Ceresoli <luca.ceresoli@bootlin.com>
+
+[ Upstream commit f063a28002e3350088b4577c5640882bf4ea17ea ]
+
+The threaded IRQ function in this driver is reading the flag twice: once to
+lock a mutex and once to unlock it. Even though the code setting the flag
+is designed to prevent it, there are subtle cases where the flag could be
+true at the mutex_lock stage and false at the mutex_unlock stage. This
+results in the mutex not being unlocked, resulting in a deadlock.
+
+Fix it by making the opt3001_irq() code generally more robust, reading the
+flag into a variable and using the variable value at both stages.
+
+Fixes: 94a9b7b1809f ("iio: light: add support for TI's opt3001 light sensor")
+Cc: stable@vger.kernel.org
+Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Link: https://patch.msgid.link/20250321-opt3001-irq-fix-v1-1-6c520d851562@bootlin.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+[ Adjust context ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/light/opt3001.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/light/opt3001.c
++++ b/drivers/iio/light/opt3001.c
+@@ -692,8 +692,9 @@ static irqreturn_t opt3001_irq(int irq,
+ struct opt3001 *opt = iio_priv(iio);
+ int ret;
+ bool wake_result_ready_queue = false;
++ bool ok_to_ignore_lock = opt->ok_to_ignore_lock;
+
+- if (!opt->ok_to_ignore_lock)
++ if (!ok_to_ignore_lock)
+ mutex_lock(&opt->lock);
+
+ ret = i2c_smbus_read_word_swapped(opt->client, OPT3001_CONFIGURATION);
+@@ -730,7 +731,7 @@ static irqreturn_t opt3001_irq(int irq,
+ }
+
+ out:
+- if (!opt->ok_to_ignore_lock)
++ if (!ok_to_ignore_lock)
+ mutex_unlock(&opt->lock);
+
+ if (wake_result_ready_queue)
--- /dev/null
+From stable+bounces-177920-greg=kroah.com@vger.kernel.org Sat Sep 6 03:33:53 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 21:33:47 -0400
+Subject: iio: pressure: mprls0025pa: use aligned_s64 for timestamp
+To: stable@vger.kernel.org
+Cc: David Lechner <dlechner@baylibre.com>, Stable@vger.kernel.org, Jonathan Cameron <Jonathan.Cameron@huawei.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250906013347.3653180-1-sashal@kernel.org>
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit ffcd19e9f4cca0c8f9e23e88f968711acefbb37b ]
+
+Follow the pattern of other drivers and use aligned_s64 for the
+timestamp. This will ensure the struct itself it also 8-byte aligned.
+
+While touching this, convert struct mpr_chan to an anonymous struct
+to consolidate the code a bit to make it easier for future readers.
+
+Fixes: 713337d9143e ("iio: pressure: Honeywell mprls0025pa pressure sensor")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Link: https://patch.msgid.link/20250418-iio-more-timestamp-alignment-v2-2-d6a5d2b1c9fe@baylibre.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+[ Applied changes to mprls0025pa.c ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/pressure/mprls0025pa.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+--- a/drivers/iio/pressure/mprls0025pa.c
++++ b/drivers/iio/pressure/mprls0025pa.c
+@@ -87,11 +87,6 @@ static const struct mpr_func_spec mpr_fu
+ [MPR_FUNCTION_C] = {.output_min = 3355443, .output_max = 13421773},
+ };
+
+-struct mpr_chan {
+- s32 pres; /* pressure value */
+- s64 ts; /* timestamp */
+-};
+-
+ struct mpr_data {
+ struct i2c_client *client;
+ struct mutex lock; /*
+@@ -120,7 +115,10 @@ struct mpr_data {
+ * loop until data is ready
+ */
+ struct completion completion; /* handshake from irq to read */
+- struct mpr_chan chan; /*
++ struct {
++ s32 pres; /* pressure value */
++ aligned_s64 ts; /* timestamp */
++ } chan; /*
+ * channel values for buffered
+ * mode
+ */
--- /dev/null
+From stable+bounces-177962-greg=kroah.com@vger.kernel.org Sat Sep 6 15:48:56 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 09:48:45 -0400
+Subject: memcg: drain obj stock on cpu hotplug teardown
+To: stable@vger.kernel.org
+Cc: Shakeel Butt <shakeel.butt@linux.dev>, Roman Gushchin <roman.gushchin@linux.dev>, Johannes Weiner <hannes@cmpxchg.org>, Michal Hocko <mhocko@kernel.org>, Muchun Song <muchun.song@linux.dev>, Andrew Morton <akpm@linux-foundation.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250906134845.8414-1-sashal@kernel.org>
+
+From: Shakeel Butt <shakeel.butt@linux.dev>
+
+[ Upstream commit 9f01b4954490d4ccdbcc2b9be34a9921ceee9cbb ]
+
+Currently on cpu hotplug teardown, only memcg stock is drained but we
+need to drain the obj stock as well otherwise we will miss the stats
+accumulated on the target cpu as well as the nr_bytes cached. The stats
+include MEMCG_KMEM, NR_SLAB_RECLAIMABLE_B & NR_SLAB_UNRECLAIMABLE_B. In
+addition we are leaking reference to struct obj_cgroup object.
+
+Link: https://lkml.kernel.org/r/20250310230934.2913113-1-shakeel.butt@linux.dev
+Fixes: bf4f059954dc ("mm: memcg/slab: obj_cgroup API")
+Signed-off-by: Shakeel Butt <shakeel.butt@linux.dev>
+Reviewed-by: Roman Gushchin <roman.gushchin@linux.dev>
+Acked-by: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Muchun Song <muchun.song@linux.dev>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/memcontrol.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -2376,9 +2376,18 @@ static void drain_all_stock(struct mem_c
+ static int memcg_hotplug_cpu_dead(unsigned int cpu)
+ {
+ struct memcg_stock_pcp *stock;
++ struct obj_cgroup *old;
++ unsigned long flags;
+
+ stock = &per_cpu(memcg_stock, cpu);
++
++ /* drain_obj_stock requires stock_lock */
++ local_lock_irqsave(&memcg_stock.stock_lock, flags);
++ old = drain_obj_stock(stock);
++ local_unlock_irqrestore(&memcg_stock.stock_lock, flags);
++
+ drain_stock(stock);
++ obj_cgroup_put(old);
+
+ return 0;
+ }
--- /dev/null
+From stable+bounces-178012-greg=kroah.com@vger.kernel.org Sun Sep 7 03:17:31 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 21:17:23 -0400
+Subject: mm/slub: avoid accessing metadata when pointer is invalid in object_err()
+To: stable@vger.kernel.org
+Cc: Li Qiong <liqiong@nfschina.com>, Harry Yoo <harry.yoo@oracle.com>, "Matthew Wilcox (Oracle)" <willy@infradead.org>, Vlastimil Babka <vbabka@suse.cz>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250907011723.378381-1-sashal@kernel.org>
+
+From: Li Qiong <liqiong@nfschina.com>
+
+[ Upstream commit b4efccec8d06ceb10a7d34d7b1c449c569d53770 ]
+
+object_err() reports details of an object for further debugging, such as
+the freelist pointer, redzone, etc. However, if the pointer is invalid,
+attempting to access object metadata can lead to a crash since it does
+not point to a valid object.
+
+One known path to the crash is when alloc_consistency_checks()
+determines the pointer to the allocated object is invalid because of a
+freelist corruption, and calls object_err() to report it. The debug code
+should report and handle the corruption gracefully and not crash in the
+process.
+
+In case the pointer is NULL or check_valid_pointer() returns false for
+the pointer, only print the pointer value and skip accessing metadata.
+
+Fixes: 81819f0fc828 ("SLUB core")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Li Qiong <liqiong@nfschina.com>
+Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
+Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
+[ Adjust context ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/slub.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -988,7 +988,12 @@ static void object_err(struct kmem_cache
+ return;
+
+ slab_bug(s, "%s", reason);
+- print_trailer(s, slab, object);
++ if (!object || !check_valid_pointer(s, slab, object)) {
++ print_slab_info(slab);
++ pr_err("Invalid pointer 0x%p\n", object);
++ } else {
++ print_trailer(s, slab, object);
++ }
+ add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
+ }
+
--- /dev/null
+From stable+bounces-177864-greg=kroah.com@vger.kernel.org Fri Sep 5 19:43:04 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 13:42:53 -0400
+Subject: net: dsa: microchip: linearize skb for tail-tagging switches
+To: stable@vger.kernel.org
+Cc: Jakob Unterwurzacher <jakobunt@gmail.com>, Jakob Unterwurzacher <jakob.unterwurzacher@cherry.de>, Vladimir Oltean <olteanv@gmail.com>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250905174253.2173195-2-sashal@kernel.org>
+
+From: Jakob Unterwurzacher <jakobunt@gmail.com>
+
+[ Upstream commit ba54bce747fa9e07896c1abd9b48545f7b4b31d2 ]
+
+The pointer arithmentic for accessing the tail tag only works
+for linear skbs.
+
+For nonlinear skbs, it reads uninitialized memory inside the
+skb headroom, essentially randomizing the tag. I have observed
+it gets set to 6 most of the time.
+
+Example where ksz9477_rcv thinks that the packet from port 1 comes from port 6
+(which does not exist for the ksz9896 that's in use), dropping the packet.
+Debug prints added by me (not included in this patch):
+
+ [ 256.645337] ksz9477_rcv:323 tag0=6
+ [ 256.645349] skb len=47 headroom=78 headlen=0 tailroom=0
+ mac=(64,14) mac_len=14 net=(78,0) trans=78
+ shinfo(txflags=0 nr_frags=1 gso(size=0 type=0 segs=0))
+ csum(0x0 start=0 offset=0 ip_summed=0 complete_sw=0 valid=0 level=0)
+ hash(0x0 sw=0 l4=0) proto=0x00f8 pkttype=1 iif=3
+ priority=0x0 mark=0x0 alloc_cpu=0 vlan_all=0x0
+ encapsulation=0 inner(proto=0x0000, mac=0, net=0, trans=0)
+ [ 256.645377] dev name=end1 feat=0x0002e10200114bb3
+ [ 256.645386] skb headroom: 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ [ 256.645395] skb headroom: 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ [ 256.645403] skb headroom: 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ [ 256.645411] skb headroom: 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ [ 256.645420] skb headroom: 00000040: ff ff ff ff ff ff 00 1c 19 f2 e2 db 08 06
+ [ 256.645428] skb frag: 00000000: 00 01 08 00 06 04 00 01 00 1c 19 f2 e2 db 0a 02
+ [ 256.645436] skb frag: 00000010: 00 83 00 00 00 00 00 00 0a 02 a0 2f 00 00 00 00
+ [ 256.645444] skb frag: 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01
+ [ 256.645452] ksz_common_rcv:92 dsa_conduit_find_user returned NULL
+
+Call skb_linearize before trying to access the tag.
+
+This patch fixes ksz9477_rcv which is used by the ksz9896 I have at
+hand, and also applies the same fix to ksz8795_rcv which seems to have
+the same problem.
+
+Signed-off-by: Jakob Unterwurzacher <jakob.unterwurzacher@cherry.de>
+CC: stable@vger.kernel.org
+Fixes: 016e43a26bab ("net: dsa: ksz: Add KSZ8795 tag code")
+Fixes: 8b8010fb7876 ("dsa: add support for Microchip KSZ tail tagging")
+Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
+Link: https://patch.msgid.link/20250515072920.2313014-1-jakob.unterwurzacher@cherry.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/dsa/tag_ksz.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+--- a/net/dsa/tag_ksz.c
++++ b/net/dsa/tag_ksz.c
+@@ -139,7 +139,12 @@ static struct sk_buff *ksz8795_xmit(stru
+
+ static struct sk_buff *ksz8795_rcv(struct sk_buff *skb, struct net_device *dev)
+ {
+- u8 *tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN;
++ u8 *tag;
++
++ if (skb_linearize(skb))
++ return NULL;
++
++ tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN;
+
+ return ksz_common_rcv(skb, dev, tag[0] & 7, KSZ_EGRESS_TAG_LEN);
+ }
+@@ -301,10 +306,16 @@ static struct sk_buff *ksz9477_xmit(stru
+
+ static struct sk_buff *ksz9477_rcv(struct sk_buff *skb, struct net_device *dev)
+ {
+- /* Tag decoding */
+- u8 *tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN;
+- unsigned int port = tag[0] & KSZ9477_TAIL_TAG_EG_PORT_M;
+ unsigned int len = KSZ_EGRESS_TAG_LEN;
++ unsigned int port;
++ u8 *tag;
++
++ if (skb_linearize(skb))
++ return NULL;
++
++ /* Tag decoding */
++ tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN;
++ port = tag[0] & KSZ9477_TAIL_TAG_EG_PORT_M;
+
+ /* Extra 4-bytes PTP timestamp */
+ if (tag[0] & KSZ9477_PTP_TAG_INDICATION) {
--- /dev/null
+From stable+bounces-177863-greg=kroah.com@vger.kernel.org Fri Sep 5 19:43:00 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 13:42:52 -0400
+Subject: net: dsa: microchip: update tag_ksz masks for KSZ9477 family
+To: stable@vger.kernel.org
+Cc: Pieter Van Trappen <pieter.van.trappen@cern.ch>, Florian Fainelli <florian.fainelli@broadcom.com>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250905174253.2173195-1-sashal@kernel.org>
+
+From: Pieter Van Trappen <pieter.van.trappen@cern.ch>
+
+[ Upstream commit 3f464b193d40e49299dcd087b10cc3b77cbbea68 ]
+
+Remove magic number 7 by introducing a GENMASK macro instead.
+Remove magic number 0x80 by using the BIT macro instead.
+
+Signed-off-by: Pieter Van Trappen <pieter.van.trappen@cern.ch>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Link: https://patch.msgid.link/20240909134301.75448-1-vtpieter@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: ba54bce747fa ("net: dsa: microchip: linearize skb for tail-tagging switches")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/dsa/tag_ksz.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/dsa/tag_ksz.c
++++ b/net/dsa/tag_ksz.c
+@@ -176,8 +176,9 @@ MODULE_ALIAS_DSA_TAG_DRIVER(DSA_TAG_PROT
+
+ #define KSZ9477_INGRESS_TAG_LEN 2
+ #define KSZ9477_PTP_TAG_LEN 4
+-#define KSZ9477_PTP_TAG_INDICATION 0x80
++#define KSZ9477_PTP_TAG_INDICATION BIT(7)
+
++#define KSZ9477_TAIL_TAG_EG_PORT_M GENMASK(2, 0)
+ #define KSZ9477_TAIL_TAG_PRIO GENMASK(8, 7)
+ #define KSZ9477_TAIL_TAG_OVERRIDE BIT(9)
+ #define KSZ9477_TAIL_TAG_LOOKUP BIT(10)
+@@ -302,7 +303,7 @@ static struct sk_buff *ksz9477_rcv(struc
+ {
+ /* Tag decoding */
+ u8 *tag = skb_tail_pointer(skb) - KSZ_EGRESS_TAG_LEN;
+- unsigned int port = tag[0] & 7;
++ unsigned int port = tag[0] & KSZ9477_TAIL_TAG_EG_PORT_M;
+ unsigned int len = KSZ_EGRESS_TAG_LEN;
+
+ /* Extra 4-bytes PTP timestamp */
--- /dev/null
+From stable+bounces-178022-greg=kroah.com@vger.kernel.org Sun Sep 7 05:40:11 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 23:39:56 -0400
+Subject: nouveau: fix disabling the nonstall irq due to storm code
+To: stable@vger.kernel.org
+Cc: Dave Airlie <airlied@redhat.com>, Danilo Krummrich <dakr@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250907033956.451552-1-sashal@kernel.org>
+
+From: Dave Airlie <airlied@redhat.com>
+
+[ Upstream commit 0ef5c4e4dbbfcebaa9b2eca18097b43016727dfe ]
+
+Nouveau has code that when it gets an IRQ with no allowed handler
+it disables it to avoid storms.
+
+However with nonstall interrupts, we often disable them from
+the drm driver, but still request their emission via the push submission.
+
+Just don't disable nonstall irqs ever in normal operation, the
+event handling code will filter them out, and the driver will
+just enable/disable them at load time.
+
+This fixes timeouts we've been seeing on/off for a long time,
+but they became a lot more noticeable on Blackwell.
+
+This doesn't fix all of them, there is a subsequent fence emission
+fix to fix the last few.
+
+Fixes: 3ebd64aa3c4f ("drm/nouveau/intr: support multiple trees, and explicit interfaces")
+Cc: stable@vger.kernel.org
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Link: https://lore.kernel.org/r/20250829021633.1674524-1-airlied@gmail.com
+[ Fix a typo and a minor checkpatch.pl warning; remove "v2" from commit
+ subject. - Danilo ]
+Signed-off-by: Danilo Krummrich <dakr@kernel.org>
+[ File renames + drop r535 changes ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/engine/fifo/base.c | 2 ++
+ drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c | 23 +++++++++++++++--------
+ drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga102.c | 1 +
+ drivers/gpu/drm/nouveau/nvkm/engine/fifo/priv.h | 2 ++
+ 4 files changed, 20 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/base.c
+@@ -348,6 +348,8 @@ nvkm_fifo_dtor(struct nvkm_engine *engin
+ nvkm_chid_unref(&fifo->chid);
+
+ nvkm_event_fini(&fifo->nonstall.event);
++ if (fifo->func->nonstall_dtor)
++ fifo->func->nonstall_dtor(fifo);
+ mutex_destroy(&fifo->mutex);
+ return fifo;
+ }
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga100.c
+@@ -516,19 +516,11 @@ ga100_fifo_nonstall_intr(struct nvkm_int
+ static void
+ ga100_fifo_nonstall_block(struct nvkm_event *event, int type, int index)
+ {
+- struct nvkm_fifo *fifo = container_of(event, typeof(*fifo), nonstall.event);
+- struct nvkm_runl *runl = nvkm_runl_get(fifo, index, 0);
+-
+- nvkm_inth_block(&runl->nonstall.inth);
+ }
+
+ static void
+ ga100_fifo_nonstall_allow(struct nvkm_event *event, int type, int index)
+ {
+- struct nvkm_fifo *fifo = container_of(event, typeof(*fifo), nonstall.event);
+- struct nvkm_runl *runl = nvkm_runl_get(fifo, index, 0);
+-
+- nvkm_inth_allow(&runl->nonstall.inth);
+ }
+
+ const struct nvkm_event_func
+@@ -559,12 +551,26 @@ ga100_fifo_nonstall_ctor(struct nvkm_fif
+ if (ret)
+ return ret;
+
++ nvkm_inth_allow(&runl->nonstall.inth);
++
+ nr = max(nr, runl->id + 1);
+ }
+
+ return nr;
+ }
+
++void
++ga100_fifo_nonstall_dtor(struct nvkm_fifo *fifo)
++{
++ struct nvkm_runl *runl;
++
++ nvkm_runl_foreach(runl, fifo) {
++ if (runl->nonstall.vector < 0)
++ continue;
++ nvkm_inth_block(&runl->nonstall.inth);
++ }
++}
++
+ int
+ ga100_fifo_runl_ctor(struct nvkm_fifo *fifo)
+ {
+@@ -594,6 +600,7 @@ ga100_fifo = {
+ .runl_ctor = ga100_fifo_runl_ctor,
+ .mmu_fault = &tu102_fifo_mmu_fault,
+ .nonstall_ctor = ga100_fifo_nonstall_ctor,
++ .nonstall_dtor = ga100_fifo_nonstall_dtor,
+ .nonstall = &ga100_fifo_nonstall,
+ .runl = &ga100_runl,
+ .runq = &ga100_runq,
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga102.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga102.c
+@@ -28,6 +28,7 @@ ga102_fifo = {
+ .runl_ctor = ga100_fifo_runl_ctor,
+ .mmu_fault = &tu102_fifo_mmu_fault,
+ .nonstall_ctor = ga100_fifo_nonstall_ctor,
++ .nonstall_dtor = ga100_fifo_nonstall_dtor,
+ .nonstall = &ga100_fifo_nonstall,
+ .runl = &ga100_runl,
+ .runq = &ga100_runq,
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/priv.h
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/priv.h
+@@ -38,6 +38,7 @@ struct nvkm_fifo_func {
+ void (*start)(struct nvkm_fifo *, unsigned long *);
+
+ int (*nonstall_ctor)(struct nvkm_fifo *);
++ void (*nonstall_dtor)(struct nvkm_fifo *);
+ const struct nvkm_event_func *nonstall;
+
+ const struct nvkm_runl_func *runl;
+@@ -194,6 +195,7 @@ extern const struct nvkm_fifo_func_mmu_f
+
+ int ga100_fifo_runl_ctor(struct nvkm_fifo *);
+ int ga100_fifo_nonstall_ctor(struct nvkm_fifo *);
++void ga100_fifo_nonstall_dtor(struct nvkm_fifo *);
+ extern const struct nvkm_event_func ga100_fifo_nonstall;
+ extern const struct nvkm_runl_func ga100_runl;
+ extern const struct nvkm_runq_func ga100_runq;
--- /dev/null
+From stable+bounces-177998-greg=kroah.com@vger.kernel.org Sat Sep 6 21:50:24 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 15:50:14 -0400
+Subject: PCI/MSI: Add an option to write MSIX ENTRY_DATA before any reads
+To: stable@vger.kernel.org
+Cc: Jonathan Currier <dullfire@yahoo.com>, Thomas Gleixner <tglx@linutronix.de>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250906195014.209521-1-sashal@kernel.org>
+
+From: Jonathan Currier <dullfire@yahoo.com>
+
+[ Upstream commit cf761e3dacc6ad5f65a4886d00da1f9681e6805a ]
+
+Commit 7d5ec3d36123 ("PCI/MSI: Mask all unused MSI-X entries") introduced a
+readl() from ENTRY_VECTOR_CTRL before the writel() to ENTRY_DATA.
+
+This is correct, however some hardware, like the Sun Neptune chips, the NIU
+module, will cause an error and/or fatal trap if any MSIX table entry is
+read before the corresponding ENTRY_DATA field is written to.
+
+Add an optional early writel() in msix_prepare_msi_desc().
+
+Fixes: 7d5ec3d36123 ("PCI/MSI: Mask all unused MSI-X entries")
+Signed-off-by: Jonathan Currier <dullfire@yahoo.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/all/20241117234843.19236-2-dullfire@yahoo.com
+[ Adjust context ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/msi/msi.c | 3 +++
+ include/linux/pci.h | 2 ++
+ 2 files changed, 5 insertions(+)
+
+--- a/drivers/pci/msi/msi.c
++++ b/drivers/pci/msi/msi.c
+@@ -610,6 +610,9 @@ void msix_prepare_msi_desc(struct pci_de
+ if (desc->pci.msi_attrib.can_mask) {
+ void __iomem *addr = pci_msix_desc_addr(desc);
+
++ /* Workaround for SUN NIU insanity, which requires write before read */
++ if (dev->dev_flags & PCI_DEV_FLAGS_MSIX_TOUCH_ENTRY_DATA_FIRST)
++ writel(0, addr + PCI_MSIX_ENTRY_DATA);
+ desc->pci.msix_ctrl = readl(addr + PCI_MSIX_ENTRY_VECTOR_CTRL);
+ }
+ }
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -245,6 +245,8 @@ enum pci_dev_flags {
+ PCI_DEV_FLAGS_NO_RELAXED_ORDERING = (__force pci_dev_flags_t) (1 << 11),
+ /* Device does honor MSI masking despite saying otherwise */
+ PCI_DEV_FLAGS_HAS_MSI_MASKING = (__force pci_dev_flags_t) (1 << 12),
++ /* Device requires write to PCI_MSIX_ENTRY_DATA before any MSIX reads */
++ PCI_DEV_FLAGS_MSIX_TOUCH_ENTRY_DATA_FIRST = (__force pci_dev_flags_t) (1 << 13),
+ };
+
+ enum pci_irq_reroute_variant {
net-pcs-rzn1-miic-correct-modctrl-register-offset.patch
revert-spi-cadence-quadspi-fix-cleanup-of-rx_chan-on-failure-paths.patch
revert-spi-spi-cadence-quadspi-fix-pm-runtime-unbalance.patch
+cpufreq-intel_pstate-revise-global-turbo-disable-check.patch
+cpufreq-intel_pstate-fold-intel_pstate_max_within_limits-into-caller.patch
+cpufreq-intel_pstate-do-not-update-global.turbo_disabled-after-initialization.patch
+cpufreq-intel_pstate-unchecked-msr-aceess-in-legacy-mode.patch
+nouveau-fix-disabling-the-nonstall-irq-due-to-storm-code.patch
+mm-slub-avoid-accessing-metadata-when-pointer-is-invalid-in-object_err.patch
+spi-fsl-qspi-use-devm-function-instead-of-driver-remove.patch
+thermal-drivers-mediatek-lvts-disable-low-offset-irq-for-minimum-threshold.patch
+pci-msi-add-an-option-to-write-msix-entry_data-before-any-reads.patch
+memcg-drain-obj-stock-on-cpu-hotplug-teardown.patch
+btrfs-adjust-subpage-bit-start-based-on-sectorsize.patch
+iio-imu-inv_mpu6050-align-buffer-for-timestamp.patch
+iio-chemical-pms7003-use-aligned_s64-for-timestamp.patch
+iio-light-opt3001-fix-deadlock-due-to-concurrent-flag-access.patch
+iio-pressure-mprls0025pa-use-aligned_s64-for-timestamp.patch
+alsa-hda-realtek-add-support-for-hp-agusta-using-cs35l41-hda.patch
+alsa-hda-realtek-add-new-hp-zbook-laptop-with-micmute-led-fixup.patch
+dmaengine-mediatek-fix-a-possible-deadlock-error-in-mtk_cqdma_tx_status.patch
+net-dsa-microchip-update-tag_ksz-masks-for-ksz9477-family.patch
+net-dsa-microchip-linearize-skb-for-tail-tagging-switches.patch
+vmxnet3-update-mtu-after-device-quiesce.patch
--- /dev/null
+From stable+bounces-178005-greg=kroah.com@vger.kernel.org Sat Sep 6 22:53:28 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 16:53:20 -0400
+Subject: spi: fsl-qspi: use devm function instead of driver remove
+To: stable@vger.kernel.org
+Cc: Han Xu <han.xu@nxp.com>, Kevin Hao <haokexin@gmail.com>, Frank Li <Frank.Li@nxp.com>, Mark Brown <broonie@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250906205320.288349-1-sashal@kernel.org>
+
+From: Han Xu <han.xu@nxp.com>
+
+[ Upstream commit 40369bfe717e96e26650eeecfa5a6363563df6e4 ]
+
+Driver use devm APIs to manage clk/irq/resources and register the spi
+controller, but the legacy remove function will be called first during
+device detach and trigger kernel panic. Drop the remove function and use
+devm_add_action_or_reset() for driver cleanup to ensure the release
+sequence.
+
+Trigger kernel panic on i.MX8MQ by
+echo 30bb0000.spi >/sys/bus/platform/drivers/fsl-quadspi/unbind
+
+Cc: stable@vger.kernel.org
+Fixes: 8fcb830a00f0 ("spi: spi-fsl-qspi: use devm_spi_register_controller")
+Reported-by: Kevin Hao <haokexin@gmail.com>
+Signed-off-by: Han Xu <han.xu@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20250326224152.2147099-1-han.xu@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+[ Adjust context ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-fsl-qspi.c | 31 +++++++++++++++++--------------
+ 1 file changed, 17 insertions(+), 14 deletions(-)
+
+--- a/drivers/spi/spi-fsl-qspi.c
++++ b/drivers/spi/spi-fsl-qspi.c
+@@ -839,6 +839,19 @@ static const struct spi_controller_mem_o
+ .get_name = fsl_qspi_get_name,
+ };
+
++static void fsl_qspi_cleanup(void *data)
++{
++ struct fsl_qspi *q = data;
++
++ /* disable the hardware */
++ qspi_writel(q, QUADSPI_MCR_MDIS_MASK, q->iobase + QUADSPI_MCR);
++ qspi_writel(q, 0x0, q->iobase + QUADSPI_RSER);
++
++ fsl_qspi_clk_disable_unprep(q);
++
++ mutex_destroy(&q->lock);
++}
++
+ static int fsl_qspi_probe(struct platform_device *pdev)
+ {
+ struct spi_controller *ctlr;
+@@ -928,6 +941,10 @@ static int fsl_qspi_probe(struct platfor
+
+ ctlr->dev.of_node = np;
+
++ ret = devm_add_action_or_reset(dev, fsl_qspi_cleanup, q);
++ if (ret)
++ goto err_destroy_mutex;
++
+ ret = devm_spi_register_controller(dev, ctlr);
+ if (ret)
+ goto err_destroy_mutex;
+@@ -947,19 +964,6 @@ err_put_ctrl:
+ return ret;
+ }
+
+-static void fsl_qspi_remove(struct platform_device *pdev)
+-{
+- struct fsl_qspi *q = platform_get_drvdata(pdev);
+-
+- /* disable the hardware */
+- qspi_writel(q, QUADSPI_MCR_MDIS_MASK, q->iobase + QUADSPI_MCR);
+- qspi_writel(q, 0x0, q->iobase + QUADSPI_RSER);
+-
+- fsl_qspi_clk_disable_unprep(q);
+-
+- mutex_destroy(&q->lock);
+-}
+-
+ static int fsl_qspi_suspend(struct device *dev)
+ {
+ return 0;
+@@ -997,7 +1001,6 @@ static struct platform_driver fsl_qspi_d
+ .pm = &fsl_qspi_pm_ops,
+ },
+ .probe = fsl_qspi_probe,
+- .remove_new = fsl_qspi_remove,
+ };
+ module_platform_driver(fsl_qspi_driver);
+
--- /dev/null
+From stable+bounces-178000-greg=kroah.com@vger.kernel.org Sat Sep 6 22:20:36 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 16:19:21 -0400
+Subject: thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold
+To: stable@vger.kernel.org
+Cc: "Nícolas F. R. A. Prado" <nfraprado@collabora.com>, "AngeloGioacchino Del Regno" <angelogioacchino.delregno@collabora.com>, "Daniel Lezcano" <daniel.lezcano@linaro.org>, "Sasha Levin" <sashal@kernel.org>
+Message-ID: <20250906201921.261506-1-sashal@kernel.org>
+
+From: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+
+[ Upstream commit fa17ff8e325a657c84be1083f06e54ee7eea82e4 ]
+
+In order to get working interrupts, a low offset value needs to be
+configured. The minimum value for it is 20 Celsius, which is what is
+configured when there's no lower thermal trip (ie the thermal core
+passes -INT_MAX as low trip temperature). However, when the temperature
+gets that low and fluctuates around that value it causes an interrupt
+storm.
+
+Prevent that interrupt storm by not enabling the low offset interrupt if
+the low threshold is the minimum one.
+
+Cc: stable@vger.kernel.org
+Fixes: 77354eaef821 ("thermal/drivers/mediatek/lvts_thermal: Don't leave threshold zeroed")
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Link: https://lore.kernel.org/r/20250113-mt8192-lvts-filtered-suspend-fix-v2-3-07a25200c7c6@collabora.com
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+[ Adapted interrupt mask definitions ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/thermal/mediatek/lvts_thermal.c | 50 +++++++++++++++++++++++---------
+ 1 file changed, 36 insertions(+), 14 deletions(-)
+
+--- a/drivers/thermal/mediatek/lvts_thermal.c
++++ b/drivers/thermal/mediatek/lvts_thermal.c
+@@ -67,10 +67,14 @@
+ #define LVTS_CALSCALE_CONF 0x300
+ #define LVTS_MONINT_CONF 0x8300318C
+
+-#define LVTS_MONINT_OFFSET_SENSOR0 0xC
+-#define LVTS_MONINT_OFFSET_SENSOR1 0x180
+-#define LVTS_MONINT_OFFSET_SENSOR2 0x3000
+-#define LVTS_MONINT_OFFSET_SENSOR3 0x3000000
++#define LVTS_MONINT_OFFSET_HIGH_INTEN_SENSOR0 BIT(3)
++#define LVTS_MONINT_OFFSET_HIGH_INTEN_SENSOR1 BIT(8)
++#define LVTS_MONINT_OFFSET_HIGH_INTEN_SENSOR2 BIT(13)
++#define LVTS_MONINT_OFFSET_HIGH_INTEN_SENSOR3 BIT(25)
++#define LVTS_MONINT_OFFSET_LOW_INTEN_SENSOR0 BIT(2)
++#define LVTS_MONINT_OFFSET_LOW_INTEN_SENSOR1 BIT(7)
++#define LVTS_MONINT_OFFSET_LOW_INTEN_SENSOR2 BIT(12)
++#define LVTS_MONINT_OFFSET_LOW_INTEN_SENSOR3 BIT(24)
+
+ #define LVTS_INT_SENSOR0 0x0009001F
+ #define LVTS_INT_SENSOR1 0x001203E0
+@@ -308,23 +312,41 @@ static int lvts_get_temp(struct thermal_
+
+ static void lvts_update_irq_mask(struct lvts_ctrl *lvts_ctrl)
+ {
+- u32 masks[] = {
+- LVTS_MONINT_OFFSET_SENSOR0,
+- LVTS_MONINT_OFFSET_SENSOR1,
+- LVTS_MONINT_OFFSET_SENSOR2,
+- LVTS_MONINT_OFFSET_SENSOR3,
++ static const u32 high_offset_inten_masks[] = {
++ LVTS_MONINT_OFFSET_HIGH_INTEN_SENSOR0,
++ LVTS_MONINT_OFFSET_HIGH_INTEN_SENSOR1,
++ LVTS_MONINT_OFFSET_HIGH_INTEN_SENSOR2,
++ LVTS_MONINT_OFFSET_HIGH_INTEN_SENSOR3,
++ };
++ static const u32 low_offset_inten_masks[] = {
++ LVTS_MONINT_OFFSET_LOW_INTEN_SENSOR0,
++ LVTS_MONINT_OFFSET_LOW_INTEN_SENSOR1,
++ LVTS_MONINT_OFFSET_LOW_INTEN_SENSOR2,
++ LVTS_MONINT_OFFSET_LOW_INTEN_SENSOR3,
+ };
+ u32 value = 0;
+ int i;
+
+ value = readl(LVTS_MONINT(lvts_ctrl->base));
+
+- for (i = 0; i < ARRAY_SIZE(masks); i++) {
++ for (i = 0; i < ARRAY_SIZE(high_offset_inten_masks); i++) {
+ if (lvts_ctrl->sensors[i].high_thresh == lvts_ctrl->high_thresh
+- && lvts_ctrl->sensors[i].low_thresh == lvts_ctrl->low_thresh)
+- value |= masks[i];
+- else
+- value &= ~masks[i];
++ && lvts_ctrl->sensors[i].low_thresh == lvts_ctrl->low_thresh) {
++ /*
++ * The minimum threshold needs to be configured in the
++ * OFFSETL register to get working interrupts, but we
++ * don't actually want to generate interrupts when
++ * crossing it.
++ */
++ if (lvts_ctrl->low_thresh == -INT_MAX) {
++ value &= ~low_offset_inten_masks[i];
++ value |= high_offset_inten_masks[i];
++ } else {
++ value |= low_offset_inten_masks[i] | high_offset_inten_masks[i];
++ }
++ } else {
++ value &= ~(low_offset_inten_masks[i] | high_offset_inten_masks[i]);
++ }
+ }
+
+ writel(value, LVTS_MONINT(lvts_ctrl->base));
--- /dev/null
+From stable+bounces-177860-greg=kroah.com@vger.kernel.org Fri Sep 5 19:31:52 2025
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 13:31:43 -0400
+Subject: vmxnet3: update MTU after device quiesce
+To: stable@vger.kernel.org
+Cc: Ronak Doshi <ronak.doshi@broadcom.com>, Guolin Yang <guolin.yang@broadcom.com>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20250905173143.2078431-1-sashal@kernel.org>
+
+From: Ronak Doshi <ronak.doshi@broadcom.com>
+
+[ Upstream commit 43f0999af011fba646e015f0bb08b6c3002a0170 ]
+
+Currently, when device mtu is updated, vmxnet3 updates netdev mtu, quiesces
+the device and then reactivates it for the ESXi to know about the new mtu.
+So, technically the OS stack can start using the new mtu before ESXi knows
+about the new mtu.
+
+This can lead to issues for TSO packets which use mss as per the new mtu
+configured. This patch fixes this issue by moving the mtu write after
+device quiesce.
+
+Cc: stable@vger.kernel.org
+Fixes: d1a890fa37f2 ("net: VMware virtual Ethernet NIC driver: vmxnet3")
+Signed-off-by: Ronak Doshi <ronak.doshi@broadcom.com>
+Acked-by: Guolin Yang <guolin.yang@broadcom.com>
+Changes v1-> v2:
+ Moved MTU write after destroy of rx rings
+Link: https://patch.msgid.link/20250515190457.8597-1-ronak.doshi@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+[ no WRITE_ONCE() in older trees ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/vmxnet3/vmxnet3_drv.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/vmxnet3/vmxnet3_drv.c
++++ b/drivers/net/vmxnet3/vmxnet3_drv.c
+@@ -3483,8 +3483,6 @@ vmxnet3_change_mtu(struct net_device *ne
+ struct vmxnet3_adapter *adapter = netdev_priv(netdev);
+ int err = 0;
+
+- netdev->mtu = new_mtu;
+-
+ /*
+ * Reset_work may be in the middle of resetting the device, wait for its
+ * completion.
+@@ -3498,6 +3496,7 @@ vmxnet3_change_mtu(struct net_device *ne
+
+ /* we need to re-create the rx queue based on the new mtu */
+ vmxnet3_rq_destroy_all(adapter);
++ netdev->mtu = new_mtu;
+ vmxnet3_adjust_rx_ring_size(adapter);
+ err = vmxnet3_rq_create_all(adapter);
+ if (err) {
+@@ -3514,6 +3513,8 @@ vmxnet3_change_mtu(struct net_device *ne
+ "Closing it\n", err);
+ goto out;
+ }
++ } else {
++ netdev->mtu = new_mtu;
+ }
+
+ out:
projects / thirdparty / kernel / stable-queue.git / commitdiff
